Forum Discussion
James_Thomson
Employee
Employeeselective re-encryption
I'm trying to have a vip with ssl acceleration enabled accept traffic, inspect it, if it is html, re-encrypt it and send it to a secure serverpool. If it is .gif, just send it to a port 80 pool.
I'm trying something like:
when CLIENTSSL_HANDSHAKE {
if {HTTP::uri ends_with "gif"} {
pool img_pool }
elseif {HTTP::uri ends_with "html" }
then use pool html_secure_pool}
I don't know what to use to re-encrypt the data to the secure server. Also, would I need to wait for HTTP_REQUEST after CLIENTSSL_HANDSHAKE or is that enough?
If I gave the vip a server ssl profile, could I then just parse out the gif's and just leave the rest alone?
Any help would be appreciated.
4 Replies
- This is what I think you want:
when HTTP_REQUEST { if {[HTTP::uri] ends_with "gif"} { pool img_pool } else { pool html_secure_pool } } when SERVER_CONNECTED { if {[TCP::remote_port] != 443} { SSL::disable } }
The above example is courtesy of drteeth.
You could even just put the html_secure_pool on the virtual and then remove the "else { pool html_secure_pool }" part of the rule since the pool on the virtual is considered the default pool. 
James_ThomsonI made the fallback pool the secure pool in the virtual.I have a clientssl and serverssl profile associated and an http profile associated as well.
With this rule:
when HTTP_REQUEST {
if {[HTTP::uri] contains "index3"} {
pool server2
serverside {SSL::disable}
}
}
I get this error in /var/log/ltm
Dec 9 22:21:28 tmm tmm[690]: 01220001:3: TCL error: Rule selective - Error: connection has no peer! (line 3) invoked from within "serverside {SSL::disable}"
Any ideas? Do I need to do anything with SSL::verify result?- James_ThomsonWith that last part, it got rid of the error and worked:
when HTTP_REQUEST {
if {[HTTP::uri] contains "index3"} {
pool server2
}
}
when SERVER_CONNECTED {
if {[TCP::remote_port] != 443} {
{SSL::disable}
}
}
Thanks for the help. - James_ThomsonWith that last part, it got rid of the error and worked:
when HTTP_REQUEST {
if {[HTTP::uri] contains "index3"} {
pool server2
}
}
when SERVER_CONNECTED {
if {[TCP::remote_port] != 443} {
{SSL::disable}
}
}
Thanks for the help.
