The current Lua action are not registered. The executed function is
selected according with a function name writed in the HAProxy configuration.
This patch add an action registration function. The configuration mode
described above disappear.
This change make some incompatibilities with existing configuration files for
HAProxy 1.6-dev.
Running the Linux kernel's checkpatch.pl is actually quite efficient
at spotting style issues and even sometimes bugs. The doc now suggests
how to use it to avoid the warnings that are specific to Linux's stricter
rules.
It properly reports errors like the following ones that were found on
real submissions so it should improve the situation for everyone :
ERROR: "foo * bar" should be "foo *bar"
+static char * tcpcheck_get_step_comment(struct check *, int);
ERROR: do not use assignment in if condition
+ if ((comment = tcpcheck_get_step_comment(check, step)))
WARNING: trailing semicolon indicates no statements, indent implies otherwise
+ if (elem->data && elem->free);
+ elem->free(elem->data);
ERROR: do not initialise statics to 0 or NULL
+static struct lru64_head *ssl_ctx_lru_tree = NULL;
ERROR: space required after that ',' (ctx:VxV)
+ !X509_gmtime_adj(X509_get_notAfter(newcrt),(long)60*60*24*365))
^
WARNING: space prohibited between function name and open parenthesis '('
+ else if (EVP_PKEY_type (capkey->type) == EVP_PKEY_RSA)
ERROR: trailing statements should be on next line
+ if (cacert) X509_free(cacert);
ERROR: space prohibited after that open parenthesis '('
+ !( (srv_op_state == SRV_ST_STOPPED)
This file was recovered from the first project where it was born 12 years
ago, but it's still convenient to understand how our circular lists work,
so let's add it.
Documentation related to a new global directive.
Purpose of this directive is to store a file path into the global
structure of HAProxy. The file pointed by the path may be used by
HAProxy to retrieve server state from the previous running process
after a reload occured.
Released version 1.6-dev5 with the following main changes :
- MINOR: dns: dns_resolution structure update: time_t to unsigned int
- BUG/MEDIUM: dns: DNS resolution doesn't start
- BUG/MAJOR: dns: dns client resolution infinite loop
- MINOR: dns: coding style update
- MINOR: dns: new bitmasks to use against DNS flags
- MINOR: dns: dns_nameserver structure update: new counter for truncated response
- MINOR: dns: New DNS response analysis code: DNS_RESP_TRUNCATED
- MEDIUM: dns: handling of truncated response
- MINOR: DNS client query type failover management
- MINOR: dns: no expected DNS record type found
- MINOR: dns: new flag to report that no IP can be found in a DNS response packet
- BUG/MINOR: DNS request retry counter used for retry only
- DOC: DNS documentation updated
- MEDIUM: actions: remove ACTION_STOP
- BUG/MEDIUM: lua: outgoing connection was broken since 1.6-dev2 (bis)
- BUG/MINOR: lua: last log character truncated.
- CLEANUP: typo: bad indent
- CLEANUP: actions: missplaced includes
- MINOR: build: missing header
- CLEANUP: lua: Merge log functions
- BUG/MAJOR: http: don't manipulate the server connection if it's killed
- BUG/MINOR: http: remove stupid HTTP_METH_NONE entry
- BUG/MAJOR: http: don't call http_send_name_header() after an error
- MEDIUM: tools: make str2sa_range() optionally return the FQDN
- BUG/MINOR: tools: make str2sa_range() report unresolvable addresses
- BUG/MEDIUM: dns: use the correct server hostname when resolving
More information regarding DNS resolution:
- behavior in case of errors
- behavior when multiple name servers are configured in a resolvers
section
- when a retry is performed
- when a query type change is performed
- make it clear that DNS resolution requires health checking enabled
on the server
Released version 1.6-dev4 with the following main changes :
- MINOR: log: Add log-format variable %HQ, to log HTTP query strings
- DOC: typo in 'redirect', 302 code meaning
- DOC: typos in tcp-check expect examples
- DOC: resolve-prefer default value and default-server update
- MINOR: DNS counters: increment valid counter
- BUG/MEDIUM: DNS resolution response parsing broken
- MINOR: server: add new SRV_ADMF_CMAINT flag
- MINOR: server SRV_ADMF_CMAINT flag doesn't imply SRV_ADMF_FMAINT
- BUG/MEDIUM: dns: wrong first time DNS resolution
- BUG/MEDIUM: lua: Lua tasks fail to start.
