Forum Discussion

GC84's avatar
GC84
Icon for Nimbostratus rankNimbostratus
Aug 15, 2019

How do you install/use TCLSCAN to validate secure iRules?

Hello,

 

I'm looking for some guidance on utilizing the TCLSCAN tool, and how we can utilize it to validate our irules are secure based on the recent security finding with TCL. Has anyone successfully installed the tool? Is it done from the F5 devices themselves?

 

https://www.itpro.co.uk/internet-security/34188/firms-urged-to-scan-networks-for-major-big-ip-load-balancer- flaw

https://support.f5.com/csp/article/K15650046

iRules
LTM
security
  • AceDawg1's avatar
    AceDawg1
    Icon for Nimbostratus rankNimbostratus
    Feb 23, 2020

    Hi GC84-

     

    This is the procedure I used:

     

    1. Compile tclscan on a CentOS 7 box
    2. Copy the iRules to the CentOS 7 device
    3. Run the tclscan command against the iRules (e.g. tclscan iRuleDoubleSub.txt)

     

    The tclscan toolkit should not be loaded on the F5.

     

    I also used Burp Suite with the iRule extender loaded to test for double substitution issues.