HTTP/2 will Host: header removal makes things faster?

2013-01-31 Thread Eliezer Croitoru
I was reading about SPDY and the up-coming HTTP/2.0 and one of their main if not the most important one is speed. Using a multiplexed protocol will cause a less painful connection re-initiation else then compression of headers. There was a small\long talk about the Host: header overhead on high

Re: client keep-alive when servers

2013-01-31 Thread Chris Burroughs
I'm using haproxy 1.4.17 if that's relevant. I tried replacing http-server-close with http-pretend-keepalive, which as far as I can tell had no effect to client side keepalive behaviour. Responses still looked something like this: HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control:

Re: client keep-alive when servers

2013-01-31 Thread Willy Tarreau
On Thu, Jan 31, 2013 at 08:39:43AM -0500, Chris Burroughs wrote: I'm using haproxy 1.4.17 if that's relevant. I tried replacing http-server-close with http-pretend-keepalive, which as far as I can tell had no effect to client side keepalive behaviour. it's not a replacement but a complement,

SSL offloading with NTLM auth

2013-01-31 Thread Roland
Hi! I'm using haproxy 1.5dev17 and try to balance traffic destined for MS Exchange 2010 CAS servers. OWA and ActiveSync are working without any problems- but Outlook Anywhere (RPC over HTTP with NTLM auth) produces an error 401 even with Microsofts Remote Connectivity Analyzer. HAProxy runs

Please confirm your information

2013-01-31 Thread Skype
Title: |

Trick: Sneaky workaround for SNI

2013-01-31 Thread Robin Lee Powell
Just something I thought the rest of the interwebs might find useful. If you can get your users to first connect to an http:// address, and then have that URL redirect them to https://, you can work around a lack of SNI support on the client end like so: # content switching based on host name

Re: HAProxy high frontend error rate

2013-01-31 Thread Adrian C.
On Tue, 29 Jan 2013, l d wrote: I've already analysed the haproxy log, captured and analysed packets with tcpdump and wireshark, but I can't see any obvious reason why it's happening. I tried to raise the client and server timeouts but it didn't help and I can't keep it too high. Hello I

Re: SSL offloading with NTLM auth

2013-01-31 Thread Baptiste
Hi, 401 is absolutely normal in NTLM. There are 2 or 3 request/response before the user is really authenticated when using NTLM. When HAProxy load-balances NTLM based services, the only log line you'll see will be 401 errors. Even if the connection works properly. This is due to the tunnel mode,

Re: client keep-alive when servers

2013-01-31 Thread Chris Burroughs
On 01/31/2013 08:55 AM, Willy Tarreau wrote: This one has everything needed, transfer-encoding: chunked specifies the size so the connection can stay alive. But responses from haproxy still closed with either http-server-close or http-pretend-keepalive set still close the connection. I

Re: [PATCH 2/5] dumpstats: Break out set weight processing code

2013-01-31 Thread Simon Horman
On Mon, Dec 24, 2012 at 07:58:13AM +0100, Willy Tarreau wrote: Hi Simon, I have some minor comments below for this patch : On Mon, Dec 24, 2012 at 10:33:54AM +0900, Simon Horman wrote: +static int stats_sock_parse_weight_change_request(struct stream_interface *si, +

Re: [PATCH 3/5] dumpstats: Remove duplicate check in nested if clauses

2013-01-31 Thread Simon Horman
On Mon, Dec 24, 2012 at 07:58:52AM +0100, Willy Tarreau wrote: On Mon, Dec 24, 2012 at 10:33:55AM +0900, Simon Horman wrote: {px-lbprm.algo BE_LB_PROP_DYN) is checked by the immediate outer if clause, so there is no need to check it a second time. Good catch, this one could be merged

Re: [PATCH 5/5] dynamic health check

2013-01-31 Thread Simon Horman
Hi Malcolm, Hi Willy, after a bit of a hiatus I'd like to restart this discussion. On Mon, Dec 24, 2012 at 10:23:15AM +0100, Willy Tarreau wrote: Hi Malcolm, On Mon, Dec 24, 2012 at 09:06:25AM +, Malcolm Turnbull wrote: Willy / Simon, I'm very happy to add a down option, my

Re: HAProxy on Multi CPU / Multi Core Hardware

2013-01-31 Thread Baptiste
Hi, There is already a multi-process model, but some features won't work as expected (anything related to memory like stick tables, maxconn, health checks, stats, etc..) So you can use this mode to mitigate DDOs or when you don't need the features listed above. Actually, the feature listed will

Re: SSL offloading with NTLM auth

2013-01-31 Thread Roland
Hi Baptiste, thanks a lot! If I connect the same computer with the same account and unchanged settings (except the URL of webaccess) directly to the CAS it works without any problems. Connection is established immediately. I also verified with Microsoft Remote Connectivity Analyzer. It

Re: [PATCH 5/5] dynamic health check

2013-01-31 Thread Willy Tarreau
Hi Simon, On Fri, Feb 01, 2013 at 01:56:01PM +0900, Simon Horman wrote: Hi Malcolm, Hi Willy, after a bit of a hiatus I'd like to restart this discussion. Cool, I wanted to ping you on this last week-end but forgot to do so ! On Mon, Dec 24, 2012 at 10:23:15AM +0100, Willy Tarreau wrote:

Re: client keep-alive when servers

2013-01-31 Thread Willy Tarreau
On Thu, Jan 31, 2013 at 10:15:44PM -0500, Chris Burroughs wrote: On 01/31/2013 08:55 AM, Willy Tarreau wrote: This one has everything needed, transfer-encoding: chunked specifies the size so the connection can stay alive. But responses from haproxy still closed with either