RFC: receive side scaling, need help with approach to port ranges

[Richard Russo]

Here are my current patches for comments.

-- 
  Richard Russo
  to...@enslaves.us

On Fri, Jul 5, 2019, at 12:23 PM, Richard Russo wrote:
> Hi,
> 
> I've been experimenting with Recieve Side Scaling (RSS) for a tcp proxy 
> application. The basic idea with RSS is by configuring the NICs, 
> kernel, and application to use the same CPU for a given socket, cross 
> CPU locking and communication is eliminated or at least significantly 
> reduced. On my system, configuring RSS allowed me to handle about three 
> times as many sessions before reaching CPU saturation, with the 
> remaining bottleneck seeming to be kernel processing around socket 
> creation and closing which requires cross cpu coordination. 
> 
> Aligning the incoming sockets is very simple, setting a socket option 
> (IP_RSS_LISTEN_BUCKET) on the listen socket restricts the accepted 
> socket to that bucket, and that's straight forward to add to the tcp 
> listener code, and configuration.
> 
> Aligning outgoing sockets is trickier -- there's no kernel help with a 
> socket option or otherwise, an application has to run the hash 
> (toeplitz) on the 4-tuple of {local ip, local port, remote ip, remote 
> port } and only use an outgoing port if the hash matches.  I've had 
> trouble finding a good approach to handle this.
> 
> The simplest thing would be to run the hash when a port is assigned by 
> port_range and return the port if it hashes to the wrong bucket; but if 
> you've already used all the acceptable ports for that port range, you 
> spend a lot of time hashing the ports that are still in the range, 
> without making any progress.
> 
> If you have a port range per rss bucket, you could hash on port 
> assignment, and not return the ports in case they hash to a wrong 
> bucket; but in the case that the remote ip changes because you've 
> configured it to use DNS or if you change the IP via "set server addr", 
> the previously computed hashes are no longer valid -- you would really 
> want to try all the ports again.
> 
> What I ended up with was a lock on port ranges (instead of atomics as 
> used in 07425de71777b688e77a9c70a7088c13e66e41e9 BUG/MEDIUM: 
> port_range: Make the ring buffer lock-free), adding a revision counter 
> to the port range, and resetting the port range whenever the server IP 
> changed. To avoid running the hash during steady state, and because 
> checking all the ports when the range needs to be filled, I also made 
> port range filing incremental. 
> 
> This approach works, but it feels complicated, and it made my config 
> much more verbose --- I had to duplicate my frontend sections, one for 
> each RSS bucket, which sends to corresponding duplicated backends for 
> each bucket; the backends had additional configuration to indicate the 
> RSS bucket (and the number of buckets). Incidentally, because each RSS 
> bucket has a distinct set of ports, and because my use case doesn't use 
> any features which benefit from coordination within HAProxy (such as 
> stick tables etc), this makes it possible to run in process mode rather 
> than threaded mode without running into a lot of port already in use 
> warnings/errors that would happen otherwise when sharing a port range.
> 
> If it's helpful for the discussion, I can share my patches as-is, but 
> if there are better ideas on how to structure this, I'd rather try to 
> get the changes done in a nice way before sharing.
> 
> Thanks!
> 
> -- 
>   Richard Russo
>   to...@enslaves.us
> 
>

0001-Allow-for-binding-listen-sockets-to-a-provided-RSS-b.patch
Description: Binary data


0002-Revert-BUG-MEDIUM-port_range-Make-the-ring-buffer-lo.patch
Description: Binary data


0003-add-port_range-locking-to-protect-against-concurrent.patch
Description: Binary data


0004-refill-port-ranges-when-addresses-change.patch
Description: Binary data


0005-Allow-for-RSS-aligned-port-selection-for-outgoing-co.patch
Description: Binary data

receive side scaling, need help with approach to port ranges

[Richard Russo]

Hi,

I've been experimenting with Recieve Side Scaling (RSS) for a tcp proxy 
application. The basic idea with RSS is by configuring the NICs, kernel, and 
application to use the same CPU for a given socket, cross CPU locking and 
communication is eliminated or at least significantly reduced. On my system, 
configuring RSS allowed me to handle about three times as many sessions before 
reaching CPU saturation, with the remaining bottleneck seeming to be kernel 
processing around socket creation and closing which requires cross cpu 
coordination. 

Aligning the incoming sockets is very simple, setting a socket option 
(IP_RSS_LISTEN_BUCKET) on the listen socket restricts the accepted socket to 
that bucket, and that's straight forward to add to the tcp listener code, and 
configuration.

Aligning outgoing sockets is trickier -- there's no kernel help with a socket 
option or otherwise, an application has to run the hash (toeplitz) on the 
4-tuple of {local ip, local port, remote ip, remote port } and only use an 
outgoing port if the hash matches.  I've had trouble finding a good approach to 
handle this.

The simplest thing would be to run the hash when a port is assigned by 
port_range and return the port if it hashes to the wrong bucket; but if you've 
already used all the acceptable ports for that port range, you spend a lot of 
time hashing the ports that are still in the range, without making any progress.

If you have a port range per rss bucket, you could hash on port assignment, and 
not return the ports in case they hash to a wrong bucket; but in the case that 
the remote ip changes because you've configured it to use DNS or if you change 
the IP via "set server addr", the previously computed hashes are no longer 
valid -- you would really want to try all the ports again.

What I ended up with was a lock on port ranges (instead of atomics as used in 
07425de71777b688e77a9c70a7088c13e66e41e9 BUG/MEDIUM: port_range: Make the ring 
buffer lock-free), adding a revision counter to the port range, and resetting 
the port range whenever the server IP changed. To avoid running the hash during 
steady state, and because checking all the ports when the range needs to be 
filled, I also made port range filing incremental. 

This approach works, but it feels complicated, and it made my config much more 
verbose --- I had to duplicate my frontend sections, one for each RSS bucket, 
which sends to corresponding duplicated backends for each bucket; the backends 
had additional configuration to indicate the RSS bucket (and the number of 
buckets). Incidentally, because each RSS bucket has a distinct set of ports, 
and because my use case doesn't use any features which benefit from 
coordination within HAProxy (such as stick tables etc), this makes it possible 
to run in process mode rather than threaded mode without running into a lot of 
port already in use warnings/errors that would happen otherwise when sharing a 
port range.

If it's helpful for the discussion, I can share my patches as-is, but if there 
are better ideas on how to structure this, I'd rather try to get the changes 
done in a nice way before sharing.

Thanks!

-- 
  Richard Russo
  to...@enslaves.us

Re: Need help on CVE-2019-11323

[Willy Tarreau]

Hi,

On Fri, May 17, 2019 at 02:54:05AM +, ??? wrote:
> Recently I found an issue CVE-2019-11323, it already fixed in 1.9.7
> 
> But it looks like all other haproxy branches affected by this issue according 
> to the following link.
> 
> 
> https://www.cvedetails.com/cve/CVE-2019-11323/
> 
> CVE-2019-11323 : HAProxy before 1.9.7 mishandles a reload with rotated keys, 
> which triggers use of uninitialized, and very predictable, 
> H
> www.cvedetails.com
> CVE-2019-11323 : HAProxy before 1.9.7 mishandles a reload with rotated keys, 
> which triggers use of uninitialized, and very predictable, HMAC keys. This is 
> related to an include/types/ssl_sock.h error.
> 
> 
> Unfortunately I'm using haproxy 1.7.11, I don't want to upgrade 1.9 right now.
(...)

I've just checked right now and only 1.9.2 and above have the affected feature,
the version details in the CVE are thus incorrect. It was developed in 2.0-dev
and was backported to 1.9 earlier this year to adapt to newer OpenSSL versions.
So on 1.8 and earlier you're not affected.

Hoping this helps,
Willy

Need help on CVE-2019-11323

[白晨红]

Hi guys,



I need your help.


Recently I found an issue CVE-2019-11323, it already fixed in 1.9.7

But it looks like all other haproxy branches affected by this issue according 
to the following link.


https://www.cvedetails.com/cve/CVE-2019-11323/

CVE-2019-11323 : HAProxy before 1.9.7 mishandles a reload with rotated keys, 
which triggers use of uninitialized, and very predictable, 
H
www.cvedetails.com
CVE-2019-11323 : HAProxy before 1.9.7 mishandles a reload with rotated keys, 
which triggers use of uninitialized, and very predictable, HMAC keys. This is 
related to an include/types/ssl_sock.h error.


Unfortunately I'm using haproxy 1.7.11, I don't want to upgrade 1.9 right now.


So I checked haproxy 1.7 release, no new version, just 1.7.11.


And then I checked the code fix in 1.9 branch and compared with 1.7 branch.

https://git.haproxy.org/?p=haproxy.git;a=commitdiff;h=8ef706502aa2000531d36e4ac56dbdc7c30f718d;hp=646b7741bc683d6c6b43342369afcbba33d7b6ec

I couldn't find the same code in 1.7 branch, it looks like this issue just 
existed in 1.9 branch.

I don't understand why this issue affected all branches in cvedetails site.

Can somebody help confirm this,  CVE-2019-11323 didn't affect 1.7 branch, is it 
right?

Thanks,

John







Thanks

Re: need help with sftp and http config on a single config file

[Imam Toufique]

Aah.., I see , it’s been awhile I have this, I seem to vaguely remember
about this now.

Yes I have sshd running on port 22, let me try a higher port for the
proxy.  But I can keep the 22 port number for my backend sftp servers,
correct?

Thanks Jarno, I appreciate your help very much!

—imam

On Fri, Oct 19, 2018 at 12:02 AM Jarno Huuskonen 
wrote:

> Hi,
>
> On Thu, Oct 18, Imam Toufique wrote:
> > *[root@crsplabnet2 examples]# haproxy -c -V -f /etc/haproxy/haproxy.cfg*
> > *Configuration file is valid*
> >
> > *when trying to start HA proxy, i see the following:*
> >
> > *[root@crsplabnet2 examples]# haproxy -D -f /etc/haproxy/haproxy.cfg -p
> > /var/run/haproxy.pid*
> > *[ALERT] 290/234618 (5889) : Starting frontend www-ssh-proxy: cannot bind
> > socket [0.0.0.0:22 ]*
>
> Do you have sshd already running on the haproxy server ?
> (Use netstat -tunapl / ss (something like ss -tlnp '( dport = :ssh or
> sport = :ssh )')
> to see if sshd is already listening on port 22).
>
> If you've sshd running on port 22 then you have to use different port or
> ipaddress for sshd / haproxy(www-ssh-proxy)
>
> -Jarno
>
> --
> Jarno Huuskonen
>
-- 
Regards,
*Imam Toufique*
*213-700-5485*

Re: need help with sftp and http config on a single config file

[Jarno Huuskonen]

Hi,

On Thu, Oct 18, Imam Toufique wrote:
> *[root@crsplabnet2 examples]# haproxy -c -V -f /etc/haproxy/haproxy.cfg*
> *Configuration file is valid*
> 
> *when trying to start HA proxy, i see the following:*
> 
> *[root@crsplabnet2 examples]# haproxy -D -f /etc/haproxy/haproxy.cfg -p
> /var/run/haproxy.pid*
> *[ALERT] 290/234618 (5889) : Starting frontend www-ssh-proxy: cannot bind
> socket [0.0.0.0:22 ]*

Do you have sshd already running on the haproxy server ?
(Use netstat -tunapl / ss (something like ss -tlnp '( dport = :ssh or sport = 
:ssh )')
to see if sshd is already listening on port 22).

If you've sshd running on port 22 then you have to use different port or
ipaddress for sshd / haproxy(www-ssh-proxy)

-Jarno

-- 
Jarno Huuskonen

need help with sftp and http config on a single config file

[Imam Toufique]

Hi,

I am working on a setup where I can host sftp and http from the same HA
proxy frontend, as I am having trouble with it.

here is my config file:
-

global
   log /dev/log local0
   log /dev/log local1 notice
   chroot /var/lib/haproxy
   stats timeout 30s
   user haproxy
   group haproxy
   daemon

defaults
   log global
   mode http
   option tcplog
   option dontlognull
   timeout connect 5000
   timeout client 5
   timeout server 5

frontend http_front
   bind *:80
   stats uri /haproxy?stats
   default_backend http_back
   mode http
   option forwardfor   # forward IP
   http-request set-header X-Forwarded-Port %[dst_port]
   http-request add-header X-Forwarded-Proto https if { ssl_fc }

backend http_back
   balance roundrobin # roundrobin is rotate customers into backend server
   server  web1 10.1.100.156:80 check inter 2000 cookie w1
   server  web2 10.1.100.160:80 check inter 2000 cookie w1
   timeout connect 90
   timeout server 90

frontend www-ssh-proxy
  bind *:22
  mode tcp
  default_backend www-ssh-proxy-backend

backend www-ssh-proxy-backend
   mode tcp
   balance roundrobin
   stick-table type ip size 200k expire 30m
   stick on src
   default-server inter 1s
   server web1 10.1.100.156:22 check id 1
   server web2 10.1.100.160:22 check id 2

I would like SFTP and HTTP to live happily in the same HA proxy config.
When I run the configuration check, everything seems to be fine.

*[root@crsplabnet2 examples]# haproxy -c -V -f /etc/haproxy/haproxy.cfg*
*Configuration file is valid*

*when trying to start HA proxy, i see the following:*

*[root@crsplabnet2 examples]# haproxy -D -f /etc/haproxy/haproxy.cfg -p
/var/run/haproxy.pid*
*[ALERT] 290/234618 (5889) : Starting frontend www-ssh-proxy: cannot bind
socket [0.0.0.0:22 ]*

*I am not sure what I am doing wrong here.  I have not setup sftp and
http in one system before.*

*Can you please give me a hand with this? *

*thanks a lot!*



-- 
Regards,
*Imam Toufique*
*213-700-5485*

FW: Need Help!

[Ray Jender]

-Original Message-
From: Ray Jender [mailto:rayjen...@gmail.com] 
Sent: Tuesday, June 26, 2018 9:34 AM
To: 'Jonathan Matthews' 
Subject: RE: Need Help!

Thanks for the response Jonathan,

Could you explain how I can set up the 4 front-ends?  I am confused on how the 
routing would look?
How HAproxy would evaluate the incoming rtmp?

Thanks,

Ray

-Original Message-
From: jonat...@jpluscplusm.com [mailto:jonat...@jpluscplusm.com] On Behalf Of 
Jonathan Matthews
Sent: Tuesday, June 26, 2018 5:56 AM
To: haproxy 
Cc: rayjen...@gmail.com
Subject: Re: Need Help!

You may not have had many replies as your email was marked as spam.
You might want to address this by, amongst other things, using plain text and 
not HTML.

On 24 June 2018 at 18:32, Ray Jender  wrote:
> I am sending rtmp from OBS with the streaming set to  rtmp://”HAproxy 
> server
> IP”:1935/LPC1

> frontend rtmp-in
> mode tcp
> acl url_LPCX path_beg -i /LPC1/
> use_backend LPC1-backend if url_LPCX

> And here is the log after restarting HAproxy with mode=http:
> And here is the log after restarting HAproxy with mode=tcp:

You can't usefully use HTTP mode, as the traffic isn't HTTP.

Haproxy doesn't speak RTMP so, in TCP mode, haproxy doesn't know how to extract 
path information (or anything protocol-specific) from the traffic.

It can't evaluate the ACL "url_LPCX", so you can't select a backend based on it.

Your best option is to have 4 frontends (or listeners) on 4 different ports, 
and route using that information.

Jonathan

Re: Need Help!

[Jonathan Matthews]

You may not have had many replies as your email was marked as spam.
You might want to address this by, amongst other things, using plain
text and not HTML.

On 24 June 2018 at 18:32, Ray Jender  wrote:
> I am sending rtmp from OBS with the streaming set to  rtmp://”HAproxy server
> IP”:1935/LPC1

> frontend rtmp-in
> mode tcp
> acl url_LPCX path_beg -i /LPC1/
> use_backend LPC1-backend if url_LPCX

> And here is the log after restarting HAproxy with mode=http:
> And here is the log after restarting HAproxy with mode=tcp:

You can't usefully use HTTP mode, as the traffic isn't HTTP.

Haproxy doesn't speak RTMP so, in TCP mode, haproxy doesn't know how
to extract path information (or anything protocol-specific) from the
traffic.

It can't evaluate the ACL "url_LPCX", so you can't select a backend based on it.

Your best option is to have 4 frontends (or listeners) on 4 different
ports, and route using that information.

Jonathan

Need Help!

[Ray Jender]

So, I am trying to forward incoming rtmp to a HAproxy server to a container
that has the media server on the same server.

I am sending rtmp from OBS with the streaming set to  rtmp://"HAproxy server
IP":1935/LPC1

 

And here is my haproxy.cfg:

 

ray@LPC-HAproxy:/etc/haproxy$ cat haproxy.cfg

 

global

log /dev/loglocal0

log /dev/loglocal1 notice

chroot /var/lib/haproxy

stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd
listeners

stats timeout 30s

user haproxy

group haproxy

daemon

 

# Default SSL material locations

ca-base /etc/ssl/certs

crt-base /etc/ssl/private

 

# Default ciphers to use on SSL-enabled listening sockets.

# For more information, see ciphers(1SSL). This list is from:

#  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/

# An alternative list with additional directives can be obtained
from

#
https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=hapro
xy

ssl-default-bind-ciphers
ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RS
A+AES:!aNULL:!MD5:!DSS

ssl-default-bind-options no-sslv3

 

defaults

log global

modehttp

option  httplog

option  dontlognull

timeout connect 5000

timeout client  5

timeout server  5

errorfile 400 /etc/haproxy/errors/400.http

errorfile 403 /etc/haproxy/errors/403.http

errorfile 408 /etc/haproxy/errors/408.http

errorfile 500 /etc/haproxy/errors/500.http

errorfile 502 /etc/haproxy/errors/502.http

errorfile 503 /etc/haproxy/errors/503.http

errorfile 504 /etc/haproxy/errors/504.http

 

frontend rtmp-in

mode tcp

bind *:1935

acl url_LPCX path_beg -i /LPC1/

use_backend LPC1-backend if url_LPCX

#acl url_LPCX path_beg -i /LPC2/

#use_backend LPC2-backend if url_LPCX

#use_backend LPC2-backend if url_LPC2

#use_backend LPC3-backend if url_LPC3

#use_backend LPC4-backend if url_LPC4

default_backend LPC1-backend

 

backend LPC1-backend

server 10.28.172.115:1935 check

#backend LPC2-backend

#server 10.28.172.116:1935 check

#backend LPC2-backend

#backend LPC3-backend

#backend LPC4-backend

 

And here is the log after restarting HAproxy with mode=http:

 

Jun 24 13:25:12 LPC-HAproxy haproxy[3498]: [WARNING] 174/132002 (3498) :
Exiting Master process...

Jun 24 13:25:12 LPC-HAproxy haproxy[3498]: [ALERT] 174/132002 (3498) :
Current worker 3500 exited with code 143

Jun 24 13:25:12 LPC-HAproxy haproxy[3498]: [WARNING] 174/132002 (3498) : All
workers exited. Exiting... (143)

Jun 24 13:25:13 LPC-HAproxy haproxy[3530]: Proxy rtmp-in started.

Jun 24 13:25:13 LPC-HAproxy haproxy[3530]: Proxy rtmp-in started.

Jun 24 13:25:13 LPC-HAproxy haproxy[3530]: Proxy LPC1-backend started.

Jun 24 13:25:13 LPC-HAproxy haproxy[3530]: Proxy LPC1-backend started.

 

And here is the log after restarting HAproxy with mode=tcp:

 

Jun 24 13:14:29 LPC-HAproxy haproxy[3348]: [WARNING] 174/130935 (3348) :
Exiting Master process...

Jun 24 13:14:29 LPC-HAproxy haproxy[3348]: [ALERT] 174/130935 (3348) :
Current worker 3352 exited with code 143

Jun 24 13:14:29 LPC-HAproxy haproxy[3348]: [WARNING] 174/130935 (3348) : All
workers exited. Exiting... (143)

Jun 24 13:14:29 LPC-HAproxy haproxy[3384]: [WARNING] 174/131429 (3384) :
parsing [/etc/haproxy/haproxy.cfg:26] : 'option httplog' not usable with
frontend 'rtmp-in' (needs 'mode http'). Falling back to 'option tcplog'.

Jun 24 13:14:29 LPC-HAproxy haproxy[3384]: Proxy rtmp-in started.

Jun 24 13:14:29 LPC-HAproxy haproxy[3384]: Proxy rtmp-in started.

Jun 24 13:14:29 LPC-HAproxy haproxy[3384]: Proxy LPC1-backend started.

Jun 24 13:14:29 LPC-HAproxy haproxy[3384]: Proxy LPC1-backend started.

