req_ssl_ver ACL not working

[Julien Vehent]

Hi everyone,

I'm working on a configuration that routes to a different backend based 
on the TLS version, using:
    acl modern_tls req_ssl_ver 3.3
However, it appears that the acl never returns true. I'm testing with:
    $ openssl s_client -connect <target>:443 -servername <target> 
-tls1_2

I tried various syntax too, such as "req_ssl_ver 3.3:3.99", but none 
work.
Am I misusing this ACL? My configuration is below. Build version at the 
bottom of this email.
    frontend https-in
        bind 0.0.0.0:443
        mode tcp
        tcp-request inspect-delay 5s
        tcp-request content accept if { req_ssl_hello_type 1 }
        acl sni_jve req.ssl_sni -i jve.linuxwall.info
        acl sni_mig req.ssl_sni -i mig.ninja
        acl modern_tls req_ssl_ver 3.3
        use_backend mig_https if sni_mig modern_tls
        use_backend jve_https if sni_jve modern_tls

        # fallback to backward compatible backend
        default_backend jve_https_old

Thanks for your help,
Julien




Build:
HA-Proxy version 1.5.14 2015/07/02
Copyright 2000-2015 Willy Tarreau <wi...@haproxy.org>

Build options :
  TARGET  = linux2628
  CPU     = generic
  CC      = gcc
  CFLAGS  = -g -O2 -fstack-protector-strong -Wformat 
-Werror=format-security -D_FORTIFY_SOURCE=2
  OPTIONS = USE_ZLIB=1 USE_OPENSSL=1 USE_PCRE=1

Default settings :
  maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 
200

Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.8
Compression algorithms supported : identity, deflate, gzip
Built with OpenSSL version : OpenSSL 1.0.2c 12 Jun 2015
Running on OpenSSL version : OpenSSL 1.0.2d 9 Jul 2015
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.35 2014-04-04
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with transparent proxy support using: IP_TRANSPARENT 
IPV6_TRANSPARENT IP_FREEBIND

Available polling systems :
      epoll : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.