Re: TLS handshake works with certificate name mismatch using "verify required" and "verifyhost"

2018-07-12 Thread Igor Cicimov
On Fri, Jul 13, 2018 at 11:26 AM, Igor Cicimov < ig...@encompasscorporation.com> wrote: > On Fri, Jul 13, 2018 at 11:08 AM, Igor Cicimov < > ig...@encompasscorporation.com> wrote: > >> Hi Martin, >> >> On Thu, Jul 12, 2018 at 6:55 PM, Martin RADEL < >> martin.ra...@rbinternational.com> wrote: >>

Re: TLS handshake works with certificate name mismatch using "verify required" and "verifyhost"

2018-07-12 Thread Igor Cicimov
On Fri, Jul 13, 2018 at 11:08 AM, Igor Cicimov < ig...@encompasscorporation.com> wrote: > Hi Martin, > > On Thu, Jul 12, 2018 at 6:55 PM, Martin RADEL < > martin.ra...@rbinternational.com> wrote: > >> Hi all, >> >> >> >> we have a strange situation with our HAProxy, running on Version 1.8.8 >>

Re: TLS handshake works with certificate name mismatch using "verify required" and "verifyhost"

2018-07-12 Thread Igor Cicimov
Hi Martin, On Thu, Jul 12, 2018 at 6:55 PM, Martin RADEL < martin.ra...@rbinternational.com> wrote: > Hi all, > > > > we have a strange situation with our HAProxy, running on Version 1.8.8 > with OpenSSL. > > (See the details in the setup listed below - some lines are missing by > intention.

Re: active-active haproxy behind Azure Load Balancer

2018-07-12 Thread Christopher Cox
I don't speak "Azure", but if they have something that claims to be a load balancer, then "sure", just have to deal with stickiness issues and of course the fact that you're load balancing load balancers. (you likely need Application Gateway) On 07/12/2018 05:50 PM, musafir wrote: Hey Folks,

active-active haproxy behind Azure Load Balancer

2018-07-12 Thread musafir
Hey Folks, is it possible to setup Haproxy 2 node active-active cluster behind Azure Load Balancer i.e. (Azure LoadBalancer -> 2 Haproxy(ACTIVE-ACTIVE) -> WEBSERVERS). any suggestions?

Re: [PATCH][MINOR] Implement resovle-opts with 2 new options

2018-07-12 Thread Willy Tarreau
On Thu, Jul 12, 2018 at 05:10:49PM +0200, Baptiste wrote: > Hi all, > > This patch adds a new keyword "resolve-opts" which can take a list of comma > separated options. (...) applied, thank you Baptiste. Willy

Re: [PATCH] REGTEST/MINOR: Wrong URI syntax.

2018-07-12 Thread Willy Tarreau
On Thu, Jul 12, 2018 at 11:05:30AM +0200, Frederic Lecaille wrote: > This is a patch to fix the issue reported by Ilya Shipitsin in this thread. Applied, thank you Fred. Willy

Re: [PATCH] MINOR: mworker: exit with 0 on successful exit

2018-07-12 Thread Willy Tarreau
On Thu, Jul 12, 2018 at 05:38:34PM +0200, William Lallemand wrote: > On Thu, Jul 12, 2018 at 04:42:01PM +0200, Vincent Bernat wrote: > > ? 12 juillet 2018 16:25 +0200, William Lallemand  : > > > > > Maybe we could take your first patch for the unit file and backport it in > > > 1.8, > > > and

Re: [PATCH] MINOR: mworker: exit with 0 on successful exit

2018-07-12 Thread William Lallemand
On Thu, Jul 12, 2018 at 04:42:01PM +0200, Vincent Bernat wrote: > ❦ 12 juillet 2018 16:25 +0200, William Lallemand  : > > > Maybe we could take your first patch for the unit file and backport it in > > 1.8, > > and then make the appropriate changes for 1.9 once the master was > > redesigned. >

[PATCH][MINOR] Implement resovle-opts with 2 new options

2018-07-12 Thread Baptiste
Hi all, This patch adds a new keyword "resolve-opts" which can take a list of comma separated options. 2 options have been implemented for now: * prevent-dup-ip: (default and historical way of working for HAProxy) ensure this server will be the single one configured to an IP address, when sharing

Re: [PATCH] MINOR: mworker: exit with 0 on successful exit

2018-07-12 Thread Vincent Bernat
❦ 12 juillet 2018 16:25 +0200, William Lallemand  : > Maybe we could take your first patch for the unit file and backport it in 1.8, > and then make the appropriate changes for 1.9 once the master was > redesigned. Yes, no problem. The first patch should apply without any change on 1.8. I am

