Re: Failed to use the source address for outgoing connections

2013-04-24 Thread Willy Tarreau
Hi Godbach, On Tue, Apr 23, 2013 at 04:08:30PM +0800, Godbach wrote: Here is the patch to fix the bug of source function in attachment for your information. (...) I've applied it now. Thank you ! Willy

Re: tcp loadbalancing

2013-04-24 Thread ZeN
Thks for the reply.. here is the capture TCP packet ( i hope it correct ) 861.531811000192.168.77.1192.168.77.50TCP60 [TCP ZeroWindow] 37535 esri-sde [ACK] Seq=1 Ack=1 Win=0 Len=0 871.531829000192.168.77.50192.168.77.1TCP66 [TCP ACKed unseen segment]

Re: tcp loadbalancing

2013-04-24 Thread Jose María Zaragoza
Hello: I don't understand HAProxy manages buffers and just forward them in both ways There are two different connections : client -- HA Proxy and HA Proxy -- server I guess both of them handle their TCP flow control separately am I wrong ? 2013/4/24 ZeN z...@pix.co.id Thks for the reply..

Re: fullconn

2013-04-24 Thread Jose María Zaragoza
Well, not at all :-) So, minconn is an upper limit for incoming connections , is right ? And maxconn will be the new upper limit for incoming connections when the number of connection ( concurrent ? ) on the backend is equal to fullconn. is right ? And what does it happen if the number on the

Re: appsession not sticking?

2013-04-24 Thread Matthew Wild
Hi, On 24 April 2013 06:35, Baptiste bed...@gmail.com wrote: Hi Mattew, You can first send us your configuration :) It was linked in my post :) Again: https://gist.github.com/mwild1/19560e39196f49da4ae2 I've been doing some further digging. Is it possible that haproxy only learns from the

Re: appsession not sticking?

2013-04-24 Thread Matthew Wild
On 24 April 2013 10:40, Matthew Wild mwi...@gmail.com wrote: I've been doing some further digging. Is it possible that haproxy only learns from the first request/response on a connection? That would explain the behaviour I'm seeing. Indeed, this seems to be the case. I also finally found a

RE: Follow-up on thread 'SSL handshake failure' from 2/5/2013

2013-04-24 Thread Connelly, Zachary (CGI Federal)
Baptiste, Thanks for the advice. I am trying to receive an SSL request into HAProxy then pass along to the back-end server as http. The back-end server is a simple SOAP service that responds on http and we want HAProxy to respond to the client on https. We are not redirecting on the back-end

Re: Block url in https

2013-04-24 Thread Bryan Talbot
Since the traffic passing through your port 443 is presumably encrypted, by design, the proxy can't do anything with the contents including read it. -Bryan On Wed, Apr 24, 2013 at 7:57 AM, Matthieu Boret mbore...@gmail.com wrote: Hi, I try to block a URL(public.mydomain.com) in https but

RE: Follow-up on thread 'SSL handshake failure' from 2/5/2013

2013-04-24 Thread Lukas Tribus
Hi! Please also note that the second SOAP call made that fails the handshake also causes the HAProxy server to crash. Could you: - use latest snapshot from [1] - provide the output of haproxy -vv - can you tell us OS, kernel and openssl version? - compile haproxy with debug and without

Re: urls in stick-table, any timeline?

2013-04-24 Thread S Ahmed
Nice! Is this in the latest 1.4 release or a dev release? I need to rate limit on a URL (that includes query string values) like: api.example.com/some_thing/other?id=asdf234asdf234id2=asdf234234 Multiple sources are possible, but I don't care of the source IP I just want to rate limit on the

Re: Block url in https

2013-04-24 Thread PiBa-NL
If your using HAProxy 1.5dev17 or later you could also give it a try with 'SNI'. |use-server www if { req_ssl_sni -i www.example.com } server www 192.168.0.1:443 weight 0 use-server mail if { req_ssl_sni -i mail.example.com } server mail 192.168.0.1:587 weight 0| Or use ssl deciphering

API/Programmatic Interface

2013-04-24 Thread Dave Ariens
Hi subs, I've looked around online and on the official site's add-ons and other solutions areas but can't find mention of a programmatic interface to managing an HA Proxy instance. What are other users doing to address this? A few top user stories are: - Modifying server status -

Re: API/Programmatic Interface

2013-04-24 Thread PiBa-NL
Hi Dave, Some of those are possible see: 9.2. Unix Socket commands: http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#9.2 For example these and their disable/get counterparts: *enable server

Re: VS: Haparoxy hangs in one minute on config reload

2013-04-24 Thread Cyril Bonté
Hi Willy, Le 05/12/2012 22:43, Willy Tarreau a écrit : OK, I see. The health checks are causing too many time-wait sockets. This issue was very recently fixed (in 1.5-dev14) as haproxy now closes health check sockets with a TCP reset, thus avoiding the TIME_WAIT. I'm pretty sure they're the one

Re: tcp loadbalancing

2013-04-24 Thread ZeN
Hello.. just like you, i also need some enlightment.. those words i quoted from Batiste mail.. and im still waiting for the solutions from my problems.. Regards On 4/24/13 2:32 PM, Jose María Zaragoza wrote: Hello: I don't understand HAProxy manages buffers and just forward them in both

Re: urls in stick-table, any timeline?

2013-04-24 Thread Baptiste
Hi, Last question: Will you have one URL per client? I mean will the query string change with each client? Then do you want to rate limit each client individually or do you want to rate limit the number of call to the script named other as a whole in your example? Baptiste On Wed, Apr 24, 2013