Quantcast
Channel: Serverphorums.com - HAProxy
Viewing all 5112 articles
Browse latest View live

[SPAM] SOE技术参数 (no replies)


CIDR Notation in ACL -- silent failure (no replies)

$
0
0
Hi!

I noticed that while this ACL matches my source IP of 192.168.42.123:

acl src_internal_net src 192.168.42.0/24

this one does _not_:

acl src_internal_net src 192.168.42/24

While not strictly part of RFC 4632 (yet), leaving out trailing .0
octets is a very common notation and is probably going to be included
in a future RFC update (as per Errata 1577):
https://www.rfc-editor.org/errata_search.php?rfc=4632&eid=1577

If there are concerns against this notation, the config parser should
at least issue a WARNING or even ERROR about this, because I found it
it quite confusing. Especially if ACLs are used for actual access
control, this can have nasty consequences.

What do you think?

Cheers,
Daniel


--
Daniel Schneller
Principal Cloud Engineer
CenterDevice GmbH

[PATCH 1/4]: BUG/MINOR : server: risk of over reading the pref_net array. (no replies)

$
0
0
Hi,

here a first patch among a small patchset.

Kind regards.

[PATCH 2/4]: BUG/MINOR: cfgparse: couple of small memory leaks. (no replies)

$
0
0
Hi,

Here the second patch, just fixing small memory leaks.

Kind regards.

[PATCH 3/4] : CLEANUP: sample: initialize the pointer before parse_binary call. (no replies)

$
0
0
Hi,

Here this is a tiny change, hope it finds its way.

Kind regards.

[PATCH 4/4]: CLEANUP: proto_uxst: initialize socket before setting. (no replies)

$
0
0
Hi,

This one might not find this way as it might then having a performance hit,
I was outweighting the outcome for this patch myself ... We ll see.

Regards.

LUA: Skip HTTP headers and forward TCP traffic (no replies)

$
0
0
Hi everybody,

I try to connect to an SSH process via proxytunnel. The incoming request carries normal HTTP headers that I have to skip those in order to forward further encrypted SSH traffic to an SSH process. I thought I could tackle this task using Lua and register_action, but since it’s my first time working with Lua and haproxy and I got stuck. I hope someone could help me on this topic.

### Output:
Apr 08 10:15:48 HOST docker[4059]: [info] 098/101548 (12) : connect-ssh
Apr 08 10:15:48 HOST docker[4059]: [debug] 098/101548 (12) : CONNECT 127.0.0.1:22 HTTP/1.1..
Apr 08 10:15:48 HOST docker[4059]: [debug] 098/101548 (12) : Host: FQDN..
Apr 08 10:15:48 HOST docker[4059]: [debug] 098/101548 (12) : Proxy-Connection: Keep-Alive..
Apr 08 10:15:48 HOST docker[4059]: [debug] 098/101548 (12) : X-Forwarded-Proto: https..
Apr 08 10:15:48 HOST docker[4059]: [debug] 098/101548 (12) : X-Forwarded-For: IP..
Apr 08 10:15:48 HOST docker[4059]: [debug] 098/101548 (12) : ..
Apr 08 10:15:53 HOST docker[4059]: [ALERT] 098/101553 (12) : Lua function 'connect-ssh': yield not allowed.

### haproxy.cfg:
global
lua-load /etc/haproxy/proxytunnel.lua



frontend multiplex-ssh-http
bind :80
mode tcp
option tcplog
tcp-request inspect-delay 5s
tcp-request content lua.connect-ssh if METH_CONNECT

# Detect SSH connection attempts
acl client_attempts_ssh payload(0,7) -m bin 5353482d322e30

use_backend tcp-ssh if client_attempts_ssh
default_backend http-nginx

backend tcp-ssh
mode tcp
option tcplog
server ssh dockerhost:22
timeout server 2h



### proxytunnel.lua:
function string.starts(haystack, needle)
return haystack:sub(1, needle:len()) == needle
end

core.register_action('connect-ssh', { "tcp-req" }, function(txn)
local line = txn.req:getline();

txn:Info("connect-ssh");

if line == nil then
txn:Debug("Got nil, skipping...");
return
elseif not line:starts("CONNECT 127.0.0.1:22 HTTP/1.1") then
txn:Debug("No match, got " .. line .. ", skipping...");
return
end

repeat -- skip headers
txn:Debug(line);
line = txn.req:getline();
until line == nil or line == "";

return

end);

King regards
Florian Aßmann

HAProxy pass-through TLS with SNI (no replies)

$
0
0
Hello,

Is it possible to use the TCP proxy mode to pass-through TLS and to distribute based on SNI even if the protocol is not HTTP ?


