Forum Discussion
NimbostratusSSLv3 iRule reply with nice error
Hi All,
I am trying to write an iRule that will return a nice error message to the user if they attempt to use the SSLv3 protocol, however I don't know how to do the message part. Can some please help/provide guidance?
This is what I have at the moment:
when CLIENT_ACCEPTED {
SSL::disable
TCP::collect
}
when CLIENT_DATA {
binary scan [TCP::payload] cS rtype sslver
log local0. "SSL Record Type $rtype, Version: $sslver"
BLOCK SSLV3
if { $sslver <= 768 } {
set SSLBlock 1
Need to add message here
} else {
SSL::enable
TCP::release
}
}
Thanks in advance Nick
3 Replies
Amit_KarnikSSL is a lower level protocol, so the "nice error message" which you are referring to has to be at the application layer and it will depend on the application protocl in question.
If (most typically) your application protocol is http then you could just use the CLIENTSSL_HANDSHAKE event to flag that the protocol version negotiated was SSLv3.
Then in the HTTP_REQUEST event on the 1st incoming request you can dish out or redirect (to) a nice error message page.
Note that this means that the SSLv3 should be enabled in your profile to let the handshake succeed.
mimlo_61970Cumulonimbus
The only way you are going to be able to send a message to the client is to allow SSL to complete the handshake with SSLv3 and then send the message. Without the SSL layer completed, HTTP events are not going to be applicable.
Based on this article https://devcentral.f5.com/wiki/iRules.RedirectOnWeakEncryption.ashx I worked up the following, which can probably be tightened up by making sure no backend resources are ever assigned and so on, but illistrates a basic example.
when HTTP_REQUEST { if { [SSL::cipher version] eq "SSLv3" } { HTTP::respond 302 Location "http://weakencryption" } }Tested using openssl s_client
openssl s_client -connect 10.0.0.1:443 -ssl3 --- ssl handshake omitted --- GET / HTTP/1.0 302 Found Location: http://weakencryption Server: BigIP Connection: close Content-Length: 0and with tls
openssl s_client -connect 10.0.0.1:443 -tls1 --- ssl handshake omitted --- GET / Hello World! closed
nickt9999_11997Thanks for the replies, I have SSLv3 disabled in my client profile. from your replies it looks like I cant do what I wanted, which was to intercept SSLv3 requests before the handshake and redirect/reply.
Cheers NIck
