Hi Haproxy List,

I upgraded to 1.8.7 (coming from 1.8.3) and found i could no-longer use one of our IIS websites. The login procedure thats using windows authentication / ntlm seems to fail.. Removing option http-tunnel seems to fix this though. Afaik http-tunnel 'should' switch to tunnelmode after the first request and as such should have no issue sending the credentials the the server.?.


Below are:  config / haproxy -vv / tcpdump / sess all

Is it a known issue? Is there anything else i can provide?

Regards,

PiBa-NL (Pieter)

-----------------------------
# Automaticaly generated, dont edit manually.
# Generated on: 2018-04-10 21:00
global
    maxconn            1000
    log            192.168.8.10    local1    info
    stats socket /tmp/haproxy.socket level admin
    gid            80
    nbproc            1
    nbthread            1
    hard-stop-after        15m
    chroot                /tmp/haproxy_chroot
    daemon
    tune.ssl.default-dh-param    2048
    defaults
    option log-health-checks


frontend site.domain.nl2
    bind            192.168.8.5:443 name 192.168.8.5:443  ssl  crt /var/etc/haproxy/site.domain.nl2.pem crt-list /var/etc/haproxy/site.domain.nl2.crt_list
    mode            http
    log            global
    option            httplog
    option            http-tunnel
    maxconn            100
    timeout client        1h
    option tcplog
    default_backend website-intern_http_ipvANY

backend site-intern_http_ipvANY
    mode            http
    log            global
    option            http-tunnel
    timeout connect        10s
    timeout server        1h
    retries            3
    server            site 192.168.13.44:443 ssl  weight 1.1 verify none

-----------------------------
[2.4.3-RELEASE][root@pfsense_5.local]/root: haproxy -vv
HA-Proxy version 1.8.7 2018/04/07
Copyright 2000-2018 Willy Tarreau <wi...@haproxy.org>

Build options :
  TARGET  = freebsd
  CPU     = generic
  CC      = cc
  CFLAGS  = -O2 -pipe -fstack-protector -fno-strict-aliasing -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -fno-strict-overflow -Wno-address-of-packed-member -Wno-null-dereference -Wno-unused-label -DFREEBSD_PORTS   OPTIONS = USE_GETADDRINFO=1 USE_ZLIB=1 USE_CPU_AFFINITY=1 USE_ACCEPT4=1 USE_REGPARM=1 USE_OPENSSL=1 USE_LUA=1 USE_STATIC_PCRE=1 USE_PCRE_JIT=1

Default settings :
  maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with network namespace support.
Built with zlib version : 1.2.11
Running on zlib version : 1.2.11
Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with PCRE version : 8.40 2017-01-11
Running on PCRE version : 8.40 2017-01-11
PCRE library supports JIT : yes
Built with multi-threading support.
Encrypted password support via crypt(3): yes
Built with transparent proxy support using: IP_BINDANY IPV6_BINDANY
Built with Lua version : Lua 5.3.4
Built with OpenSSL version : OpenSSL 1.0.2m-freebsd  2 Nov 2017
Running on OpenSSL version : OpenSSL 1.0.2m-freebsd  2 Nov 2017
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : SSLv3 TLSv1.0 TLSv1.1 TLSv1.2

Available polling systems :
     kqueue : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result OK
Total: 3 (3 usable), will use kqueue.

Available filters :
        [TRACE] trace
        [COMP] compression
        [SPOE] spoe
-----------------------------
tcpdump of : Client 8.32>Haproxy 8.5:

