Forum Discussion

hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Feb 26, 2009

Using HTTP::payload with/without HTTP::collect/HTTP_REQUEST_DATA?

Citizen_elah suggested you could use 'HTTP::payload length' in HTTP_RESPONSE in this recent post (Click here). I didn't realize you could use HTTP::payload length outside of HTTP_REQUEST_DATA or HTTP_RESPONSE_DATA.

After some quick testing on 9.4.6, I'm a bit confused on whether/why you can use HTTP::payload in HTTP_REQUEST or HTTP_RESPONSE. I always thought these two events were triggered when only the HTTP headers had been parsed. But it seems like the payload is also available:

  
 when HTTP_REQUEST { 
  
  Log the original payload 
 log local0. "\[HTTP::payload\]: [HTTP::payload], \[HTTP::payload length\]:\ 
 [HTTP::payload length], \[HTTP::header Content-Length\]: [HTTP::header Content-Length]" 
  
  Replace the full payload with some text 
 HTTP::payload replace 0 [HTTP::payload length] "new data here!" 
  
  Log the updated payload 
 log local0. "500 \[HTTP::payload\]: [HTTP::payload], \[HTTP::payload length\]:\ 
 [HTTP::payload length], \[HTTP::header Content-Length\]: [HTTP::header Content-Length]" 
  
 } 
 when HTTP_REQUEST priority 501 { 
  
  Log the updated payload 
 log local0. "501 \[HTTP::payload\]: [HTTP::payload], \[HTTP::payload length\]:\ 
 [HTTP::payload length], \[HTTP::header Content-Length\]: [HTTP::header Content-Length]" 
 } 
 

For a test request this is the log output:

: [HTTP::payload]: param=value, [HTTP::payload length]: 11, [HTTP::header Content-Length]: 11

: 500 [HTTP::payload]: new data here!, [HTTP::payload length]: 14, [HTTP::header Content-Length]: 11

: 501 [HTTP::payload]: new data here!, [HTTP::payload length]: 14, [HTTP::header Content-Length]: 14

So it looks like the Content-Length header is even updated correctly (as shown in the non-cached value from HTTP_REQUEST priority 501.

Is this new? Is the full payload always available or are there size constraints or other issues with accessing/modifying the payload in HTTP_REQUEST and/or HTTP_RESPONSE?

Thanks for any info,

Aaron

4 Replies

  • spark_86682's avatar
    spark_86682
    Historic F5 Account

    I always thought these two events were triggered when only the HTTP headers had been parsed.

     

     

     

    They are; your understanding is correct. The key to this is that it's quite common for an HTTP server to send the start of the data in the same packet as the end of the headers, so it's not surprising that there's some amount of payload at the moment when all of the headers are received by the LTM.

     

     

    I don't know when this happened, but I'd be surprised if it's very new. It looks like it works in v9.3.0+ at the very least, possibly earlier versions as well.

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Thanks for the info, Spark. Do you think there are scenarios where it's practical to modify the HTTP payload without collecting it?

     

     

    I guess you could get a way with not collecting the payload if you knew the data you wanted to modify was always in the first packet. But it seems like to be safe you'd still need to always collect the full payload. I'll need to do some testing and see what happens if you modify the current HTTP::payload in HTTP_REQUEST or HTTP_RESPONSE and then the peer sends more than packets.

     

     

    Aaron
  • Just a little rusty on my part, Hoolio, sorry about misleading you.
  • It's always grand when ignorance leads to something useful.