Uploaded image for project: 'MariaDB MaxScale'
  1. MariaDB MaxScale
  2. MXS-6010

One listener for several services, chosen by TLS SNI

    XMLWordPrintable

Details

    • New Feature
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • None
    • 26.10.0
    • mariadbclient
    • None
    • Hide
      Listeners now support [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication).
      SNI allows a client to connect to different MaxScale services through one
      listener. MaxScale can select a TLS certificate depending on the host the
      client is connecting to. This feature is configured with an external JSON
      file. See
      [listener documentation]({maxscale}/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#sni_mapping_file)
      for more information.
      Show
      Listeners now support [SNI]( https://en.wikipedia.org/wiki/Server_Name_Indication ). SNI allows a client to connect to different MaxScale services through one listener. MaxScale can select a TLS certificate depending on the host the client is connecting to. This feature is configured with an external JSON file. See [listener documentation]({maxscale}/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#sni_mapping_file) for more information.

    Description

      Description:
      Add sni_mapping_file setting to listeners. The file contents define a mapping of hostname to a certificate and a MaxScale service. This allows MaxScale to serve multiple services through one listener port. The selected certificate and service depend on the hostname the client requests in the TLS negotiation.

      Original description:
      If the client sends the hostname in the TLS SNI, select the service based on that. As a fallback, if no TLS SNI is present but connection attributes define _server_host, use that.

      The set of services that are reachable from the listener is defined in a new setting named virtual_services which takes a mapping of hostnames to services in MaxScale.

      [Listener]
      type=listener
      port=3306
      service=DefaultService
      virtual_services=foo.db.com=FooService,bar.db.com=BarService
      

      This way, if a client connects on port 3306 with a TLS connection that sets the SNI value to foo.db.com, the FooService is used. If the client connects to an unknown hostname, the normal behavior of using the service from the service setting is used.

      Attachments

        Issue Links

          Activity

            People

              esa.korhonen Esa Korhonen
              markus makela markus makela
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 10d
                  10d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 2d Time Not Required
                  2d

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.