Hi,

HAProxy 1.7-dev2 was released on 2016/03/14. It added 172 new commits
after version 1.7-dev1.

There are quite some news in this version, which is expected after almost
3 months. This time all maintained versions were released (down to 1.3),
don't be surprized I'm copy-pasting some parts of the relevant changes in
each announce e-mail.

First, a handful of severe bugs were fixed and some of them also affect
older versions. One could cause a server's port to be overwritten upon
reload when both the DNS and server-state-file are used. Another one
could cause some connections to freeze and remain orphaned when an idle
timeout stroke during http-reuse. It was more visible with maxconn. This
bug was reported by Yves Lafon who provided lots of useful dumps and tried
debugging code to help figure what was happening, so many thanks for this!
Thierry fixed two major Lua bugs, one causing a segfault and another one
preventing an applet from being woken up. Baptiste found that using L7
sample fetches in "tcp-request connection" rulesets would cause a nice
segfault. It was even broader than that, any L5-7 fetch there can cause
this, except the few that still had the double check. 1.6 is also affected,
so the lack of prior report simply means that people now write clean
configurations and get rid of warnings! Finally, the variables could also
crash the process if improperly used (eg: using session variables at the
connection level). Last, I remember there were several people reporting
the systemd-wrapper was leaving some processes behind. I found a few race
conditions that I fixed. I hope it will be enough. The remaining bugs are
numerous but not critical, see the changelog.

The most visible change to developers is the introduction of "filters"
by Christopher Faulet. The principle is to place some hooks around the
existing analysers and at a few extra places to call various content
processing functions. This adds a lot of flexibility to the processing
and the first immediate gain is the move of the compression code out of
the HTTP forwarding engine, which made it possible to factor out the
request and response parsers (which were almost identical except for
the compression). It also improved the compression performance a little
bit. Another short-term benefit I'm seeing is that the traffic shaping
I've been wanting to implement for many years will now be quite easy to
implement using filters (it could even be done as an exercise). I'm
seeing this as a first step towards a big simplification of the stream
processor to possibly remove a number of the static analysers and only
add them when needed. But that's another difficult change, so one thing
at a time please :-)

Another big change (but quite confined) concerns the stats. I've been
irritated for a long time by the difficulty to add new output fields to
the CSV dump and to see people parsing the HTML to get extra information.
So I attacked the problem by fixing me as a goal that the HTML dump would
only use the data available to the CSV and should not lose any information.
It was painful but it's now the case. That made it much easier to create
new fields and in the end we have many more data. And since by that time,
Thierry was working on a stats aggregator, it occurred to me that the CSV
format is not enough to aggregate stats between multiple processes, so I
introduced a new output called "typed output format" which provides the
type of each field as well as a series of qualifiers to know the nature,
origin and scope of the information so that an aggragator knows how to
aggregate fields it doesn't know about (eg: you don't aggregate a limit,
a max, an uptime, a weight or a request rate similarly). I ensured it is
now easy to add new fields and hard to emit HTML output without passing
via these fields so there are chances that we won't miss anything anymore
in the machine-readable output. It also means that people can start to
look at the HTML generator and suggest improvements without having to
have deep understanding of the internals, or even provide other backends
to feed other types of interfaces.

We recently had the opportunity to feel the pain systemd users are
forced to live with. This thing doesn't even make it possible to use
environment variables for a reload since it doesn't expect a new process
to be started for a reload... So users believe updated variables have
been used while they were just silently ignored. Just another product
designed under a shower without any consideration for the real life :-/

So the only solution that was left to us was to make it possible to
define environment variables from within haproxy itself. Yes it sounds
stupid, but we have to be more stupid than the "service manager" below
us to continue to operate sanely. So now in the global section it is
possible to set/preset/unset environment variables. And since it is
possible to have multiple global sections, it's perfectly possible to
have all haproxy environment variables in a specific file (eg: global.env)
and the rest in other files. A reload will properly consider any possible
change as it used to do before systemd. The only difference is that you'd
rather not mix the two usages. An in order to ease debugging, a dump of
environment variables is provided on the CLI (show env).

I've seen a number of Lua updates, Thierry regularly adds whatever he
misses when he writes code, so at one point we may see haproxy
reimplemented in Lua and running inside itself :-)

And there were a number of small updates at many places that are clear
enough in the changelog below.

I'll update the web site ASAP.

Please find the usual URLs below :
Site index : http://www.haproxy.org/
Discourse : http://discourse.haproxy.org/
Sources : http://www.haproxy.org/download/1.7/src/
Git repository : http://git.haproxy.org/git/haproxy.git/
Git Web browsing : http://git.haproxy.org/?p=haproxy.git
Changelog : http://www.haproxy.org/download/1.7/src/CHANGELOG
Cyril's HTML doc : http://cbonte.github.io/haproxy-dconv/

Willy
---
Complete changelog :
- DOC: lua: fix lua API
- DOC: mailers: typo in 'hostname' description
- DOC: compression: missing mention of libslz for compression algorithm
- BUILD/MINOR: regex: missing header
- BUG/MINOR: stream: bad return code
- DOC: lua: fix somme errors and add implicit types
- MINOR: lua: add set/get priv for applets
- BUG/MINOR: http: fix several off-by-one errors in the url_param parser
- BUG/MINOR: http: Be sure to process all the data received from a server
- MINOR: filters/http: Use a wrapper function instead of stream_int_retnclose
- BUG/MINOR: chunk: make chunk_dup() always check and set dst->size
- DOC: ssl: fixed some formatting errors in crt tag
- MINOR: chunks: ensure that chunk_strcpy() adds a trailing zero
- MINOR: chunks: add chunk_strcat() and chunk_newstr()
- MINOR: chunk: make chunk_initstr() take a const string
- MEDIUM: tools: add csv_enc_append() to preserve the original chunk
- MINOR: tools: make csv_enc_append() always start at the first byte of the chunk
- MINOR: lru: new function to delete <nb> least recently used keys
- DOC: add Ben Shillito as the maintainer of 51d
- BUG/MINOR: 51d: Ensures a unique domain for each configuration
- BUG/MINOR: 51d: Aligns Pattern cache implementation with HAProxy best practices.
- BUG/MINOR: 51d: Releases workset back to pool.
- BUG/MINOR: 51d: Aligned const pointers to changes in 51Degrees.
- CLEANUP: 51d: Aligned if statements with HAProxy best practices and removed casts from malloc.
- MINOR: rename master process name in -Ds (systemd mode)
- DOC: fix a few spelling mistakes
- DOC: fix "workaround" spelling
- BUG/MINOR: examples: Fixing haproxy.spec to remove references to .cfg files
- MINOR: fix the return type for dns_response_get_query_id() function
- MINOR: server state: missing LF (\n) on error message printed when parsing server state file
- BUG/MEDIUM: dns: no DNS resolution happens if no ports provided to the nameserver
- BUG/MAJOR: servers state: server port is erased when dns resolution is enabled on a server
- BUG/MEDIUM: servers state: server port is used uninitialized
- BUG/MEDIUM: config: Adding validation to stick-table expire value.
- BUG/MEDIUM: sample: http_date() doesn't provide the right day of the week
- BUG/MEDIUM: channel: fix miscalculation of available buffer space.
- MEDIUM: pools: add a new flag to avoid rounding pool size up
- BUG/MEDIUM: buffers: do not round up buffer size during allocation
- BUG/MINOR: stream: don't force retries if the server is DOWN
- BUG/MINOR: counters: make the sc-inc-gpc0 and sc-set-gpt0 touch the table
- MINOR: unix: don't mention free ports on EAGAIN
- BUG/CLEANUP: CLI: report the proper field states in "show sess"
- MINOR: stats: send content-length with the redirect to allow keep-alive
- BUG: stream_interface: Reuse connection even if the output channel is empty
- DOC: remove old tunnel mode assumptions
- BUG/MAJOR: http-reuse: fix risk of orphaned connections
- BUG/MEDIUM: http-reuse: do not share private connections across backends
- BUG/MINOR: ssl: Be sure to use unique serial for regenerated certificates
- BUG/MINOR: stats: fix missing comma in stats on agent drain
- MAJOR: filters: Add filters support
- MINOR: filters: Do not reset stream analyzers if the client is gone
- REORG: filters: Prepare creation of the HTTP compression filter
- MAJOR: filters/http: Rewrite the HTTP compression as a filter
- MEDIUM: filters: Use macros to call filters callbacks to speed-up processing
- MEDIUM: filters: remove http_start_chunk, http_last_chunk and http_chunk_end
- MEDIUM: filters: Replace filter_http_headers callback by an analyzer
- MEDIUM: filters/http: Move body parsing of HTTP messages in dedicated functions
- MINOR: filters: Add stream_filters structure to hide filters info
- MAJOR: filters: Require explicit registration to filter HTTP body and TCP data
- MINOR: filters: Remove unused or useless stuff and do small optimizations
- MEDIUM: filters: Optimize the HTTP compression for chunk encoded response
- MINOR: filters/http: Slightly update the parsing of chunks
- MINOR: filters/http: Forward remaining data when a channel has no "data" filters
- MINOR: filters: Add an filter example
- MINOR: filters: Extract proxy stuff from the struct filter
- MINOR: map: Add regex matching replacement
- BUG/MINOR: lua: unsafe initialization
- DOC: lua: fix somme errors
- MINOR: lua: file dedicated to unsafe functions
- MINOR: lua: add "now" time function
- MINOR: standard: add RFC HTTP date parser
- MINOR: lua: Add date functions
- MINOR: lua: move common function
- MINOR: lua: merge function
- MINOR: lua: Add concat class
- MINOR: standard: add function "escape_chunk"
- MEDIUM: log: add a new log format flag "E"
- DOC: add server name at rate-limit sessions example
- BUG/MEDIUM: ssl: fix off-by-one in ALPN list allocation
- BUG/MEDIUM: ssl: fix off-by-one in NPN list allocation
- DOC: LUA: fix some typos and syntax errors
- MINOR: cli: add a new "show env" command
- MEDIUM: config: allow to manipulate environment variables in the global section
- MEDIUM: cfgparse: reject incorrect 'timeout retry' keyword spelling in resolvers
- MINOR: mailers: increase default timeout to 10 seconds
- MINOR: mailers: use <CRLF> for all line endings
- BUG/MAJOR: lua: segfault using Concat object
- DOC: lua: copyrights
- MINOR: common: mask conversion
- MEDIUM: dns: extract options
- MEDIUM: dns: add a "resolve-net" option which allow to prefer an ip in a network
- MINOR: mailers: make it possible to configure the connection timeout
- BUG/MAJOR: lua: applets can't sleep.
- BUG/MINOR: server: some prototypes are renamed
- BUG/MINOR: lua: Useless copy
- BUG/MEDIUM: stats: stats bind-process doesn't propagate the process mask correctly
- BUG/MINOR: server: fix the format of the warning on address change
- CLEANUP: server: add "const" to some message strings
- MINOR: server: generalize the "updater" source
- BUG/MEDIUM: chunks: always reject negative-length chunks
- BUG/MINOR: systemd: ensure we don't miss signals
- BUG/MINOR: systemd: report the correct signal in debug message output
- BUG/MINOR: systemd: propagate the correct signal to haproxy
- MINOR: systemd: ensure a reload doesn't mask a stop
- BUG/MEDIUM: cfgparse: wrong argument offset after parsing server "sni" keyword
- CLEANUP: stats: Avoid computation with uninitialized bits.
- CLEANUP: pattern: Ignore unknown samples in pat_match_ip().
- CLEANUP: map: Avoid memory leak in out-of-memory condition.
- BUG/MINOR: tcpcheck: fix incorrect list usage resulting in failure to load certain configs
- BUG/MAJOR: samples: check smp->strm before using it
- MINOR: sample: add a new helper to initialize the owner of a sample
- MINOR: sample: always set a new sample's owner before evaluating it
- BUG/MAJOR: vars: always retrieve the stream and session from the sample
- CLEANUP: payload: remove useless and confusing nullity checks for channel buffer
- BUG/MINOR: ssl: fix usage of the various sample fetch functions
- MINOR: stats: create fields types suitable for all CSV output data
- MINOR: stats: add all the "show info" fields in a table
- MEDIUM: stats: fill all the show info elements prior to displaying them
- MINOR: stats: add a function to emit fields into a chunk
- MINOR: stats: add stats_dump_info_fields() to dump one field per line
- MEDIUM: stats: make use of stats_dump_info_fields() for "show info"
- MINOR: stats: add a declaration of all stats fields
- MINOR: stats: don't hard-code the CSV fields list anymore
- MINOR: stats: create stats fields storage and CSV dump function
- MEDIUM: stats: convert stats_dump_fe_stats() to use stats_dump_fields_csv()
- MEDIUM: stats: make stats_dump_fe_stats() use stats fields for HTML dump
- MEDIUM: stats: convert stats_dump_li_stats() to use stats_dump_fields_csv()
- MEDIUM: stats: make stats_dump_li_stats() use stats fields for HTML dump
- MEDIUM: stats: convert stats_dump_be_stats() to use stats_dump_fields_csv()
- MEDIUM: stats: make stats_dump_be_stats() use stats fields for HTML dump
- MEDIUM: stats: convert stats_dump_sv_stats() to use stats_dump_fields_csv()
- MEDIUM: stats: make stats_dump_sv_stats() use the stats field for HTML
- MEDIUM: stats: move the server state coloring logic to the server dump function
- MINOR: stats: do not use srv->admin & STATS_ADMF_MAINT in HTML dumps
- MINOR: stats: do not check srv->state for SRV_ST_STOPPED in HTML dumps
- MINOR: stats: make CSV report server check status only when enabled
- MINOR: stats: only report backend's down time if it has servers
- MINOR: stats: prepend '*' in front of the check status when in progress
- MINOR: stats: make HTML stats dump rely on the table for the check status
- MINOR: stats: add agent_status, agent_code, agent_duration to output
- MINOR: stats: add check_desc and agent_desc to the output fields
- MINOR: stats: add check and agent's health values in the output
- MEDIUM: stats: make the HTML server state dump use the CSV states
- MEDIUM: stats: only report observe errors when observe is set
- MEDIUM: stats: expose the same flags for CLI and HTTP accesses
- MEDIUM: stats: report server's address in the CSV output
- MEDIUM: stats: report the cookie value in the server & backend CSV dumps
- MEDIUM: stats: compute the color code only in the HTML form
- MEDIUM: stats: report the listeners' address in the CSV output
- MEDIUM: stats: make it possible to report the WAITING state for listeners
- REORG: stats: dump the frontend's HTML stats via a generic function
- REORG: stats: dump the socket stats via the generic function
- REORG: stats: dump the server stats via the generic function
- REORG: stats: dump the backend stats via the generic function
- MEDIUM: stats: add a new "mode" column to report the proxy mode
- MINOR: stats: report the load balancing algorithm in CSV output
- MINOR: stats: add 3 fields to report the frontend-specific connection stats
- MINOR: stats: report number of intercepted requests for frontend and backends
- MINOR: stats: introduce stats_dump_one_line() to dump one stats line
- CLEANUP: stats: make stats_dump_fields_html() not rely on proxy anymore
- MINOR: stats: add ST_SHOWADMIN to pass the admin info in the regular flags
- MINOR: stats: make stats_dump_fields_html() not use &trash by default
- MINOR: stats: add functions to emit typed fields into a chunk
- MEDIUM: stats: support "show info typed" on the CLI
- MEDIUM: stats: implement a typed output format for stats
- DOC: document the "show info typed" and "show stat typed" output formats
- MINOR: cfgparse: warn when uid parameter is not a number
- MINOR: cfgparse: warn when gid parameter is not a number
- BUG/MINOR: standard: Avoid free of non-allocated pointer
- BUG/MINOR: pattern: Avoid memory leak on out-of-memory condition
- CLEANUP: http: fix a build warning introduced by a recent fix
- BUG/MINOR: log: GMT offset not updated when entering/leaving DST
---

Hi,

HAProxy 1.6.4 was released on 2016/03/14. It added 73 new commits
after version 1.6.3.

