This is a question about http transformation rules.

We have a working HTTP Transformation Rule to add new HTTP headers, but it drops headers if they are too large (5-8 K in size). Not found yet the actual limit.

Would anyone know the maximum limit of header size that is configured in WebSEAL ? and if it is configurable or hardcoded ?

We are testing the exact same http transformation rule with the same XML HTTPRequest document with on online XLST site and it works without truncation.

------------------------------
Sylvain Gilbert
------------------------------

Hi Sylvain,

I don't know for sure but my best guess would be that WebSEAL is not able to read in enough of your request to run the transformation rules when the headers are big.

Take a look at these parameters in the configuration file:

# This parameter specifies the maximum number of bytes that
# WebSEAL will read from a client when parsing an HTTP request.
# The total size of the URL and HTTP headers must be less than
# this value. This parameter cannot be set lower than it's
# default: 32768
max-client-read = 32768

request-body-max-read = 4096

These parameters don't mention HTTP Transformation but seems like they could be relevant - especially when you say it's failing only for large requests.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Jon

Thanks for your suggestion. I tried doubling/trippling these values to well beyond the size of the HTTP header of interest but it did not help. Will probably open a case to go beyond this point unless someone else has another suggestion/hint ?

------------------------------
Sylvain Gilbert
------------------------------

Original Message:
Sent: Mon October 21, 2019 08:57 AM
From: Jon Harry
Subject: HTTP Transformation Rule size limit

Hi Sylvain,

I don't know for sure but my best guess would be that WebSEAL is not able to read in enough of your request to run the transformation rules when the headers are big.

Take a look at these parameters in the configuration file:

# This parameter specifies the maximum number of bytes that
# WebSEAL will read from a client when parsing an HTTP request.
# The total size of the URL and HTTP headers must be less than
# this value. This parameter cannot be set lower than it's
# default: 32768
max-client-read = 32768

request-body-max-read = 4096

These parameters don't mention HTTP Transformation but seems like they could be relevant - especially when you say it's failing only for large requests.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Sylvain,

Check this setting:

# Maximum size, in bytes, of WebSEAL generated HTTP Headers.
# Headers over this size will be split across multiple
# HTTP Headers. A value of "0" disables this support.
max-webseal-header-size = 0



------------------------------
Nick
ISAM Level II Support
------------------------------

Original Message:
Sent: Mon October 21, 2019 09:37 AM
From: Sylvain Gilbert
Subject: HTTP Transformation Rule size limit

Hi Jon

Thanks for your suggestion. I tried doubling/trippling these values to well beyond the size of the HTTP header of interest but it did not help. Will probably open a case to go beyond this point unless someone else has another suggestion/hint ?

------------------------------
Sylvain Gilbert
------------------------------


Original Message:
Sent: Mon October 21, 2019 08:57 AM
From: Jon Harry
Subject: HTTP Transformation Rule size limit

Hi Sylvain,

I don't know for sure but my best guess would be that WebSEAL is not able to read in enough of your request to run the transformation rules when the headers are big.

Take a look at these parameters in the configuration file:

# This parameter specifies the maximum number of bytes that
# WebSEAL will read from a client when parsing an HTTP request.
# The total size of the URL and HTTP headers must be less than
# this value. This parameter cannot be set lower than it's
# default: 32768
max-client-read = 32768

request-body-max-read = 4096

These parameters don't mention HTTP Transformation but seems like they could be relevant - especially when you say it's failing only for large requests.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Hi

Just a quick follow-up regarding the behavior observed and discussed in the past on this thread.

The following APAR has been opened acknowledging the apparent existence of a size limitation in ISAM's HTTP Transformation engine for http header larger than 4096.

