Forum Discussion
iRule Client Cert fail
We have a problem with this iRule. We need insert the client cert in HTTP request, if the content to request is minor to 10 Mb (more o less) work ok, but when this request is greater fail. Have you any idea?
when RULE_INIT {
set ::loglevel 0
set ::requestcert 1
}
when CLIENTSSL_CLIENTCERT {
set cert [SSL::cert 0]
set sid [SSL::sessionid]
if { $sid ne "" } {
if { $::loglevel > 10 } { log local0. "Sesion SSL Cacheada" }
set key [concat [IP::remote_addr]@$sid]
session add ssl $key $cert 180
HTTP::release
}
}
when HTTP_REQUEST {
set cert [SSL::cert 0]
set requestedUri [HTTP::uri]
if { ([HTTP::uri] starts_with "/home") } {
if { $::loglevel > 10 } { log local0. "Se Requiere Certificado de cliente. Solicitada URI segura: $requestedUri" }
set ::requestcert 1
}
else {
if { $::loglevel > 10 } { log local0. "No se requiere Certificado de cliente. Solicitada URI insegura: $requestedUri" }
set ::requestcert 0
}
if { $::requestcert == 1} { se requiere certificado de cliente
if { [info exists cert] and $cert ne "" } {
if { $::loglevel > 10 } { log local0. "Se encontro certificado de cliente" }
set sn [X509::serial_number $cert]
} else {
set sid [SSL::sessionid]
if { $::loglevel > 10 } { log local0. "No hay certificado de cliente" }
if { $sid ne "" } {
if { $::loglevel > 10 } { log local0. "Sesion en cache, recuperamos certificado de la tabla de sesion" }
set key [concat [IP::remote_addr]@$sid]
set cert [session lookup ssl $key]
if { $cert ne "" } {
set sn [X509::serial_number $cert]
} else {
if { $::loglevel > 10 } { log local0. "***** NO SE ENCONTRO EL CERTIFICADO DE CLIENTE, Solicitando Certificado de cliente *****"}
HTTP::collect
SSL::cert mode request
SSL::renegotiate
}
} else {
if { $::loglevel > 10 } { log local0. "Solicitando Certificado de Cliente.."}
HTTP::collect
SSL::cert mode request
SSL::renegotiate
}
}
}
}
when HTTP_REQUEST_SEND {
if { $::loglevel > 10} { log local0. "HTTP_REQUEST_SEND: " }
if { [info exists cert] and $cert ne "" } {
if { $::loglevel > 5} { log local0. "Insertando Cabecera HTTP [X509::whole $cert]" }
clientside { HTTP::header replace ClientCert [b64encode [X509::whole $cert]] }
}
}
the article about HTTP::collect mentions some limits or at least warnings about not collecting too much data.
https://devcentral.f5.com/wiki/iRules.HTTP__collect.ashx
do you really require that HTTP::collect command? i have requested client certificates fine with just the SSL client profile.
- Stanislas_Piro2
Cumulonimbus
Hi,
you are working with global variables which is deprecated.
replace all ::requestcert by requestcert in all irule
replace all $::log level by $static::loglevel
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com