<div>
I am trying to setup stunnel with protocol = proxy through haproxy to my apache2 cluster. I have been using haproxy for a while, and wanted to try this before having to go to nginx, or some other proxy. My config works fine as is if I remove the "accept proxy" from the haproxy.cfg and the protocol=proxy from stunnel config, as soon as those are in, I get a 502 bad gateway.
</div><div><br></div><div>My haproxy.cfg:</div><div><br></div><div><div>global</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>log 127.0.0.1<span class="Apple-tab-span" style="white-space:pre"> </span>local0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>log 127.0.0.1<span class="Apple-tab-span" style="white-space:pre"> </span>local1 debug</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#log loghost<span class="Apple-tab-span" style="white-space:pre"> </span>local0 info</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>maxconn 50000</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#chroot /usr/share/haproxy</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>user haproxy</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>group haproxy</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>daemon</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#debug</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#quiet</div><div><br></div><div>defaults</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>log<span class="Apple-tab-span" style="white-space:pre"> </span>global</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mode<span class="Apple-tab-span" style="white-space:pre"> </span>http</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>option<span class="Apple-tab-span" style="white-space:pre"> </span>httplog</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>option<span class="Apple-tab-span" style="white-space:pre"> </span>dontlognull</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>option forwardfor</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>retries<span class="Apple-tab-span" style="white-space:pre"> </span>3</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>option redispatch</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>maxconn<span class="Apple-tab-span" style="white-space:pre"> </span>50000</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>contimeout<span class="Apple-tab-span" style="white-space:pre"> </span>5000</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>clitimeout<span class="Apple-tab-span" style="white-space:pre"> </span>60000</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>srvtimeout<span class="Apple-tab-span" style="white-space:pre"> </span>300000</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>stats uri /haproxy_xxxx</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>stats realm Global\ statistics</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>stats auth xxxxxx:xxxxxxx</div><div><br></div><div>frontend dev-stg</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>bind *:80</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mode http</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>timeout client 5m</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>option forwardfor</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>default_backend dev-www</div><div><span class="Apple-tab-span" style="white-space:pre"> </span></div><div>frontend dev-stg-ssl</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>bind *:81 accept-proxy</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mode http</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>option httpclose</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>option forwardfor</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>timeout client 5m</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>default_backend dev-www</div><div> </div><div>backend dev-www</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mode http</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>timeout connect 10s</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>timeout server 600s</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>balance roundrobin</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#begin_web_config</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>server ws1 10.0.2.10 maxconn 1000 check port 80</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#end_web_config</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>stats uri /haproxy_xxxx</div><div><span class="Apple-tab-span" style="white-space: pre; "> </span>stats realm Global\ statistics</div><div><span class="Apple-tab-span" style="white-space: pre; "> </span>stats auth xxxxxx:xxxxxxx</div><div><br></div><div>My stunnel config:</div><div><br></div><div><div>; *****************************************************************************</div><div>; * Global Options *</div><div>; *****************************************************************************</div><div><br></div><div>; A copy of some devices and system files is needed within the chroot jail</div><div>; Chroot conflicts with configuration file reload and many other features</div><div>chroot = /var/lib/stunnel4/</div><div>; Chroot jail can be escaped if setuid option is not used</div><div>setuid = stunnel4</div><div>setgid = stunnel4</div><div><br></div><div>; PID is created inside the chroot jail</div><div>pid = /stunnel4.pid</div><div><br></div><div>; Debugging stuff (may useful for troubleshooting)</div><div>debug = 7</div><div>output = /var/log/stunnel4/stunnel.log</div><div><br></div><div>; *****************************************************************************</div><div>; * Service Defaults (may also be specified in individual service sections) *</div><div>; *****************************************************************************</div><div><br></div><div>; Certificate/key is needed in server mode and optional in client mode</div><div>cert = /usr/local/certs/server.crt</div><div>key = /usr/local/certs/server.key</div><div><br></div><div>; Disable support for insecure SSLv2 protocol</div><div>options = NO_SSLv2</div><div>; Workaround for Eudora bug</div><div>;options = DONT_INSERT_EMPTY_FRAGMENTS</div><div><br></div><div>; The following options provide additional security at some performance penalty</div><div>; Default ECDH/DH parameters are strong/conservative, so it is quite safe to</div><div>; comment out these lines in order to get a performance boost</div><div>;options = SINGLE_ECDH_USE</div><div>;options = SINGLE_DH_USE</div><div><br></div><div>; *****************************************************************************</div><div>; * Service Definitions (remove all services for inetd mode) *</div><div>; *****************************************************************************</div><div><br></div><div>; Example SSL server mode services</div><div>; Example SSL front-end to a web server</div><div><br></div><div>[proxy]</div><div>accept = 443</div><div>connect = 127.0.0.1:81</div><div>; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL</div><div>; It does not use SSL close-notify alert designed to prevent truncation attacks</div><div>TIMEOUTclose = 0</div><div>protocol = proxy</div><div>; vim:ft=dosini</div><div><br></div><div>And here is the syslog for haproxy and stunner (ip address in log and cfgs are changed to protect the innocent ;-) )</div><div><br></div><div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193127680]: Service [proxy] accepted (FD=3) from 1.2.3.4:35045</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Service [proxy] started</div><div><span>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Service [proxy] accepted connection from </span>1.2.3.4<span>:35045</span></div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: connect_blocking: connecting 127.0.0.1:81</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: connect_blocking: s_poll_wait 127.0.0.1:81: waiting 10 seconds</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: connect_blocking: connected 127.0.0.1:81</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Service [proxy] connected remote server from 127.0.0.1:49010</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Remote socket (FD=8) initialized</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Server-mode proxy protocol negotiations started</div><div><span>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: -> PROXY TCP4 </span>1.2.3.4<span> 10.0.2.9 35045 443</span></div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Server-mode proxy protocol negotiations succeeded</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: SSL accepted: new session negotiated</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption)</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Compression: null, expansion: null</div><div><span>Jun 7 07:10:50 localhost haproxy[1710]: </span>1.2.3.4<span>:35045 [07/Jun/2012:07:10:50.496] dev-stg-ssl dev-www/ws1 214/0/1/-1/216 502 754 - - PH-- 0/0/0/0/0 0/0 "GET / HTTP/1.1"</span></div><div><span>Jun 7 07:10:50 localhost haproxy[1710]: </span>1.2.3.4<span>:35045 [07/Jun/2012:07:10:50.496] dev-stg-ssl dev-www/ws1 214/0/1/-1/216 502 754 - - PH-- 0/0/0/0/0 0/0 "GET / HTTP/1.1"</span></div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Socket closed on read</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Sending close_notify alert</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: SSL_shutdown successfully sent close_notify alert</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG3[1737:140557193119488]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Connection closed: 204 byte(s) sent to SSL, 137 byte(s) sent to socket</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Remote socket (FD=8) closed</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Local socket (FD=3) closed</div><div>Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Service [proxy] finished (0 left)</div><div><br></div><div><br></div><div>1.2.3.4 = my external ip I am testing with</div><div>10.0.2.9 = haproxy/stunnel server</div><div>10.0.2.10 = my apache server</div><div><br></div></div></div></div>
<div><div>Any ideas greatly appreciated.</div><div><br></div><div><div style="font-size: 13px; ">-- </div><div style="font-size: 13px; ">Robert Garcia</div><div style="font-size: 13px; ">BigHead Technology</div><div style="font-size: 13px; ">15520 Coutolenc Rd</div><div style="font-size: 13px; ">Magalia, Ca 95954</div><div style="font-size: 13px; ">ph: 530.645.4040 x222 fax: 530.645.4040</div><div style="font-size: 13px; "><a href="mailto:rgarcia@bighead.net" style="color: rgb(0, 106, 227); ">rgarcia@bighead.net</a> - <a href="http://bighead.net/" style="color: rgb(0, 106, 227); ">http://bighead.net/</a></div></div></div>