cancel
Showing results for 
Search instead for 
Did you mean: 

Modify HTTP response from ICAP server on BigIP

tatmotiv
Altostratus
Altostratus

Hi all,

 

I'm facing the following problem with an ICAP setup: What we want is AV scanning of file uploads to a web page using ICAP on the BigIP. This is done by using a request adapt profile in conjunction with an internal virtual with ICAP profile. We want all POST requests to a specific upload path to be sent to an ICAP server that performs AV scanning. When finding an infected upload, the ICAP server will respond with an ICAP result "respond" (instead of "modify") and return an http 403 error page (we cannot change that behaviour). The upload (POST request) will not reach the webserver in that case. Up to that point, we could get all of this working properly.

 

Unfortunately, the client application (third party product) will throw an unexpected and undefined error upon receiving an http 403 status code. In order to display a meaningful error message to the end user, the application expects an http status code 901 instead. As already mentioned, we can neither change the http 403 error returned by the ICAP server (third party product), nor the need/expectation for an http 901 status by the web application (also third party product). Hence, we plan to rewrite the http 403 reply (of the ICAP server) into an http 901 status on the bigip, resulting in the following setup: click here

 

I tried to address this issue with the following iRule:

 

when HTTP_REQUEST { if { [HTTP::uri] starts_with "/some/path/to/file/uploads" } { log local0. "Upload detected - activating ICAP" ADAPT::enable request true set icap_enabled 1 set icap_respond 0 } else { ADAPT::enable request false set icap_enabled 0 set icap_respond 0 } } when ADAPT_REQUEST_RESULT { set result [ADAPT::result] log local0. "ICAP RESULT received. Result: $result" if { $result == "respond" } { set icap_respond 1 log local0. "ICAP MATCH respond" } } when HTTP_RESPONSE { if { $icap_enabled == 1 } { if { $icap_respond == 1 } { HTTP::respond 901 log local0. "Upload ICAP response detected - sending http 901 to client." } } }

Unfortunately, this does not work, since the HTTP_RESPONSE event will not be triggered by the ICAP response, because it is not coming from a server as the wiki page states:

 

HTTP_RESPONSE is specific to a server response passing through the load balancer, and is not triggered for locally-generated responses

 

HTTP_RESPONSE_RELEASE is also not a suitable event, because it does not allow HTTP::respond actions.

 

Trying to do the HTTP::respond action within the ADAPT_REQUEST_RESULT event block will result in TCL errors during execution and break down the whole virtual.

 

Does anybody have ideas on how to address this issue properly? I'm running out of ideas.

 

Many thanks in advance!

 

Martin

 

1 REPLY 1

tatmotiv
Altostratus
Altostratus

Since nobody else seems willingly to answer me, I'll provide the answer myself 😉

 

Short version: it currently works flawlessly when using HTTP_RESPONSE_RELEASE as event in the last part of the iRule.

 

Long version: I have doubts whether this can be deployed in production or not, because according to the official iRule API documentation, HTTP::respond is disallowed under an HTTP_RESPONSE_RELEASE event. That's also the reason why I haven't even tried this at first, although it came to my mind before. The big question now is: is there any guarantee that this will continue to work, let's say for example after an upgrade from (currently) 12.1.3 to 13.x or maybe someday 14.x? I'm trying to get an official statement from f5 concerning this.