Re: Trouble getting rid of Connection Keep-Alive header

2017-06-23 Thread Mats Eklund
Hi again, It looks like the "option httpclose" is effective, even though the client receives a keep-alive header, likely from another intermediate proxy. >From the HAProxy status page, I can see that the number of concurrent sessions >is kept low. And this is really what matters I believe

Re: Trouble getting rid of Connection Keep-Alive header

2017-06-23 Thread Mats Eklund
Hi Aleks, I'm on Openshift Online v2. I have been able to make changes to the config file, and for them to take effect, following this article: https://stackoverflow.com/questions/23569365/can-i-tweak-openshifts-haproxy-cfg-using-a-file-in-my-scalable-apps-git-reposi Mats Aleks wrote:

Re: BUG: frontend IP/port logging broken since 9b061e332

2017-06-23 Thread Willy Tarreau
Hi Lukas, On Tue, Jun 20, 2017 at 09:36:25PM +0200, Lukas Tribus wrote: > Hello, > > > as per Mathias Weiersmueller's report on discourse [1], there is a bug > in TCP logging when using a custom log-format, accessing the frontend > IP or port (%fi/%fp or the deprecated form %Fi/%Fp) in

Re: Logging SSL pre-master-key

2017-06-23 Thread Willy Tarreau
Hi Patrick, On Thu, Jun 22, 2017 at 03:57:18PM -0400, Patrick Hemmer wrote: > Haven't heard anything back about the consistency aspect, so here's an > updated patch with the other changes not affected by user experience > consistency. Sorry, I've been quite busy these last days and didn't have

Re: 1.7.6 redirect regression (commit 73d071ecc84e0f26ebe1b9576fffc1ed0357ef32)

2017-06-23 Thread Willy Tarreau
Hi Vincent, On Fri, Jun 23, 2017 at 07:24:05AM +0200, Vincent Bernat wrote: > Is the patch important enough to warrant a 1.7.7 soon? Notably, should > downstreams continue to push 1.7.6 to users? So I just checked and in fact it was introduced in version 1.7.6 by this commit : 73d071e

Re: Reverse Gateway Throught Security Zones

2017-06-23 Thread Malcolm Turnbull
Lukas, Ha, I like the comment about DMZs being a concept from 1999 :-). Sorry if I'm going slightly off topic. We put a comic style picture at the bottom of this blog about, “Our DMZ is so secure we can’t even get into it!” https://www.loadbalancer.org/blog/what-exactly-is-a-reverse-proxy I find

Irregular Set-Cookie behavior

2017-06-23 Thread Mats Eklund
Hi, I'm having another issue with HAProxy (v1.4.22). This time related to cookies that HAProxy sets for persistance. When I run a load test with JMeter I have noticed that some, but not all, new threads receive a Set-Cookie header. I'm thinking that this might be due to that I'm also using