Re: SSL load-balancing across multiple HAProxy instances

[PiBa-NL]

I think this is the issue in the mode http frontend:

req_ssl_hello_type : integer (deprecated)
this will not work with "bind" lines having the "ssl"


Patrick Hemmer schreef op 14-2-2014 22:34:

You haven't told it to use SSL when talking to the servers listening on :4443. By default haproxy is going to use non-SSL TCP.

Add the `ssl` option to both of your `server` parameters.

http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.2-ssl

-Patrick


------------------------------------------------------------------------
*From: *m...@hawknetdesigns.com
*Sent: * 2014-02-14 16:21:02 E
*To: *haproxy@formilux.org
*Subject: *SSL load-balancing across multiple HAProxy instances

Hi all,

I'm working on a load-balanced instance using HAProxy, Varnish, and back-end web servers.

I've successfully tested the new SSL termination feature using dev build 1.5-dev22-1a34d57 2014/02/03, and it works well, however, I want to load-balance the SSL terminal feature across more than 1 HAProxy instance like so:

Main HAProxy instance on 192.168.1.5, secondary on 192.168.1.10

Varnish servers on 192.168.1.20 and 192.168.1.30

Previously, I was terminating SSL on the single active HAProxy (192.168.1.5), and speaking HTTP to the Varnish back-ends. This works well.

What I'd like to do is

Request comes in to HAProxy on port 443. Request is then load balanced to the two HAProxy servers in tcp mode to 192.168.1.5:4443 and 192.168.1.10:4443 - maintaining SSL mode until it terminates at port 4443.

An example config (just the relevant sections) would be this:

listen ssl_relay
        bind 192.168.1.5:443
        mode tcp
        option socket-stats
        #option ssl-hello-chk
        tcp-request inspect-delay 5s
        tcp-request content accept if { req_ssl_hello_type 1 }
        tcp-request content accept if { req_ssl_hello_type 1 }
        default_backend test

frontend incoming
        bind 192.168.1.5:80
        mode http
        log global
        option forwardfor

bind 192.168.1.5:4443 no-sslv3 ssl crt /certs/haproxy.pem crt /certs/ ciphers RC4-SHA:AES128-SHA:AES256-SHA

        mode http
        log global
        option forwardfor
        tcp-request inspect-delay 5s
        tcp-request content accept if { req_ssl_hello_type 1 }


    backend test
        mode tcp
        balance roundrobin
        # maximum SSL session ID length is 32 bytes.
        stick-table type binary len 32 size 30k expire 30m

        acl clienthello req_ssl_hello_type 1
        acl serverhello rep_ssl_hello_type 2

# use tcp content accepts to detects ssl client and server hello.

        tcp-request inspect-delay 5s
        tcp-request content accept if clienthello

        # no timeout on response inspect delay by default.
        tcp-response content accept if serverhello

# SSL session ID (SSLID) may be present on a client or server hello. # Its length is coded on 1 byte at offset 43 and its value starts

        # at offset 44.

        # Match and learn on request if client hello.
        stick on payload_lv(43,1) if clienthello

        # Learn on response if server hello.
        stick store-response payload_lv(43,1) if serverhello

        server test1 192.168.1.5:4443
        server test2 192.168.1.10:4443

http works, and I receive requests on port 443, but this is all I get from the HAProxy log:

00000000:ssl_relay.accept(0006)=0009 from [192.168.1.2:50496]
00000000:test.clireq[0009:ffffffff]:
00000000:test.clicls[0009:ffffffff]
00000000:test.closed[0009:ffffffff]

It appears that HAProxy is not speaking or passing through SSL to the frontend on port 4443.

curl -i https://192.168.1.5/

curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

So... what am I missing?

Cheers,
-=Mark