Forum Discussion

jan_carlin_4038's avatar
jan_carlin_4038
Icon for Nimbostratus rankNimbostratus
Sep 14, 2010

Problem with turning SSL on again after having turned it off

Hi I have a problem with turning SSL on after having turned it off, and disabled HTTP as well. The situation is our client libraries for Flash goes thru this sequence to startup in SSL mode:

1. Get a helper swf in SSL mode and a new connection which is kept open
2. Get the cross-domain file in non-SSL mode in an additional connection 
    a) Sending exactly "[less-than]policy-file-request/[greater-than]\0" to our server. This is according to Adobe's spec.
    b) Receive the  XML snippet
    c) Close this second connection
3. Open a new connection to transport application data.
This all works when running directly against our server. Running it thru BigIP using a virtual server with an off-the-shelf http profile and a custom SSL profile to activate SSL off-loading causes the client to send an alert saying that it wants to close the connection, presumably because the SSL hand shake didn't work. The iRule is:
when CLIENT_ACCEPTED {
  TCP::collect
}
when CLIENTSSL_HANDSHAKE {
  if { [SSL::mode] == 0} {
    HTTP::enable
    SSL::enable
   }
}
when CLIENT_DATA {
  TCP::collect
  if {[TCP::payload] contains ""} {
    log "Found policy file/ Disabling SSL [TCP::payload]"
    SSL::disable
    HTTP::disable
  } else {
    log "Standard packet"
    HTTP::enable
    SSL::enable
}
  TCP::release
  TCP::collect
}
when SERVER_CONNECTED {
  TCP::collect
}
when SERVER_DATA {
  if {[TCP::payload] contains ""} {
    log "Found cross-domain file: [TCP::payload]"
  }
  TCP::release
}
I believe I must have HTTP on to be able to turn on SSL. That has been my experience also. I get an error saying "Unknown error invoked from within SSL::enable" if I don't have it on before I do SSL:enable. I need SSL off after sending the [less-than]policy-file-request/[greater-than];. It's mandated by Adobe. Then I need it on again after that the purpose of our application data. Please help --Jan
No RepliesBe the first to reply