First, a handful of severe bugs were fixed and some of them also affect
older versions. One could cause a server's port to be overwritten upon
reload when both the DNS and server-state-file are used. Another one
could cause some connections to freeze and remain orphaned when an idle
timeout stroke during http-reuse. It was more visible with maxconn. This
bug was reported by Yves Lafon who provided lots of useful dumps and tried
debugging code to help figure what was happening, so many thanks for this!
Thierry fixed a major Lua bug preventing an applet from being woken up.
Baptiste found that using L7 sample fetches in "tcp-request connection"
rulesets would cause a nice segfault. It was even broader than that, any
L5-7 fetch there can cause this, except the few that still had the double
check. Finally, the variables could also crash the process if improperly
used (eg: using session variables at the connection level). Last, I remember
there were several people reporting the systemd-wrapper was leaving some
processes behind. I found a few race conditions that I fixed. I hope it
will be enough. The remaining bugs are numerous but not critical, see the
changelog.

While not a bug, the default mailer timeout change was backported from 1.7
to ensure more reliable operation (changed to 10 seconds), as well as the
change disabling the connection retry on a server already marked down, and
the content-length header that's now added in the stats response to avoid
a risk of truncated responses and permit client-side keep-alive. The other
changes are just here to support the respective fixes.

Please find the usual URLs below :
Site index : http://www.haproxy.org/
Discourse : http://discourse.haproxy.org/
Sources : http://www.haproxy.org/download/1.6/src/
Git repository : http://git.haproxy.org/git/haproxy-1.6.git/
Git Web browsing : http://git.haproxy.org/?p=haproxy-1.6.git
Changelog : http://www.haproxy.org/download/1.6/src/CHANGELOG
Cyril's HTML doc : http://cbonte.github.io/haproxy-dconv/

Willy
---
Complete changelog :
- BUG/MINOR: http: fix several off-by-one errors in the url_param parser
- BUG/MINOR: http: Be sure to process all the data received from a server
- BUG/MINOR: chunk: make chunk_dup() always check and set dst->size
- MINOR: chunks: ensure that chunk_strcpy() adds a trailing zero
- MINOR: chunks: add chunk_strcat() and chunk_newstr()
- MINOR: chunk: make chunk_initstr() take a const string
- MINOR: lru: new function to delete <nb> least recently used keys
- DOC: add Ben Shillito as the maintainer of 51d
- BUG/MINOR: 51d: Ensures a unique domain for each configuration
- BUG/MINOR: 51d: Aligns Pattern cache implementation with HAProxy best practices.
- BUG/MINOR: 51d: Releases workset back to pool.
- BUG/MINOR: 51d: Aligned const pointers to changes in 51Degrees.
- CLEANUP: 51d: Aligned if statements with HAProxy best practices and removed casts from malloc.
- DOC: fix a few spelling mistakes (cherry picked from commit cc123c66c2075add8524a6a9925382927daa6ab0)
- DOC: fix "workaround" spelling
- BUG/MINOR: examples: Fixing haproxy.spec to remove references to .cfg files
- MINOR: fix the return type for dns_response_get_query_id() function
- MINOR: server state: missing LF (\n) on error message printed when parsing server state file
- BUG/MEDIUM: dns: no DNS resolution happens if no ports provided to the nameserver
- BUG/MAJOR: servers state: server port is erased when dns resolution is enabled on a server
- BUG/MEDIUM: servers state: server port is used uninitialized
- BUG/MEDIUM: config: Adding validation to stick-table expire value.
- BUG/MEDIUM: sample: http_date() doesn't provide the right day of the week
- BUG/MEDIUM: channel: fix miscalculation of available buffer space.
- MEDIUM: pools: add a new flag to avoid rounding pool size up
- BUG/MEDIUM: buffers: do not round up buffer size during allocation
- BUG/MINOR: stream: don't force retries if the server is DOWN
- BUG/MINOR: counters: make the sc-inc-gpc0 and sc-set-gpt0 touch the table
- MINOR: unix: don't mention free ports on EAGAIN
- BUG/CLEANUP: CLI: report the proper field states in "show sess"
- MINOR: stats: send content-length with the redirect to allow keep-alive
- BUG: stream_interface: Reuse connection even if the output channel is empty
- DOC: remove old tunnel mode assumptions
- BUG/MAJOR: http-reuse: fix risk of orphaned connections
- BUG/MEDIUM: http-reuse: do not share private connections across backends
- BUG/MINOR: ssl: Be sure to use unique serial for regenerated certificates
- BUG/MINOR: stats: fix missing comma in stats on agent drain
- BUG/MINOR: lua: unsafe initialization
- DOC: lua: fix somme errors
- DOC: add server name at rate-limit sessions example
- BUG/MEDIUM: ssl: fix off-by-one in ALPN list allocation
- BUG/MEDIUM: ssl: fix off-by-one in NPN list allocation
- DOC: LUA: fix some typos and syntax errors
- MINOR: cfgparse: warn for incorrect 'timeout retry' keyword spelling in resolvers
- MINOR: mailers: increase default timeout to 10 seconds
- MINOR: mailers: use <CRLF> for all line endings
- BUG/MAJOR: lua: applets can't sleep.
- BUG/MINOR: server: some prototypes are renamed
- BUG/MINOR: lua: Useless copy
- BUG/MEDIUM: stats: stats bind-process doesn't propagate the process mask correctly
- BUG/MINOR: server: fix the format of the warning on address change
- BUG/MEDIUM: chunks: always reject negative-length chunks
- BUG/MINOR: systemd: ensure we don't miss signals
- BUG/MINOR: systemd: report the correct signal in debug message output
- BUG/MINOR: systemd: propagate the correct signal to haproxy
- MINOR: systemd: ensure a reload doesn't mask a stop
- BUG/MEDIUM: cfgparse: wrong argument offset after parsing server "sni" keyword
- CLEANUP: stats: Avoid computation with uninitialized bits.
- CLEANUP: pattern: Ignore unknown samples in pat_match_ip().
- CLEANUP: map: Avoid memory leak in out-of-memory condition.
- BUG/MINOR: tcpcheck: fix incorrect list usage resulting in failure to load certain configs
- BUG/MAJOR: samples: check smp->strm before using it
- MINOR: sample: add a new helper to initialize the owner of a sample
- MINOR: sample: always set a new sample's owner before evaluating it
- BUG/MAJOR: vars: always retrieve the stream and session from the sample
- CLEANUP: payload: remove useless and confusing nullity checks for channel buffer
- BUG/MINOR: ssl: fix usage of the various sample fetch functions
- MINOR: cfgparse: warn when uid parameter is not a number
- MINOR: cfgparse: warn when gid parameter is not a number
- BUG/MINOR: standard: Avoid free of non-allocated pointer
- BUG/MINOR: pattern: Avoid memory leak on out-of-memory condition
- CLEANUP: http: fix a build warning introduced by a recent fix
- BUG/MINOR: log: GMT offset not updated when entering/leaving DST
---

Hi,

HAProxy 1.5.16 was released on 2016/03/14. It added 47 new commits
after version 1.5.15.

There's nothing really outstanding here. The main visible fix probably
is the one for a bug occasionally causing some missed timeout events
on a connection with a pending close. This results in a busy poll loop
until the timeout expires again. A lot of detailed information was
provided by BaiYang which was critical in helping understanding the
problem. A related issue is that some keep-alive requests can face a
shutdown if the server closed during the idle timeout. Browsers normally
don't notice this, but download tools or web services do. The remaining
bugs are not very important, please see the changelog.

