Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-08-25 Thread Willy Tarreau
Hi Dave, On Tue, Aug 25, 2015 at 03:50:23PM +, Dave Zhu (yanbzhu) wrote: Hey Willy, On 8/25/15, 10:36 AM, Willy Tarreau w...@1wt.eu wrote: This means that the RSA/DSA/ECDSA cert names must be derived from the original cert name. I¹ve thought of a way to avoid this behavior, with

Re: Using sockets from Lua

2015-08-25 Thread Willy Tarreau
On Tue, Aug 25, 2015 at 05:27:59PM +0200, Thierry FOURNIER wrote: Hello, Thank you for the bug repport. It is fixed in the current developpment version. You must compile from sources or wait for the next dev release. Actually, the function txn.close() causes a segfault, it will be fixed

Re: Rate Limiting - Stick-Table Entry Expiration

2015-08-25 Thread Willy Tarreau
Hi Hugues, On Wed, Aug 19, 2015 at 01:34:46PM -0700, Hugues Alary wrote: Hi there, I've been trying to implement rate limiting for some HTTP POST requests on my website. It works great, except for one detail: the expiration of my entry in my stick-table is always reset to 30 seconds, which

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-08-25 Thread Robin Geuze
Hey willy, One small comment. As of openssl v1.0.2 it actually supports loading multiple certificates with different chains. It requires calling SSL_CTX_add0_chain_cert (or SSL_CTX_add1_chain_cert, the exact difference can be found in the man page) instead of SSL_CTX_add_extra_chain_cert.

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-08-25 Thread Willy Tarreau
Hi guys, Yesterday Emeric and I brainstormed on this subject in the office. Emeric brought on the table some cases which couldn't be reliably covered anymore, and proposed a slightly different approach which finally convinced me. I'll try to summarize here our long conversation and we'd like to

Re: Using sockets from Lua

2015-08-25 Thread Thierry FOURNIER
Hello, Thank you for the bug repport. It is fixed in the current developpment version. You must compile from sources or wait for the next dev release. Actually, the function txn.close() causes a segfault, it will be fixed in a few time. Thierry On Thu, 20 Aug 2015 15:09:10 +0300 Tsvetan

Re:Comeptition swim goggles

2015-08-25 Thread POQSWIM
DearSir/Madam 100%siliconeswimcaps:Qty=:1000pcsprice:USD0.86=/pcs Logo:USD0.2/color/side TrialorderisaccpetableOEMisacceptableAcceptmixedorderCustomserviceandpa=ckageareavailableCompetitiveprice,Cansave30%cost Recommend:PSC1300swi=mgogglewhichcanstartfromsmallMOQ BestRegards

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-08-25 Thread Dave Zhu (yanbzhu)
Hey Willy, On 8/25/15, 10:36 AM, Willy Tarreau w...@1wt.eu wrote: This means that the RSA/DSA/ECDSA cert names must be derived from the original cert name. I¹ve thought of a way to avoid this behavior, with the end result being very similar to what you/Emeric proposed. What if we delayed the

Re: Using sockets from Lua

2015-08-25 Thread Tsvetan Tsvetanov
On Tue, 2015-08-25 at 18:28 +0200, Willy Tarreau wrote: On Tue, Aug 25, 2015 at 05:27:59PM +0200, Thierry FOURNIER wrote: Hello, Thank you for the bug repport. It is fixed in the current developpment version. You must compile from sources or wait for the next dev release. Actually,

Re: Pop / Imap Haproxy

2015-08-25 Thread joris dedieu
2015-06-19 23:21 GMT+02:00 Nathan Neulinger nn...@neulinger.org: You can use the 'proxy protocol' - but you will have to insure that your target pop/imap daemons are aware of it. dovecot has preliminary proxy protocol support http://hg.dovecot.org/dovecot-2.2/rev/4d7a83ddb644 It's not

Re: Next dev version?

2015-08-25 Thread Willy Tarreau
Hi Pavlos, On Mon, Aug 24, 2015 at 02:00:18PM +0200, Pavlos Parissis wrote: Do you think the next release will be *ready* to be used in production environment which can *afford* some level of outages/breakages ? Over the years developing and maintaining haproxy, I learned that *any* software

Re: [PATCH] DOC: mention support for RFC 5077 TLS Ticket extension in starter guide

2015-08-25 Thread Willy Tarreau
On Mon, Aug 24, 2015 at 01:43:54PM +0200, Pavlos Parissis wrote: Hi, Please consider applying the attached patch. Applied, thank you Pavlos. Willy

Re: Next dev version?

2015-08-25 Thread Pavlos Parissis
On 25/08/2015 11:52 πμ, Willy Tarreau wrote: Hi Pavlos, On Mon, Aug 24, 2015 at 02:00:18PM +0200, Pavlos Parissis wrote: Do you think the next release will be *ready* to be used in production environment which can *afford* some level of outages/breakages ? Over the years developing and

Re: [PATCH] DOC: mention support for RFC 5077 TLS Ticket extension in starter guide

2015-08-25 Thread Pavlos Parissis
On 25/08/2015 11:21 πμ, Willy Tarreau wrote: On Mon, Aug 24, 2015 at 01:43:54PM +0200, Pavlos Parissis wrote: Hi, Please consider applying the attached patch. Applied, thank you Pavlos. Willy Thanks for this awesome(missing) document. BTW, will it be available in HTML format as the

Re: Haproxy core utilization

2015-08-25 Thread Thierry
Hi, The last stable version is 1.5.13, try to update your version. The delta between 1.5.9 and 1.5.13 is about 200 bugfix :) One of the fix is: BUG/MAJOR: session: revert all the crappy client-side timeout changes This is the 3rd regression caused by the changes below. The latest

Re: HTTP CONNECT request returns 4XX

2015-08-25 Thread thierry . fournier
Hi, Its possible with the Socket Lua object. The high level directives ares: - create a tcp frontend - create an hook with tcp-request content lua - in the lua, you read the first line with the Channel object (txn.req:read()) - establish the SSL conenction with Socket like this: socket =