bhouse-nexthop opened a new pull request, #14131:
URL: https://github.com/apache/cloudstack/pull/14131
### Description
Two bugs in the HAProxy config the virtual router generates. Both are in
`HAProxyConfigurator`, both are independent of each other, and each is one
commit.
#### 1. `option forceclose` is not a valid keyword
With keepalive enabled, an LB rule that also uses HTTP-based stickiness or
SSL offload emits
`no option forceclose`. HAProxy has rejected that keyword since 2.0, and the
system VM is Debian 12
(HAProxy 2.6):
```
[ALERT] config : parsing [haproxy.cfg:22]: option 'forceclose' is not
supported any more
since HAProxy 2.0, please just remove it, or use 'option httpclose'
if absolutely
needed.
[ALERT] config : Fatal errors found in configuration.
```
The whole file is rejected, so haproxy keeps serving the previous config and
the rule silently
never takes effect. Replaced with `option http-keep-alive`, which expresses
the same intent and is
valid on every version the system VM has shipped.
#### 2. One rule's settings leak into every rule generated afterwards
`globalSection` and `defaultsSection` are `static String[]`. The generator
wraps them in
`Arrays.asList(...)` and calls `set()`, which writes **through** to the
arrays, so the value
survives the call:
| set once by | leaks as |
|---|---|
| keepalive on any rule | `no option httpclose` in the defaults for every
later rule, any network, any account |
| `idleTimeout` > 0 | that timeout becomes the default for the next rule |
| `idleTimeout` == 0 | timeouts blanked permanently |
Copying the arrays fixes it. Output is unchanged for a single rule.
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [x] Major
- [ ] Minor
- [ ] Trivial
### How Has This Been Tested?
Three new cases in `HAProxyConfiguratorTest`, each of which fails without
the corresponding fix:
- keepalive + SSL offload emits no `forceclose` and does emit `option
http-keep-alive`
- a keepalive config followed by a non-keepalive one does not leave `no
option httpclose` behind
- an idle timeout followed by an unset one falls back to the built-in default
`Tests run: 8, Failures: 0`. Reverting the two fixes gives `Failures: 3`.
The generated snippets were also checked against a real `haproxy -c`, which
is where the alert text
above comes from. `option http-keep-alive` and `no option httpclose` both
parse clean; per-listen
directives coexist with TCP listeners in the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
