ABOUT DEVCENTRAL

DevCentral News Technical Forum Technical Articles Technical CrowdSRC Community Guidelines DevCentral EULA Get a Developer Lab License Become a DevCentral MVP

RESOURCES

Product Documentation White Papers Glossary Customer Stories Webinars Free Online Courses F5 Certification LearnF5 Training

SUPPORT

Manage Subscriptions Professional Services Professional Services Create a Service Request Software Downloads Support Portal

PARTNERS

Find a Reseller Partner Technology Alliances Become an F5 Partner Login to Partner Central

---

©2024 F5, Inc. All rights reserved.

Problem this snippet solves:

This iRule illustrates how to scrub out Credit Card Numbers from HTTP traffic.

Let's say you want to specify a policy to not allow any credit card numbers outside of your network. How would you go about scrubbing out Credit Card Numbers? This isn't as simple as searching for a string pattern. CCNs vary in length depending on the issuer of the card. But one thing is common: they all must pass the Luhn Formula. Info on the Luhn Formula or MOD 10 can be found here.\nAn excellent reference on credit card number makeup (beyond the 5 types checked in this iRule) is available here.

How to use this snippet:

This rule will match Diners (13 digit), Amex (15 digit), Visa (13 and 16 digit) Mastercard (16 Digit) and Discover (16 Digit).

This example will look matching patterns looking like credit cards and return their indexes into the payload. Then the number is run through the Luhn formula (with optimizations by unRuleY). If it is indeed a valid credit card number, it is masked with X's.

Further modifications added support for CCNs with - or a blank between the numbers. i.e. xxxx-xxxx-xxxx-xxxx, xxxx xxxx xxxx xxxx, xxxxxxxxxxxxxxxx, would match.

To mask all but the last N digits with X's do the following. At the bottom of the script, you see this line:

HTTP::payload replace $card_start $card_len [string repeat \"X\" $card_len]

Add a small line before it like this: Here N=4.

set card_len [expr {$card_len - 4}]

I used the number 4 to replace all but the last 4 digits. Change this to the number of digits you want to leave untouched. so you end up with:

set card_len [expr {$card_len - 4}]\nHTTP::payload replace $card_start $card_len [string repeat \"X\" $card_len]\n

Note for an alternate method of implementing this iRule using the stream profile, check the Codeshare example.

Code :

