From 9e1733fb604e51aada4ae446c9489ac142b9332a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 11 Aug 2026 17:15:27 +0000 Subject: [PATCH 1/4] Initial plan From 4b24fe6375c2491521df2d38a21affbc520f81e6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 11 Aug 2026 17:17:53 +0000 Subject: [PATCH 2/4] Enforce strict-sni to reject unmatched SNI instead of default cert Co-authored-by: Thanhphan1147 <42444001+Thanhphan1147@users.noreply.github.com> --- docs/release-notes/artifacts/pr0621.yaml | 16 ++++++++++++++++ haproxy-operator/templates/haproxy.cfg.j2 | 2 +- 2 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 docs/release-notes/artifacts/pr0621.yaml diff --git a/docs/release-notes/artifacts/pr0621.yaml b/docs/release-notes/artifacts/pr0621.yaml new file mode 100644 index 000000000..c8b9b7509 --- /dev/null +++ b/docs/release-notes/artifacts/pr0621.yaml @@ -0,0 +1,16 @@ +version_schema: 2 + +changes: + - title: Fail TLS connections when SNI does not match a configured certificate + author: Copilot + type: minor + description: > + Added `strict-sni` to the global `ssl-default-bind-options` so HAProxy + rejects TLS connections whose SNI does not match any configured + certificate instead of falling back to a default certificate. + urls: + pr: + - https://github.com/canonical/haproxy-operator/pull/621 + related_issue: https://github.com/canonical/haproxy-operator/issues/610 + visibility: public + highlight: false diff --git a/haproxy-operator/templates/haproxy.cfg.j2 b/haproxy-operator/templates/haproxy.cfg.j2 index 76fbe2998..f574e3972 100644 --- a/haproxy-operator/templates/haproxy.cfg.j2 +++ b/haproxy-operator/templates/haproxy.cfg.j2 @@ -52,7 +52,7 @@ global ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 - ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets + ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets strict-sni ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 From 618dec898886828cb882e09f77990cbbedc68da9 Mon Sep 17 00:00:00 2001 From: tphan025 Date: Wed, 12 Aug 2026 19:16:34 +0200 Subject: [PATCH 3/4] put strict-sni at bind level --- haproxy-operator/templates/haproxy.cfg.j2 | 2 +- haproxy-operator/templates/haproxy_ingress.cfg.j2 | 2 +- haproxy-operator/templates/haproxy_ingress_per_unit.cfg.j2 | 2 +- haproxy-operator/templates/haproxy_route.cfg.j2 | 2 +- haproxy-operator/templates/haproxy_route_grpc.cfg.j2 | 2 +- haproxy-operator/templates/haproxy_route_tcp.cfg.j2 | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/haproxy-operator/templates/haproxy.cfg.j2 b/haproxy-operator/templates/haproxy.cfg.j2 index f574e3972..76fbe2998 100644 --- a/haproxy-operator/templates/haproxy.cfg.j2 +++ b/haproxy-operator/templates/haproxy.cfg.j2 @@ -52,7 +52,7 @@ global ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 - ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets strict-sni + ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 diff --git a/haproxy-operator/templates/haproxy_ingress.cfg.j2 b/haproxy-operator/templates/haproxy_ingress.cfg.j2 index 635d153f0..7e2457f59 100644 --- a/haproxy-operator/templates/haproxy_ingress.cfg.j2 +++ b/haproxy-operator/templates/haproxy_ingress.cfg.j2 @@ -3,7 +3,7 @@ frontend ingress mode http bind [::]:80 v4v6 - bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 + bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 strict-sni filter compression compression algo gzip diff --git a/haproxy-operator/templates/haproxy_ingress_per_unit.cfg.j2 