web-services - haproxy 1.5 特定源 IP 地址在 haproxy 日志中显示 <NOSRV> 503 SC

Question

我遇到了一个不寻常的问题(就像这个网站上的每个人一样)。我有 HAProxy 监听端口 80 和 443。我正在将 SSL 加密卸载到 HAproxy，并将所有流量传递到端口 80 上的 Web 服务器。我的 HAProxy 服务器前面有一个防火墙，NAT 规则指向我的内部监听 IP 地址HA代理。我们在端口 443 上通过 SSL 收到随机 IP 源地址的异常 503 消息。其他随机 IP 地址通过 SSL 工作正常。我们的服务是一个 API，大部分流量都会通过，但只有极少数会获得 503。

这是一个有效的 HAProxy 日志条目，一个无效 工作:

localhost haproxy[5404]: XXX.XXX.XXX.XXX:54787 [15/Jun/2016:22:46:57.592] https_in_ssl~ http_www2/web1 32/0/0/232/264 200 747 - - ---- 5/4/0/1/0 0/0 "POST /webservices/ourService.asmx HTTP/1.1"

不工作:

localhost haproxy[5404]: XXX.XXX.XXX.XXX:55494 [15/Jun/2016:22:46:39.514] https_in_ssl~ https_in_ssl/<NOSRV> -1/-1/-1/-1/227 503 212 - - SC-- 3/2/0/0/0 0/0 "POST /webservices/ourService.asmx HTTP/1.0"

我注意到的一件事是前端和后端在不工作的日志条目中是相同的。

这是我的配置文件:

peers prodHAproxypeers
        peer haproxylb1 10.0.0.145:1024
        peer haproxylb2 10.0.0.146:1024

global
        log     127.0.0.1 local0
#       log /dev/log local0
#       log /dev/log local1 notice
        chroot /var/lib/haproxy
        stats socket /var/lib/haproxy/stats
        stats timeout 30s
        tune.ssl.default-dh-param 2048
        user haproxy
        group haproxy
        daemon

defaults
        log global
        mode http
        option httplog
        option dontlognull
        option redispatch
        option forwardfor
        option http-server-close
        maxconn 5000
        timeout connect 5s
        timeout client 5h
        timeout server 5h
        timeout queue 30s
        timeout http-request 5s
        timeout http-keep-alive 15s

listen stats *:1936
        mode http
        stats enable
        stats hide-version
        stats realm Haproxy\ Statistics
        stats uri /haproxy_stats
        stats auth admin:hardPassword
        stats admin if TRUE

frontend http_in
        bind *:80
        ###Add new acl and use_backend entry for each new site
        ###new backend sections will be needed as well
        acl is_www1 hdr(host) -i www1.domainname.com
        acl is_www2 hdr(host) -i www2.domainname.com
        acl is_www3 hdr(host) -i www3.domainname.com
        acl is_www4 hdr(host) -i www4.domainname.com
        acl is_wildcardwww hdr_end(host) -i domainname.com
        use_backend http_www1 if is_www1
        use_backend http_www2 if is_www2
        use_backend http_www3 if is_www3
        use_backend http_www4 if is_www4
        use_backend http_www5 if is_www5
        option forwardfor
        option http-server-close

frontend https_in_ssl
        mode http
        bind *:443 ssl crt /etc/ssl/private/ no-sslv3
        reqadd X-Forwarded-Proto:\ https
        use_backend http_www1 if { ssl_fc_sni www1.domainname.com }
        use_backend http_www2 if { ssl_fc_sni www2.domainname.com }

        acl is_ssl_www5 hdr_end(host) -i domainname.com
        use_backend http_www5 if is_ssl_www5


backend http_www1
        balance source
        cookie SRV_ID prefix
        stick-table type ip size 1m expire 6h peers prodHAproxypeers
        stick on src
        ###This site does not use host header - only the page name is needed###
#       option httpchk HEAD /Default.aspx
        ###Added host header so haproxy can route around NLB - use below for checking###
        option httpchk HEAD /Default.aspx HTTP/1.1\r\nHost:\ www1.domainname.com
        server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
        server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
        server p-websvr03 10.0.0.115:80 cookie pweb3 weight 5 check
        server p-websvr04 10.0.0.118:80 cookie pweb4 weight 5 check

backend http_www2
        balance roundrobin
        stick-table type ip size 1m expire 6h peers prodHAproxypeers
        stick on src
        ###This site uses host headers so this type of check is required###
        option httpchk HEAD /default.htm HTTP/1.1\r\nHost:\ www2.domainname.com
        server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
        server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
        server p-websvr03 10.0.0.113:80 cookie pweb3 weight 5 check
        server p-websvr04 10.0.0.116:80 cookie pweb4 weight 5 check

backend http_www3
        balance roundrobin
        cookie SRV_ID prefix
        stick-table type ip size 1m expire 6h peers prodHAproxypeers
        stick on src
        ###This site does not use host header - only the page name is needed###
        option httpchk HEAD /login.aspx HTTP/1.1\r\nHost:\ www3.domainname.com
        server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
        server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
        server p-websvr03 10.0.0.113:80 cookie pweb3 weight 5 check
        server p-websvr04 10.0.0.116:80 cookie pweb4 weight 5 check

backend http_www4
        balance roundrobin
        cookie SRV_ID prefix
        stick-table type ip size 1m expire 6h peers prodHAproxypeers
        stick on src
        ###This site uses host header so this type of check is required###
        option httpchk HEAD /default.aspx HTTP/1.1\r\nHost:\ www4.domainname.com
        server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
        server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
        server p-websvr03 10.0.0.113:80 cookie pweb3 weight 5 check
        server p-websvr04 10.0.0.116:80 cookie pweb4 weight 5 check

backend http_www5
        balance roundrobin
        cookie SRV_ID prefix
        stick-table type ip size 1m expire 6h peers prodHAproxypeers
        stick on src
        ###This site uses host header so this type of check is required###
        option httpchk HEAD /default.aspx HTTP/1.1\r\nHost:\ www5.domainname.com
        server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
        server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
        server p-websvr03 10.0.0.115:80 cookie pweb3 weight 5 check
        server p-websvr04 10.0.0.117:80 cookie pweb4 weight 5 check

Answer 1

https_in_ssl 前端似乎处理了请求，但由于没有任何后端(http_www1、http_www2 和 http_www5) 被选中，你会得到一个 503 错误(=没有选择后端，在这种情况下)。这是因为主机名不是 www1.domainname.com、www2.domainname.com 或 *.domainname.com。您可以 try catch 主机 HTTP header ，如 here 所述并查看实际值是多少，以及失败的原因。

不确定您为什么选择使用 ssl_fc_sni 而不是 hdr(host)，这似乎是一个 bad idea也可能是您问题的根本原因。