Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for HTTPS+TCP+SNI on the same listener #783

Closed
nathanejohnson opened this issue Aug 28, 2020 · 0 comments · Fixed by #784
Closed

Add support for HTTPS+TCP+SNI on the same listener #783

nathanejohnson opened this issue Aug 28, 2020 · 0 comments · Fixed by #784

Comments

@nathanejohnson
Copy link
Member

nathanejohnson commented Aug 28, 2020 •
edited
Loading

In some cases it is desirable to have TCP SNI steering as well as HTTPS proxying.

For example: Say you have one external IP address, 1.2.3.4

You have a services A, B and C that need path based (https) routing

You have service D that needs to see the client certificate, and any traffic with this SNI should be routed to D so it can terminate TLS

Adding a https+tcp+sni mode would support this use case by allowing any hosts that match D - as specified by proto=tcp or scheme is tcp:// in the route - would be tcp proxied, and that everything else would fall through to existing HTTPS routing logic.
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 28, 2020
@nathanejohnson
https+tcp+sni listener support
377ba36 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches
@nathanejohnson nathanejohnson mentioned this issue Aug 28, 2020
Merged
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 28, 2020
@nathanejohnson
https+tcp+sni listener support
259b023 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 28, 2020
@nathanejohnson
https+tcp+sni listener support
9f92192 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 30, 2020
@nathanejohnson
https+tcp+sni listener support
3a998fb 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches

Adding an integration test
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 30, 2020
@nathanejohnson
https+tcp+sni listener support
5d38e22 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches

Adding an integration test
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 30, 2020
@nathanejohnson
https+tcp+sni listener support
1a484e5 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches

Adding an integration test
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 30, 2020
@nathanejohnson
https+tcp+sni listener support
edb9a70 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches

Adding an integration test

make sure proxy is listening before starting test
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 30, 2020
@nathanejohnson
https+tcp+sni listener support
7f1f8f2 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches

Adding an integration test

make sure proxy is listening before starting test
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 30, 2020
@nathanejohnson
https+tcp+sni listener support
0cbf12c 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches

Adding an integration test

make sure proxy is listening before starting test
nathanejohnson added a commit to nathanejohnson/fabio that referenced this issue Aug 31, 2020
@nathanejohnson
https+tcp+sni listener support
ffec71e 
Adds support for the https+tcp+sni listener.  Any routes that are marked with
proto=tcp or have a scheme tcp:// will be matched for TCP steering.  Failing
any matches there, fallthrough will be to https matching.  This resolves: fabiolb#783.

clean up error handling on 'use of closed network connection' case

fix makefile tag finding stuff

fix logic for https+tcp+sni matching so that only explicit proto=tcp matches

Adding an integration test

make sure proxy is listening before starting test

add buffered err chan to Close() per dcarbone

add 1.14 and 1.15 to travis tests
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

https+tcp+sni listener support nathanejohnson/fabio
1 participant
@nathanejohnson