Forum Discussion

Fernas's avatar
Fernas
Icon for Nimbostratus rankNimbostratus
Feb 28, 2024

Manipulating Hostname and SNI

Hello everyone,

 

I have this situation:

 

I need to access website (sitea.com), then i need the F5 replace the host and SNI by siteb.com, is it possible?

 

We are trying to use an iRule to manipulate this but we don't how to replace the SNI value in the request, and we are not sure if it in the request it should be done. We tried to use ssl server certificate with SNI configured but it didn't worked too.

 

Any ideas?

 

Best regards,

 

Fernando Duarte

  • Do you want to redirect URL from URL-A to URL-B or do you want to mask the URL so client can't see the other URL from where response is coming ?

  • There is no in-built functionality to send SNI value in serverside TLS connection as mentioned in https://my.f5.com/manage/s/article/K41600007

    But you can try with below iRule to replace HOST header and SNI value on the serverside connection. Please let us know how the testing goes.

     

    when HTTP_REQUEST {
     # Replace the host header value with siteb.com
    HTTP::header replace Host "siteb.com"
    set sni_value "siteb.com"
    }
    when SERVERSSL_CLIENTHELLO_SEND {
    # SNI extension record as defined in RFC 3546/3.1
    #
    # - TLS Extension Type                =  int16( 0 = SNI ) 
    # - TLS Extension Length              =  int16( $sni_length + 5 byte )
    #    - SNI Record Length              =  int16( $sni_length + 3 byte)
    #       - SNI Record Type             =   int8( 0 = HOST )
    #          - SNI Record Value Length  =  int16( $sni_length )
    #          - SNI Record Value         =    str( $sni_value )
    #
    # Calculate the length of the SNI value, Compute the SNI Record / TLS extension fields
    # and add the result to the SERVERSSL_CLIENTHELLO 
    SSL::extensions insert [binary format SSScSa* 0 [expr { [set sni_length [string length $sni_value]] + 5 }] [expr { $sni_length + 3 }] 0 $sni_length $sni_value]
    }

     

  • Try below if its a https

    when CLIENTSSL_HANDSHAKE {
        if { [SSL::extensions exists -type 0x00] } {
            # Replace SNI with siteb.com
            SSL::extensions insert -type 0x00 -value "siteb.com"
        }
    }

    when HTTP_REQUEST {
        if { [HTTP::host] eq "sitea.com" } {
            # Replace the Host header with siteb.com
            HTTP::header replace "Host" "siteb.com"
        }
    }