BUG/FEATURE? http-request always applied if backend not available

[Bertrand Jacquin]

Hi Willy,

I'm getting trouble with that sample configuration when backend has no
server available :

defaults HTTP
  mode http

  option httplog
  log global

frontend ft_public
  bind 0.0.0.0:80 name HTTP
  bind 0.0.0.0:443 name HTTPS ssl crt foo.pem

  acl v-local hdr(Host) 203.0.113.42
  acl p-admin path_beg /__bar

  http-request redirect scheme https code 301 if v-local p-admin ! { ssl_fc }

  use_backend bk_local if v-local p-admin

  default_backend bk_default

backend bk_local
  balance source
  option forwardfor except 127.0.0.1/8

  server localhost 127.0.0.1:8080 weight 10 maxconn 100 check inter 1000 fall 2 
rise 2

backend bk_default
  block if TRUE

If bk_local has server UP in the farm, and request look like
https://203.0.113.42/__bar, then everything is fine, request is nicely
handled by bk_local/localhost. http://203.0.113.42/__bar is correctly
redirected.

If bk_local has no server UP in the farm, then the 'http-request
redirect scheme' is always applied instead of a 503 response. I don't
known if this is the really intended result. In the request
(https://203.0.113.42/__bar),

  v-local match
  p-admin match
  ! { ssl_fc } does not match

So no redirection should be applied.

I'm using HA-Proxy version 1.5-dev22-1a34d57 2014/02/03
Copyright 2000-2014 Willy Tarreau <w...@1wt.eu>

Build options :
  TARGET  = linux2628
  CPU     = generic
  CC      = x86_64-pc-linux-gnu-gcc
  CFLAGS  = -march=native -O2 -pipe -fomit-frame-pointer -fno-strict-aliasing
  OPTIONS = USE_LIBCRYPT=1 USE_GETADDRINFO=1 USE_ZLIB=1 USE_OPENSSL=1 
USE_PCRE=1 USE_PCRE_JIT=1

Default settings :
  maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200

Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.8
Compression algorithms supported : identity, deflate, gzip
Built with OpenSSL version : OpenSSL 1.0.1f 6 Jan 2014
Running on OpenSSL version : OpenSSL 1.0.1f 6 Jan 2014
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.33 2013-05-28
PCRE library supports JIT : yes
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT 
IP_FREEBIND

Available polling systems :
      epoll : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.

Thanks.

-- 
Bertrand