Re: Buffer limits when adding a large number of CA certs into one ca-file via socket

2022-08-17 Thread Lais, Alexander
Dear William, Thank you. We will adjust our planning accordingly. Kind regards, Alex > On 16. Aug 2022, at 15:24, William Lallemand wrote: > > On Tue, Aug 16, 2022 at 11:16:43AM +0000, Lais, Alexander wrote: >> Hi William, >> >> Thank you! I figured you were on

Re: Buffer limits when adding a large number of CA certs into one ca-file via socket

2022-08-16 Thread Lais, Alexander
Hi William, Thank you! I figured you were on holidays. A lot of our team are as well. Do you see this being back ported to 2.5 / 2.6 (LTS) as well? Thanks and kind regards, Alex > On 16. Aug 2022, at 11:07, William Lallemand wrote: > > On Thu, Aug 04, 2022 at 11:57:16AM +0

Buffer limits when adding a large number of CA certs into one ca-file via socket

2022-07-26 Thread Lais, Alexander
Dear all, We are now using the new feature of adding CA files dynamically via the stats / admin socket. Assuming that the CA file does not exist yet, our understanding is that we: 1. Create a CA file (new ssl ca-file customer-cas.pem) 2. Set the content of the CA file with payload notation;

Re: Granular rate-limits, metrics and stick-tables

2022-05-13 Thread Lais, Alexander
Hi Tristan, I can’t add anything (yet) besides saying thank you for the write up. I’m mostly writing this because I don’t see the message in the mailing list archive and found the actual mail in my junk mail folder for some reason. Cheers, Alex > On 11. May 2022, at 21:34, Tristan wrote: > >

Check interval rise and fall behaviour

2022-03-29 Thread Lais, Alexander
Dear all, We are using the backend health checks to disable flapping backends. The default values for rise and fall are 2 subsequent succeeded and 3 subsequent failed checks. Our check interval is at 1000ms (a little frequent, potentially part of the problem). Here is what we observed, using

ACL execution order, short circuit behaviour?

2022-02-28 Thread Lais, Alexander
Dear all, I’m trying to understand, how ACL chains, e.g. for `http-request deny` are executed, and whether they support short-circuit. Example: acl1: ip in particular range acl2: comple regex match with a long list of patterns http-request deny acl1 !acl2 That would mean block the request