For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Blair_Murray_10's avatar
Blair_Murray_10
Icon for Nimbostratus rankNimbostratus
Feb 24, 2014

iRule not working with 11.4

We have an iRule that was working fine on our LTM with 11.1. We are in the process of upgrading our System to 11.4 , when I make the LTM running this newer code the active member this iRule will not allow connections. I am seeing the failure at CLIENTSSL_HANDSHAKE

 

IS there anything with 11.4 that would treat this iRule differently or any suggestions?

 

ACME Production Site iRule - CompanyX.ACME.SSO SSL Profile (Client) - CompanyXACME Client SSL Profiles - Name - CompanyXACME Parent Profile - clientssl Certificate - acme.companyx.com Key - acme.companyx.com Parent Profile - clientssl Client Certificate - ignore Data Group - CompanyX_ACME_NonClientCertificate Type - Address Address Records - 10.20.0.0/255.255.0.0 10.21.0.0/255.255.0.0 Data Group - CompanyX.ACME.SSO Type - String String Records /companyxfe/custom/login/acme/seamlesslogin.action

when HTTP_REQUEST { set CookiePresent 0 set ClientCertificatePresent 0

 

if { [HTTP::cookie exists "IV-USER"] } { set CookiePresent 1 }

if { not [matchclass [IP::remote_addr] equals CompanyX_ACME_NonClientCertificate ] } {
    if { [matchclass [HTTP::uri] starts_with CompanyX.ACME.SSO] } {
        HTTP::collect
        SSL::authenticate once
        SSL::authenticate depth 9
        SSL::cert mode request
        SSL::renegotiate
    }
}

}

 

when CLIENTSSL_HANDSHAKE { HTTP::release }

 

when CLIENTSSL_CLIENTCERT { if { [SSL::cert count] > 0 } { set ClientCertificatePresent 1 set IVUSER [substr [X509::subject [SSL::cert 0]] 3 ","] } }

 

when HTTP_REQUEST_SEND { clientside { if { $CookiePresent eq 0 and $ClientCertificatePresent eq 1 } { HTTP::cookie insert name "IV-USER" value $IVUSER } } }

 

when HTTP_RESPONSE { if { $CookiePresent eq 0 and $ClientCertificatePresent eq 1 } { HTTP::header insert Set-Cookie "IV-USER=$IVUSER; Path=/" } }

 

application delivery
devops
iRules
LTM

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Feb 24, 2014

    Move you HTTP::release command to the CLIENTSSL_CLIENTCERT event.

    when CLIENTSSL_CLIENTCERT { 
    if { [SSL::cert count] > 0 } {
        set ClientCertificatePresent 1 
        set IVUSER [substr [X509::subject [SSL::cert 0]] 3 ","]
        HTTP::release
    } 
}
when HTTP_REQUEST { 
    set CookiePresent 0 
    set ClientCertificatePresent 0

    if { [HTTP::cookie exists "IV-USER"] } { 
        set CookiePresent 1 
    }

    if { not [matchclass [IP::remote_addr] equals CompanyX_ACME_NonClientCertificate ] } {
        if { [matchclass [HTTP::uri] starts_with CompanyX.ACME.SSO] } {
            HTTP::collect
            SSL::authenticate once
            SSL::authenticate depth 9
            SSL::cert mode request
            SSL::renegotiate
        }
    }
}
when HTTP_REQUEST_SEND {
    clientside { 
        if { $CookiePresent eq 0 and $ClientCertificatePresent eq 1 } {
            HTTP::cookie insert name "IV-USER" value $IVUSER 
        } 
    } 
}
when HTTP_RESPONSE {
    if { $CookiePresent eq 0 and $ClientCertificatePresent eq 1 } { 
        HTTP::header insert Set-Cookie "IV-USER=$IVUSER; Path=/" 
    } 
}