 

And here is the error when I start the stream:

 

When mode = http:

 

Jun 24 13:20:28 LPC-HAproxy haproxy[3500]: 192.168.0.5:58373
[24/Jun/2018:13:20:28.665] rtmp-in rtmp-in/ -1/-1/-1/-1/0 400 188 - -
PR-- 1/1/0/0/0 0/0 ""

 

When mode = tcp:

 

Jun 24 13:15:54 LPC-HAproxy haproxy[3386]: 192.168.0.5:58356
[24/Jun/2018:13:15:54.814] rtmp-in LPC1-backend/ -1/-1/0 188 PR
1/1/0/0/3 0/0

 

One thing that confuses me is that all of the tutorials/examples are for
doing load balancing.  In my case I only want to do forwarding

based on the incoming rtmp.  Note LPC can be LPC1-4.  And subsequently
should forwarded to container 1-4, which are named LPC1-4

in lxc.

 

Can anyone help?   


Thanks,

 

Ray

 

Re: Need help?

[Willy Tarreau]

Hi Nikhil,

On Sat, Mar 17, 2018 at 05:39:29PM +, Nikhil Kapoor wrote:
> Actually, I just wanted to deeply understand the code of haproxy. So just
> wanted to know which tool should i use in order to understand the code. Is it
> only gdb that you all use or any other?

Well, gdb is not suited to read code. You'd rather need an editor or
an IDE to help you follow the code. Gdb can serve to place break points
at certain locations however.

What I could suggest you is to take a look at these places particularly :
  - run_poll_loop() : this one is the main loop, iterating between polling,
processing I/O and processing tasks ;

  - listener_accept() : it's where an incoming connection is accepted

  - session_new() : it's called some time after listener_accept(), and
creates a new session ;

  - stream_new() : it creates a fresh new stream on a session ;

  - process_stream() : it calls all analysers subscribed to a stream, and
deals with timeouts, events etc... It's where the main tcp/http stuff
happens ; 

  - cfg_parse_listen() : it's where most of the config keywords are still
parsed (many of them have moved to other locations now). This will
help you figure how config elements are allocated and initialized,
how certain callbacks or analysers are enabled and why/when ;

  - check_config_validity() : some validity checks are run on the config
there late in the boot process, some config elements are resolved,
and some default values are assigned. I think it's also where we
assign an ID to the backends and servers if they don't have one yet.
It will definitely help you understand the relations between various
elements.

Before this, take a look inside doc/internals, and particularly the file
"entities.pdf" which shows how a stream is attached to objects surrounding
it.

Hoping this helps,
Willy

Need help?

[Nikhil Kapoor]

Hi,

I hope u all are doing well. It feels great to be a part of haproxy community. 

Actually, I just wanted to deeply understand the code of haproxy. So just 
wanted to know which tool should i use in order to understand the code. Is it 
only gdb that you all use or any other?

Please help me as i am willing to contribute to haproxy. 

Regards
Nikhil Kapoor

Re: cannot bind socket - Need help with config file

[Lukas Tribus]

Hello,


On 11 January 2018 at 16:36, Jonathan Matthews  wrote:
> On 11 January 2018 at 00:03, Imam Toufique  wrote:
>> So, I have everything in the listen section commented out:
>>
>> frontend main
>>bind :2200
>>default_backend sftp
>>timeout client 5d
>>
>>
>> #listen stats
>> #   bind *:2200
>> #   mode tcp
>> #   maxconn 2000
>> #   option redis-check
>> #   retries 3
>> #   option redispatch
>> #   balance roundrobin
>>
>> #use_backend sftp_server
>> backend sftp
>> balance roundrobin
>> server web 10.0.15.21:2200 check weight 2
>> server nagios 10.0.15.15:2200 check weight 2
>>
>> Is that what I need, right?
>
> I suspect you won't need to have your *backend*'s ports changed to
> 2200. Your SSH server on those machines is *probably* also your SFTP
> server

That's exactly right, your backend destination port should probably
22, there is no need to bump that one to 2200.



> As an aside, it's not clear why you're trying to do this. You've
> already hit the host-key-changing problem, and unless you have a
> *very* specific use case, your users will hit the "50% of the time I
> connect, my files have gone away" problem soon. So you've probably got
> to solve the shared-storage problem on your backends ... which turns
> them in to stateless SFTP-to-FS servers.
>
> In my opinion adding haproxy as a TCP proxy in your architecture adds
> very little, if anything. If I were you, I'd strongly consider just
> sync'ing the same host key to each server, putting their IPs in a
> low-TTL DNS record, and leaving haproxy out of the setup.

With DNS round-robin instead of haproxy you have the same exact
requirements regarding SSH keys and filesystem synchronization, with
all the disadvantages (no health checks, no direct control of the
actual load-balancing, no stats, no logs, etc).

I'm really not sure why you'd recommend DNS RR instead of haproxy
here. Load-balancing a single-port TCP protocol between 2 backends is
a bread and butter use-case for haproxy.



Regards,
Lukas

Re: cannot bind socket - Need help with config file

[Jonathan Matthews]

On 11 January 2018 at 00:03, Imam Toufique  wrote:
> So, I have everything in the listen section commented out:
>
> frontend main
>bind :2200
>default_backend sftp
>timeout client 5d
>
>
> #listen stats
> #   bind *:2200
> #   mode tcp
> #   maxconn 2000
> #   option redis-check
> #   retries 3
> #   option redispatch
> #   balance roundrobin
>
> #use_backend sftp_server
> backend sftp
> balance roundrobin
> server web 10.0.15.21:2200 check weight 2
> server nagios 10.0.15.15:2200 check weight 2
>
> Is that what I need, right?

I suspect you won't need to have your *backend*'s ports changed to
2200. Your SSH server on those machines is *probably* also your SFTP
server. I don't recall if you can serve a different/sync'd host key
per port in sshd, but this might be a reason to run a different daemon
on a higher port as you're doing.

As an aside, it's not clear why you're trying to do this. You've
already hit the host-key-changing problem, and unless you have a
*very* specific use case, your users will hit the "50% of the time I
connect, my files have gone away" problem soon. So you've probably got
to solve the shared-storage problem on your backends ... which turns
them in to stateless SFTP-to-FS servers.

In my opinion adding haproxy as a TCP proxy in your architecture adds
very little, if anything. If I were you, I'd strongly consider just
sync'ing the same host key to each server, putting their IPs in a
low-TTL DNS record, and leaving haproxy out of the setup.

J

Re: cannot bind socket - Need help with config file

[Imam Toufique]

Thanks, Lukas!  Sorry, I think I have been just replying to you by
accidentally hitting the 'reply' button.

So, I have everything in the listen section commented out:

frontend main
   bind :2200
   default_backend sftp
   timeout client 5d


#listen stats
#   bind *:2200
#   mode tcp
#   maxconn 2000
#   option redis-check
#   retries 3
#   option redispatch
#   balance roundrobin

#use_backend sftp_server
backend sftp
balance roundrobin
server web 10.0.15.21:2200 check weight 2
server nagios 10.0.15.15:2200 check weight 2

Is that what I need, right?

thanks.

On Wed, Jan 10, 2018 at 4:00 PM, Lukas Tribus  wrote:

> Hello Imam,
>
>
> On Wed, Jan 10, 2018 at 11:49 PM, Imam Toufique 
> wrote:
> > Lukas,
> >
> > Sorry to keep on dragging this, I am confused here.  I will admit that I
> > have not had the time to read the documentation on this.  From what I was
> > able to read, I slapped togather this config to get me started.
> >
> > I am not sure exactly what the 'listen' part do.  From what I can
> gather, I
> > found this in the user documentation:
>
> Again please "Reply-All" so the mailing list remains CC'ed.
>
>
> The frontend and listen functionality overlap, they can do the same
> thing, with a slightly different syntax. You either use a frontend OR
> a listen section. You don't use both for the same exact purpose.
>
> The frontend is fine, just delete everything related to the listen
> section and that's it.
>
>
>
>
> Regards,
> Lukas
>



-- 
Regards,
*Imam Toufique*
*213-700-5485*

Re: cannot bind socket - Need help with config file

[Lukas Tribus]

Hello Imam,


On Wed, Jan 10, 2018 at 11:49 PM, Imam Toufique  wrote:
> Lukas,
>
> Sorry to keep on dragging this, I am confused here.  I will admit that I
> have not had the time to read the documentation on this.  From what I was
> able to read, I slapped togather this config to get me started.
>
> I am not sure exactly what the 'listen' part do.  From what I can gather, I
> found this in the user documentation:

Again please "Reply-All" so the mailing list remains CC'ed.


The frontend and listen functionality overlap, they can do the same
thing, with a slightly different syntax. You either use a frontend OR
a listen section. You don't use both for the same exact purpose.

The frontend is fine, just delete everything related to the listen
section and that's it.




Regards,
Lukas

Re: cannot bind socket - Need help with config file

[Lukas Tribus]

Hi Imam,


On Tue, Jan 9, 2018 at 6:54 PM, Imam Toufique  wrote:
> Hi Lukus,
>
> thanks again for your continued help and support!  Here is my config file
> with updates now:
>
> frontend main
>bind :2200
>default_backend sftp
>timeout client 5d
>
>
> listen stats
>bind *:2200
>mode tcp
>maxconn 2000
>option redis-check
>retries 3
>option redispatch
>balance roundrobin
>
>
> Please correct me if you see something that is not right.

That's wrong. You are again configuring 2 services on a single port.
In this case, the kernel will load-balance between the two causing
chaos.

What is the "listen stats" section supposed to do anyway in your
configuration? Why do you need a main frontend and this listen
section?



> You asked about my SSH/SFTP use-case.  Basically, here is my use-case.  I
> have several SFTP servers that I would like to load-balance.  I was thinking
> about using HAProxy to load-balance SFTP connections between my SFTP
> servers.  As I was testing my setup yesterday, I was sending sftp file
> transfers to the HAproxy node, I noticed that HAProxy node CPU usage was
> pretty high.  I am beginning to wonder if it is the right setup for my
> environment.
> Is HAProxy is the right solution for SFTP server load-balancing?

Load-balancing SSH/SFTP generally should be very easy to do, as SSH
only uses a single port and doesn't have any layering violations (as
opposed to FTP).
The only thing to be aware of is the public key issue with different
servers, as you are load-balancing between them. Use the same private
key on all the backend server to avoid this problem.

As for the high CPU usage, I'd recommend fixing the configuration
first, before troubleshooting the CPU load. You may see strange
effects due to unintended load-balancing.


The rule is is simple: you are specifying the same listening port more
than once in the configuration, then something is and will go wrong.
You must have one single reference to port 2200 only.



Lukas

Re: cannot bind socket - Need help with config file

[Imam Toufique]

Hi Lukus,

thanks again for your continued help and support!  Here is my config file
with updates now:

frontend main
   bind :2200
   default_backend sftp
   timeout client 5d


listen stats
   bind *:2200
   mode tcp
   maxconn 2000
   option redis-check
   retries 3
   option redispatch
   balance roundrobin


Please correct me if you see something that is not right.

