Sometimes it may make sense to be able to immediately apply a verdict
without waiting at all. It was not possible because no inspect-delay
meant no inspection at all. This is now fixed.
When a backend has no LB algo specified and is not in dispatch, proxy
nor transparent mode, use "balance roundrobin" by default instead of
complaining. This will be particularly useful with stats and redirects.
Released version 1.3.16-rc1 with the following main changes :
- appsessions: cleanup DEBUG_HASH and initialize request_counter
- [MINOR] acl: add new keyword "connslots"
- [MINOR] cfgparse: fix off-by 2 in error message size
- [BUILD] fix build with gcc 4.3
- [BUILD] fix MANDIR default location to match documentation
- [TESTS] add a debug patch to help trigger the stats bug
- [BUG] Flush buffers also where there are exactly 0 bytes left
- [MINOR] Allow to specify a domain for a cookie
- [BUG/CLEANUP] cookiedomain -> cookie_domain rename + free(p->cookie_domain)
- [MEDIUM] Fix memory freeing at exit
- [MEDIUM] Fix memory freeing at exit, part 2
- [BUG] Fix listen & more of 2 couples <ip>:<port>
- [DOC] remove buggy comment for use_backend
- [CRITICAL] fix server state tracking: it was O(n!) instead of O(n)
- [MEDIUM] add support for URI hash depth and length limits
- [MINOR] permit renaming of x-forwarded-for header
- [BUILD] fix Makefile.bsd and Makefile.osx for stream_interface
- [BUILD] Haproxy won't compile if DEBUG_FULL is defined
- [MEDIUM] upgrade to ebtree v4.0
- [DOC] update the README file with new build options
- [MEDIUM] reduce risk of event starvation in ev_sepoll
- [MEDIUM] detect streaming buffers and tag them as such
- [MEDIUM] add support for conditional HTTP redirection
- [BUILD] make install should depend on haproxy not "all"
- [DEBUG] add a TRACE macro to facilitate runtime data extraction
- [BUG] event pollers must not wait if a task exists in the run queue
- [BUG] queue management: wake oldest request in queues
- [BUG] log: reported queue position was offed-by-one
- [BUG] fix the dequeuing logic to ensure that all requests get served
- [DOC] documentation for the "retries" parameter was missing.
- [MEDIUM] implement a monotonic internal clock
- [MEDIUM] further improve monotonic clock by check forward jumps
- [OPTIM] add branch prediction hints in list manipulations
- [MAJOR] replace ultree with ebtree in wait-queues
- [BUG] we could segfault during exit while freeing uri_auths
- [BUG] wqueue: perform proper timeout comparisons with wrapping values
- [MINOR] introduce now_ms, the current date in milliseconds
- [BUG] disable buffer read timeout when reading stats
- [MEDIUM] rework the wait queue mechanism
- [BUILD] change declaration of base64tab to fix build with Intel C++
- [OPTIM] shrink wake_expired_tasks() by using task_wakeup()
- [MAJOR] use an ebtree instead of a list for the run queue
- [MEDIUM] introduce task->nice and boot access to statistics
- [OPTIM] task_queue: assume most consecutive timers are equal
- [BUILD] silent a warning in unlikely() with gcc 4.x
- [MAJOR] convert all expiration timers from timeval to ticks
- [BUG] use_backend would not correctly consider "unless"
- [TESTS] added test-acl.cfg to test some ACL combinations
- [MEDIUM] add support for configuration keyword registration
- [MEDIUM] modularize the global "stats" keyword configuration parser
- [MINOR] cfgparse: add support for warnings in external functions
- [MEDIUM] modularize the "timeout" keyword configuration parser
- [MAJOR] implement tcp request content inspection
- [MINOR] acl: add a new parsing function: parse_dotted_ver
- [MINOR] acl: add req_ssl_ver in TCP, to match an SSL version
- [CLEANUP] remove unused include/types/client.h
- [CLEANUP] remove many #include <types/xxx> from C files
- [CLEANUP] remove dependency on obsolete INTBITS macro
- [DOC] document the new "tcp-request" keyword and associated ACLs
- [MINOR] acl: add REQ_CONTENT to the list of default acls
- [MEDIUM] acl: permit fetch() functions to set the result themselves
- [MEDIUM] acl: get rid of dummy values in always_true/always_false
- [MINOR] acl: add the "wait_end" acl verb
- [MEDIUM] acl: enforce ACL type checking
- [MEDIUM] acl: set types on all currently known ACL verbs
