Re: [PATCH 2/2] DOC: ssl: Specify stronger example ciphers

2019-02-06 Thread Willy Tarreau
Hi Bertrand, On Wed, Feb 06, 2019 at 10:00:14PM +, Bertrand Jacquin wrote: > Yep, all of this sounds legit. Please find attache a new patch serie > attempting to address all your concerns. Perfect and fairly complete, thank you! I've just applied them both. Cheers, Willy

Re: [PATCH 2/2] DOC: ssl: Specify stronger example ciphers

2019-02-06 Thread Bertrand Jacquin
Hi all, On 05/02/2019 05:37, Willy Tarreau wrote: Hi guys, On Mon, Feb 04, 2019 at 10:13:11PM +0100, Lukas Tribus wrote: > Since TLS ciphers are not well understand, it is very common parameters > from documentation are used as is. Since RC4 should not be used anymore > I believe it is wiser

Re: possible use of unitialized value in v2.0-dev0-274-g1a0fe3be

2019-02-06 Thread Tim Düsterhus
Ricardo, Am 06.02.19 um 17:28 schrieb Ricardo Nabinger Sanchez: > Hello, > > scan-build found a 28-step path where an unitialized value could be used in > h2s_htx_bck_make_req_headers(). > > Here is a shortened version: > > 4378 idx = htx_get_head(htx); // returns the SL that we skip >

Re: Weighted Backend's

2019-02-06 Thread Aleksandar Lazic
Hi James. Am 06.02.2019 um 16:16 schrieb James Root: > Hi All, > > I am doing some research and have not really found a great way to configure > HAProxy to get the desired results. The problem I face is that I a service > backed by two separate collections of servers. I would like to split

Re: HAProxy returns a 502 error when ssl offload and response has a large header

2019-02-06 Thread Jarno Huuskonen
Hi, On Wed, Feb 06, Steve GIRAUD wrote: > Effectively, the header size is 17 556 bytes. Is the large header(s) only on response (and not on request) ? (Is it one large header 17k header ?) > If I increase the bufsize to 40 000 bytes and the maxrewrite to 20 000 the > request failed. For me

possible use of unitialized value in v2.0-dev0-274-g1a0fe3be

2019-02-06 Thread Ricardo Nabinger Sanchez
Hello, scan-build found a 28-step path where an unitialized value could be used in h2s_htx_bck_make_req_headers(). Here is a shortened version: 4378 idx = htx_get_head(htx); // returns the SL that we skip 4379 while ((idx = htx_get_next(htx, idx)) != -1) { 4380

Re: [ANNOUNCE] haproxy-1.9.4

2019-02-06 Thread Willy Tarreau
Hi Aleks, On Wed, Feb 06, 2019 at 05:16:58PM +0100, Aleksandar Lazic wrote: > Maybe this patch was to late for 1.9.4 please can you consider to add it > to 2.0 and later 1.9.5, thanks. > > https://www.mail-archive.com/haproxy@formilux.org/msg32693.html I wanted to check it with Christopher

Re: [ANNOUNCE] haproxy-1.9.4

2019-02-06 Thread Aleksandar Lazic
Hi willy. Am 06.02.2019 um 15:25 schrieb Willy Tarreau: > Hi, > > HAProxy 1.9.4 was released on 2019/02/06. It added 65 new commits > after version 1.9.3. Images are updated. https://hub.docker.com/r/me2digital/haproxy-19-boringssl https://hub.docker.com/r/me2digital/haproxy19 Maybe this

[ANNOUNCE] haproxy-1.8.18

2019-02-06 Thread Willy Tarreau
Hi, HAProxy 1.8.18 was released on 2019/02/06. It added 39 new commits after version 1.8.17. The changes here are fairly limited but worth a release, in an effort to clean the net from previous versions which were affected by the TLS 1.3 KeyUpdate bug that currently prevents browsers from using

Re: Opinions about DoH (=DNS over HTTPS) as resolver for HAProxy

2019-02-06 Thread Baptiste
Hi there, I don't have much opinion about this one :) And I did not meet anybody needing such solution for now. >From an implementation point of view, as far as I understand, the idea is to write/read a DNS payload to/from an HTTP request. We already have the primitives to do this. The "most"

Weighted Backend's

2019-02-06 Thread James Root
Hi All, I am doing some research and have not really found a great way to configure HAProxy to get the desired results. The problem I face is that I a service backed by two separate collections of servers. I would like to split traffic between these two clusters (either using percentages or

Re: info defaults maxconn

2019-02-06 Thread Federico Iezzi
Thanks a lot, and sorry for my misinterpretation :-) Cheers, Federico On Wed, 6 Feb 2019 at 14:59, Aleksandar Lazic wrote: > Hi Federico. > > Am 06.02.2019 um 15:33 schrieb Federico Iezzi: > > Hey there, > > > > Maybe this is gonna be a very simple answer. > > In HAProxy 1.5.18 seems that the

Re: info defaults maxconn

2019-02-06 Thread Aleksandar Lazic
Hi Federico. Am 06.02.2019 um 15:33 schrieb Federico Iezzi: > Hey there, > > Maybe this is gonna be a very simple answer. > In HAProxy 1.5.18 seems that the defaults maxconn have a global influence and > not per backend one. > > In my case I have global maxconn at 5120001, while defaults at

Re: Idea for the Wiki

2019-02-06 Thread Baptiste
Hi Willy, Thanks a lot for bringing up this topic, long time I wanted to spend time on this! We discussed my point during a lunch, but I want to share it here as well. I think one of the most important piece is guide lines on integrating HAProxy with third parties, IE: Observing HAProxy with

info defaults maxconn

2019-02-06 Thread Federico Iezzi
Hey there, Maybe this is gonna be a very simple answer. In HAProxy 1.5.18 seems that the defaults maxconn have a global influence and not per backend one. In my case I have global maxconn at 5120001, while defaults at 256. What I'm trying to achieve is to set for all my backends the same maxconn

[ANNOUNCE] haproxy-1.9.4

2019-02-06 Thread Willy Tarreau
Hi, HAProxy 1.9.4 was released on 2019/02/06. It added 65 new commits after version 1.9.3. The main focus in terms of time spent was clearly on end-to-end H2 correctness, which involves both the H2 protocol itself and the idle connections management. It's difficult to enumerate in details all

RE: HAProxy returns a 502 error when ssl offload and response has a large header

2019-02-06 Thread Steve GIRAUD
Effectively, the header size is 17 556 bytes. If I increase the bufsize to 40 000 bytes and the maxrewrite to 20 000 the request failed. -- Steve Giraud De : Jarno Huuskonen Envoyé : mercredi 6 février 2019 09:36 À : Steve GIRAUD Cc : haproxy@formilux.org

Re: HAProxy returns a 502 error when ssl offload and response has a large header

2019-02-06 Thread Jarno Huuskonen
Hi, On Wed, Feb 06, Steve GIRAUD wrote: > Hello everybody, > Has anyone ever found that HAProxy returns a 502 error when ssl offload is > enabled and the http response contains a very long header. > If I turn off SSL offload , all is OK with the same header. What's the size of the (very long)

HAProxy returns a 502 error when ssl offload and response has a large header

2019-02-06 Thread Steve GIRAUD
Hello everybody, Has anyone ever found that HAProxy returns a 502 error when ssl offload is enabled and the http response contains a very long header. If I turn off SSL offload , all is OK with the same header. I Use HaProxy 1.8.17 on PFSense 2.4.4p1 Regards, uname -a FreeBSD PFSHA3.statim.fr