I understand it is possible to forward base on the SNI (www.example.com) contained in a http URI like: http://Jojo:lApIn@www.example.com:8888
But if the URI is

- mqtt://Jojo:lApIn@www.example.com:8888 or

- amqp://Jojo:lApIn@www.example.com:8888
is it possible to have the same behavior as for http ? without any special configuration of HAProxy ?

Thanks in advance

Best regards
Pascal Reungoat

Conditionally include unique-id-header (3 replies)

$
0
0
Hi all,

I’m trying to replicate functionality from a previous load balancer in HAProxy, and the final sticking point seems to be the unique ID header. I found the unique-id-header and unique-id-format commands, which are great, but what I want to do is only add a unique-id-header if there is not already one present. If there is one present, I do not want to add another one (which is what seems to be happening by default).

I’ve tried adding a conditional:

acl unique_id_missing hdr_cnt(X-Unique-ID) eq 0
unique-id-format %{+X}o\ %ci-%cp-%rt-%pid-%Ts%fp
unique-id-header X-Unique-ID if unique_id_missing

But that does not seem to be working. Should it? If not, is there another way to go about this?

Thanks!
Scott

This email message contains information that Motus, LLC considers confidential and/or proprietary, or may later designate as confidential and proprietary. It is intended only for use of the individual or entity named above and should not be forwarded to any other persons or entities without the express consent of Motus, LLC, nor should it be used for any purpose other than in the course of any potential or actual business relationship with Motus, LLC. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify sender immediately and destroy the original message.

Internal Revenue Service regulations require that certain types of written advice include a disclaimer. To the extent the preceding message contains advice relating to a Federal tax issue, unless expressly stated otherwise the advice is not intended or written to be used, and it cannot be used by the recipient or any other taxpayer, for the purpose of avoiding Federal tax penalties, and was not written to support the promotion or marketing of any transaction or matter discussed herein.

同类产品优缺点对比 (no replies)

$
0
0
Dear all:

详情请查阅附件

当一个企业从单一产品线向多产品线跨越的时候,必须突破的一个瓶颈就是公司产品经理的培养,
因为产品经理是公司价值链中最重要的一个环节,是直接面向客户、带领团队创造价值的领军人物,
因此产品经理个人及其所率领的团队的能力往往决定了该产品在市场上的竞争力。
然而,很多发展中的企业在构建产品管理体系和培养产品经理的过程中却面临很多困惑

------------------ 原始邮件 ------------------
发件人: wtr@wer.com
发送时间: 2016-4-9(星期二) 下午3:59:54
收件人: haproxy@formilux.org
主题: 回覆: 回复:同类产品优缺点对比


您好!
国内很多科技企业普遍存在如下问题:
产品开发闭门造车,只关注技术,不关注客户,研发从早忙到晚,产品开发的不少,但赚钱的产品屈指可数
产品开发出来才找客户、找卖点,销售人员报怨我们的产品从娘胎中出来就躺在担架上,产品没有优势,
也不知道竞争对手产品的弱点,但我们产品的弱点往往被对手抓住.
几乎没有产品路标的规划,有规划也主要是技术驱动,客户需求到不了规划人员手中,公司神经末梢与大脑失去联系.
了解市场的不懂技术,懂技术的不了解市场,不知道需求应该谁负责,缺少完备的需求收集、汇总、分析机制
把销售驱动误以为是市场驱动,销售人员反馈的需求往往是短期行为、而且很个性化,
研发总是被这些短平快的个性化需求驱动的团团转,还被老板骂“你们这帮笨蛋,怎么搞不出几个拳头产品出来?”……
=============================
Thank you and best regards
无锡星洲医药有限公司

[PATCH 2/2] BUG/MEDIUM: dns: fix alignment issue when building DNS queries (1 reply)

$
0
0
From: Vincent Bernat <vincent@bernat.im>

On some architectures, unaligned access is not authorized. On most
architectures, it is just slower. Therefore, we have to use memcpy()
when an unaligned access is needed, specifically when writing the qinfo.

