For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Breeden_62's avatar
Mike_Breeden_62
Icon for Nimbostratus rankNimbostratus
Feb 05, 2015

SSL Client Irule Verification

We are having an issue I thinkg with this IRULE. It checks to see if client cert serial number matches and if it does it will allow traffic to pass. We know the serial numbers match however it logs t...
application delivery
devops
iRules
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Aug 10, 2016

Hi Cmiller,

 

the iRule should work fine. The problem of the OP is that the hardcoded serial number of "‎35:f3:82:5a:5f:29:c3:ee" contains the non-printable character sequence of %e2%80%8e (for whatever reason).

 

So basically his iRule compares visibly...

 

"35:f3:82:5a:5f:29:c3:ee" "‎35:f3:82:5a:5f:29:c3:ee"

 

... but the [if] command compares ...

 

%22%33%35%3a%66%33%3a%38%32%3a%35%61%3a%35%66%3a%32%39%3a%63%33%3a%65%65%22 %22%e2%80%8e%33%35%3a%66%33%3a%38%32%3a%35%61%3a%35%66%3a%32%39%3a%63%33%3a%65%65%22

 

... which is not "equals"

 

Note: Copy and paste the serial number of the original post (including "") into notepad and you'll notice the added character by skipping through each single char. At the beginning it will take two hits to move to the next character...

 

Cheers, Kai