Forum Discussion
hoolio
Cirrostratus
Feb 26, 2009Using HTTP::payload with/without HTTP::collect/HTTP_REQUEST_DATA?
Citizen_elah suggested you could use 'HTTP::payload length' in HTTP_RESPONSE in this recent post (Click here). I didn't realize you could use HTTP::payload length outside of HTTP_REQUEST_DATA or HTTP_RESPONSE_DATA.
After some quick testing on 9.4.6, I'm a bit confused on whether/why you can use HTTP::payload in HTTP_REQUEST or HTTP_RESPONSE. I always thought these two events were triggered when only the HTTP headers had been parsed. But it seems like the payload is also available:
when HTTP_REQUEST {
Log the original payload
log local0. "\[HTTP::payload\]: [HTTP::payload], \[HTTP::payload length\]:\
[HTTP::payload length], \[HTTP::header Content-Length\]: [HTTP::header Content-Length]"
Replace the full payload with some text
HTTP::payload replace 0 [HTTP::payload length] "new data here!"
Log the updated payload
log local0. "500 \[HTTP::payload\]: [HTTP::payload], \[HTTP::payload length\]:\
[HTTP::payload length], \[HTTP::header Content-Length\]: [HTTP::header Content-Length]"
}
when HTTP_REQUEST priority 501 {
Log the updated payload
log local0. "501 \[HTTP::payload\]: [HTTP::payload], \[HTTP::payload length\]:\
[HTTP::payload length], \[HTTP::header Content-Length\]: [HTTP::header Content-Length]"
}
For a test request this is the log output:
: [HTTP::payload]: param=value, [HTTP::payload length]: 11, [HTTP::header Content-Length]: 11
: 500 [HTTP::payload]: new data here!, [HTTP::payload length]: 14, [HTTP::header Content-Length]: 11
: 501 [HTTP::payload]: new data here!, [HTTP::payload length]: 14, [HTTP::header Content-Length]: 14
So it looks like the Content-Length header is even updated correctly (as shown in the non-cached value from HTTP_REQUEST priority 501.
Is this new? Is the full payload always available or are there size constraints or other issues with accessing/modifying the payload in HTTP_REQUEST and/or HTTP_RESPONSE?
Thanks for any info,
Aaron
4 Replies
- spark_86682Historic F5 Account
I always thought these two events were triggered when only the HTTP headers had been parsed.
They are; your understanding is correct. The key to this is that it's quite common for an HTTP server to send the start of the data in the same packet as the end of the headers, so it's not surprising that there's some amount of payload at the moment when all of the headers are received by the LTM.
I don't know when this happened, but I'd be surprised if it's very new. It looks like it works in v9.3.0+ at the very least, possibly earlier versions as well. - hoolio
Cirrostratus
Thanks for the info, Spark. Do you think there are scenarios where it's practical to modify the HTTP payload without collecting it?
I guess you could get a way with not collecting the payload if you knew the data you wanted to modify was always in the first packet. But it seems like to be safe you'd still need to always collect the full payload. I'll need to do some testing and see what happens if you modify the current HTTP::payload in HTTP_REQUEST or HTTP_RESPONSE and then the peer sends more than packets.
Aaron - JRahm
Admin
Just a little rusty on my part, Hoolio, sorry about misleading you. - JRahm
Admin
It's always grand when ignorance leads to something useful.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects