3

I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg

defaults
    log global
    timeout client 50s
    timeout client-fin 50s
    timeout connect 5s
    timeout server 10s
    timeout tunnel 50s
frontend tcp-0_0_0_0-443
    bind *:443
    mode tcp

    acl sni_acl_example_com req.ssl_sni -m sub example.com
    use_backend example_com_be if sni_acl_example_com

backend example_com_be
    mode tcp
    server name1 93.184.216.34

I run HaProxy using the following Dockerfile:

FROM haproxy:1.7.9-alpine
COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
EXPOSE 443

and the following command: docker build -t my-haproxy . && docker run -p 443:443 --rm -d --name my-running-haproxy my-haproxy

Now I would like to check if the rule called sni_acl_example_com will work as expected using cURL.

curl -k -X 'GET' -H 'Host: example.com' --resolve example.com:443:127.0.0.1 https://example.com

The result is:

curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to example.com:443

Obviously the rules does not work and there is no suitable backend (that's why I get SSL_ERROR_SYSCALL). If I add some default_backend, it will be used instead to perform my request.

Why my cURL request does not open http://example.com using HaProxy?

I use curl 7.54.0 with latest OSX High Sierra.

  • Use curl -k -X 'GET' -H 'Host: example.com' https://127.0.0.1 – Jacob Evans Dec 26 '17 at 12:02
  • @JacobEvans just checked and it does not work. I did not even expect it to work, because I suppose sni-field is 127.0.0.1 in this case. Setting Host header does not mean to set SNI in your request. – Derp Dec 26 '17 at 13:13
2

Figured it out. cURL request is absolutely correct.

There were 2 configuration statements missing in haproxy.cfg. In order to make sni-rules work you also need:

tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }

under frontend section.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.