Forum Discussion
Luis_Ribeiro
Nimbostratus
Dec 20, 2017HTTPS does not hit iRule
Hi,
I'm to implement an iRule for HTTPS. The iRule is:
when HTTP_REQUEST {
HTTPS ------------------------------------------------------------------------
log local0. ".TESTE HTTPS: [IP::client_addr] -> [IP::local_addr] HOST:[HTTP::host] PATH:[HTTP::path] [HTTP::uri] [TCP::local_port]"
if { [string tolower [HTTP::host]] contains "xpto.com" } {
log local0. ".TESTE HTTPS.IF: [IP::client_addr] -> [IP::local_addr] [HTTP::host] [HTTP::uri] [TCP::local_port]"
switch -glob [string tolower [HTTP::uri]] {
"/index1.php" {
persist source_addr 255.255.255.255 1800
log local0. ".TESTE index1: [IP::client_addr] -> [IP::local_addr] [HTTP::host] [HTTP::uri] [TCP::local_port]"
node "10.1.144.100:[TCP::local_port]"
}
"/index3.php" {
persist source_addr 255.255.255.255 1800
log local0. ".TESTE index2: [IP::client_addr] -> [IP::local_addr] [HTTP::host] [HTTP::uri] [TCP::local_port]"
node "10.1.144.101:[TCP::local_port]"
}
"/index3.php" {
persist source_addr 255.255.255.255 1800
log local0. ".TESTE /index3: [IP::client_addr] -> [IP::local_addr] [HTTP::host] [HTTP::uri] [`TCP::local_port]"
node "10.1.144.102:[TCP::local_port]"
log local0. ".TESTE index3: [IP::client_addr] -> [IP::local_addr] [HTTP::host] [HTTP::uri] [TCP::local_port]"
}
default { HTTPS but not BKO
log local0. ".TESTE DEFAULT: [IP::client_addr] -> [IP::local_addr]"
}
}
}
}
I have a similar iRule for a virtual-server HTTP and it works fine, this one, for https, does not work, and I do not see any log.
Later to check if the iRule is called I have added to the iRule: when CLIENT_ACCEPTED {
log local0. ".TESTE CLIENT_ACCEPTED: [IP::client_addr] -> [IP::local_addr] [TCP::local_port]"
Check the VS port to determine if connection is SSL or not
switch [TCP::local_port] {
"443" {
log local0. ".TESTE CLIENT_ACCEPTED:443: [IP::client_addr] -> [IP::local_addr] [TCP::local_port]"
set proto "https"
}
default {
log local0. ".TESTE CLIENT_ACCEPTED:not443: [IP::client_addr] -> [IP::local_addr] [TCP::local_port]"
set proto "http"
}
}
}
I have logs for "CLIENT_ACCEPTED" and "443", so the iRule is called!
The https use TLSv3.
So the question is: what's wrong?
Thanks, LFR.
1 Reply
Do you have a client-ssl profile attached to the virtual server? You need to terminate the SSL connection if you want to see the HTTP traffic.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects