Forum Discussion

aonsux_5649's avatar
aonsux_5649
Icon for Nimbostratus rankNimbostratus
Mar 09, 2010

Modify http header to send carriage returns

Hi all,

 

 

we need to ensure that an application is getting a complete certificate in the http header. The only problem is that I also need the right format for the cert.

 

This should be the format:

 

----Begin Certificate-----

 

asdlkfjsdfjlksdjflksdjfklsdjf

 

asldkjflskdjflasdjflksjflasjk

 

asdlkfjsdfjlksdjflksdjfklsdjf

 

asldkjflskdjflasdjflksjflasjk

 

asdlkfjsdfjlksdjflksdjfklsdjf

 

asldkjflskdjflasdjflksjflasjk

 

asdlkfjsdfjlksdjflksdjfklsdjf

 

asldkjflskdjflasdjflksjflasjk

 

------End of Certificate-----

 

 

The F5 box is sending it in this format:

 

 

----Begin Certificate----- asdlkfjsdfjlksdjflksdjfklsdjf asldkjflskdjflasdjflksjflasjk asdlkfjsdfjlksdjflksdjfklsdjf asldkjflskdjflasdjflksjflasjk sdlkfjsdfjlksdjflksdjfklsdjf asldkjflskdjflasdjflksjflasjk asdlkfjsdfjlksdjflksdjfklsdjf asldkjflskdjflasdjflksjflasjk ------End of Certificate-----

 

 

We tried to replace the space with cr but the Irule is not working.

 

The iRule:

 

when RULE_INIT {

 

 

Session timeout. Length of time (in seconds) to store the client cert in the session table.

 

set ::session_timeout 3600

 

 

SSL::sessionid returns 64 0's if the session ID doesn't exist, so set a to check for this

 

set ::null_sessionid [string repeat 0 64]

 

}

 

when CLIENTSSL_CLIENTCERT {

 

if { [SSL::cert count] > 0 } {

 

Add the cert to the session table for use in subsequent HTTP requests. Use the SSL session ID as the key.

 

log "SSL_shops CLIENTSSL_CLIENTCERT"

 

session add ssl [SSL::sessionid] [X509::whole [SSL::cert 0]] $::session_timeout

 

}

 

}

 

 

I need a solution to get the carriage returns in my header because I can´t rewrite the application in the backend and it needs the cert for authentication.

 

 

best regards,

 

aonsux
application delivery
dev
devops
iRules
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 09, 2010
    Hi aonsux,

     

     

    You cannot have raw carriage returns in an HTTP header value as this is the delimiter between headers. You can URL encode the cert before storing it in the session table. The web app should URL decode it before trying to parse the value.

     

     

    session add ssl [SSL::sessionid] [URI::encode [X509::whole [SSL::cert 0]]] $::session_timeout

     

     

    Adding the cert URI encoded to the session table takes more memory, but saves on having to do the encoding on each HTTP request using the same SSL session ID.

     

     

    If there are problems with URL encoding, you might try base64 encoding the value. This assumes the app can be changed to base64 decode the header value.

     

     

    Aaron