6.7. Inspection Service Port Remap in non-Topology Configurations

6.7.1. What it is

When port remap is applied to an inspection service, it is supported by an iRule that is automatically generated and added to the main topology virtual server. This iRule will have the -port_remap name suffix and can be found attached to the -in-t virtual server(s) of a topology configuration. However, if an inspection service is created outside of a topology workflow, either by creating directly with its “mini workflow”, or via the “existing application” topology (where there is no topology virtual server), this iRule will not get created, thus the port remap will not function in those scenarios.

To allow port remap to function for an inspection service in these situations, it is necessary to manually create this iRule and add it to the primary traffic virtual server that contains the SSL Orchestrator policy.

6.7.2. How to build it

The iRule, applied to the traffic virtual server that contains the SSL Orchestrator policy, will trigger the CONNECTOR_OPEN event at the insertion point of each inspection service. Inside this event, the CONNECTOR::remap command will set up the port remap:

CONNECTOR::remap server_port 8080

A very simple implementation of this iRule, with a single inspection service, could then look like this:

when CONNECTOR_OPEN {
    CONNECTOR::remap server_port 8080
}

When there are multiple services, each with different port remap requirements, the CONNECTOR::profile value can be read to make a logical remap decision (based on the full path of the connector profile):

when CONNECTOR_OPEN {
    set connector_profile [CONNECTOR::profile]

    switch -glob -- $connector_profile {
        "/Common/ssloS_MYSERVICE1.app/ssloS_MYSERVICE1-t-*" {
            CONNECTOR::remap server_port 8080
        }
        "/Common/ssloS_MYSERVICE2.app/ssloS_MYSERVICE2-t-*" {
            CONNECTOR::remap server_port 8181
        }
    }
}

The SSL Orchestrator configuration intentionally only performs a port remap on decrypted HTTPS traffic. This involves checking for a TLS handshake and an l7_proto value of “https” before performing the port remap. A slightly modified version of the auto-generated iRule follows:

when RULE_INIT {
    set static::SERVICE_NAME "MYSERVICE"
}

when CLIENT_ACCEPTED {
    # add new variable
    set cl_ssl_enabled 0
}

when CLIENTSSL_HANDSHAKE {
    # set the cl_ssl_enabled flag if not bypassed
    set cl_ssl_enabled 1
}

when CONNECTOR_OPEN {
    set connector_profile [CONNECTOR::profile]
    if { [ catch { set l7_proto [L7CHECK::protocol get] } ] } {
        # no L7CHECK filter
        if { [PROFILE::exists http] } {
            if { [PROFILE::exists clientssl] } {
                set l7_proto "https"
            } else {
                set l7_proto "http"
            }
        } else {
            set l7_proto "unknown"
        }
    }
    if { ( $connector_profile eq "/Common/ssloS_${static::SERVICE_NAME}.app/ssloS_${static::SERVICE_NAME}-t-4-connector"
        || $connector_profile eq "/Common/ssloS_${static::SERVICE_NAME}.app/ssloS_${static::SERVICE_NAME}-t-6-connector" )
        && $cl_ssl_enabled == 1 && ( $l7_proto eq "https" || $l7_proto eq "http-connect" ) } {
        if { [info exists ctx] && [info exists ctx(log)] && $ctx(log) > 1 } {
            ACCESS::log ssl-orchestrator.debug "[virtual] CONNECTOR_OPEN from [IP::client_addr]_[TCP::client_port] to [IP::local_addr]_[TCP::local_port] $connector_profile remap server port to 8080"
        }
        CONNECTOR::remap server_port 8080
    }
}

Additional details on the CONNECTOR commands can be found here: https://clouddocs.f5.com/api/irules/CONNECTOR.html