This patch implements a listen proxy within the master. It uses the
sockpair of all the workers as servers.
In the current state of the code, the proxy is only doing round robin on
the CLI of the workers. A CLI mode will be needed to know to which CLI
send the requests.
The init code of the mworker_proc structs has been moved before the
init of the listeners.
Each socketpair is now connected to a CLI within the workers, which
allows the master to access their CLI.
The inherited flag of the worker side socketpair is removed so the
socket can be closed in the master.
There's a call there to si_cs_send() while we're supposed to come from
si_cs_io_cb() which has just done it. But in fact we can also come here
as a lower layer callback from ->wake() after a connection is established.
Since most of the time we'll end up here with either no data in the buffer
or a blocked output, let's simply check if we're already susbcribed to send
events before calling si_cs_send().
stream_int_notify() is I/O agnostic and should not wake up the tasklet,
it's up to si_cs_process() to do that, just like si_applet_wake_cb()
does it for the applet.
This one was added by commit 53216e7db ("MEDIUM: connections: Don't
directly mess with the polling from the upper layers.") after the
removal of the conditional cs_want_send() call. But after analysis
it turned out that it's not needed since the si_cs_send() call will
either succeed or subscribe.
Calling si_cs_send() alone is always dangerous because it can result
in the loss of an event if it manages to empty the buffer. Indeed, in
this case it's critical to call si_chk_rcv() on the opposite stream-int.
Given that si_cs_process() takes care of all this, let's call it instead.
All this code could possibly be refined soon to avoid redoing the whole
stream_int_notify() and do it only after a send(), but at the moment it's
not important.
With the new synchronous si_cs_send() at the end of process_stream(),
we're seeing re-appear the I/O layer specific part of the stream interface
which is supposed to deal with I/O event subscription. The only difference
is that now we subscribe to I/Os only after having attempted (and failed)
them.
This patch brings a cleanup in this by reintroducing stream_int_update_conn()
with the send code from process_stream(). However this alone would not be
enough because the flags which are cleared afterwards would result in the
loss of the possible events (write events only at the moment). So the flags
clearing and stream-int state updates are also performed inside si_update()
between the generic code and the I/O specific code. This definitely makes
sense as after this call we can simply check again for channel and SI flag
changes and decide to loop once again or not.
The rationale here is that we should never need to try to send() at the
beginning of process_stream() because :
- if something was pending, it's very unlikely that it was unblocked
and not sent just between the last poll() and the wakeup instant.
- if something pending was recently sent, then we don't have anything
to send anymore.
So at first glance it doesn't seem like there could be any valid case
where trying to send before entering the function brings any benefit.
If a buffer allocation failed, we have SI_FL_WAIT_ROOM set and c_size(buf)
being zero. It's the only moment where we have a new opportunity to try to
allocate this buffer. However we don't want to waste our time trying this
if both are non-null since it indicates missing room without any changed
condition.
Well that's only 3 places (applet.c, stream_interface.c, hlua.c). This
ensures we always clear SI_FL_WAIT_ROOM before setting it on failure,
so that it is granted that SI_FL_WAIT_ROOM always indicates a lack of
room for doing an operation, including the inability to allocate a
buffer for this.
This will supersed channel_alloc_buffer() while relying on it. It will
automatically adjust SI_FL_WAIT_ROOM on the stream-int depending on
success or failure to allocate this buffer.
It's worth noting that it could make sense to also set SI_FL_WANT_PUT
each time we do this to further simplify the code at user places such
as applets, but it would possibly not be easy to clean this flag
everywhere an rx operation stops.
The vars_prune() and vars_init() functions involve locking while most of
the time there is no variable at all in streams nor sessions. Let's check
for emptiness before calling these functions. Simply doing this has
increased the multithreaded performance from 1.5 to 5% depending on the
workload.
While "option prefer-last-server" only applies to non-deterministic load
balancing algorithms, 401/407 responses actually caused haproxy to prefer
the last server unconditionally.
As this breaks deterministic load balancing algorithms like uri, this
patch applies the same condition here.
Should be backported to 1.8 (together with "BUG/MINOR: only mark
connections private if NTLM is detected").
Instead of marking all connections that see a 401/407 response private
(for connection reuse), this patch detects a RFC4559/NTLM authentication
scheme and restricts the private setting to those connections.