- [MEDIUM] acl: when possible, report the name and requirements of ACLs in warnings
- [CLEANUP] remove 65 useless NULL checks before free
- [MEDIUM] memory: update pool_free2() to support NULL pointers
- [MEDIUM] buffers: ensure buffer_shut* are properly called upon shutdowns
- [MEDIUM] process_srv: rely on buffer flags for client shutdown
- [MEDIUM] process_srv: don't rely at all on client state
- [MEDIUM] process_cli: don't rely at all on server state
- [BUG] fix segfault with url_param + check_post
- [BUG] server timeout was not considered in some circumstances
- [BUG] client timeout incorrectly rearmed while waiting for server
- [MAJOR] kill CL_STINSPECT and CL_STHEADERS (step 1)
- [MAJOR] get rid of SV_STANALYZE (step 2)
- [MEDIUM] simplify and centralize request timeout cancellation and request forwarding
- [MAJOR] completely separate HTTP and TCP states on the request path
- [BUG] fix recently introduced loop when client closes early
- [MAJOR] get rid of the SV_STHEADERS state
- [MAJOR] better separation of response processing and server state
- [MAJOR] clearly separate HTTP response processing from TCP server state
- [MEDIUM] remove unused references to {CL|SV}_STSHUT*
- [MINOR] term_trace: add better instrumentations to trace the code
- [BUG] ev_sepoll: closed file descriptors could persist in the spec list
- [BUG] process_response must not enable the read FD
- [BUG] buffers: remove BF_MAY_CONNECT and fix forwarding issue
- [BUG] process_response: do not touch srv_state
- [BUG] maintain_proxies must not disable backends
- [CLEANUP] get rid of BF_SHUT*_PENDING
- [MEDIUM] buffers: add BF_EMPTY and BF_FULL to remove dependency on req/rep->l
- [MAJOR] process_session: rely only on buffer flags
- [MEDIUM] use buffer->wex instead of buffer->cex for connect timeout
- [MEDIUM] centralize buffer timeout checks at the top of process_session
- [MINOR] ensure the termination flags are set by process_xxx
- [MEDIUM] session: move the analysis bit field to the buffer
- [OPTIM] process_cli/process_srv: reduce the number of tests
- [BUG] regparm is broken on gcc < 3
- [BUILD] fix warning in proto_tcp.c with gcc >= 4
- [MEDIUM] merge inspect_exp and txn->exp into request buffer
- [BUG] process_cli/process_srv: don't call shutdown when already done
- [BUG] process_request: HTTP body analysis must return zero if missing data
- [TESTS] test-fsm: 22 regression tests for state machines
- [BUG] Fix empty X-Forwarded-For header name when set in defaults section
- [BUG] fix harmless but wrong fd insertion sequence
- [MEDIUM] make it possible for analysers to follow the whole session
- [MAJOR] rework of the server FSM
- [OPTIM] remove useless fd_set(read) upon shutdown(write)
- [MEDIUM] massive cleanup of process_srv()
- [MEDIUM] second level of code cleanup for process_srv_data
- [MEDIUM] third cleanup and optimization of process_srv_data()
- [MEDIUM] process_srv_data: ensure that we always correctly re-arm timeouts
- [MEDIUM] stream_sock_process_data moved to stream_sock.c
- [MAJOR] make the client side use stream_sock_process_data()
- [MEDIUM] split stream_sock_process_data
- [OPTIM] stream_sock_read must check for null-reads more often
- [MINOR] only call flow analysers when their read side is connected.
- [MEDIUM] reintroduce BF_HIJACK with produce_content
- [MINOR] re-arrange buffer flags and rename some of them
- [MINOR] do not check for BF_SHUTR when computing write timeout
- [OPTIM] ev_sepoll: detect newly created FDs and check them once
- [OPTIM] reduce the number of calls to task_wakeup()
- [OPTIM] force inlining of large functions with gcc >= 3
- [MEDIUM] indicate a reason for a task wakeup
- [MINOR] change type of fdtab[]->owner to void*
- [MAJOR] make stream sockets aware of the stream interface
- [MEDIUM] stream interface: add the ->shutw method as well as in and out buffers
- [MEDIUM] buffers: add BF_READ_ATTACHED and BF_ANA_TIMEOUT
- [MEDIUM] process_session: make use of the new buffer flags
- [CLEANUP] process_session: move debug outputs out of the critical loop
- [MEDIUM] move QUEUE and TAR timers to stream interfaces
- [OPTIM] add compiler hints in tick_is_expired()
- [MINOR] add buffer_check_timeouts() to check what timeouts have fired.