Please find the usual URLs below :
Site index : http://www.haproxy.org/
Discourse : http://discourse.haproxy.org/
Sources : http://www.haproxy.org/download/1.5/src/
Git repository : http://git.haproxy.org/git/haproxy-1.5.git/
Git Web browsing : http://git.haproxy.org/?p=haproxy-1.5.git
Changelog : http://www.haproxy.org/download/1.5/src/CHANGELOG
Cyril's HTML doc : http://cbonte.github.io/haproxy-dconv/

Willy
---
Complete changelog :
- BUG/BUILD: replace haproxy-systemd-wrapper with $(EXTRA) in install-bin.
- BUG/MINOR: acl: don't use record layer in req_ssl_ver
- BUG: http: do not abort keep-alive connections on server timeout
- BUG/MEDIUM: http: switch the request channel to no-delay once done.
- MINOR: config: extend the default max hostname length to 64 and beyond
- BUG/MEDIUM: http: don't enable auto-close on the response side
- BUG/MEDIUM: stream: fix half-closed timeout handling
- BUG/MEDIUM: cli: changing compression rate-limiting must require admin level
- BUILD: freebsd: double declaration
- BUG/MEDIUM: sample: urlp can't match an empty value
- BUG/MEDIUM: peers: table entries learned from a remote are pushed to others after a random delay.
- BUG/MEDIUM: peers: old stick table updates could be repushed.
- CLEANUP: haproxy: using _GNU_SOURCE instead of __USE_GNU macro.
- BUG/MINOR: chunk: make chunk_dup() always check and set dst->size
- MINOR: chunks: ensure that chunk_strcpy() adds a trailing zero
- MINOR: chunks: add chunk_strcat() and chunk_newstr()
- MINOR: chunk: make chunk_initstr() take a const string
- BUG/MEDIUM: config: Adding validation to stick-table expire value.
- BUG/MEDIUM: sample: http_date() doesn't provide the right day of the week
- BUG/MEDIUM: channel: fix miscalculation of available buffer space.
- BUG/MINOR: stream: don't force retries if the server is DOWN
- MINOR: unix: don't mention free ports on EAGAIN
- BUG/CLEANUP: CLI: report the proper field states in "show sess"
- MINOR: stats: send content-length with the redirect to allow keep-alive
- BUG: stream_interface: Reuse connection even if the output channel is empty
- DOC: remove old tunnel mode assumptions
- DOC: add server name at rate-limit sessions example
- BUG/MEDIUM: ssl: fix off-by-one in ALPN list allocation
- BUG/MEDIUM: ssl: fix off-by-one in NPN list allocation
- BUG/MEDIUM: stats: stats bind-process doesn't propagate the process mask correctly
- BUG/MINOR: http: Be sure to process all the data received from a server
- BUG/MEDIUM: chunks: always reject negative-length chunks
- BUG/MINOR: systemd: ensure we don't miss signals
- BUG/MINOR: systemd: report the correct signal in debug message output
- BUG/MINOR: systemd: propagate the correct signal to haproxy
- MINOR: systemd: ensure a reload doesn't mask a stop
- CLEANUP: stats: Avoid computation with uninitialized bits.
- CLEANUP: pattern: Ignore unknown samples in pat_match_ip().
- CLEANUP: map: Avoid memory leak in out-of-memory condition.
- BUG/MINOR: tcpcheck: conf parsing error when no port configured on server and last rule is a CONNECT with no port
- BUG/MINOR: tcpcheck: fix incorrect list usage resulting in failure to load certain configs
- MINOR: cfgparse: warn when uid parameter is not a number
- MINOR: cfgparse: warn when gid parameter is not a number
- BUG/MINOR: standard: Avoid free of non-allocated pointer
- BUG/MINOR: pattern: Avoid memory leak on out-of-memory condition
- CLEANUP: http: fix a build warning introduced by a recent fix
- BUG/MINOR: log: GMT offset not updated when entering/leaving DST
---

Hi,

HAProxy 1.4.27 was released on 2016/03/14. It added 29 new commits
after version 1.4.26 that was released more than one year ago.

This version mainly fixes a bug causing the process to crash when
http-send-name-header is used if a number of conditions are met. The
other visible change is that some protocol security checks have been
backported to closely match the HTTP specification and limit the risk
that haproxy passes mangled requests or responses that may affect
devices vulnerable to smuggling attacks. The rest is pretty minor.

Please find the usual URLs below :
Site index : http://www.haproxy.org/
Discourse : http://discourse.haproxy.org/
Sources : http://www.haproxy.org/download/1.4/src/
Git repository : http://git.haproxy.org/git/haproxy-1.4.git/
Git Web browsing : http://git.haproxy.org/?p=haproxy-1.4.git
Changelog : http://www.haproxy.org/download/1.4/src/CHANGELOG
Cyril's HTML doc : http://cbonte.github.io/haproxy-dconv/

Willy
---
Complete changelog :
- DOC: Fix L4TOUT typo in documentation
- BUG/MEDIUM: http: remove content-length from chunked messages
- DOC: http: update the comments about the rules for determining transfer-length
- BUG/MEDIUM: http: do not restrict parsing of transfer-encoding to HTTP/1.1
- BUG/MEDIUM: http: incorrect transfer-coding in the request is a bad request
- BUG/MEDIUM: http: remove content-length form responses with bad transfer-encoding
- MEDIUM: http: restrict the HTTP version token to 1 digit as per RFC7230
- BUG/MINOR: cfgparse: fix typo in 'option httplog' error message
- DOC: usesrc root privileges requirements
- DOC: typo in 'redirect', 302 code meaning
- BUG/MINOR: http: remove stupid HTTP_METH_NONE entry
- BUG/MAJOR: http: don't call http_send_name_header() after an error
- CLEANUP: config: make the errorloc/errorfile messages less confusing
- BUG/MINOR: config: check that tune.bufsize is always positive
- BUG/MINOR: http: Add OPTIONS in supported http methods (found by find_http_meth)
- DOC: Address issue where documentation is excluded due to a gitignore rule.
- CLEANUP: .gitignore: ignore more test files
- CLEANUP: .gitignore: finally ignore everything but what is known.
- CLEANUP: don't ignore debian/ directory if present
- FIX: small typo in an example using the "Referer" header
- BUG/MEDIUM: config: count memory limits on 64 bits, not 32
- BUG/MINOR: acl: don't use record layer in req_ssl_ver
- BUG/MEDIUM: http: switch the request channel to no-delay once done.
- BUILD: freebsd: double declaration
- BUG/MINOR: chunk: make chunk_dup() always check and set dst->size
- BUG/MEDIUM: config: Adding validation to stick-table expire value.
- DOC: add server name at rate-limit sessions example
- MINOR: cfgparse: warn when uid parameter is not a number
- MINOR: cfgparse: warn when gid parameter is not a number
---

Hi,

HAProxy 1.3.28 was released on 2016/03/14. It added 15 new commits
after version 1.3.27 which was released more than one year ago.

Please note that this is the very last 1.3 release and that 1.3 is
now marked end-of-life almost 10 years after its first release.
There's nothing really interesting in this version, but since fixes
were available it was better to issue a release so that users can
benefit from them.

There is no more reason for staying on 1.3 now, bugs which will be
discovered in the future will not be fixed. If you need a rock-solid
version and don't need SSL, 1.4 represents a seamless upgrade. If you
need some time to validate a major upgrade, better spot 1.5 (1.6 still
requires frequent updates).

Please find the usual URLs below :
Site index : http://www.haproxy.org/
Discourse : http://discourse.haproxy.org/
Sources : http://www.haproxy.org/download/1.3/src/
Git repository : http://git.haproxy.org/git/haproxy-1.3.git/
Git Web browsing : http://git.haproxy.org/?p=haproxy-1.3.git
Changelog : http://www.haproxy.org/download/1.3/src/CHANGELOG
Cyril's HTML doc : http://cbonte.github.io/haproxy-dconv/

Willy
---
Complete changelog :
- DOC: usesrc root privileges requirements
- BUG/MINOR: http: remove stupid HTTP_METH_NONE entry
- BUG/MINOR: http: Add OPTIONS in supported http methods (found by find_http_meth)
- CLEANUP: config: make the errorloc/errorfile messages less confusing
- DOC: Address issue where documentation is excluded due to a gitignore rule.
- CLEANUP: .gitignore: ignore more test files
- CLEANUP: .gitignore: finally ignore everything but what is known.
- CLEANUP: don't ignore debian/ directory if present
- FIX: small typo in an example using the "Referer" header
- BUG/MEDIUM: config: count memory limits on 64 bits, not 32
- BUG/MINOR: acl: don't use record layer in req_ssl_ver
- BUILD: freebsd: double declaration
- DOC: add server name at rate-limit sessions example
- MINOR: cfgparse: warn when uid parameter is not a number
- MINOR: cfgparse: warn when gid parameter is not a number
---

Hi Benoit,

On Tue, Mar 15, 2016 at 09:21:17PM +0100, Benoît GARNIER wrote:
> +/* Return the difference in seconds between two times (leap seconds are ignored).
> + * Taken from glibc source code.
> + */

Nice to see that you never resign, you pulled out the machine gun :-)
I'll trust you as I guess you've run a number of tests. The glibc being
covered by LGPL, it should be fine in theory, except if you picked it
from an LPGLv3 version which is not compatible with GPLv2 (it requires
to upgrade to GPLv3). But since I'm seeing this code in glibc 2.18 which
is still LGPLv2.1, that's fine. You should mention the glibc version you
used to clear any doubt.

