summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* BUILD: globally enable -Wundef20210830-wundef-1Willy Tarreau2021-08-301-1/+1
| | | | | | | | As seen in issue #1369, supporting #if with unknown macros can silently hide typos that may result in suboptimal code paths to be used, or even possibly bugs. It looks like our code base does not rely that much on this, so it's worth enabling -Wundef to catch future ones and have them turned to more explicit "#if defined()" or #ifdef.
* BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSLWilly Tarreau2021-08-302-2/+2
| | | | | | | | One was in backend.c and the other one in hlua.c. No other candidate was found with "git grep '^#if\s*USE'". It's worth noting that 3 other such tests exist for SSL_OP_NO_{SSLv3,TLSv1_1,TLSv1_2} but that these ones are properly set to 0 in openssl-compat.h when not defined.
* BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBERWilly Tarreau2021-08-301-3/+3
| | | | | | Other build warnings were emitted on LIBRESSL_VERSION_NUMBER with -Wundef under openssl < 1.1. Related to GH issue #1369. Seems like some of them could be simplified a little bit.
* BUG/MINOR: tools: Fix loop condition in dump_text()Tim Duesterhus2021-08-301-2/+2
| | | | | | | | | | | The condition should first check whether `bsize` is reached, before dereferencing the offset. Even if this always works fine, due to the string being null-terminated, this certainly looks odd. Found using GitHub's CodeQL scan. This bug traces back to at least 97c2ae13bc0d7961a348102d6719fbcaf34d46d5 (1.7.0+) and this patch should be backported accordingly.
* BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)timeTim Duesterhus2021-08-302-22/+16
| | | | | | | | | | Using localtime / gmtime is not thread-safe, whereas the `get_*` wrappers are. Found using GitHub's CodeQL scan. The use in sample_conv_ltime() can be traced back to at least fac9ccfb705702f211f99e67d5f5d5129002086a (first appearing in 1.6-dev3), so all supported branches with thread support are affected.
* [RELEASE] Released version 2.5-dev5v2.5-dev5Willy Tarreau2021-08-284-3/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Released version 2.5-dev5 with the following main changes : - MINOR: httpclient: initialize the proxy - MINOR: httpclient: implement a simple HTTP Client API - MINOR: httpclient/cli: implement a simple client over the CLI - MINOR: httpclient/cli: change the User-Agent to "HAProxy" - MEDIUM: ssl: Keep a reference to the client's certificate for use in logs - BUG/MEDIUM: h2: match absolute-path not path-absolute for :path - BUILD/MINOR: ssl: Fix compilation with OpenSSL 1.0.2 - MINOR: server: check if srv is NULL in free_server() - MINOR: proxy: check if p is NULL in free_proxy() - BUG/MEDIUM: cfgparse: do not allocate IDs to automatic internal proxies - BUG/MINOR: http_client: make sure to preset the proxy's default settings - REGTESTS: http_upgrade: fix incorrect expectation on TCP->H1->H2 - REGTESTS: abortonclose: after retries, 503 is expected, not close - REGTESTS: server: fix agent-check syntax and expectation - BUG/MINOR: httpclient: fix uninitialized sl variable - BUG/MINOR: httpclient/cli: change the appctx test in the callbacks - BUG/MINOR: httpclient: check if hdr_num is not 0 - MINOR: httpclient: cleanup the include files - MINOR: hlua: take the global Lua lock inside a global function - MINOR: tools: add FreeBSD support to get_exec_path() - BUG/MINOR: systemd: ExecStartPre must use -Ws - MINOR: systemd: remove the ExecStartPre line in the unit file - MINOR: ssl: add an openssl version string parser - MINOR: cfgcond: implements openssl_version_atleast and openssl_version_before - CLEANUP: ssl: remove useless check on p in openssl_version_parser() - BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions - BUG/MINOR: httpclient: remove deinit of the httpclient - BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec} - MINOR: httpclient: set verify none on the https server - MINOR: httpclient: add the server to the proxy - BUG/MINOR: httpclient: fix Host header - BUILD: httpclient: fix build without OpenSSL - CI: github-actions: remove obsolete options - CLEANUP: assorted typo fixes in the code and comments - MINOR: proc: setting the process to produce a core dump on FreeBSD. - BUILD: adopt script/build-ssl.sh for OpenSSL-3.0.0beta2 - MINOR: server: return the next srv instance on free_server - BUG/MINOR: stats: use refcount to protect dynamic server on dump - MEDIUM: server: extend refcount for all servers - MINOR: server: define non purgeable server flag - MINOR: server: mark referenced servers as non purgeable - MINOR: server: mark servers referenced by LUA script as non purgeable - MEDIUM: server: allow to remove servers at runtime except non purgeable - BUG/MINOR: base64: base64urldec() ignores padding in output size check - REGTEST: add missing lua requirements on server removal test - REGTEST: fix haproxy required version for server removal test - BUG/MINOR: proxy: don't dump servers of internal proxies - REGTESTS: Use `feature cmd` for 2.5+ tests - REGTESTS: Remove REQUIRE_VERSION=1.5 from all tests - BUG/MINOR: resolvers: mark servers with name-resolution as non purgeable - MINOR: compiler: implement an ONLY_ONCE() macro - BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords - MEDIUM: ssl: Capture more info from Client Hello - MINOR: sample: Expose SSL captures using new fetchers - MINOR: sample: Add be2dec converter - MINOR: sample: Add be2hex converter - MEDIUM: config: Deprecate tune.ssl.capture-cipherlist-size - BUG/MINOR: time: fix idle time computation for long sleeps - MINOR: time: add report_idle() to report process-wide idle time - BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long - BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING - BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef - BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef - IMPORT: slz: silence a build warning with -Wundef - BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef
* BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -WundefWilly Tarreau2021-08-281-2/+2
| | | | | regex-t emits a warning on #elif USE_PCRE2 when built with -Wundef, let's just fix it. This was reported in GH issue #1369.
* IMPORT: slz: silence a build warning with -WundefWilly Tarreau2021-08-281-1/+1
| | | | | | | The test on FIND_OPTIMAL_MATCH for the experimental code can yield a build warning when using -Wundef, let's turn it into a regular ifdef. This is slz upstream commit 05630ae8f22b71022803809eb1e7deb707bb30fb
* BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -WundefWilly Tarreau2021-08-281-1/+1
| | | | | | Openssl-compat emits a warning for the test on LIBRESSL_VERSION that might be underfined, if built with -Wundef. The fix is easy, let's do it. Related to GH issue #1369.
* BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -WundefWilly Tarreau2021-08-281-1/+1
| | | | | | As reported in GH issue #1369, there is a single case of #if with a possibly undefined value in defaults.h which is on MAXHOSTNAMELEN. Let's turn it to a #ifdef.
* BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILINGWilly Tarreau2021-08-281-4/+4
| | | | | This avoids most build warnings with -Wundef, and all other USE_* flags are tested this way, let's do it there as well. See gh issue #1369.
* BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per longWilly Tarreau2021-08-281-18/+26
| | | | | | | | | | | | The code used to rely on BITS_PER_LONG to decide on the most efficient way to perform a 64-bit shift, but this macro is not defined (at best it's __BITS_PER_LONG) and it's likely that it's been like this since the early implementation of ebtrees designed on i386. Let's remove the test on this macro and rely on sizeof(long) instead, it also has the benefit of letting the compiler validate the two branches. This can be backported to all versions. Thanks to Ezequiel Garcia for reporting this one in issue #1369.
