|
| 1 | +# OpenBSD relayd research for echothrust hosts |
| 2 | +The following document will outline the findings with regards to our research |
| 3 | +on the subject of utilizing `relayd` for infrastructure. The needs for usage in |
| 4 | +particularly on `puffy.echothrust.com` in order to serve `www.echothrust.com`, |
| 5 | +`gitlab.echothrust.com` for both HTTP and HTTPS accelerator along with the |
| 6 | +ability to serve a separate content on cases where a downtime is required. |
| 7 | + |
| 8 | +At the same time we want to filter certain requests based on protocol specific |
| 9 | +criteria (eg when the `Host` http header is not set, deny specific URL patterns |
| 10 | +and other such cases). |
| 11 | + |
| 12 | +**NOTE**: The configuration directives `interval`, `timeout` and `prefork` must |
| 13 | +be before the table definitions otherwise they might not work. This is as of |
| 14 | +16/03/2016 (relayd - prefork option seems to be ignored). |
| 15 | + |
| 16 | +Relayd makes the following distinctions with regards to the relaying capabilities: |
| 17 | + |
| 18 | +* **`Redirections`** Redirections are translated to pf(4) rdr-to rules for stateful forwarding to a target host from a health-checked table on layer 3. |
| 19 | +* **`Relays`** Relays allow application layer load balancing, TLS acceleration, and general purpose TCP proxying on layer 7. |
| 20 | +* **`Routers`** Routers are used to insert routes with health-checked gateways for (WAN) link balancing. |
| 21 | + |
| 22 | +## Preparing for relayd |
| 23 | +You'd have to pump up the your `ulimit` a bit in order for `relayd` to be able |
| 24 | +to start. The best option is to create a specific section on your |
| 25 | +`/etc/login.conf` for the daemon to use. |
| 26 | + |
| 27 | +Depending on your requirements you may need to tweak this a bit |
| 28 | +``` |
| 29 | +relayd:\ |
| 30 | + :openfiles-cur=1024:\ |
| 31 | + :openfiles-max=2048:\ |
| 32 | + :tc=daemon: |
| 33 | +``` |
| 34 | + |
| 35 | +Futhermore for SSL off-loading to be work we will have to create a private key |
| 36 | +and a certificate for each individual IP's that relay will serve. |
| 37 | + |
| 38 | +The file locations are `/etc/ssl/private/IP:port.key` and `/etc/ssl/IP.ctt` |
| 39 | + |
| 40 | +## Configuring www.echothrust.com |
| 41 | + |
| 42 | +``` |
| 43 | +ext_if="re0" |
| 44 | +www_echothrust_com="172.20.3.240" |
| 45 | +web_echothrust_com="10.5.0.2" |
| 46 | +
|
| 47 | +gitlabpub_echothrust_com="172.20.3.240" |
| 48 | +gitlab_echothrust_com="10.5.0.3" |
| 49 | +
|
| 50 | +interval 10 |
| 51 | +timeout 1000 |
| 52 | +prefork 10 |
| 53 | +
|
| 54 | +table <www_echothrust_com> { $web_echothrust_com } |
| 55 | +table <gitlab_echothrust_com> { $gitlab_echothrust_com } |
| 56 | +table <fallback> disable { 127.0.0.1 } |
| 57 | +
|
| 58 | +http protocol www_echothrust_com_filter { |
| 59 | + include "/etc/www_echothrust_com_filters-relayd.conf" |
| 60 | +
|
| 61 | + # Various TCP performance options |
| 62 | + tcp { nodelay, sack, socket buffer 65536, backlog 128 } |
| 63 | +} |
| 64 | +
|
| 65 | +http protocol www_echothrust_com_sslfilter { |
| 66 | + include "/etc/www_echothrust_com_filters-relayd.conf" |
| 67 | + match request header set "HTTPS" value "on" |
