Sometimes SSL error with haproxy

[Mitch]

Hi everyone,

not sure if this is the right place to request help (first time mailing to
a mailing list :-)), but I give it a try.

I'm trying to setup a haproxy for SSL offloading for multiple hosts. This
works perfect with this config:





# Example configuration for a possible web application.  See the
# full configuration options online.
#
#   http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
#
#-

#-
# Global settings
#-
global
# to have these messages end up in /var/log/haproxy.log you will
# need to:
#
# 1) configure syslog to accept network log events.  This is done
#by adding the '-r' option to the SYSLOGD_OPTIONS in
#/etc/sysconfig/syslog
#
# 2) configure local2 events to go to the /var/log/haproxy.log
#   file. A line like the following can be added to
#   /etc/sysconfig/syslog
#
#local2.*   /var/log/haproxy.log
#
log 127.0.0.1 local2

chroot  /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 15000
userhaproxy
group   haproxy
daemon

# turn on stats unix socket
stats socket /var/lib/haproxy/stats

#tune.ssl.default-dh-param 2048

#-
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#-
defaults
modehttp
log global
option  httplog
option  dontlognull
option http-server-close
option forwardfor   except 127.0.0.0/8
option  redispatch
 retries 3
timeout http-request10s
timeout queue   1m
timeout connect 10s
timeout client  1m
timeout server  1m
timeout http-keep-alive 10s
timeout check   10s
maxconn 11000

#-
# main frontends which proxys to the backends
#-


frontend www-https *:443
bind *:443 ssl crt /etc/ssl/private/starmyhostname.pem no-sslv3

#Define hosts & ACL's
acl host_BEADHOSTWWW01 hdr(host) -i wwwtest.myhostname.eu
acl host_BEADHOSTKB01 hdr(host) -i kb.myhostname.eu

#Define which backend to use for each host
use_backend BEADHOSTWWW01 if host_BEADHOSTWWW01
use_backend BEADHOSTKB01 if host_BEADHOSTKB01

#-
# Backends
#-
backend BEADHOSTWWW01
option httpclose
cookie JSESSIONID prefix
mode http
server  WWW01 172.26.75.10:80 cookie A check

backend BEADHOSTKB01
option httpclose
cookie JSESSIONID prefix
mode http
server  KB01 172.26.75.2:80 cookie A check





However, in some cases (lets say 1 out of 20), I receive a
ERR_SSL_PROTOCOL_ERROR (chrome) or ssl_error_rx_record_too_long (firefox).
Hitting F5 solves the issue instantly, but it comes back after a while.

Anyone knows what could be the reason for this, and how to solve this? I am
kind of lost.

Thanks a lot for your help!

Mitch

Re: Sometimes SSL error with haproxy

[Sehoon Kim]

Hi, Mitch

Try to change  into 

Regards,
Seri

2015-11-17 20:27 GMT+09:00 Mitch :

