Irule for redirect to error page when the client request from weak ciphers

Hi Visvesh,

this is unfortunately not possible.

Browsers wouldn't speak HTTP before the SSL handshake is complete. Therefore you can't use

[HTTP::redirect]

in earlier stages to redirect to a friendly errorpage.

BTW: Are your sure that your outlined iRule is working? You're using a

&&

operator (aka. AND) to deny the different chipher suites, but the result can be always be just one of the values. An

||

operator (aka. OR) would make more sense. In this case only one of the listed weak-chiphers is needed to trigger the redirect...

Cheers, Kai

Thanks a lot for your response Kai...

 

I haven't tested this I-rule yet...As you suggested I will use "||" instead of "&&".

 

Also is there any way to enable the log with this irule for the blocked ciphers.

 

Regards Visvesh.

 

Hi Visvesh,

you can use the iRule below as a startingpoint.

It performs the chipher checks during

CLIENTSSL_HANDSHAKE

to speed up keep-alive sessions. And then just triggers the

[HTTP::redirect]

during

HTTP_REQUEST

to send the friendly error message...

when CLIENTSSL_HANDSHAKE {
    if { ( [SSL::cipher version] contains "SSL" ) or 
         ( [SSL::cipher name] contains "DES" ) or 
         ( [SSL::cipher name] contains "RC4" ) or
         ( [SSL::cipher bits] < 128 ) } then {
        log local0. "Denied SSL Handshake for Client [IP::client_addr]:[TCP::client_port] using [SSL::cipher version], [SSL::cipher name] and [SSL::cipher bits]"
        set invalid_ssl 1
    } else {
        set invalid_ssl 0
    }
}
when HTTP_REQUEST {
    if { $invalid_ssl } then {
        HTTP::redirect http://www.domain.de/errorpage.html
    }
}

You may also take a look to Stephans chipher sheet if you need to tweak the contained chipher values.

https://devcentral.f5.com/questions/tmos-ssl-tls-cipher-cheat-sheetanswer131007

Cheers, Kai

Hi Kai, Thanks for providing the irule.

 

What is invalid_ssl 1 and invalid_ssl 0 in Set syntax?

 

Also I see in the redirection it's used invalid_ssl not "invalid_ssl 1 and 0".

 

set invalid_ssl 1 } else { set invalid_ssl 0 }

 

Regards Visvesh.

 

Hi Visvesh,

the

set invalid_ssl 1

is a variable to store the result of the check. The name of the variable is free text and can be changed to whatever you want.

A

if { $invalid_ssl } then { ... }

is a little faster than

if { $invalid_ssl == 1 } then { ... }

but is performing the same. It will both trigger the contained

[HTTP::redirect]

action as long

$invalid_ssl

is set to 1.

Cheers, Kai

Thanks a lot Kei...I will test this irule and update you the results.

 

Regards Visvesh