For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

bongshanks's avatar
bongshanks
Icon for Nimbostratus rankNimbostratus
Dec 26, 2017

Scan command and variables in a SSL transaction

Hey folks, I'm trying to finish an iRule and I'd appreciate some critiquing or advice. I'm trying to capture some client IP/SSL cipher information as well as a 23 character string of text that will...
BIG-IP
iRules
security
nitass_89166's avatar
nitass_89166
Icon for Noctilucent rankNoctilucent
Dec 27, 2017

Does scan perform the same search action as a regex?

can you try something like this?

// config

[root@ve13a:Active:In Sync] config  tmsh list ltm rule qux
ltm rule qux {
when CLIENT_ACCEPTED {
  log local0. "SSL_CUSTOM: Connection of Client Source IP: [IP::client_addr]:[TCP::client_port]<-->[virtual name]<-->[LB::server]"
}
when CLIENTSSL_HANDSHAKE {
  if { [SSL::cipher bits] > 0 } then {
    log local0. "Client: [IP::client_addr] is using [SSL::cipher version]. SSL Cipher:[SSL::cipher name]. Virtual:[virtual]. SSL Profile:[PROFILE::clientssl name]."
    SSL::collect
  }
}
when CLIENTSSL_DATA {
  log local0. "\[SSL::payload\] is [SSL::payload]"
  if { [regexp {(\d{8})(\d{15})} [SSL::payload] -> tid mid] } {
    log local0. "tid=$tid mid=$mid"
  }
  SSL::release
}
}

// client

 (echo abc123xyz16021201334440212201602ijk987) |openssl s_client -connect 172.28.24.10:443 >& /dev/null

// log

[root@ve13a:Active:In Sync] config  tail -f /var/log/ltm
Dec 27 11:24:53 ve13a info tmm[17969]: Rule /Common/qux : SSL_CUSTOM: Connection of Client Source IP: 172.28.24.1:32824<-->/Common/bar<-->/Common/foo 0
Dec 27 11:24:53 ve13a info tmm[17969]: Rule /Common/qux : Client: 172.28.24.1 is using TLSv1.2. SSL Cipher:ECDHE-RSA-AES128-GCM-SHA256. Virtual:/Common/bar. SSL Profile:/Common/clientssl.
Dec 27 11:24:53 ve13a info tmm[17969]: Rule /Common/qux : [SSL::payload] is abc123xyz16021201334440212201602ijk987
Dec 27 11:24:53 ve13a info tmm[17969]: Rule /Common/qux : tid=16021201 mid=334440212201602
bongshanks's avatar
bongshanks
Icon for Nimbostratus rankNimbostratus
Dec 27, 2017

I'll try that in the next change window in a week

This is my first iteration that I wanted to try

when CLIENTSSL_DATA {
set payload [SSL::payload] 
set combo ""
set tid ""
set mid ""
regexp ([0-9]{8}[0-9]{15}){1} $payload combo 
set tid [string range $combo 0 7]
set mid [string range $combo 8 end]