when HTTP_REQUEST {\n\n   # Prevent the server from sending a compressed response\n   # remove the compression offerings from the client\n   HTTP::header remove \"Accept-Encoding\"\n\n   # Don't allow response data to be chunked\n   if { [HTTP::version] eq \"1.1\" } {\n\n      # Force downgrade to HTTP 1.0, but still allow keep-alive connections.\n      # Since HTTP 1.1 is keep-alive by default, and 1.0 isn't,\n      # we need make sure the headers reflect the keep-alive status.\n\n      # Check if this is a keep alive connection\n      if { [HTTP::header is_keepalive] } {\n\n         # Replace the connection header value with \"Keep-Alive\"\n         HTTP::header replace \"Connection\" \"Keep-Alive\"\n      }\n\n      # Set server side request version to 1.0\n      # This forces the server to respond without chunking\n      HTTP::version \"1.0\"\n   }\n}\nwhen HTTP_RESPONSE {\n\n  # Only check responses that are a text content type (text/html, text/xml, text/plain, etc).\n  if { [HTTP::header \"Content-Type\"] starts_with \"text/\" } {\n\n    # Get the content length so we can collect the data (to be processed in the HTTP_RESPONSE_DATA event)\n    # Limit collection to 1Mb (1048576 minus a little to spare) - See SOL6578 for details\n    if { [HTTP::header exists \"Content-Length\"] } {\n      if { [HTTP::header \"Content-Length\"] > 1048000 }{\n        # Content-Length over 1Mb so collect 1Mb\n        set content_length 1048000\n      } else {\n        # Content-Length under 1Mb so collect actual length\n        set content_length [HTTP::header \"Content-Length\"]\n      }\n    } else {\n      # Response did not have Content-Length header, so use default of 1Mb\n      set content_length 1048000\n    }\n    # Don't collect content if Content-Length header value was 0\n    if { $content_length > 0 } {\n       HTTP::collect $content_length\n    }\n  }\n}\nwhen HTTP_RESPONSE_DATA {\n  # Find ALL the possible credit card numbers in one pass  \n  set card_indices [regexp -all -inline -indices\\\n    {(?:3[4|7]\\d{2})(?:[ ,-]?(?:\\d{5}(?:\\d{1})?)){2}|(?:4\\d{3})(?:[ ,-]?(?:\\d{4})){3}|(?:5[1-5]\\d{2})(?:[ ,-]?(?:\\d{4})){3}|(?:6011)(?:[ ,-]?(?:\\d{4})){3}}\\\n    [HTTP::payload]]\n\n  foreach card_idx $card_indices {\n    set card_start [lindex $card_idx 0]\n    set card_end [lindex $card_idx 1]\n    set card_len [expr {$card_end - $card_start + 1}]\n    set card_number [string range [HTTP::payload] $card_start $card_end]\n    # Remove dash or space if they exist and count the occurrences in variable cutouts.\n    set cutouts [regsub -all {[- ]} $card_number \"\" card_number]\n    # Adjsut card_len variable but keep it for later use.\n    set new_card_len [expr {$card_len - $cutouts}]\n\n    set double [expr {$new_card_len & 1}]  \n    set chksum 0  \n    set isCard invalid\n\n    # Calculate MOD10\n    for { set i 0 } { $i < $new_card_len } { incr i } { \n       set c [string index $card_number $i]  \n       if {($i & 1) == $double} {  \n          if {[incr c $c] >= 10} {incr c -9}  \n       }  \n       incr chksum $c  \n    }  \n\n    # Determine Card Type\n    switch [string index $card_number 0] {  \n       3 { set type AmericanExpress }  \n       4 { set type Visa }  \n       5 { set type MasterCard }  \n       6 { set type Discover }  \n       default { set type Unknown }  \n    }\n    \n    # If valid card number, then mask out numbers with X's  \n    if { ($chksum % 10) == 0 } {  \n       set isCard valid \n       HTTP::payload replace $card_start $card_len [string repeat \"X\" $card_len]\n    }\n    \n    # Log Results\n    log local0. \"Found $isCard $type CC# $card_number\"  \n  }\n}

Problem this snippet solves:

This iRule illustrates how to scrub out Credit Card Numbers from HTTP traffic.

Let's say you want to specify a policy to not allow any credit card numbers outside of your network. How would you go about scrubbing out Credit Card Numbers? This isn't as simple as searching for a string pattern. CCNs vary in length depending on the issuer of the card. But one thing is common: they all must pass the Luhn Formula. Info on the Luhn Formula or MOD 10 can be found here.\nAn excellent reference on credit card number makeup (beyond the 5 types checked in this iRule) is available here.

How to use this snippet:

This rule will match Diners (13 digit), Amex (15 digit), Visa (13 and 16 digit) Mastercard (16 Digit) and Discover (16 Digit).

This example will look matching patterns looking like credit cards and return their indexes into the payload. Then the number is run through the Luhn formula (with optimizations by unRuleY). If it is indeed a valid credit card number, it is masked with X's.

Further modifications added support for CCNs with - or a blank between the numbers. i.e. xxxx-xxxx-xxxx-xxxx, xxxx xxxx xxxx xxxx, xxxxxxxxxxxxxxxx, would match.

To mask all but the last N digits with X's do the following. At the bottom of the script, you see this line:

HTTP::payload replace $card_start $card_len [string repeat \"X\" $card_len]

Add a small line before it like this: Here N=4.

set card_len [expr {$card_len - 4}]

I used the number 4 to replace all but the last 4 digits. Change this to the number of digits you want to leave untouched. so you end up with:

set card_len [expr {$card_len - 4}]\nHTTP::payload replace $card_start $card_len [string repeat \"X\" $card_len]\n

Note for an alternate method of implementing this iRule using the stream profile, check the Codeshare example.

Code :

when HTTP_REQUEST {\n\n   # Prevent the server from sending a compressed response\n   # remove the compression offerings from the client\n   HTTP::header remove \"Accept-Encoding\"\n\n   # Don't allow response data to be chunked\n   if { [HTTP::version] eq \"1.1\" } {\n\n      # Force downgrade to HTTP 1.0, but still allow keep-alive connections.\n      # Since HTTP 1.1 is keep-alive by default, and 1.0 isn't,\n      # we need make sure the headers reflect the keep-alive status.\n\n      # Check if this is a keep alive connection\n      if { [HTTP::header is_keepalive] } {\n\n         # Replace the connection header value with \"Keep-Alive\"\n         HTTP::header replace \"Connection\" \"Keep-Alive\"\n      }\n\n      # Set server side request version to 1.0\n      # This forces the server to respond without chunking\n      HTTP::version \"1.0\"\n   }\n}\nwhen HTTP_RESPONSE {\n\n  # Only check responses that are a text content type (text/html, text/xml, text/plain, etc).\n  if { [HTTP::header \"Content-Type\"] starts_with \"text/\" } {\n\n    # Get the content length so we can collect the data (to be processed in the HTTP_RESPONSE_DATA event)\n    # Limit collection to 1Mb (1048576 minus a little to spare) - See SOL6578 for details\n    if { [HTTP::header exists \"Content-Length\"] } {\n      if { [HTTP::header \"Content-Length\"] > 1048000 }{\n        # Content-Length over 1Mb so collect 1Mb\n        set content_length 1048000\n      } else {\n        # Content-Length under 1Mb so collect actual length\n        set content_length [HTTP::header \"Content-Length\"]\n      }\n    } else {\n      # Response did not have Content-Length header, so use default of 1Mb\n      set content_length 1048000\n    }\n    # Don't collect content if Content-Length header value was 0\n    if { $content_length > 0 } {\n       HTTP::collect $content_length\n    }\n  }\n}\nwhen HTTP_RESPONSE_DATA {\n  # Find ALL the possible credit card numbers in one pass  \n  set card_indices [regexp -all -inline -indices\\\n    {(?:3[4|7]\\d{2})(?:[ ,-]?(?:\\d{5}(?:\\d{1})?)){2}|(?:4\\d{3})(?:[ ,-]?(?:\\d{4})){3}|(?:5[1-5]\\d{2})(?:[ ,-]?(?:\\d{4})){3}|(?:6011)(?:[ ,-]?(?:\\d{4})){3}}\\\n    [HTTP::payload]]\n\n  foreach card_idx $card_indices {\n    set card_start [lindex $card_idx 0]\n    set card_end [lindex $card_idx 1]\n    set card_len [expr {$card_end - $card_start + 1}]\n    set card_number [string range [HTTP::payload] $card_start $card_end]\n    # Remove dash or space if they exist and count the occurrences in variable cutouts.\n    set cutouts [regsub -all {[- ]} $card_number \"\" card_number]\n    # Adjsut card_len variable but keep it for later use.\n    set new_card_len [expr {$card_len - $cutouts}]\n\n    set double [expr {$new_card_len & 1}]  \n    set chksum 0  \n    set isCard invalid\n\n    # Calculate MOD10\n    for { set i 0 } { $i < $new_card_len } { incr i } { \n       set c [string index $card_number $i]  \n       if {($i & 1) == $double} {  \n          if {[incr c $c] >= 10} {incr c -9}  \n       }  \n       incr chksum $c  \n    }  \n\n    # Determine Card Type\n    switch [string index $card_number 0] {  \n       3 { set type AmericanExpress }  \n       4 { set type Visa }  \n       5 { set type MasterCard }  \n       6 { set type Discover }  \n       default { set type Unknown }  \n    }\n    \n    # If valid card number, then mask out numbers with X's  \n    if { ($chksum % 10) == 0 } {  \n       set isCard valid \n       HTTP::payload replace $card_start $card_len [string repeat \"X\" $card_len]\n    }\n    \n    # Log Results\n    log local0. \"Found $isCard $type CC# $card_number\"  \n  }\n}