Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-19 Thread Willy Tarreau
Hi Christopher, On Mon, Feb 19, 2018 at 03:24:09PM +0100, Christopher Faulet wrote: > Someone on discourse reports a problem with this patch: > > https://discourse.haproxy.org/t/random-sa-errors-with-haproxy-1-8-3/2116/6 > > I asked him to test the attached patch. But It could be cool to have mo

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-19 Thread Christopher Faulet
Le 14/02/2018 à 18:53, Willy Tarreau a écrit : On Wed, Feb 14, 2018 at 06:20:42PM +0100, Mateusz Malek wrote: Hi, On 14.02.2018 17:53, Willy Tarreau wrote: On Wed, Feb 14, 2018 at 05:29:57PM +0100, Olivier Houchard wrote: What about what's attached, instead ? I think it should work. Mateusz,

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-14 Thread Willy Tarreau
On Wed, Feb 14, 2018 at 06:20:42PM +0100, Mateusz Malek wrote: > Hi, > > On 14.02.2018 17:53, Willy Tarreau wrote: > > On Wed, Feb 14, 2018 at 05:29:57PM +0100, Olivier Houchard wrote: > > > What about what's attached, instead ? > > I think it should work. Mateusz, care to give it a try to confirm

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-14 Thread Mateusz Małek
Hi, On 14.02.2018 17:53, Willy Tarreau wrote: On Wed, Feb 14, 2018 at 05:29:57PM +0100, Olivier Houchard wrote: What about what's attached, instead ? I think it should work. Mateusz, care to give it a try to confirm ? If OK, I'll merge it. I confirm, with this patch applied problem is gone.

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-14 Thread Willy Tarreau
On Wed, Feb 14, 2018 at 05:29:57PM +0100, Olivier Houchard wrote: > Hi Willy, > > On Tue, Feb 13, 2018 at 08:05:44PM +0100, Willy Tarreau wrote: > > Hi Olivier, > > Such type of construct tends to scare me (probably because I'm not reading > > the whole code). It means we're supposed to set an err

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-14 Thread Olivier Houchard
Hi Willy, On Tue, Feb 13, 2018 at 08:05:44PM +0100, Willy Tarreau wrote: > Hi Olivier, > Such type of construct tends to scare me (probably because I'm not reading > the whole code). It means we're supposed to set an error by default unless > we pass by a specific path. I fear that we'll get futur

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-13 Thread Willy Tarreau
Hi Olivier, On Tue, Feb 13, 2018 at 06:07:36PM +0100, Olivier Houchard wrote: > Hi Emmanuel, > > On Tue, Feb 13, 2018 at 05:40:00PM +0100, Emmanuel Hocdet wrote: > > Hi Olivier > > > > > Le 13 févr. 2018 à 15:27, Olivier Houchard a > > > écrit : > > > > > > Thanks a lot for the detailed analy

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-13 Thread Olivier Houchard
Hi Emmanuel, On Tue, Feb 13, 2018 at 05:40:00PM +0100, Emmanuel Hocdet wrote: > Hi Olivier > > > Le 13 févr. 2018 à 15:27, Olivier Houchard a écrit : > > > > Thanks a lot for the detailed analyze, and sorry for the late answer. > > You're probably right, SSL_ERROR_SYSCALL shouldn't be treated a

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-13 Thread Emmanuel Hocdet
Hi Olivier > Le 13 févr. 2018 à 15:27, Olivier Houchard a écrit : > > Thanks a lot for the detailed analyze, and sorry for the late answer. > You're probably right, SSL_ERROR_SYSCALL shouldn't be treated as an > unrecoverable error. > So, what you basically did was something equivalent to the pa

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-13 Thread Willy Tarreau
On Tue, Feb 13, 2018 at 05:29:21PM +0100, Mateusz Malek wrote: > Hi, > > On 13.02.2018 15:27, Olivier Houchard wrote: > > Thanks a lot for the detailed analyze, and sorry for the late answer. > > You're probably right, SSL_ERROR_SYSCALL shouldn't be treated as an > > unrecoverable error. > > So, w

