Forum Discussion
jan_carlin_4038
Nimbostratus
Sep 14, 2010Problem with turning SSL on again after having turned it off
Hi
I have a problem with turning SSL on after having turned it off, and disabled HTTP as well.
The situation is our client libraries for Flash goes thru this sequence to startup in SSL mode:
1. Get a helper swf in SSL mode and a new connection which is kept open
2. Get the cross-domain file in non-SSL mode in an additional connection
a) Sending exactly "[less-than]policy-file-request/[greater-than]\0" to our server. This is according to Adobe's spec.
b) Receive the XML snippet
c) Close this second connection
3. Open a new connection to transport application data.
This all works when running directly against our server. Running it thru BigIP using a virtual server with an off-the-shelf http profile and a custom SSL profile to activate SSL off-loading causes the client to send an alert saying that it wants to close the connection, presumably because the SSL hand shake didn't work.
The iRule is:
when CLIENT_ACCEPTED {
TCP::collect
}
when CLIENTSSL_HANDSHAKE {
if { [SSL::mode] == 0} {
HTTP::enable
SSL::enable
}
}
when CLIENT_DATA {
TCP::collect
if {[TCP::payload] contains ""} {
log "Found policy file/ Disabling SSL [TCP::payload]"
SSL::disable
HTTP::disable
} else {
log "Standard packet"
HTTP::enable
SSL::enable
}
TCP::release
TCP::collect
}
when SERVER_CONNECTED {
TCP::collect
}
when SERVER_DATA {
if {[TCP::payload] contains ""} {
log "Found cross-domain file: [TCP::payload]"
}
TCP::release
}
I believe I must have HTTP on to be able to turn on SSL. That has been my experience also. I get an error saying "Unknown error invoked from within SSL::enable" if I don't have it on before I do SSL:enable.
I need SSL off after sending the [less-than]policy-file-request/[greater-than];. It's mandated by Adobe. Then I need it on again after that the purpose of our application data.
Please help
--JanNo RepliesBe the first to reply
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects