4

I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg

defaults
    log global
    timeout client 50s
    timeout client-fin 50s
    timeout connect 5s
    timeout server 10s
    timeout tunnel 50s
frontend tcp-0_0_0_0-443
    bind *:443
    mode tcp

    acl sni_acl_example_com req.ssl_sni -m sub example.com
    use_backend example_com_be if sni_acl_example_com

backend example_com_be
    mode tcp
    server name1 93.184.216.34

I run HaProxy using the following Dockerfile:

FROM haproxy:1.7.9-alpine
COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
EXPOSE 443

and the following command: docker build -t my-haproxy . && docker run -p 443:443 --rm -d --name my-running-haproxy my-haproxy

Now I would like to check if the rule called sni_acl_example_com will work as expected using cURL.

curl -k -X 'GET' -H 'Host: example.com' --resolve example.com:443:127.0.0.1 https://example.com

The result is:

curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to example.com:443

Obviously the rules does not work and there is no suitable backend (that's why I get SSL_ERROR_SYSCALL). If I add some default_backend, it will be used instead to perform my request.

Why my cURL request does not open http://example.com using HaProxy?

I use curl 7.54.0 with latest OSX High Sierra.

Kirill
  • 245
  • 3
  • 7
  • Use `curl -k -X 'GET' -H 'Host: example.com' https://127.0.0.1` – Jacob Evans Dec 26 '17 at 12:02
  • @JacobEvans just checked and it does not work. I did not even expect it to work, because I suppose sni-field is `127.0.0.1` in this case. Setting `Host` header does not mean to set SNI in your request. – Kirill Dec 26 '17 at 13:13

1 Answers1

4

Figured it out. cURL request is absolutely correct.

There were 2 configuration statements missing in haproxy.cfg. In order to make sni-rules work you also need:

tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }

under frontend section.

Kirill
  • 245
  • 3
  • 7
  • 1
    hi, i had a similar issue and after adding your options everything works, do you have any explanation on these by any chance ? looking at the official HAProxy documentation this is not really clear – olivierg Oct 15 '19 at 15:28