Deocde BigIP cookies to internal IP address and port number

bigip_decode_cookie.py

'''
Name:    bigip_decode_cookie.py
Purpose: Convert BigIP cookies to internal IP address and port number
Date:    20150702
Author:  Don C. Weber (@cutaway) of InGuardians, Inc.

Resources:
    Initial python project I found for doing this: https://penturalabs.wordpress.com/2011/03/29/how-to-decode-big-ip-f5-persistence-cookie-values/
    F5 LTM Encrypted Cookie Insert Persistence: http://packetpushers.net/encrypted-cookie-persistence/
    Encrypting Big-IP Cookies (10.x - 11.x): https://support.f5.com/kb/en-us/solutions/public/14000/700/sol14784.html
    Encrypting Big-IP Cookies (9.x): https://support.f5.com/kb/en-us/solutions/public/7000/700/sol7784.html

TODO:
    Add base64 decoding if deemed necessary
'''
import sys
import struct
import re

delim = "."

def decode(data):
    '''
    Converts the cookie value and returns a tuple: (address_str, port_int)
    Returns None for both values if possibly base64 encoded.
    '''
    # Test for period. If no period then the value is base64 encoded and thus encrypted
    if not re.search(delim,data):
        return (None, None)

    # Split on period
    (encoded_host,encoded_port,reserved) = data.split(".")

    # Get hex value, decode, reverse, and build IP address string
    addr = '.'.join([str(ord(i)) for i in hex(int(encoded_host))[2:].decode('hex')[::-1]])

    # Get port number
    port = struct.unpack("<H",hex(int(encoded_port))[2:].decode('hex'))[0]

    return (addr, port)

if __name__ == "__main__":
    d = sys.argv[1]
    i = decode(d)
    if i[0]:
        print "Host: %s\nPort: %s" % i
    else:
        print "The cookie might be encrypted. Is this base64 encoded?:", d