Bypass SSL redirect if URI is....

Give the following a try

 when HTTP_REQUEST {
    if { [TCP::remote_port] eq 80 && !([string tolower [HTTP::uri]] starts_with "/articles/2015/09/09/something.aspx") }
    {
        HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
    elseif { [TCP::local_port] eq 443 && [string tolower [HTTP::uri]] starts_with "/articles/2015/09/09/something.aspx" } {
        HTTP::redirect http://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
    else {
       return
    }
}

The code looks fine, but seems very specific to a given URI. How does the loop manifest? Do you have a client side capture that shows the looping URLs?

On another note, by nature of doing SSL in the first place, I have to assume you have something you want to protect. It is also very likely that allowing HTTP and HTTPS access to the same site creates information leakage - session cookies and other information in the HTTPS content can bleed over into the HTTP content. I can completely understand the desire to not require encryption for some otherwise trivial content, but for the sake of the content (and users) you're trying to protect it may be worthwhile to consider an "all or nothing" approach to SSL.

Any idea why this results in a redirect loop?

If someone visits an article other than /articles/2015/09/09/something.aspx, it stays on http. When I added the https redirect to the else statement, this resulted in a loop.

when HTTP_REQUEST {
    if { [TCP::remote_port] eq 80 && !([string tolower [HTTP::uri]] eq "/articles/2015/09/09/something.aspx") }
    {
        HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
    elseif { [TCP::local_port] eq 443 && [string tolower [HTTP::uri]] eq "/articles/2015/09/09/something.aspx" } {
        HTTP::redirect http://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
    else {
       HTTP::redirect https://[HTTP::host][HTTP::uri]
    }
}

Looks like you used "TCP::remote_port" in your first if. That is what caused your loop since its not being matched. Try this:

when HTTP_REQUEST {
    if { [TCP::local_port] eq 80 && !([string tolower [HTTP::uri]] eq "/articles/2015/09/09/something.aspx") }
    {
        HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
    elseif { [TCP::local_port] eq 443 && [string tolower [HTTP::uri]] eq "/articles/2015/09/09/something.aspx" } {
        HTTP::redirect http://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
    else {
       HTTP::redirect https://[HTTP::host][HTTP::uri]
    }
}

Looks like you used "TCP::remote_port" in your first if. That is what caused your loop since its not being matched. Try this:

when HTTP_REQUEST {
    if { [TCP::local_port] eq 80 && !([string tolower [HTTP::uri]] eq "/articles/2015/09/09/something.aspx") }
    {
        HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
    elseif { [TCP::local_port] eq 443 && [string tolower [HTTP::uri]] eq "/articles/2015/09/09/something.aspx" } {
        HTTP::redirect http://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
    else {
       HTTP::redirect https://[HTTP::host][HTTP::uri]
    }
}

Hi,

this irule does the job but evaluate twice port and URL.

try this irule which evaluate clientssl profile on the VS instead of port and compare the URI once.

when HTTP_REQUEST {
    set is_ssl [PROFILE::exists clientssl]
    set is_ssl_URL [string compare -nocase [HTTP::uri] "/articles/2015/09/09/something.aspx"]
    if { $is_ssl && $is_ssl_URL} {
        HTTP::redirect http://[getfield [HTTP::host] ":" 1][HTTP::uri]
    } elseif { !($is_ssl) && !($is_ssl_URL)} {
        HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
}

Why can't we do this with a switch statement? I've tried this code, however I get a redirect loop as well.

when HTTP_REQUEST {
    switch -glob [string tolower [HTTP::uri]] {
        "/articles/2015/09/09/something.aspx" {
            HTTP::redirect http://[getfield [HTTP::host] ":" 1][HTTP::uri]
            return
        }
        default {
            if {([string tolower [HTTP::host]] starts_with "www.")} {
                HTTP::redirect "https://[string range [HTTP::host] 4 end][HTTP::uri]"
                return
                } elseif { [TCP::local_port clientside] == 80 } {
                HTTP::redirect https://[HTTP::host][HTTP::uri]
                return
            }
        }
    }
}

With the irule I provided, I have the following result:

$ curl -i

HTTP/1.0 302 Found
Location: https://xx.xx.xx.xx/articles/2015/09/09/something.aspx
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

$ curl -i -k

HTTP/1.1 404 Not Found
Date: Tue, 01 Sep 2015 03:33:54 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Length: 310
Content-Type: text/html; charset=iso-8859-1

$ curl -i -k

HTTP/1.0 302 Found
Location: http://xx.xx.xx.xx/articles/2015/09/09/somethingelse.aspx
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

$ curl -i

HTTP/1.1 404 Not Found
Date: Tue, 01 Sep 2015 03:34:25 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Length: 314
Content-Type: text/html; charset=iso-8859-1

Isn't it the expected result?

$ curl -i

HTTP/1.1 404 Not Found
Date: Tue, 01 Sep 2015 03:34:25 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Length: 314
Content-Type: text/html; charset=iso-8859-1

$ curl -i

HTTP/1.1 404 Not Found
Date: Tue, 01 Sep 2015 04:24:50 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

$ curl -i

HTTP/1.1 404 Not Found
Date: Tue, 01 Sep 2015 04:25:00 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

this is exactly the result you described.

try this one, I changed order between conditions:

when HTTP_REQUEST {
    set is_ssl [PROFILE::exists clientssl]
    log local0. "SSL : $is_ssl"
    set is_ssl_URL [string compare -nocase [HTTP::uri] "/articles/2015/09/09/something.aspx"]
    log local0. "clear URL : $is_ssl_URL"
    if { $is_ssl && !($is_ssl_URL)} {
        HTTP::redirect http://[getfield [HTTP::host] ":" 1][HTTP::uri]
    } elseif { !($is_ssl) && $is_ssl_URL} {
        HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
    }
}