Re: Relayd with TLS and non-TLS backends - bug

2020-07-05 Thread Henry Bonath
This specific Backend in my test lab is an IIS machine, but in production I have OpenBSD/HAProxy in front of IIS, Apache, Tomcat, etc. I'm not doing anything fancy either... although the certificate in the lab is signed by an internal CA. Here's the relevant output from openssl s_client: The cert

Re: Relayd with TLS and non-TLS backends - bug

2020-07-04 Thread Lyndon Nerenberg
Henry Bonath writes: > I would like to chime in here and confirm that I am seeing very > similar behavior with HAProxy on OpenBSD 6.7, > I was preparing to create my own post on this issue until I saw your thread. > I too believe this is a bug. We saw the same thing after upgrading our proxy host

Re: Relayd with TLS and non-TLS backends - bug

2020-07-04 Thread Brian Brombacher
> On Jul 3, 2020, at 7:17 PM, Henry Bonath wrote: > > Daniel, > > Thanks for taking the time to test this out. > I just reloaded a test machine from scratch with -current and > installed the HAProxy 2.0.15-4f39279 package. > I loaded a very basic config file, and am also seeing the same

Re: Relayd with TLS and non-TLS backends - bug

2020-07-04 Thread Brian Brombacher
> On Jun 11, 2020, at 4:28 PM, Toyam Cox wrote: > > Hello Misc, > > Full config at end of email. > > I've discussed the below in #openbsd on freenode, and was told to come > here. At present, I have a setup where I need multiple unrelated > servers under a single IP address. I used relayd

Re: Relayd with TLS and non-TLS backends - bug

2020-07-03 Thread Brian Brombacher
> On Jul 3, 2020, at 9:46 PM, Daniel Jakots wrote: > > On Fri, 3 Jul 2020 20:25:12 -0400, Brian Brombacher > wrote: > >> My subjective net gain is simplicity, security, performance, and >> flexibility. > > I don't think adding ipsec (or a mesh vpn) into the mix achieve that but > ymmv. >

Re: Relayd with TLS and non-TLS backends - bug

2020-07-03 Thread Daniel Jakots
On Fri, 3 Jul 2020 20:25:12 -0400, Brian Brombacher wrote: > My subjective net gain is simplicity, security, performance, and > flexibility. I don't think adding ipsec (or a mesh vpn) into the mix achieve that but ymmv.

Re: Relayd with TLS and non-TLS backends - bug

2020-07-03 Thread Daniel Jakots
On Fri, 3 Jul 2020 19:14:17 -0400, Henry Bonath wrote: > Daniel, > > Thanks for taking the time to test this out. > I just reloaded a test machine from scratch with -current and > installed the HAProxy 2.0.15-4f39279 package. > I loaded a very basic config file, and am also seeing the same

Re: Relayd with TLS and non-TLS backends - bug

2020-07-03 Thread Brian Brombacher
> On Jun 11, 2020, at 4:28 PM, Toyam Cox wrote: > > Hello Misc, > > Full config at end of email. > > I've discussed the below in #openbsd on freenode, and was told to come > here. At present, I have a setup where I need multiple unrelated > servers under a single IP address. I used relayd

Re: Relayd with TLS and non-TLS backends - bug

2020-07-03 Thread Henry Bonath
Daniel, Thanks for taking the time to test this out. I just reloaded a test machine from scratch with -current and installed the HAProxy 2.0.15-4f39279 package. I loaded a very basic config file, and am also seeing the same exact issue on this one as well. Very strange that you are not - Would

Re: Relayd with TLS and non-TLS backends - bug

2020-07-02 Thread Daniel Jakots
On Thu, 2 Jul 2020 14:00:48 -0400, Henry Bonath wrote: > Note the missing Client Hello on the 6.7 machine as it jumps to > Application Data straight away. > Configuration files for HAProxy are identical on both systems. > > I'm currently spinning up a machine on -CURRENT just to see if there >

Re: Relayd with TLS and non-TLS backends - bug

2020-07-02 Thread Henry Bonath
I would like to chime in here and confirm that I am seeing very similar behavior with HAProxy on OpenBSD 6.7, I was preparing to create my own post on this issue until I saw your thread. I too believe this is a bug. I also get the same "Empty reply" response you get via Curl: > GET / HTTP/1.1 >