Page MenuHomePhabricator

HAproxy and varnish misreport the authentication mechanism used in TLSv1.3 traffic
Closed, ResolvedPublic

Description

using openssl s_client to force the usage of the RSA certificate with TLSv1.3:

vgutierrez@traffic-cache-upload-bullseye:~$ echo -e "GET /\r\nHost: 127.0.0.1:443\r\n\r\n" | openssl s_client -tls1_3 -sigalgs "RSA-PSS+SHA512:RSA-PSS+SHA384:RSA-PSS+SHA256:RSA+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA224:RSA+SHA1"  -connect 127.0.0.1:443 2>&1 |grep -i "Peer Signature Type"
Peer signature type: RSA-PSS

haproxy sends the following x-analytics-tls header:

ReqHeader      x-analytics-tls: vers=TLSv1.3;keyx=unknown;auth=ECDSA;ciph=AES-256-GCM-SHA384;prot=h1;sess=new

for varnish the same issue is there given that it's only using X-Connection-Properties header and right now it attempts to infer the authentication mechanism from the ciphersuite and that's no longer possible with TLSv1.3

Event Timeline

Vgutierrez moved this task from Backlog to Traffic team actively servicing on the Traffic board.
Vgutierrez renamed this task from HAproxy misreports the authentication mecanism in TLSv1.3 traffic to HAproxy and varnish misreport the authentication mechanism used in TLSv1.3 traffic.Sep 26 2024, 7:40 AM
Vgutierrez updated the task description. (Show Details)

Change #1075849 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] varnish: Prepare for KA field on X-Connection-Properties

https://gerrit.wikimedia.org/r/1075849

Change #1075853 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] haproxy: Fix RSA usage reporting for TLSv1.3

https://gerrit.wikimedia.org/r/1075853

Change #1075858 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] varnish: Use XCP KA field to report TLS auth data

https://gerrit.wikimedia.org/r/1075858

Change #1075849 merged by Vgutierrez:

[operations/puppet@production] varnish: Prepare for KA field on X-Connection-Properties

https://gerrit.wikimedia.org/r/1075849

Change #1075853 merged by Vgutierrez:

[operations/puppet@production] haproxy: Fix RSA usage reporting for TLSv1.3

https://gerrit.wikimedia.org/r/1075853

Change #1075880 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] haproxy: Fix XCP value syntax

https://gerrit.wikimedia.org/r/1075880

Change #1075880 merged by Vgutierrez:

[operations/puppet@production] haproxy: Fix XCP value syntax

https://gerrit.wikimedia.org/r/1075880

Change #1075858 merged by Vgutierrez:

[operations/puppet@production] varnish: Use XCP KA field to report TLS auth data

https://gerrit.wikimedia.org/r/1075858

-   ReqUnset       x-tls-prot: h1
-   ReqUnset       x-tls-vers: TLSv1.3
-   ReqUnset       x-tls-sess: new
-   ReqUnset       x-tls-keyx: UNKNOWN
-   ReqUnset       x-tls-auth: RSA
-   ReqUnset       x-tls-ciph: AES-128-GCM-SHA256
`` 

we should start getting RSA data for TLSv1.3 as soon as puppet runs in the cp nodes