> Hi everyone,
>
> not sure if this is the right place to request help (first time mailing to
> a mailing list :-)), but I give it a try.
>
> I'm trying to setup a haproxy for SSL offloading for multiple hosts. This
> works perfect with this config:
>
>
> 
> 
>
> # Example configuration for a possible web application.  See the
> # full configuration options online.
> #
> #   http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
> #
> #-
>
> #-
> # Global settings
> #-
> global
> # to have these messages end up in /var/log/haproxy.log you will
> # need to:
> #
> # 1) configure syslog to accept network log events.  This is done
> #by adding the '-r' option to the SYSLOGD_OPTIONS in
> #/etc/sysconfig/syslog
> #
> # 2) configure local2 events to go to the /var/log/haproxy.log
> #   file. A line like the following can be added to
> #   /etc/sysconfig/syslog
> #
> #local2.*   /var/log/haproxy.log
> #
> log 127.0.0.1 local2
>
> chroot  /var/lib/haproxy
> pidfile /var/run/haproxy.pid
> maxconn 15000
> userhaproxy
> group   haproxy
> daemon
>
> # turn on stats unix socket
> stats socket /var/lib/haproxy/stats
>
> #tune.ssl.default-dh-param 2048
>
> #-
> # common defaults that all the 'listen' and 'backend' sections will
> # use if not designated in their block
> #-
> defaults
> modehttp
> log global
> option  httplog
> option  dontlognull
> option http-server-close
> option forwardfor   except 127.0.0.0/8
> option  redispatch
>  retries 3
> timeout http-request10s
> timeout queue   1m
> timeout connect 10s
> timeout client  1m
> timeout server  1m
> timeout http-keep-alive 10s
> timeout check   10s
> maxconn 11000
>
> #-
> # main frontends which proxys to the backends
> #-
>
>
> frontend www-https *:443
> bind *:443 ssl crt /etc/ssl/private/starmyhostname.pem no-sslv3
>
> #Define hosts & ACL's
> acl host_BEADHOSTWWW01 hdr(host) -i wwwtest.myhostname.eu
> acl host_BEADHOSTKB01 hdr(host) -i kb.myhostname.eu
>
> #Define which backend to use for each host
> use_backend BEADHOSTWWW01 if host_BEADHOSTWWW01
> use_backend BEADHOSTKB01 if host_BEADHOSTKB01
>
> #-
> # Backends
> #-
> backend BEADHOSTWWW01
> option httpclose
> cookie JSESSIONID prefix
> mode http
> server  WWW01 172.26.75.10:80 cookie A check
>
> backend BEADHOSTKB01
> option httpclose
> cookie JSESSIONID prefix
> mode http
> server  KB01 172.26.75.2:80 cookie A check
>
>
> 
> 
>
> However, in some cases (lets say 1 out of 20), I receive a
> ERR_SSL_PROTOCOL_ERROR (chrome) or ssl_error_rx_record_too_long (firefox).
> Hitting F5 solves the issue instantly, but it comes back after a while.
>
> Anyone knows what could be the reason for this, and how to solve this? I
> am kind of lost.
>
> Thanks a lot for your help!
>
> Mitch
>

HAProxy and container IP changes in Docker

[Baptiste]

Hi,

For those who asks how to follow-up IP changes in HAProxy when a
container has been reloaded, here is one way of doing it using
inotify, dnsmasq and DNS:

http://blog.haproxy.com/2015/11/17/haproxy-and-container-ip-changes-in-docker/

I may write an other blog article later to workaround the limitations
due to linking container together.

Baptiste

RE: Haproxy

[Lukas Tribus]

> Howover, Can you send me some sample haproxy.cfg configuration file for 
> Solaris 11.

Sample configurations are already bundled with haproxy, check the folder
examples/

Of course, the those configurations will not work out of the box for
your specific requirements. You will have to understand what those
configurations mean (by reading the documentation) and adjust them
accordingly.



> Also Please let me know the how to start haproxy on Solaris 11 OS.

I don't know, I don't use Solaris. Please understand that this
mailing list is about haproxy, not generic OS support. Use a OS
you are familiar with and use existing procedures (the package
manager instead of compiling from source, for example).



> #:/etc/haproxy-1.5.15# gmake TARGET=solaris CPU=ultrasparc USE_OPENSSL=1 

You just had haproxy running, why are you trying to compile from
source now?



Lukas

  

Re: appsession replacement in 1.6

[Sylvain Faivre]

Replying to myself :

On 11/17/2015 10:58 AM, Sylvain Faivre wrote:

Hi Aleks, and thanks again for your help.

Concerning this point :
On 11/16/2015 11:16 PM, Aleksandar Lazic wrote:


As described here

http://git.haproxy.org/?p=haproxy-1.6.git;a=blob;f=doc/configuration.txt;h=45d1aacfbe0d2d53193f7956a0dd03e5f8151ea6;hb=HEAD#l5043



option http-buffer-request

maybe you should stick on the header ;-)


OK I added "option http-buffer-request", it will help for sure !

What do you mean "stick on the header" ?


Oh well, it seems like I forgot to stick on the request URL parameter, 
when passed with a question mark.


So I just added this to my config :
 stick on urlp(JSESSIONID) table back_jsessionid
 stick store-request urlp(JSESSIONID) table back_jsessionid

It should cover all cases now.