* MINOR: time: add report_idle() to report process-wide idle timeWilly Tarreau2021-08-282-3/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before threads were introduced in 1.8, idle_pct used to be a global variable indicating the overall process idle time. Threads made it thread-local, meaning that its reporting in the stats made little sense, though this was not easy to spot. In 2.0, the idle_pct variable moved to the struct thread_info via commit 81036f273 ("MINOR: time: move the cpu, mono, and idle time to thread_info"). It made it more obvious that the idle_pct was per thread, and also allowed to more accurately measure it. But no more effort was made in that direction. This patch introduces a new report_idle() function that accurately averages the per-thread idle time over all running threads (i.e. it should remain valid even if some threads are paused or stopped), and makes use of it in the stats / "show info" reports. Sending traffic over only two connections of an 8-thread process would previously show this erratic CPU usage pattern: $ while :; do socat /tmp/sock1 - <<< "show info"|grep ^Idle;sleep 0.1;done Idle_pct: 30 Idle_pct: 35 Idle_pct: 100 Idle_pct: 100 Idle_pct: 100 Idle_pct: 100 Idle_pct: 100 Idle_pct: 100 Idle_pct: 35 Idle_pct: 33 Idle_pct: 100 Idle_pct: 100 Idle_pct: 100 Idle_pct: 100 Idle_pct: 100 Idle_pct: 100 Now it shows this more accurate measurement: $ while :; do socat /tmp/sock1 - <<< "show info"|grep ^Idle;sleep 0.1;done Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 Idle_pct: 83 This is not technically a bug but this lack of precision definitely affects some users who rely on the idle_pct measurement. This should at least be backported to 2.4, and might be to some older releases depending on users demand.
* BUG/MINOR: time: fix idle time computation for long sleepsWilly Tarreau2021-08-271-1/+1
| | | | | | | | | | | | | | In 2.4 we extended the max poll time from 1s to 60s with commit 4f59d3861 ("MINOR: time: increase the minimum wakeup interval to 60s"). This had the consequence that the calculation of the idle time percentage may overflow during the multiply by 100 if the thread had slept 43s or more. Let's change this to a 64 bit computation. This will have no performance impact since this is done at most twice per second. This should fix github issue #1366. This must be backported to 2.4.
* MEDIUM: config: Deprecate tune.ssl.capture-cipherlist-sizeMarcin Deranek2021-08-2622-48/+55
| | | | | | Deprecate tune.ssl.capture-cipherlist-size in favor of tune.ssl.capture-buffer-size which better describes the purpose of the setting.
* MINOR: sample: Add be2hex converterMarcin Deranek2021-08-263-0/+135
| | | | | Add be2hex converter to convert big-endian binary data into hex string with optional string separators.
* MINOR: sample: Add be2dec converterMarcin Deranek2021-08-263-0/+134
| | | | | | | | | | | | Add be2dec converter which allows to build JA3 compatible TLS fingerprints by converting big-endian binary data into string separated unsigned integers eg. http-request set-header X-SSL-JA3 %[ssl_fc_protocol_hello_id],\ %[ssl_fc_cipherlist_bin(1),be2dec(-,2)],\ %[ssl_fc_extlist_bin(1),be2dec(-,2)],\ %[ssl_fc_eclist_bin(1),be2dec(-,2)],\ %[ssl_fc_ecformats_bin,be2dec(-,1)]
* MINOR: sample: Expose SSL captures using new fetchersMarcin Deranek2021-08-264-21/+276
| | | | | | | | | | | To be able to provide JA3 compatible TLS Fingerprints we need to expose all Client Hello captured data using fetchers. Patch provides new and modifies existing fetchers to add ability to filter out GREASE values: - ssl_fc_cipherlist_* - ssl_fc_ecformats_bin - ssl_fc_eclist_bin - ssl_fc_extlist_bin - ssl_fc_protocol_hello_id
* MEDIUM: ssl: Capture more info from Client HelloMarcin Deranek2021-08-264-18/+142
| | | | | | | | | | | | | When we set tune.ssl.capture-cipherlist-size to a non-zero value we are able to capture cipherlist supported by the client. To be able to provide JA3 compatible TLS fingerprinting we need to capture more information from Client Hello message: - SSL Version - SSL Extensions - Elliptic Curves - Elliptic Curve Point Formats This patch allows HAProxy to capture such information and store it for later use.
* BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywordsWilly Tarreau2021-08-261-4/+2
| | | | | | | | | | | | | The lua initialization code which creates the Lua mapping of all converters and sample fetch keywords makes use of strncpy(), and as such can take ages to start with large values of tune.bufsize because it spends its time zeroing gigabytes of memory for nothing. A test performed with an extreme value of 16 MB takes roughly 4 seconds, so it's possible that some users with huge 1 MB buffers (e.g. for payload analysis) notice a small startup latency. However this does not affect config checks since the Lua stack is not yet started. Let's replace this with strlcpy2(). This should be backported to all supported versions.
* MINOR: compiler: implement an ONLY_ONCE() macroWilly Tarreau2021-08-261-0/+8
| | | | | | | | | | | | | | There are regularly places, especially in config analysis, where we need to report certain things (warnings or errors) only once, but where implementing a counter is sufficiently deterrent so that it's not done. Let's add a simple ONLY_ONCE() macro that implements a static variable (char) which is atomically turned on, and returns true if it's set for the first time. This uses fairly compact code, a single byte of BSS and is thread-safe. There are probably a number of places in the config parser where this could be used. It may also be used to implement a WARN_ON() similar to BUG_ON() but which would only warn once.
* BUG/MINOR: resolvers: mark servers with name-resolution as non purgeableAmaury Denoyelle2021-08-261-0/+2
| | | | | | | | When a server is configured with name-resolution, resolvers objects are created with reference to this server. Thus the server is marked as non purgeable to prevent its removal at runtime. This does not need to be backport.
* REGTESTS: Remove REQUIRE_VERSION=1.5 from all testsTim Duesterhus2021-08-251-1/+0
| | | | | | | | HAProxy 1.5 is EOL, thus this always matches. 1.6 / 1.7 were already removed in: d8be0018fe85b5f815d59cdf1e0400274a99a9b1 (1.6) 1b095cac9468d0c3eeb157e9b1a2947487bd3c83 (1.7)
* REGTESTS: Use `feature cmd` for 2.5+ testsTim Duesterhus2021-08-253-6/+4
| | | | | Using `REQUIRE_VERSION` is deprecated for tests targeting HAProxy with `-cc` support.
* BUG/MINOR: proxy: don't dump servers of internal proxiesWilliam Lallemand2021-08-251-1/+1
| | | | | | | | | | | Patch 211c967 ("MINOR: httpclient: add the server to the proxy") broke the reg-tests that do a "show servers state". Indeed the servers of the proxies flagged with PR_CAP_INT are dumped in the output of this CLI command. This patch fixes the issue par ignoring the PR_CA_INT proxies in the dump.
* REGTEST: fix haproxy required version for server removal testAmaury Denoyelle2021-08-251-1/+1
| | | | The ability to delete all servers is introduced in 2.5 release.
* REGTEST: add missing lua requirements on server removal testAmaury Denoyelle2021-08-252-25/+48
| | | | | | | | | The test that removes server via CLI is using LUA to check that servers referenced in a LUA script cannot be removed. This requires LUA support to be built in haproxy. Split the test and create a new one containing only the LUA relevant test. Mark it as LUA dependant.
* BUG/MINOR: base64: base64urldec() ignores padding in output size checkDragan Dosen2021-08-251-3/+3
| | | | | | | | | | Without this fix, the decode function would proceed even when the output buffer is not large enough, because the padding was not considered. For example, it would not fail with the input length of 23 and the output buffer size of 15, even the actual decoded output size is 17. This patch should be backported to all stable branches that have a base64urldec() function available.
* MEDIUM: server: allow to remove servers at runtime except non purgeableAmaury Denoyelle2021-08-255-56/+155
| | | | | | | | | | | | | | | | | Relax the condition on "delete server" CLI handler to be able to remove all servers, even non dynamic, except if they are flagged as non purgeable. This change is necessary to extend the use cases for dynamic servers with reload. It's expected that each dynamic server created via the CLI is manually commited in the haproxy configuration by the user. Dynamic servers will be present on reload only if they are present in the configuration file. This means that non-dynamic servers must be allowed to be removable at runtime. The dynamic servers removal reg-test has been updated and renamed to reflect its purpose. A new test is present to check that non-purgeable servers cannot be removed.