- [MEDIUM] use buffer_check_timeouts instead of stream_sock_check_timeouts()
- [MINOR] add an expiration flag to the stream_sock_interface
- [MAJOR] migrate the connection logic to stream interface
- [MAJOR] add a connection error state to the stream_interface
- [MEDIUM] add the SN_CURR_SESS flag to the session to track open sessions
- [MEDIUM] continue layering cleanups.
- [MEDIUM] stream_interface: added a DISconnected state between CON/EST and CLO
- [MEDIUM] remove stream_sock_update_data()
- [MINOR] maintain a global session list in order to ease debugging
- [BUG] shutw must imply close during a connect
- [MEDIUM] process shutw during connection attempt
- [MEDIUM] make the stream interface control the SHUT{R,W} bits
- [MAJOR] complete layer4/7 separation
- [CLEANUP] move the session-related functions to session.c
- [MINOR] call session->do_log() for logging
- [MINOR] replace the ambiguous client_return function by stream_int_return
- [MINOR] replace client_retnclose() with stream_int_retnclose()
- [MINOR] replace srv_close_with_err() with http_server_error()
- [MEDIUM] make the http server error function a pointer in the session
- [CLEANUP] session.c: removed some migration left-overs in sess_establish()
- [MINOR] stream_sock_data_finish() should not expose fd
- [MEDIUM] extract TCP request processing from HTTP
- [MEDIUM] extract the HTTP tarpit code from process_request().
- [MEDIUM] move the HTTP request body analyser out of process_request().
- [MEDIUM] rename process_request to http_process_request
- [BUG] fix forgotten server session counter
- [MINOR] declare process_session in session.h, not proto_http.h
- [MEDIUM] first pass of lifting to proto_uxst.c:uxst_event_accept()
- [MINOR] add an analyser code for UNIX stats request
- [MINOR] pre-set analyser flags on the listener at registration time
- [BUG] do not forward close from cons to prod with analysers
- [MEDIUM] ensure that sock->shutw() also closes read for init states
- [MINOR] add an analyser state in struct session
- [MAJOR] make unix sockets work again with stats
- [MEDIUM] remove cli_fd, srv_fd, cli_state and srv_state from the session
- [MINOR] move the listener reference from fd to session
- [MEDIUM] reference the current hijack function in the buffer itself
- [MINOR] slightly rebalance stats_dump_{raw,http}
- [MINOR] add a new back-reference type : struct bref
- [MINOR] add back-references to sessions for later use by a dumper.
- [MEDIUM] add support for "show sess" in unix stats socket
- [BUG] do not release the connection slot during a retry
- [BUG] dynamic connection throttling could return a max of zero conns
- [BUG] do not try to pause backends during reload
- [BUG] ensure that listeners from disabled proxies are correctly unbound.
- [BUG] acl-related keywords are not allowed in defaults sections
- [BUG] cookie capture is declared in the frontend but checked on the backend
- [BUG] critical errors should be reported even in daemon mode
- [MINOR] redirect: add support for the "drop-query" option
- [MINOR] redirect: add support for "set-cookie" and "clear-cookie"
- [MINOR] redirect: in prefix mode a "/" means not to change the URI
- [BUG] do not dequeue requests on a dead server
- [BUG] do not dequeue the backend's pending connections on a dead server
- [MINOR] stats: indicate if a task is running in "show sess"
- [BUG] check timeout must not be changed if timeout.check is not set
- [BUG] "option transparent" is for backend, not frontend !
