[2019] Modernizing relayd & the road to HTTP⧸2 - Reyk Floeter

This talk is about my recent work to modernize relayd, to fix long-standing issues and limitations, and about the road to HTTP/2 in OpenBSD’s web stack. relayd’s HTTP support dates back to early 2007, about three months after it was imported into OpenBSD for the first time. It was a necessary feature to complement relayd’s pf-based redirections with layer 7 load balancing for cookie-awareness, SSL acceleration, and basic header or URL filtering. The daemon has been improved, renamed, hardened, and widely deployed over the years. Meanwhile, the web has changed a lot. While relayd is still a very useful tool, it had to get modernized to stay relevant. OpenBSD’s Claudio Jeker had updated the TLS support in 2017, and I added missing features such as TLS SNI and OCSP this year. Furthermore, I improved the protocol filters to offer greater flexibility when relaying HTTP traffic and I finally fixed a persistency bug that was a big show stopper for such filters. But the most important step