Forum Discussion
vinny_murphy_96
Apr 01, 2005Nimbostratus
Hi unRuleY,
I was hoping you would reply, I like'd your work on the MSRDP problem.
Here's the thing, I have 3 different pools of Servers (3 services) I have client infor in the X-Client-IP header (you can refer to my original post,5:07AM) The rule I developed works fine on non persistent TCP as there is only going to be one request with one X-Client-IP in a TCP connection. However when enabling keep-alive and manipulating the appropriate offsets and carriage returns it does not fire.
Can I use Client data on its own without a client accepted event, how can I loop within the client accepted to retrieve all possible X-Client-IPs in a keep-alive TCP. Here's my hack at it:
when CLIENT_ACCEPTED {
TCP::collect
}
when CLIENT_DATA {
For requests arriving using a Content-Length header
if { [TCP::payload contains "Content-Length:"] } {
set ConLen [TCP::payload value "Content-Length:"]
set hashKey [findstr [TCP::payload] "X-Client-IP" 13 "\r"]
if {$hashKey ne ""} {
persist uie $hashKey 1200
} else { [TCP::payload contains "Encapsulated: req-hdr="] } {
set hdrStart [TCP::payload value "Encapsulated: req-hdr="]
set hashKey1 [findstr [TCP::payload] "X-Client-IP" 13 "\r"]
if {$hashKey1 ne ""} {
persist uie $hashKey1 1200
}
} elseif { [TCP::payload contains "Encapsulated: req-hdr=0, null-body="] } {
set hdrOSet [TCP::payload value "Encapsulated: req-hdr=0, null-body="]
set hashKey2 [findstr [TCP::payload] "X-Client-IP" 13 "\r"]
if {$hashKey2 ne ""} {
persist uie $hashKey2 1200
}
}
}
TCP::release
}
As you can see it gets a little complicated with the offsets, so I just want to precise exactly the offset values:
Encapsulated: req-hdr=0, req-body=412
The request header starts at 0 and the body at 412 bytes.
Encapsulated: req-hdr=0, null-body=412
The request header is 412 bytes, there is no request body.
The BIP is 9.0.4 I would also appreciate a little help on the server response problem.
Cheers,
Vinny.