{"id":21,"date":"2008-06-25T04:50:44","date_gmt":"2008-06-25T04:50:44","guid":{"rendered":"http:\/\/www.houquner.com\/?p=58"},"modified":"2008-06-25T04:50:44","modified_gmt":"2008-06-25T04:50:44","slug":"relaydconf","status":"publish","type":"post","link":"https:\/\/www.houquner.com\/index.php\/archives\/21","title":{"rendered":"RELAYD.CONF"},"content":{"rendered":"<p>RELAYD.CONF(5) OpenBSD Programmer&#8217;s ManualRELAYD.CONF(5)<br \/>\n<a href=\"http:\/\/www.openbsd.org\/cgi-bin\/man.cgi?query=relayd.conf&amp;sektion=5\">http:\/\/www.openbsd.org\/cgi-bin\/man.cgi?query=relayd.conf&amp;sektion=5<\/a><br \/>\nNAME<br \/>\n relayd.conf &#8211; relay daemon configuration file<br \/>\nDESCRIPTION<br \/>\n relayd.conf is the configuration file for the relay daemon, relayd(8).<br \/>\nSECTIONS<br \/>\n relayd.conf is divided into six main sections:<br \/>\n? Macros<br \/>\n User-defined variables may be defined and used later, simplifying<br \/>\n the configuration file.<br \/>\n? Global Configuration<br \/>\n Global settings for relayd(8).<br \/>\n? Tables<br \/>\n Table definitions describe a list of hosts, in a similar fashion to<br \/>\n pf(4) tables.? They are used for relay and redirection target se-<br \/>\n lection with the described options and health checking on the host<br \/>\n they contain.<br \/>\n? Redirections<br \/>\n Redirections are translated to pf(4) rdr rules for stateful for-<br \/>\n warding to a target host from a health-checked table on layer 3.<br \/>\n? Relays<br \/>\n Relays allow application layer load balancing, SSL acceleration,<br \/>\n and general purpose TCP proxying on layer 7.<br \/>\n? Protocols<br \/>\n Protocols are predefined protocol handlers and settings for relays.<br \/>\n? Within the sections, a host address can be specified by IPv4 address,<br \/>\n IPv6 address, or DNS hostname.? A port can be specified by number or<br \/>\n name.? The port name to number mappings are found in the file<br \/>\n \/etc\/services; see services(5) for details.<br \/>\n? Comments can be put anywhere in the file using a hash mark (`#&#8217;), and ex-<br \/>\n tend to the end of the current line.<br \/>\n? Additional configuration files can be included with the include keyword,<br \/>\n for example:<br \/>\n include &#8220;\/etc\/relayd.conf.local&#8221;<br \/>\nMACROS<br \/>\n Macros can be defined that will later be expanded in context.? Macro<br \/>\n names must start with a letter, and may contain letters, digits, and un-<br \/>\n derscores.? Macro names may not be reserved words (for example, table,<br \/>\n relay, or timeout).? Macros are not expanded inside quotes.<br \/>\n? For example:<br \/>\n www1=&#8221;10.0.0.1&#8243;<br \/>\n www2=&#8221;10.0.0.2&#8243;<br \/>\n table &lt;webhosts&gt; {<br \/>\n $www1<br \/>\n $www2<br \/>\n }<br \/>\nGLOBAL CONFIGURATION<br \/>\n Here are the settings that can be set globally:<br \/>\n? demote group<br \/>\n Enable the global carp(4) demotion option, resetting the carp de-<br \/>\n motion counter for the specified interface group to zero on<br \/>\n startup and to 128 on shutdown of the daemon.? For more informa-<br \/>\n tion on interface groups, see the group keyword in ifconfig(8).<br \/>\n? interval number<br \/>\n Set the interval in seconds at which the hosts will be checked.<br \/>\n The default interval is 10 seconds.<br \/>\n? log (updates|all)<br \/>\n Log state notifications after completed host checks.? Either only<br \/>\n log the updates to new states or log all state notifications,<br \/>\n even if the state didn&#8217;t change.? The host state can be up (the<br \/>\n health check completed successfully), down (the host is down or<br \/>\n didn&#8217;t match the check criteria), or unknown (the host is dis-<br \/>\n abled or has not been checked yet).<br \/>\n? prefork number<br \/>\n When using relays, run the specified number of processes to han-<br \/>\n dle relayed connections.? This increases the performance and pre-<br \/>\n vents delays when connecting to a relay.? relayd(8) runs 5 relay<br \/>\n processes by default and every process will handle all configured<br \/>\n relays.<br \/>\n? send trap<br \/>\n Send an SNMP trap when the state of a host changes.? relayd(8)<br \/>\n will try to connect to snmpd(8) and request it send a trap to the<br \/>\n registered trap receivers; see snmpd.conf(5) for more information<br \/>\n about the configuration.<br \/>\n? timeout number<br \/>\n Set the global timeout in milliseconds for checks.? This can be<br \/>\n overriden by the timeout value in the table definitions.? The de-<br \/>\n fault interval is 200 milliseconds and it must not exceed the<br \/>\n global interval.? Please note that the default value is optimized<br \/>\n for checks within the same collision domain &#8211; use a higher time-<br \/>\n out, such as 1000 milliseconds, for checks of hosts in other sub-<br \/>\n nets.<br \/>\nTABLES<br \/>\n Tables are used to group a set of hosts as the target for redirections or<br \/>\n relays; they will be mapped to a pf(4) table for redirections.? Tables<br \/>\n may be defined with the following attribute:<br \/>\n? disable? Start the table disabled &#8211; no hosts will be checked in this<br \/>\n table.? The table can be later enabled through relayctl(8).<br \/>\n? Each table must contain at least one host; multiple hosts are separated<br \/>\n by newline, comma, or whitespace.?Host entries may be defined with the<br \/>\n following attribute:<br \/>\n? retry number<br \/>\n The optional retry option adds a tolerance for failed host checks;<br \/>\n the check will be retried for number more times before setting the<br \/>\n host state to down.? If this table is used by a relay, it will al-<br \/>\n so specify the number of retries for outgoing connection attempts.<br \/>\n? For example:<br \/>\n table &lt;service&gt; { 192.168.1.1, www.houquner.com, 192.168.2.3 }<br \/>\n table &lt;backup&gt; disable { 10.1.5.1 retry 2 }<br \/>\n redirect &#8220;www&#8221; {<br \/>\n listen on www.example.com port 80<br \/>\n forward to &lt;service&gt; check http &#8220;\/&#8221; code 200<br \/>\n forward to &lt;backup&gt; check http &#8220;\/&#8221; code 200<br \/>\n }<br \/>\n? Tables are used by forward to directives in redirections or relays with a<br \/>\n set of general options, health-checking rules, and timings; see the<br \/>\n REDIRECTIONS and RELAYS sections for more information about the forward<br \/>\n context.? Table specific configuration directives are described below.<br \/>\n Multiple options can be appended to forward to directives, separated by<br \/>\n whitespaces.<br \/>\n? The following options will configure the health-checking method for the<br \/>\n table, and is mandatory for redirections:<br \/>\n? check http path [host hostname] code number<br \/>\n For each host in the table, verify that retrieving the URL path<br \/>\n gives the HTTP return code number.? If hostname is specified, it<br \/>\n is used as the <code>Host:'' header to query a specific hostname at<br \/>\n the target host.<br \/>\n? check https path [host hostname] code number<br \/>\n This has the same effect as above but wraps the HTTP request in<br \/>\n SSL.<br \/>\n? check http path [host hostname] digest string<br \/>\n For each host in the table, verify that retrieving the URL path<br \/>\n produces content whose message digest matches the defined string.<br \/>\n The algorithm used is determined by the string length of the<br \/>\n digest argument, either SHA1 (40 characters) or MD5 (32 charac-<br \/>\n ters).? If hostname is specified, it is used as the<\/code>Host:&#8221;<br \/>\n header to query a specific hostname at the target host.? The di-<br \/>\n gest does not take the HTTP headers into account.?To compute the<br \/>\n digest, use this simple command:<br \/>\n? $ ftp -o &#8211; <a href=\"http:\/\/host[:port]\/path\">http:\/\/host[:port]\/path<\/a> | sha1<br \/>\n This gives a digest that can be used as-is in a digest statement:<br \/>\n? a9993e36476816aba3e25717850c26c9cd0d89d<br \/>\n? check https path [host hostname] digest string<br \/>\n This has the same effect as above but wraps the HTTP request in<br \/>\n SSL.<br \/>\n? check icmp<br \/>\n Ping hosts in this table to determine whether they are up or not.<br \/>\n This method will automatically use ICMP or ICMPV6 depending on<br \/>\n the address family of each host.<br \/>\n? check script path<br \/>\n Execute an external program to check the host state.? The program<br \/>\n will be executed for each host by specifing the hostname on the<br \/>\n command line:<br \/>\n? \/usr\/local\/bin\/checkload.pl front-www1.private.example.com<br \/>\n relayd(8) expects a positive return value on success and zero on<br \/>\n failure.? Note that the script will be executed with the privi-<br \/>\n leges of the &#8220;_relayd&#8221; user and terminated after timeout mil-<br \/>\n liseconds.<br \/>\n? check send data expect pattern [ssl]<br \/>\n For each host in the table, a TCP connection is established on<br \/>\n the port specified, then data is sent.? Incoming data is then<br \/>\n read and is expected to match against pattern using shell glob-<br \/>\n bing rules.? If data is an empty string or nothing then nothing<br \/>\n is sent on the connection and data is immediately read.? This can<br \/>\n be useful with protocols that output a banner like SMTP, NNTP,<br \/>\n and FTP.? If the ssl keyword is present, the transaction will oc-<br \/>\n cur in an SSL tunnel.<br \/>\n? check ssl<br \/>\n Perform a complete SSL handshake with each host to check their<br \/>\n availability.<br \/>\n? check tcp<br \/>\n Use a simple TCP connect to check that hosts are up.<br \/>\n? The following general table options are available:<br \/>\n? demote group<br \/>\n Enable the per-table carp(4) demotion option.? This will incre-<br \/>\n ment the carp demotion counter for the specified interface group<br \/>\n if all hosts in the table are down.? For more information on in-<br \/>\n terface groups, see the group keyword in ifconfig(8).<br \/>\n? interval number<br \/>\n Override the global interval and specify one for this table.? It<br \/>\n must be a multiple of the global interval.<br \/>\n? timeout number<br \/>\n Set the timeout in milliseconds for each host that is checked us-<br \/>\n ing TCP as the transport.?This will override the global timeout,<br \/>\n which is 200 milliseconds by default.<br \/>\n? The following options will set the scheduling algoritm to select a host<br \/>\n from the specified table:<br \/>\n? mode hash<br \/>\n Balances the outgoing connections across the active hosts based<br \/>\n on the hashed name of the table.? Additional input can be fed in-<br \/>\n to the hash by looking at HTTP headers and GET variables; see the<br \/>\n PROTOCOLS section below.? This mode is only supported by relays.<br \/>\n? mode loadbalance<br \/>\n Balances the outgoing connections across the active hosts based<br \/>\n on the hashed name of the table, the source and destination ad-<br \/>\n dresses, and the corresponding ports.? This mode is only support-<br \/>\n ed by relays.<br \/>\n? mode roundrobin<br \/>\n Distributes the outgoing connections using a round-robin sched-<br \/>\n uler through all active hosts.? This is the default mode and will<br \/>\n be used if no option has been specified.? This mode is supported<br \/>\n by redirections and relays.<br \/>\nREDIRECTIONS<br \/>\n Redirections represent a pf(4) rdr rule.? They are used for stateful<br \/>\n redirections to the hosts in the specified tables.? pf(4) rewrites the<br \/>\n target IP addresses and ports of the incoming connections, operating on<br \/>\n layer 3.? The configuration directives that are valid in the redirect<br \/>\n context are described below:<br \/>\n? disable<br \/>\n The redirection is initially disabled.? It can be later enabled<br \/>\n through relayctl(8).<br \/>\n? forward to &lt;table&gt; [port number] options &#8230;<br \/>\n Specify the tables of target hosts to be used; see the TABLES<br \/>\n section above for information about table options.? If the port<br \/>\n option is not specified, the port from the listen on directive<br \/>\n will be used.? This directive can be specified twice &#8211; the second<br \/>\n entry will be used as the backup table if all hosts in the main<br \/>\n table are down.? At least one entry for the main table is manda-<br \/>\n tory.<br \/>\n? listen on address port port [interface name]<br \/>\n Specify an address and a port to listen on.? pf(4) will redirect<br \/>\n incoming connections for the specified target to the hosts in the<br \/>\n main or backup table.? The rdr rule can be optionally restricted<br \/>\n to a given interface name.<br \/>\n? sticky-address<br \/>\n This has the same effect as specifying sticky-address for an rdr<br \/>\n rule in pf.conf(5).? It will ensure that multiple connections<br \/>\n from the same source are mapped to the same redirection address.<br \/>\n? tag name<br \/>\n Automatically tag packets passing through the pf(4) rdr rule with<br \/>\n the name supplied.? This allows simpler filter rules.<br \/>\nRELAYS<br \/>\n Relays will forward traffic between a client and a target server.?In<br \/>\n contrast to redirections and IP forwarding in the network stack, a relay<br \/>\n will accept incoming connections from remote clients as a server, open an<br \/>\n outgoing connection to a target host, and forward any traffic between the<br \/>\n target host and the remote client, operating on layer 7.? A relay is also<br \/>\n called an application layer gateway or layer 7 proxy.<br \/>\n? The main purpose of a relay is to provide advanced load balancing func-<br \/>\n tionality based on specified protocol characteristics, such as HTTP head-<br \/>\n ers, to provide SSL acceleration and to allow basic handling of the un-<br \/>\n derlying application protocol.<br \/>\n? The relay configuration directives are described below:<br \/>\n? disable<br \/>\n Start the relay but immediately close any accepted connections.<br \/>\n? forward to address [port port] [retry number]<br \/>\n Specify the address and port of the target host to connect to.<br \/>\n If the port option is not specified, the port from the listen on<br \/>\n directive will be used.<br \/>\n The optional host retry option will be used as a tolerance for<br \/>\n failed host connections; the connection will be retried for<br \/>\n number more times.<br \/>\n? forward to &lt;table&gt; [port port] options &#8230;<br \/>\n Like the previous directive, but connect to a host from the spec-<br \/>\n ified table; see the TABLES section above for information about<br \/>\n table options.<br \/>\n? forward to nat lookup [retry number]<br \/>\n When redirecting connections with an rdr rule in pf.conf(5) to a<br \/>\n relay listening on localhost, this directive will look up the re-<br \/>\n al destination address of the intended target host, allowing the<br \/>\n relay to be run as a transparent proxy.? If an additional forward<br \/>\n to directive to a specified address or table is present, it will<br \/>\n be used as a backup if the NAT lookup failed.<br \/>\n? listen on address [port port] [ssl]<br \/>\n Specify the address and port for the relay to listen on.? The re-<br \/>\n lay will accept incoming connections to the specified address.<br \/>\n If the port option is not specified, the port from the listen on<br \/>\n directive will be used.<br \/>\n If the ssl keyword is present, the relay will accept connections<br \/>\n using the encrypted SSL protocol.?The relay will look up a pri-<br \/>\n vate key in \/etc\/ssl\/private\/address.key and a public certificate<br \/>\n in \/etc\/ssl\/address.crt, where address is the specified IP ad-<br \/>\n dress of the relay to listen on.? See ssl(8) for details about<br \/>\n SSL server certificates.