There are three different scenarios involving the SAP Web Dispatcher (WDP) and HTTPS access: SSL Termination (in the WDP), SSL Re-encryption and End to End SSL. This blog will present the second scenario.

Prerequisites

  • SAP Web Dispatcher 7.20 or higher
  • SAPCRYPTOLIB 5.5.5 patch level 24 or higher (in this blog pl 32 is used)

Profile parameters

The standard SSL configuration demands the following three parameters:


ssl/ssl_lib     = <path>\sapcrypto.dll

ssl/server_pse  = <path>\SAPSSLS.pse

ssl/client_pse  = <path>\SAPSSLC.pse

As the WDP 7.20 or higher can connect to different systems, the following parameters were set:

wdisp/system_0 = SID=AAA, MSHOST=<FQDN1>, MSPORT=8100, SRCSRV=webdispatcher.foo.bar:10000

wdisp/system_1 = SID=BBB, MSHOST=<FQDN2>, MSPORT=8171, SRCSRV=webdispatcher.foo.bar:10001

The server ports also must be defined:

icm/server_port_0 = PROT=HTTP,PORT=9999

icm/server_port_1 = PROT=HTTPS,PORT=10000

icm/server_port_2 = PROT=HTTPS,PORT=10001


As the WDP will perform a re-encryption of the data, the parameter below must be set:

wdisp/ssl_encrypt = 1

At last, but not least, for testing purposes, the HTML dump into the trace will be enabled, along with a trace level 3. Important: the trace files will be HUGE! The parameters below should be set only for a quick test or for error analysis. The default trace level (i.e. 1) must be used in productive systems (and for security matters, the HTML dump should not be active).

icm/trace_secured_data = 1

rdisp/TRACE = 3


Checking the configuration

As soon as the profile file is saved, one can test the configuration by running:


sapwebdisp pf=sapwebdisp.pfl -checkconfig

No error message is expected (the result of the -checkconfig is the same as shown here)

The WDP is now ready to work!



Analyzing the scenario and the dev_webdisp trace file

Similar to other scenarios, the trace level 3 recorded in the dev_webdisp has plenty information. From a test calling a giving internet service (WEBGUI, for example) it is possible to see the moment the request reached the WDP:


“…

[Thr 6876] IcmWorkerThread: worker 2 got the semaphore

[Thr 6876] REQ TRACE BEGIN: 0/18/1

[Thr 6876] REQUEST:

    Type: ACCEPT_CONNECTION    Index = 2

[Thr 6876] CONNECTION (id=0/18):

    used: 1, type: default, role: Server(1), stateful: 0

    NI_HDL: 147, protocol: HTTPS(2)

    local host:  <WDP IP>:10000 ()

    remote host: <Client IP>:53691 ()

    status: NOP

    connect time: xx.zz.yyyy aa:bb:cc

    MPI request:        <0>      MPI response:        <0>  

request_buf_size:   0        response_buf_size:   0    

request_buf_used:   0        response_buf_used:   0    

request_buf_offset: 0 response_buf_offset: 0    

…”


Next it is possible to check the SSL handshake between the client and the server (WDP):

“…

[Thr 6876] ->> SapSSLSessionInit(&sssl_hdl=0000000002C5C6E0, role=2 (SERVER), auth_type=1 (ASK_CLIENT_CERT))

[Thr 6876] <<- SapSSLSessionInit()==SAP_O_K

[Thr 6876]      in: args = “role=2 (SERVER), auth_type=1 (ASK_CLIENT_CERT)”

[Thr 6876]     out: sssl_hdl = 0000000002D7D810

[Thr 6876] ->> SapSSLSetNiHdl(sssl_hdl=0000000002D7D810, ni_hdl=147)

[Thr 6876] NiIBlockMode: set blockmode for hdl 147 TRUE

[Thr 6876]   SSL NI-sock: local=<WDP IP>:10000 peer=<Client IP>:53691

[Thr 6876] <<- SapSSLSetNiHdl(sssl_hdl=0000000002D7D810, ni_hdl=147)==SAP_O_K

[Thr 6876] ->> SapSSLSessionStart(sssl_hdl=0000000002D7D810)

[Thr 6876] Server-configured Ciphersuites: “TLS_RSA_WITH_AES128_CBC_SHA:TLS_RSA_WITH_AES256_CBC_SHA:SSL_RSA_WITH_RC4_128_SHA:SSL_RSA_WITH_RC4_128_MD5:SSL_RSA_WITH_3DES_EDE_CBC_SHA:SSL_RSA_WITH_DES_CBC_SHA:SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:SSL_RSA_EXPORT_WITH_RC4_40_MD5”

[Thr 6876] Client-offered Ciphersuites: “TLS_RSA_WITH_AES128_CBC_SHA:TLS_RSA_WITH_AES256_CBC_SHA:SSL_RSA_WITH_RC4_128_SHA:SSL_RSA_WITH_3DES_EDE_CBC_SHA:SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA:SSL_RSA_WITH_RC4_128_MD5”

[Thr 6876]   No Client Certificate

[Thr 6876]   New session (TLSv1.0)

[Thr 6876]   HexDump of native SSL session ID { &buf= 0000000002D53EE4, buf_len= 32 }

[Thr 6876]    00000: 5f d1 b3 37 34 1f 33 fc  84 a5 d8 c3 01 4f fe b1   _..74.3. …..O..

[Thr 6876] 00010: 33 99 af e4 20 0f 1a 88  77 24 e2 2f 4a d8 64 c6   3… … w$./J.d.

[Thr 6876] <<- SapSSLSessionStart(sssl_hdl=0000000002D7D810)==SAP_O_K

[Thr 6876] status = “new SSL session, NO client cert”

…”


The request is then read from the connection:

“…

[Thr 6876] IcmReadFromConn(id=0/18): read 443 bytes, 1 readops (timeout 0)

[Thr 6876] Address Offset  IcmReadFromConn received

[Thr 6876] ————————————————————————

[Thr 6876] 0000000003F76058 000000  47455420 2f736170 2f62632f 6775692f |GET /sap/bc/gui/|

[Thr 6876] 0000000003F76068 000016  7361702f 6974732f 77656267 75692048 |sap/its/webgui H|

[Thr 6876] 0000000003F76078 000032  5454502f 312e310d 0a416363 6570743a |TTP/1.1..Accept:|

[Thr 6876] 0000000003F76088 000048  202a2f2a 0d0a4163 63657074 2d4c616e | */*..Accept-Lan|

…”

The WDP will reach the web application server ABAP via HTTPS:

“…

[Thr 6876] HttpPortTableMatchPort: Port 0, webdispatcher.foo.bar:10000 (<WDP IP>:10000) matches request

[Thr 6876] ICR: IcrFindTargetSystem(0000000002D614F0, ‘/sap/bc/gui/sap/its/webgui’ -> 0

[Thr 6876] HttpGetRouteTargetSystem: SID=’AAA’

[Thr 6876] ICT: IctLookupPathTable() -> 0

[Thr 6876] HTR: found stack ABAP for URL /sap/bc/gui/sap/its/webgui

[Thr 6876] HTR: routing destination type = ICF/ABAP .

[Thr 6876] HTR: No esid found in request

[Thr 6876] HTR: HtrIExtractSessionID -> ” 0

[Thr 6876] HTR: stateless request (no valid session ID found) or initial request for stored session id

[Thr 6876] ICR: IcrIGetMinLoadServer: server ‘HOST_AAA_00’1 delta=400 load=0/0valid=1 resp=1 capacity=10

[Thr 6876] ICR: IcrIFindMatchingPort for prot=1 stack=1 vhost=-1

[Thr 6876] ICR: IcrIFindMatchingPort: compare with 0 0 8000 10

[Thr 6876] ICR: IcrIFindMatchingPort: compare with 1 0 443 10

[Thr 6876] ICR: IcrIFindMatchingPort: found matching port: prot=1 vhost=0 port=443 f=10

