Re: MINOR: fixes haiku linkage

2021-06-24 Thread Willy Tarreau
On Sat, Jun 19, 2021 at 02:47:52PM +0100, David CARLIER wrote: > Hi here a little change proposal to fix haproxy at runtime in this platform. > Cheers. Thanks David, now merged. Willy

Re: Fix small bug in srv_parse_agent_check

2021-06-24 Thread Willy Tarreau
Hi Dirkjan, On Fri, Jun 18, 2021 at 10:03:17PM +0200, Dirkjan Bussink wrote: > Hi all, > > I was building HAProxy using scan-build to see if there were any issues and > it called out an unused variable write. I think this was due to a bug that > the err_code was not used in srv_parse_agent_check.

Re: SSL Labs says my server isn't doing ssl session resumption

2021-06-24 Thread Willy Tarreau
On Sun, Jun 20, 2021 at 05:20:41PM -0600, Shawn Heisey wrote: > On 6/20/2021 3:16 PM, Lukas Tribus wrote: > > It's a haproxy bug, affecting 2.4 releases, I've filed an issue in our > > tracker: > > > > https://github.com/haproxy/haproxy/issues/1297 > > Almost always when I report a problem I'm h

Re: Line 47 in src/queue.c "s * queue's lock."

2021-06-24 Thread Willy Tarreau
On Thu, Jun 24, 2021 at 11:35:51PM +0200, Aleksandar Lazic wrote: > Hi. > > when someone works again on src/queue.c could be this typo fixed. > > http://git.haproxy.org/?p=haproxy.git;a=blob;f=src/queue.c;h=6d3aa9a12bcd6078d1b5a76969da4104a6adb1bd;hb=HEAD#l47 > > ``` > 44 * - a pendconn_add

Line 47 in src/queue.c "s * queue's lock."

2021-06-24 Thread Aleksandar Lazic
Hi. when someone works again on src/queue.c could be this typo fixed. http://git.haproxy.org/?p=haproxy.git;a=blob;f=src/queue.c;h=6d3aa9a12bcd6078d1b5a76969da4104a6adb1bd;hb=HEAD#l47 ``` 44 * - a pendconn_add() is only performed by the stream which will own the 45 * pendconn ; the

Re: SNI spoofing in HAproxy?

2021-06-24 Thread Willy Tarreau
On Thu, Jun 24, 2021 at 04:07:33PM +0200, Tim Düsterhus wrote: > Julien, > > On 6/24/21 3:40 PM, Julien Pivotto wrote: > > >use_backend bob if { hdr(host) -m dom bob.com } > > >use_backend alice if { hdr(host) -m dom alice.com } > > > > Thanks for taking the time to write this report. > >

Re: SNI spoofing in HAproxy?

2021-06-24 Thread Tim Düsterhus
Julien, On 6/24/21 3:40 PM, Julien Pivotto wrote: use_backend bob if { hdr(host) -m dom bob.com } use_backend alice if { hdr(host) -m dom alice.com } Thanks for taking the time to write this report. SNI and host header are indeed different. You should consider using req.ssl_sni instead

Re: SNI spoofing in HAproxy?

2021-06-24 Thread Tim Düsterhus
Dominik, On 6/24/21 3:29 PM, Froehlich, Dominik wrote: Not sure if you would call this a security issue, hence I am asking this on the mailing list prior to opening a github issue: This is also known as "Domain Fronting" (https://en.wikipedia.org/wiki/Domain_fronting). It's not necessarily a

Re: SNI spoofing in HAproxy?

2021-06-24 Thread Julien Pivotto
On 24 Jun 13:29, Froehlich, Dominik wrote: > Hi, > > Not sure if you would call this a security issue, hence I am asking this on > the mailing list prior to opening a github issue: > > I’ve noticed that it is really easy to bypass the check on client > certificates of a domain when the client c

SNI spoofing in HAproxy?

2021-06-24 Thread Froehlich, Dominik
Hi, Not sure if you would call this a security issue, hence I am asking this on the mailing list prior to opening a github issue: I’ve noticed that it is really easy to bypass the check on client certificates of a domain when the client can present a valid certificate for another domain. Consi

unable to load certificate chain from file error (Haproxy 2.2 )

2021-06-24 Thread Midhun K
Hello Guys, Issue - Haproxy config test is failing with below error unable to load certificate chain from file '/etc/haproxy/certs/mapersite2-vs/209037_mapersite2_default_mysite.pem'. Haproxy Version - haproxy version is 2.2.9-a947cc2 & tried 2.2.10-6a09215 also. Troubleshooting details - Va

Re: [PATCH 0/1] Replace issue templates by issue forms

2021-06-24 Thread Tim Düsterhus
Willy, On 6/24/21 4:17 AM, Willy Tarreau wrote: Thanks for this fast feedback, now merged! And now we already have the first issue created using an Issue Form: https://github.com/haproxy/haproxy/issues/1307 I think the result is looking great. I particularly like that the plaintext email