Hi Bertrand,
Le 01/04/2014 23:10, Bertrand Jacquin a écrit :
Hi Willy,
I'm getting trouble with that sample configuration when backend has no
server available :
defaults HTTP
mode http
option httplog
log global
frontend ft_public
bind 0.0.0.0:80 name HTTP
bind 0.0.0.0:443 name HTTPS ssl crt foo.pem
acl v-local hdr(Host) 203.0.113.42
acl p-admin path_beg /__bar
http-request redirect scheme https code 301 if v-local p-admin ! { ssl_fc }
use_backend bk_local if v-local p-admin
default_backend bk_default
backend bk_local
balance source
option forwardfor except 127.0.0.1/8
server localhost 127.0.0.1:8080 weight 10 maxconn 100 check inter 1000 fall
2 rise 2
backend bk_default
block if TRUE
If bk_local has server UP in the farm, and request look like
https://203.0.113.42/__bar, then everything is fine, request is nicely
handled by bk_local/localhost. http://203.0.113.42/__bar is correctly
redirected.
If bk_local has no server UP in the farm, then the 'http-request
redirect scheme' is always applied instead of a 503 response. I don't
known if this is the really intended result. In the request
(https://203.0.113.42/__bar),
I'm not sure to understand. Did you want to write
http://203.0.113.42/__bar just above ?
If it was supposed to be "http" instead of "https", I'd call it a
feature and you can use "nbsrv" to disable disable redirects when no
server are available.
v-local match
p-admin match
! { ssl_fc } does not match
So no redirection should be applied.
I'm using HA-Proxy version 1.5-dev22-1a34d57 2014/02/03
Copyright 2000-2014 Willy Tarreau <w...@1wt.eu>
Build options :
TARGET = linux2628
CPU = generic
CC = x86_64-pc-linux-gnu-gcc
CFLAGS = -march=native -O2 -pipe -fomit-frame-pointer -fno-strict-aliasing
OPTIONS = USE_LIBCRYPT=1 USE_GETADDRINFO=1 USE_ZLIB=1 USE_OPENSSL=1
USE_PCRE=1 USE_PCRE_JIT=1
Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200
Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.8
Compression algorithms supported : identity, deflate, gzip
Built with OpenSSL version : OpenSSL 1.0.1f 6 Jan 2014
Running on OpenSSL version : OpenSSL 1.0.1f 6 Jan 2014
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.33 2013-05-28
PCRE library supports JIT : yes
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT
IP_FREEBIND
Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Thanks.
--
Cyril Bonté
