Forum Discussion
StephenGonsalv1
Nimbostratus
Jan 22, 2018Irule Clubbing due to TCL errors.
Hi Guys, Need help to combine these irules. Code when HTTP_REQUEST { set http_uri [string tolower [HTTP::uri]] switch -glob ${http_uri} { "/ib/*" { } "/robots.txt" { } "/favicon.ico" { } "...
JG
Cumulonimbus
Jan 24, 2018I have combined all your irules into one:
when CLIENT_ACCEPTED {
set static::expires [clock scan "1 year"]
}
when HTTP_REQUEST {
set version [SSL::cipher version]
set cipher [SSL::cipher name]
set oldsite [HTTP::host]
set encode [b64encode $oldsite]
Check for less than TLSv1.2. This prevents SSLv2, SSLv3, TLSv1, and TLSv1.1 (TLSv1.0 is returned as TLSv1 by [SSL::cipher version]).
switch -glob $version {
"TLSv1.2" {
do nothing
}
default {
When browser cannot negotiate at least TLSv1.2
redirect to an unencrypted page with an informational error.
Set cache control headers to prevent proxies from caching the response.
The cache control headers shouldn't be necessary for a 302,
but it doesn't do any harm setting them.
HTTP::respond 302 Location "http://y.y.y.y.com/?$encode" Cache-Control No-Cache Pragma No-Cache Connection Close
return
Log details of the SSL handshake and browser user-agent
Consider using High Speed Logging instead to improve performance: https://devcentral.f5.com/wiki/iRules.hsl.ashx
log local0. "[IP::client_addr]:[TCP::client_port]:\
\[SSL::cipher version\]: [SSL::cipher version],\
\[SSL::cipher name\]: [SSL::cipher name],\
\[SSL::cipher bits\]: [SSL::cipher bits],\
U-A: [HTTP::header User-Agent]"
}
}
set http_uri [string tolower [HTTP::uri]]
switch -glob ${http_uri} {
"/ib/*" {
do nothing
}
"/robots.txt" {
do nothing
}
"/favicon.ico" {
do nothing
}
"/sitecore*" } {
HTTP::respond 301 Location "https://[HTTP::host]" Connection Close
return
}
"/rsabackchannel/hbibservice.svc" {
if { [class match [IP::client_addr] equals FynSin_IPs] } {
do nothing
} else {
HTTP::respond 301 noserver Location "https://x.x.x.x.com" Connection Close
return
}
} default {
HTTP::respond 301 noserver Location "https://x.x.x.x.com" Connection Close
return
}
}
}
when HTTP_RESPONSE {
Remove all instances of the Server header
HTTP::header remove Server
Remove all headers starting with x- (i.e. X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version)
foreach header_name [HTTP::header names] {
if {[string match -nocase x-* $header_name]}{
HTTP::header remove $header_name
}
}
if { [IP::client_addr] starts_with 10. } {
Do nothing.
} else {
HTTP::header insert Strict-Transport-Security "max-age=[expr {$static::expires - [clock seconds]}];"
}
}
when CACHE_RESPONSE {
CACHE::expire
}
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects