Forum Discussion
_V_aniac_74372
Nimbostratus
NimbostratusHelp interpret iRule...ASAP
when CLIENTSSL_CLIENTCERT {
if {[SSL::cert 0] ne ""}
{
set serial_number [X509::serial_number [SSL::cert 0]]
log local0. "Client certificate received: $serial_number"
}
}
when HTTP_REQUEST {
if {([HTTP::header exists "X-IntaToken"])}
{
log local0. "Header already exists in request"
reject
}
elseif {([info exists serial_number] eq 1)}
{
if {([class search $::XXX_Serialz equals $serial_number])}
{
log local0. "Serial number found in the list of valid serial numbers"
set letters [ list a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 8 9 ]
set token ""
for { set i 1 } { $i <= 6 } { incr i }
{
append token [lindex $letters [expr { int (rand() * 36) }]]
}
log local0. "Random token is: $token"
HTTP::header insert X-IntaToken $token
if {[HTTP::query] ne ""}
{
set tokenString "&token=$token"
}
else
{
set tokenString "?token=$token"
}
HTTP::uri [HTTP::uri]$tokenString
}
else
{
log local0. "Serial number not found in the list of valid serial number"
}
}
else
{
log local0. "Serial number is not set as no client certificate was provided"
}
}
1 Reply
Kevin_Davies_40Nacreous
if header X-IntaToken exists reject the connection that contains the http request.
else if a serial number from the SSL certificate exists in class XXX_Serialz then create a random six character token from the character set shown, inject X-IntaToken header the new token as its value and append a query string (token=$token) to the http request then pass the request through.
otherwise if there is no matching serial then log that information but pass the request through.
otherwise if there is no client certificate then log that information but pass the request through.