b/haproxy-operator/templates/haproxy_ingress_per_unit.cfg.j2 index 120f0a923..6e2e343cf 100644 --- a/haproxy-operator/templates/haproxy_ingress_per_unit.cfg.j2 +++ b/haproxy-operator/templates/haproxy_ingress_per_unit.cfg.j2 @@ -3,7 +3,7 @@ frontend ingress_per_unit mode http bind [::]:80 v4v6 - bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 + bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 strict-sni filter compression compression algo gzip diff --git a/haproxy-operator/templates/haproxy_route.cfg.j2 b/haproxy-operator/templates/haproxy_route.cfg.j2 index a84d34631..18a8e6e94 100644 --- a/haproxy-operator/templates/haproxy_route.cfg.j2 +++ b/haproxy-operator/templates/haproxy_route.cfg.j2 @@ -4,7 +4,7 @@ frontend haproxy mode http bind [::]:80 v4v6 - bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 + bind [::]:443 v4v6 ssl crt {{ haproxy_crt_dir }} alpn h2,http/1.1 strict-sni {{ ddos_protection_rules() }} diff --git a/haproxy-operator/templates/haproxy_route_grpc.cfg.j2 b/haproxy-operator/templates/haproxy_route_grpc.cfg.j2 index 37ac4b405..d90ff3535 100644 --- a/haproxy-operator/templates/haproxy_route_grpc.cfg.j2 +++ b/haproxy-operator/templates/haproxy_route_grpc.cfg.j2 @@ -1,7 +1,7 @@ {% for backend in grpc_backends %} frontend {{ backend.backend_name }} mode http - bind [::]:{{ backend.application_data.external_grpc_port }} v4v6 ssl crt /var/lib/haproxy/certs alpn h2 + bind [::]:{{ backend.application_data.external_grpc_port }} v4v6 ssl crt /var/lib/haproxy/certs alpn h2 strict-sni acl acl_host_{{ backend.backend_name }} req.hdr(host),field(1,:) -i {% for hostname in backend.hostname_acls %}{{hostname}} {% endfor +%} {% if backend.path_acl_required %} acl acl_path_{{ backend.backend_name }} path_beg -i {% for path in backend.application_data.paths %}{{ path }} {% endfor +%} diff --git a/haproxy-operator/templates/haproxy_route_tcp.cfg.j2 b/haproxy-operator/templates/haproxy_route_tcp.cfg.j2 index dbb5e0843..d36a645c1 100644 --- a/haproxy-operator/templates/haproxy_route_tcp.cfg.j2 +++ b/haproxy-operator/templates/haproxy_route_tcp.cfg.j2 @@ -20,7 +20,7 @@ send-proxy frontend haproxy_route_tcp_{{ frontend.bind_port }} mode tcp option tcplog - bind [::]:{{ frontend.bind_port }} v4v6 {% if frontend.tls_terminate %} ssl crt {{ haproxy_crt_dir }} {% endif +%} + bind [::]:{{ frontend.bind_port }} v4v6 {% if frontend.tls_terminate %} ssl crt {{ haproxy_crt_dir }} strict-sni {% endif +%} {# DDOS protection configuration. #} {% if ddos_protection_config.client_timeout %} From 9468f2ad996593b295163d54cba99844bc46e524 Mon Sep 17 00:00:00 2001 From: Phan Trung Thanh Date: Thu, 13 Aug 2026 11:55:51 +0200 Subject: [PATCH 4/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/release-notes/artifacts/pr0621.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/release-notes/artifacts/pr0621.yaml b/docs/release-notes/artifacts/pr0621.yaml index c8b9b7509..2db6e5de6 100644 --- a/docs/release-notes/artifacts/pr0621.yaml +++ b/docs/release-notes/artifacts/pr0621.yaml @@ -1,9 +1,9 @@ version_schema: 2 changes: - - title: Fail TLS connections when SNI does not match a configured certificate + - title: Rejected TLS connections when SNI does not match a configured certificate author: Copilot - type: minor + type: breaking description: > Added `strict-sni` to the global `ssl-default-bind-options` so HAProxy rejects TLS connections whose SNI does not match any configured