This is so we can reuse connections with 401/407 responses with
deterministic load balancing algorithms later (which requires another fix).
This fixes the problem reported here by Elliot Barlas :
https://discourse.haproxy.org/t/unable-to-configure-load-balancing-per-request-over-persistent-connection/3144
Should be backported to 1.8.
The behaviour of the flag CF_WRITE_PARTIAL was modified by commit
95fad5ba4 ("BUG/MAJOR: stream-int: don't re-arm recv if send fails") due
to a situation where it could trigger an immediate wake up of the other
side, both acting in loops via the FD cache. This loss has caused the
need to introduce CF_WRITE_EVENT as commit c5a9d5bf, to replace it, but
both flags express more or less the same thing and this distinction
creates a lot of confusion and complexity in the code.
Since the FD cache now acts via tasklets, the issue worked around in the
first patch no longer exists, so it's more than time to kill this hack
and to restore CF_WRITE_PARTIAL's semantics (i.e.: there has been some
write activity since we last left process_stream).
This patch mostly reverts the two commits above. Only the part making
use of CF_WROTE_DATA instead of CF_WRITE_PARTIAL to detect the loss of
data upon connection setup was kept because it's more accurate and
better suited.
With this patch we avoid parsing "max-object-size" with atoi() and we store its
value as an unsigned int to prevent bad implicit conversion issues especially
when we compare it with others unsigned value (content length).
With this patch we check that shctx_init() does not returns 0.
This is possible if the maxblocks argument, which is passed as an
int, is negative due to an implicit conversion.
Must be backported to 1.8.
With this patch we support cache size larger than 2047 (MB) and prevent haproxy from crashing when "total-max-size" is parsed as negative values by atoi().
The limit at parsing time is 4095 MB (UINT_MAX >> 20).
May be backported to 1.8.
This patch adds "max-object-size" option to the cache to limit
the size in bytes of the HTTP objects to be cached. When not provided,
the maximum size of an HTTP object is a 256th of the cache size.
This patch makes the capable of storing HTTP objects larger than a buffer.
It makes usage of the "block by block shared object allocation" new shctx API.
A new pointer to struct shared_block has been added to the cache applet
context to memorize the next block to be used by the HTTP cache I/O handler
http_cache_io_handler() to emit the data. Another member, named "sent" memorize
the number of bytes already sent by this handler. So, to send an object from cache,
http_cache_io_handler() must be called until "sent" counter reaches the size
of this object.
This patch makes shctx capable of storing objects in several parts,
each parts being made of several blocks. There is no more need to
walk through until reaching the end of a row to append new blocks.
A new pointer to a struct shared_block member, named last_reserved,
has been added to struct shared_block so that to memorize the last block which was
reserved by shctx_row_reserve_hot(). Same thing about "last_append" pointer which
is used to memorize the last block used by shctx_row_data_append() to store the data.
Fred reported a random crash related to the pools. This was introduced
by commit e18db9e98 ("MEDIUM: pools: implement a thread-local cache for
pool entries") because the minimum pool item size should have been
increased to 32 bytes to accommodate the 2 double-linked lists.
No backport is needed.
This option makes a proxy use only HTX-compatible muxes instead of the
HTTP-compatible ones for HTTP modes. It must be set on both ends, this
is checked at parsing time.
With the previous connection model, when we purposely decided to stop
receiving in order to avoid polling after a complete request was received
for example, it was needed to set SI_FL_WAIT_ROOM to prevent receive
polling from being re-armed. Now with the new subscription-based model
there is no such thing anymore and there is noone to remove this flag
either. Thus if a request takes more than one packet to come in or
spans over too many packets, this flag will cause it to wait forever.
Let's simply remove this flag now.
This patch should not be backported since older versions still need
that this flag is set here to stop receiving.
Some samples representing time will cover more than one sample at once
if they are units of time per time. For this we'd need to have the
ability to loop over swrate_add() multiple times but that would be
inefficient. By developing the function elevated to power N, it's
visible that some coefficients quickly disappear and that those which
remain at the first order more or less compensate each other.
Thus a simplified version of this function was added to provide a single
value for a given number of samples. Tests with multiple values, window
sizes and sample sizes have shown that it is possible to make it remain
surprisingly accurate (typical error < 0.2% over various large window
and sample sizes, even samples representing up to 1/4 of the window).
