Forum Discussion

DamP_320463's avatar
DamP_320463
Icon for Nimbostratus rankNimbostratus
Jun 16, 2017

iRule dump files

Hi DevCentral Community,   I would like to know if it is possible to collect files that pass through F5 VIP (via HTTP POST) using an iRule that dumps the tcp payload.   Thanks.   D.  
iRules
security
IheartF5_45022's avatar
IheartF5_45022
Icon for Nacreous rankNacreous
Jun 16, 2017

Hi Yes you can use HTTP::collect

https://devcentral.f5.com/wiki/iRules.HTTP__collect.ashx

Beware - it's processor intensive.

Here is a variation on the sample in the link above where you could send the payload off to a logging server;-

when HTTP_REQUEST {
  if {[HTTP::method] eq "POST"}{
     Trigger collection for up to 1MB of data
    if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{
      set content_length [HTTP::header "Content-Length"]
    } else {
        set content_length 1048576
    }
     Check if $content_length is not set to 0
    if { $content_length > 0} {
      HTTP::collect $content_length
    }
  }
}
when HTTP_REQUEST_DATA {
   Send payload to logging server
  if ![info exists hsl] {
  set hsl [HSL::open -proto tcp -pool pl_syslog_servers]
  }
  HSL::send $hsl "[HTTP::payload]\n"
}
}
  • DamP_320463's avatar
    DamP_320463
    Icon for Nimbostratus rankNimbostratus
    Jun 16, 2017

    Thank your for your quick answer.

    I tried to test this with a little modification but I am not seeing the file payload as you can see:

    when HTTP_REQUEST_DATA {
  set payload [HTTP::payload]
  set hash [ sha256 [HTTP::payload]]
  log local0. "HASH is $hash and PAYLOAD is $payload"

}

    HASH is:

    Q.ˆ¬õáì¾wñþà –œ(4u�L¹,R=ä ú

    and PAYLOAD is ------WebKitFormBoundaryF4AYhFSjOTYIpqcZ Content-Disposition: form-data; name="MAX_FILE_SIZE" 1000000000 ------WebKitFormBoundaryF4AYhFSjOTYIpqcZ Content-Disposition: form-data; name="from" 1 ------WebKitFormBoundaryF4AYhFSjOTYIpqcZ Content-Disposition: form-data; name="dircor" ------WebKitFormBoundaryF4AYhFSjOTYIpqcZ Content-Disposition: form-data; name="file"; filename="New Text Document.pdf" Content-Type: application/octet-stream ------WebKitFormBoundaryF4AYhFSjOTYIpqcZ--

    I would like to extract the file and check the hash, What I am missing?

    Thanks!