- BUILD: add USE_LUA to BUILD_OPTIONS when it's used
- DOC/MINOR: fix OpenBSD versions where haproxy works
- MINOR: 51d: unable to start haproxy without "51degrees-data-file"
- BUG/MEDIUM: peers: fix wrong message id on stick table updates acknowledgement.
- BUG/MAJOR: peers: fix current table pointer not re-initialized on session release.
- BUILD: ssl: Allow building against libssl without SSLv3.
- DOC: clarify some points about SSL and the proxy protocol
- DOC: mention support for RFC 5077 TLS Ticket extension in starter guide
- BUG/MEDIUM: mailer: DATA part must be terminated with <CRLF>.<CRLF>
- DOC: match several lua configuration option names to those implemented in code
- MINOR cfgparse: Correct the mailer warning text to show the right names to the user
- BUG/MINOR: ssl: TLS Ticket Key rotation broken via socket command
- MINOR: stream: initialize the current_rule field to NULL on stream init
- BUG/MEDIUM: lua: timeout error with converters, wrapper and actions.
- CLEANUP: proto_http: remove useless initialisation
- CLEANUP: http/tcp actions: remove the scope member
- BUG/MINOR: proto_tcp: custom action continue is ignored
- MINOR: proto_tcp: add session in the action prototype
- MINOR: vars: reduce the code size of some wrappers
- MINOR: Move http method enum from proto_http to sample
- MINOR: sample: Add ipv6 to ipv4 and sint to ipv6 casts
- MINOR: sample/proto_tcp: export "smp_fetch_src"
- MEDIUM: cli: rely on the map's output type instead of the sample type
- BUG/MEDIUM: stream: The stream doen't inherit SC from the session
- BUG/MEDIUM: vars: segfault during the configuration parsing
- BUG/MEDIUM: stick-tables: refcount error after copying SC for the session to the stream
- BUG/MEDIUM: lua: bad error processing
- MINOR: samples: rename a struct from sample_storage to sample_data
- MINOR: samples: rename some struct member from "smp" to "data"
- MEDIUM: samples: Use the "struct sample_data" in the "struct sample"
- MINOR: samples: extract the anonymous union and create the union sample_value
- MINOR: samples: rename union from "data" to "u"
- MEDIUM: 51degrees: Adapt the 51Degrees library
- MINOR: samples: data assignation simplification
- MEDIUM: pattern/map: Maps can returns various types
- MINOR: map: The map can return IPv4 and IPv6
- MEDIUM: actions: Merge (http|tcp)-(request|reponse) action structs
- MINOR: actions: Remove the data opaque pointer
- MINOR: lua: use the hlua_rule type in place of opaque type
- MINOR: vars: use the vars types as argument in place of opaque type
- MINOR: proto_http: use an "expr" type in place of generic opaque type.
- MINOR: proto_http: replace generic opaque types by real used types for the actions on thr request line
- MINOR: proto_http: replace generic opaque types by real used types in "http_capture"
- MINOR: proto_http: replace generic opaque types by real used types in "http_capture" by id
- MEDIUM: track-sc: Move the track-sc configuration storage in the union
- MEDIUM: capture: Move the capture configuration storage in the union
- MINOR: actions: add "from" information
- MINOR: actions: remove the mark indicating the last entry in enum
- MINOR: actions: Declare all the embedded actions in the same header file
- MINOR: actions: change actions names
- MEDIUM: actions: Add standard return code for the action API
- MEDIUM: actions: Merge (http|tcp)-(request|reponse) keywords structs
- MINOR: proto_tcp: proto_tcp.h is now useles
- MINOR: actions: mutualise the action keyword lookup
- MEDIUM: actions: Normalize the return code of the configuration parsers
- MINOR: actions: Remove wrappers
- MAJOR: stick-tables: use sample types in place of dedicated types
- MEDIUM: stick-tables: use the sample type names
- MAJOR: stick-tables: remove key storage from the key struct
- MEDIUM: stick-tables: Add GPT0 in the stick tables
- MINOR: stick-tables: Add GPT0 access
- MINOR: stick-tables: Add GPC0 actions
- BUG/MEDIUM: lua: the lua fucntion Channel:close() causes a segfault
- DOC: ssl: missing LF
- MINOR: lua: add core.done() function
- DOC: fix function name
- BUG/MINOR: lua: in some case a sample may remain undefined
- DOC: fix "http_action_set_req_line()" comments
- MINOR: http: Action for manipulating the returned status code.
