Am 2017-03-07 10:19, schrieb Willy Tarreau:
If I do a netstat -an I see a lot of:
tcp4 0 0 127.0.0.1.443 127.0.0.1.47010
TIME_WAIT
tcp4 0 0 127.0.0.1.443 127.0.0.1.46961
CLOSE_WAIT
tcp4 0 0 127.0.0.1.46961 127.0.0.1.443
FIN_WAIT_2
Is :443 your haproxy or the server after haproxy ? If it's the server
behind
haproxy it means this one didn't respond to a close. If it's haproxy it
means
it's stuck doing something else (very bad).
could you please check my first post, there is the complete haproxy
config included, here a short summary:
sslh is listening on 192.168.0.251:443 and 192.168.1.2:443 and
192.168.200.6:443 is acting as transparent proxy forwarding all requests
to 192.168.0.251:8443 or 192.168.200.6:8443
External connections reaching the server on
192.168.0.251/192.168.1.2/192.168.200.6 depending on which network
interface they came in.
haproxy (frontend) is listening on localhost:443 and 192.168.0.251:8443,
192.168.200.6:8443 (in tcp mode, as I use http2 to connect to backend
nginx).
So in this case I would say that haproxy is hanging.
As this is a test system, I can do more tests if required.
Yes, please test with "nokqueue" in the global section, or start
haproxy with
"-dk". It will switch to poll() and will tell us if there's a bug in
the kqueue
poller. Please be aware that your CPU usage will increase a bit.
I tested it again.
haproxy 1.7.3 with patch reverted -> timeout
haproxy 1.7.3 with patch reverted and kqueue disabled -> timeout
ps shows: /usr/local/sbin/haproxy -dk -q -f /usr/local/etc/haproxy.conf
-p /var/run/haproxy.pid
haproxy 1.7.2 -> no timeouts
I cannot says that in sslh is maybe a bug that is now triggered by a
change inside haproxy.
The homepage of sslh is here: http://www.rutschle.net/tech/sslh.shtml
I use sslh to get ssh/https/openvpn to listen the same port (443). sslh
just looks at the first bytes of the connection and acts as a
transparent proxy to forward the connection to haproxy (https), ssh or
openvpn.
Version 1.7.2 shows:
HA-Proxy version 1.7.2 2017/01/13
Copyright 2000-2017 Willy Tarreau <[email protected]>
Build options :
TARGET = freebsd
CPU = generic
CC = cc
CFLAGS = -O2 -pipe -fstack-protector -fno-strict-aliasing
-DFREEBSD_PORTS
OPTIONS = USE_GETADDRINFO=1 USE_ZLIB=1 USE_CPU_AFFINITY=1
USE_OPENSSL=1 USE_STATIC_PCRE=1 USE_PCRE_JIT=1
Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents =
200
Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.8
Running on zlib version : 1.2.8
Compression algorithms supported : identity("identity"),
deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with OpenSSL version : OpenSSL 1.0.2j 26 Sep 2016
Running on OpenSSL version : OpenSSL 1.0.2k 26 Jan 2017
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.39 2016-06-14
Running on PCRE version : 8.39 2016-06-14
PCRE library supports JIT : yes
Built without Lua support
Built with transparent proxy support using: IP_BINDANY IPV6_BINDANY
Available polling systems :
kqueue : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use kqueue.
Available filters :
[SPOE] spoe
[TRACE] trace
[COMP] compression
Version 1.7.3 shows:
HA-Proxy version 1.7.3 2017/02/28
Copyright 2000-2017 Willy Tarreau <[email protected]>
Build options :
TARGET = freebsd
CPU = generic
CC = cc
CFLAGS = -O2 -pipe -fstack-protector -fno-strict-aliasing
-DFREEBSD_PORTS
OPTIONS = USE_GETADDRINFO=1 USE_ZLIB=1 USE_CPU_AFFINITY=1
USE_OPENSSL=1 USE_STATIC_PCRE=1 USE_PCRE_JIT=1
Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents =
200
Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.8
Running on zlib version : 1.2.8
Compression algorithms supported : identity("identity"),
deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with OpenSSL version : OpenSSL 1.0.2k 26 Jan 2017
Running on OpenSSL version : OpenSSL 1.0.2k 26 Jan 2017
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.40 2017-01-11
Running on PCRE version : 8.40 2017-01-11
PCRE library supports JIT : yes
Built without Lua support
Built with transparent proxy support using: IP_BINDANY IPV6_BINDANY
Available polling systems :
kqueue : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use kqueue.
Available filters :
[SPOE] spoe
[TRACE] trace
[COMP] compression
--
Gruß
Matthias
