Unescaped " escape with backslash issue

Hello, I have HTTP monitor with my own HTML string inside. tmsh config below:

ltm monitor http /Common/MONITOR_SOAP_disc {
    defaults-from /Common/http
    destination *:*
    interval 5
    ip-dscp 0
    recv Heartbeat
    send "POST /axis2/services/PolicyNotifyService HTTP/1.0\r\nContent-Type:text/xml\r\nContent-Length:366\r\n\r\n220000000000000"
    time-until-up 0
    timeout 16
}

When F5 box is rebooted it writes in ltm.log file:

May 7 13:35:31 rzt-f5-aaa1-ref err mcpd[6321]: 01070642:3: Monitor /Common/MONITOR_SOAP_disc parameter contains d " escape with backslash.

May 7 13:35:32 rzt-f5-aaa1-ref emerg load_config_files: "/usr/bin/tmsh -n -g load sys config partitions all" - failed. -- 01070642:3: Monitor /Common/MONITOR_SOAP_disc parameter contains d " escape with backslash. Unexpected Error: Loading configuration process failed.

May 7 13:35:32 rzt-f5-aaa1-ref err tmsh[8563]: 01420006:3: Loading configuration process failed.

May 7 13:35:33 rzt-f5-aaa1-ref err mcpd[6321]: 01070425:3: Full configuration load failed.

I know that I can change outer " with single ' (this will look like: send 'POST ... \" ...') but after save it is changed back to double.

Is this a bug? How can I preserve the single ' in the config?

I'm running 11.5.0 patch 3.0.236

Thanks!

uni_87886
Cirrostratus
May 08, 2014
I don't see what it is complaining about. Is this a redacted version, as I notice your content-length is wrong?

What happens if you save the config to an scf and then verify it?

save sys config file /var/tmp/test.scf load sys config verify file /var/tmp/test.scf
- Grzegorz_Skrzyp
  Nimbostratus
  May 08, 2014
  Hello, the content-lengt is right in the config (not all was pasted into question). Below please find the verification output: ~~~ root@(rzt-f5-aaa1-ref)(cfg-sync Standalone)(Active)(/Common)(tmos) load sys config verify file /var/local/scf/test.scf Validating system configuration... /defaults/asm_base.conf /defaults/config_base.conf /defaults/low_profile_base.conf /defaults/policy_base.conf /defaults/wam_base.conf /defaults/analytics_base.conf /defaults/apm_saml_base.conf /defaults/app_template_base.conf /defaults/classification_base.conf /defaults/daemon.conf /defaults/fullarmor_gpo_base.conf /defaults/profile_base.conf /defaults/sandbox_base.conf /defaults/security_base.conf /defaults/urldb_base.conf /usr/share/monitors/base_monitors.conf /usr/local/gtm/include/gtm_base_region_isp.conf /usr/share/monitors/gtm_base_monitors.conf Validating configuration... /var/local/scf/test.scf There were warnings: /Common/RADIUS_CallingStationID_OddEven:42: warning: [use curly braces to avoid double substitution][$callingId] 01070642:3: Monitor /Common/MONITOR_SOAP_disc parameter contains d " escape with backslash. Unexpected Error: Validating configuration process failed. ~~~ below is full sned string direclty from config file: ~~~ send "POST /axis2/services/PolicyNotifyService HTTP/1.0\r\nContent-Type:text/xml\r\nConten t-Length:366\r\n\r\n220000000000000" ~~~
- uni_87886
  Cirrostratus
  May 08, 2014
  I tried it in 11.4.1 and it was fine. Time to log a case I think
- Grzegorz_Skrzyp
  Nimbostratus
  May 13, 2014
  Sorry for late answer ... but YES, you are absolutely right, this was working just before the SSL patch :( I did patch - upgrade - and after this - my box went into "config not loaded" state ... Just to inform all - a quick work around was applied - I changed all escaped double's with not-escaped single's - this is working fine, as long as my server will accept this as a HTML request ... I also noticed - that after the patch - the WEB GUI now "translates" all notation into real: New Line and Carridge Return ... is this also correct? in the config now I see "windows like" notation with ^M maker at the and of each line in string ...
uni
Altostratus
May 08, 2014
I don't see what it is complaining about. Is this a redacted version, as I notice your content-length is wrong?