Re: Issue with parsing DNS from AWS

2018-07-12 Thread Jim Deville
Thanks for the update. We will see what we can do, and I appreciate your help! Jim From: Baptiste Sent: Thursday, July 12, 2018 8:59:53 AM To: Jim Deville Cc: haproxy@formilux.org; Jonathan Works Subject: Re: Issue with parsing DNS from AWS Hi Jim, "hold

Re: [PATCH] MINOR: mworker: exit with 0 on successful exit

2018-07-12 Thread William Lallemand
On Thu, Jul 12, 2018 at 04:14:34PM +0200, Vincent Bernat wrote: > ❦ 22 juin 2018 22:03 +0200, Vincent Bernat  : > > > Without this patch, when killing the master process, the SIGTERM > > signal is forwarded to all children. Last children will likely exit > > with "killed by signal SIGTERM"

Re: [PATCH] MINOR: mworker: exit with 0 on successful exit

2018-07-12 Thread Vincent Bernat
❦ 22 juin 2018 22:03 +0200, Vincent Bernat  : > Without this patch, when killing the master process, the SIGTERM > signal is forwarded to all children. Last children will likely exit > with "killed by signal SIGTERM" status which would be converted by an > exit with status 143 of the master

Re: Issue with parsing DNS from AWS

2018-07-12 Thread Baptiste
Hi Jim, "hold obsolete" defaults to 0, so basically, HAProxy may evince servers from your backend quite frequently (the bigger the farm, the more chance it happens). Furthermore, most of those changes are "false positive" (since the server may still be healthy). DNS over TCP won't help. As I

Re: haproxy bug: healthcheck not passing after port change when statefile is enabled

2018-07-12 Thread Baptiste
Hi Sven, Thanks for the clarification. It's a bit more complicated than what it is supposed to be. I think we may want to apply the port only if it has been changed at runtime (changed by DNS SRV records). The status is the following: I have a pending patch which brings SRV record information

Re: haproxy ci (again), gitlab.com ?

2018-07-12 Thread William Lallemand
On Thu, Jul 12, 2018 at 02:54:43PM +0500, Илья Шипицин wrote: > hello, > Hello, > I have the following suggestion > > 1) I will add .gitlab-ci.yml to the haproxy repo (it will include "centos > 7" and "fedora 28" builds, just to cover openssl-1.0.2 and openssl-1.1.0) > It could be a better

haproxy ci (again), gitlab.com ?

2018-07-12 Thread Илья Шипицин
hello, I have the following suggestion 1) I will add .gitlab-ci.yml to the haproxy repo (it will include "centos 7" and "fedora 28" builds, just to cover openssl-1.0.2 and openssl-1.1.0) 2) that .gitlab-ci.yml will run reg tests 3) anyone can follow to https://gitlab.com --> new --> CI for

[PATCH] REGTEST/MINOR: Wrong URI syntax.

2018-07-12 Thread Frederic Lecaille
This is a patch to fix the issue reported by Ilya Shipitsin in this thread. Fred. >From 47ca7696d0ccca5989929940db323e9e9255ae4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20L=C3=A9caille?= Date: Thu, 12 Jul 2018 10:48:06 +0200 Subject: [PATCH] REGTEST/MINOR: Wrong URI syntax.

TLS handshake works with certificate name mismatch using "verify required" and "verifyhost"

2018-07-12 Thread Martin RADEL
Hi all, we have a strange situation with our HAProxy, running on Version 1.8.8 with OpenSSL. (See the details in the setup listed below - some lines are missing by intention. It's a config snippet with just the interesting parts mentioned) Initial situation: We run a HAProxy instance which

Re: how h1_frt_addr is defined during reg tests?

2018-07-12 Thread Илья Шипицин
yes, it fixed build: https://gitlab.com/chipitsine/haproxy/-/jobs/81225803 чт, 12 июл. 2018 г. в 13:28, Frederic Lecaille : > On 07/11/2018 09:12 PM, Илья Шипицин wrote: > > Hello, > > > > I'm playing with reg tests. Sometimes they fail for weird reasons. > > (for example, fedora 28 on gitlab

Re: how h1_frt_addr is defined during reg tests?

2018-07-12 Thread Frederic Lecaille
On 07/11/2018 09:12 PM, Илья Шипицин wrote: Hello, I'm playing with reg tests. Sometimes they fail for weird reasons. (for example, fedora 28 on gitlab ci) https://gitlab.com/chipitsine/haproxy/-/jobs/81106855 curl -i -k https://${h1_frt_addr}:${h1_frt_port} became curl -i -k