You asked about my SSH/SFTP use-case.  Basically, here is my use-case.  I
have several SFTP servers that I would like to load-balance.  I was
thinking about using HAProxy to load-balance SFTP connections between my
SFTP servers.  As I was testing my setup yesterday, I was sending sftp file
transfers to the HAproxy node, I noticed that HAProxy node CPU usage was
pretty high.  I am beginning to wonder if it is the right setup for my
environment.
Is HAProxy is the right solution for SFTP server load-balancing?

thanks

On Tue, Jan 9, 2018 at 2:12 AM, Lukas Tribus  wrote:

> Hello Imam,
>
>
> On Tue, Jan 9, 2018 at 2:30 AM, Imam Toufique  wrote:
> >
> > Hi Jonathan, and Lucas,
> >
> > Thanks for your replies.  With your help, I was able to get it work
> > partially.
>
> Please always CC the mailing list though.
>
>
>
> > frontend main *:2200
> >#bind *:22
> >default_backend sftp
> >timeout client 1h
>
> While this works, it's causing a lot of confusion. Please do follow my
> advice and DON'T specify the port in the frontend/listen line. Use the
> bind directive instead.
> So in this case:
>
> > frontend main
> >bind :2200
> >default_backend sftp
> >timeout client 1h
>
> It's much more readable like this.
>
>
>
> > listen stats
> > #bind *:22
>
> You disbled your stats section with this configuration. Either decide
> for a port, or remove it if you don't need it.
>
>
>
> > But haproxy starts and I was able to get ssh to one of the servers.  Now
> I
> > have a different problem where I get a ssh ket fingerprint error warning
> and
> > my connection drops.
> >
> > I get the error below:
> >
> > [vagrant@db ~]$ ssh file -p 2200
> > @@@
> > @WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
> > @@@
> > IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
> > Someone could be eavesdropping on you right now (man-in-the-middle
> attack)!
> > It is also possible that a host key has just been changed.
> > The fingerprint for the RSA key sent by the remote host is
> > SHA256:MHkXThp4cSltDn0/mRsq7Se+qcDz6cz1dD+kCiyE9e0.
> > Please contact your system administrator.
> > Add correct host key in /home/vagrant/.ssh/known_hosts to get rid of this
> > message.
> > Offending ECDSA key in /home/vagrant/.ssh/known_hosts:4
> > RSA host key for [file]:2200 has changed and you have requested strict
> > checking.
> > Host key verification failed
> >
> > It looks like host keys are changing, and the host key becomes unknown to
> > both servers that are behind HAProxy.  what do you recommend doing in a
> case
> > like this?
>
> That's what happens when you load-balance between 2 different SSH
> servers with a different private key. What is it that you want to
> achieve in the first place?
>
>
>
> cheers,
> lukas
>



-- 
Regards,
*Imam Toufique*
*213-700-5485*

Re: cannot bind socket - Need help with config file

[Lukas Tribus]

Hello Imam,


On Tue, Jan 9, 2018 at 2:30 AM, Imam Toufique  wrote:
>
> Hi Jonathan, and Lucas,
>
> Thanks for your replies.  With your help, I was able to get it work
> partially.

Please always CC the mailing list though.



> frontend main *:2200
>#bind *:22
>default_backend sftp
>timeout client 1h

While this works, it's causing a lot of confusion. Please do follow my
advice and DON'T specify the port in the frontend/listen line. Use the
bind directive instead.
So in this case:

> frontend main
>bind :2200
>default_backend sftp
>timeout client 1h

It's much more readable like this.



> listen stats
> #bind *:22

You disbled your stats section with this configuration. Either decide
for a port, or remove it if you don't need it.



> But haproxy starts and I was able to get ssh to one of the servers.  Now I
> have a different problem where I get a ssh ket fingerprint error warning and
> my connection drops.
>
> I get the error below:
>
> [vagrant@db ~]$ ssh file -p 2200
> @@@
> @WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
> @@@
> IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
> Someone could be eavesdropping on you right now (man-in-the-middle attack)!
> It is also possible that a host key has just been changed.
> The fingerprint for the RSA key sent by the remote host is
> SHA256:MHkXThp4cSltDn0/mRsq7Se+qcDz6cz1dD+kCiyE9e0.
> Please contact your system administrator.
> Add correct host key in /home/vagrant/.ssh/known_hosts to get rid of this
> message.
> Offending ECDSA key in /home/vagrant/.ssh/known_hosts:4
> RSA host key for [file]:2200 has changed and you have requested strict
> checking.
> Host key verification failed
>
> It looks like host keys are changing, and the host key becomes unknown to
> both servers that are behind HAProxy.  what do you recommend doing in a case
> like this?

That's what happens when you load-balance between 2 different SSH
servers with a different private key. What is it that you want to
achieve in the first place?



cheers,
lukas

Re: cannot bind socket - Need help with config file

[Lukas Tribus]

Hello Imam,


On Mon, Jan 8, 2018 at 11:24 AM, Jonathan Matthews
 wrote:
> On Mon, 8 Jan 2018 at 08:29, Imam Toufique  wrote:
>>
>> [ALERT] 007/081940 (1416) : Starting frontend sftp-server: cannot bind
>> socket [0.0.0.0:22]
>> [ALERT] 007/081940 (1416) : Starting proxy stats: cannot bind socket
>> [10.0.15.23:22]
>> [ALERT] 007/081940 (1416) : Starting proxy stats: cannot bind socket
>> [0.0.0.0:22]
>
>
> I would strongly suspect that the server already has something bound to port
> 22. It's probably your SSH daemon.
>
> You'll need to fix that, by dedicating either a different port or interface
> to the SFTP listener.

Correct.

Also:
- you can't bind the stats socket to the same port as your actual frontend
- you are binding twice for the stats socket already (you must not
have "bind :ABC" AND listen stats 1.2.3.4:ABC as that will cause 2
different sockets to be created - don't specify IP and port in the
"listen" line to avoid that kind of confusing)


Lukas

Re: cannot bind socket - Need help with config file

[Jonathan Matthews]

On Mon, 8 Jan 2018 at 08:29, Imam Toufique  wrote:

> [ALERT] 007/081940 (1416) : Starting frontend sftp-server: cannot bind
> socket [0.0.0.0:22]
> [ALERT] 007/081940 (1416) : Starting proxy stats: cannot bind socket [
> 10.0.15.23:22]
> [ALERT] 007/081940 (1416) : Starting proxy stats: cannot bind socket [
> 0.0.0.0:22]
>

I would strongly suspect that the server already has something bound to
port 22. It's probably your SSH daemon.

You'll need to fix that, by dedicating either a different port or interface
to the SFTP listener.

J

> --
Jonathan Matthews
London, UK
http://www.jpluscplusm.com/contact.html

cannot bind socket - Need help with config file

[Imam Toufique]

Hi,

I need some help figuring out why my config below is failing to start the
haproxy daemon.  I am totally new to this.

Below is my confg:


global
#   local2.* /var/log/haproxy.log
#
   log 127.0.0.1 local2
   #local2.* /var/log/haproxy.log
   chroot /var/log/haproxy
   #stats timeout 30s
   user haproxy
   group haproxy
   daemon

defaults
   log global
   mode tcp
   option tcplog
   option dontlognull
   timeout connect 5000
   timeout client 5
   timeout server 5


frontend sftp-server
   bind *:22
   default_backend sftp_server
   timeout client 1h


listen stats 10.0.15.23:22
bind :22
mode tcp
maxconn 2000
option redis-check
retries 3
option redispatch
balance roundrobin

use_backend sftp_server
backend sftp_server
balance roundrobin
server web 10.0.15.21:22 check weight 2
server nagios 10.0.15.15:22 check weight 2

When I run a config check, i get this:

[root@file haproxy]# haproxy -f ./haproxy.cfg -c
Configuration file is valid

when I try to start haproxy, I get the following error:

[root@file haproxy]# haproxy -f ./haproxy.cfg -d
Available polling systems :
  epoll : pref=300,  test result OK
   poll : pref=200,  test result OK
 select : pref=150,  test result FAILED
Total: 3 (2 usable), will use epoll.
Using epoll() as the polling mechanism.
[ALERT] 007/081940 (1416) : Starting frontend sftp-server: cannot bind
socket [0.0.0.0:22]
[ALERT] 007/081940 (1416) : Starting proxy stats: cannot bind socket [
10.0.15.23:22]
[ALERT] 007/081940 (1416) : Starting proxy stats: cannot bind socket [
0.0.0.0:22]

In the config above, I am trying to setup 2 SFTP servers load-balanced with
haproxy.  I would like to use port 22 , for sftp.

Please help, I need to get this going.

thanks.

Re: Need help to reolsve haproxy issue

[Praveen Koppula]

 Sorry for the late reply, I was on unplanned leave.

What I observed in my investigation, when I commented below line it's
working as expected. Means even after reboot the machine the haproxy
service get started automatically.
#stats socket /etc/haproxy/haproxysock level admin
I'm not sure what is the significance of this line.
Can we proceed with this in our configuration or will it cause any
issues further?

NOTE : I couldn't find haproxy-wrapper under below location
/usr/sbin> ls -ltr *haproxy*
-rwxr-xr-x 1 root root  35152 Sep  3  2014 haproxy-halog
-rwxr-xr-x 1 root root 788672 Sep  3  2014 haproxy
lrwxrwxrwx 1 root root 19 Jan  9 01:47 rchaproxy -> /etc/init.d/haproxy

Thanks in advance.

On Mon, Jan 16, 2017 at 11:43 AM, Aaron West  wrote:
> I've not personally had any issues with systemd which I know doesn't mean
> there isn't any... However, on closer inspection, it gets started through a
> wrapper "haproxy-systemd-wrapper" for me :
>
> [Unit]
> Description=HAProxy Load Balancer
> After=network.target
>
> [Service]
> ExecStartPre=/usr/local/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q
> ExecStart=/usr/local/sbin/haproxy-systemd-wrapper -f
> /etc/haproxy/haproxy.cfg -$
> ExecReload=/bin/kill -USR2 $MAINPID
> KillMode=mixed
> Restart=always
>
> [Install]
> WantedBy=multi-user.target
>
> So definitely check if you are using that wrapper or not if systemd is being
> used.
>
> Otherwise, my feeling is that for whatever reason you cannot access the
> socket previously created due to permissions... I mean I can get the same
> error trying to start HAproxy as an unprivileged user who cannot write to
> the file/directory.
>
> Aaron West
>
> Loadbalancer.org Limited
> +44 (0)330 380 1064
> www.loadbalancer.org
>
> On 16 January 2017 at 16:21, Baptiste  wrote:
>>
>> Might be a systemd dependency issue, where the socket is not created
>> before the process is started.
>>
>> Baptiste
>>
>> On Mon, Jan 16, 2017 at 4:46 PM, Aaron West 
>> wrote:
>>>
>>> Hi Praveen,
>>>
>>> Am I right in assuming it's a socket for the stats page? Also what user
>>> is starting HAproxy because maybe it doesn't have permissions to create the
>>> socket?
>>>
>>> We might need your whole config or at least the GLOBAL section...
>>>
>>> Aaron West
>>>
>>> Loadbalancer.org Limited
>>> +44 (0)330 380 1064
>>> www.loadbalancer.org
>>>
>>> On 16 January 2017 at 15:38, Praveen Koppula
>>>  wrote:

 Some content was missing. Adding again.