21:09:13.452118 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [S], seq 1417754656, win 8192, options [mss 1260,nop,wscale 8,nop,nop,sackOK], length 0 21:09:13.452312 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [S.], seq 1950703403, ack 1417754657, win 65228, options [mss 1260,nop,wscale 7,sackOK,eol], length 0 21:09:13.453030 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [.], ack 1, win 260, length 0 21:09:13.457740 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [P.], seq 1:190, ack 1, win 260, length 189 21:09:13.457762 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [.], ack 190, win 510, length 0 21:09:13.459503 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [.], seq 1:1261, ack 190, win 511, length 1260 21:09:13.459516 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [.], seq 1261:2521, ack 190, win 511, length 1260 21:09:13.459527 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [P.], seq 2521:2686, ack 190, win 511, length 165 21:09:13.460342 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [.], ack 2686, win 260, length 0 21:09:13.478984 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [P.], seq 190:316, ack 2686, win 260, length 126 21:09:13.479038 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [.], ack 316, win 510, length 0 21:09:13.480105 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [P.], seq 2686:2737, ack 316, win 511, length 51 21:09:13.490136 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [P.], seq 316:615, ack 2737, win 260, length 299 21:09:13.490159 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [.], ack 615, win 509, length 0 21:09:13.502733 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [.], seq 2737:3997, ack 615, win 511, length 1260 21:09:13.502745 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [P.], seq 3997:4314, ack 615, win 511, length 317 21:09:13.502970 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [.], ack 4314, win 260, length 0
<User fills in the password popup from the browser this takes a few seconds>
21:09:25.294174 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [P.], seq 615:992, ack 4314, win 260, length 377 21:09:25.294233 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [.], ack 992, win 508, length 0
<After a little while the connection is lost..>
21:11:26.433054 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [P.], seq 4314:4345, ack 992, win 508, length 31 21:11:26.433087 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [F.], seq 4345, ack 992, win 508, length 0 21:11:26.434317 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [.], ack 4346, win 260, length 0 21:11:26.446968 IP 192.168.8.32.51658 > 192.168.8.5.443: Flags [F.], seq 992, ack 4346, win 260, length 0 21:11:26.446994 IP 192.168.8.5.443 > 192.168.8.32.51658: Flags [.], ack 993, win 508, length 0

tcpdump of: Haproxy 13.5> Webserver 13.44:

21:09:13.490504 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [S], seq 2510965801, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 1036282720 ecr 0], length 0 21:09:13.492572 IP 192.168.13.44.443 > 192.168.13.5.6015: Flags [S.], seq 3868280669, ack 2510965802, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 4405365 ecr 1036282720], length 0 21:09:13.492596 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [.], ack 1, win 513, options [nop,nop,TS val 1036282720 ecr 4405365], length 0 21:09:13.492737 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [P.], seq 1:518, ack 1, win 513, options [nop,nop,TS val 1036282720 ecr 4405365], length 517 21:09:13.495339 IP 192.168.13.44.443 > 192.168.13.5.6015: Flags [.], seq 1:1449, ack 518, win 260, options [nop,nop,TS val 4405365 ecr 1036282720], length 1448 21:09:13.495356 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [.], ack 1449, win 501, options [nop,nop,TS val 1036282729 ecr 4405365], length 0 21:09:13.495363 IP 192.168.13.44.443 > 192.168.13.5.6015: Flags [P.], seq 1449:2660, ack 518, win 260, options [nop,nop,TS val 4405365 ecr 1036282720], length 1211 21:09:13.495374 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [.], ack 2660, win 492, options [nop,nop,TS val 1036282729 ecr 4405365], length 0 21:09:13.497287 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [P.], seq 518:644, ack 2660, win 513, options [nop,nop,TS val 1036282729 ecr 4405365], length 126 21:09:13.500555 IP 192.168.13.44.443 > 192.168.13.5.6015: Flags [P.], seq 2660:2711, ack 644, win 259, options [nop,nop,TS val 4405366 ecr 1036282729], length 51 21:09:13.500570 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [.], ack 2711, win 512, options [nop,nop,TS val 1036282729 ecr 4405366], length 0 21:09:13.500799 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [P.], seq 644:943, ack 2711, win 513, options [nop,nop,TS val 1036282729 ecr 4405366], length 299 21:09:13.502465 IP 192.168.13.44.443 > 192.168.13.5.6015: Flags [.], seq 2711:4159, ack 943, win 258, options [nop,nop,TS val 4405366 ecr 1036282729], length 1448 21:09:13.502483 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [.], ack 4159, win 501, options [nop,nop,TS val 1036282729 ecr 4405366], length 0 21:09:13.502492 IP 192.168.13.44.443 > 192.168.13.5.6015: Flags [P.], seq 4159:4288, ack 943, win 258, options [nop,nop,TS val 4405366 ecr 1036282729], length 129 21:09:13.502502 IP 192.168.13.5.6015 > 192.168.13.44.443: Flags [.], ack 4288, win 500, options [nop,nop,TS val 1036282729 ecr 4405366], length 0
<User/Password is never send>
21:11:26.432105 IP 192.168.13.44.443 > 192.168.13.5.6015: Flags [R.], seq 4288, ack 943, win 0, length 0

-----------------------------
'sess all' before and after the credentials..