- [MINOR] transfer errors were not reported anymore in data phase
- [MEDIUM] add a send limit to a buffer
- [MEDIUM] don't report buffer timeout when there is I/O activity
- [MEDIUM] indicate when we don't care about read timeout
- [MINOR] add flags to indicate when a stream interface is waiting for space/data
- [MEDIUM] enable inter-stream_interface wakeup calls
- [MAJOR] implement autonomous inter-socket forwarding
- [MINOR] add the splice_len member to the buffer struct in preparation of splice support
- [MEDIUM] stream_sock: factor out the return path in case of no-writes
- [MEDIUM] i/o: rework ->to_forward and ->send_max
- [OPTIM] stream_sock: do not ask for polling on EAGAIN if we have read
- [OPTIM] buffer: replace rlim by max_len
- [OPTIM] stream_sock: factor out the buffer full handling out of the loop
- [CLEANUP] replace a few occurrences of (flags & X) && !(flags & Y)
- [CLEANUP] stream_sock: move the write-nothing condition out of the loop
- [MEDIUM] split stream_sock_write() into callback and core functions
- [MEDIUM] stream_sock_read: call ->chk_snd whenever there are data pending
- [MINOR] stream_sock: fix a few wrong empty calculations
- [MEDIUM] stream_sock: try to send pending data on chk_snd()
- [MINOR] global.maxpipes: add the ability to reserve file descriptors for pipes
- [MEDIUM] splice: add configuration options and set global.maxpipes
- [MINOR] introduce structures required to support Linux kernel splicing
- [MEDIUM] add definitions for Linux kernel splicing
- [MAJOR] complete support for linux 2.6 kernel splicing
- [BUG] reserve some pipes for backends with splice enabled
- [MEDIUM] splice: add hints to support older buggy kernels
- [MEDIUM] introduce pipe pools
- [MEDIUM] splice: make use of pipe pools
- [STATS] report pipe usage in the statistics
- [OPTIM] make global.maxpipes default to global.maxconn/4 when not specified
- [BUILD] fix snapshot date extraction with negative timezones
- [MEDIUM] move global tuning options to the global structure
- [MEDIUM] splice: add the global "nosplice" option
- [BUILD] add USE_LINUX_SPLICE to enable LINUX_SPLICE on linux 2.6
- [BUG] we must not exit if protocol binding only returns a warning
- [MINOR] add support for bind interface name
- [BUG] inform the user when root is expected but not set
- [MEDIUM] add support for source interface binding
- [MEDIUM] add support for source interface binding at the server level
- [MEDIUM] implement bind-process to limit service presence by process
- [DOC] document maxpipes, nosplice, option splice-{auto,request,response}
- [DOC] filled the logging section of the configuration manual
- [DOC] document HTTP status codes
- [DOC] document a few missing info about errorfile
- [BUG] fix random memory corruption using "show sess"
- [BUG] fix unix socket processing of interrupted output
- [DOC] add diagrams of queuing and future ACL design
- [BUILD] proto_http did not build on gcc-2.95
- [BUG] the "source" keyword must first clear optional settings
- [BUG] global.tune.maxaccept must be limited even in mono-process mode
- [MINOR] ensure that http_msg_analyzer updates pointer to invalid char
- [MEDIUM] store a complete dump of request and response errors in proxies
- [MEDIUM] implement error dump on unix socket with "show errors"
- [DOC] document "show errors"
- [MINOR] errors dump must use user-visible date, not internal date.
- [MINOR] time: add __usec_to_1024th to convert usecs to 1024th of second
- [MINOR] add curr_sec_ms and curr_sec_ms_scaled for current second.
