Join Log in
Score:0
avatar Server

How to force a specific routing based on SNI in HAProxy?

in flag
Torsten Bronger

I have the following HAProxy configuration:

listen sni-443
    bind *:443
    mode tcp

    timeout connect  4s
    timeout client   3m
    timeout server   3m
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }
    acl no-ssl req.ssl_hello_type 0

    use-server backend1.default.svc.cluster.local if !no-ssl { req_ssl_sni -i www.example.com }
    server  backend1.default.svc.cluster.local  10.96.245.95:443 weight 0

    use-server backend2.default.svc.cluster.local if !no-ssl { req_ssl_sni -i demo.example.com }
    server  backend2.default.svc.cluster.local  10.96.184.199:443 weight 0

If I visit www.example.com, everything is fine. But when I do so after having reloaded demo.example.com with high frequency (hammering on Shift-Ctrl-R in the browser), I end up at demo.example.com. Yes, exactly: I open www.example.com in the browser but HAProxy routes that to backend2 (which returns an error).

Apparently, HAProxy does not fully understand that the two services are not alternatives for load balancing but very distinct products. How can I ensure that www.example.com ends up with backend1?

265
0 + 0
sni
Michael Hampton avatar
cz flag
Michael Hampton
Call me old school, but for clarity I prefer to keep separate `frontend` and `backend` sections rather than a mixed `listen` section. Anyway your config otherwise looks fine and I see nothing here that would cause the problem. Do you have something else in front of haproxy?
0
Reply
in flag
Torsten Bronger
No. But I currently investigate whether that fact that the TLS certs for both backends contain both domains (in other words, the same certificate with aliases) may confuse HAproxy.
0
Reply
Score:1
tbielaszewski avatar Server
ng flag
tbielaszewski

This is an example from docs for req_ssl_sni:

tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
use_backend bk_allow if { req_ssl_sni -f allowed_sites }
default_backend bk_sorry_page

You probably need tcp-request inspect-delay set to something, because not setting it, means haproxy doesn't wait at all and has no idea what SNI was.
Longer explaination in docs for tcp-request inspect-delay

0 + 0
in flag
Torsten Bronger
I added further settings to my minimal configuration. They don’t prevent this unfortunate behaviour of HAProxy. What is the difference between `use_backend` and `use-server`? May this be the cause?
0
Reply
tbielaszewski avatar
ng flag
tbielaszewski
`server` is single IP:PORT service while `backend` is a whole config structure in haproxy, like `listen` or `frontend`, which contains its own rules, ACLs and servers. defining seperate backends and putting servers there could perhaps help seperate those servers further. can you post some haproxy logs, with SNI in them if possible?
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.