[2.4.3-RELEASE][root@pfsense_5.itm.local]/root: /usr/local/pkg/haproxy/haproxy_socket.sh show sess all

show sess all

0x8024adf80: [10/Apr/2018:21:09:13.453304] id=7 proto=tcpv4 source=192.168.8.32:51658
  flags=0x4ce, conn_retries=3, srv_conn=0x8024f6000, pend_pos=0x0
  frontend=portal.itemedical.nl2 (id=2 mode=http), listener=192.168.8.5:443 (id=1) addr=192.168.8.5:443   backend=synergy-intern_http_ipvANY (id=3 mode=http) addr=192.168.13.5:6015
  server=portalServer (id=1) addr=192.168.13.44:443
  task=0x80242d8c0 (state=0x08 nice=0 calls=4 exp=7s tmask=0x1 age=3s)
  txn=0x80244b8c0 flags=0x100000 meth=1 status=401 req.st=MSG_TUNNEL rsp.st=MSG_TUNNEL waiting=0   si[0]=0x8024ae1c8 (state=EST flags=0x08 endp0=NONE:0x8024a8350 exp=<NEVER>, et=0x000)   si[1]=0x8024ae1f0 (state=EST flags=0x118 endp1=NONE:0x8024a8380 exp=<NEVER>, et=0x000)   co0=0x80243c480 ctrl=tcpv4 xprt=SSL mux=PASS data=STRM target=LISTENER:0x80243c300
      flags=0x80203306 fd=10 fd.state=25 fd.cache=0 updt=0 fd.tmask=0x1
  co1=0x80243c600 ctrl=tcpv4 xprt=SSL mux=PASS data=STRM target=SERVER:0x8024f6000
      flags=0x00203306 fd=11 fd.state=25 fd.cache=0 updt=0 fd.tmask=0x1
  req=0x8024adf90 (f=0x8848000 an=0x0 pipe=0 tofwd=-1 total=270)
      an_exp=<NEVER> rex=59m57s wex=<NEVER>
      buf=0x7d2c18 data=0x7d2c2c o=0 p=0 req.next=0 i=0 size=0
  res=0x8024adfd0 (f=0xc8048200 an=0x0 pipe=0 tofwd=-1 total=1548)
      an_exp=<NEVER> rex=59m57s wex=<NEVER>
      buf=0x802507840 data=0x802507854 o=0 p=0 rsp.next=0 i=0 size=16384
0x8024aed80: [10/Apr/2018:21:09:16.365440] id=8 proto=unix_stream source=unix:1
  flags=0x88, conn_retries=0, srv_conn=0x0, pend_pos=0x0
  frontend=GLOBAL (id=0 mode=tcp), listener=? (id=1) addr=unix:1
  backend=<NONE> (id=-1 mode=-)
  server=<NONE> (id=-1)
  task=0x80242d780 (state=0x02 nice=-64 calls=1 exp=10s tmask=0x1 age=0s)
  si[0]=0x8024aefc8 (state=EST flags=0x08 endp0=NONE:0x8024a8530 exp=<NEVER>, et=0x000)   si[1]=0x8024aeff0 (state=EST flags=0x4018 endp1=APPCTX:0x80243cc00 exp=<NEVER>, et=0x000)   co0=0x80243ca80 ctrl=unix_stream xprt=RAW mux=PASS data=STRM target=LISTENER:0x80243c180
      flags=0x00203306 fd=12 fd.state=25 fd.cache=0 updt=0 fd.tmask=0x1
  app1=0x80243cc00 st0=7 st1=0 st2=3 applet=<CLI> tmask=0x1
  req=0x8024aed90 (f=0x40c08202 an=0x0 pipe=0 tofwd=-1 total=15)
      an_exp=<NEVER> rex=10s wex=<NEVER>
      buf=0x8025b3340 data=0x8025b3354 o=0 p=0 req.next=0 i=0 size=16384
  res=0x8024aedd0 (f=0x80008002 an=0x0 pipe=0 tofwd=-1 total=1398)
      an_exp=<NEVER> rex=<NEVER> wex=<NEVER>
      buf=0x802501900 data=0x802501914 o=1398 p=1398 rsp.next=0 i=0 size=16384

