For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Andrea_Folco_11's avatar
Andrea_Folco_11
Icon for Nimbostratus rankNimbostratus
Mar 06, 2014

Some solutions for the proxypass iRules in section ProxyPassSSLProfiles

Hi, in the proxypass v10/v11 i have modify something in the proxypassSSLProfile section. I think is good create more then one datagroup with the sslprofile. I modified this section and corrected some issue. Now the users can create more then one ProxyPassSSLProfiles with sintax similar of the original proxypass. I have correct the string with findclass and use the new class functions.

 

The following code will look up SSL profile rules from 
the Data Group "ProxyPass[virtual server name]SSLProfiles" and apply them. 
The format of the entries in this list is as follows: 
  
All entries are separated by spaces, and both items 
are required.  The virtual server also will need to
have any serverssl profile applied to it for this to work.

   when SERVER_CONNECTED { 
if {$bypass} {
    return
}
    set class_exists_cmd "class exists ${clname}SSLProfiles"
if {! [eval $class_exists_cmd]} {
    return
}
set pool [LB::server pool]  
    regsub "^.*/" $pool "" pool
    regsub remove /Common/ in the  [LB::server pool]

    set profilename [class lookup $pool ${clname}SSLProfiles]


if {$profilename eq ""} { 
    if { [PROFILE::exists serverssl] == 1} {
         Hide this command from the iRule parser (in case no serverssl profile is applied) 
        set disable "SSL::disable serverside" 
        catch {eval $disable}
    }
    return 
}
if { $static::ProxyPassDebug > 0 } { 
    log local0. "$log_prefix: ServerSSL profile $profilename assigned for pool $pool"  
} 
if { [PROFILE::exists serverssl] == 1} {
     Hide these commands from the iRule parser (in case no serverssl profile is applied)
    set profile "SSL::profile $profilename"
    catch {eval $profile}
    set enable "SSL::enable $profilename" 
    catch {eval $enable}
} else {
    log local0. "$log_prefix: ServerSSL profile must be defined on virtual server to enable server-side encryption!"  
}
}
No RepliesBe the first to reply