What happens if you save the config to an scf and then verify it?

save sys config file /var/tmp/test.scf load sys config verify file /var/tmp/test.scf
- Grzegorz_Skrzyp
  Nimbostratus
  May 08, 2014
  Hello, the content-lengt is right in the config (not all was pasted into question). Below please find the verification output: ~~~ root@(rzt-f5-aaa1-ref)(cfg-sync Standalone)(Active)(/Common)(tmos) load sys config verify file /var/local/scf/test.scf Validating system configuration... /defaults/asm_base.conf /defaults/config_base.conf /defaults/low_profile_base.conf /defaults/policy_base.conf /defaults/wam_base.conf /defaults/analytics_base.conf /defaults/apm_saml_base.conf /defaults/app_template_base.conf /defaults/classification_base.conf /defaults/daemon.conf /defaults/fullarmor_gpo_base.conf /defaults/profile_base.conf /defaults/sandbox_base.conf /defaults/security_base.conf /defaults/urldb_base.conf /usr/share/monitors/base_monitors.conf /usr/local/gtm/include/gtm_base_region_isp.conf /usr/share/monitors/gtm_base_monitors.conf Validating configuration... /var/local/scf/test.scf There were warnings: /Common/RADIUS_CallingStationID_OddEven:42: warning: [use curly braces to avoid double substitution][$callingId] 01070642:3: Monitor /Common/MONITOR_SOAP_disc parameter contains d " escape with backslash. Unexpected Error: Validating configuration process failed. ~~~ below is full sned string direclty from config file: ~~~ send "POST /axis2/services/PolicyNotifyService HTTP/1.0\r\nContent-Type:text/xml\r\nConten t-Length:366\r\n\r\n220000000000000" ~~~
- uni
  Altostratus
  May 08, 2014
  I tried it in 11.4.1 and it was fine. Time to log a case I think
- Grzegorz_Skrzyp
  Nimbostratus
  May 13, 2014
  Sorry for late answer ... but YES, you are absolutely right, this was working just before the SSL patch :( I did patch - upgrade - and after this - my box went into "config not loaded" state ... Just to inform all - a quick work around was applied - I changed all escaped double's with not-escaped single's - this is working fine, as long as my server will accept this as a HTML request ... I also noticed - that after the patch - the WEB GUI now "translates" all notation into real: New Line and Carridge Return ... is this also correct? in the config now I see "windows like" notation with ^M maker at the and of each line in string ...
nitass_89166
Noctilucent
May 18, 2014
just for information. it is ID453256.

ID453256 Backslash escape double quote in monitor recv strings removed upon load
- Grzegorz_Skrzyp
  Nimbostratus
  May 18, 2014
  OK, it's looking like it is a bug.I hope it will be fixed in next release ...
- Noble_148853
  Nimbostratus
  Aug 26, 2014
  Any solution on this issue? I am experiencing the same problem on 11.5.0 Hotfix4.
nitass
Employee
May 18, 2014
just for information. it is ID453256.

ID453256 Backslash escape double quote in monitor recv strings removed upon load
- Grzegorz_Skrzyp
  Nimbostratus
  May 18, 2014
  OK, it's looking like it is a bug.I hope it will be fixed in next release ...
- Noble_148853
  Nimbostratus
  Aug 26, 2014
  Any solution on this issue? I am experiencing the same problem on 11.5.0 Hotfix4.
nitass_89166
Noctilucent
Aug 26, 2014
Any solution on this issue? I am experiencing the same problem on 11.5.0 Hotfix4.

you may open a support case to see if they can provide engineering hotfix.
- Hadrien
  Nimbostratus
  Sep 21, 2016
  Had the same issue with a double quote in a recv string of a http monitor on a big-ip running 11.5.4 even though f5 support and SOL15977 says it shouldn't be affected. Trying triple backslash (\\") as recommended in the SOL does not work, a "load sys config" will work but it removes a backslash from the running recv string, and so breaks the monitor...
  
  The only thing that has worked for me is writing the double quote character in hex ascii code (\x22) in the recv string.
  
  Hope this helps someone someday.
nitass
Employee
Aug 26, 2014
Any solution on this issue? I am experiencing the same problem on 11.5.0 Hotfix4.

you may open a support case to see if they can provide engineering hotfix.
- Hadrien
  Nimbostratus
  Sep 21, 2016
  Had the same issue with a double quote in a recv string of a http monitor on a big-ip running 11.5.4 even though f5 support and SOL15977 says it shouldn't be affected. Trying triple backslash (\\") as recommended in the SOL does not work, a "load sys config" will work but it removes a backslash from the running recv string, and so breaks the monitor...
  
  The only thing that has worked for me is writing the double quote character in hex ascii code (\x22) in the recv string.
  
  Hope this helps someone someday.
Noble_148853
Nimbostratus
Aug 29, 2014
My issue was resolved with BIG-IP 11.5.0 Build 4.31.245 Engineering Hotfix HF4. I had to open a ticket to get the hot fix.

ID453256-3: Backslash escape double quote in monitor recv strings removed upon load