For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

bizooga's avatar
bizooga
Icon for Nimbostratus rankNimbostratus
Jun 07, 2016

iRule to selectively perform server side encryption based on URL and/or URI

I am currently running SSL offloading on my BIGIP. I was wondering if it would be possible to do server side encryption only for a specific URL and/or URI using an iRule? If so, does anyone have any examples they could share?

 

I don't want to do SSL bridging for all my traffic just for a single exception URL and/or URI

 

Thanks,

 

Kevin

 

application delivery
iRules
LTM

5 Replies

  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Jun 07, 2016

    Hi,

    You have to put a Serverssl profile first on your Virtual Server and then put a similar irule in place : 

    when HTTP_REQUEST {
    if { !([HTTP::uri] contains "/myexception/uri") } {
       SSL::disable serverside
    }
}
  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Jun 07, 2016

    CLASS_URI is the datagroup that contains the list of URI for which you need server-side SSL encryption. I am using "NOT" logic to disable server-side SSL encryption.

    Try this (untested):

    when HTTP_REQUEST {
    if { not ([class match [HTTP::uri] eq CLASS_URI]) } {
         SSL::disable serverside
    }

}
  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Jun 08, 2016

    Hi,

    You are right, please find below an example : 

    when HTTP_REQUEST {
    if { !([HTTP::uri] contains "/myexception/uri") } {
       SSL::disable serverside
    } else {
        pool my_ssl_pool
    }
}
  • bizooga's avatar
    bizooga
    Icon for Nimbostratus rankNimbostratus
    Jun 08, 2016

    How about this?

    when HTTP_REQUEST {
if { !([HTTP::uri] contains "/myexception/uri") } {
   SSL::enable serverside
   pool my_ssl_pool
} else {
    pool non_ssl_pool
    SSL: disable serverside
}
}
  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Jun 08, 2016

    Hi,

    In that case, just remove the "!" in the if condition : 

    when HTTP_REQUEST {
    if { [HTTP::uri] contains "/myexception/uri" } {
       SSL::enable serverside
       pool my_ssl_pool
    } else {
        SSL:disable serverside
        pool non_ssl_pool
    }
}