[2.4.3-RELEASE][root@pfsense_5.itm.local]/root: /usr/local/pkg/haproxy/haproxy_socket.sh show sess all
show sess all

0x8024adf80: [10/Apr/2018:21:09:13.453304] id=7 proto=tcpv4 source=192.168.8.32:51658
  flags=0x4ce, conn_retries=3, srv_conn=0x8024f6000, pend_pos=0x0
  frontend=portal.itemedical.nl2 (id=2 mode=http), listener=192.168.8.5:443 (id=1) addr=192.168.8.5:443   backend=synergy-intern_http_ipvANY (id=3 mode=http) addr=192.168.13.5:6015
  server=portalServer (id=1) addr=192.168.13.44:443
  task=0x80242d8c0 (state=0x04 nice=0 calls=5 exp=59m43s tmask=0x1 age=16s)
  txn=0x80244b8c0 flags=0x100000 meth=1 status=401 req.st=MSG_TUNNEL rsp.st=MSG_TUNNEL waiting=0   si[0]=0x8024ae1c8 (state=EST flags=0x08 endp0=NONE:0x8024a8350 exp=<NEVER>, et=0x000)   si[1]=0x8024ae1f0 (state=EST flags=0x118 endp1=NONE:0x8024a8380 exp=<NEVER>, et=0x000)   co0=0x80243c480 ctrl=tcpv4 xprt=SSL mux=PASS data=STRM target=LISTENER:0x80243c300
      flags=0x80203306 fd=10 fd.state=25 fd.cache=0 updt=0 fd.tmask=0x1
  co1=0x80243c600 ctrl=tcpv4 xprt=SSL mux=PASS data=STRM target=SERVER:0x8024f6000
      flags=0x00203306 fd=11 fd.state=25 fd.cache=0 updt=0 fd.tmask=0x1
  req=0x8024adf90 (f=0x8848000 an=0x0 pipe=0 tofwd=-1 total=270)
      an_exp=<NEVER> rex=59m43s wex=<NEVER>
      buf=0x7d2c18 data=0x7d2c2c o=0 p=0 req.next=0 i=0 size=0
  res=0x8024adfd0 (f=0x88048000 an=0x0 pipe=0 tofwd=-1 total=1548)
      an_exp=<NEVER> rex=59m43s wex=<NEVER>
      buf=0x7d2c18 data=0x7d2c2c o=0 p=0 rsp.next=0 i=0 size=0
0x8024aed80: [10/Apr/2018:21:09:29.621432] id=9 proto=unix_stream source=unix:1
  flags=0x88, conn_retries=0, srv_conn=0x0, pend_pos=0x0
  frontend=GLOBAL (id=0 mode=tcp), listener=? (id=1) addr=unix:1
  backend=<NONE> (id=-1 mode=-)
  server=<NONE> (id=-1)
  task=0x80242d780 (state=0x02 nice=-64 calls=1 exp=10s tmask=0x1 age=0s)
  si[0]=0x8024aefc8 (state=EST flags=0x08 endp0=NONE:0x8024a8530 exp=<NEVER>, et=0x000)   si[1]=0x8024aeff0 (state=EST flags=0x4018 endp1=APPCTX:0x80243cc00 exp=<NEVER>, et=0x000)   co0=0x80243ca80 ctrl=unix_stream xprt=RAW mux=PASS data=STRM target=LISTENER:0x80243c180
      flags=0x00203306 fd=12 fd.state=25 fd.cache=0 updt=0 fd.tmask=0x1
  app1=0x80243cc00 st0=7 st1=0 st2=3 applet=<CLI> tmask=0x1
  req=0x8024aed90 (f=0x40c08202 an=0x0 pipe=0 tofwd=-1 total=15)
      an_exp=<NEVER> rex=10s wex=<NEVER>
      buf=0x802507840 data=0x802507854 o=0 p=0 req.next=0 i=0 size=16384
  res=0x8024aedd0 (f=0x80008002 an=0x0 pipe=0 tofwd=-1 total=1393)
      an_exp=<NEVER> rex=<NEVER> wex=<NEVER>
      buf=0x802501900 data=0x802501914 o=1393 p=1393 rsp.next=0 i=0 size=16384


Reply via email to