For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

GC84's avatar
GC84
Icon for Nimbostratus rankNimbostratus
Aug 15, 2019

How do you install/use TCLSCAN to validate secure iRules?

Hello,   I'm looking for some guidance on utilizing the TCLSCAN tool, and how we can utilize it to validate our irules are secure based on the recent security finding with TCL. Has anyone succes...
iRules
LTM
security
AceDawg1's avatar
AceDawg1
Icon for Nimbostratus rankNimbostratus
Feb 23, 2020

Hi GC84-

 

This is the procedure I used:

 

  1. Compile tclscan on a CentOS 7 box
  2. Copy the iRules to the CentOS 7 device
  3. Run the tclscan command against the iRules (e.g. tclscan iRuleDoubleSub.txt)

 

The tclscan toolkit should not be loaded on the F5.

 

I also used Burp Suite with the iRule extender loaded to test for double substitution issues.