I currently have the following config, I think it will stick on
JSESSIONID, either in the cookie (so request header, also capturing the
cookie in reply header) or as a request URL parameter. Am I missing
something ?

backend front
 [stick-table for another purpose]
 [other stuff]
 # sticky session on JSESSIONID
 option http-buffer-request
 stick on urlp(JSESSIONID,;) table front_jsessionid
 stick on cookie(JSESSIONID) table front_jsessionid
 stick store-response cookie(JSESSIONID) table front_jsessionid
 stick store-request cookie(JSESSIONID) table front_jsessionid
 stick store-request urlp(JSESSIONID,;) table front_jsessionid

backend front_jsessionid
 stick-table type string len 24 size 10m expire 1h peers prod

Re: haproxy management web service ?

[Jeff Palmer]

There is a built in web UI which offers that functionality

https://cbonte.github.io/haproxy-dconv/configuration-1.5.html#stats admin

you can see a demo of it at http://demo.haproxy.org (the demo is
read-only, so you won't see the options to enable/disable backends and
such)



On Tue, Nov 17, 2015 at 3:10 PM, Ed Young  wrote:
> So there a web service api that would support bringing nodes up and Down
> programmatically for orchestration of upgrades and other maintenance events?
>
> --
> - Ed



-- 
Jeff Palmer
https://PalmerIT.net

haproxy management web service ?

[Ed Young]

So there a web service api that would support bringing nodes up and
Down programmatically for orchestration of upgrades and other maintenance
events?

-- 
- Ed

Re: haproxy management web service ?

[Park, Sang-Min]

Fyi, Eucalyptus implements AWS ELB api using haproxy as its backend.
---
Sang-Min Park – Software Engineer
HP Enterprise / Eucalyptus

From: Ed Young >
Date: Tuesday, November 17, 2015 at 12:10 PM
To: "Haproxy@formilux.org" 
>
Subject: haproxy management web service ?

So there a web service api that would support bringing nodes up and Down 
programmatically for orchestration of upgrades and other maintenance events?

--
- Ed

Re: Echo server in Lua

[Thrawn]

Hi, again.
Actually, when I think more about it, this service needs to support SSL, so a 
Layer 7 implementation is needed.Also, when I put the TCP applet under any 
degree of stress (as little as 100 request with concurrency 10), it hangs? The 
other two implementations (http-req vs http applet) seem to behave very 
similarly to each other, though. 
Increasing the number of processes (nbproc 2) makes a difference. At 
concurrency 1000 and 3 requests, the 90% response time rises to 2-3ms, but 
there is typically no 200ms spike on the last few requests; they take only 
10-15ms.

On Thursday, 12 November 2015, 5:50, PiBa-NL  wrote:
 

  Hi Thrawn,
 
 I tried these configs, and there doesn't seem to be much if any difference. 
The tcp one might even be the slowest in my limited virtualized tests, but only 
my a few milliseconds..
 
 frontend lua-replyip
     bind            192.168.0.120:9010   
     mode            http
     http-request use-service lua.lua-replyip 
 frontend lua-replyip-copy
     bind            192.168.0.120:9011  
     mode            tcp
     tcp-request content use-service lua.lua-replyip-tcp 
 frontend lua-replyip-httpreq
     bind            192.168.0.120:9012   
     mode            http
     http-request lua.lua-replyip-http-req 
 
 core.register_service("lua-replyip", "http", function(applet) 
    local response = applet.f:src()
    applet:set_status(200)
    applet:add_header("Server", "haproxy-lua/echo") 
    applet:add_header("content-length", string.len(response)) 
    applet:add_header("content-type", "text/plain") 
    applet:start_response() 
    applet:send(response) 
 end)
 
 core.register_service("lua-replyip-tcp", "tcp", function(applet)
    local buffer = applet.f:src()
    applet:send("HTTP/1.0 200 OK\r\nServer: haproxy-lua/echo\r\nContent-Type: 
text/html\r\nContent-Length: " .. buffer:len() .. "\r\nConnection: 
close\r\n\r\n" .. buffer)
 end)
 
 core.register_action("lua-replyip-http-req", { "http-req" }, function (txn)
     local buffer = txn.f:src()
     txn.res:send("HTTP/1.0 200 OK\r\nServer: haproxy-lua/echo\r\nContent-Type: 
text/html\r\nContent-Length: " .. buffer:len() .. "\r\nConnection: 
close\r\n\r\n" .. buffer)
     txn:done()
 end)
  