* MINOR: server: mark servers referenced by LUA script as non purgeableAmaury Denoyelle2021-08-251-1/+3
| | | | | | Each server that is retrieved by a LUA script is marked as non purgeable. Note that for this to work, the script must have been executed already once.
* MINOR: server: mark referenced servers as non purgeableAmaury Denoyelle2021-08-253-0/+4
| | | | | | | | Mark servers that are referenced by configuration elements as non purgeable. This includes the following list : - tracked servers - servers referenced in a use-server rule - servers referenced in a sample fetch
* MINOR: server: define non purgeable server flagAmaury Denoyelle2021-08-251-0/+1
| | | | | | Define a flag to mark a server as non purgeable. This flag will be used for "delete server" CLI handler. All servers without this flag will be eligible to runtime suppression.
* MEDIUM: server: extend refcount for all serversAmaury Denoyelle2021-08-258-40/+28
| | | | | | | | | | | | | | | | | | | | | | | | | In a future patch, it will be possible to remove at runtime every servers, both static and dynamic. This requires to extend the server refcount for all instances. First, refcount manipulation functions have been renamed to better express the API usage. * srv_refcount_use -> srv_take The refcount is always initialize to 1 on the server creation in new_server. It's also incremented for each check/agent configured on a server instance. * free_server -> srv_drop This decrements the refcount and if null, the server is freed, so code calling it must not use the server reference after it. As a bonus, this function now returns the next server instance. This is useful when calling on the server loop without having to save the next pointer before each invocation. In these functions, remove the checks that prevent refcount on non-dynamic servers. Each reference to "dynamic" in variable/function naming have been eliminated as well.
* BUG/MINOR: stats: use refcount to protect dynamic server on dumpAmaury Denoyelle2021-08-253-6/+20
| | | | | | | | | | | | | | A dynamic server may be deleted at runtime at the same moment when the stats applet is pointing to it. Use the server refcount to prevent deletion in this case. This should be backported up to 2.4, with an observability period of 2 weeks. Note that it requires the dynamic server refcounting feature which has been implemented on 2.5; the following commits are required : - MINOR: server: implement a refcount for dynamic servers - BUG/MINOR: server: do not use refcount in free_server in stopping mode - MINOR: server: return the next srv instance on free_server
* MINOR: server: return the next srv instance on free_serverAmaury Denoyelle2021-08-253-8/+16
| | | | | | | | As a convenience, return the next server instance from servers list on free_server. This is particularily useful when using this function on the servers list without having to save of the next pointer before calling it.
* BUILD: adopt script/build-ssl.sh for OpenSSL-3.0.0beta2Ilya Shipitsin2021-08-251-2/+2
| | | | | | | starting with https://github.com/openssl/openssl/commit/74b7f339aa58af57c0e71b7efca66e6f2db5ae2e, libs are installed to "lib64", to get back required behaviour, let us set libdir explicitly
* MINOR: proc: setting the process to produce a core dump on FreeBSD.devnexen@gmail.com2021-08-252-3/+13
| | | | | | using the procctl api to set the current process as traceable, thus being able to produce a core dump as well. making it as compile option if not wished or using freebsd prior to 11.x (last no EOL release).
* CLEANUP: assorted typo fixes in the code and commentsIlya Shipitsin2021-08-253-27/+27
| | | | This is 26th iteration of typo fixes
* CI: github-actions: remove obsolete optionsWilly Tarreau2021-08-251-3/+0
| | | | | | | | 2.5-dev1 removed http-use-htx but the h2spec config was not updated accordingly, causing failures. In addition, let's also remove the unneeded "nbthread 4" which is either too much or not enough (it's automatic nowadays), and remove "option httplog" which causes a warning since there's no defined log destination.
* BUILD: httpclient: fix build without OpenSSLWilliam Lallemand2021-08-241-2/+17
| | | | Add some defines around the ssl server so we can build without OpenSSL.
* BUG/MINOR: httpclient: fix Host headerWilliam Lallemand2021-08-241-0/+2
| | | | | | | | THe http_update_update_host function takes an URL and extract the domain to use as a host header. However it only update an existing host header and does not create one. This patch add an empty host header so the function can update it.