 When we reboot our machine (Where haproxy installed) teh haproxy going
 to be down and it's not starting after machine boot.
 When we force to start haproxy service getting below error.
 Error: Starting haproxy [ALERT] 047/083514 : Starting frontend GLOBAL:
 error when trying to preserve previous UNIX socket
 [/etc/haproxy/haproxysock] startproc: exit status of parent of
 /usr/sbin/haproxy: 1 Failed

 On Mon, Jan 16, 2017 at 10:32 AM, Praveen Koppula
  wrote:
>
> Can you please help me on this.
>
> Haproxy version is : 1.5.4-2.1
>
> Thanks in advance


>>>
>>
>

Re: Need help to reolsve haproxy issue

[Aaron West]

I've not personally had any issues with systemd which I know doesn't mean
there isn't any... However, on closer inspection, it gets started through a
wrapper "haproxy-systemd-wrapper" for me :

[Unit]
Description=HAProxy Load Balancer
After=network.target

[Service]
ExecStartPre=/usr/local/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q
ExecStart=/usr/local/sbin/haproxy-systemd-wrapper -f
/etc/haproxy/haproxy.cfg -$
ExecReload=/bin/kill -USR2 $MAINPID
KillMode=mixed
Restart=always

[Install]
WantedBy=multi-user.target

So definitely check if you are using that wrapper or not if systemd is
being used.

Otherwise, my feeling is that for whatever reason you cannot access the
socket previously created due to permissions... I mean I can get the same
error trying to start HAproxy as an unprivileged user who cannot write to
the file/directory.

Aaron West

Loadbalancer.org Limited
+44 (0)330 380 1064
www.loadbalancer.org

On 16 January 2017 at 16:21, Baptiste  wrote:

> Might be a systemd dependency issue, where the socket is not created
> before the process is started.
>
> Baptiste
>
> On Mon, Jan 16, 2017 at 4:46 PM, Aaron West 
> wrote:
>
>> Hi Praveen,
>>
>> Am I right in assuming it's a socket for the stats page? Also what user
>> is starting HAproxy because maybe it doesn't have permissions to create the
>> socket?
>>
>> We might need your whole config or at least the GLOBAL section...
>>
>> Aaron West
>>
>> Loadbalancer.org Limited
>> +44 (0)330 380 1064
>> www.loadbalancer.org
>>
>> On 16 January 2017 at 15:38, Praveen Koppula <
>> praveenkumarkopp...@gmail.com> wrote:
>>
>>> Some content was missing. Adding again.
>>>
>>> When we reboot our machine (Where haproxy installed) teh haproxy going
>>> to be down and it's not starting after machine boot.
>>> When we force to start haproxy service getting below error.
>>> Error: Starting haproxy [ALERT] 047/083514 : Starting frontend GLOBAL:
>>> error when trying to preserve previous UNIX socket
>>> [/etc/haproxy/haproxysock] startproc: exit status of parent of
>>> /usr/sbin/haproxy: 1 Failed
>>>
>>> On Mon, Jan 16, 2017 at 10:32 AM, Praveen Koppula <
>>> praveenkumarkopp...@gmail.com> wrote:
>>>
 Can you please help me on this.

 Haproxy version is : 1.5.4-2.1

 Thanks in advance

>>>
>>>
>>
>

Re: Need help to reolsve haproxy issue

[Baptiste]

Might be a systemd dependency issue, where the socket is not created before
the process is started.

Baptiste

On Mon, Jan 16, 2017 at 4:46 PM, Aaron West  wrote:

> Hi Praveen,
>
> Am I right in assuming it's a socket for the stats page? Also what user is
> starting HAproxy because maybe it doesn't have permissions to create the
> socket?
>
> We might need your whole config or at least the GLOBAL section...
>
> Aaron West
>
> Loadbalancer.org Limited
> +44 (0)330 380 1064
> www.loadbalancer.org
>
> On 16 January 2017 at 15:38, Praveen Koppula <
> praveenkumarkopp...@gmail.com> wrote:
>
>> Some content was missing. Adding again.
>>
>> When we reboot our machine (Where haproxy installed) teh haproxy going to
>> be down and it's not starting after machine boot.
>> When we force to start haproxy service getting below error.
>> Error: Starting haproxy [ALERT] 047/083514 : Starting frontend GLOBAL:
>> error when trying to preserve previous UNIX socket
>> [/etc/haproxy/haproxysock] startproc: exit status of parent of
>> /usr/sbin/haproxy: 1 Failed
>>
>> On Mon, Jan 16, 2017 at 10:32 AM, Praveen Koppula <
>> praveenkumarkopp...@gmail.com> wrote:
>>
>>> Can you please help me on this.
>>>
>>> Haproxy version is : 1.5.4-2.1
>>>
>>> Thanks in advance
>>>
>>
>>
>

Re: Need help to reolsve haproxy issue

[Aaron West]

Hi Praveen,

Am I right in assuming it's a socket for the stats page? Also what user is
starting HAproxy because maybe it doesn't have permissions to create the
socket?

We might need your whole config or at least the GLOBAL section...

Aaron West

Loadbalancer.org Limited
+44 (0)330 380 1064
www.loadbalancer.org

On 16 January 2017 at 15:38, Praveen Koppula 
wrote:

> Some content was missing. Adding again.
>
> When we reboot our machine (Where haproxy installed) teh haproxy going to
> be down and it's not starting after machine boot.
> When we force to start haproxy service getting below error.
> Error: Starting haproxy [ALERT] 047/083514 : Starting frontend GLOBAL:
> error when trying to preserve previous UNIX socket
> [/etc/haproxy/haproxysock] startproc: exit status of parent of
> /usr/sbin/haproxy: 1 Failed
>
> On Mon, Jan 16, 2017 at 10:32 AM, Praveen Koppula <
> praveenkumarkopp...@gmail.com> wrote:
>
>> Can you please help me on this.
>>
>> Haproxy version is : 1.5.4-2.1
>>
>> Thanks in advance
>>
>
>

Re: Need help to reolsve haproxy issue

[Aaron West]

There are some very knowledgeable people on this list so I'm sure someone
can help, however, what might the problem actually be?


Aaron West

Loadbalancer.org Limited
+44 (0)330 380 1064
www.loadbalancer.org

On 16 January 2017 at 15:32, Praveen Koppula 
wrote:

> Can you please help me on this.
>
> Haproxy version is : 1.5.4-2.1
>
> Thanks in advance
>

Re: Need help to reolsve haproxy issue

[Praveen Koppula]

Some content was missing. Adding again.

When we reboot our machine (Where haproxy installed) teh haproxy going to
be down and it's not starting after machine boot.
When we force to start haproxy service getting below error.
Error: Starting haproxy [ALERT] 047/083514 : Starting frontend GLOBAL:
error when trying to preserve previous UNIX socket
[/etc/haproxy/haproxysock] startproc: exit status of parent of
/usr/sbin/haproxy: 1 Failed

On Mon, Jan 16, 2017 at 10:32 AM, Praveen Koppula <
praveenkumarkopp...@gmail.com> wrote:

> Can you please help me on this.
>
> Haproxy version is : 1.5.4-2.1
>
> Thanks in advance
>

Need help to reolsve haproxy issue

[Praveen Koppula]

Can you please help me on this.

Haproxy version is : 1.5.4-2.1

Thanks in advance

You need help?

[Victoria Xusa]

Need Help ?





Look no further.

Your answer is just a click away.

There’s a new method on the block
that people are finding works for them.

And I figured out how to gain access.

Explore this tried and tested new method here.

Have a good day

Talk soon,
Victoria


Moral story of the day:
Once upon a time there lived a cat that loved to read. At night, when
everybody was asleep, she would put on the spectacles and read the BIG BOOK
FOR CATS.

One day, she read in the book: If you want a mouse for dinner, repeat the
following rhyme: In this house there is a mouse, where is the mouse, where
is the mouse? The cat looked up from the book and found that there was a
mouse on the top of the table. The cat repeated the rhyme and soon found
the same mouse on the bed. Then she jumped upon the bed to catch the mouse
and the mouse was gone!

The mouse was very clever. Suddenly he squeaked, “Oh, dear cat, run, run
fast! There is dog after you!” The cat left the mouse and was ready to
jump out of the window. The mouse sat near his hole and said, “Ha-ha-ha!
Dear cat that was the trick I learnt from the BIO BOOK FOR MICE!” And the
mouse ran into his hole!

MORAL :An intelligent person should not think that others are illiterate.



Subscription info:

If you no longer want to receive updates, use the unsubscribe link that is
at the very bottom of this email.
Stay subscribed you will receive carefully picked recommendations, no cost
gifts and marketing downloads and we can get a commission, if you click and
buy on links in this email.
If you feel that the content is inappropriate reply to this email.

Unsubscribe me from this list




To stop receiving these
emails:http://victorinoxusa.com/unsubscribe.php?M=246361=7acfbfdbd56352a99dfce9243371b5d7=2=14

Need help with configuration its not working on a new Archlinux VPS

[Jeffrey Scott Flesher Gmail]

This is the haproxy.cfg file I have been running for years on an Ubuntu
12 VPS, I just installed this on an Archlinux VPS and its not working.

Note:
    acl has_path path /
reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if has_path
This is because its a Wt app and needs a url that starts off with a ww
in this case:
http://wittywizard.org/ww/en/blue/

and I do not want the www
    redirect prefix http://wittywizard.org code 301 if { hdr(host)
-i www.wittywizard.org }

wittywizard.org is on the new Archlinux VPS, the other sites are under the 
Ubuntu VPS

I am running monit.

If you see anything that needs to be changed or delete let me know, I am not 
very good at this, I just need it to work and need help.

Thanks for any help.

