For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

4 Replies

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Feb 10, 2009
    Support for changing profile parameters in iRules is not there yet.
  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Feb 11, 2009
    You could try using the trick we use for HTTP collection mechanics where you force the connection to HTTP/1.0 (RFC2616 prohibits servers from responding to 1.0 requests w/chunked encoding):
    when HTTP_REQUEST { 
    Don't allow data to be chunked 
   if { [HTTP::version] eq "1.1" } { 
       if { [HTTP::header is_keepalive] } { 
          HTTP::header replace "Connection" "Keep-Alive" 
       } 
       HTTP::version "1.0" 
    } 
 }

     

     

    Just add a Data Group list of type Address that includes the IP addresses & networks for which chunking is not desired, and modify the above code snip to add a source IP test against the address class:
    when HTTP_REQUEST { 
    if {[matchclass [IP::client_addr] equals $::NoChunkIPs]}{ 
        Don't allow data to be chunked 
       if { [HTTP::version] eq "1.1" } { 
           if { [HTTP::header is_keepalive] } { 
              HTTP::header replace "Connection" "Keep-Alive" 
           } 
           HTTP::version "1.0" 
       } 
    } 
 }

     

     

    hth

     

    /d
  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Feb 11, 2009
    hate to do the matchclass for each request is all...

    this s/b more efficient & does the same thing: 

       
 when CLIENT_ACCEPTED {   
    set chunk 1   
    if {[matchclass [IP::client_addr] equals $::NoChunkIPs]}{    
       set chunk 0   
    }   
 }   
 when HTTP_REQUEST {    
    if { $chunk == 0 }{    
        Don't allow data to be chunked    
       if { [HTTP::version] eq "1.1" } {    
          if { [HTTP::header is_keepalive] } {    
             HTTP::header replace "Connection" "Keep-Alive"    
           }    
           HTTP::version "1.0"    
       }    
    }    
 }

    /d
    • Jason_Adams's avatar
      Jason_Adams
      Ret. Employee
      Nov 07, 2022

      ^ Expanding the above iRule as it was clobbered during one of our platform migrations

      when CLIENT_ACCEPTED priority 500 {
          set chunk 1
          if {[class match -- [IP::client_addr] equals "/Common/NoChunkIPs"]} {
              set chunk 0
          }
      }
      when HTTP_REQUEST priority 500 {
          if {$chunk == 0} {
              # Don't allow data to be chunked
              if {[HTTP::version] eq "1.1"} {
                  if {[HTTP::header is_keepalive]} {
                      HTTP::header replace "Connection" "Keep-Alive"
                  }
                  HTTP::version "1.0"
              }
          }
      }