But I have two small requests below :

> +static int tm_diff(const struct tm *a, const struct tm *b)

Please don't use the same name as glibc's and in general avoid too generic
names especially when their name suggests they apply to standard types;
over time we've been used to see name clashes on various systems and/or
libs. The simplest way is to prefix them with "my_" so that we know it's a
local implementation. That's how we have my_strndup() and a few others.

> + sprintf(gmt_offset+1, "%02d%02d", (diff/60)%100, diff%60);

Please use snprintf() instead. We completely got rid of sprintf() as it
emits warnings on some platforms for being notoriously insecure and misused.

Thanks!
Willy

On Mon, Mar 14, 2016 at 09:26:21AM +0100, Baptiste wrote:
> > We as users have the opportunity choose to leave this list. It's not an ideal solution but there isn't at the moment
> > a good alternative to haproxy. So in my case I haven't to like, but I have to live with it.
>
>
> Do you mean you could switch to an other product because of an amount
> of spam on a mailling list purposely widely opened to everyone?

Yes that's the part I loved the most in this thread :-)

I have to go before shops close now, I must change my laptop because
it shows me more spams than what I used to have on my previous one,
so there must be a relation :-)

Willy

Le 15/03/2016 21:59, Willy Tarreau a écrit :
> Nice to see that you never resign, you pulled out the machine gun :-)
> I'll trust you as I guess you've run a number of tests. The glibc being
> covered by LGPL, it should be fine in theory, except if you picked it
> from an LPGLv3 version which is not compatible with GPLv2 (it requires
> to upgrade to GPLv3). But since I'm seeing this code in glibc 2.18 which
> is still LGPLv2.1, that's fine. You should mention the glibc version you
> used to clear any doubt.

I'll redo the patch with the glibc 2.18 code, but I'll need to redo all
my tests if there are any differences in the aforementioned code.

> But I have two small requests below :
>
>> +static int tm_diff(const struct tm *a, const struct tm *b)
> Please don't use the same name as glibc's and in general avoid too generic
> names especially when their name suggests they apply to standard types;
> over time we've been used to see name clashes on various systems and/or
> libs. The simplest way is to prefix them with "my_" so that we know it's a
> local implementation. That's how we have my_strndup() and a few others.

Fair enough, I'll change the name.

>> + sprintf(gmt_offset+1, "%02d%02d", (diff/60)%100, diff%60);
> Please use snprintf() instead. We completely got rid of sprintf() as it
> emits warnings on some platforms for being notoriously insecure and misused.

I was extra careful to be sure to not overwrite the receiving buffer
(thus the modulus and the sign handling), but I didn't think about the
warnings.
I'll amend the patch to use snprintf().

> Thanks!
> Willy
Benoit GARNIER

On Tue, Mar 15, 2016 at 07:09:49PM +0000, David CARLIER wrote:
> Hi and thanks.
> Attached the patch with the related changes.

Thanks, applied. I found that the macros were still using int64_t so
I turned all int64_t to uint64_t to avoid any trouble, especially with
the retrieval of the last argument which could possibly hit the sign
bit and cause a negative type to be returned (I haven't counted but
in theory that's possible).

Thanks David,
Willy

On Tue, Mar 15, 2016 at 10:12:51PM +0100, Benoît GARNIER wrote:
> Le 15/03/2016 21:59, Willy Tarreau a écrit :
> > Nice to see that you never resign, you pulled out the machine gun :-)
> > I'll trust you as I guess you've run a number of tests. The glibc being
> > covered by LGPL, it should be fine in theory, except if you picked it
> > from an LPGLv3 version which is not compatible with GPLv2 (it requires
> > to upgrade to GPLv3). But since I'm seeing this code in glibc 2.18 which
> > is still LGPLv2.1, that's fine. You should mention the glibc version you
> > used to clear any doubt.
>
> I'll redo the patch with the glibc 2.18 code, but I'll need to redo all
> my tests if there are any differences in the aforementioned code.

Just diff it, visually it was exactly the same.

> >> + sprintf(gmt_offset+1, "%02d%02d", (diff/60)%100, diff%60);
> > Please use snprintf() instead. We completely got rid of sprintf() as it
> > emits warnings on some platforms for being notoriously insecure and misused.
>
> I was extra careful to be sure to not overwrite the receiving buffer
> (thus the modulus and the sign handling), but I didn't think about the
> warnings.

The only sprintf() we used to have were all pretty safe. Also, improper use
of snprintf() can cause the same damage as sprintf(), but at least it limits
the risks especially for quick changes performed later. So we declared that
the warnings were easy to get rid of without adding any cost and that marked
the end of sprintf().

Willy

From 65198ff81545bd146511511eda534c699cb100b7 Mon Sep 17 00:00:00 2001
From: Benoit GARNIER <chezbunch+haproxy@gmail.com>
Date: Sun, 27 Mar 2016 03:04:16 +0200
Subject: [PATCH] BUG/MINOR: log: Don't use strftime() which can clobber
timezone if chrooted

The strftime() function can call tzset() internally on some platforms.
When haproxy is chrooted, the /etc/localtime file is not found, and some
implementations will clobber the content of the current timezone.

The GMT offset is computed by diffing the times returned by gmtime_r() and
localtime_r(). These variants are guaranteed to not call tzset() and were
already used in haproxy while chrooted, so they should be safe.

This patch must be backported to 1.6 and 1.5.
---
include/common/standard.h | 6 ++--
src/log.c | 4 +--
src/standard.c | 76 ++++++++++++++++++++++++++++++++++-------------
3 files changed, 62 insertions(+), 24 deletions(-)

diff --git a/include/common/standard.h b/include/common/standard.h
index 353d0b0..cd2208c 100644
--- a/include/common/standard.h
+++ b/include/common/standard.h
@@ -871,10 +871,11 @@ extern const char *monthname[];
char *date2str_log(char *dest, struct tm *tm, struct timeval *date, size_t size);

/* Return the GMT offset for a specific local time.
+ * Both t and tm must represent the same time.
* The string returned has the same format as returned by strftime(... "%z", tm).
* Offsets are kept in an internal cache for better performances.
*/
-const char *get_gmt_offset(struct tm *tm);
+const char *get_gmt_offset(time_t t, struct tm *tm);

/* gmt2str_log: write a date in the format :
* "%02d/%s/%04d:%02d:%02d:%02d +0000" without using snprintf
@@ -885,10 +886,11 @@ char *gmt2str_log(char *dst, struct tm *tm, size_t size);

/* localdate2str_log: write a date in the format :
* "%02d/%s/%04d:%02d:%02d:%02d +0000(local timezone)" without using snprintf
+ * Both t and tm must represent the same time.
* return a pointer to the last char written (\0) or
* NULL if there isn't enough space.
*/
-char *localdate2str_log(char *dst, struct tm *tm, size_t size);
+char *localdate2str_log(char *dst, time_t t, struct tm *tm, size_t size);

/* These 3 functions parses date string and fills the
* corresponding broken-down time in <tm>. In succes case,
diff --git a/src/log.c b/src/log.c
index ab38353..4d496cd 100644
--- a/src/log.c
+++ b/src/log.c
@@ -979,7 +979,7 @@ static char *update_log_hdr_rfc5424(const time_t time)

tvsec = time;
get_localtime(tvsec, &tm);
- gmt_offset = get_gmt_offset(&tm);
+ gmt_offset = get_gmt_offset(time, &tm);

hdr_len = snprintf(logheader_rfc5424, global.max_syslog_len,
"<<<<>1 %4d-%02d-%02dT%02d:%02d:%02d%.3s:%.2s %s ",
@@ -1495,7 +1495,7 @@ int build_logline(struct stream *s, char *dst, size_t maxsize, struct list *list

case LOG_FMT_DATELOCAL: // %Tl
get_localtime(s->logs.accept_date.tv_sec, &tm);
- ret = localdate2str_log(tmplog, &tm, dst + maxsize - tmplog);
+ ret = localdate2str_log(tmplog, s->logs.accept_date.tv_sec, &tm, dst + maxsize - tmplog);
if (ret == NULL)
goto out;
tmplog = ret;
diff --git a/src/standard.c b/src/standard.c
index e08795f..2fe92ba 100644
--- a/src/standard.c
+++ b/src/standard.c
@@ -2552,31 +2552,66 @@ char *date2str_log(char *dst, struct tm *tm, struct timeval *date, size_t size)
return dst;
}

+/* Base year used to compute leap years */
+#define TM_YEAR_BASE 1900
+
+/* Return the difference in seconds between two times (leap seconds are ignored).
+ * Retrieved from glibc 2.18 source code.
+ */
+static int my_tm_diff(const struct tm *a, const struct tm *b)
+{
+ /* Compute intervening leap days correctly even if year is negative.
+ * Take care to avoid int overflow in leap day calculations,
+ * but it's OK to assume that A and B are close to each other.
+ */
+ int a4 = (a->tm_year >> 2) + (TM_YEAR_BASE >> 2) - ! (a->tm_year & 3);
+ int b4 = (b->tm_year >> 2) + (TM_YEAR_BASE >> 2) - ! (b->tm_year & 3);
+ int a100 = a4 / 25 - (a4 % 25 < 0);
+ int b100 = b4 / 25 - (b4 % 25 < 0);
+ int a400 = a100 >> 2;
+ int b400 = b100 >> 2;
+ int intervening_leap_days = (a4 - b4) - (a100 - b100) + (a400 - b400);
+ int years = a->tm_year - b->tm_year;
+ int days = (365 * years + intervening_leap_days
+ + (a->tm_yday - b->tm_yday));
+ return (60 * (60 * (24 * days + (a->tm_hour - b->tm_hour))
+ + (a->tm_min - b->tm_min))
+ + (a->tm_sec - b->tm_sec));
+}
+
/* Return the GMT offset for a specific local time.
+ * Both t and tm must represent the same time.
* The string returned has the same format as returned by strftime(... "%z", tm).
* Offsets are kept in an internal cache for better performances.
*/
-const char *get_gmt_offset(struct tm *tm)
+const char *get_gmt_offset(time_t t, struct tm *tm)
{
/* Cache offsets from GMT (depending on whether DST is active or not) */
static char gmt_offsets[2][5+1] = { "", "" };

- int old_isdst = tm->tm_isdst;
char *gmt_offset;
-
- /* Pretend DST not active if its status is unknown, or strftime() will return an empty string for "%z" */
- if (tm->tm_isdst < 0) {
- tm->tm_isdst = 0;
- }
-
- /* Fetch the offset and initialize it if needed */
- gmt_offset = gmt_offsets[tm->tm_isdst & 0x01];
- if (unlikely(!*gmt_offset)) {
- strftime(gmt_offset, 5+1, "%z", tm);
- }
-
- /* Restore previous DST flag */
- tm->tm_isdst = old_isdst;
+ struct tm tm_gmt;
+ int diff;
+ int isdst = tm->tm_isdst;
+
+ /* Pretend DST not active if its status is unknown */
+ if (isdst < 0)
+ isdst = 0;
+
+ /* Fetch the offset and initialize it if needed */
+ gmt_offset = gmt_offsets[isdst & 0x01];
+ if (unlikely(!*gmt_offset)) {
+ get_gmtime(t, &tm_gmt);
+ diff = my_tm_diff(tm, &tm_gmt);
+ if (diff < 0) {
+ diff = -diff;
+ *gmt_offset = '-';
+ } else {
+ *gmt_offset = '+';
+ }
+ diff /= 60; /* Convert to minutes */
+ snprintf(gmt_offset+1, 4+1, "%02d%02d", diff/60, diff%60);
+ }

return gmt_offset;
}
@@ -2616,16 +2651,17 @@ char *gmt2str_log(char *dst, struct tm *tm, size_t size)

/* localdate2str_log: write a date in the format :
* "%02d/%s/%04d:%02d:%02d:%02d +0000(local timezone)" without using snprintf
- * * return a pointer to the last char written (\0) or
- * * NULL if there isn't enough space.
+ * Both t and tm must represent the same time.
+ * return a pointer to the last char written (\0) or
+ * NULL if there isn't enough space.
*/
-char *localdate2str_log(char *dst, struct tm *tm, size_t size)
+char *localdate2str_log(char *dst, time_t t, struct tm *tm, size_t size)
{
const char *gmt_offset;
if (size < 27) /* the size is fixed: 26 chars + \0 */
return NULL;

- gmt_offset = get_gmt_offset(tm);
+ gmt_offset = get_gmt_offset(t, tm);

dst = utoa_pad((unsigned int)tm->tm_mday, dst, 3); // day
*dst++ = '/';
--
2.5.0

On 16/03/2016 12:27 AM, "Hugo Maia" <hugofemaia@gmail.com> wrote:
>
> Hi, my name is Hugo.
>
> I'm currently using Haproxy 1.5, I have a backend with 2 servers. My app
servers receive connection from two clients and I want both of them to be
attributed to the same server. All connections have a url parameter X and
sessions that should be attributed to the same server have the same url
parameter X value. I use a stick table to save the server that a particular
url parameter value uses so that future connections can be attributed to
the same server.
>
> I want to be able to add app servers as load increases. In order to
instruct haproxy to move previous connections to the new app server I need
to expire stick table entries when no session (of either client) is active
in the server.
>
Isn't what a least connection balancer is for? I use that mode so when
adding new backend server all new sessions will go to that one, including
existing ones when they expire.

> Can you help me with this?
>
> Thanks in advance for any kind of help.
>
> Best Regards,
>
> Hugo Maia

Greetings,

On 03/15/2016 02:54 PM, Zachary Punches wrote:
>
> Hello!
>
> My name is Zack, and I have been in the middle of an on going HAProxy
> issue that has me scratching my head.
>
> Here is the setup:
>
> Our setup is hosted by amazon, and our HAProxy (1.6.3) boxes are in
> each region in 3 regions. We have 2 HAProxy boxes per region for a
> total of 6 proxy boxes.
>
> These boxes are routed information through route 53. Their entire job
> is to forward data from one of our clients to our database backend. It
> handles this absolutely fine, except between the hours of 7pm PST and
> 7am PST. During these hours, our route53 health checks time out thus
> causing the traffic to switch to the other HAProxy box inside of the
> same region.
>
> During the other 12 hours of the day, we receive 0 alerts from our
> health checks.
>
> I have noticed that we get a series of SSL handshake failures (though
> this happens throughout the entire day) that causes the server to hang
> for a second, thus causing the health checks to fail. During the day
> our SSL failures do not cause the server to hang long enough to go
> fail the checks, they only fail at night. I have attached my HAProxy
> config hoping that you guys have an answer for me. Lemme know if you
> need any more info.
>
Before thinking about less obvious potential causes, the CPU of the
instance isn't close to getting capped out during the time in question?
Also, are the connection counts under 15,000 (otherwise I could see it
ending up with a timeout and trying again)?