- [MEDIUM] measure and report session rate on frontend, backends and servers
- [BUG] the "connslots" keyword was matched as "connlots"
- [MINOR] acl: add 2 new verbs: fe_sess_rate and be_sess_rate
- [MEDIUM] implement "rate-limit sessions" for the frontend
- [BUG] interface binding: length must include the trailing zero
- [BUG] typo in timeout error reporting : report *res and not *err
- [OPTIM] maintain_proxies: only wake up when the frontend will be ready
- [OPTIM] rate-limit: cleaner behaviour on low rates and reduce consumption
- [BUG] switch server-side stream interface to close in case of abort
- [CLEANUP] remove last references to term_trace
- [OPTIM] freq_ctr: do not rotate the counters when reading
- [BUG] disable any analysers for monitoring requests
- [BUG] rate-limit in defaults section was ignored
- [BUG] task: fix handling of duplicate keys
- [OPTIM] task: don't unlink a task from a wait queue when waking it up
- [OPTIM] displace tasks in the wait queue only if absolutely needed
- [MEDIUM] minor update to the task api: let the scheduler queue itself
- [BUG] event_accept() must always wake the task up, even in health mode
- [CLEANUP] task: distinguish between clock ticks and timers
- [OPTIM] task: reduce the number of calls to task_queue()
- [OPTIM] do not re-check req buffer when only response has changed
- [CLEANUP] don't enable kernel splicing when socket is closed
- [CLEANUP] buffer_flush() was misleading, rename it as buffer_erase
- [MINOR] buffers: implement buffer_flush()
- [MEDIUM] rearrange forwarding condition to enable splice during analysis
- [BUILD] build fixes for Solaris
- [BUILD] proto_http did not build on gcc-2.95 (again)
- [CONTRIB] halog: fast log parser for haproxy
- [CONTRIB] halog: faster fgets() and add support for percentile reporting
The new "rate-limit sessions" statement sets a limit on the number of
new connections per second on the frontend. As it is extremely accurate
(about 0.1%), it is efficient at limiting resource abuse or DoS.
These new ACLs match frontend session rate and backend session rate.
Examples are provided in the doc to explain how to use that in order
to limit abuse of service.
With this change, all frontends, backends, and servers maintain a session
counter and a timer to compute a session rate over the last second. This
value will be very useful because it varies instantly and can be used to
check thresholds. This value is also reported in the stats in a new "rate"
column.
On overloaded systems, it sometimes happens that hundreds or thousands
of incoming connections are queued in the system's backlog, and all get
dequeued at once. The problem is that when haproxy processes them and
does not apply any limit, this can take some time and the internal date
does not progress, resulting in wrong timer measures for all sessions.
The most common effect of this is that all of these sessions report a
large request time (around several hundreds of ms) which is in fact
caused by the time spent accepting other connections. This might happen
on shared systems when the machine swaps.
For this reason, we finally apply a reasonable limit even in mono-process
mode. Accepting 100 connections at once is fast enough for extreme cases
and will not cause that much of a trouble when the system is saturated.
Some parts from the previous doc about logging have been merged and
updated. Most of those parts have been reworked and completed. The
examples are now accurate and reflect recent versions.
The "bind-process" keyword lets the admin select which instances may
run on which process (in multi-process mode). It makes it easier to
more evenly distribute the load across multiple processes by avoiding
having too many listen to the same IP:ports.
Specifying "interface <name>" after the "source" statement allows
one to bind to a specific interface for proxy<->server traffic.
This makes it possible to use multiple links to reach multiple
servers, and to force traffic to pass via an interface different
from the one the system would have chosen based on the routing
table.
By appending "interface <name>" to a "bind" line, it is now possible
to specifically bind to a physical interface name. Note that this
currently only works on Linux and requires root privileges.
"option transparent" was set and checked on frontends only while it
is purely a backend thing as it replaces the "balance" mode. For this
reason, it did only work in "listen" sections. This change will then
not affect the rare users of this option.
If the prefix is set to "/", it means the user does not want to alter
the original URI, so we don't want to insert a new slash before the
original URI.
(cherry-picked from commit 02a35c74942c1bce762e996698add1270e6a5030)
It is now possible to set or clear a cookie during a redirection. This
is useful for logout pages, or for protecting against some DoSes. Check
the documentation for the options supported by the "redirect" keyword.
(cherry-picked from commit 4af993822e880d8c932f4ad6920db4c9242b0981)
If "drop-query" is present on a "redirect" line using the "prefix" mode,
then the returned Location header will be the request URI without the
query-string. This may be used on some login/logout pages, or when it
must be decided to redirect the user to a non-secure server.
(cherry-picked from commit f2d361ccd73aa16538ce767c766362dd8f0a88fd)
I'm in the process of setting up one haproxy instance now, and I find
the following acl option useful. I'm not too sure why this option has
not been available before, but I find this useful for my own usage, so
I'm submitting this patch in the hope that it will be useful as well.
The basic idea is to be able to measure the available connection slots
still available (connection, + queue) - anything beyond that can be
redirected to a different backend. 'connslots' = number of available
server connection slots, + number of available server queue slots. In
the case where we encounter srv maxconn = 0, or srv maxqueue = 0 (in
which case we dont need to care about connslots) the value you get is
-1. Note also that this code does not take care of dynamic connections
at this point in time.