[Thr 6876] ICR: IcrIGetMinLoadServer: near-zero load #0: HOST_AAA_00

[Thr 6876] ICR: IcrAttachToServer: next destination server ‘HOST_AAA_00’1 10 1 0 port:443/1/0

…”


Since the connection to the server uses HTTPS, a new SSL handshake is necessary:

“…

[Thr 6876] NiHLGetNodeAddr: found hostname ‘<FQDN WAS>’ in cache

[Thr 6876] NiIGetNodeAddr: hostname ‘<FQDN WAS>’ = addr <WAS IP>

[Thr 6876] NiIGetServNo: servicename ‘443’ = port 443

[Thr 6876] NiICreateHandle: hdl 153 state NI_INITIAL_CON

[Thr 6876] NiIInitSocket: set default settings for new hdl 153/sock 32916 (I4; ST)

[Thr 6876] NiIBlockMode: set blockmode for hdl 153 FALSE

[Thr 6876] NiIConnectSocket: hdl 153 is connecting to <WAS IP>:443 (timeout=5000)

[Thr 6876] SiPeekPendConn: connection of sock 32916 established

[Thr 6876] NiICheckPendConnection: connection of hdl 153 to <WAS IP>:443 established

[Thr 6876] NiIConnect: hdl 153 took local address <WDP IP>:53692

[Thr 6876] NiIConnect: state of hdl 153 NI_CONNECTED

[Thr 6876] IcmConnPoolConnect: Connection to host: <FQDN WAS>, service: 443 established (nihdl=153)

[Thr 6876] ->> SapSSLSessionInit(&sssl_hdl=00000000026CC6E8, role=1 (CLIENT), auth_type=0 (NO_CLIENT_CERT))

[Thr 6876] <<- SapSSLSessionInit()==SAP_O_K

[Thr 6876]      in: args = “role=3 (ANONYMOUS-CLIENT), auth_type=0 (NO_CLIENT_CERT)”

[Thr 6876]     out: sssl_hdl = 0000000002D7DA30

[Thr 6876] ->> SapSSLSetNiHdl(sssl_hdl=0000000002D7DA30, ni_hdl=153)

[Thr 6876] NiIBlockMode: set blockmode for hdl 153 TRUE

[Thr 6876]   SSL NI-sock: local=<WDP IP>:53692 peer=<WAS IP>:443

[Thr 6876] <<- SapSSLSetNiHdl(sssl_hdl=0000000002D7DA30, ni_hdl=153)==SAP_O_K

[Thr 6876] ->> SapSSLSetTargetHostname(sssl_hdl=0000000002D7DA30, &hostname=0000000002D4FE20)

[Thr 6876] <<- SapSSLSetTargetHostname(sssl_hdl=0000000002D7DA30)==SAP_O_K

[Thr 6876]      in: hostname = “<FQDN WAS>”

[Thr 6876] ->> SapSSLSessionStart(sssl_hdl=0000000002D7DA30)

[Thr 6876] SapISSLUseSessionCache(): Creating NEW session (0 cached)

[Thr 6876] SecudeSSL_SessionStart(): created new SSL session (TLSv1.0)

[Thr 6876]   Server Certificate available (FCPath-Len= 0)

[Thr 6876]   Server’s List of trusted CA DNames (from cert-request message):

[Thr 6876]     #1  “CN=xxxxxxxxxxxx, OU=yyyyyyyyy, O=zzzzzzzzzzzzzzzzzz, C=??”

[Thr 6876]     #2  “CN=kkkkkkkkkkkk, O=wwwwwwwwww, C=??”