Released version 1.9-dev4 with the following main changes :
- BUILD: Allow configuration of pcre-config path
- DOC: clarify force-private-cache is an option
- BUG/MINOR: connection: avoid null pointer dereference in send-proxy-v2
- REORG: http: move the code to different files
- REORG: http: move HTTP rules parsing to http_rules.c
- CLEANUP: http: remove some leftovers from recent cleanups
- BUILD: Makefile: add a "make opts" target to simply show the build options
- BUILD: Makefile: speed up compiler options detection
- BUG/MINOR: backend: check that the mux installed properly
- BUG/MEDIUM: h2: check that the connection is still valid at the end of init()
- BUG/MEDIUM: h2: make h2_stream_new() return an error on memory allocation failure
- REGTEST/MINOR: compatibility: use unix@ instead of abns@ sockets
- MINOR: ssl: cleanup old openssl API call
- MINOR: ssl: generate-certificates for BoringSSL
- BUG/MEDIUM: buffers: Make sure we don't wrap in ci_insert_line2/b_rep_blk.
- MEDIUM: ssl: add support for ciphersuites option for TLSv1.3
- CLEANUP: haproxy: Remove unused variable
- CLEANUP: h1: Fix debug warnings for h1 headers
- CLEANUP: stick-tables: Remove unneeded double (()) around conditional clause
- MEDIUM: task: perform a single tree lookup per run queue batch
- BUG/MEDIUM: Cur/CumSslConns counters not threadsafe.
- BUG/MINOR: threads: move declaration of capabilities to config.h
- OPTIM: tools: optimize my_ffsl() for x86_64
- BUG/MINOR: h2: null-deref
- BUG/MINOR: checks: queues null-deref
- MINOR: connections: Introduce an unsubscribe method.
- MEDIUM: connections: Change struct wait_list to wait_event.
- BUG/MEDIUM: h2: Make sure we're not in the send list on flow control.
- BUG/MEDIUM: mworker: segfault receiving SIGUSR1 followed by SIGTERM.
- BUG/MEDIUM: stream: Make sure to unsubscribe before si_release_endpoint.
- MINOR: http: Move comment about some HTTP macros in the right header file
- MINOR: stats: Add missing include
- MINOR: http: Export some functions and do cleanup to prepare HTTP refactoring
- MEDIUM: http: Ignore http-pretend-keepalive option on frontend
- MEDIUM: http: Ignore http-tunnel option on backend
- MINOR: http: Use same flag for httpclose and forceclose options
- MINOR: h1: Add EOH marker during headers parsing
- MINOR: conn-stream: Add CL_FL_NOT_FIRST flag
- MINOR: h1: Change the union h1_sl to use indirect strings to store infos
- MINOR: h1: Add the flag H1_MF_NO_PHDR to not add pseudo-headers during parsing
- MINOR: log: make sess_log() support sess=NULL
- MINOR: chunk: add chunk_cpy() and chunk_cat()
- MEDIUM: h2: stop relying on H2_SS_IDLE / H2_SS_CLOSED
- CLEANUP: h2: rename h2c_snd_settings() to h2c_send_settings()
- MINOR: h2: don't try to send data before preface
- MINOR: h2: unify the mux init function
- MINOR: h2: retrieve the front proxy from the caller instead of the session
- MINOR: h2: split h2c_stream_new() into h2s_new() + h2c_frt_stream_new()
- MINOR: h2: add a new flag to quickly distinguish front vs back connection
- BUG/MEDIUM: mworker: don't poll on LI_O_INHERITED listeners
- BUG/MEDIUM: stream: don't crash on out-of-memory
- BUILD: compiler: add a new statement "__unreachable()"
- BUILD: lua: silence some compiler warnings about potential null derefs
- BUILD: ssl: fix null-deref warning in ssl_fc_cipherlist_str sample fetch
- BUILD: ssl: fix another null-deref warning in ssl_sock_switchctx_cbk()
- BUILD: stick-table: make sure not to fail on task_new() during initialization
- BUILD: peers: check allocation error during peers_init_sync()
- MINOR: tools: add a new function atleast2() to test masks for more than 1 bit
- MINOR: config: use atleast2() instead of my_popcountl() where relevant
- MEDIUM: fd/threads: only grab the fd's lock if the FD has more than one thread
- MAJOR: tasks: create per-thread wait queues
- OPTIM: tasks: group all tree roots per cache line
- DOC: Fix a few typos
- MINOR: pools: allocate most memory pools from an array
- MINOR: pools: split pool_free() in the lockfree variant
- MEDIUM: pools: implement a thread-local cache for pool entries
- BUG/MEDIUM: threads: fix thread_release() at the end of the rendez-vous point
- Revert "BUILD: lua: silence some compiler warnings about potential null derefs"
- BUILD: lua: silence some compiler warnings about potential null derefs (#2)
- MINOR: lua: all functions calling lua_yieldk() may return
- BUILD: lua: silence some compiler warnings after WILL_LJMP
- BUILD: Makefile: silence an option conflict warning with clang
- MINOR: server: Use memcpy() instead of strncpy().
- CLEANUP: state-file: make the path concatenation code a bit more consistent
- MINOR: build: Disable -Wstringop-overflow.
- MINOR: cfgparse: Write 130 as 128 as 0x82 and 0x80.
- MINOR: peers: use defines instead of enums to appease clang.
- DOC: fix reference to map files in MAINTAINERS
- MINOR: fd: centralize poll timeout computation in compute_poll_timeout()
- MINOR: poller: move time and date computation out of the pollers
- BUILD: memory: fix pointer declaration for atomic CAS
- BUILD: Makefile: add USE_RT to pass -lrt for clock_gettime() and friends
- MINOR: time: add now_mono_time() and now_cpu_time()
- MEDIUM: time: measure the time stolen by other threads
- BUILD: memory: fix free_list pointer declaration again for atomic CAS
- BUILD: compiler: rename __unreachable() to my_unreachable()
- BUG/MEDIUM: pools: Fix the usage of mmap()) with DEBUG_UAF.
- BUILD: memory: fix free_list pointer declaration again for atomic CAS
- BUG/MEDIUM: h2: Close connection if no stream is left an GOAWAY was sent.
- BUG/MEDIUM: connections: Remove subscription if going in idle mode.
- BUG/MEDIUM: stream: Make sure polling is right on retry.
- MINOR: h2: Make sure to return 1 in h2_recv() when needed.
- MEDIUM: connections: Don't directly mess with the polling from the upper layers.
- MINOR: streams: Call tasklet_free() after si_release_endpoint().
- MINOR: connection: Add a SUB_CALL_UNSUBSCRIBE event.
- MINOR: h2: Don't run tasks that are waiting to send if mux in full.
- MINOR: ebtree: save 8 bytes in struct eb32sc_node
There is a 4-bytes hole in this structure after the eb_node and the
last field is 4-bytes as well, resulting in a total of 64 bytes with
8 bytes holes. Just moving the key after the eb_node (like in eb32_node)
fills the hole and reduces the structure's size by 8 bytes.
We wake up all the streams waiting to send data when we have space available
in the mux buffer. Doing so means we probably wake way too many streams,
because after a few the buffer will probably be full instead. So keep a
list of all the streams that are about to send data, and if we detect that
the buffer is full, unschedule the tasks and put the streams back to the
send_list.
Make sure we call tasklet_free() only after si_release_endpoint(), when the
unsubscribe() method has been called, so that we're sure the mux won't
attempt to access the taslet.
Avoid using conn_xprt_want_send/recv, and totally nuke cs_want_send/recv,
from the upper layers. The polling is now directly handled by the connection
layer, it is activated on subscribe(), and unactivated once we got the event
and we woke the related task.
In h2_recv(), return 1 if we have data available, or if h2_recv_allowed()
failed, to be sure h2_process() is called.
Also don't subscribe if our buffer is full.
When retrying to connect to a server, because the previous connection failed,
make sure if we subscribed to the previous connection, the polling flags will
be true for the new fd.
No backport is needed.
Make sure we don't have any subscription when the connection is going in
idle mode, otherwise there's a race condition when the connection is
reused, if there are still old subscriptions, new ones won't be done.
No backport is needed.
When we're closing a stream, is there's no stream left and a goaway was sent,
close the connection, there's no reason to keep it open.
[wt: it's likely that this is needed in 1.8 as well, though it's unclear
how to trigger this issue, some tests are needed]
