HTTP_REQUEST not triggered in HTTPS virtual server?

Hello,

 

 

I have setup a simple HTTPS offloading virtual server. We use

 

clientside certificates. We also use an iRule, because we use

 

specific parts from the client certificate to perform special

 

tasks (not relevant to this question).

 

 

Using a webbrowser the iRule works. However, it's an application

 

that must use this VS/iRule. The application does not work properly.

 

 

The problem is that I can see a correct SSL handshake and client

 

certificate being passed to the LTM.

 

I can also see the application sending an encrypted HTTP request

 

packet (with wireshark I see TLSv1 application data (application

 

data protocol: HTTP).

 

This packet is being ACKed by the LTM at the TCP level

 

(only a TCP ACK, no data is being transferred from the LTM to the

 

client application). However, the HTTP_REQUEST event is not

 

triggered in the iRule and the (SSL/TCP) communication seems to

 

get stuck.

 

 

This is the iRule:

 

 

---------------------------------------------------------------

 

when CLIENTSSL_CLIENTCERT {

 

set cert [SSL::cert 0]

 

session add ssl [SSL::sessionid] $cert 36000

 

 

HTTP::release

 

}

 

 

when HTTP_REQUEST {

 

set client_cert [session lookup ssl [SSL::sessionid]]

 

 

DEBUG

 

set cert_data [X509::whole $client_cert]

 

log "X509 client cert: $cert_data"

 

DEBUG ENDS

 

 

other code not relevant to this question

 

}

 

---------------------------------------------------------------

 

 

My questions are:

 

 

1) what can be the reason the HTTP_REQUEST is not triggered?

 

The only thing I can think of is that the HTTP request is

 

not complete or the application is not sending a valid

 

HTTP request.

 

 

2) Because of 1) I would really like to be able to look into

 

the unencrypted data being send from the client to the LTM.

 

Is there any way I can use debugging in the iRule to have

 

access to the unencrypted raw data send from the client

 

application to the LTM? (ssldump is not an option).

 

HTTP::collect will not work as HTTP_REQUEST is not triggered.

 

TCP::collect probably won't work because I probably get the

 

encrypted data (which I can also see using tcpdump on the

 

interface).

 

 

Any help/hints are very much appreciated.

 

 

-Frank