- Chad
>
> I have done a few tcpdump captures during the SSL handshake failures
> (not at night during it failing, but during the day when it still gets
> the SSL handshake failures, but doesn’t fail the health check) and it
> seems there is a d/c and a reconnect during the handshake.
>
> Here is my config, I will be running a tcpdump tonight to capture the
> packets during the failure and will attach it if you guys need more info.
>
> #---------------------------------------------------------------------
>
> # Example configuration for a possible web application. See the
>
> # full configuration options online.
>
> #
>
> # http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
>
> #
>
> #---------------------------------------------------------------------
>
> #---------------------------------------------------------------------
>
> # Global settings
>
> #---------------------------------------------------------------------
>
> global
>
> log 127.0.0.1 local2
>
> pidfile /var/run/haproxy.pid
>
> maxconn 30000
>
> user haproxy
>
> group haproxy
>
> daemon
>
> ssl-default-bind-options no-sslv3 no-tls-tickets
>
> tune.ssl.default-dh-param 2048
>
> # turn on stats unix socket
>
> # stats socket /var/lib/haproxy/stats`
>
> #---------------------------------------------------------------------
>
> # common defaults that all the 'listen' and 'backend' sections will
>
> # use if not designated in their block
>
> #---------------------------------------------------------------------
>
> defaults
>
> mode http
>
> log global
>
> option httplog
>
> retries 3
>
> timeout http-request 5s
>
> timeout queue 1m
>
> timeout connect 31s
>
> timeout client 31s
>
> timeout server 31s
>
> maxconn 15000
>
> # Stats
>
> stats enable
>
> stats uri /haproxy?stats
>
> stats realm Strictly\ Private
>
> stats auth $StatsUser:$StatsPass
>
> #---------------------------------------------------------------------
>
> # main frontend which proxys to the backends
>
> #---------------------------------------------------------------------
>
> frontend shared_incoming
>
> maxconn 15000
>
> timeout http-request 5s
>
> # Bind ports of incoming traffic
>
> bind *:1025 accept-proxy # http
>
> bind *:1026 accept-proxy ssl crt /path/to/default/ssl/cert.pem ssl
> crt /path/to/cert/folder/ # https
>
> bind *:1027 # Health checking port
>
> acl gs_texthtml url_reg \/gstext\.html ## allow gs to do meta
> tag verififcation
>
> acl gs_user_agent hdr_sub(User-Agent) -i globalsign ## allow gs to
> do meta tag verififcation
>
> # Add headers
>
> http-request set-header $Proxy-Header-Ip %[src]
>
> http-request set-header $Proxy-Header-Proto http if !{ ssl_fc }
>
> http-request set-header $Proxy-Header-Proto https if { ssl_fc }
>
> # Route traffic based on domain
>
> use_backend gs_verify if gs_texthtml or gs_user_agent ## allow
> gs meta tag verification
>
> use_backend
> %[req.hdr(host),lower,map_dom(/path/to/map/file.map,unknown_domain)]
>
> # Drop unrecognized traffic
>
> default_backend unknown_domain
>
> #---------------------------------------------------------------------
>
> # Backends
>
> #---------------------------------------------------------------------
>
> backend server0 ## added to allow gs ssl meta tag verification
>
> reqrep ^GET\ /.*\ (HTTP/.*) GET\ /GlobalSignVerification\ \1
>
> server server0_http server0.domain.com:80/GlobalSignVerification/
>
> backend server1
>
> server server1_http server1.domain.net:80
>
> backend server2
>
> server server2_http server2.domain.net:80
>
> backend server3
>
> server server3_http server3.domain.net:80
>
> backend server4
>
> server server4_http server4.domain.net:80
>
> backend server5
>
> server server5_http server5.domain.net:80
>
> backend server6
>
> server server6_http server6.domain.net:80
>
> backend server7
>
> server server7_http server7.domain.net:80
>
> backend server8
>
> server server8_http server8.domain.net:80
>
> backend server9
>
> server server9_http server9.domain.net:80
>
> backend unknown_domain
>
> timeout connect 4s
>
> timeout server 4s
>
> errorfile 503 /etc/haproxy-shared/errors/404.html
>

On Wed, Mar 16, 2016 at 5:54 AM, Zachary Punches <zpunches@getcake.com>
wrote:

> Hello!
>
>
>
> My name is Zack, and I have been in the middle of an on going HAProxy
> issue that has me scratching my head.
>
>
>
> Here is the setup:
>
>
>
> Our setup is hosted by amazon, and our HAProxy (1.6.3) boxes are in each
> region in 3 regions. We have 2 HAProxy boxes per region for a total of 6
> proxy boxes.
>
>
>
> These boxes are routed information through route 53. Their entire job is
> to forward data from one of our clients to our database backend. It handles
> this absolutely fine, except between the hours of 7pm PST and 7am PST.
> During these hours, our route53 health checks time out thus causing the
> traffic to switch to the other HAProxy box inside of the same region.
>
>
>
> During the other 12 hours of the day, we receive 0 alerts from our health
> checks.
>
>
>
> I have noticed that we get a series of SSL handshake failures (though this
> happens throughout the entire day) that causes the server to hang for a
> second, thus causing the health checks to fail. During the day our SSL
> failures do not cause the server to hang long enough to go fail the checks,
> they only fail at night. I have attached my HAProxy config hoping that you
> guys have an answer for me. Lemme know if you need any more info.
>
>
>
> I have done a few tcpdump captures during the SSL handshake failures (not
> at night during it failing, but during the day when it still gets the SSL
> handshake failures, but doesn’t fail the health check) and it seems there
> is a d/c and a reconnect during the handshake.
>
>
>
> Here is my config, I will be running a tcpdump tonight to capture the
> packets during the failure and will attach it if you guys need more info.
>
>
>
> #---------------------------------------------------------------------
>
> # Example configuration for a possible web application. See the
>
> # full configuration options online.
>
> #
>
> # http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
>
> #
>
> #---------------------------------------------------------------------
>
>
>
> #---------------------------------------------------------------------
>
> # Global settings
>
> #---------------------------------------------------------------------
>
> global
>
> log 127.0.0.1 local2
>
>
>
> pidfile /var/run/haproxy.pid
>
> maxconn 30000
>
> user haproxy
>
> group haproxy
>
> daemon
>
> ssl-default-bind-options no-sslv3 no-tls-tickets
>
> tune.ssl.default-dh-param 2048
>
>
>
> # turn on stats unix socket
>
> # stats socket /var/lib/haproxy/stats`
>
>
>
> #---------------------------------------------------------------------
>
> # common defaults that all the 'listen' and 'backend' sections will
>
> # use if not designated in their block
>
> #---------------------------------------------------------------------
>
> defaults
>
> mode http
>
> log global
>
> option httplog
>
> retries 3
>
> timeout http-request 5s
>
> timeout queue 1m
>
> timeout connect 31s
>
> timeout client 31s
>
> timeout server 31s
>
> maxconn 15000
>
>
>
> # Stats
>
> stats enable
>
> stats uri /haproxy?stats
>
> stats realm Strictly\ Private
>
> stats auth $StatsUser:$StatsPass
>
>
>
> #---------------------------------------------------------------------
>
> # main frontend which proxys to the backends
>
> #---------------------------------------------------------------------
>
>
>
> frontend shared_incoming
>
> maxconn 15000
>
> timeout http-request 5s
>
>
>
> # Bind ports of incoming traffic
>
> bind *:1025 accept-proxy # http
>
> bind *:1026 accept-proxy ssl crt /path/to/default/ssl/cert.pem ssl crt
> /path/to/cert/folder/ # https
>
> bind *:1027 # Health checking port
>
> acl gs_texthtml url_reg \/gstext\.html ## allow gs to do meta tag
> verififcation
>
> acl gs_user_agent hdr_sub(User-Agent) -i globalsign ##
> allow gs to do meta tag verififcation
>
>
>
> # Add headers
>
> http-request set-header $Proxy-Header-Ip %[src]
>
> http-request set-header $Proxy-Header-Proto http if !{ ssl_fc }
>
> http-request set-header $Proxy-Header-Proto https if { ssl_fc }
>
>
>
> # Route traffic based on domain
>
> use_backend gs_verify if gs_texthtml or gs_user_agent ## allow gs
> meta tag verification
>
> use_backend
> %[req.hdr(host),lower,map_dom(/path/to/map/file.map,unknown_domain)]
>
>
>
> # Drop unrecognized traffic
>
> default_backend unknown_domain
>
>
>
> #---------------------------------------------------------------------
>
> # Backends
>
> #---------------------------------------------------------------------
>
>
>
> backend server0 ## added to allow gs ssl meta tag verification
>
> reqrep ^GET\ /.*\ (HTTP/.*) GET\ /GlobalSignVerification\ \1
>
> server server0_http server0.domain.com:80/GlobalSignVerification/
>
>
>
> backend server1
>
> server server1_http server1.domain.net:80
>
>
>
> backend server2
>
> server server2_http server2.domain.net:80
>
>
>
> backend server3
>
> server server3_http server3.domain.net:80
>
>
>
> backend server4
>
> server server4_http server4.domain.net:80
>
>
>
> backend server5
>
> server server5_http server5.domain.net:80
>
>
>
> backend server6
>
> server server6_http server6.domain.net:80
>
>
>
> backend server7
>
> server server7_http server7.domain.net:80
>
>
>
> backend server8
>
> server server8_http server8.domain.net:80
>
>
>
> backend server9
>
> server server9_http server9.domain.net:80
>
>
>
> backend unknown_domain
>
> timeout connect 4s
>
> timeout server 4s
>
> errorfile 503 /etc/haproxy-shared/errors/404.html
>
>
>

I would say the best thing is to move the HAP health checks to separate
port(s). Also don't see the need for the hc being over SSL at all. have
following setup on each HAP we use in AWS:

# check LB status
frontend monitor-in
bind *:33305
mode http
option httplog
monitor-uri /monitor

# this checks the backend health instead HAP health
frontend health
bind *:34180
mode http
# create a status URI in /haproxy_status that will return
# a 200 if backend is healthy, and 503 if it isn't. This
# URI can be queried by an ELB or Route53.
acl backend_dead nbsrv(tomcats) lt 1
monitor-uri /haproxy_status
monitor fail if backend_dead

frontend localhost
bind *:80
bind *:443 ssl crt /etc/haproxy/star_encompasshost_com.crt no-sslv3
ciphers
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-RC4-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES128-SHA:AES256-SHA256:AES256-SHA:EDH+aRSA:DHE-RSA-AES256-SHA256:RC4-SHA:!aNULL:!eNULL:!LOW:!EXP:!RC4
mode http
default_backend tomcats
....
backend tomcats
....
default-server inter 10s downinter 5s rise 2 fall 2 slowstart 60s
maxconn 250 maxqueue 256
server s1 ...
server s2 ...
server s3 ...
....

