Forum Discussion

Micros_88999's avatar
Micros_88999
Icon for Nimbostratus rankNimbostratus
Oct 17, 2014
Solved

LTM check http or https the request and make action to it

Hello,

 

I have the following iRule, but I would like to make an extra check. If it is coming via http I want to drop it but if it comes via https I would like to allow it.

 

if { ( [ string tolower [HTTP::uri]] contains "/rest/reservationservice" ) } then { drop }

 

Please let me know if you have any suggestion.

 

Best Regards,

 

Csaba

 

application delivery
devops
iRules
LTM
  • BinaryCanary_19's avatar
    BinaryCanary_19
    Oct 17, 2014

    Create a virtual server that listens on the specified IP address, Port 80, and attach that irule to it. Add a redirect for the HTTPS version in an else clause.

    Pseudocode example:

     if (uri_matches) {
    redirect to port 443
 } else {
    accept request (do nothing)
 }

    You can also use a condition that checks for "TCP::local_port clientside" and reject if you get 80 (or whatever port your non-HTTP service is listening on).

    Pseudocode example

    if (TCP::local_port eq "80" and uri_matches) { 
   redirect
}

    I'm not aware of a way to ask the question "is this an SSL connection"? Others can chime in if they have better ideas.

2 Replies

Sort By
  • BinaryCanary_19's avatar
    BinaryCanary_19
    Historic F5 Account
    Oct 17, 2014

    Create a virtual server that listens on the specified IP address, Port 80, and attach that irule to it. Add a redirect for the HTTPS version in an else clause.

    Pseudocode example:

     if (uri_matches) {
    redirect to port 443
 } else {
    accept request (do nothing)
 }

    You can also use a condition that checks for "TCP::local_port clientside" and reject if you get 80 (or whatever port your non-HTTP service is listening on).

    Pseudocode example

    if (TCP::local_port eq "80" and uri_matches) { 
   redirect
}

    I'm not aware of a way to ask the question "is this an SSL connection"? Others can chime in if they have better ideas.

    • Micros_88999's avatar
      Micros_88999
      Icon for Nimbostratus rankNimbostratus
      Oct 17, 2014
      Hello, Thanks for the replay. The (TCP::local_port eq "80" and uri_matches) was a good idea for me. Thanks for it again. Best Regards, Csaba