Re: [PATCH 2/2] DOC: ssl: Specify stronger example ciphers

2019-02-04 Thread Willy Tarreau
Hi guys, On Mon, Feb 04, 2019 at 10:13:11PM +0100, Lukas Tribus wrote: > > Since TLS ciphers are not well understand, it is very common parameters > > from documentation are used as is. Since RC4 should not be used anymore > > I believe it is wiser to show example including stronger ciphers to > >

Re: support for FreeBSD accept filters

2019-02-04 Thread Richard Russo
Thanks Willy and Lukas, I've tried your config suggestions; the system behavior seems to be pretty similar to with accept filters. It's also simpler for me to deploy, so it's a definitely win. Thanks again! On 2/1/19, 11:50 PM, "Willy Tarreau" wrote: Hi Lukas, On Sat, Feb 02, 2

Re: Opinions about DoH (=DNS over HTTPS) as resolver for HAProxy

2019-02-04 Thread Aleksandar Lazic
Hi Lukas. Am 04.02.2019 um 21:39 schrieb Lukas Tribus: > Hello, > > On Mon, 4 Feb 2019 at 12:14, Aleksandar Lazic wrote: >> >> Hi. >> >> I have just opened a new Issue about DoH for resolving. >> >> https://github.com/haproxy/haproxy/issues/33 >> >> As I know that this is a major change in the In

Re: [PATCH 2/2] DOC: ssl: Specify stronger example ciphers

2019-02-04 Thread Lukas Tribus
Hello, On Mon, 4 Feb 2019 at 20:48, Bertrand Jacquin wrote: > > Since TLS ciphers are not well understand, it is very common parameters > from documentation are used as is. Since RC4 should not be used anymore > I believe it is wiser to show example including stronger ciphers to > avoid deployin

Re: Opinions about DoH (=DNS over HTTPS) as resolver for HAProxy

2019-02-04 Thread Lukas Tribus
Hello, On Mon, 4 Feb 2019 at 12:14, Aleksandar Lazic wrote: > > Hi. > > I have just opened a new Issue about DoH for resolving. > > https://github.com/haproxy/haproxy/issues/33 > > As I know that this is a major change in the Infrastructure I would like to > here what you think about this sugge

[PATCH 1/2] DOC: ssl: Clarify when pre TLSv1.3 cipher can be used

2019-02-04 Thread Bertrand Jacquin
This is mainly driven by the fact TLSv1.3 will have a successor at some point. --- doc/configuration.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/configuration.txt b/doc/configuration.txt index fe5eb25076c7..f7e1339a3e9b 100644 --- a/doc/configuration.txt +++ b/d

[PATCH 2/2] DOC: ssl: Specify stronger example ciphers

2019-02-04 Thread Bertrand Jacquin
Since TLS ciphers are not well understand, it is very common parameters from documentation are used as is. Since RC4 should not be used anymore I believe it is wiser to show example including stronger ciphers to avoid deploying unsafe configuration in the wild. "ALL" is also to avoid since it cont

Re: cQ-- termination state doubts

2019-02-04 Thread Willy Tarreau
Hi, On Mon, Feb 04, 2019 at 04:05:15PM +, Juan Pablo Mora wrote: > > During a period of slowness of my database I see this log (HAProxy 1.7.5): > > > Feb 4 11:09:30 localhost.localdomain haproxy[23601]: 185.198.176.21:41987 > [04/Feb/2019:11:09:12.408] WWW BUS/BUS2 9/8785/2/8860/17657 200

Idea for the Wiki

2019-02-04 Thread Willy Tarreau
Hi all, as discussed a few times in the past, we have the possibility to enable the Wiki on the github repository. In the past a few of us thought it would be a nice alternative to the obsolete architecture manual because it would allow a number of people to contribute to various areas with a rela

cQ-- termination state doubts

2019-02-04 Thread Juan Pablo Mora
During a period of slowness of my database I see this log (HAProxy 1.7.5): Feb 4 11:09:30 localhost.localdomain haproxy[23601]: 185.198.176.21:41987 [04/Feb/2019:11:09:12.408] WWW BUS/BUS2 9/8785/2/8860/17657 200 596 8453 - - cQ-- 528/236/37/14/0 0/9 {|3701F3DB6BBF1DAC} {|RESULT_OK_HEADER} "P

Re: Early connection close, incomplete transfers

2019-02-04 Thread Willy Tarreau
Hi Veiko, On Mon, Feb 04, 2019 at 01:52:28PM +, Veiko Kukk wrote: > I'm sure it happens with all versions we have tried: 1.6, 1.7, 1.9 (did not > try 1.8, because we have never used it in production and decided to switch > directly to 1.9), but how could we make sure it's caused by something >

Re: Early connection close, incomplete transfers

2019-02-04 Thread Veiko Kukk
ppens only/more with keep-alive, close or server-close ? I have seen no difference, unfortunately. If you can run more tests in your test environment, I'd be interested in seeing how latest 2.0-dev works with these variants : Tested with http://www.haproxy.org/download/2.0/src/snaps

Opinions about DoH (=DNS over HTTPS) as resolver for HAProxy

2019-02-04 Thread Aleksandar Lazic
Hi. I have just opened a new Issue about DoH for resolving. https://github.com/haproxy/haproxy/issues/33 As I know that this is a major change in the Infrastructure I would like to here what you think about this suggestion. My opinion was at the beginning against this change as there was only