# nano -c /etc/haproxy/haproxy.cfg
global
log 127.0.0.1 local0 
log 127.0.0.1 local1 notice
maxconn 4096
user haproxy
group haproxy
daemon
defaults
log global
modehttp
option  httplog
option  dontlognull
retries 3
option  redispatch
maxconn 1000
timeout connect 5000
timeout client 5
timeout server 5
option http-server-close
timeout http-keep-alive 3000
option forwardfor
frontend wt
bind 216.117.149:80
    option http-server-close
timeout http-keep-alive 3000
reqidel ^Client-IP:.*
reqidel ^X-Forwarded-For:.*
option forwardfor
# Set inside Witty Wizard main.cpp
acl has_path path /
reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if has_path
    redirect prefix http://wittywizard.org code 301         if {
hdr(host) -i www.wittywizard.org }
redirect prefix http://lightwizzard.com code 301       if {
hdr(host) -i www.lightwizzard.com }
redirect prefix http://thedarkwizzard.com code 301  if { hdr(host)
-i www.thedarkwizzard.com }
redirect prefix http://greywizzard.com code 301       if {
hdr(host) -i www.greywizzard.com }
redirect prefix http://rodremelin.com code 301        if {
hdr(host) -i www.rodremelin.com }
# Note: see wthttpd.sh session-id-prefix
acl srv1 url_sub wtd=wt-8060
acl srv1_up nbsrv(bck1) gt 0
use_backend bck1 if srv1_up srv1
#
# Second Thread
# Note: see wthttpd.sh session-id-prefix
# acl srv2  url_sub wtd=wt-8061
# acl srv2_up nbsrv(bck2) gt 0
# use_backend bck2 if srv2_up srv2 has_ww_uri
#
default_backend bck_lb
backend bck_lb
balance roundrobin
server srv1 216.117.149.91:8060 track bck1/srv1
# server srv2 108.59.251.28:8060 track bck1/srv1
backend bck1
balance roundrobin
server srv1 216.117.149.91:8060 check
# server srv2 108.59.251.28:8060 check
backend bck2
balance roundrobin
server srv2 216.117.149.91:8061 check
# server srv2 108.59.251.28:8060 check
# EOF #

Re: Need help to configure ha proxy

[Harish Chander]

Hi,


Will you please help me in configuration on HAPROXY.


Example - api.example.com

server api01 10.0.0.10:80 check

server api02 10.0.0.11:80 check


Requirement -

10 Backend server and every backend with host name and 2 server under backend 
with roundrobin. Now issue is if we deploy on Prod, with jenkins, once deploy 
tomcat/apache will restart and use another server. During restart request fails 
those send on server 01 because this server goes under restart.


How to handel that.


AWS we do with ELB, before deployment server take out from elb then deploy then 
attach and make the inservice.


Regard's
Harish Chander
8529142143

  *




From: Jeff Palmer <j...@palmerit.net>
Sent: Tuesday, August 30, 2016 7:05 PM
To: Harish Chander
Cc: haproxy@formilux.org
Subject: Re: Need help to configure ha proxy

This config appears to be a decent start.  and looks to meet your
requirements for http.

Now you just need another frontend configured for 443,  it would match
the :80 frontend, aside from port, using SSL, and a path to the
certificates.



On Tue, Aug 30, 2016 at 8:47 AM, Harish Chander
<harish.chan...@hotmail.com> wrote:
> Hi,
>
>
> I shall be really thankful you if you help in configure haproxy or its
> possible or not.
>
>
> External ELB - In external AWS ELB i have 2 Ha proxy server
>
>
> HA Proxy
>
> connect
>
> haproxy > beta.example.com
>
> beta.example.com > api-example.com
>
>
> beta.example.com server work's on 80 and 443 both, If i add A Name in DNS of
> direct server IP then work everything.
>
>
> Requirement - beta.example.com should work on both 443 and 80. now its
> working for 80 only. Please help me out. you can call me +918529142143 any
> time.
>
>
> Current haproxy conf under below
>
>
>
> haproxy.conf
>
>
> global
>
> log /dev/log local0
>
> log /dev/log local1 notice
>
> chroot /var/lib/haproxy
>
> stats socket /run/haproxy/admin.sock mode 660 level admin
>
> stats timeout 30s
>
> user haproxy
>
> group haproxy
>
> daemon
>
>
> # Default SSL material locations
>
> ca-base /etc/ssl/certs
>
> crt-base /etc/ssl/private
>
>
> # Default ciphers to use on SSL-enabled listening sockets.
>
> # For more information, see ciphers(1SSL). This list is from:
>
> #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
>
> ssl-default-bind-ciphers
> ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
>
> ssl-default-bind-options no-sslv3
>
>
> defaults
>
> log global
>
> mode http
>
> option httplog
>
> option dontlognull
>
> timeout connect 5000
>
> timeout client  5
>
> timeout server  5
>
>
> frontend haproxy
>
>bind *:80
>
>stats uri /stats
>
>stats realm Strictly\ Private
>
>stats auth pass:word
>
>
> # Define hosts
>
> #urls
>
> acl beta.example hdr(host) -i beta.example.com
>
>
>
> acl api.example hdr(host) -i api-example.com
>
>
>
> #cluster
>
> use_backend b.example if beta.example
>
>
> use_backend z.api if api.example
>
>
> #Frontend Server
>
>
> backend b.example
>
> mode http
>
> balance roundrobin
>
> option forwardfor
>
>server server01 10.0.0.1:80 check
>
>
> ##API
>
> backend z.api
>
> mode http
>
> balance roundrobin
>
> option forwardfor
>
> server api01 192.168.1.1:80 check
>
>
>
> Regard's
> Harish Chander
> 8529142143
>
>



--
Jeff Palmer
https://PalmerIT.net

Re: Need help to configure ha proxy

[Harish Chander]

For same i need your help will you please help me, and today i have new 
requirement. back to example.com backend will run on 80 and 8080


example.com will run on 80 and 443 will you share the conf file ?? i shall be 
really thankfull to you


Regard's
Harish Chander
8529142143

  *




From: Jeff Palmer <j...@palmerit.net>
Sent: Tuesday, August 30, 2016 7:05 PM
To: Harish Chander
Cc: haproxy@formilux.org
Subject: Re: Need help to configure ha proxy

This config appears to be a decent start.  and looks to meet your
requirements for http.

Now you just need another frontend configured for 443,  it would match
the :80 frontend, aside from port, using SSL, and a path to the
certificates.



On Tue, Aug 30, 2016 at 8:47 AM, Harish Chander
<harish.chan...@hotmail.com> wrote:
> Hi,
>
>
> I shall be really thankful you if you help in configure haproxy or its
> possible or not.
>
>
> External ELB - In external AWS ELB i have 2 Ha proxy server
>
>
> HA Proxy
>
> connect
>
> haproxy > beta.example.com
>
> beta.example.com > api-example.com
>
>
> beta.example.com server work's on 80 and 443 both, If i add A Name in DNS of
> direct server IP then work everything.
>
>
> Requirement - beta.example.com should work on both 443 and 80. now its
> working for 80 only. Please help me out. you can call me +918529142143 any
> time.
>
>
> Current haproxy conf under below
>
>
>
> haproxy.conf
>
>
> global
>
> log /dev/log local0
>
> log /dev/log local1 notice
>
> chroot /var/lib/haproxy
>
> stats socket /run/haproxy/admin.sock mode 660 level admin
>
> stats timeout 30s
>
> user haproxy
>
> group haproxy
>
> daemon
>
>
> # Default SSL material locations
>
> ca-base /etc/ssl/certs
>
> crt-base /etc/ssl/private
>
>
> # Default ciphers to use on SSL-enabled listening sockets.
>
> # For more information, see ciphers(1SSL). This list is from:
>
> #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
Hardening Your Web Server's SSL Ciphers · Homepage of 
...<https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/>
hynek.me
There are many wordy articles on configuring your web server's TLS ciphers. 
This is not one of them. Instead I will share a configuration which is both 
compatible ...



>
> ssl-default-bind-ciphers
> ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
>
> ssl-default-bind-options no-sslv3
>
>
> defaults
>
> log global
>
> mode http
>
> option httplog
>
> option dontlognull
>
> timeout connect 5000
>
> timeout client  5
>
> timeout server  5
>
>
> frontend haproxy
>
>bind *:80
>
>stats uri /stats
>
>stats realm Strictly\ Private
>
>stats auth pass:word
>
>
> # Define hosts
>
> #urls
>
> acl beta.example hdr(host) -i beta.example.com
>
>
>
> acl api.example hdr(host) -i api-example.com
>
>
>
> #cluster
>
> use_backend b.example if beta.example
>
>
> use_backend z.api if api.example
>
>
> #Frontend Server
>
>
> backend b.example
>
> mode http
>
> balance roundrobin
>
> option forwardfor
>
>server server01 10.0.0.1:80 check
>
>
> ##API
>
> backend z.api
>
> mode http
>
> balance roundrobin
>
> option forwardfor
>
> server api01 192.168.1.1:80 check
>
>
>
> Regard's
> Harish Chander
> 8529142143
>
>



--
Jeff Palmer
https://PalmerIT.net

Re: Need help to configure ha proxy

[Jeff Palmer]

This config appears to be a decent start.  and looks to meet your
requirements for http.

Now you just need another frontend configured for 443,  it would match
the :80 frontend, aside from port, using SSL, and a path to the
certificates.



On Tue, Aug 30, 2016 at 8:47 AM, Harish Chander
 wrote:
> Hi,
>
>
> I shall be really thankful you if you help in configure haproxy or its
> possible or not.
>
>
> External ELB - In external AWS ELB i have 2 Ha proxy server
>
>
> HA Proxy
>
> connect
>
> haproxy > beta.example.com
>
> beta.example.com > api-example.com
>
>
> beta.example.com server work's on 80 and 443 both, If i add A Name in DNS of
> direct server IP then work everything.
>
>
> Requirement - beta.example.com should work on both 443 and 80. now its
> working for 80 only. Please help me out. you can call me +918529142143 any
> time.
>
>
> Current haproxy conf under below
>
>
>
> haproxy.conf
>
>
> global
>
> log /dev/log local0
>
> log /dev/log local1 notice
>
> chroot /var/lib/haproxy
>
> stats socket /run/haproxy/admin.sock mode 660 level admin
>
> stats timeout 30s
>
> user haproxy
>
> group haproxy
>
> daemon
>
>
> # Default SSL material locations
>
> ca-base /etc/ssl/certs
>
> crt-base /etc/ssl/private
>
>
> # Default ciphers to use on SSL-enabled listening sockets.
>
> # For more information, see ciphers(1SSL). This list is from:
>
> #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
>
> ssl-default-bind-ciphers
> ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
>
> ssl-default-bind-options no-sslv3
>
>
> defaults
>
> log global
>
> mode http
>
> option httplog
>
> option dontlognull
>
> timeout connect 5000
>
> timeout client  5
>
> timeout server  5
>
>
> frontend haproxy
>
>bind *:80
>
>stats uri /stats
>
>stats realm Strictly\ Private
>
>stats auth pass:word
>
>
> # Define hosts
>
> #urls
>
> acl beta.example hdr(host) -i beta.example.com
>
>
>
> acl api.example hdr(host) -i api-example.com
>
>
>
> #cluster
>
> use_backend b.example if beta.example
>
>
> use_backend z.api if api.example
>
>
> #Frontend Server
>
>
> backend b.example
>
> mode http
>
> balance roundrobin
>
> option forwardfor
>
>server server01 10.0.0.1:80 check
>
>
> ##API
>
> backend z.api
>
> mode http
>
> balance roundrobin
>
> option forwardfor
>
> server api01 192.168.1.1:80 check
>
>
>
> Regard's
> Harish Chander
> 8529142143
>
>



-- 
Jeff Palmer
https://PalmerIT.net

Re: Configure Log in Haproxy ( Need help )

[ge...@riseup.net]

Hi Qing,

On 16-08-23 00:02:17, Qing Wang wrote:
> And the haproxy.conf in /etc/rsyslog.d/ is:
> # Create an additional socket in haproxy's chroot in order to allow
> logging via
> # /dev/log to chroot'ed HAProxy processes
> #$AddUnixListenSocket /var/lib/haproxy/dev/log

Uncomment this ^^^ line...

> $AddUnixListenSocket /dev/log

...comment that ^^^ one, restart rsyslog and HAProxy, and see if
this helps.

> I already create the log file inside the path /var/lib/haproxy/dev/log

If you're using rsyslog, you don't have to create the files manually. 

All the best,
Georg


signature.asc
Description: Digital signature

Need Help : Haproxy as server with CA signed cert to fetch self-signed client certificate

[Deepak Agarwal]

Hi Baptiste,
As discussed, Please help with inputs on the following.
http://discourse.haproxy.org/t/haproxy-as-server-with-ca-signed-cert-to-fetch-self-signed-client-certificate/551
http://discourse.haproxy.org/t/how-to-fetch-ssl-subjectaltname-san-extension-data-in-haproxy/539
 
Thanks,
Deepak
  

New projects need help

[jerrychen]

Hi,=20AreyoudealingwithLEDlights?ThisisJerryfromShenzhenGuohuiLightingEquipmentCo.,Ltd.ALED=originalmanufactuer.LEDfloodlight,highbay,cornlightareourbest-sellers.Plslinkourwebsite:www.guohui-light.com;ifyouwanttoknowmorea=boutourproduct.Thanksinadvance!JerryChenSalesManager=20GuohuiLightingEquipmentCo.,Ltd.www.guohui-light.com=20Ph:860755-89728339=20Mob:008618684678473Skype:jerry_chenbin=2051800071#XiangYinRd,NanLianCommunity,LongGangDistrict,ShenZhen,GuangDong,China

Re: Need Help

[Nitesh Kumar Gupta]

Hi Jeff,

I am having below configurations in haproxy

~
global
log 127.0.0.1 local0
log 127.0.0.1 local1 debug
chroot  /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
userhaproxy
group   haproxy
daemon
stats socket /var/lib/haproxy/stats
tune.ssl.default-dh-param 2048

defaults
modehttp
option  forwardfor
option  http-server-close
log global
option  tcplog
option  dontlognull
option  redispatch
retries 3
timeout http-request10s
timeout queue   1m
timeout connect 10s
timeout client  1m
timeout server  1m
timeout http-keep-alive 10s
timeout check   10s
maxconn 3000
stats   enable
stats   uri /stats
stats   realm Haproxy\ Statistics
stats   auth fusionops:fusion12

frontend www-http
bind :80
option httplog

reqadd X-Forwarded-Proto:\ http
use_backend www-backend-c1
   frontend www-https
bind :443 ssl crt /etc/pki/tls/private/wildcard.example.com.pem
reqadd X-Forwarded-Proto:\ https
acl path_c2 path_beg -i -f /etc/haproxy/c2.list
acl host_c1 hdr(host) -i test1.example.com
acl host_c2 hdr(host) -i test2.example.com

redirect prefix https://test2.example.com/ if path_c2 host_c1

use_backend www-backend-c1 if host_c1
use_backend www-backend-c2 if host_c2

backend www-backend-c1
mode http
redirect scheme https if !{ ssl_fc }
balance source
hash-type consistent
server prodapp1 prodapp1.example.com:80 weight 1 maxconn 512
check
server prodapp2 prodapp2.example.com:80 weight 1 maxconn 512
check
server prodapp3 prodapp3.example.com:80 weight 1 maxconn 512
check

backend www-backend-c2
mode http
redirect scheme https if !{ ssl_fc }
balance source
hash-type consistent
server prodappc2n1 prdappc2n1.example.com:80 weight 1 maxconn
512 check
#   server prodappc2n2 prdappc2n2.example.com:80 weight 1 maxconn
512 check

listen https
   bind *:443
   mode tcp
   option ssl-hello-chk
   option tcplog
   balance roundrobin
   server vm1 prdappc2n1.example.com:80weight 1 maxconn 512 check
~



Here both http and https and tcp is working in normal
but i want to set some conditional routing here for tcp
suppose if request coming from test1.example.com that should route to via
tcp on some perticular server

also can we do this with stiky table and 1 more question how can we route
tcp traffic to perticular server becouse i read somewhere acl is not
working with tcp

Please help me to resolve this question i am trying to resolve this from
last 10 days but no luck
Please help me.

On Mon, Sep 21, 2015 at 11:53 AM, Nitesh Kumar Gupta <
niteshgupta...@gmail.com> wrote:

> Hi  Jeff,joris
>
> Actually this is what i am looking for exactly for our production the
> earlier configuration for a test server only
> but the below is the exact thing which i am looking for can you please
> help on this please its very urgent for me
>
> Currently the connector is pointing to 192.168.104.109.
> When the connector (windows service OpsPRD) is started on fdev2 server it
> will first make a http URL call to the server 192.168.104.109 with the URL:
> /ispring/FileReaderServlet?fileName=lib/properties/ispring_properties.xml=274006AB_1837_48D1_A597_48A29B86A52D
>
> Here prj=274006AB_1837_48D1_A597_48A29B86A52D is the parameter which will
> help us decide where we want to route the tcp traffic.
> Lets say, if the parameter prj is equal to
> 274006AB_1837_48D1_A597_48A29B86A52D then it should get routed to
> prdappc2n2.
> For anything else it should go to prdappc2n1.
>
>
>
>
> Regards
> Nitesh
>
> On Sat, Sep 19, 2015 at 7:45 PM, Jeff Palmer  wrote:
>
>> I also noticed, you aren't doing anything on the frontend to determine if
>> the connection is TCP or http.  In fact, this looks nothing like the
>> example configuration I suggested.
>> On Sep 19, 2015 10:12 AM, "Jeff Palmer"  wrote:
>>
>>> As I previously mentioned, your frontend will need to use mode TCP.  You
>>> v have a defaults of mode http, and don't  change the mode on your front
>>> end.
>>>
>>> Give that a try, and report back.
>>> On Sep 19, 2015 9:44 AM, "Nitesh Kumar Gupta" 
>>> wrote:
>>>

 Hi All,

 I am repeating my question again coz all the suggestions din't here

 I am having 4 servers

 

Re: Need Help

[Nitesh Kumar Gupta]

Hi  Jeff,joris

Actually this is what i am looking for exactly for our production the
earlier configuration for a test server only
but the below is the exact thing which i am looking for can you please help
on this please its very urgent for me

Currently the connector is pointing to 192.168.104.109.
When the connector (windows service OpsPRD) is started on fdev2 server it
will first make a http URL call to the server 192.168.104.109 with the URL:
/ispring/FileReaderServlet?fileName=lib/properties/ispring_properties.xml=274006AB_1837_48D1_A597_48A29B86A52D

Here prj=274006AB_1837_48D1_A597_48A29B86A52D is the parameter which will
help us decide where we want to route the tcp traffic.
Lets say, if the parameter prj is equal to
274006AB_1837_48D1_A597_48A29B86A52D then it should get routed to
prdappc2n2.
For anything else it should go to prdappc2n1.




Regards
Nitesh

On Sat, Sep 19, 2015 at 7:45 PM, Jeff Palmer  wrote:

> I also noticed, you aren't doing anything on the frontend to determine if
> the connection is TCP or http.  In fact, this looks nothing like the
> example configuration I suggested.
> On Sep 19, 2015 10:12 AM, "Jeff Palmer"  wrote:
>
>> As I previously mentioned, your frontend will need to use mode TCP.  You
>> v have a defaults of mode http, and don't  change the mode on your front
>> end.
>>
>> Give that a try, and report back.
>> On Sep 19, 2015 9:44 AM, "Nitesh Kumar Gupta" 
>> wrote:
>>
>>>
>>> Hi All,
>>>
>>> I am repeating my question again coz all the suggestions din't here
>>>
>>> I am having 4 servers
>>>
>>> server1
>>> server2
>>> server3
>>> server4
>>>
>>>
>>> Now what i want
>>>
>>> if any request come from dev1.server.com that should forward to tcp on
>>> server4 and the normal opertion should be between the rest there servers
>>>
>>> I am using below configuration file but that is not working
>>>
>>> Please check the below config and provide me proper solution
>>>
>>> ~
>>> global
>>> log 127.0.0.1 local0
>>> log 127.0.0.1 local1 debug
>>> chroot  /var/lib/haproxy
>>> pidfile /var/run/haproxy.pid
>>> maxconn 4000
>>> userhaproxy
>>> group   haproxy
>>> daemon
>>> stats socket /var/lib/haproxy/stats
>>>
>>> defaults
>>> modehttp
>>> log global
>>> option  tcplog
>>> option  dontlognull
>>> option http-server-close
>>> option  redispatch
>>> retries 3
>>> timeout http-request10s
>>> timeout queue   1m
>>> timeout connect 10s
>>> timeout client  1m
>>> timeout server  1m
>>> timeout http-keep-alive 10s
>>> timeout check   10s
>>> maxconn 3000
>>>
>>> frontend haproxy_in
>>> bind *:80
>>> default_backend haproxy_http
>>> option httplog
>>> acl host1 hdr(host) -i dev1.server.com
>>>
>>> use_backend haproxy_http_tcp if host1
>>> backend haproxy_http
>>> balance roundrobin
>>> mode http
>>> server server1 server1:80 weight 1 maxconn 512 check
>>> server server2 server2:80 weight 1 maxconn 512 check
>>> server server3 server3:80 weight 1 maxconn 512 check
>>>
>>> backend haproxy_http_tcp
>>> bind *:443
>>> mode tcp
>>> option tcplog
>>> server server4 server4:80 weight 1 maxconn 512 check
>>>
>>>
>>> #listen https
>>> #bind *:443
>>> #mode tcp
>>> #option tcplog
>>> #balance roundrobin
>>> #   server vm1 prdappc2n2:443  weight 1 maxconn 512 check
>>>
>>>
>>> On Fri, Sep 18, 2015 at 12:24 PM, joris dedieu 
>>> wrote:
>>>
 Hi,

 2015-09-18 3:13 GMT+02:00 Nitesh Kumar Gupta :
 > Hi,
 >
 > I want to setup haproxy in way there that will work on both http and
 https
 > and also tpc but that will be conditional mean if any perticular link
 will
 > come that will go via tcp
 >
 > So can you help me how can i setup this

 You may find a lot of useful ressources by searching how make ssh and
 https work on the same port with haproxy. This is a common case on
 using http and tcp stuff on the same port (to bypass corporate proxies
 I presume).

