Forum Discussion

den_39838's avatar
den_39838
Icon for Nimbostratus rankNimbostratus
May 16, 2010

Binary (HEX) payload replace in HTTP

Trying to write simple iRule to replace 2 bytes in HTTP response data.

 

 

===============================================

 

when HTTP_RESPONSE {

 

 

set v_1_0 "\x8d\x90"

 

set v_1_2 "\x8d\x92"

 

 

regsub $v_1_2 [HTTP::payload] $v_1_0 replaced

 

HTTP::payload replace 0 [HTTP::payload length] $replaced

 

HTTP::release

 

}

 

===============================================

 

 

Looks like "regsub" or "HTTP::payload replace" does not do the job right.

 

After replacement the Wireshark could not reassemble the packet.

 

 

This iRule just ruin all paiload data and replace not only 2 bytes as you can see in attached Wireshark screen captures, the payload before replacemnt was starting as HEX:

 

8c 81 98 ...

 

and after replacement:

 

c2 8c c2 81 c2 98 ...

 

 

Any idea what i doing wrong?

 

 

regards,

 

Denis

 

application delivery
dev
devops
iRules

2 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    May 18, 2010
    Hi Den,

     

     

    Here is an old post on a related issue with nulls in binary data. The fix there was to use binary format:

     

     

     

    http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/aft/1253/afv/topic/Default.aspx

     

     

    Unruley

     

     

    Please try this out and let us know:

     

     

    HTTP::payload replace offset 0 [binary format ca* 0 "my goofy string"]

     

     

    FYI, the problem is that the literal string is converted to Utf-8 when Tcl compiles the rule. This changes any embedded NUL's to C0 80 in the string. Therefore, you still need to use the binary format command to convert from the Utf-8 encoded literal string into a binary array (this is what keeps HTTP::payload replace offset 0 "\000my goofy string" from working).

     

     

    There is also a known issue with the binary format command that will prevent just using a* from working correctly (ie, binary format a* "\000my goofy string") This has been fixed in the upcoming 9.0.3 release.

     

     

     

    Aaron
  • den_39838's avatar
    den_39838
    Icon for Nimbostratus rankNimbostratus
    May 24, 2010
    Hi Aaron,

    Thanks for link to related issue, strange how i miss it before.

    So the final working script will looks like following: 

    when HTTP_RESPONSE {

set v_1_0 "\x8d\x90"
set v_1_1 "\x8d\x91"
set v_1_2 "\x8d\x92"

log local0. "START response parsing"

if { [regexp {\x8d\x92} [HTTP::payload]] } {
 log local0. "Found 8d92 = v1.2:"
}
if { [regexp {\x8d\x91} [HTTP::payload]] } {
 log local0. "Found 8d91 = v1.1:"
}
if { [regexp {\x8d\x90} [HTTP::payload]] } {
 log local0. "Found 8d90 = v1.0:"
}

 regsub $v_1_2 [HTTP::payload] $v_1_0 replaced
 regsub $v_1_1 $replaced $v_1_0 replaced

 HTTP::payload replace 0 [HTTP::payload length] [binary format a* $replaced]
 log local0. "STOP response processing"
 HTTP::release
}

    As mentioned in old issue the "binary format ca*" was not working in my SW version BIG-IP 9.4.8 Build 396.1 Hotfix HF3

    but "binary format a*" working as required.

    thanks and regards,

    Denis