| 68 | + match request header append "X-Forwarded-Proto" value "https" |
| 69 | +
|
| 70 | + # Various TCP performance options |
| 71 | + tcp { nodelay, sack, socket buffer 65536, backlog 128 } |
| 72 | +
|
| 73 | + ssl { no sslv2, sslv3, tlsv1, ciphers HIGH } |
| 74 | + ssl session cache disable |
| 75 | +
|
| 76 | +} |
| 77 | +
|
| 78 | +relay www_echothrust_com_proxy { |
| 79 | + listen on $www_echothrust_com port 8880 |
| 80 | + protocol www_echothrust_com_filter |
| 81 | +
|
| 82 | + forward to <www_echothrust_com> port http check http "/" code 200 |
| 83 | + forward to <fallback> port http check http "/" code 200 |
| 84 | +} |
| 85 | +
|
| 86 | +relay www_echothrust_com_ssl { |
| 87 | + # Run as a SSL accelerator |
| 88 | + listen on $www_echothrust_com port 443 ssl |
| 89 | + protocol www_echothrust_com_sslfilter |
| 90 | +
|
| 91 | + forward to <www_echothrust_com> port http check http "/" code 200 |
| 92 | + forward to <fallback> port http check http "/" code 200 |
| 93 | +} |
| 94 | +
|
| 95 | +http protocol gitlab_echothrust_com_sslfilter { |
| 96 | + match request header set "HTTPS" value "on" |
| 97 | + match request header append "X-Forwarded-Proto" value "https" |
| 98 | +
|
| 99 | + # Various TCP performance options |
| 100 | + tcp { nodelay, sack, socket buffer 65536, backlog 128 } |
| 101 | +
|
| 102 | + ssl { no sslv2, sslv3, tlsv1, ciphers HIGH } |
| 103 | + ssl session cache disable |
| 104 | +} |
| 105 | +
|
| 106 | +
|
| 107 | +relay gitlab_echothrust_com_ssl { |
| 108 | + # Run as a SSL accelerator |
| 109 | + listen on $gitlabpub_echothrust_com port 443 ssl |
| 110 | + protocol gitlab_echothrust_com_sslfilter |
| 111 | +
|
| 112 | + forward to <gitlab_echothrust_com> port http check http "/" code 200 |
| 113 | + forward to <fallback> port http check http "/" code 200 |
| 114 | +} |
| 115 | +``` |
| 116 | + |
| 117 | +The contents of the file "/etc/www_echothrust_com_filters-relayd.conf" has the following contents |
| 118 | +``` |
| 119 | + # Return HTTP/HTML error pages to the client |
| 120 | + return error style "body { background: #e7e9ec; color:#737373; font:normal 13px/21px \"Droid Sans\", sans-serif; }\nhr { border: 0; border-bottom: 1px dashed; }" |
| 121 | +
|
| 122 | + match request label "Invalid Host" |
| 123 | + pass request quick header "Host" value "echothrust.com" |
| 124 | + pass request quick header "Host" value "www.echothrust.com" |
| 125 | + block request quick header "Host" value "*" |
| 126 | +
|
| 127 | + # Block disallowed sites |
| 128 | + match request label "URL filtered!" |
| 129 | + block request quick url "www.echothrust.com/wp-login.php" value "*" |
| 130 | + block request quick path "/wp-login.php" value "*" |
| 131 | +
|
| 132 | + # Add forwarder-for and by header details |
| 133 | + match request header append "X-Forwarded-For" value "$REMOTE_ADDR" |
| 134 | + match request header append "X-Forwarded-By" value "$SERVER_ADDR:$SERVER_PORT" |
| 135 | + match request header append "X-Real-IP" value "$REMOTE_ADDR" |
| 136 | +
|
| 137 | + match request header set "Connection" value "close" |
| 138 | + match request header "Keep-Alive" value "$TIMEOUT" |
| 139 | +``` |
| 140 | + |
