We have a haproxy 2.2.4-de45672 2020/09/30 working as a router proxy for another proxy (just for the records: a squid webproxy, but which should not matter here)
Here is our haproxy config
log stdout format raw local0 info
stats socket /var/run/haproxy.stat
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
stats uri /stats
stats auth xxx:yyyy
cookie SERVERID insert indirect nocache
server webproxy squid:8080
Now the problem with this haproxy and configuration is that using curl, we can test and send requests to the haproxy which work and returns us the websites content
(going through the squid webproxy)
$ curl https://abcdefghi.jklmnopqrs.de -v -x http://:8888
Output in Haproxy Log:
10.60.1.131:43080 [19/Oct/2020:09:50:37.111] proxy_in proxies_out/squid 0/0/4/32/+36 200 +124 - - --NI 1/1/1/1/0 0/0 "CONNECT abcdefghi.jklmnopqrs.de:443 HTTP/1.1"
Now the problem is from a application different than curl we get the following Haproxy error, when running the same request as we did with curl.
10.60.1.131:43080 [19/Oct/2020:09:58:54.111] proxy_in proxy_in/<NOSRV> -1/-1/-1/-1/+0 400 +211 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"
We can identify the only difference between the two requests using tcpdump, which is the port number in the Host header.
Non-Working version, see the difference between CONNECT and Host header, CONNECT has the port, the host header not.
The Application is a standard Java Webapplication using default HTTP libraries.
Working curl version, see there is no difference between the CONNECT and Host header, both have the port appended.
As this is the only remarkable difference between those two requests, we think it is due to that difference between CONNECT and Host header.
Now since we cannot change the applications code I wonder if there is an HAProxy option / flag or setting which disable this check between CONNECT and Host
header resulting in a BADREQ.
Thank you very much for your help
Note: 10/21/20 edited the haproxy log output from blockquote to preformatted_text as the blockquote killed its formatting.