* MINOR: httpclient: add the server to the proxyWilliam Lallemand2021-08-241-1/+6
| | | | | | Add the raw and ssl server to the proxy list so they can be freed during the deinit() of HAProxy. As a side effect the 2 servers need to have a different ID so the SSL one was renamed "<HTTPSCLIENT>".
* MINOR: httpclient: set verify none on the https serverWilliam Lallemand2021-08-241-0/+2
| | | | | | There is currently no way to specify the CA to verify from the httpclient API. Sets the verify to none so we can still do https request.
* BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}Dragan Dosen2021-08-241-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Ensure that no more than olen bytes is written to the output buffer, otherwise we might experience an unexpected behavior. While the original code used to validate that the output size was always large enough before starting to write, this validation was later broken by the commit below, allowing to 3-byte blocks to areas whose size is not multiple of 3: commit ed697e4856e5ac0b9931fd50fd8ff1b7739e5d88 Author: Emeric Brun <ebrun@haproxy.com> Date: Mon Jan 14 14:38:39 2019 +0100 BUG/MINOR: base64: dec func ignores padding for output size checking Decode function returns an error even if the ouptut buffer is large enought because the padding was not considered. This case was never met with current code base. For base64urldec(), it's basically the same problem except that since the input format supports arbitrary lengths, the problem has always been there since its introduction in 2.4. This should be backported to all stable branches having a backport of the patch above (i.e. 2.0), with some adjustments depending on the availability of the base64dec() and base64urldec().
* BUG/MINOR: httpclient: remove deinit of the httpclientWilliam Lallemand2021-08-241-9/+0
| | | | | | The httpclient does a free of the servers and proxies it uses, however since we are including them in the global proxy list, haproxy already free them during the deinit. We can safely remove these free.
* BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressionsWilly Tarreau2021-08-241-2/+5
| | | | | | | | | | | | | | | | | | | | The sc-set-gpt0() parser was extended in 2.1 by commit 0d7712dff ("MINOR: stick-table: allow sc-set-gpt0 to set value from an expression") to support sample expressions in addition to plain integers. However there is a subtlety there, which is that while the arg position must be incremented when parsing an integer, it must not be touched when calling an expression since the expression parser already does it. The effect is that rules making use of sc-set-gpt0() followed by an expression always ignore one word after that expression, and will typically fail to parse if followed by an "if" as the parser will restart after the "if". With no condition it's different because an empty condition doesn't result in trying to parse anything. This patch moves the increment at the right place and adds a few explanations for a code part that was far from being obvious. This should be backported to branches having the commit above (2.1+).
* CLEANUP: ssl: remove useless check on p in openssl_version_parser()William Lallemand2021-08-221-5/+3
| | | | | | | Remove a useless check on a pointer which reports a NULL dereference on coverity. Fixes issue #1358.
* MINOR: cfgcond: implements openssl_version_atleast and openssl_version_beforeWilliam Lallemand2021-08-224-6/+65
| | | | | | | | | | | Implements a way of checking the running openssl version: If the OpenSSL support was not compiled within HAProxy it will returns a error, so it's recommanded to do a SSL feature check before: $ ./haproxy -cc 'feature(OPENSSL) && openssl_version_atleast(0.9.8zh) && openssl_version_before(3.0.0)' This will allow to select the SSL reg-tests more carefully.
* MINOR: ssl: add an openssl version string parserWilliam Lallemand2021-08-212-1/+85
| | | | | | | | | | openssl_version_parser() parse a string in the OpenSSL version format which is documented here: https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_VERSION_NUMBER.html The function returns an unsigned int that could be used for comparing openssl versions.
* MINOR: systemd: remove the ExecStartPre line in the unit fileWilliam Lallemand2021-08-201-1/+0
| | | | | | | | | | | | The ExecStartPre line was introduced a long time ago in the systemd unit file, at the time of systemd wrapper. With the haproxy master worker mode, this line is now useless, since starting haproxy itself will check the configuration. However this does not concern the check in the ExecReload which is still needed to return a reload status to HAProxy. It probably shouldn't be backported.
View Lorry Controller Status