[PATCH 00/12] Peers SSL/TSL support

From: Frédéric Lécaille Hi ML, Willy, Here is a new series of patches for this feature with Willy's remarks taken into an account. Was easy to break something ;) but I think this series does not break the current usage of "peers" section. I prefered work from the previous series without

[PATCH 02/12] CLEANUP: cfgparse: Return asap from cfg_parse_peers().

From: Frédéric Lécaille Avoid useless code indentation. May be backported to 1.5 and newer. --- src/cfgparse.c | 6 -- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/cfgparse.c b/src/cfgparse.c index 6fde7c9f..6670a861 100644 --- a/src/cfgparse.c +++ b/src/cfgparse.c @@

[PATCH 10/12] MINOR: cfgparse: peers: Be less confusing.

From: Frédéric Lécaille Make "bind" line also parse the local peer bind address. Add "default-bind" option to parse the binding options excepted the bind address. Prevent "bind" lines to be mixed with "peer" line to help in handling the migration. --- src/cfgparse.c | 153

[PATCH 09/12] MINOR: cfgparse: SSL/TLS binding in "peers" sections.

From: Frédéric Lécaille This patch makes "bind" work in "peers" sections. All "bind" settings are supported, excepted ip:port parameters which are provided on "peer" (or server) line matching the local peer. After having parsed the configuration files ->prepare_bind_conf is run to initialize all

[PATCH 05/12] MINOR: cfgparse: Rework peers frontend init.

From: Frédéric Lécaille Even if not already the case, we suppose that the frontend "peers" section may have been already initialized outside of "peer" line, we seperate their initializations from their binding initializations. May be backported to 1.5 and newer. --- src/cfgparse.c | 50

[PATCH 12/12] DOC: peers: SSL/TLS documentation for "peers"

From: Frédéric Lécaille --- doc/configuration.txt | 40 +++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/doc/configuration.txt b/doc/configuration.txt index 888515fb..960f1948 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@

[PATCH 03/12] CLEANUP: cfgparse: Code reindentation.

From: Frédéric Lécaille May help the series of patches to be reviewed. May be backported to 1.5 and newer. --- src/cfgparse.c | 72 +- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/src/cfgparse.c b/src/cfgparse.c index

[PATCH 06/12] MINOR: cfgparse: Simplication.

From: Frédéric Lécaille Make init_peers_frontend() be callable without having to check if there is something to do or not. May be backported to 1.5 and newer. --- src/cfgparse.c | 7 +-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/cfgparse.c b/src/cfgparse.c index

[PATCH 04/12] MINOR: cfgparse: Useless frontend initialization in "peers" sections.

From: Frédéric Lécaille Use ->local "peers" struct member to flag a "peers" section frontend has being initialized. This is to be able to initialize the frontend of "peers" sections on lines different from "peer" lines. May be backported to 1.5 and newer. --- src/cfgparse.c | 17

[PATCH 11/12] MINOR: peers: Less confusing peer binding parsing.

From: Frédéric Lécaille With this patch the "server" lines do not parse anymore the bind address for local peers. We do not use anymore list_for_each_entry() to set the "peers" section listeners parameter because there is only one listener by "peers" section. --- include/proto/server.h | 2 +-

[PATCH 08/12] MINOR: peers: Make outgoing connection to SSL/TLS peers work.

From: Frédéric Lécaille This patch adds pointer to a struct server to peer structure which is initialized after having parsed a remote "peer" line. After having parsed all peers section we run ->prepare_srv to initialize all SSL/TLS stuff of remote perr (or server). Remaining thing to do to

[PATCH 01/12] MINOR: cfgparse: Extract some code to be re-used.

From: Frédéric Lécaille Create init_peers_frontend() function to allocate and initialize the frontend of "peers" sections (->peers_fe) so that to reuse it later. May be backported to 1.5 and newer. --- src/cfgparse.c | 34 ++ 1 file changed, 26 insertions(+), 8

[PATCH 07/12] MINOR: cfgparse: Make "peer" lines be parsed as "server" lines.

From: Frédéric Lécaille With this patch "default-server" lines are supported in "peers" sections to setup the default settings of peers which are from now setup when parsing both "peer" and "server" lines. May be backported to 1.5 and newer. --- src/cfgparse.c | 88

Re: stats webpage crash, htx and scope filter, [PATCH] REGTEST is included

Le 15/01/2019 à 21:07, PiBa-NL a écrit : Hi Christopher, Op 15-1-2019 om 10:48 schreef Christopher Faulet: Le 14/01/2019 à 21:53, PiBa-NL a écrit : Hi Christopher, Op 14-1-2019 om 11:17 schreef Christopher Faulet: Le 12/01/2019 à 23:23, PiBa-NL a écrit : Hi List, I've configured haproxy

[PATCH] Buffer API changes for 51d.c

Hi Willy, It appears that 51.d still uses some elements of the the now deprecated buffer API, so I have attached a patch which updates the usage to the new buffer API. This can also be backported to 1.9 where the new API was introduced. Thanks, Ben Shillito Developer

Re: stats webpage crash, htx and scope filter, [PATCH] REGTEST is included

On Wed, Jan 16, 2019 at 02:28:56PM +0100, Christopher Faulet wrote: > Rah ! I'll probably need some rest. I've done my tests without the HTX > enabled... It's a bit embarrassing and not really responsible. Let's say it's due to uncaught -EKIDSAROUND :-) > Anyway, here is a new patch, again.

Re: Browser downloads failing because of h2c_send_goaway_error (1.8.17 + 1.9.1)

Hi, On Wed, Jan 16, 2019 at 10:32:00AM +0300, Wert wrote: > How to reproduce: > 1. Start browser-download (content-disposition: attachment) of some big file > through H2 > * Tested with 1Gb file and several Chrome-versions (67-) > 2. Make reload > 3. Process with this connection would stay,

RE: [PATCH] Buffer API changes for 51d.c

Hi Willy, Great, thanks for the quick turnaround. Regards, Ben Shillito Developer O: +44 1183 287152 E: b...@51degrees.com T: @51Degrees -Original Message- From: Willy Tarreau [mailto:w...@1wt.eu] Sent: 16 January 2019 16:27 To: Ben Shillito Cc: haproxy@formilux.org Subject: Re:

Re: HTTP version log format for http2

Hi Willy, Thanks for the workaround and explanation. Works as expected. Sincerely, Amin Shayan On Wed, Jan 16, 2019 at 6:15 PM Willy Tarreau wrote: > Hi Amin, > > On Mon, Dec 31, 2018 at 05:23:17PM +0100, Amin Shayan wrote: > > Hi guys, > > > > I'm trying to get clients request http version

Re: Not enough timeout for socket transfer (completely broken after reload)

Hi, On Wed, Jan 16, 2019 at 11:24:58AM +0300, Wert wrote: > Problem: > Sometimes in multi-process configuration might appear error "Failed to get > the number of sockets to be transferred !" during reload. > Than new instance would silently fail like 50-80% of new connections. > > > Reason: >

[ANNOUNCE] haproxy-1.9.2

Hi, HAProxy 1.9.2 was released on 2019/01/16. It added 58 new commits after version 1.9.1. It addresses a number of lower importance pending issues that were not yet merged into 1.9.1, one bug in the cache and fixes some long-standing limitations that were affecting H2. The highest severity

Re: How to replicate RedirectMatch (apache reverse proxy) in Haproxy

Hi. Am 16.01.2019 um 16:35 schrieb mirko stefanelli: > Hi to all, > > we are trying to move from Apache reverse proxy to Haproxy, you can see below > a > part of del file Apache httpd.conf: > > >  ServerName dipendenti.xxx.xxx.it >  ErrorLog logs/intranet_ssl_error_log >  TransferLog

How to replicate RedirectMatch (apache reverse proxy) in Haproxy

Hi to all, we are trying to move from Apache reverse proxy to Haproxy, you can see below a part of del file Apache httpd.conf: ServerName dipendenti.xxx.xxx.it ErrorLog logs/intranet_ssl_error_log TransferLog logs/intranet_ssl_access_log LogLevel info ProxyRequests Off

Re: [PATCH] Buffer API changes for 51d.c

Hi Ben, On Wed, Jan 16, 2019 at 11:43:03AM +, Ben Shillito wrote: > Hi Willy, > > It appears that 51.d still uses some elements of the the now deprecated > buffer API, so I have attached a patch which updates the usage to the new > buffer API. > > This can also be backported to 1.9 where

Re: HTTP version log format for http2

Hi Amin, On Mon, Dec 31, 2018 at 05:23:17PM +0100, Amin Shayan wrote: > Hi guys, > > I'm trying to get clients request http version and it seems %HV which is > the last field of %r works fine for http/0.9,1.0,1.1. However I get > http/1.1 on logs for http2 requests. > > Using HAProxy 1.8.16, Is

Re: stats webpage crash, htx and scope filter, [PATCH] REGTEST is included

Hi Pieter, On Wed, Jan 16, 2019 at 08:44:58PM +0100, PiBa-NL wrote: > Hi Willy, Christopher, > Op 16-1-2019 om 17:32 schreef Willy Tarreau: > > On Wed, Jan 16, 2019 at 02:28:56PM +0100, Christopher Faulet wrote: > > > here is a new patch, again. Willy, I hope it will be good for the > > > release

Re: [ANNOUNCE] haproxy-1.9.2

Hi. Am 16.01.2019 um 19:02 schrieb Willy Tarreau: > Hi, > > HAProxy 1.9.2 was released on 2019/01/16. It added 58 new commits > after version 1.9.1. > > It addresses a number of lower importance pending issues that were not > yet merged into 1.9.1, one bug in the cache and fixes some

Re: stats webpage crash, htx and scope filter, [PATCH] REGTEST is included

Hi Willy, Christopher, Op 16-1-2019 om 17:32 schreef Willy Tarreau: On Wed, Jan 16, 2019 at 02:28:56PM +0100, Christopher Faulet wrote: here is a new patch, again. Willy, I hope it will be good for the release 1.9.2. This one works :). OK so I've mergd it now, thank you! Willy Op 14-1-2019

Re: [ANNOUNCE] haproxy-1.9.2

Hi Aleks, On Wed, Jan 16, 2019 at 11:52:12PM +0100, Aleksandar Lazic wrote: > For service routing are the standard haproxy content routing options possible > (path, header, ...) , right? Yes absolutely. > If someone want to route based on grpc content he can use lua with body > content >

Re: Seamless reloads: file descriptors utilization in LUA

> CC'ing Thierry: as this has come on this discourse, can we have your > opinion about the FD's in LUA and howto best handle ulimit? > Apologies for the duplicate mail. > Thanks, > Lukas 1. FD I don't know your architecture too much. From user-side I just see no reasons to keep FD that

Not enough timeout for socket transfer (completely broken after reload)

Problem: Sometimes in multi-process configuration might appear error "Failed to get the number of sockets to be transferred !" during reload. Than new instance would silently fail like 50-80% of new connections. Reason: There is hard-coded timeout in get_old_sockets() - 1 second. It is used for

Re: Get client IP

Hi. Am 16.01.2019 um 06:43 schrieb Vũ Xuân Học: > Dear, > > I fixed it. I use { src x.x.x.x ... } in use_backend and it worked. > > Many thanks, Great ;-). How about the origin issue with the ssl, how is the solution now? Best regards Aleks > -Original Message- > From: Vũ Xuân Học