Re: http-response set-header is unreliable

2018-05-07 Thread Tim Düsterhus
Willy, Am 03.05.2018 um 18:18 schrieb Willy Tarreau: >> Personally I'd prefer the rate limited warning over the counter. As >> outlined before: A warning counter probably will be incremented for >> multiple unrelated reasons in the longer term and thus loses it >> usefulness. Having a warning_head

Re: http-response set-header is unreliable

2018-05-03 Thread Willy Tarreau
On Thu, May 03, 2018 at 06:00:45PM +0200, Tim Düsterhus wrote: > > What you have above looks like stderr. The rest are logs. They are for > > very different usages, stderr is there to inform you that something went > > wrong during a reload operation (that systemd happily hides so that you > > beli

Re: http-response set-header is unreliable

2018-05-03 Thread Tim Düsterhus
Willy, Am 03.05.2018 um 17:37 schrieb Willy Tarreau: >> [1] I'd love to have a proper integration with systemd-journald to have >> all my logs in one place. It's pretty annoying, because some things >> ("Proxy bk_*** started"; [WARNING] 121/202559 (11635) : Reexecuting >> Master process) go to sys

Re: http-response set-header is unreliable

2018-05-03 Thread Willy Tarreau
Hi Tim, On Thu, May 03, 2018 at 03:34:01PM +0200, Tim Düsterhus wrote: > >> Especially since the issue happens randomly: Sometimes the additional > >> headers fit by chance. Sometimes they don't. I would start by > >> investigating the connection to the backend services, not investigating > >> som

Re: http-response set-header is unreliable

2018-05-03 Thread Tim Düsterhus
Willy, Am 03.05.2018 um 05:23 schrieb Willy Tarreau: >> To me a message like: "Unable to add-header Content-Security-Policy to >> response. Possibly the amount of headers exceeds tune.maxrewrite." would >> have been more helpful than random 502 without any further information. > > We could possib

Re: http-response set-header is unreliable

2018-05-02 Thread Willy Tarreau
On Thu, May 03, 2018 at 12:08:37AM +0200, Tim Düsterhus wrote: > Willy, > > Am 02.05.2018 um 11:47 schrieb Willy Tarreau: > > Nice one, though I'd argue that sites which do this know that they > > are manipulating large contents (it's visible in the config file and > > sometimes they are the ones

Re: http-response set-header is unreliable

2018-05-02 Thread Tim Düsterhus
Willy, Am 02.05.2018 um 11:47 schrieb Willy Tarreau: > Nice one, though I'd argue that sites which do this know that they > are manipulating large contents (it's visible in the config file and > sometimes they are the ones asking to relax the config parsing rules). > So they're also aware of the n

Re: http-response set-header is unreliable

2018-05-02 Thread Willy Tarreau
On Tue, May 01, 2018 at 05:10:19PM +0200, Tim Düsterhus wrote: > Willy, > > Am 01.05.2018 um 06:28 schrieb Willy Tarreau: > >> It might make sense to enlarge the rewrite buffer reservation by > >> default. > > > > We used to have this a long time ago, the maxrewrite value used to > > default to h

Re: http-response set-header is unreliable

2018-05-01 Thread Tim Düsterhus
Willy, Am 01.05.2018 um 06:28 schrieb Willy Tarreau: >> It might make sense to enlarge the rewrite buffer reservation by >> default. > > We used to have this a long time ago, the maxrewrite value used to > default to half the buffer size. But it caused too many requests to > be rejected and becam

Re: http-response set-header is unreliable

2018-04-30 Thread Willy Tarreau
Hi Tim, On Tue, May 01, 2018 at 01:57:06AM +0200, Tim Düsterhus wrote: > Willy, > > Am 30.04.2018 um 23:06 schrieb Willy Tarreau: > >> Anything I could do to help investigate this? I can apply patches with > >> additional logging or I can send you the unredacted configuration in > >> private if t

Re: http-response set-header is unreliable

2018-04-30 Thread Tim Düsterhus
Willy, Am 30.04.2018 um 23:06 schrieb Willy Tarreau: >> Anything I could do to help investigate this? I can apply patches with >> additional logging or I can send you the unredacted configuration in >> private if that would help. > > OK, it's just that for now I can't propose anything, I'm contex

Re: http-response set-header is unreliable

2018-04-30 Thread Willy Tarreau
On Mon, Apr 30, 2018 at 09:06:16PM +0200, Tim Düsterhus wrote: > Am 30.04.2018 um 15:48 schrieb Willy Tarreau: > >> And why does it affect two headers at once? If the length is right below > >> the limit intuitively only the very last header should be affected. > > > > I really don't know, maybe t

Re: http-response set-header is unreliable

2018-04-30 Thread Tim Düsterhus
Willy, Am 30.04.2018 um 15:48 schrieb Willy Tarreau: >> And why does it affect two headers at once? If the length is right below >> the limit intuitively only the very last header should be affected. > > I really don't know, maybe the rules are aborted during their processing. Anything I could d

Re: http-response set-header is unreliable

2018-04-30 Thread Willy Tarreau
Hi Tim, On Sun, Apr 29, 2018 at 09:36:13PM +0200, Tim Düsterhus wrote: > Willy, > > Am 28.04.2018 um 07:51 schrieb Willy Tarreau: > > Not that many ideas. Could you retry by setting "tune.maxrewrite" to a > > larger value ? It defaults to 1024, and maybe you're already adding 1kB > > of response

Re: http-response set-header is unreliable

2018-04-29 Thread Tim Düsterhus
Willy, Am 28.04.2018 um 07:51 schrieb Willy Tarreau: > Not that many ideas. Could you retry by setting "tune.maxrewrite" to a > larger value ? It defaults to 1024, and maybe you're already adding 1kB > of response and there's no more room in the response buffer. It's just > a guess, I could be com

Re: http-response set-header is unreliable

2018-04-27 Thread Willy Tarreau
Hi Tim, On Thu, Apr 26, 2018 at 05:33:09PM +0200, Tim Düsterhus wrote: > Hi > > I have got a frontend in mode http that sets various headers > unconditionally: > > > http-response set-headerExpect-CT > > "max-age=3600; report-uri=\"https://xxx.report-uri.com/r/d/ct/r

http-response set-header is unreliable

2018-04-26 Thread Tim Düsterhus
Hi I have got a frontend in mode http that sets various headers unconditionally: > http-response set-headerExpect-CT > "max-age=3600; report-uri=\"https://xxx.report-uri.com/r/d/ct/reportOnly\""; > http-response set-headerExpect-Staple > "