| 141 | +# Managing fallback |
| 142 | +In order to initiate a downtime period you'll have to disable the primary table |
| 143 | +`<www_echothrust_com>` and activate the fallback. |
| 144 | + |
| 145 | +``` |
| 146 | +relayctl table disable www_echothrust_com:80 |
| 147 | +relayctl table disable www_echothrust_com:443 |
| 148 | +relayctl table enable fallback:80 |
| 149 | +relayctl table enable fallback:443 |
| 150 | +relayctl poll |
| 151 | +``` |
| 152 | + |
| 153 | +# Modify the error pages |
| 154 | +In order to modify your return pages (the error pages that relayd sends back to |
| 155 | +the client in case of an error) you have to modfy the following details |
| 156 | + |
| 157 | +* `relayd/relay_http.c` modify the function `relay_abort_http` where the code |
| 158 | +reads like this |
| 159 | +``` |
| 160 | + /* A CSS stylesheet allows minimal customization by the user */ |
| 161 | + style = (rlay->rl_proto->style != NULL) ? rlay->rl_proto->style : |
| 162 | + "body { background-color: #a00000; color: white; font-family: " |
| 163 | + "'Comic Sans MS', 'Chalkboard SE', 'Comic Neue', sans-serif; }\n" |
| 164 | + "hr { border: 0; border-bottom: 1px dashed; }\n"; |
| 165 | +
|
| 166 | + /* Generate simple HTTP+HTML error document */ |
| 167 | + if ((bodylen = asprintf(&body, |
| 168 | + "<!DOCTYPE html>\n" |
| 169 | + "<html>\n" |
| 170 | + "<head>\n" |
| 171 | + "<title>%03d %s</title>\n" |
| 172 | + "<style type=\"text/css\"><!--\n%s\n--></style>\n" |
| 173 | + "</head>\n" |
| 174 | + "<body>\n" |
| 175 | + "<h1>%s</h1>\n" |
| 176 | + "<div id='m'>%s</div>\n" |
| 177 | + "<div id='l'>%s</div>\n" |
| 178 | + "<hr><address>%s at %s port %d</address>\n" |
| 179 | + "</body>\n" |
| 180 | + "</html>\n", |
| 181 | + code, httperr, style, httperr, text, |
| 182 | + label == NULL ? "" : label, |
| 183 | + RELAYD_SERVERNAME, hbuf, ntohs(rlay->rl_conf.port))) == -1) |
| 184 | + goto done; |
| 185 | +
|
| 186 | +``` |
| 187 | + |
| 188 | +* `relayd/relayd.h` modify the line |
| 189 | +``` |
| 190 | +#define RELAYD_SERVERNAME "OpenBSD relayd" |
| 191 | +``` |
| 192 | + |
| 193 | +## Per url relay |
| 194 | +``` |
| 195 | +table <web0> { 10.0.0.0 } |
| 196 | +table <web1> { 10.0.0.1 } |
| 197 | +table <web2> { 10.0.0.2 } |
| 198 | +table <web3> { 10.0.0.3 } |
| 199 | +
|
| 200 | +http protocol echolab { |
| 201 | + return error |
| 202 | + pass |
| 203 | + match request path "/web1*" forward to <web1> |
| 204 | + match request path "/web2*" forward to <web2> |
| 205 | + match request path "/web3*" forward to <web3> |
| 206 | +} |
| 207 | +
|
| 208 | +relay echolab { |
| 209 | + listen on $www_echothrust_com port 80 |
| 210 | + protocol echolab |
| 211 | +
|
| 212 | + # Main server table |
| 213 | + forward to <web0> check tcp port 80 |
| 214 | +
|
| 215 | + # Additional server tables used by custom rules |
| 216 | + forward to <web1> check tcp port 80 |
| 217 | + forward to <web2> check tcp port 80 |
| 218 | + forward to <web3> check tcp port 80 |
| 219 | +} |
| 220 | +``` |
| 221 | + |
| 222 | + |
| 223 | +## login.conf |
| 224 | +relayd:\ |
| 225 | + :maxproc-max=31:\ |
| 226 | + :openfiles-cur=16384:\ |
| 227 | + :openfiles-max=65536:\ |
| 228 | + :tc=daemon: |
0 commit comments