The reason why I'm using this new acl (as opposed to 'nbsrv') is that
'nbsrv' only measures servers that are actually *down*. Whereas this
other acl is more fine-grained, and looks into the number of conn
slots available as well.
It is now possible to list all known sessions by issuing "show sess"
on the unix stats socket. The format is not much evolved but it is
very useful for debugging.
The doc has been updated to reflect the new keyword.
There were rare situations where it was not easy to detect that a failed
session attempt had occurred and needed some server cleanup. In particular,
client aborts sometimes lead to session leaks on the server side.
A new state "SI_ST_DIS" (disconnected) has been introduced for this. When
a session has been closed at a stream interface but the server cleanup has
not occurred, this state is entered instead of CLO. The cleanup is then
performed there and the state goes to CLO.
A new diagram has been added to show possible stream_interface state
transitions that can occur in a stream-sock. It makes debugging easier.
Because I needed it in my situation - here's a quick patch to
allow changing of the "x-forwarded-for" header by using a suboption to
"option forwardfor".
Suboption "header XYZ" will set the header from "x-forwarded-for" to "XYZ".
Default is still "x-forwarded-for" if the header value isn't defined.
Also the suboption 'except a.b.c.d/z' still works on the same line.
So it's now: option forwardfor [except a.b.c.d[/z]] [header XYZ]
The new "wait_end" acl delays evaluation of the rule (and the next ones)
to the end of the analysis period. This is intented to be used with TCP
content analysis. A rule referencing such an ACL will not match until
the delay is over. An equivalent default ACL "WAIT_END" has been created.
With content inspection, checking the presence of data in the
request buffer is very important. It's getting boring to always
add such an ACL, so let's add it by default.
A new "redirect" keyword adds the ability to send an HTTP 301/302/303
redirection to either an absolute location or to a prefix followed by
the original URI. The redirection is conditionned by ACL rules, so it
becomes very easy to move parts of a site to another site using this.
This work was almost entirely done at Exceliance by Emeric Brun.
A test-case has been added in the tests/ directory.
This patch allows to specify a domain used when inserting a cookie
providing a session stickiness. Usefull for example with wildcard domains.
The patch adds one new variable to the struct proxy: cookiedomain.
When set the domain is appended to a Set-Cookie header.
Domain name is validated using the new invalid_domainchar() function.
It is basically invalid_char() limited to [A-Za-z0-9_.-]. Yes, the test
is too trivial and does not cover all wrong situations, but the main
purpose is to detect most common mistakes, not intentional abuses.
The underscore ("_") character is not RFC-valid but as it is
often (mis)used so I decided to allow it.
This patch adds two optional arguments "len" and "depth" to
"balance uri". They are used to limit the length in characters
of the analysis, as well as the number of directory components
it applies to.
Released version 1.3.15 with the following main changes :
- [BUILD] Added support for 'make install'
- [BUILD] Added 'install-man' make target for installing the man page
- [BUILD] Added 'install-bin' make target
- [BUILD] Added 'install-doc' make target
- [BUILD] Removed "/" after '$(DESTDIR)' in install targets
- [BUILD] Changed 'install' target to install the binaries first
- [BUILD] Replace hardcoded 'LD = gcc' with 'LD = $(CC)'
- [MEDIUM]: Inversion for options
- [MEDIUM]: Count retries and redispatches also for servers, fix redistribute_pending, extend logs, %d->%u cleanup
- [BUG]: Restore clearing t->logs.bytes
- [MEDIUM]: rework checks handling
- [DOC] Update a "contrib" file with a hint about a scheme used for formathing subjects
- [MEDIUM] Implement "track [<backend>/]<server>"
- [MINOR] Implement persistent id for proxies and servers
- [BUG] Don't increment server connections too much + fix retries
- [MEDIUM]: Prevent redispatcher from selecting the same server, version #3
- [MAJOR] proto_uxst rework -> SNMP support
- [BUG] appsession lookup in URL does not work
