ABOUT DEVCENTRAL

DevCentral News Technical Forum Technical Articles Technical CrowdSRC Community Guidelines DevCentral EULA Get a Developer Lab License Become a DevCentral MVP

RESOURCES

Product Documentation White Papers Glossary Customer Stories Webinars Free Online Courses F5 Certification LearnF5 Training

SUPPORT

Manage Subscriptions Professional Services Professional Services Create a Service Request Software Downloads Support Portal

PARTNERS

Find a Reseller Partner Technology Alliances Become an F5 Partner Login to Partner Central

---

©2024 F5, Inc. All rights reserved.

Problem this snippet solves:

Summary: Allows certain applications to use the HTTP proxy which normally otherwise do not have way to point to the proxy

Contribution

• Bhattman at gmail dot com (original version)
• michel.belleau at malaiwah dot com (updated version with fixes for more generic protocol support, i.e.: protocols that do not wait for servers answer to request)

Use Case

Blackberry Enterprise Server does not have proxy settings. However, it does need to access Blackberry BES system on the internet. Thus it can then simply aim a particular IP address either via hostname or the application itself. The IP Address in this case is a :any VIP. The VIP will run the iRule below. The VIP will contain a pool associated to SQUID or Ironport OR Webtrends OR Bluecoat proxy.

Please post questions or fixes for this iRule in iRules forum to get the fastest response

Code :

# Tested on v10.2 version and up\n\nwhen RULE_INIT {\n    # Change to \"1\" to enable debugging log statements\n    set static::proxydebug 0\n}\n\nwhen CLIENT_ACCEPTED {\n    if { $static::proxydebug != 0 } { log local0. \"Client connected\" }\n    set bypass 0\n    set bufferdata \"\"\n    #  0 to make sure the server-side connection is opened right away\n    TCP::collect 0 0\n}\n\nwhen CLIENT_DATA {\n    if { $static::proxydebug != 0 } { log local0. \"CLIENT_DATA before is |[TCP::payload]|\" }\n    \n    # accumulate until ready, release when connected\n    if { $bypass eq 1 } {\n         TCP::payload replace 0 [string length $bufferdata] \"\"\n        TCP::release   \n        return\n    }\n    set bufferdata [TCP::payload]\n    TCP::collect\n}\n\nwhen SERVER_CONNECTED {\n    serverside {TCP::respond \"CONNECT :[TCP::local_port clientside] HTTP/1.0\\r\\n\\r\\n\"}\n    TCP::collect\n}\n\nwhen SERVER_DATA {\n    if { $bypass eq 1 } {\n        TCP::release\n        return\n    }\n    if { $static::proxydebug != 0 } { log local0. \"PAYLOAD before is |[TCP::payload]|\" }\n\n    # You might need HTTP/1.1 for your proxy, my version of squid was 1.0 \n    if { [TCP::payload] starts_with \"HTTP/1.0 200 Connection established\\r\\n\\r\\n\" } {\n        TCP::payload replace 0 39 \"\"\n        if { $static::proxydebug != 0 } { log local0. \"PAYLOAD after is |[TCP::payload]|\" }\n\n        TCP::respond $bufferdata\n        TCP::release\n         \n        set bypass 1\n\n    } else {\n        TCP::close\n    }  \n}

Tested this on version:

Problem this snippet solves:

Summary: Allows certain applications to use the HTTP proxy which normally otherwise do not have way to point to the proxy

Contribution

• Bhattman at gmail dot com (original version)
• michel.belleau at malaiwah dot com (updated version with fixes for more generic protocol support, i.e.: protocols that do not wait for servers answer to request)

Use Case

Blackberry Enterprise Server does not have proxy settings. However, it does need to access Blackberry BES system on the internet. Thus it can then simply aim a particular IP address either via hostname or the application itself. The IP Address in this case is a :any VIP. The VIP will run the iRule below. The VIP will contain a pool associated to SQUID or Ironport OR Webtrends OR Bluecoat proxy.

Please post questions or fixes for this iRule in iRules forum to get the fastest response

Code :

# Tested on v10.2 version and up\n\nwhen RULE_INIT {\n    # Change to \"1\" to enable debugging log statements\n    set static::proxydebug 0\n}\n\nwhen CLIENT_ACCEPTED {\n    if { $static::proxydebug != 0 } { log local0. \"Client connected\" }\n    set bypass 0\n    set bufferdata \"\"\n    #  0 to make sure the server-side connection is opened right away\n    TCP::collect 0 0\n}\n\nwhen CLIENT_DATA {\n    if { $static::proxydebug != 0 } { log local0. \"CLIENT_DATA before is |[TCP::payload]|\" }\n    \n    # accumulate until ready, release when connected\n    if { $bypass eq 1 } {\n         TCP::payload replace 0 [string length $bufferdata] \"\"\n        TCP::release   \n        return\n    }\n    set bufferdata [TCP::payload]\n    TCP::collect\n}\n\nwhen SERVER_CONNECTED {\n    serverside {TCP::respond \"CONNECT :[TCP::local_port clientside] HTTP/1.0\\r\\n\\r\\n\"}\n    TCP::collect\n}\n\nwhen SERVER_DATA {\n    if { $bypass eq 1 } {\n        TCP::release\n        return\n    }\n    if { $static::proxydebug != 0 } { log local0. \"PAYLOAD before is |[TCP::payload]|\" }\n\n    # You might need HTTP/1.1 for your proxy, my version of squid was 1.0 \n    if { [TCP::payload] starts_with \"HTTP/1.0 200 Connection established\\r\\n\\r\\n\" } {\n        TCP::payload replace 0 39 \"\"\n        if { $static::proxydebug != 0 } { log local0. \"PAYLOAD after is |[TCP::payload]|\" }\n\n        TCP::respond $bufferdata\n        TCP::release\n         \n        set bypass 1\n\n    } else {\n        TCP::close\n    }  \n}

Tested this on version:

I have not had any luck getting this code to work. Could you share information on the following:

• Is this code only useful to proxy http traffic?
• If https can also be proxied with this irule, could you share any details on the configuration required on the Virtual Server where this irule will be associated?

Thanks