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-13 Thread Mateusz Małek
Hi, On 13.02.2018 15:27, Olivier Houchard wrote: > Thanks a lot for the detailed analyze, and sorry for the late answer. > You're probably right, SSL_ERROR_SYSCALL shouldn't be treated as an > unrecoverable error. > So, what you basically did was something equivalent to the patch attached ? Yeah,

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-13 Thread Olivier Houchard
Hi guys, On Sat, Feb 10, 2018 at 06:26:42PM +0100, Mateusz Małek wrote: > Hi everyone, > > I've narrowed down my problem down to the same commit as Tomek Gacek - > c2aae74f010f97a3415542fe649198a5d3be1ea8 (MEDIUM: ssl: Handle early data > with OpenSSL 1.1.1), so I guess it may be related. In my c

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-10 Thread Willy Tarreau
Hi Mateusz, I'm CCing Emeric (SSL maintainer) and Olivier (who added early-data support), and responding to some points below. On Sat, Feb 10, 2018 at 06:26:42PM +0100, Mateusz Malek wrote: > Hi everyone, > > I've narrowed down my problem down to the same commit as Tomek Gacek - > c2aae74f010f97

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-10 Thread Mateusz Małek
Hi everyone, I've narrowed down my problem down to the same commit as Tomek Gacek - c2aae74f010f97a3415542fe649198a5d3be1ea8 (MEDIUM: ssl: Handle early data with OpenSSL 1.1.1), so I guess it may be related. In my case, since upgrade to 1.8, some responses from some backends (not sure what exa

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-08 Thread Tomek Gacek
Hi Willy On 2018-02-03 10:05, Willy Tarreau wrote: Hi Tomek, On Sat, Feb 03, 2018 at 08:47:35AM +0100, Tomek Gacek wrote: I have same issue. It's pretty random as I would say about 60-70% requests are OK, but rest is failing. I compiled all 1.8 versions and was able to isolate this a little bi

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-03 Thread Willy Tarreau
Hi Tomek, On Sat, Feb 03, 2018 at 08:47:35AM +0100, Tomek Gacek wrote: > I have same issue. It's pretty random as I would say about 60-70% requests > are OK, but rest is failing. I compiled all 1.8 versions and was able to > isolate this a little bit. It's fine up to 1.8.0-dev3 branch and it's > f

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-02-02 Thread Tomek Gacek
Hi On 2018-01-17 11:37, Bart Geesink wrote: Hi, On 01/17/2018 10:16 AM, Christopher Faulet wrote: Le 16/01/2018 à 16:18, Lukas Tribus a écrit : Hello Christopher, On 16 January 2018 at 15:01, Bart Geesink wrote: Hi, We have an issue in haproxy > 1.8 on CentOS when using SSL in the server

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-01-17 Thread Bart Geesink
Hi, On 01/17/2018 10:16 AM, Christopher Faulet wrote: > Le 16/01/2018 à 16:18, Lukas Tribus a écrit : >> Hello Christopher, >> >> >> On 16 January 2018 at 15:01, Bart Geesink >> wrote: >>> Hi, >>> >>> We have an issue in haproxy > 1.8 on CentOS when using SSL in the server >>> configuration. Hapr

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-01-17 Thread Christopher Faulet
Le 16/01/2018 à 16:18, Lukas Tribus a écrit : Hello Christopher, On 16 January 2018 at 15:01, Bart Geesink wrote: Hi, We have an issue in haproxy > 1.8 on CentOS when using SSL in the server configuration. Haproxy sometimes logs a http status code "-1" followed by the termination_state SDxx.

Re: haproxy 1.8 ssl backend server leads to server session aborts

2018-01-16 Thread Lukas Tribus
Hello Christopher, On 16 January 2018 at 15:01, Bart Geesink wrote: > Hi, > > We have an issue in haproxy > 1.8 on CentOS when using SSL in the server > configuration. Haproxy sometimes logs a http status code "-1" followed > by the termination_state SDxx. This happens every few requests. When >

haproxy 1.8 ssl backend server leads to server session aborts

2018-01-16 Thread Bart Geesink
Hi, We have an issue in haproxy > 1.8 on CentOS when using SSL in the server configuration. Haproxy sometimes logs a http status code "-1" followed by the termination_state SDxx. This happens every few requests. When using one backend, the clients don't notice it. When using multiple backends, thi