RE: Haproxy

[Roja Venkata Rani]

#:/etc/haproxy-1.5.15# gmake TARGET=solaris CPU=ultrasparc USE_OPENSSL=1
gcc -Iinclude -Iebtree -Wall  -O6 -mcpu=v9 -mtune=ultrasparc -g 
-fno-strict-aliasing -fomit-frame-pointer -DFD_SETSIZE=6553ANT  -DTPROXY 
-DCONFIG_HAP_CRYPT -DNEED_CRYPT_H -DUSE_GETADDRINFO -DENABLE_POLL -DUSE_OPENSSL 
  -DCONFIG_HAPROXY_VERSIO" -DCONFIG_HAPROXY_DATE=\"2015/11/01\" \
  -DBUILD_TARGET='"solaris"' \
  -DBUILD_ARCH='""' \
  -DBUILD_CPU='"ultrasparc"' \
  -DBUILD_CC='"gcc"' \
  -DBUILD_CFLAGS='"-O6 -mcpu=v9 -mtune=ultrasparc -g -fno-strict-aliasing 
-fomit-frame-pointer -DFD_SETSIZE=65536 -D_RE
  -DBUILD_OPTIONS='"USE_OPENSSL=1"' \
   -c -o src/haproxy.o src/haproxy.c
gmake: execvp: gcc: Not a directory
gmake: *** [src/haproxy.o] Error 127



#:/etc/haproxy-1.5.15# sudo gmake install
gcc -Iinclude -Iebtree -Wall  -O2 -g -fno-strict-aliasing   -DENABLE_POLL  
-DCONFIG_HAPROXY_VERSION=\"1.5.15\" -DCONFIGTE=\"2015/11/01\" \
  -DBUILD_TARGET='""' \
  -DBUILD_ARCH='""' \
  -DBUILD_CPU='"generic"' \
  -DBUILD_CC='"gcc"' \
  -DBUILD_CFLAGS='"-O2 -g -fno-strict-aliasing"' \
  -DBUILD_OPTIONS='"USE_POLL=default"' \
   -c -o src/haproxy.o src/haproxy.c
gmake: execvp: gcc: Not a directory
gmake: *** [src/haproxy.o] Error 127


Thanks,
Roja

From: Roja Venkata Rani
Sent: Tuesday, November 17, 2015 12:27 PM
To: 'Lukas Tribus'
Cc: haproxy@formilux.org
Subject: Haproxy

Hi,

I have downloaded and compiled haproxy on soalris 11 sucessfully.

# ps -ef|grep haproxy
099 15528 1   0   Nov 12 ?   2:33 
./haproxy-1.4.26-pcre-solaris-sparc.notstripped -f /etc/haproxy/haproxy.cfg

Howover, Can you send me some sample haproxy.cfg configuration file for Solaris 
11.
Also Please let me know the how to start haproxy on Solaris 11 OS.

Regards,
Roja

Haproxy

[Roja Venkata Rani]

Hi,

I have downloaded and compiled haproxy on soalris 11 sucessfully.

# ps -ef|grep haproxy
099 15528 1   0   Nov 12 ?   2:33 
./haproxy-1.4.26-pcre-solaris-sparc.notstripped -f /etc/haproxy/haproxy.cfg

Howover, Can you send me some sample haproxy.cfg configuration file for Solaris 
11.
Also Please let me know the how to start haproxy on Solaris 11 OS.

Regards,
Roja

Re: appsession replacement in 1.6

[Sylvain Faivre]

Hi Aleks, and thanks again for your help.

Concerning this point :
On 11/16/2015 11:16 PM, Aleksandar Lazic wrote:


As described here

http://git.haproxy.org/?p=haproxy-1.6.git;a=blob;f=doc/configuration.txt;h=45d1aacfbe0d2d53193f7956a0dd03e5f8151ea6;hb=HEAD#l5043


option http-buffer-request

maybe you should stick on the header ;-)


OK I added "option http-buffer-request", it will help for sure !

