Forum Discussion
NimbostratusLogging SSL information through iRule
Hello,
We are migrating an application in an older DC, but before doing so the application team would like to collect some information that they are unable to at the server level. We are offloading SSL to to the F5 running version 10.0.1, and I would like to log the client ip, ssl cipher name and version. The issue is not with the actual iRule as it works, but that it logs the same message for each step in the SSL handshake. I'm looking for a way to only log on the initial client hello packet as the corresponding event is not available for this version of code.
when CLIENTSSL_HANDSHAKE {
set hsl [HSL::open -proto UDP -pool Pool-Syslog]
HSL::send $hsl "Connection from Client: [IP::client_addr] with Cipher: [SSL::cipher name] and SSL Version: [SSL::cipher version]"
}
Any help would be greatly appreciated. This is more of a nuisance than a problem.
Thanks,
Zac
2 Replies
- Kevin_Stewart
Employee
An interesting question for sure. The CLIENTSSL_CLIENTHELLO command was introduced in 11.1.0, which would exactly trigger on the CLIENTHELLO message.
when CLIENTSSL_CLIENTHELLO { log local0. [IP::client_addr] log local0. [SSL::cipher name] log local0. [SSL::cipher version] }Just playing around with this, I found it a little odd that the above would actually produce values at all, given that the chosen cipher and version are dictated by the SERVERHELLO message. In any case, I would also argue that the CLIENTHELLO message is not a finite thing, and the client and server will likely continue to renegotiate SSL through the life of the session. I think if you need something to log only one time, then you should probably move that logic up the stack and maybe tie it to an application session (something like cookie existence perhaps).
- nitass
I would like to log the client ip, ssl cipher name and version.
just wondering what actual information you are looking for. if you want to know how many client is using each cipher/version, would table command be useful?
The TAO of Tables - Part Three by Kevin Davies
https://devcentral.f5.com/articles/the-tao-of-tables-part-three.UvXe37SjZQI