TITLE: IJ20633: HTTP TRANSFORMATION RESULT TRUNCATED

Cheers

------------------------------
Sylvain Gilbert
------------------------------

Original Message:
Sent: Tue October 22, 2019 08:59 AM
From: Nick Lloyd
Subject: HTTP Transformation Rule size limit

Hi Sylvain,

Check this setting:

# Maximum size, in bytes, of WebSEAL generated HTTP Headers.
# Headers over this size will be split across multiple
# HTTP Headers. A value of "0" disables this support.
max-webseal-header-size = 0



------------------------------
Nick
ISAM Level II Support
------------------------------


Original Message:
Sent: Mon October 21, 2019 09:37 AM
From: Sylvain Gilbert
Subject: HTTP Transformation Rule size limit

Hi Jon

Thanks for your suggestion. I tried doubling/trippling these values to well beyond the size of the HTTP header of interest but it did not help. Will probably open a case to go beyond this point unless someone else has another suggestion/hint ?

------------------------------
Sylvain Gilbert


Original Message:
Sent: Mon October 21, 2019 08:57 AM
From: Jon Harry
Subject: HTTP Transformation Rule size limit

Hi Sylvain,

I don't know for sure but my best guess would be that WebSEAL is not able to read in enough of your request to run the transformation rules when the headers are big.

Take a look at these parameters in the configuration file:

# This parameter specifies the maximum number of bytes that
# WebSEAL will read from a client when parsing an HTTP request.
# The total size of the URL and HTTP headers must be less than
# this value. This parameter cannot be set lower than it's
# default: 32768
max-client-read = 32768

request-body-max-read = 4096

These parameters don't mention HTTP Transformation but seems like they could be relevant - especially when you say it's failing only for large requests.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Hi all

This problem will be fixed on the next version, as can be seen on the following APAR description:

https://www-01.ibm.com/support/docview.wss?uid=swg1IJ20633

I was able to test the fix and it did resolve the behavior observed.

Cheers.


------------------------------
Sylvain Gilbert
------------------------------

Original Message:
Sent: Mon November 04, 2019 08:34 PM
From: Sylvain Gilbert
Subject: HTTP Transformation Rule size limit

Hi

Just a quick follow-up regarding the behavior observed and discussed in the past on this thread.

The following APAR has been opened acknowledging the apparent existence of a size limitation in ISAM's HTTP Transformation engine for http header larger than 4096.

TITLE: IJ20633: HTTP TRANSFORMATION RESULT TRUNCATED

Cheers

------------------------------
Sylvain Gilbert
------------------------------


Original Message:
Sent: Tue October 22, 2019 08:59 AM
From: Nick Lloyd
Subject: HTTP Transformation Rule size limit

Hi Sylvain,

Check this setting:

# Maximum size, in bytes, of WebSEAL generated HTTP Headers.
# Headers over this size will be split across multiple
# HTTP Headers. A value of "0" disables this support.
max-webseal-header-size = 0



------------------------------
Nick
ISAM Level II Support


Original Message:
Sent: Mon October 21, 2019 09:37 AM
From: Sylvain Gilbert
Subject: HTTP Transformation Rule size limit

Hi Jon

Thanks for your suggestion. I tried doubling/trippling these values to well beyond the size of the HTTP header of interest but it did not help. Will probably open a case to go beyond this point unless someone else has another suggestion/hint ?

------------------------------
Sylvain Gilbert


Original Message:
Sent: Mon October 21, 2019 08:57 AM
From: Jon Harry
Subject: HTTP Transformation Rule size limit

Hi Sylvain,

I don't know for sure but my best guess would be that WebSEAL is not able to read in enough of your request to run the transformation rules when the headers are big.

Take a look at these parameters in the configuration file:

# This parameter specifies the maximum number of bytes that
# WebSEAL will read from a client when parsing an HTTP request.
# The total size of the URL and HTTP headers must be less than
# this value. This parameter cannot be set lower than it's
# default: 32768
max-client-read = 32768

request-body-max-read = 4096

These parameters don't mention HTTP Transformation but seems like they could be relevant - especially when you say it's failing only for large requests.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM