ssl - Weird behavior/error trying to use HAProxy to forward requests to ELBs -


we have architecture have several apis on multiple hosts. each api sits behind aws elb. want put proxy in front route requests based on uri elb.

what have far works, 3 out of 10 requests result in following error (using curl, problem isn't curl):

curl: (35) unknown ssl protocol error in connection test-router.versal.com:-9847

i have feeling elb culprit. ssl terminated there.

here our haproxy config:

global   log 127.0.0.1   local0   log 127.0.0.1   local1 notice   maxconn 10240   user haproxy   group haproxy   daemon   debug   stats socket /var/run/haproxy.sock   log-send-hostname test-router.domain.com   description "haproxy on test-router.domain.com"  defaults   log     global   mode    http   option  httplog   option  dontlognull   retries 3   option redispatch   option forwardfor   option httpclose   option dontlognull   option tcpka   maxconn 10240   timeout connect 10000ms   timeout client 600000ms   timeout server 600000ms  frontend public   bind *:80   bind *:443   acl elb0 path_beg /elb0   acl elb1 path_beg /elb1   use_backend elb0 if elb0   use_backend elb1 if elb1    bind 0.0.0.0:443 ssl crt /etc/ssl/cert.pem no-sslv3 ciphers aes128+eecdh:aes128+edh  backend elb0   server server_vcat elb0.domain.com:443 ssl verify none  backend elb1   server server_laapi elb1.domain.com:443 ssl verify none

the ssl curl not terminated @ elb. terminated @ haproxy, in configuration...

bind 0.0.0.0:443 ssl crt /etc/ssl/cert.pem no-sslv3 ciphers aes128+eecdh:aes128+edh

...and entirely different ssl session established haproxy on connection elb:

server ... ssl verify none

an ssl problem elb not possibly propagated curl through haproxy in configuration.

the problem in haproxy configuration, here:

bind *:443

remove line. it's redundant (and incorrect).

you telling haproxy bind port 443 twice: once speaking ssl, , once not speaking ssl.

so, statistically, on approximately 50% of connection attempts, curl finds haproxy not speaking ssl on port 443 -- it's speaking http, , curl can't (and shouldn't) handle gracefully.

i believe (mis)configuration goes undetected haproxy, not because of actual bug, rather because of way things implemented in haproxy internals, related multi-process deployments , hot reloads, in case valid have haproxy bound same socket more once.


Comments

Post a Comment

Popular posts from this blog

Retrieving ETA (estimated time of arrival) with Google Distance Matrix API and public transit as transport mode -

Image
is possible retrieve eta google's distancematrix api (or alternative api). fyi, eta different duration, when using public transport. following example clarify request. when leave on friday @ 8.15 i'll able catch train @ 8.30 , arrive @ 9.00 am. google says duration 30 minutes. however, when leave on saturday @ 8.15 i'll able catch first train @ 9.00 , arrive @ 9.30 am. google still says duration 30 minutes, means ignore delay. google map supports functionality there api around giving me eta instead of duration. can see, distance-matrix' response no good. clarifying question little. eta estimated time of arrival , it's clear user wants know entire duration of transport (including waiting time public transport).
Read more

javascript - Confirm a form & display message if form is valid with JQuery -

i'm developing django application , use javascript in order improve website. i have form , display 2 things : confirm form before submit if form submitted, display message : 'form saved' it's first time i'm using js , need make process. this code : <form class = "form" method='post' action=''> {% csrf_token %} <br></br> {{ form.as_p}} <br></br> <button type="submit">valider</button> </form> <script> $('#form').submit(function() { var c = confirm("click ok continue?"); return c; //you can return c because true or false }); </script> and if form valid , saved : <script type="text/javascript" > $(document).on('valider', 'form.form', function(form) { var $form = $(form); $.ajax({ ...
Read more

ionic framework - Meteor - Error: Failed to execute 'insertBefore' on 'Node' -

i trying make dynamic list display using meteor, idea load more elements each time bottom of page reached. the html template following : <template name="contacts"> {{#contentfor "headertitle"}} <div class="bar bar-header bar-assertive"> <h1 class="title">contacts :</h1> </div> {{/contentfor}} {{#ionview}} {{#ioncontent}} <div class="list"> {{#each contacts}} <a class="item item-avatar" href="/contacts/{{_id}}"> <img src="/img/ico_client.png"> <h2>{{full_name}}</h2> <p>{{company}}</p> </a> {{/each}} </div> {{#if moreresults}} <div id="showmoreresults" style="margin-left: 25px;"> <span class="loading">loading...</span> </div> {{/if}} {{/ioncontent}} {{/ionview}} </te...
Read more