Associating a content rewrite profile with an HTTP(S) virtual service enables modification of HTML content within the body of a server response. Content rewrite policy can be created and attached to a virtual service through the VMware Avi Load Balancer CLI or using an API.
Content rewrite profile specifies one or more strings to be searched for within the body of the server response. The profile modifies neither the client requests nor the server headers. Headers can be modified using other features such as DataScripts or policies. For more information about rewriting response headers, see HTTP Response Policy under Virtual Service Policies.
In VMware Avi Load Balancer, the only way to modify the server response is through the content rewrite profile. Content rewrite profile can be configured as a sub-field in the virtual service. The profile contains a list of key-value pairs to match and replace strings in the response body. Content-rewrite allows you to configure literal strings or variables that are either:
Defined in the DataScript using
avi.http.set_reqvar().Defined internally for common virtual service or HTTP request parameters like
$vs_name,$vs_ip,$http_host,$req_id, and so on.
About Searching
Content rewriting can be computationally expensive. Therefore, it is recommended limiting the search-replace to specific content types that must be modified. The rewritable_content_ref argument is used to specify a string group, which contains a list of eligible content types. By default, the VMware Avi Load Balancer configurations include the System-Rewritable-Content-Types string group, a list containing common text-based HTML MIME types such as text/html, text/plain, and so on. This ensures that base64-encoded content, such as images are not inspected when performing search-replace operations.
Search is conducted throughout the entire body of the eligible server response, with no length limit.
If a search string is found in multiple locations within a single HTTP response body, it will be replaced in all those locations.
Multiple search-replace pairs can be specified in a single content rewrite profile. All are actively and independently applied. The content replacement is not recursive. For example, consider a profile having a search-replace of “a” with “b”, and a second search-replace of “b” with “c”. Only pre-existing instances of “b” in the server response will be replaced with “c". Instances of “a” that are replaced with “b” are not recursively checked and replaced with “c”. So, with both pairs applied, a server response body of
abcawould be rewritten tobccb.Searches are not case sensitive.
Replacement String Types
The found strings can be replaced with new strings through one of three methods used to specify the new string.
Literal strings are basic text strings to be used for replacing data found in response bodies.
Strings within identified HTTP headers can be incorporated into replacement strings. Specify the header name to make its current value to be used as the replacement string. If the header does not exist, the search string is replaced with null data, effectively removing the search string from the response. When using HTTP Header, set the Type to
HTTP_HEADER_VAR, and then input the name of the header to use.DataScript can be used to generate a replacement string. Create and attach a new DataScript to the virtual service. It must use the
avi.http.set_reqvar()function to specify the new value. For example, a call toavi.http.set_reqvar(“key1”, “value1”)creates a variable named key1 and sets it tovalue1. In the content rewrite profile, set the type toDATASCRIPT_VARand the variable tokey1. With each HTTP request, the DataScript can uniquely set the DataScript variable to key1 and assign it a new value, for example, value1, value2, and so on, based on the script logic. If no DataScript has been assigned to the virtual service, if the variable is set to a different name, or no variable has been set, the content rewrite profile will replace the searched string with null data, effectively removing the searched string from the response.
CLI Interface
In the following terminal, notice these operative fields within the virtual service object named VS3:
content_rewrite.rewritable_content_ref.content_rewrite.request_rewrite_enabled.content_rewrite.response_rewrite_enabled.content_rewrite.rsp_match_replace_pair.match_string.content_rewrite.rsp_match_replace_pair.replacement_string.type.content_rewrite.rsp_match_replace_pair.replacement_string.val.
We have inserted [TAB][TAB] in the below terminal to indicate the user’s typing of 2 tabs, causing the shell to reveal command-line syntax.
