HAProxy基于名称的路由转发到同一后端

Question

当我使用mytonic_nonssl时，它将转到http://drappointment.mytonic.com后端。但是根据配置，它应该转到drappointment_nonssl后端。

有配置问题吗？

HAProxy版本： 1.5.18

Configuration:

global
log         127.0.0.1 local2
chroot      /var/lib/haproxy
pidfile     /var/run/haproxy.pid
maxconn     4000
user        haproxy
group       haproxy
daemon
stats socket /var/lib/haproxy/stats
defaults
   timeout client 30s
   timeout server 30s
   timeout connect 5s

frontend https
   bind *:443
   mode tcp
   tcp-request inspect-delay 5s
   tcp-request content accept if { req_ssl_hello_type 1 }
   acl host_mytonicssl req_ssl_sni -i mytonic.com
   acl host_mytonicssl_www req_ssl_sni -i www.mytonic.com
   acl host_drappointmentssl req_ssl_sni -i drappointment.mytonic.com
   use_backend mytonic_ssl if host_mytonicssl
   use_backend mytonic_ssl if host_mytonicssl_www
   use_backend drappointment_ssl if host_drappointmentssl


backend mytonic_ssl
   mode tcp
   balance roundrobin
   stick-table type binary len 32 size 30k expire 30m
   acl clienthello req_ssl_hello_type 1
   acl serverhello rep_ssl_hello_type 2
   tcp-request inspect-delay 5s
   tcp-request content accept if clienthello
   tcp-response content accept if serverhello
   stick on payload_lv(43,1) if clienthello
   stick store-response payload_lv(43,1) if serverhello
   option ssl-hello-chk
   server server1 10.10.17.222:8443 check

 backend drappointment_ssl
   mode tcp
   balance roundrobin
   stick-table type binary len 32 size 30k expire 30m
   acl clienthello req_ssl_hello_type 1
   acl serverhello rep_ssl_hello_type 2
   tcp-request inspect-delay 5s
   tcp-request content accept if clienthello
   tcp-response content accept if serverhello
   stick on payload_lv(43,1) if clienthello
   stick store-response payload_lv(43,1) if serverhello
   option ssl-hello-chk
   server server1 10.10.17.222:5001 check

frontend http
   bind *:80
   mode http
   acl host_mytonic_http hdr_dom(host) -i mytonic.com
   acl host_mytonic_http_www hdr_dom(host) -i www.mytonic.com
   acl host_drappointment_http hdr_dom(host) -i drappointment.mytonic.com
   use_backend mytonic_nonssl if host_mytonic_http
   use_backend mytonic_nonssl if host_mytonic_http_www
   use_backend drappointment_nonssl if host_drappointment_http

backend mytonic_nonssl
   mode http
   balance roundrobin
   option httpclose
   option forwardfor
   server server1 10.10.17.222:8080 check

backend drappointment_nonssl
  mode http
  balance roundrobin
  option httpclose
  option forwardfor
  server server1 10.10.17.222:5000 check

Answer 1

小姐。

hdr_dom是一个“域匹配”--它匹配任何与.分隔符和/或字符串的任何一端或两端完全对齐的内容。它发现域名匹配或在域名内。

例如，这是：

hdr_dom(host) -i example.com

...matches所有这些：

example.com
www.example.com
example.com.io
us-west-2.api.example.com

你的ACL：

acl host_mytonic_http hdr_dom(host) -i mytonic.com

...matches，drappointment.mytonic.com，因此.

use_backend mytonic_nonssl if host_mytonic_http

....is请求所采用的路径，因为它是通过引用ACL计算主机头的第一条规则。使用第一个匹配项。

尝试hdr()而不是hdr_dom()

acl host_mytonic_http hdr(host) -i mytonic.com