- [BUG] transparent proxy address was ignored in backend
- [BUG] hot reconfiguration failed because of a wrong error check
- [DOC] big update to the configuration manual
- [DOC] large update to the configuration manual
- [DOC] document more options
- [BUILD] major rework of the GNU Makefile
- [STATS] add support for "show info" on the unix socket
- [DOC] document options forwardfor to logasap
- [MINOR] add support for the "backlog" parameter
- [OPTIM] introduce global parameter "tune.maxaccept"
- [MEDIUM] introduce "timeout http-request" in frontends
- [MINOR] tarpit timeout is also allowed in backends
- [BUG] increment server connections for each connect()
- [MEDIUM] add a turn-around state of one second after a connection failure
- [BUG] fix typo in redispatched connection
- [DOC] document options nolinger to ssl-hello-chk
- [DOC] added documentation for "option tcplog" to "use_backend"
- [BUG] connect_server: server might not exist when sending error report
- [MEDIUM] support fully transparent proxy on Linux (USE_LINUX_TPROXY)
- [MEDIUM] add non-local bind to connect() on Linux
- [MINOR] add transparent proxy support for balabit's Tproxy v4
- [BUG] use backend's source and not server's source with tproxy
- [BUG] fix overlapping server flags
- [MEDIUM] fix server health checks source address selection
- [BUG] build failed on CONFIG_HAP_LINUX_TPROXY without CONFIG_HAP_CTTPROXY
- [DOC] added "server", "source" and "stats" keywords
- [DOC] all server parameters have been documented
- [DOC] document all req* and rsp* keywords.
- [DOC] added documentation about HTTP header manipulations
- [BUG] log response byte count, not request
- [BUILD] code did not build in full debug mode
- [BUG] fix truncated responses with sepoll
- [MINOR] use s->frt_addr as the server's address in transparent proxy
- [MINOR] fix configuration hint about timeouts
- [DOC] minor cleanup of the doc and notice to contributors
- [MINOR] report correct section type for unknown keywords.
- [BUILD] update MacOS Makefile to build on newer versions
- [DOC] fix erroneous "useallbackups" option in the doc
- [DOC] applied small fixes from early readers
- [MINOR] add configuration support for "redir" server keyword
- [MEDIUM] completely implement the server redirection method
- [TESTS] add a test case for the server redirection mechanism
- [DOC] add a configuration entry for "server ... redir <prefix>"
- [BUILD] backend.c and checks.c did not build without tproxy !
- Revert "[BUILD] backend.c and checks.c did not build without tproxy !"
- [BUILD] backend.c and checks.c did not build without tproxy !
- [OPTIM] used unsigned ints for HTTP state and message offsets
- [OPTIM] GCC4's builtin_expect() is suboptimal
- [BUG] failed conns were sometimes incremented in the frontend!
- [BUG] timeout.check was not pre-set to eternity
- [TESTS] add test-pollers.cfg to easily report pollers in use
- [BUG] do not apply timeout.connect in checks if unset
- [BUILD] ensure that makefile understands USE_DLMALLOC=1
- [MINOR] silent gcc for a wrong warning
- [CLEANUP] update .gitignore to ignore more temporary files
- [CLEANUP] report dlmalloc's source path only if explictly specified
- [BUG] str2sun could leak a small buffer in case of error during parsing
- [BUG] option allbackups was not working anymore in roundrobin mode
- [MAJOR] implementation of the "leastconn" load balancing algorithm
- [BUILD] ensure that users don't build without setting the target anymore.
- [DOC] document the leastconn LB algo
- [MEDIUM] fix stats socket limitation to 16 kB
- [DOC] fix unescaped space in httpchk example.
- [BUG] fix double-decrement of server connections
- [TESTS] add a test case for port mapping
- [TESTS] add a benchmark for integer hashing
- [TESTS] add new methods in ip-hash test file
- [MAJOR] implement parameter hashing for POST requests
This patch extends the "url_param" load balancing method by introducing
the "check_post" option. Using this option enables analysis of the beginning
of POST requests to search for the specified URL parameter.
The patch also fixes a few minor typos in comments that were discovered
during code review.
Currently there is a ~16KB limit for a data size passed via unix socket.
It is caused by a trivial bug ttat is going to fixed soon, however
in most cases there is no need to dump a full stats.
