HAProxy in `mode tcp` accepts HTTP with HTTPS backend

@pludikovsky wrote:

I’m seeing a pretty strange behavior with one HAProxy setup using mode tcp trying to do pass-through to 2 HTTPS enabled servers.

Relevant configuration:

frontend front-ssl
  default_backend back-ssl
  bind 1.1.1.1:443
  mode tcp

backend back-ssl
  server back-ssl-001 1.1.1.2:8443 weight 100 check check-ssl maxconn 128 ssl verify none
  server back-ssl-002 1.1.1.3:8443 weight 100 check check-ssl maxconn 128 ssl verify none
  log global
  balance leastconn
  mode tcp
  option httpchk GET /check
  http-check expect status 200

As far as I can tell from the configuration & documentation this should work by just passing through the TCP packets. However, what I see is that the bind address accepts plain text HTTP requests which it encapsulates in HTTPS requests to the backend:

telnet 1.1.1.1 443
Trying 1.1.1.1...
Connected to 1.1.1.1.
Escape character is '^]'.
GET / HTTP/1.1
Connection: close
Accept: */*
Host: myservice.mydomain

HTTP/1.1 404 Not Found
Date: Tue, 03 Mar 2020 14:28:06 GMT
Connection: close

HAproxy is 1.7.12-1ppa1~xenial

Posts: 1

Participants: 1

Read full topic