Forum Discussion
SIDI_132370
Nimbostratus
Jun 08, 2017How can I collect that server side "Certificate request" in server hello-record layer?
Everyone,
I want collect "Certificate request" to use fire the event in iRules.
I looked for applicable command in devcentral site,but I can't find it.
So, I tried the follows rule.
when SERVER_CONNECTED {
TCP::collect
}
when SERVER_DATA {
log local0. "[TCP::payload length]"
set tcplen [TCP::payload length]
set offset 3
while {$offset < $tcplen} {
set HSType Null
binary scan [TCP::payload] @${offset}Sc RecordLayerLen HSType
log local0. "RecordLayerLen:$RecordLayerLen, HSType:$HSType"
set offset [expr {$offset + $RecordLayerLen + 5}]
log local0. "end offset:$offset"
if { $HSType == "13" }{
log local0. "HSType:$HSType certrequest"
table set -subtable BYPASS_BY_HOST "$desthost.[TCP::remote_port]" "1" 3600
log local0. "srvd keys: [table keys -subtable BYPASS_BY_HOST]"
log local0. "srvd value: [table lookup -subtable BYPASS_BY_HOST "$desthost.[TCP::remote_port]"]"
TCP::payload replace 0 [TCP::payload length] ""
clientside { TCP::respond [binary format H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2 16 03 03 00 24 00 00 00 00 67 9f 99 82 82 0b f6 d7 38 a6 0c 44 24 34 38 9a 19 f3 dc a2 24 47 93 9a 40 a3 b0 d6 f3 ac c9 8f] }
TCP::release
break
} elseif { $HSType == "14" }{
log local0. "HSType:$HSType serverhello done"
TCP::release
break
} else {
log local0. "other loop"
continue
}
TCP::release
log local0. "tcp release"
}
the rules works , but it isn't works well in specific a few site.
Are there nice idea for resolve this ? or , are there appropriate command available?
I am waiting for a good idea.
Best Regards,
- dragonflymr
Cirrostratus
Hi,
There is plenty of commands and events related to SSL, I doubt you need any TCP::collect here. Check for example SSL.
Piotr
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects