Can't test linkerd-tcp TLS server with curl or tls-scan

[stevej]

Can't test linkerd-tcp TLS server with curl or tls-scan

[stevej]

I should mention that none of the backends returned from namerd are https.

[olix0r]

I'm able to run a slow_cooker test with TLS against the most recent linkerd-tcp (soon to be on master):

plain server, plain client:

stevej@netty-test-8:~$ ./slow_cooker_linux_amd64 -totalRequests 100000 -interval 10s -qps 100 -concurrency 10 http://proxy-test-4d:7474                                                      
# sending 1000 GET req/s with concurrency=10 to http://proxy-test-4d:7474 ...
#                      good/b/f t   goal%   min [p50 p95 p99  p999]  max bhash change
2017-06-16T21:07:51Z   9987/0/0 10000  99% 10s   0 [  0   0   1   26 ]   26      0 +
2017-06-16T21:08:01Z  10000/0/0 10000 100% 10s   0 [  0   0   0    4 ]    4      0 
2017-06-16T21:08:11Z  10006/0/0 10000 100% 10s   0 [  0   0   1    3 ]    3      0 +
2017-06-16T21:08:21Z  10004/0/0 10000 100% 10s   0 [  0   0   1    6 ]    6      0 +
2017-06-16T21:08:31Z  10000/0/0 10000 100% 10s   0 [  0   0   1    6 ]    6      0 +
2017-06-16T21:08:41Z  10000/0/0 10000 100% 10s   0 [  0   0   1    2 ]    2      0 +
2017-06-16T21:08:51Z  10000/0/0 10000 100% 10s   0 [  0   0   1    7 ]    7      0 +
2017-06-16T21:09:01Z  10000/0/0 10000 100% 10s   0 [  0   0   1    2 ]    2      0 
2017-06-16T21:09:11Z  10000/0/0 10000 100% 10s   0 [  0   0   1    4 ]    4      0 
2017-06-16T21:09:21Z  10000/0/0 10000 100% 10s   0 [  0   0   1    4 ]    4      0 
2017-06-16T21:09:31Z  10000/0/0 10000 100% 10s   0 [  0   0   1   16 ]   16      0 
FROM    TO #REQUESTS
   0     2 109724
   2     8 253
   8    32 20
  32    64 0
  64   128 0
 128   256 0
 256   512 0
 512  1024 0
1024  4096 0
4096 16384 0

TLS server, plain client

stevej@netty-test-8:~$ ./slow_cooker_linux_amd64 -totalRequests 100000 -interval 10s -qps 100 -concurrency 10 https://proxy-test-4d:7473
# sending 1000 GET req/s with concurrency=10 to https://proxy-test-4d:7473 ...
#                      good/b/f t   goal%   min [p50 p95 p99  p999]  max bhash change
2017-06-16T21:11:07Z   9940/0/0 10000  99% 10s   0 [  0   0   1   64 ]   64      0 +
2017-06-16T21:11:17Z   9961/0/0 10000  99% 10s   0 [  0   0   1   55 ]   55      0 +
2017-06-16T21:11:27Z  10000/0/0 10000 100% 10s   0 [  0   0   1   10 ]   10      0 +
2017-06-16T21:11:37Z   9998/0/0 10000  99% 10s   0 [  0   0   1   27 ]   27      0 +
2017-06-16T21:11:47Z   9976/0/0 10000  99% 10s   0 [  0   0   1   29 ]   29      0 +
2017-06-16T21:11:57Z   9977/0/0 10000  99% 10s   0 [  0   0   1   34 ]   34      0 
2017-06-16T21:12:07Z   9975/0/0 10000  99% 10s   0 [  0   0   1   36 ]   36      0 
2017-06-16T21:12:17Z   9981/0/0 10000  99% 10s   0 [  0   0   1   30 ]   30      0 
2017-06-16T21:12:27Z   9982/0/0 10000  99% 10s   0 [  0   0   1   28 ]   28      0 
2017-06-16T21:12:37Z   9989/0/0 10000  99% 10s   0 [  0   0   1   33 ]   33      0 
2017-06-16T21:12:47Z   9983/0/0 10000  99% 10s   0 [  0   0   1   26 ]   26      0 
FROM    TO #REQUESTS
   0     2 109089
   2     8 382
   8    32 265
  32    64 18
  64   128 8
 128   256 0
 256   512 0
 512  1024 0
1024  4096 0
4096 16384 0

Config

admin:
  port: 9989
  metricsIntervalSecs: 10

routers:

  - label: default

    interpreter:
      kind: io.l5d.namerd.http
      baseUrl: http://localhost:4180
      namespace: default
      periodSecs: 20

    servers:
      - port: 7474
        ip: 0.0.0.0
        dstName: /svc/default
        connectTimeoutMs: 500

      - port: 7473
        ip: 0.0.0.0
        dstName: /svc/default
        connectTimeoutMs: 500
        tls:
          defaultIdentity:
            privateKey: ../eg-ca/abra.cadab.ra.tls/private.pem
            certs:
              - ../eg-ca/abra.cadab.ra.tls/cert.pem
              - ../eg-ca/ca/intermediate/certs/ca-chain.cert.pem