What would it take to support TLS-enabled backends? #12

Activity

1. clems4ever commented on Apr 5, 2020

   

   clems4ever

   on Apr 5, 2020

   Last edited by clems4ever

   Author

   More actions

   I mean I think it's not as simple as replacing socket.http with another library otherwise I guess you would have done it. So, can you elaborate?
2. TimWolla commented on Apr 5, 2020

   

   TimWolla

   on Apr 5, 2020

   Owner

   More actions

   I would have to test it once again, but one limitation that comes to my mind immediately is that haproxy-auth-request connects to IP addresses and not hostnames. That is because DNS lookups are not possible within the Lua script. haproxy-auth-request cheats by pulling the IP addresses HAProxy resolved from the backend structure. So I would need to set the SNI value manually (I don't know whether that's even possible with HAProxy's sockets) and also make sure to properly validate certificates.

   I mean I think it's not as simple as replacing socket.http with another library otherwise I guess you would have done it. So, can you elaborate?

   socket.http is only used for the HTTP parsing. The underlying socket is taken from HAProxy's Lua Standard library. Non-HAProxy sockets must not be used, they will cause issues. I'm planning to get rid of socket.http in the medium term (8a17b20), but that will change nothing about the SSL situation, because that's a different layer.

   ---

   The recommended workaround is something like this, pointing the auth request backend to HAProxy itself, listening on localhost, which then forwards the request TLS encrypted to the actual backend. It comes at the cost of two additional TCP connections, but allows the full HAProxy configuration flexibility with regard to TLS verification as well as header rewriting (in case that is required).

   backend auth_request_backend
     mode http  
     server proxy 127.0.0.1:8080
   
   listen auth_request_proxy
     mode http
     bind 127.0.0.1:8080
   
     server example example.com:443 ssl
   
3. TimWolla

   added

   questionFurther information is requestedFurther information is requested

   on Apr 5, 2020
4. TimWolla

   changed the title [-][Question] What would it take to support TLS-enabled backends?[/-] [+]What would it take to support TLS-enabled backends?[/+] on Apr 5, 2020
5. clems4ever commented on Apr 7, 2020

   

   clems4ever

   on Apr 7, 2020

   Author

   More actions

   Thank you for the detailed answer @TimWolla and for the workaround. It'll just be fine for me since doing the actual fix seems far from trivial with my limited knowledge.

   Thank you.

   👍React with 👍1Reacted by Tim Düsterhus
6. clems4ever

   closed this as completedon Apr 7, 2020
7. Repository owner locked and limited conversation to collaborators on May 19, 2022
8. TimWolla

   converted this issue into a discussion #48 on May 19, 2022