- MEDIUM: lua: turns txn:close into txn:done
- BUG/MEDIUM: lua: cannot process more Lua hooks after a "done()" function call
- BUILD: link with libdl if needed for Lua support
- CLEANUP: backend: factor out objt_server() in connect_server()
- MEDIUM: backend: don't call si_alloc_conn() when we reuse a valid connection
- MEDIUM: stream-int: simplify si_alloc_conn()
- MINOR: stream-int: add new function si_detach_endpoint()
- MINOR: server: add a list of private idle connections
- MINOR: connection: add a new list member in the connection struct
- MEDIUM: stream-int: queue idle connections at the server
- MINOR: stream-int: make si_idle_conn() only accept valid connections
- MINOR: server: add a list of already used idle connections
- MINOR: connection: add a new flag CO_FL_PRIVATE
- MINOR: config: add new setting "http-reuse"
- MAJOR: backend: initial work towards connection reuse
- MAJOR: backend: improve the connection reuse mechanism
- MEDIUM: backend: implement "http-reuse safe"
- MINOR: server: add a list of safe, already reused idle connections
- MEDIUM: backend: add the "http-reuse aggressive" strategy
- DOC: document the new http-reuse directive
- DOC: internals: document next steps for HTTP connection reuse
- DOC: mention that %ms is left-padded with zeroes.
- MINOR: init: indicate to check 'bind' lines when no listeners were found.
- MAJOR: http: remove references to appsession
- CLEANUP: config: remove appsession initialization
- CLEANUP: appsession: remove appsession.c and sessionhash.c
- CLEANUP: tests: remove sessionhash_test.c and test-cookie-appsess.cfg
- CLEANUP: proxy: remove last references to appsession
- CLEANUP: appsession: remove the last include files
- DOC: remove documentation about appsession
- CLEANUP: .gitignore: ignore more test files
- CLEANUP: .gitignore: finally ignore everything but what is known.
- MEDIUM: config: emit a warning on a frontend without listener
- DOC: add doc/internals/entities-v2.txt
- DOC: add doc/linux-syn-cookies.txt
- DOC: add design thoughts on HTTP/2
- DOC: add some thoughts on connection sharing for HTTP/2
- DOC: add design thoughts on dynamic buffer allocation
- BUG/MEDIUM: counters: ensure that src_{inc,clr}_gpc0 creates a missing entry
- DOC: add new file intro.txt
- MAJOR: tproxy: remove support for cttproxy
- BUG/MEDIUM: lua: outgoing connection was broken since 1.6-dev2
- DOC: lua: replace txn:close with txn:done in lua-api
- DOC: intro: minor updates and fixes
- DOC: intro: fix too long line.
- DOC: fix example of http-request using ssl_fc_session_id
- BUG/MEDIUM: lua: txn:done() still causes a segfault in TCP mode
- CLEANUP: lua: fix some indent issues
- BUG/MEDIUM: lua: fix a segfault in txn:done() if called twice
- DOC: lua: mention than txn:close was renamed txn:done.
- temporarily remove reference to management.txt which doesn't exist yet
- minor update to the lb intro
- indicate that e-mails can be sent to notify about server state change
This patch is inspired by Bowen Ni's proposal and it is based on his first
implementation:
With Lua integration in HAProxy 1.6, one can change the request method,
path, uri, header, response header etc except response line.
I'd like to contribute the following methods to allow modification of the
response line.
[...]
