For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

SSL Renegotiation DOS iRule - Updates

There’s been a lot of commentary on the previous post (SSL Renegotiation DOS – an iRule Countermeasure).  Here are some of the updates and corrections. After the previous post went live, Jorge Or...
Published May 16, 2011
Version 1.0
security
us
Steven_87308's avatar
Steven_87308
Icon for Nimbostratus rankNimbostratus
Oct 15, 2013
We were trying to test this today and got a bit stuck. Is there an easy way to trigger say, 100 https sessions in a row? And where would the log be found -- can we specify the name? We were looking in /var/logs, but didn't see it show up in existing logs as we tried to trigger a test.

 

We began analyzing this today, for we suddenly began to get these messages in the GUI, constantly from the orginal version of the rule...

 

Mon Oct 14 13:05:15 CDT 2013 err LTM tmm[11044] 01220001 TCL error: /Common/irule_SSLRenegotiationDOSCountermeasure - can't read "flow": no such variable while executing "table delete -subtable reqrate:$flow -all"

 

Mon Oct 14 13:05:17 CDT 2013 err LTM tmm1[11044] 01220001 TCL error: /Common/irule_SSLRenegotiationDOSCountermeasure - no serverside connection established (line 1) invoked from within "IP::server_addr"