Haproxy - HTTP/2 - TLS ALPN - Don't work correctly

问题

I have a centos 7 server with OpenSSl 1.0.2j fully working. With Nginx working correcly with HTTP/2 but haproxy fail.

When I try to run a curl ( is already version 7.51 ) once is enabled alpn h2 I have the following error :

curl --http2 -I https://domain:port/file.htm
curl: (16) Error in the HTTP2 framing layer

If I disabled h2, curl work correctly but of course only connect http 1.1 :

curl --http2 -I https://domain.com:port/file.htm
HTTP/1.1 200 OK
Server: nginx/1.11.6
Date: Fri, 18 Nov 2016 12:22:47 GMT
Content-Type: text/html; charset=utf-8
Last-Modified: Wed, 10 Aug 2016 10:27:58 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "57ab01ae-59"
Expires: Tue, 13 Dec 2016 12:22:47 GMT
Cache-Control: max-age=2160000
X-Page-Speed: Powered By ngx_pagespeed

Here I put haproxy setting ( it suppose only is setup https mode )

global

  # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # Default ciphers to use on SSL-enabled listening sockets.
    ssl-default-bind-options   no-sslv3 no-tls-tickets force-tlsv12
    ssl-default-bind-ciphers   ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS

    spread-checks 4

    tune.maxrewrite 1024
    tune.ssl.default-dh-param 2048

...

frontend
    mode tcp
    bind 0.0.0.0:60641 ssl crt /etc/haproxy/certs/domain.pem alpn h2,http/1.1

   http-response set-header Strict-Transport-Security "max-age=16000000; includeSubDomains; preload;"

...

backend

  stick-table type ip size 200k expire 30m
  stick on src

  server server_51_a4.domain.com IP:PORT check ssl verify none

I have read a lot of sites and information related

OpenSSL Information : https://www.nginx.com/blog/supporting-http2-google-chrome-users/

Setup curl haproxy and others : https://blog.cloudflare.com/tools-for-debugging-testing-and-using-http-2/

Best site to setup Nginx and Haproxy : http://m12.io/blog/http-2-with-haproxy-and-nginx-guide

Here Haproxy vv information

HA-Proxy version 1.7-dev3 2016/05/10
Copyright 2000-2016 Willy Tarreau <willy@haproxy.org>

Build options :
  TARGET  = linux2628
  CPU     = generic
  CC      = gcc
  CFLAGS  = -O2 -g -fno-strict-aliasing -DTCP_USER_TIMEOUT=18
  OPTIONS = USE_LINUX_TPROXY=1 USE_ZLIB=1 USE_REGPARM=1 USE_OPENSSL=1 USE_LUA=1 USE_PCRE=1 USE_PCRE_JIT=1

Default settings :
  maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.7
Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with OpenSSL version : OpenSSL 1.0.2j  26 Sep 2016
Running on OpenSSL version : OpenSSL 1.0.2j  26 Sep 2016
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.32 2012-11-30
PCRE library supports JIT : yes
Built with Lua version : Lua 5.3.0
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND

Available polling systems :
      epoll : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.

Available filters :
    [COMP] compression
    [TRACE] trace

Also I have seen another site where told haproxy don't support Http/2.

https://istlsfastyet.com/#server-performance

What is the problem ? Haproxy ?

Centos 7 openssl support ?

Thank you for read. Help world to have haproxy ready for http/2.

I want to add another question related.

"When setting up haproxy in front on a web server, haproxy will do the ALPN negotiation".

And what happen if we can use haproxy with two levels and in different servers.

Server 01 - Level 01 - Haproxy ( listen ssl)


Server 02 - Level 02 - Haproxy ( listen ssl)


Server 03 - Level 03 - Nginx  ( listen no ssl )

In this model, who did Alpn negotiation ?

In my test I have trying to make a proxy from SSL to another SSL server.

Thanks for all.

Brqx / Ricardo.

回答1:

When setting up haproxy in front on a web server, haproxy will do the ALPN negotiation. That means that only haproxy knows which protocol was negotiated (http/1.1 or h2). I believe you're seeing an error because haproxy is negotiating h2, and then sending clear text HTTP/2 traffic to a server that's not expecting it.

As pointed out by the 'The complete guide to HTTP/2 with HAProxy and Nginx' site you liked to, the way you address that is that you make Nginx listed for two ports: one for HTTP/1.1 and another for HTTP/2:

  listen      80  default_server;
  listen      81  default_server http2 proxy_protocol; ## Needed when behind HAProxy with SSL termination + HTTP/2 support

Then, in haproxy, you declare two backends:

backend nodes-http
    server node1 web.server:80 check

backend nodes-http2
    mode tcp
    server node1 web.server:81 check send-proxy

and direct traffic depending on the negotiated ALPN protocol:

use_backend nodes-http2 if { ssl_fc_alpn -i h2 }

来源：https://stackoverflow.com/questions/40679618/haproxy-http-2-tls-alpn-dont-work-correctly

标签

curl

centos7

HAproxy

http2