<br \/>\n? protocol name<br \/>\n Use the specified protocol definition for the relay.? The generic<br \/>\n TCP protocol options will be used by default; see the PROTOCOLS<br \/>\n section below.<br \/>\n? timeout seconds<br \/>\n Specify the timeout in seconds for accepted sessions.? The de-<br \/>\n fault timeout is 600 seconds (10 minutes).<br \/>\nPROTOCOLS<br \/>\n Protocols are templates defining actions and settings for relays.?They<br \/>\n allow setting generic TCP options, SSL settings, and actions specific to<br \/>\n the selected application layer protocol.<br \/>\n? The protocol directive is available for a number of different application<br \/>\n layer protocols.? There is no generic handler for UDP-based protocols be-<br \/>\n cause it is a stateless datagram-based protocol which has to look into<br \/>\n the application layer protocol to find any possible state information.<br \/>\n? dns protocol<br \/>\n (UDP) Domain Name System (DNS) protocol.? The requested IDs in<br \/>\n the DNS header will be used to match the state.? relayd(8) re-<br \/>\n places these IDs with random values to compensate for predictable<br \/>\n values generated by some hosts.<br \/>\n? http protocol<br \/>\n Handle the Hypertext Transfer Protocol (HTTP, or &#8220;HTTPS&#8221; if en-<br \/>\n capsulated in an SSL tunnel).<br \/>\n? [tcp] protocol<br \/>\n Generic handler for TCP-based protocols.? This is the default.<br \/>\n? The available configuration directives are described below:<br \/>\n? [direction] [type] action [marked id] [log]<br \/>\n Define an action for the selected entity.?The optional log key-<br \/>\n word will log the entity name and the value and the optional<br \/>\n marked keyword requires that the session has been marked with a<br \/>\n given identifier in order to execute the action.? The actions are<br \/>\n dependent on the underlying application protocol.<br \/>\n? [direction] may be one of:<br \/>\n? request<br \/>\n Handle the data stream from the client to the relay, like HTTP<br \/>\n requests.?This is the default if the direction directive is<br \/>\n omitted.<br \/>\n? response<br \/>\n Handle the data stream from the target host to the relay, like<br \/>\n HTTP server replies.<br \/>\n? [action] may be one of:<br \/>\n? cookie? Look up the entity as a value in the Cookie header when using the<br \/>\n http protocol.? This type is only available with the direction<br \/>\n request.<br \/>\n? header? Look up the entity in the application protocol headers, like HTTP<br \/>\n headers in http mode.<br \/>\n? path Look up the entity as a value in the URL path when using the http<br \/>\n protocol.?This type is only available with the direction<br \/>\n request.? The key will match the path of the requested URL with-<br \/>\n out the hostname and query and the value will match the complete<br \/>\n query, for example:<br \/>\n? request path filter &#8220;\/index.html&#8221;<br \/>\n request path filter &#8220;foo=bar*&#8221; from &#8220;\/cgi-bin\/t.cgi&#8221;<br \/>\n? query Look up the entity as a query variable in the URL when using the<br \/>\n http protocol.? This type is only available with the direction<br \/>\n request, for example:<br \/>\n? # Will match \/cgi-bin\/example.pl?foo=bar&amp;ok=yes<br \/>\n request query expect &#8220;bar&#8221; from &#8220;foo&#8221;<br \/>\n? url? Look up the entity as a URL suffix\/prefix expression consisting<br \/>\n of a canonicalized hostname without port or suffix and a path<br \/>\n name or prefix when using the http protocol.? This type is only<br \/>\n available with the direction request, for example:<br \/>\n? request url filter &#8220;example.com\/index.html&#8221;<br \/>\n request url filter &#8220;example.com\/test.cgi?val=1&#8221;<br \/>\n relayd(8) will match the full URL and different possible suf-<br \/>\n fix\/prefix combinations by stripping subdomains and path compo-<br \/>\n nents (up to 5 levels), and the query string.? For example, the<br \/>\n following lookups will be done for<br \/>\n <a href=\"http:\/\/www.example.com:81\/1\/2\/3\/4\/5.html?query=yes\">http:\/\/www.example.com:81\/1\/2\/3\/4\/5.html?query=yes<\/a>:<br \/>\n? www.example.com\/1\/2\/3\/4\/5.html?query=yes<br \/>\n www.example.com\/1\/2\/3\/4\/5.html<br \/>\n www.example.com\/<br \/>\n www.example.com\/1\/<br \/>\n www.example.com\/1\/2\/<br \/>\n www.example.com\/1\/2\/3\/<br \/>\n example.com\/1\/2\/3\/4\/5.html?query=yes<br \/>\n example.com\/1\/2\/3\/4\/5.html<br \/>\n example.com\/<br \/>\n example.com\/1\/<br \/>\n example.com\/1\/2\/<br \/>\n example.com\/1\/2\/3\/<br \/>\n? [action] may be one of:<br \/>\n? append value to key<br \/>\n Append the specified value to a protocol entity with the selected<br \/>\n name.? When using the http protocol, key will indicate a speci-<br \/>\n fied HTTP header.?If key does not exist in the request, it will<br \/>\n be created with the value set to value.<br \/>\n The value string may contain predefined macros that will be ex-<br \/>\n panded at runtime:<br \/>\n? $REMOTE_ADDR? The IP address of the connected client.<br \/>\n $REMOTE_PORT? The TCP source port of the connected client.<br \/>\n $SERVER_ADDR? The configured IP address of the relay.<br \/>\n $SERVER_PORT? The configured TCP server port of the relay.<br \/>\n $TIMEOUT? The configured session timeout of the relay.<br \/>\n? change key to value<br \/>\n Like the append directive above, but change the contents of the<br \/>\n specified entity.?If key does not exist in the request, it will<br \/>\n be created with the value set to value.<br \/>\n The value string may contain predefined macros that will be ex-<br \/>\n panded at runtime, as detailed for the append directive above.<br \/>\n? expect value from key<br \/>\n Expect an entity key and match against value using shell globbing<br \/>\n rules.? If the entity is not present or the value doesn&#8217;t match,<br \/>\n the connection will be dropped.<br \/>\n? expect [digest] key<br \/>\n Expect an entity key with any possible value.? This is the short<br \/>\n form of expect * from key.<br \/>\n If the digest keyword is specified, compare the message digest of<br \/>\n the entity against the defined string.? The algorithm used is de-<br \/>\n termined by the string length of the key argument, either SHA1<br \/>\n (40 characters) or MD5 (32 characters).? To compute the digest,<br \/>\n use this simple command:<br \/>\n? $ echo -n &#8220;example.com\/path\/?args&#8221; | sha1<br \/>\n? filter value from key<br \/>\n Like the expect .. from directive above, but drop any connections<br \/>\n with the specified entity key and a matching value.<br \/>\n? filter [digest] key<br \/>\n Like the expect directive above, but drop any connections with<br \/>\n the specified entity key and any possible value.? This is the<br \/>\n short form of filter * from key.<br \/>\n? hash key<br \/>\n Feed the value of the selected entity into the load balancing<br \/>\n hash to select the target host.? See the table keyword in the<br \/>\n RELAYS section above.<br \/>\n? log key<br \/>\n Log the name and the value of the entity.<br \/>\n? mark [value from] key with id<br \/>\n Mark the session with the specified identifier (a positive number<br \/>\n between 1 and 65535) if the specified condition matches.? Note<br \/>\n that the mark action does not accept the marked option (see<br \/>\n above).<br \/>\n? label string<br \/>\n Add a label to subsequently added actions.? The label will be<br \/>\n printed as part of the error message if the return error option<br \/>\n is set and may contain HTML tags, for example:<br \/>\n? label &#8220;&lt;a href=&#8217;<a href=\"http:\/\/example.com\/advisory.pl?id=7359\">http:\/\/example.com\/advisory.pl?id=7359<\/a>&#8216;&gt;<br \/>\n Advisory provided by example.com&lt;\/a&gt;&#8221;<br \/>\n url filter digest 5c1e03f58f8ce0b457474ffb371fd1ef<br \/>\n url filter digest 80c1a7b8337462093ef8359c57b4d56a<br \/>\n no label<br \/>\n? no label<br \/>\n Do not set a label for subsequently added actions; this is the<br \/>\n default.<br \/>\n? remove key<br \/>\n Remove the entity with the selected name.<br \/>\n? return error [option]<br \/>\n Return an error reponse to the client if an internal operation or<br \/>\n the forward connection to the client failed.? By default, the<br \/>\n connection will be silently dropped.? The effect of this option<br \/>\n depends on the protocol: HTTP will send an error header and page<br \/>\n to the client before closing the connection.? Additional valid<br \/>\n options are:<br \/>\n style string<br \/>\n Specify a Cascading Style Sheet (CSS) to be used for the<br \/>\n returned HTTP error pages, for example:<br \/>\n body { background: #a00000; color: white; }<br \/>\n? ssl option<br \/>\n Set the SSL options and session settings.?This is only used if<br \/>\n SSL is enabled in the relay.? Valid options are:<br \/>\n ciphers string<br \/>\n Set the string defining the SSL cipher suite.? If not<br \/>\n specified, the default value HIGH:!ADH will be used<br \/>\n (strong crypto cipher suites without anonymous DH).? See<br \/>\n the CIPHERS section of openssl(1) for information about<br \/>\n SSL cipher suites and preference lists.<br \/>\n session cache value<br \/>\n Set the maximum size of the SSL session cache.? If the<br \/>\n value is zero, the default size defined by the SSL li-<br \/>\n brary will be used.? A positive number will set the maxi-<br \/>\n mum size in bytes and the keyword disable will disable<br \/>\n the SSL session cache.<br \/>\n [no] sslv2<br \/>\n Enable the SSLv2 protocol; disabled by default.<br \/>\n [no] sslv3<br \/>\n Disable the SSLv3 protocol; enabled by default.<br \/>\n [no] tlsv1<br \/>\n Disable the TLSv1\/SSLv3.1 protocol; enabled by default.<br \/>\n? tcp option<br \/>\n Enable or disable the specified TCP\/IP options; see tcp(4) and<br \/>\n ip(4) for more information about the options.? Valid options are:<br \/>\n backlog number<br \/>\n Set the maximum length the queue of pending connections<br \/>\n may grow to.? The backlog option is 10 by default and is<br \/>\n limited by the kern.somaxconn sysctl(8) variable.<br \/>\n ip minttl number<br \/>\n This option for the underlying IP connection may be used<br \/>\n to discard packets with a TTL lower than the specified<br \/>\n value.? This can be used to implement the Generalized TTL<br \/>\n Security Mechanism (GTSM) according to RFC 3682.<br \/>\n ip ttl? Change the default time-to-live value in the IP headers.<br \/>\n [no] nodelay<br \/>\n Enable the TCP NODELAY option for this connection.? This<br \/>\n is recommended to avoid delays in the relayed data<br \/>\n stream, e.g. for SSH connections.<br \/>\n [no] sack<br \/>\n Use selective acknowledgements for this connection.<br \/>\n socket buffer number<br \/>\n Set the socket-level buffer size for input and output for<br \/>\n this connection.? This will affect the TCP window size.<br \/>\nFILES<br \/>\n \/etc\/relayd.conf relayd(8) configuration file.<br \/>\n? \/etc\/services Service name database.<br \/>\n? \/etc\/ssl\/address.crt<br \/>\n \/etc\/ssl\/private\/address.key Location of the relay SSL server certifi-<br \/>\n cates, where address is the configured IP<br \/>\n address of the relay.