[Thr 6876] secudessl_AddSSL2Cache(): Creating new SSSL_CACHE entry

[Thr 6876]   HexDump of native SSL session ID { &buf= 0000000002D53F64, buf_len= 32 }

[Thr 6876] 00000: 5e 4a f0 f1 1d 0e 94 c8  c8 37 d0 c5 66 4b c1 e0   ^J…… .7..fK..

[Thr 6876] 00010: 80 26 ee b5 b1 0e 36 bb  92 45 10 c9 3a 8d ad e4   .&….6. .E..:…

[Thr 6876]   Subject DN: CN=<FQDN WAS>, OU=aaaaaaa, OU=bbbbbbbbbbbbbb, OU=ccccccc, O=ddddd, C=??

[Thr 6876] Issuer  DN: CN=xxxxxxxxxxxx, OU=yyyyyyyyy, O=zzzzzzzzzzzzzzzzzz, C=??

[Thr 6876]   Current Cipher: TLS_RSA_WITH_AES128_CBC_SHA

[Thr 6876] MatchTargetName(“<FQDN WAS>”, CN=”<FQDN WAS>”) == EXACT match

[Thr 6876] <<- SapSSLSessionStart(sssl_hdl=0000000002D7DA30)==SAP_O_K

[Thr 6876] status = “new SSL session”

[Thr 6876] Server DN = ” CN=<FQDN WAS>, OU=aaaaaaa, OU=bbbbbbbbbbbbbb, OU=ccccccc, O=ddddd, C=??”

[Thr 6876] IcmConnPoolNewEntry: created new entry 000000000B8A0930[0] for pool 000000000B809610 (nihdl=153, ssl=0000000002D7DA30)

[Thr 6876] ICR: IcrAttachToServer(‘!DIAGS’ 1 2 4100 1 port:443/1/0) 0-> 0

[Thr 6876] HTR: routing to destination ‘HOST_AAA_00’ (balanceable=0)

[Thr 6876] server triggered

[Thr 6876]    Pool Entry 000000000B8A0930:

[Thr 6876]    NI: 153, SSL: 0000000002D7DA30, allocated: 1, inuse: 1, desc: 000000000B8096B0

…”


A few seconds later the WDP sends the request to the application server:

“…

[Thr 6876] local host: <WDP IP>:53692

[Thr 6876] remote host: <WAS IP>:443

[Thr 6876] HTR: forwarding buffer to server (443)

[Thr 6876] Address Offset  Send to AppServer via net:

[Thr 6876] ————————————————————————

[Thr 6876] 0000000003F76058 000000  47455420 2f736170 2f62632f 6775692f |GET /sap/bc/gui/|

[Thr 6876] 0000000003F76068 000016  7361702f 6974732f 77656267 75692048 |sap/its/webgui H|

[Thr 6876] 0000000003F76078 000032  5454502f 312e310d 0a616363 6570743a |TTP/1.1..accept:|

[Thr 6876] 0000000003F76088 000048  202a2f2a 0d0a6163 63657074 2d6c616e | */*..accept-lan|

…”


A response is received from the application server:

“…

[Thr 6876] Address Offset  IcmReadFromPartner received

[Thr 6876] ————————————————————————

[Thr 6876] 0000000003F76058 000000  48545450 2f312e31 20323030 204f4b0d |HTTP/1.1 200 OK.|

[Thr 6876] 0000000003F76068 000016  0a636f6e 74656e74 2d747970 653a2074 |.content-type: t|

[Thr 6876] 0000000003F76078 000032  6578742f 68746d6c 3b206368 61727365 |ext/html; charse|

[Thr 6876] 0000000003F76088  000048 743d7574 662d380d 0a636f6e 74656e74 |t=utf-8..content|

[Thr 6876] 0000000003F76098  000064 2d656e63 6f64696e 673a2067 7a69700d |-encoding: gzip.|

[Thr 6876] 0000000003F760A8  000080 0a636f6e 74656e74 2d6c656e 6774683a |.content-length:|

…”

The response is then re-encrypted and sent to the web browser:

