SNI Based on IRule

How about something a little different, where you set the "tls_SNI_extension" based on what the client sends? Something like this:

when CLIENTSSL_HANDSHAKE {
    if { [SSL::extensions exists -type 0] } then {
        set tls_sni_extension [SSL::extensions -type 0]
    } else {
        set tls_sni_extension ""
    }
}
when SERVERSSL_CLIENTHELLO_SEND {
    if { $tls_sni_extension ne "" } then {
        SSL::extensions insert $tls_sni_extension
    }
}

Hi,

 

Kai Wilke wrote 2 codes available in codeshare section. the one provided above by RossVermette and another to insert SNI with server side hostname (if SNI is not included by the client).

 

Client side to server side SNI relay iRule

 

Serverside SNI injection iRule

 

Hi Murugs,

 

your iRule contains a old version of my SNI injection iRule. You may check out the links provided by Stanislas to get an optimized version...

 

Cheers, Kai

 

Thanks for the optimized version, I will definitely get it implemented.

 

My request is how do I make the SERVERSSL_CLIENTHELLO_SEND event fired for each HTTP Request irrespective of whether the request is coming from same browser session or not. The VS has only one HTTP host attached.

 

Hi Murugs,

to force an

SERVERSSL_CLIENTHELLO_SEND

event after each single

HTTP_REQUEST

event you would need to execute

[LB::detach]

on/after every single

HTTP_REQUEST

or

HTTP_RESPONSE

event. But this approach would hurt your overall performance and is absolutely NOT recommended...

I'd like to ask the question why do you need to do that?

You need SNI just to select a specific SSL cert on your web server. After the Server SSL handshake is completed, you can pump as many HTTP request over the established TCP connection / SSL session without the need to further manipulate server side SNI records.

Cheers, Kai