Add TLS ALPN support #98
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hello Dustin, the fact that it only supports a single method of backend selection makes it quite impractical. In effect for my use-case (distinguish traffic for ocserv vpn), it makes it an unsuitable solution as I need alpn or sni. As ALPN is not deployed yet, most use cases will be using sni or alpn initially as well. Proxying through another sniproxy is too much overhead to be considered as a solution. |
Use protocol data functionality to hold configure ALPN protocols. Since the complexity increased and there wasn't a clear use case, support only a single TLS extension at a time per listener: TLS or ALPN. Complex configurations involving both ALPN and SNI can be accomplished by using configuring SNIProxy to proxy to another of its own listeners over a UNIX socket to examine the other TLS extension. Use an additional protocol argument toggle between SNI and ALPN TLS extensions.
|
Hello Dustin, is there any update on that? Do you plan to allow selecting between ALPN or SNI on a server? |
|
Any chance you can update this PR and merge it? And possibly add an example configuration of proxying ALPN back to sniproxy? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add support for switching backends by TLS ALPN (Application Layer Protocol Negotiation) extension. This is based on #66, but avoids adding additional dependencies to the TLS module and only supports a single method of backend selection: SNI or ALPN. More complex configurations could be achieved by proxying back to sniproxy on over a local UNIX socket to another listener configured for the other protocol.
The configuration syntax is also changed compared to #66:
Linker dependencies for master branch:
And for ALPN branch:
@nmav I would appreciate your review of this pull request since it is based on your earlier work.