There are two new keywords in 'http-response' that allows you to rewrite
them in the native HAProxy config. There are also two new APIs in Lua that
allows you to do the same rewriting in your Lua script.
Example:
Use it in HAProxy config:
*http-response set-code 404*
Or use it in Lua script:
*txn.http:res_set_reason("Redirect")*
I dont take the full patch because the manipulation of the "reason" is useless.
standard reason are associated with each returned code, and unknown code can
take generic reason.
So, this patch can set the status code, and the reason is automatically adapted.
This was the first transparent proxy technology supported by haproxy
circa 2005 but it was obsoleted in 2007 by Tproxy 4.0 which removed a
lot of the earlier versions' shortcomings and was finally merged into
the kernel. Since nobody has been using cttproxy for many years now
and nobody has even just tried to compile the files, it's time to
remove it. The doc was updated as well.
This is an introduction to present HAProxy. The aim is to get rid of the
totally obsolete haproxy-en and haproxy-fr files. This file references
another one which is not there yet and which should cover the remaining
part of these obsolete files, which is how to manage the process. The
format is the same as the other docs so it should integrate seamlessly
to existing docs.
Since sample fetches are not always available in the response phase,
this patch implements %HQ such that:
GET /foo?bar=baz HTTP/1.0
...would be logged as:
?bar=baz
By the code, resolve-prefer defaults to IPv6 and is also available in
the default-server directive.
These information were missing or wrong in the documentation.
Released version 1.6-dev3 with the following main changes :
- CLEANUP: sample: generalize sample_fetch_string() as sample_fetch_as_type()
- MEDIUM: http: Add new 'set-src' option to http-request
- DOC usesrc root privileges requirments
- BUG/MINOR: dns: wrong time unit for some DNS default parameters
- MINOR: proxy: bit field for proxy_find_best_match diff status
- MINOR: server: new server flag: SRV_F_FORCED_ID
- MINOR: server: server_find functions: id, name, best_match
- DOC: dns: fix chapters syntax
- BUILD/MINOR: tools: rename popcount to my_popcountl
- BUILD: add netbsd TARGET
- MEDIUM: 51Degrees code refactoring and cleanup
- MEDIUM: 51d: add LRU-based cache on User-Agent string detection
- DOC: add notes about the "51degrees-cache-size" parameter
- BUG/MEDIUM: 51d: possible incorrect operations on smp->data.str.str
- BUG/MAJOR: connection: fix TLV offset calculation for proxy protocol v2 parsing
- MINOR: Add sample fetch to detect Supported Elliptic Curves Extension
- BUG/MINOR: payload: Add volatile flag to smp_fetch_req_ssl_ec_ext
- BUG/MINOR: lua: type error in the arguments wrapper
- CLEANUP: vars: remove unused struct
- BUG/MINOR: http/sample: gmtime/localtime can fail
- MINOR: standard: add 64 bits conversion functions
- MAJOR: sample: converts uint and sint in 64 bits signed integer
- MAJOR: arg: converts uint and sint in sint
- MEDIUM: sample: switch to saturated arithmetic
- MINOR: vars: returns variable content
- MEDIUM: vars/sample: operators can use variables as parameter
- BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id
- BUILD/MINOR: lua: fix a harmless build warning
- BUILD/MINOR: stats: fix build warning due to condition always true
- BUG/MAJOR: lru: fix unconditional call to free due to unexpected semi-colon
- BUG/MEDIUM: logs: fix improper systematic use of quotes with a few tags
- BUILD/MINOR: lua: ensure that hlua_ctx_destroy is properly defined
- BUG/MEDIUM: lru: fix possible memory leak when ->free() is used
- MINOR: vars: make the accounting not depend on the stream
- MEDIUM: vars: move the session variables to the session, not the stream
- BUG/MEDIUM: vars: do not freeze the connection when the expression cannot be fetched
- BUG/MAJOR: buffers: make the buffer_slow_realign() function respect output data
- BUG/MAJOR: tcp: tcp rulesets were still broken
- MINOR: stats: improve compression stats reporting
- MINOR: ssl: make self-generated certs also work with raw IPv6 addresses
- CLEANUP: ssl: make ssl_sock_generated_cert_serial() take a const
- CLEANUP: ssl: make ssl_sock_generate_certificate() use ssl_sock_generated_cert_serial()
- BUG/MINOR: log: missing some ARGC_* entries in fmt_directives()
- MINOR: args: add new context for servers
- MINOR: stream: maintain consistence between channel_forward and HTTP forward
- MINOR: ssl: provide ia function to set the SNI extension on a connection
- MEDIUM: ssl: add sni support on the server lines
- CLEANUP: stream: remove a useless call to si_detach()
- CLEANUP: stream-int: fix a few outdated comments about stream_int_register_handler()
- CLEANUP: stream-int: remove stream_int_unregister_handler() and si_detach()
- MINOR: stream-int: only use si_release_endpoint() to release a connection
- MINOR: standard: provide htonll() and ntohll()
- CLEANUP/MINOR: dns: dns_str_to_dn_label() only needs a const char
- BUG/MAJOR: dns: fix the length of the string to be copied
This patch allow the existing operators to take a variable as parameter.
This is useful to add the content of two variables. This patch modify
the behavior of operators.
This patch check calculus for overflow and returns capped values.
This permits to protect against integer overflow in certain operations
involving ratios, percentages, limits or anything. That can sometimes
be critically important with some operations (eg: content-length < X).
This patch removes the 32 bits unsigned integer and the 32 bit signed
integer. It replaces these types by a unique type 64 bit signed.
This makes easy the usage of integer and clarify signed and unsigned use.
With the previous version, signed and unsigned are used ones in place of
others, and sometimes the converter loose the sign. For example, divisions
are processed with "unsigned", if one entry is negative, the result is
wrong.
Note that the integer pattern matching and dotted version pattern matching
are already working with signed 64 bits integer values.
There is one user-visible change : the "uint()" and "sint()" sample fetch
functions which used to return a constant integer have been replaced with
a new more natural, unified "int()" function. These functions were only
introduced in the latest 1.6-dev2 so there's no impact on regular
deployments.
The new "sni" server directive takes a sample fetch expression and
uses its return value as a hostname sent as the TLS SNI extension.
A typical use case consists in forwarding the front connection's SNI
value to the server in a bridged HTTPS forwarder :
sni ssl_fc_sni
Clients that support ECC cipher suites SHOULD send the specified extension
within the SSL ClientHello message according to RFC4492, section 5.1. We
can use this extension to chain-proxy requests so that, on the same IP
address, a ECC compatible clients gets an EC certificate and a non-ECC
compatible client gets a regular RSA certificate. The main advantage of this
approach compared to the one presented by Dave Zhu on the mailing list
is that we can make it work with OpenSSL versions before 1.0.2.
Example:
frontend ssl-relay
mode tcp
bind 0.0.0.0:443
use_backend ssl-ecc if { req.ssl_ec_ext 1 }
default_backend ssl-rsa
backend ssl-ecc
mode tcp
server ecc unix@/var/run/haproxy_ssl_ecc.sock send-proxy-v2 check
backend ssl-rsa
mode tcp
server rsa unix@/var/run/haproxy_ssl_rsa.sock send-proxy-v2 check
listen all-ssl
bind unix@/var/run/haproxy_ssl_ecc.sock accept-proxy ssl crt /usr/local/haproxy/ecc.foo.com.pem user nobody
bind unix@/var/run/haproxy_ssl_rsa.sock accept-proxy ssl crt /usr/local/haproxy/www.foo.com.pem user nobody
Signed-off-by: Nenad Merdanovic <nmerdan@anine.io>
This option enables overriding source IP address in a HTTP request. It is
useful when we want to set custom source IP (e.g. front proxy rewrites address,
but provides the correct one in headers) or we wan't to mask source IP address
for privacy or compliance.
It acts on any expression which produces correct IP address.
All chapters in the configuration documentation used to follow this syntax :
<chapter number>. <title>
-------------------------
The new chapters introduced to document the dns resolution didn't provide the
dot character after the chapter number, which breaks the parsing for the HTML
converter. Instead of adding new conditions in the converter, we can align the
chapters with this syntax.
