For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ed_Vitale_28327's avatar
Ed_Vitale_28327
Icon for Nimbostratus rankNimbostratus
Nov 18, 2005

uri scheme

What is the best way to extract the uri scheme (http(s))?

 

 

im using ssl on nonstandard ports and need to pass the protocol back to the app in with a header insert.

 

 

https://app-a.foo.com:8080 or http://app-b.foo.com

 

 

header insert required is

 

HTTP::header insert BIG-IP-PROTOCOL [???]

 

 

Thanks

 

Ed

 

 

ps: im a newbie.
application delivery
dev
devops
iRules

7 Replies

  • Ed_Vitale_28327's avatar
    Ed_Vitale_28327
    Icon for Nimbostratus rankNimbostratus
    Nov 18, 2005
    tcp local port provides the incoming port used,

     

    but not the uri scheme.

     

     

    wont tell me if its http or https.
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Nov 18, 2005
    Sorry, misunderstood your question. Check out this post:

     

     

    http://devcentral.f5.com/Default.aspx?tabid=28&view=topic&forumid=5&postid=1258 Click here
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Nov 18, 2005
    You could also do a TCP::collect and look for the various SSL handshake signatures immediately following the TCP header:

     

     

    0x010002 (SSL version 2)

     

    0x160300 (SSL version 3)

     

    0x160301 (TLS version 1)

     

     

    My captures show SSLv2 signature at tcp offset 23 and SSLv3/TLSv1 signatures at tcp offset 21

     

     

    HTH
  • unRuleY_95363's avatar
    unRuleY_95363
    Historic F5 Account
    Nov 18, 2005
    Assuming you are terminating the SSL on the BIGIP (which you must be since you are inserting an HTTP header), you can also do something like:
    when HTTP_REQUEST {
   if {[catch {PROFILE::clientssl mode}] == 0} {
      set scheme HTTPS
   } else {
      set scheme HTTP
   }
   HTTP::header insert BIGIP-PROTOCOL $scheme
}

    This sets the scheme variable based on whether or not a clientssl profile is configured on the current virtual.