This patch makes possible to select a scope of dumped data by extending
current "show stat" to "show stat [<iid> <type> <sid>]":
- iid is a proxy id, -1 to dump all proxies
- type selects type of dumpable objects: 1 for frontend, 2 for backend, 4 for
server, -1 for all types. Values can be ORed, for example:
1+2=3 -> frontend+backend.
1+2+4=7 -> frontend+backend+server.
- sid is a service id, -1 to dump everything from the selected proxy.
To do this I implemented a new session flag (SN_STAT_BOUND), added three
variables in data_ctx.stats (iid, type, sid), modified dumpstats.c and
completely revorked the process_uxst_stats: now it waits for a "\n"
terminated string, splits args and uses them. BTW: It should be quite easy
to add new commands, for example to enable/disable servers, the only problem
I can see is a not very lucky config name (*stats* socket). :|
During the work I also fixed two bug:
- s->flags were not initialized for proto_uxst
- missing comma if throttling not enabled (caused by a stupid change in
"Implement persistent id for proxies and servers")
Other changes:
- No more magic type valuse, use STATS_TYPE_FE/STATS_TYPE_BE/STATS_TYPE_SV
- Don't memset full s->data_ctx (it was clearing s->data_ctx.stats.{iid/type/sid},
instead initialize stats.sv & stats.sv_st (stats.px and stats.px_st were already
initialized)
With all that changes it was extremely easy to write a short perl plugin
for a perl-enabled net-snmp (also included in this patch).
29385 is my PEN (Private Enterprise Number) and I'm willing to donate
the SNMPv2-SMI::enterprises.29385.106.* OIDs for HAProxy if there
is nothing assigned already.
This patch adds a possibility to set a persistent id for a proxy/server.
Now, even if some proxies/servers are inserted/deleted/moved, iids and
sids can be still used reliable.
Some people add servers with tricky names (BACKEND or FRONTEND for example).
So I also added one more field ('type') to distinguish between a
backend (0), frontend (1) and server (2) without complicated logic:
if name==BACKEND and sid==0 then type is BACKEND else type is SERVER,
etc for a FRONTEND. It also makes possible to have one frontend with more
than one IP (a patch coming soon) with independed stats - for example to
differs between remote and local traffic.
Finally, I added documentation about the CSV format.
This patch depends on '[MEDIUM] Implement "track [<backend>/]<server>"'
This patch implements ability to set the current state of one server
by tracking another one. It:
- adds two variables: *tracknext, *tracked to struct server
- implements findserver(), similar to findproxy()
- adds "track" keyword accepting both "proxy/server" and "server" (assuming current proxy)
- verifies if both checks and tracking is not enabled at the same time
- changes set_server_down() to notify tracking server
- creates set_server_up(), set_server_disabled(), set_server_enabled() by
moving the code from process_chk() and adding notifications
- changes stats to show a name of tracked server instead of Chk/Dwn/Dwntime(html)
or by adding new variable (csv)
Changes from the previuos version:
- it is possibile to track independently of the declaration order
- one extra comma bug is fixed
- new condition to check if there is no disable-on-404 inconsistency
This patch adds two new variables: fastinter and downinter.
When server state is:
- non-transitionally UP -> inter (no change)
- transitionally UP (going down), unchecked or transitionally DOWN (going up) -> fastinter
- down -> downinter
It allows to set something like:
server sr6 127.0.51.61:80 cookie s6 check inter 10000 downinter 20000 fastinter 500 fall 3 weight 40
In the above example haproxy uses 10000ms between checks but as soon as
one check fails fastinter (500ms) is used. If server is down
downinter (20000) is used or fastinter (500ms) if one check pass.
Fastinter is also used when haproxy starts.
New "timeout.check" variable was added, if set haproxy uses it as an additional
read timeout, but only after a connection has been already established. I was
thinking about using "timeout.server" here but most people set this
with an addition reserve but still want checks to kick out laggy servers.
Please also note that in most cases check request is much simpler
and faster to handle than normal requests so this timeout should be smaller.
I also changed the timeout used for check connections establishing.
Changes from the previous version:
- use tv_isset() to check if the timeout is set,
- use min("timeout connect", "inter") but only if "timeout check" is set
as this min alone may be to short for full (connect + read) check,
- debug code (fprintf) commented/removed
- documentation
Compile tested only (sorry!) as I'm currently traveling but changes
are rather small and trivial.