What do you mean "stick on the header" ?
I currently have the following config, I think it will stick on 
JSESSIONID, either in the cookie (so request header, also capturing the 
cookie in reply header) or as a request URL parameter. Am I missing 
something ?


backend front
[stick-table for another purpose]
[other stuff]
# sticky session on JSESSIONID
option http-buffer-request
stick on urlp(JSESSIONID,;) table front_jsessionid
stick on cookie(JSESSIONID) table front_jsessionid
stick store-response cookie(JSESSIONID) table front_jsessionid
stick store-request cookie(JSESSIONID) table front_jsessionid
stick store-request urlp(JSESSIONID,;) table front_jsessionid

backend front_jsessionid
stick-table type string len 24 size 10m expire 1h peers prod

Re: haproxy management web service ?

[Jeff Palmer]

Ed,


If you look into the "stats socket"  it has the same functionality as
the web interface.  you can interact with it via shell scripts and
similar.   I use this with ansible to take backends out of haproxy
before doing maintenance or updates.  so that may work for you.

If you are looking for like a restful API or similar,  you are going
to have to use a 3rd party solution as haproxy doesn't have this
capability built in.



On Tue, Nov 17, 2015 at 4:37 PM, Ed Young  wrote:
> I'm aware of the stats application and have it configured to manually
> enable, disable and soft stop/start nodes.
>
> The UI is nice, but what I'm asking about is whether there is an web service
> or API to enable/disable/soft stop/start nodes programmatically.
>
> That way when I have a release or some other maintenance, I can do it all
> from Jenkins, for example.
>
> Eucalyptus?
> is this what you mean?
> https://github.com/eucalyptus/load-balancer-servo
>
>
>
>
>
> On Tue, Nov 17, 2015 at 1:47 PM, Park, Sang-Min 
> wrote:
>>
>> Fyi, Eucalyptus implements AWS ELB api using haproxy as its backend.
>> ---
>> Sang-Min Park – Software Engineer
>> HP Enterprise / Eucalyptus
>>
>> From: Ed Young >
>> Date: Tuesday, November 17, 2015 at 12:10 PM
>> To: "Haproxy@formilux.org"
>> >
>> Subject: haproxy management web service ?
>>
>> So there a web service api that would support bringing nodes up and Down
>> programmatically for orchestration of upgrades and other maintenance events?
>>
>> --
>> - Ed
>
>
>
>
> --
> - Ed



-- 
Jeff Palmer
https://PalmerIT.net

Re: haproxy management web service ?

[Pavlos Parissis]

On 17/11/2015 10:37 μμ, Ed Young wrote:
> I'm aware of the stats application and have it configured to manually
> enable, disable and soft stop/start nodes. 
> 
> The UI is nice, but what I'm asking about is whether there is an web
> service or API to enable/disable/soft stop/start nodes programmatically. 
> 

I assume you don't mean RESTful API, so I will mention
github.com/unixsurfer/haproxyadmin which is a Python module which
does most of operations supported over the stats socket.
This github.com/unixsurfer/haproxytool is a tool which uses the
mentioned library.

Both are in Python and I have some plans to write a Go API, as a way to
learn Golang, but it can take time before it is ready for public release.

Cheers,
Pavlos




signature.asc
Description: OpenPGP digital signature

特大优惠！！！深圳盐田/蛇口整柜拖车报关一条龙服务部分产品全包价只需1200元

[pxcnmxqpn]

    
   深圳盐田、蛇口整柜报关交仓  本公司是集拖车、商检、报关、报检、仓储、码头内装等服务的专业的码头服务公司 
 东莞到深圳盐田/蛇口整柜,拖车1200元部分产品免报关费   欢迎有柜来电咨询。（珠三角到深圳盐田/蛇口整柜拖车都可以达到）
 我司专业代理深圳盐田买单报关单检包柜、蛇口买单报关单检包柜、皇岗口岸进口清关，中港运输报关、文锦渡中港运输报关、深圳机场UPS/TNT/FEDEX/DHL出口报关报检、深圳机场UPS/TNT/FEDEX/DHL进口报关报检.  
  联系人： 杨生     Mobile:15916781607   HK :00852-31757876  Skype: chengsi8023     E-Mail：384145...@qq.com  Q Q ：384145946   微信号：15916781607

Re: haproxy management web service ?

[Ed Young]

I'm aware of the stats application and have it configured to manually
enable, disable and soft stop/start nodes.