Also remove the unaligned access when reading answer count when reading
the answer. It's likely that this instruction was optimized away by the
compiler since it is unneeded. Add a comment to explain why we use 7 as
an offset instead of 6. Not an unaligned offset since "resp" is
"unsigned char", then promoted to int.
---
src/dns.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/src/dns.c b/src/dns.c
index 3906742bce36..3b3dfc59e065 100644
--- a/src/dns.c
+++ b/src/dns.c
@@ -619,8 +619,7 @@ int dns_get_ip_from_response(unsigned char *resp, unsigned char *resp_end,
cname = *newip = newip4 = newip6 = NULL;
cnamelen = currentip_found = 0;
*newip_sin_family = AF_UNSPEC;
- ancount = (((struct dns_header *)resp)->ancount);
- ancount = *(resp + 7);
+ ancount = *(resp + 7); /* Assume no more than 256 answers */

/* bypass DNS response header */
reader = resp + sizeof(struct dns_header);
@@ -975,7 +974,7 @@ int dns_init_resolvers(void)
int dns_build_query(int query_id, int query_type, char *hostname_dn, int hostname_dn_len, char *buf, int bufsize)
{
struct dns_header *dns;
- struct dns_question *qinfo;
+ struct dns_question qinfo;
char *ptr, *bufend;

memset(buf, '\0', bufsize);
@@ -1021,9 +1020,9 @@ int dns_build_query(int query_id, int query_type, char *hostname_dn, int hostnam
return -1;

/* set up query info (type and class) */
- qinfo = (struct dns_question *)ptr;
- qinfo->qtype = htons(query_type);
- qinfo->qclass = htons(DNS_RCLASS_IN);
+ qinfo.qtype = htons(query_type);
+ qinfo.qclass = htons(DNS_RCLASS_IN);
+ memcpy(ptr, &qinfo, sizeof(qinfo));

ptr += sizeof(struct dns_question);

--
2.8.0.rc3

[PATCH 1/2] BUG/MINOR: dns: fix DNS header definition (no replies)

$
0
0
From: Vincent Bernat <vincent@bernat.im>

Conforming to RFC 2535, section 6.1. This is not an important bug as
those fields don't seem to be set to something else than 0 and to be
checked on answers.
---
include/types/dns.h | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/types/dns.h b/include/types/dns.h
index 757eaaf28d9a..98adc983bf44 100644
--- a/include/types/dns.h
+++ b/include/types/dns.h
@@ -63,16 +63,16 @@
/* DNS request or response header structure */
struct dns_header {
unsigned short id:16; /* identifier */
- unsigned char rd :1; /* recursion desired 0: no, 1: yes */
- unsigned char tc :1; /* truncation 0:no, 1: yes */
- unsigned char aa :1; /* authoritative answer 0: no, 1: yes */
- unsigned char opcode :4; /* operation code */
unsigned char qr :1; /* query/response 0: query, 1: response */
- unsigned char rcode :4; /* response code */
- unsigned char z :1; /* no used */
+ unsigned char opcode :4; /* operation code */
+ unsigned char aa :1; /* authoritative answer 0: no, 1: yes */
+ unsigned char tc :1; /* truncation 0:no, 1: yes */
+ unsigned char rd :1; /* recursion desired 0: no, 1: yes */
+ unsigned char ra :1; /* recursion available 0: no, 1: yes */
+ unsigned char z :1; /* not used */
unsigned char ad :1; /* authentic data */
unsigned char cd :1; /* checking disabled */
- unsigned char ra :1; /* recursion available 0: no, 1: yes */
+ unsigned char rcode :4; /* response code */
unsigned short qdcount :16; /* question count */
unsigned short ancount :16; /* answer count */
unsigned short nscount :16; /* authority count */
--
2.8.0.rc3

[PATCH] CLEANUP: .gitignore cleanup (1 reply)

