Title
#kolide
grant seltzer

grant seltzer

05/14/2019, 4:47 PM
Is there any known incompatibility with connecting osqueryd to fleet through a proxy server?
zwass

zwass

05/14/2019, 4:51 PM
If you are using Launcher it tries to connect with grpc using HTTP2 which is not supported (or requires special configuration) with many proxies. With regular osqueryd I am not aware of any issues when the proxy is configured properly.
4:51 PM
What error are you seeing?
grant seltzer

grant seltzer

05/14/2019, 4:53 PM
Still the same one we were looking at a few days ago, the proxy is giving me a 503 error with osqueryd but works fine with curl, or directly to the host
4:53 PM
curl through the proxy as well
4:54 PM
Is osqueryd definitely using https as oppose to grpc?
zwass

zwass

05/14/2019, 4:55 PM
Yes osqueryd has no grpc capabilities
4:56 PM
Does the request seem to hit the Fleet server when you run it through the proxy with osqueryd (is there a log entry)? Or is it erroring at the proxy?
4:56 PM
Also what proxy is this?
grant seltzer

grant seltzer

05/14/2019, 4:57 PM
haproxy, and no it doesn't (erroring at the proxy),
4:57 PM
with curl it reaches fleet
zwass

zwass

05/14/2019, 4:58 PM
I haven't heard of such issues before... Maybe osqueryd provides (or does not provide) headers in a way that HAProxy doesn't like?
grant seltzer

grant seltzer

05/14/2019, 4:58 PM
I see there's a
proxy_hostname
flag but don't see any documentation for usage or if It's what i'm looking for
4:59 PM
I'll try taking a close look at pcaps
zwass

zwass

05/14/2019, 4:59 PM
This generally sounds like a proxy issue so I would dig into what might make HAProxy return a 503.
grant seltzer

grant seltzer

05/14/2019, 5:35 PM
Hm yea our theory right now is that osqueryd is not setting the host field of the http header
5:35 PM
which HAProxy uses to route traffic
6:33 PM
So... crazy solution
6:33 PM
We realized that osqueryd was not populating the "Host" field of the HTTP header
6:33 PM
HAProxy uses that to route to the fleet service
6:34 PM
so we just wrote a one line patch to osquery that fixed the issue
6:34 PM
We're going to open a PR soon. Does this come to mind as something that makes sense?