SSL::enable/SSL::disable unexpected behaviour
I have a question about the specific bahaviour of LTM with regard to SSL::enable/SSL::disable.
I have a virtual server with two pools:
- One pool has a member that needs TLS communication;
- The other pool has a member that doesn't use TLS (i.e., it uses plain text HTTP).
The pool selection is based on the request URI (e.g., the first URI-path selects the pool).
I have a serverside SSL profile configured to my virtual server.
When I use the iRule below, the behaviour is not quite what I expected:
when HTTP_REQUEST {
if { } {
select the tls-pool: enable server side SSL
SSL::enable serverside
pool
}
else {
select the http-pool: disable server side SSL
SSL::disable serverside
pool
}
}
`
The observed behaviour is as follows:
- Client connects to virtual server (new TCP connection).
- Client issues a request that selects the http-pool. The http-pool member responds (confirmed: the 'SSL::disable' works).
- Over the same client TCP connection, the client issues a request that selects the tls-pool. The tls-pool member responds (confirmed: server side TLS is working).
-
Over the same client TCP connection, the client issues a request that selects the http-pool again. This fails!
A tcpdump reveals that LTM is sending a TLS Client Hello to the http pool member. The pool member responds with a '400 Bad Request', I get errors in /var/log/ltm:
`warning tmm2[1688]: 01260009:4: Connection error: ssl_null_parse:3177: record length too large (22) warning tmm2[1688]: 01260013:4: SSL Handshake failed for TCP 192.168.10.10:80 -> 192.168.10.1:50214 `
and the client side TCP connection is aborted (TCP RST).
When I rewrite my iRule to perform the 'SSL::enable' and 'SSL::disable' in a SERVER_CONNECTED event, all seems to work fine:
`when HTTP_REQUEST { if { } { set tls 1 pool } else { set tls 0 pool } } when SERVER_CONNECTED { if { $tls == 1 } { SSL::enable serverside } else { SSL::disable serverside } }
What is the difference? My guess is it has to do with attach/detach. But I seem to miss the subtle difference...