1

I'm trying to set up HAProxy to pass on SSL information with PROXY protocol. So far I've been unsuccessful. My test config:

global
        chroot /tmp/haproxy-chroot
        log stderr format raw local0 debug

defaults
        mode tcp

frontend testpp
         bind *:5000
         mode tcp
         option tcplog
         option logasap
         log global
         timeout client 1s #15s
         default_backend nginx

backend nginx
        mode tcp
        log global
        timeout server 1s #20s
        timeout connect 1s #10s
        server nginx1 localhost:443 send-proxy-v2-ssl

However, when I run tcpdump, I don't see the extra data:

        0x0000:  4500 029e 0918 4000 4006 3140 7f00 0001  E.....@.@.1@....
        0x0010:  7f00 0001 c55c 05a3 905c 04de 5983 fd53  .....\...\..Y..S
        0x0020:  8018 0156 0093 0000 0101 080a 96ee 0dcb  ...V............
        0x0030:  96ee 0dcb 0d0a 0d0a 000d 0a51 5549 540a  ...........QUIT.
        0x0040:  2111 0014 47a2 f3d2 0a01 015c d6b2 1388  !...G......\....
        0x0050:  2000 0500 0000 0000 1603 0102 4101 0002  ............A...
                                      ^-------------------TLS starts here

If I run with with just send-proxy-v2 (no -ssl) I see the exact same thing.

Am I missing something about how this should work?

New contributor
marcantonio is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    Maybe this don't work with mode tcp? – marcantonio Sep 11 at 20:11
  • This doesn't look like a PROXY protocol v2 header. Mostly because per specification, it MUST start with 0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A. Is the tcpdump output truncated? If not, did you manage to get PROXY protocol v2 to work (without TLS for starter). I can confirm it works with TCP so ensure you have a functional starting point. – Ginnungagap Sep 11 at 21:54
  • @Ginnungagap That byte sequence appears in the tcpdump output. – Michael Hampton Sep 11 at 22:31
  • Right, sorry about that, it must have been past the my bedtime... – Ginnungagap Sep 12 at 6:47
1

From your configuration, HAProxy doesn't handle the SSL part of the connection so it cannot provide SSL information in the PROXY protocol header.

Add a crt <cert> directive to your frontend bind and you should see the SSL information in the PROXY protocol header.

If you think about it, it's rather normal since if HAProxy was to provide you with that information despite not handling the SSL termination, it couldn't appropriately request client certificates, offer cipher suites or any other options that are negotiated during the handshake.

  • That makes sense. I suppose it would be unnecessary since the TLS connection is not terminated. Thanks! – marcantonio Sep 12 at 13:15
0

To add to @Ginnungagap's answer, you can see additional proxy protocol TLVs in the tcpdump output by setting send-proxy-v2 proxy-v2-options crc32c. No SSL termination needed.

New contributor
marcantonio is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

marcantonio is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.