“…

[Thr 6876] IcmPlCheckRetVal: Next status: READ_REQUEST(1)

[Thr 6876] IcmHandleNetWrite(id=0/18): HandleServData returned: 1

[Thr 6876] Address    Offset  IcmWriteToConn:

[Thr 6876] ————————————————————————

[Thr 6876] 0000000003F76058 000000  48545450 2f312e31 20323030 204f4b0d |HTTP/1.1 200 OK.|

[Thr 6876] 0000000003F76068 000016  0a636f6e 74656e74 2d747970 653a2074 |.content-type: t|

[Thr 6876] 0000000003F76078 000032  6578742f 68746d6c 3b206368 61727365 |ext/html; charse|

[Thr 6876] 0000000003F76088  000048 743d7574 662d380d 0a636f6e 74656e74 |t=utf-8..content|

[Thr 6876] 0000000003F76098  000064 2d656e63 6f64696e 673a2067 7a69700d |-encoding: gzip.|

[Thr 6876] 0000000003F760A8  000080 0a636f6e 74656e74 2d6c656e 6774683a |.content-length:|

…”


Finally, the thread is free to wait a new request:

“…

[Thr 6876] IcmWriteToConn(id=0/18): wrote data to partner (len = 5243)

[Thr 6876] IcmNetBufFree: free netbuf: 0000000000759C10 out of 1 used

[Thr 6876] MPI<5>0#4 DiscardOutbuf 0 0 0 1a5fa0 0 0 -> 0000000003F75FF0 MPI_OK

[Thr 6876] NiWakeupExec: send wakeup signal to 49627->64998 (sock 33032)

[Thr 6876] IcmConnRollOut: connection (id=0/18) rolled out: reason:1 role:1 timeout:60

[Thr 6876] CONNECTION (id=0/18):

    used: 1, type: default, role: Server(1), stateful: 0

    NI_HDL: 147, protocol: HTTPS(2)

    local host:  <WDP IP>:10000 ()

    remote host: <Client IP>:53691 ()

    status: READ_REQUEST

    connect time: xx.zz.yyyy aa:bb:cc

    MPI request:        <4>      MPI response:        <5>  

request_buf_size:   0        response_buf_size:   0    

request_buf_used:   0        response_buf_used:   0    

request_buf_offset: 0 response_buf_offset: 0    

[Thr 6876] IcmWorkerThread: SSL Session rolled out

[Thr 6876] REQ TRACE END: 0/18/1

[Thr 6876] IcmWorkerThread: Thread 2: Waiting for event

…”


If the parameter “icm/trace_secured_data = 1” is not set, it is not possible to see the HTML content. The following log entry appears:

“…

BINDUMP of content denied

…”

Stay tuned for my next blog about End-to-End SSL in the SAP Web Dispatcher!

To report this post you need to login first.

5 Comments

You must be Logged on to comment or reply to a post.

  1. Matt Fraser

    Hi Cris,

    Great blog series, with nice technical details. I like how you go into what is happening at a technical level. Personally, I prefer the “re-encrypt” scenario for most applications (there are obvious exceptions), and this is what we use for our enterprise portal here.

    Perhaps I missed it, though — do you have an overview of the functional differences and pros and cons of the three scenarios? I think folks who are trying to make a decision at the beginning of a Web Dispatcher implementation might like some guidance on this point, so adding a paragraph at the beginning of the first in the series, with links back to it from the others, might be a nice enhancement.

    Cheers,

    Matt

    (0) 
    1. Cristiano Hansen Post author

      Hi Matt,

      Thank you very much for your comment. I will write one additional paragraph and put in the first article with a few pros and cons.

      I intend to continue the series with some different landscapes, but I need some spare time to write down things. 🙂

      Thanks once again,

      Cris

      (0) 
      1. Matt Fraser

        Oh yes, that fleetingly scarce resource: time! I did notice you seem to be in a “blogging mood” the past few days or so, quite productive.

        (0) 

Leave a Reply