cancel
Showing results for 
Search instead for 
Did you mean: 

what's wrong with my syntax in this iRule?

Ken-Dawg
Nimbostratus
Nimbostratus

I want to write and iRule to key on a source IP and log the pre-shared master keys:
when CLIENT_ACCEPTED {
if { [IP::addr [IP::client_addr] equals 10.10.10.10] } {
when CLIENTSSL_HANDSHAKE {
log local0. "[TCP::client_port] :: RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
}
when SERVERSSL_HANDSHAKE {
log local0. "[TCP::client_port] :: RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
}
}

2 ACCEPTED SOLUTIONS

Kevin_Stewart
F5 Employee
F5 Employee

Can't have iRule events nested inside other events.

 

when CLIENTSSL_HANDSHAKE {
    if { [IP::addr [IP::client_addr] equals 10.10.10.10] } {
        log local0. "[TCP::client_port] :: RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
    }
}

when SERVERSSL_HANDSHAKE {
    if { [IP::addr [IP::client_addr] equals 10.10.10.10] } {
        log local0. "[TCP::client_port] :: RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
    }
}

 

View solution in original post

Just do this in the server side event to see what the client IP is:

when SERVERSSL_HANDSHAKE {
    log local0. "client IP: [IP::client_addr]"
    if { [IP::addr [IP::client_addr] equals 10.10.10.10] } {
        log local0. "[TCP::client_port] :: RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
    }
}

View solution in original post

5 REPLIES 5

Kevin_Stewart
F5 Employee
F5 Employee

Can't have iRule events nested inside other events.

 

when CLIENTSSL_HANDSHAKE {
    if { [IP::addr [IP::client_addr] equals 10.10.10.10] } {
        log local0. "[TCP::client_port] :: RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
    }
}

when SERVERSSL_HANDSHAKE {
    if { [IP::addr [IP::client_addr] equals 10.10.10.10] } {
        log local0. "[TCP::client_port] :: RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
    }
}

 

Thank you so much Kevin, although for my SERVERSSL_HANDSHAKE i think i should use my self IP? Unless the iRule only looks at the cs-client-addr?

You're saying, if the client source address is 10.10.10.10, log the client side session-id and server side session-id.

[IP::client_addr] is still the client source, even on the server side.

I tested it out and the client side worked, however the serverside did not. So i think I'll update the serverside with the self IP and see what i get. Thanks again Kevin!

Just do this in the server side event to see what the client IP is:

when SERVERSSL_HANDSHAKE {
    log local0. "client IP: [IP::client_addr]"
    if { [IP::addr [IP::client_addr] equals 10.10.10.10] } {
        log local0. "[TCP::client_port] :: RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
    }
}