Log the count of the STREAM hits
I'm trying to figure out how it will be possible, how many times a STREAM::expression is being executed. when HTTP_RESPONSE { if { $http_host equals "avv.com" or $http_host equals "acc.com" }{ STREAM::expression "@aa@bb@" STREAM::expression "@rr@ff" STREAM::expression "@gg@qaqa@" STREAM::enable log local0. "RESPONSE: $http_host to IP: [IP::client_addr]" } } So in the log i want to see like: Total STREAM hit 80 (40aa - 20rr - 20gg)
STREAM::expression and "thread safety"
Hi, I don't think "thread safety" is the right term here, but kinda helps explain my question. STREAM::expression can be changed in an iRule, and the documentation says it affects "this connection only": https://devcentral.f5.com/wiki/irules.stream__expression.ashx What happens if I'm changing this in HTTP_RESPONSE and there's multiple requests / responses on the same TCP connection? Will the STREAM::expression set in one HTTP_RESPONSE pollute the value set in another? Do multiple HTTP_REQUESTs and HTTP_RESPONSEs happen at the same time if there's many concurrent requests from the same browser? Likewise, for STREAM::enable. I've already come across the issue where enabling STREAM::enable in one HTTP_RESPONSE causes other HTTP requests to also get processed. I think this is because the stream processing is enabled for a connection. I now use the pattern: when HTTP_REQUEST { STREAM::disable } when HTTP_RESPONSE { if {some condition holds} { STREAM::enable } } This means that the STREAM processing is disabled at the beginning of every request. However, does this lead to a race condition if there are multiple requests executing in parallel? If response enables the stream, is it visible to other responses on the same connection? i.e. REQUEST 1 REQUEST 2 HTTP_REQUEST (disable stream) HTTP_REQUEST (disable stream) HTTP_RESPONSE condition is true: (enable stream) (stream processing occurs) HTTP_RESPONSE condition is false: (leave stream as-is) (stream processing occurs anyway)
iRule to Change HTML "Name" Attribute in VPE
I am attempting to have an iRule that will change the HTML while in the VPE. We have an application that uses SAML and is looking for the "name" attribute to be "user," but our SAML IdP's name attribute is "username." This is important because the application allows credential caching, but it is hard coded to only allow caching for that specific value. I've been reading up on the STREAM expression to do this, but can't seem to figure out how to have the F5 do it since it is redirecting to the IdP. We were able to do this with IIS, but would rather have the F5 handle it. The other thought was to create a custom login screen on the F5 that would have the name attribute set correctly, but I can't figure out how to post to our ADFS SAML IdP. Update: I've been looking into the STREAM expressions, but apparently those have a bug when being used by APM as described in https://support.f5.com/csp/article/K12558. It doesn't appear that we have LTM installed on the same machine as APM because we don't have the option for "Host" in the destination box. When I log into the local (non-DMZ) LTM, it does have that option available. I've also tried using HTML_TAG_MATCHED, but it appears to only trigger the iRule AFTER the submit button is clicked on the form. From the documentation, it doesn't sound like that should be the way it happens - the example shows replacing jpg images with png, so it would need to happen on page load unless I am misunderstanding it. https://devcentral.f5.com/wiki/iRules.HTML-tag-attribute.ashx https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/9.html Thanks!