The UI is nice, but what I'm asking about is whether there is an web
service or API to enable/disable/soft stop/start nodes programmatically.

That way when I have a release or some other maintenance, I can do it all
from Jenkins, for example.

Eucalyptus?
is this what you mean?
https://github.com/eucalyptus/load-balancer-servo





On Tue, Nov 17, 2015 at 1:47 PM, Park, Sang-Min 
wrote:

> Fyi, Eucalyptus implements AWS ELB api using haproxy as its backend.
> ---
> Sang-Min Park – Software Engineer
> HP Enterprise / Eucalyptus
>
> From: Ed Young >
> Date: Tuesday, November 17, 2015 at 12:10 PM
> To: "Haproxy@formilux.org" <
> Haproxy@formilux.org>
> Subject: haproxy management web service ?
>
> So there a web service api that would support bringing nodes up and Down
> programmatically for orchestration of upgrades and other maintenance events?
>
> --
> - Ed
>



-- 
- Ed

Re: haproxy management web service ?

[Ed Young]

Ok, thanks!

I just built and installed socat, and I'll check out haproxyadmin as well.

I've got a few golang irons in the fire for the same reason, so let me know
if you make some progress.

Thanks again.

On Tue, Nov 17, 2015 at 2:57 PM, Pavlos Parissis 
wrote:

> On 17/11/2015 10:37 μμ, Ed Young wrote:
> > I'm aware of the stats application and have it configured to manually
> > enable, disable and soft stop/start nodes.
> >
> > The UI is nice, but what I'm asking about is whether there is an web
> > service or API to enable/disable/soft stop/start nodes programmatically.
> >
>
> I assume you don't mean RESTful API, so I will mention
> github.com/unixsurfer/haproxyadmin which is a Python module which
> does most of operations supported over the stats socket.
> This github.com/unixsurfer/haproxytool is a tool which uses the
> mentioned library.
>
> Both are in Python and I have some plans to write a Go API, as a way to
> learn Golang, but it can take time before it is ready for public release.
>
> Cheers,
> Pavlos
>
>
>


-- 
- Ed

Re: haproxy management web service ?

[Park, Sang-Min]

That is just one piece of overall software.
So Eucalyptus is  the AWS-compatible private cloud and ELB is the 
implementation of AWS ELB on top of haproxy.
To use it, you need to install Eucalyptus on 1 or multiple machines and haproxy 
will be running inside the VMs.

Depending on your use-case, it may be a good fit or over-kill. For example, 
applications should be running the VMs.
If you have AWS experience and plan to run multiple loadbalancers, then you can 
give it a try.
Eucalyptus covers 100% of ELB APIs, which covers life-cycle management, backend 
registration, SSL, etc.
---
Sang-Min Park – Software Engineer
HP Enterprise

From: Ed Young >
Date: Tuesday, November 17, 2015 at 1:37 PM
To: "Haproxy@formilux.org" 
>
Subject: Re: haproxy management web service ?

I'm aware of the stats application and have it configured to manually enable, 
disable and soft stop/start nodes.

The UI is nice, but what I'm asking about is whether there is an web service or 
API to enable/disable/soft stop/start nodes programmatically.

That way when I have a release or some other maintenance, I can do it all from 
Jenkins, for example.

Eucalyptus?
is this what you mean?
https://github.com/eucalyptus/load-balancer-servo





On Tue, Nov 17, 2015 at 1:47 PM, Park, Sang-Min 
> wrote:
Fyi, Eucalyptus implements AWS ELB api using haproxy as its backend.
---
Sang-Min Park – Software Engineer
HP Enterprise / Eucalyptus

From: Ed Young 
>>
Date: Tuesday, November 17, 2015 at 12:10 PM
To: 
"Haproxy@formilux.org>"
 
>>
Subject: haproxy management web service ?

So there a web service api that would support bringing nodes up and Down 
programmatically for orchestration of upgrades and other maintenance events?

--
- Ed



--
- Ed

[CLEANUP]: silencing warning in dumpsters

[David CARLIER]

Hi all,

this should be a harmless patch in order to silence the compiler
warning in some operating systems regarding time_t / printf format
specifier.

Kindest regards.


0001-CLEANUP-dumpstats-silencing-warning-for-printf-forma.patch
Description: Binary data