Then in Route53 I can use check on port 33305 to find out if the HAP is
still alive and/or port 34180 to find out if there is still any backend
left to handle the requests.

Cheers,
Igor

&#22806;&#36152;&#34892;&#19994;&#25972;&#20307;&#22823;&#29615;&#22659;&#19981;&#22909;&#65292;&#20294;&#26159;&#20026;&#20160;&#20040;&#21035;&#20154;&#19994;&#32489;&#36824;&#26159;&#19968;&#24180;&#27604;&#19968;&#24180;&#39640;&#65311;
&#22806;&#36152;&#28192;&#36947;&#36873;&#25321;&#19981;&#23545;&#65292;&#21162;&#21147;&#30333;&#36153;&#65281;
&#29616;&#22312;&#36824;&#25226;B2B&#24179;&#21488;&#24403;&#20570;&#20225;&#19994;&#23458;&#25143;&#24320;&#21457;&#28192;&#36947;&#30340;&#21807;&#19968;&#36873;&#25321;&#65292;&#37027;&#24744;&#23601;&#30495;&#30340;&#35201;&#34987;OUT&#20986;&#23616;&#20102;&#65281;
&#36890;&#36807;&#20027;&#21160;&#20986;&#20987;&#30340;&#26041;&#24335;&#33719;&#24471;&#26356;&#22810;&#19982;&#22269;&#22806;&#23458;&#25143;&#27807;&#36890;&#30340;&#26426;&#20250;&#65292;&#32780;&#19981;&#34987;&#21160;&#31561;&#24453;&#23458;&#25143;&#21672;&#35810;&#65292;&#20135;&#21697;&#26356;&#24555;&#30340;&#25512;&#24191;&#20986;&#21435;&#65292;&#19994;&#21153;&#21592;&#19994;&#32489;&#26356;&#31283;&#23450;&#65292;&#20225;&#19994;&#26356;&#33391;&#24615;&#21457;&#23637;&#12290;
&#20026;&#22806;&#36152;&#20225;&#19994;&#25552;&#20379;&#24180;&#24213;&#23458;&#25143;&#24320;&#21457;&#28192;&#36947;&#25237;&#36164;&#35745;&#21010;&#12290;
&nbsp;
&#26377;&#20852;&#36259;&#30340;&#26379;&#21451;&#21152;&#25105;+1747175804&larr;QQ&#35814;&#32454;&#20102;&#35299;&#65281;&#65288;&#20844;&#21496;&#26377;&#23458;&#25143;&#25512;&#24191;&#35745;&#21010;&#30340;&#21487;&#20197;&#35814;&#32454;&#20102;&#35299;&#19968;&#19979;&#65289;

Has ELB changed its IP address???
Maybe you're checking a third party VM :)

Baptiste

附件供您参考

------------------ 原始邮件 ------------------
发件人: admin@alibabab.com.cn
发送时间: 2016年2016-3-16 14:23:11
收件人: haproxy@formilux.org
抄送: 陆经理
主题: 答复:研发项目部李经理

Dear Manager，


Good day to you.
It's time for share our new styles Clutch bags for 2016.

These bags With minimal detailing and a textured leather finish,

- Zip fastening across the top

- Leather ajustable (can be take down) shoulder strap.

- Beautiful pattern and popular shape.

- Internal zip fastened pocket for the cards and money.

-The big space can be put your Iphone ,small cosmetics etc.

- 100% leather

-our bag is an ideal day to evening option,please carry your our bag and good moon to travel with your friends.




How do you think of these bags? Please feel free to contact with me if you are interested or have some new styles to develop.

We can offer samples at first.

Look forward to hearing from you.

--

Thanks & Best regards
Candy
Sales manager
Guangzhou Shera-bag factory
Tel: 86-20 34329687
Email: candy@sherabag.com
Web: http://www.sherabag.com/
Address: Address: Rom1705 West Tower, Building C, Baoli world Trade Center, Pazhou Haizhu District Guangzhou China.

在 2016-02-17 14:08:30，"SANCIA" <info@sancia.com.au> 写道：

Hi Candy,


Thanks for sending those images through,


Are these pieces full leather? Could you give us some FOB prices and MOQ's for the pictures below?


Thanks


Angus


Angus Plate
Director


www.sancia.com.au













From: GZ Shera bag factory Candy <candy@sherabag.com>
Date: Tuesday, 16 February 2016 2:14 pm
To: SANCIA <info@sancia.com.au>
Subject: New styles for 2016



Dear Manager,


How are you and your weekend?
This is Candy from shera bag factory in Guangzhou ,China.
Glad to tell you that we have come back to the factory from Chinese New Year .
To the begining of Lunar New Year, our factory is available to receive orders and ready to produce.
Welcome your designs and welcome to choose the styles on our website.Some style for 2016 for your reference.


Wish you a good businese and look forward to get your reply.







--

Thanks & Best regards
Candy
Sales manager
Guangzhou Shera-bag factory
Tel: 86-20 34329687
Email: candy@sherabag.com
Web: http://www.sherabag.com/
Address: Address: Rom1705 West Tower, Building C, Baoli world Trade Center, Pazhou Haizhu District Guangzhou China.

Hi all,

Here a little update of the DeviceAtlas module which use the new wider 64
bytes ARG# macros introduced recently, plus documentations related changes.

Please cc ttrnka@deviceatlas.com for all answers.

All the best.

Kindest regards.

Dear&nbsp;Manager,I&nbsp;am&nbsp;Lucy&nbsp;from&nbsp;Tianjin&nbsp;World&nbsp;Machinery&nbsp;Manufacture&nbsp;Co.,&nbsp;Ltd.
We&nbsp;are&nbsp;glad&nbsp;to&nbsp;know&nbsp;you&nbsp;from&nbsp;my&nbsp;client.
As&nbsp;a&nbsp;professional&nbsp;valve&nbsp;manufacturer,&nbsp;I&nbsp;would&nbsp;like&nbsp;to&nbsp;introduce&nbsp;our&nbsp;products&nbsp;to&nbsp;you&nbsp;and&nbsp;offer&nbsp;you&nbsp;a&nbsp;quote.&nbsp;We&nbsp;manufacture&nbsp;
Butterfly&nbsp;Valve&nbsp;Gate&nbsp;Valve
Check&nbsp;Valve&nbsp;Y-Strainer
Rubber&nbsp;Expansion&nbsp;Joint&nbsp;Dismantling&nbsp;Joint
We are very competitive because we do parts process and painting
ourself and casting factory is near us.
If&nbsp;there&nbsp;is&nbsp;anything&nbsp;we&nbsp;can&nbsp;do&nbsp;for&nbsp;you,&nbsp;we&nbsp;shall&nbsp;be&nbsp;more&nbsp;than&nbsp;pleased&nbsp;to&nbsp;do&nbsp;so.
&nbsp;
Sincerely
Yours!&nbsp;Lucy


Foreign Trade&nbsp;Department&nbsp;
Tianjin&nbsp;World&nbsp;Machinery&nbsp;Manufacture&nbsp;Co.,&nbsp;Ltd
Add:&nbsp;No.9,&nbsp;Chuangye&nbsp;Road,&nbsp;Jinnan&nbsp;District,&nbsp;Tianjin,&nbsp;China.Tel:&nbsp;86-22-59848440
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp; Fax:86-22-59848444Mobile:&nbsp;86-15320145077 &nbsp; &nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;Skype:
world-machinery