$
0
0
From: Vincent Bernat <vincent@bernat.im>

..gitignore is an odd beast. All the stuff at the beginning is useless
since in the bottom part starts with /.* and /*. Therefore, the top part
is useless. Moreover, the bottom part makes unignore *.o and
friends. Add it back at the bottom.
---
.gitignore | 49 +------------------------------------------------
1 file changed, 1 insertion(+), 48 deletions(-)

diff --git a/.gitignore b/.gitignore
index 0292bcc1b4ce..54c9cdeb3a3b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,51 +1,3 @@
-*.o
-*/.svn
-*~
-.flxdisk*
-.flxpkg
-.flxstatus*
-.svn
-haproxy
-src/*.o
-*.rej
-*.orig
-*.log*
-*.trace*
-haproxy-*
-!doc/haproxy-*.txt
-!src/*.c
-make-*
-dlmalloc.c
-00*.patch
-*.service
-*.bak
-.nfs*
-contrib/base64/base64rev
-contrib/halog/halog
-contrib/ip6range/ip6range
-contrib/iprange/iprange
-tests/test_hashes
-/*.cfg
-/*.conf
-/*.diff
-/*.patch
-/*.c
-/*.o
-/*.so
-/*.txt
-/*.TXT
-/*.txt.*
-/*.prof
-/*.gprof
-/*.prof.*
-/*.gprof.*
-/*.tar
-/*.tar.gz
-/*.tgz
-/*.mbox
-/*.sh
-/bug*
-/TAGS
# Below we forbid everything and only allow what we know, that's much easier
# than blocking about 500 different test files and bug report outputs.
/.*
@@ -69,3 +21,4 @@ tests/test_hashes
!/src
!/tests
!/debian
+*.o
--
2.8.0.rc3

[SPAM] Créez votre top avec Scottage ! (no replies)

建立“以客户为中心、以市场为导向”的研发体系 (no replies)

$
0
0
Dear all:

附件是您要的资料

上海友拓实业有限公司

陆主任

unsubscribe (no replies)

Patch documentation 1.5.x (no replies)

$
0
0
Hi,

There is small discrepancy in the documentation for version 1..5.x.
req.uri is used where it should be capture.req.uri.
Also no scheme is used resulting in a redirect loop.

Patch as follows:

# diff -u /usr/share/doc/haproxy-1.5.15/configuration.txt
/usr/share/doc/haproxy-1.5.15/configuration.txt.new
--- /usr/share/doc/haproxy-1.5.15/configuration.txt 2015-11-05
14:55:32.000000000 +0100
+++ /usr/share/doc/haproxy-1.5.15/configuration.txt.new 2016-04-11
11:28:42.376609464 +0200
@@ -5509,7 +5509,7 @@
redirect scheme https if !{ ssl_fc }

Example: append 'www.' prefix in front of all hosts not having it
- http-request redirect code 301 location www.%[hdr(host)]%[req.uri]
\
+ http-request redirect code 301 location
http://www.%[hdr(host)]%[capture.req.uri]
\
unless { hdr_beg(host) -i www }

See section 7 about ACL usage.

Kind regards,
Coen

unsubscribe (no replies)

Patch: Add predefined METH_PUT and METH_DELETE ACLs (no replies)

$
0
0
Hi!

I virtually every haproxy.cfg I touch I need to define ACLs for
METH_PUT and METH_DELETE in line with the predefined METH_GET,
METH_POST etc.

Unless there is a non-obvious reason I don’t know about (Googling
haproxy METH_PUT/DELETE does not produce anything apparent), I offer
the attached small patch to add them.




Cheers,
Daniel

--
Daniel Schneller
Principal Cloud Engineer
CenterDevice GmbH
daniel.schneller@centerdevice.de | www.centerdevice.de

[SPAM] Profitez des aides de l'état pour changer vos fénêtres (no replies)

$
0
0
MieuxLoger.com &nbsp; Cliquez ici pour lire cet e-mail dans votre navigateur. &nbsp; Fabrication sous 10 Jours Fourniture et pose Prix direct usine Fabrication française &nbsp; &nbsp; Se d&eacute;sabonner
Viewing all 5112 articles
Browse latest View live




Latest Images