[admin:10-160-0-3]: > configure virtualservice VS3 Updating an existing object. Currently, the object is: +----------------------------------+-----------------------------------------------------+ | Field | Value | +----------------------------------+-----------------------------------------------------+ | uuid | virtualservice-d49aff8a-2846-457b-98c7-657c18675b0e | | name | VS3 | | enabled | True | | services[1] | | | port | 80 | | enable_ssl | False | | port_range_end | 80 | | application_profile_ref | System-HTTP | | network_profile_ref | System-TCP-Proxy | | pool_ref | VS3-pool | | se_group_ref | Default-Group | | network_security_policy_ref | vs-VS3-Default-Cloud-ns | | analytics_policy | | | full_client_logs | | | enabled | True | | duration | 30 min | | all_headers | False | | client_insights | ACTIVE | | metrics_realtime_update | | | | enabled | True | | duration | 30 min | | vrf_context_ref | global | | enable_autogw | True | | analytics_profile_ref | System-Analytics-Profile | | weight | 1 | | delay_fairness | False | | max_cps_per_client | 0 | | limit_doser | False | | type | VS_TYPE_NORMAL | | cloud_type | CLOUD_NONE | | use_bridge_ip_as_vip | False | | flow_dist | LOAD_AWARE | | ign_pool_net_reach | False | | ssl_sess_cache_avg_size | 1024 | | remove_listening_port_on_vs_down | False | | tenant_ref | admin | | cloud_ref | Default-Cloud | | east_west_placement | False | | scaleout_ecmp | False | | active_standby_se_tag | ACTIVE_STANDBY_SE_1 | | flow_label_type | NO_LABEL | | content_rewrite | | | rewritable_content_ref | System-Rewritable-Content-Types | | request_rewrite_enabled | False | | response_rewrite_enabled | False | | sideband_profile | | | sideband_max_request_body_size | 1024 bytes | | vip[1] | | | vip_id | 1 | | ip_address | 10.160.33.200 | | enabled | True | | auto_allocate_ip | False | | auto_allocate_floating_ip | False | | avi_allocated_vip | False | | avi_allocated_fip | False | | vsvip_ref | vsvip-VS3-Default-Cloud | +----------------------------------+-----------------------------------------------------+ [admin:10-160-0-3]: virtualservice> content_rewrite [admin:10-160-0-3]: virtualservice:content_rewrite> where Tenant: admin +--------------------------+---------------------------------+ | Field | Value | +--------------------------+---------------------------------+ | rewritable_content_ref | System-Rewritable-Content-Types | | request_rewrite_enabled | False | | response_rewrite_enabled | False | +--------------------------+---------------------------------+ [admin:10-160-0-3]: virtualservice:content_rewrite> response_rewrite_enabled [TAB][TAB] request_rewrite_enabled Enable rewrite on request body. rewritable_content_ref Rewrite only content types listed in this string group. Content types not present in this list are not rewritten. [admin:10-160-0-3]: virtualservice:content_rewrite> response_rewrite_enabled Overwriting the previously entered value for response_rewrite_enabled [admin:10-160-0-3]: virtualservice:content_rewrite> where Tenant: admin +--------------------------+---------------------------------+ | Field | Value | +--------------------------+---------------------------------+ | rewritable_content_ref | System-Rewritable-Content-Types | | request_rewrite_enabled | False | | response_rewrite_enabled | True | +--------------------------+---------------------------------+ [admin:10-160-0-3]: virtualservice:content_rewrite> rsp_match_replace_pair New object being created [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair> where Tenant: admin No result. [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair> match_string ABC [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair> replacement_string [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair:replacement_string> type [TAB][TAB] datascript_var The variable exposed in datascript to be used as the replacement string in content rewrite. http_header_var The HTTP header to be used as the replacement string in content rewrite. literal_string The literal string to be used as the replacement string in content rewrite. [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair:replacement_string> type literal_string [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair:replacement_string> val XYZ [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair:replacement_string> save [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair> where Tenant: admin +--------------------+----------------+ | Field | Value | +--------------------+----------------+ | match_string | ABC | | replacement_string | | | type | LITERAL_STRING | | val | XYZ | +--------------------+----------------+ [admin:10-160-0-3]: virtualservice:content_rewrite:rsp_match_replace_pair> save [admin:10-160-0-3]: virtualservice:content_rewrite> save [admin:10-160-0-3]: virtualservice> save +----------------------------------+------------------------------------------------------+ | Field | Value | +----------------------------------+------------------------------------------------------+ | uuid | virtualservice-d49aff8a-2846-457b-98c7-657c18675b0e | | name | VS3 | | enabled | True | | services[1] | | | port | 80 | | enable_ssl | False | | port_range_end | 80 | | application_profile_ref | System-HTTP | | network_profile_ref | System-TCP-Proxy | | pool_ref | VS3-pool | | se_group_ref | Default-Group | | network_security_policy_ref | vs-VS3-Default-Cloud-ns | | analytics_policy | | | full_client_logs | | | enabled | True | | duration | 30 min | | all_headers | False | | client_insights | ACTIVE | | metrics_realtime_update | | | enabled | True | | duration | 30 min | | vrf_context_ref | global | | enable_autogw | True | | analytics_profile_ref | System-Analytics-Profile | | weight | 1 | | delay_fairness | False | | max_cps_per_client | 0 | | limit_doser | False | | type | VS_TYPE_NORMAL | | cloud_type | CLOUD_NONE | | use_bridge_ip_as_vip | False | | flow_dist | LOAD_AWARE | | ign_pool_net_reach | False | | ssl_sess_cache_avg_size | 1024 | | remove_listening_port_on_vs_down | False | | tenant_ref | admin | | cloud_ref | Default-Cloud | | east_west_placement | False | | scaleout_ecmp | False | | active_standby_se_tag | ACTIVE_STANDBY_SE_1 | | flow_label_type | NO_LABEL | | content_rewrite | | |rewritable_content_ref | System-Rewritable-Content-Types | |request_rewrite_enabled | False | |response_rewrite_enabled | True | |rsp_match_replace_pair[1] | | |match_string | ABC | |replacement_string | | | type | LITERAL_STRING | | val | XYZ | | sideband_profile | | | sideband_max_request_body_size | 1024 bytes | | vip[1] | | | vip_id | 1 | | ip_address | 10.160.33.200 | | enabled | True | | auto_allocate_ip | False | | auto_allocate_floating_ip | False | | avi_allocated_vip | False | | avi_allocated_fip | False | | vsvip_ref | vsvip-VS3-Default-Cloud | +----------------------------------+----------------------------------------------------- +
To view the content rewrite profile configuration on a virtual service,
[admin:10-160-0-8]: show virtualservice virtualservice-1 +----------------------------------+---------------------------------------------------------------------------------+ | Field | Value | +----------------------------------+---------------------------------------------------------------------------------+ |uuid | virtualservice-80519ed3-00f8-437d-9b4e-66c12f331f60 | |name | virtualservice-1 | |enabled | True | |services[1] | | |port | 9000 | |enable_ssl | False | |port_range_end | 9000 | |services[2] | | |port | 9443 | |enable_ssl | True | |port_range_end | 9443 | |application_profile_ref | applicationprofile-1 | |network_profile_ref | System-TCP-Proxy | |pool_ref | pool-1 | |se_group_ref | Default-Group | |ssl_key_and_certificate_refs[1] | System-Default-Cert-EC | |ssl_profile_ref | System-Standard | |analytics_policy | | |full_client_logs | | |enabled | True | |duration | 0 min | |throttle | 0 per_second | |client_insights | NO_INSIGHTS | |all_headers | True | |metrics_realtime_update | | |enabled | True | |duration |0 min | |udf_log_throttle |0 per_second | |significant_log_throttle |0 per_second | |enabled |True | |vrf_context_ref |global | |enable_autogw |True | |analytics_profile_ref |System-Analytics-Profile | |vs_datascripts[1] | | |index | 0 | |vs_datascript_set_ref | vsds1-0 | |weight | 1 | |delay_fairness | False | |max_cps_per_client | 0 | |limit_doser | False | |type | VS_TYPE_NORMAL | |cloud_type | CLOUD_NONE | |use_bridge_ip_as_vip | False | |flow_dist | CONSISTENT_HASH_SOURCE_IP_ADDRESS_AND_PORT | |ign_pool_net_reach | False | |ssl_sess_cache_avg_size | 1024 | | remove_listening_port_on_vs_down | False | |close_client_conn_on_config_update| False | |bulk_sync_kvcache | False | |tenant_ref | admin | | cloud_ref | Default-Cloud | | east_west_placement | False | | scaleout_ecmp | False | | active_standby_se_tag | ACTIVE_STANDBY_SE_1 | | flow_label_type | NO_LABEL | | content_rewrite | | | rewritable_content_ref | sg-1 | | request_rewrite_enabled | False | | response_rewrite_enabled | True | | rsp_match_replace_pair[1] | | | match_string | The Big Picture | | replacement_string | | | type | LITERAL_STRING | | val | The Bigger Picture | | rsp_match_replace_pair[2] | | | match_string | abankerisafellowwholendsyouhisumbrellawhenthesunisshining | |replacement_string | | |type | LITERAL_STRING | |VAL | ABANKERISAFELLOWWHOLENDSYOUHISUMBRELLAWHENTHESUNISSHINING | |rsp_match_replace_pair[3] | | | match_string | literal | |replacement_string | | | type | LITERAL_STRING | | val | blah | | rsp_match_replace_pair[4] | | | match_string | httpvar | | replacement_string | | |type | HTTP_HEADER_VAR | | val | http_host | | match_string | datascriptvar | | replacement_string | | | type | DATASCRIPT_VAR | | val | modified_hostname | | rsp_match_replace_pair[6] | | | match_string | fghijkl | | replacement_string | | | type | HTTP_HEADER_VAR | | val | http_host | | rsp_match_replace_pair[7] | | | match_string | datascript_some_var | | replacement_string | | | type | DATASCRIPT_VAR | | val | some_var | | rsp_match_replace_pair[8] | | | match_string | integer_variable | | replacement_string | | | type | DATASCRIPT_VAR | | val | int_variable | | rsp_match_replace_pair[9] | | | match_string | true_var | | replacement_string | | | type | DATASCRIPT_VAR | | val | true_variable | | rsp_match_replace_pair[10] | | | match_string | false_var | | replacement_string | | | type | DATASCRIPT_VAR | | val | false_variable | | rsp_match_replace_pair[11] | | | match_string | unset_var | | replacement_string | | | type | DATASCRIPT_VAR | | val | get_unset | | rsp_match_replace_pair[12] | | | match_string | variable1 | | replacement_string | | | type | DATASCRIPT_VAR | | val | multi_var1 | | rsp_match_replace_pair[13] | | | match_string | small_match | | replacement_string | | | type | LITERAL_STRING | | val | abcdefghijklmnopqrstuvwxyz 0123456789 ABCDEFGHIJKLMNOPQRSTUVQXYZ 9876543210 ABCD| | | EFGHIJKLMNOPQRSTUVQXYZ 0123456789 9876543210_abcdefghijk | | rsp_match_replace_pair[14] | | | match_string | ZYXWVUTSRQPONMLKJIHGFEDCBA_9876543210_0123456789_zyxwvutsrqponmlkjihgfedcba_The | | | quick brown fox jumps over the lazy dog_Pack my box with five dozen liquor jugs.| | replacement_string | | | type | DATASCRIPT_VAR | | val | modified_hostname | | rsp_match_replace_pair[15] | | | match_string | nginx | | replacement_string | | | type | LITERAL_STRING | | val | content rewrite | | rsp_match_replace_pair[16] | | | match_string | apache | | replacement_string | | | type | LITERAL_STRING | | val | NGINX | | rsp_match_replace_pair[17] | | | match_string | FEDORA | | replacement_string | | | type | LITERAL_STRING | | val | Ubuntu | | rsp_match_replace_pair[18] | | | match_string | SerVer | | replacement_string | | | type | LITERAL_STRING | | val | backend | | rsp_match_replace_pair[19] | | | match_string | SSL_VERSION_TLS1_1 | | replacement_string | | | type | LITERAL_STRING | | val | SSL_VERSION_TLS1_2 | | rsp_match_replace_pair[20] | | | match_string | Gambardella | | replacement_string | | | type | LITERAL_STRING | | val | alledrabmaG | | rsp_match_replace_pair[21] | | | match_string | ztoa | | replacement_string | | | type | LITERAL_STRING | | val | ZTOA | | vip[1] | | | vip_id | 0 | | ip_address | 10.160.35.63 | | enabled | True | | auto_allocate_ip | False | | auto_allocate_floating_ip | False | | avi_allocated_vip | False | | avi_allocated_fip | False | | auto_allocate_ip_type | V4_ONLY | | vsvip_ref | vsvip-beK7uc | | use_vip_as_snat | False | | traffic_enabled | True | +--------------------------------------------------------------------------------------------------------------------+ [admin:10-160-0-8]:
Content-Rewrite Rule
The new object model allows users to configure a list of Content Rewrite rules. Each rule has a name, index, and a list of search-and-replace-pairs to be configured. The configured rules run in the order they are defined. The first rule takes precedence over the second rule and the rest follow.
Search String Types |
In VMware Avi Load Balancer, different types of strings can be searched for. These types are similar to the string types for replacement strings. You can search for the following strings:
|
New Replace String Type. |
Combination Strings can also access regex captures groups using the variables |
Examples of Search and Replace Pairs
Example 1 (Replace all instances of the user-agent in the response with string “NSX”)
SearchReplacePair:
search_string:
type: SEARCH_HTTP_VAR
val: ${http_user_agent}
replacement_string:
type: LITERAL_STRING
val: NSX
Example 2 (Replace the address and port tags in an XML response with the virtual services IP and port):
SearchReplacePair #1:
search_string:
type: REGEX_STRING.
val: (<address>)[\s]*([\w\.]*)[\s]*(</address>).
replacement_string:
type: COMBINATION_STRING.
val: ${1}${vs_ip}${3}.
SearchReplacePair #2:
search_string:
type: REGEX_STRING.
val: (<port>)8443(</port>).
replacement_string:
type: COMBINATION_STRING.
val: ${1}${vs_port}${3}.