<br \/>\nEXAMPLES<br \/>\n This configuration file would create a service <code>www'' which load bal-<br \/>\n ances four hosts and falls back to one host containing a<\/code>sorry page&#8221;:<br \/>\n www1=front-www1.private.example.com<br \/>\n www2=front-www2.private.example.com<br \/>\n www3=front-www3.private.example.com<br \/>\n www4=front-www4.private.example.com<br \/>\n interval 5<br \/>\n table &lt;phphosts&gt; { $www1, $www2, $www3, $www4 }<br \/>\n table &lt;sorryhost&gt; disable { sorryhost.private.example.com }<br \/>\n redirect &#8220;www&#8221; {<br \/>\n listen on www.example.com port 8080 interface trunk0<br \/>\n listen on www6.example.com port 80 interface trunk0<br \/>\n? tag REDIRECTED<br \/>\n? forward to &lt;phphosts&gt; port 8080 timeout 300 <br \/>\n check http &#8220;\/&#8221; digest &#8220;630aa3c2f&#8230;&#8221;<br \/>\n forward to &lt;sorryhost&gt; port 8080 timeout 300 check icmp<br \/>\n }<br \/>\n? The following configuration would add a relay to forward secure HTTPS<br \/>\n connections to a pool of HTTP webservers using the loadbalance mode (SSL<br \/>\n acceleration and layer 7 load balancing).?The HTTP protocol definition<br \/>\n will add two HTTP headers containing address information of the client<br \/>\n and the server, set the <code>Keep-Alive'' header value to the configured<br \/>\n session timeout, and include the<\/code>sessid&#8221; variable in the hash to cal-<br \/>\n culate the target host:<br \/>\n http protocol &#8220;http_ssl&#8221; {<br \/>\n header append &#8220;$REMOTE_ADDR&#8221; to &#8220;X-Forwarded-For&#8221;<br \/>\n header append &#8220;$SERVER_ADDR:$SERVER_PORT&#8221; to &#8220;X-Forwarded-By&#8221;<br \/>\n header change &#8220;Keep-Alive&#8221; to &#8220;$TIMEOUT&#8221;<br \/>\n query hash &#8220;sessid&#8221;<br \/>\n cookie hash &#8220;sessid&#8221;<br \/>\n path filter &#8220;*command=*&#8221; from &#8220;\/cgi-bin\/index.cgi&#8221;<br \/>\n? ssl { sslv2, ciphers &#8220;MEDIUM:HIGH&#8221; }<br \/>\n }<br \/>\n relay &#8220;sslaccel&#8221; {<br \/>\n listen on www.example.com port 443 ssl<br \/>\n protocol &#8220;http_ssl&#8221;<br \/>\n forward to &lt;phphosts&gt; port 8080 mode loadbalance check tcp<br \/>\n }<br \/>\n? The second relay example will accept incoming connections to port 2222<br \/>\n and forward them to a remote SSH server.? The TCP nodelay option will al-<br \/>\n low a &#8220;smooth&#8221; SSH session without delays between keystrokes or dis-<br \/>\n played output on the terminal:<br \/>\n protocol &#8220;myssh&#8221; {<br \/>\n tcp { nodelay, socket buffer 65536 }<br \/>\n }<br \/>\n relay &#8220;sshforward&#8221; {<br \/>\n listen on www.example.com port 2222<br \/>\n protocol &#8220;myssh&#8221;<br \/>\n forward to shell.example.com port 22<br \/>\n }<br \/>\nSEE ALSO<br \/>\n relayctl(8), relayd(8), snmpd(8), ssl(8)<br \/>\nHISTORY<br \/>\n The relayd.conf file format, formerly known as hoststated.conf, first ap-<br \/>\n peared in OpenBSD 4.1.? It was renamed to relayd.conf in OpenBSD 4.3.<br \/>\nAUTHORS<br \/>\n The relayd(8) program was written by Pierre-Yves Ritschard<br \/>\n &lt;pyr@openbsd.org&gt; and Reyk Floeter &lt;reyk@openbsd.org&gt;.<br \/>\nOpenBSD 4.3 March 3, 2008? 11<\/p>\n<p>\u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1a<a href=\"https:\/\/www.houquner.com\">Kermit\u7684\u7f51\u7ad9<\/a> &raquo; <a href=\"https:\/\/www.houquner.com\/index.php\/archives\/21\">RELAYD.CONF<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>RELAYD.CONF(5) OpenBSD Programmer&#8217;s ManualRELAYD.CONF(5) http:\/\/www.openbsd.org\/cgi-bin\/man.cgi?query=relayd.conf&amp;s [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-21","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts\/21"}],"collection":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/comments?post=21"}],"version-history":[{"count":0,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/posts\/21\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/media?parent=21"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/categories?post=21"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.houquner.com\/index.php\/wp-json\/wp\/v2\/tags?post=21"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}