 Joris


 >
 > --
 > Regards
 > Nitesh Kumar Gupta

>>>
>>>
>>>
>>> --
>>> Regards
>>> Nitesh Kumar Gupta
>>>
>>


-- 
Regards
Nitesh Kumar Gupta

Re: Need Help

[Jeff Palmer]

As I previously mentioned, your frontend will need to use mode TCP.  You v
have a defaults of mode http, and don't  change the mode on your front end.

Give that a try, and report back.
On Sep 19, 2015 9:44 AM, "Nitesh Kumar Gupta" 
wrote:

>
> Hi All,
>
> I am repeating my question again coz all the suggestions din't here
>
> I am having 4 servers
>
> server1
> server2
> server3
> server4
>
>
> Now what i want
>
> if any request come from dev1.server.com that should forward to tcp on
> server4 and the normal opertion should be between the rest there servers
>
> I am using below configuration file but that is not working
>
> Please check the below config and provide me proper solution
>
> ~
> global
> log 127.0.0.1 local0
> log 127.0.0.1 local1 debug
> chroot  /var/lib/haproxy
> pidfile /var/run/haproxy.pid
> maxconn 4000
> userhaproxy
> group   haproxy
> daemon
> stats socket /var/lib/haproxy/stats
>
> defaults
> modehttp
> log global
> option  tcplog
> option  dontlognull
> option http-server-close
> option  redispatch
> retries 3
> timeout http-request10s
> timeout queue   1m
> timeout connect 10s
> timeout client  1m
> timeout server  1m
> timeout http-keep-alive 10s
> timeout check   10s
> maxconn 3000
>
> frontend haproxy_in
> bind *:80
> default_backend haproxy_http
> option httplog
> acl host1 hdr(host) -i dev1.server.com
>
> use_backend haproxy_http_tcp if host1
> backend haproxy_http
> balance roundrobin
> mode http
> server server1 server1:80 weight 1 maxconn 512 check
> server server2 server2:80 weight 1 maxconn 512 check
> server server3 server3:80 weight 1 maxconn 512 check
>
> backend haproxy_http_tcp
> bind *:443
> mode tcp
> option tcplog
> server server4 server4:80 weight 1 maxconn 512 check
>
>
> #listen https
> #bind *:443
> #mode tcp
> #option tcplog
> #balance roundrobin
> #   server vm1 prdappc2n2:443  weight 1 maxconn 512 check
>
>
> On Fri, Sep 18, 2015 at 12:24 PM, joris dedieu 
> wrote:
>
>> Hi,
>>
>> 2015-09-18 3:13 GMT+02:00 Nitesh Kumar Gupta :
>> > Hi,
>> >
>> > I want to setup haproxy in way there that will work on both http and
>> https
>> > and also tpc but that will be conditional mean if any perticular link
>> will
>> > come that will go via tcp
>> >
>> > So can you help me how can i setup this
>>
>> You may find a lot of useful ressources by searching how make ssh and
>> https work on the same port with haproxy. This is a common case on
>> using http and tcp stuff on the same port (to bypass corporate proxies
>> I presume).
>>
>> Joris
>>
>>
>> >
>> > --
>> > Regards
>> > Nitesh Kumar Gupta
>>
>
>
>
> --
> Regards
> Nitesh Kumar Gupta
>

Re: Need Help

[Nitesh Kumar Gupta]

Hi All,

I am repeating my question again coz all the suggestions din't here

I am having 4 servers

server1
server2
server3
server4


Now what i want

if any request come from dev1.server.com that should forward to tcp on
server4 and the normal opertion should be between the rest there servers

I am using below configuration file but that is not working

Please check the below config and provide me proper solution

~
global
log 127.0.0.1 local0
log 127.0.0.1 local1 debug
chroot  /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
userhaproxy
group   haproxy
daemon
stats socket /var/lib/haproxy/stats

defaults
modehttp
log global
option  tcplog
option  dontlognull
option http-server-close
option  redispatch
retries 3
timeout http-request10s
timeout queue   1m
timeout connect 10s
timeout client  1m
timeout server  1m
timeout http-keep-alive 10s
timeout check   10s
maxconn 3000

frontend haproxy_in
bind *:80
default_backend haproxy_http
option httplog
acl host1 hdr(host) -i dev1.server.com

use_backend haproxy_http_tcp if host1
backend haproxy_http
balance roundrobin
mode http
server server1 server1:80 weight 1 maxconn 512 check
server server2 server2:80 weight 1 maxconn 512 check
server server3 server3:80 weight 1 maxconn 512 check

backend haproxy_http_tcp
bind *:443
mode tcp
option tcplog
server server4 server4:80 weight 1 maxconn 512 check


#listen https
#bind *:443
#mode tcp
#option tcplog
#balance roundrobin
#   server vm1 prdappc2n2:443  weight 1 maxconn 512 check


On Fri, Sep 18, 2015 at 12:24 PM, joris dedieu 
wrote:

> Hi,
>
> 2015-09-18 3:13 GMT+02:00 Nitesh Kumar Gupta :
> > Hi,
> >
> > I want to setup haproxy in way there that will work on both http and
> https
> > and also tpc but that will be conditional mean if any perticular link
> will
> > come that will go via tcp
> >
> > So can you help me how can i setup this
>
> You may find a lot of useful ressources by searching how make ssh and
> https work on the same port with haproxy. This is a common case on
> using http and tcp stuff on the same port (to bypass corporate proxies
> I presume).
>
> Joris
>
>
> >
> > --
> > Regards
> > Nitesh Kumar Gupta
>



-- 
Regards
Nitesh Kumar Gupta

Re: Need Help

[Jeff Palmer]

I also noticed, you aren't doing anything on the frontend to determine if
the connection is TCP or http.  In fact, this looks nothing like the
example configuration I suggested.
On Sep 19, 2015 10:12 AM, "Jeff Palmer"  wrote:

> As I previously mentioned, your frontend will need to use mode TCP.  You v
> have a defaults of mode http, and don't  change the mode on your front end.
>
> Give that a try, and report back.
> On Sep 19, 2015 9:44 AM, "Nitesh Kumar Gupta" 
> wrote:
>
>>
>> Hi All,
>>
>> I am repeating my question again coz all the suggestions din't here
>>
>> I am having 4 servers
>>
>> server1
>> server2
>> server3
>> server4
>>
>>
>> Now what i want
>>
>> if any request come from dev1.server.com that should forward to tcp on
>> server4 and the normal opertion should be between the rest there servers
>>
>> I am using below configuration file but that is not working
>>
>> Please check the below config and provide me proper solution
>>
>> ~
>> global
>> log 127.0.0.1 local0
>> log 127.0.0.1 local1 debug
>> chroot  /var/lib/haproxy
>> pidfile /var/run/haproxy.pid
>> maxconn 4000
>> userhaproxy
>> group   haproxy
>> daemon
>> stats socket /var/lib/haproxy/stats
>>
>> defaults
>> modehttp
>> log global
>> option  tcplog
>> option  dontlognull
>> option http-server-close
>> option  redispatch
>> retries 3
>> timeout http-request10s
>> timeout queue   1m
>> timeout connect 10s
>> timeout client  1m
>> timeout server  1m
>> timeout http-keep-alive 10s
>> timeout check   10s
>> maxconn 3000
>>
>> frontend haproxy_in
>> bind *:80
>> default_backend haproxy_http
>> option httplog
>> acl host1 hdr(host) -i dev1.server.com
>>
>> use_backend haproxy_http_tcp if host1
>> backend haproxy_http
>> balance roundrobin
>> mode http
>> server server1 server1:80 weight 1 maxconn 512 check
>> server server2 server2:80 weight 1 maxconn 512 check
>> server server3 server3:80 weight 1 maxconn 512 check
>>
>> backend haproxy_http_tcp
>> bind *:443
>> mode tcp
>> option tcplog
>> server server4 server4:80 weight 1 maxconn 512 check
>>
>>
>> #listen https
>> #bind *:443
>> #mode tcp
>> #option tcplog
>> #balance roundrobin
>> #   server vm1 prdappc2n2:443  weight 1 maxconn 512 check
>>
>>
>> On Fri, Sep 18, 2015 at 12:24 PM, joris dedieu 
>> wrote:
>>
>>> Hi,
>>>
>>> 2015-09-18 3:13 GMT+02:00 Nitesh Kumar Gupta :
>>> > Hi,
>>> >
>>> > I want to setup haproxy in way there that will work on both http and
>>> https
>>> > and also tpc but that will be conditional mean if any perticular link
>>> will
>>> > come that will go via tcp
>>> >
>>> > So can you help me how can i setup this
>>>
>>> You may find a lot of useful ressources by searching how make ssh and
>>> https work on the same port with haproxy. This is a common case on
>>> using http and tcp stuff on the same port (to bypass corporate proxies
>>> I presume).
>>>
>>> Joris
>>>
>>>
>>> >
>>> > --
>>> > Regards
>>> > Nitesh Kumar Gupta
>>>
>>
>>
>>
>> --
>> Regards
>> Nitesh Kumar Gupta
>>
>

Re: Need Help

[joris dedieu]

Hi,

2015-09-18 3:13 GMT+02:00 Nitesh Kumar Gupta :
> Hi,
>
> I want to setup haproxy in way there that will work on both http and https
> and also tpc but that will be conditional mean if any perticular link will
> come that will go via tcp
>
> So can you help me how can i setup this

You may find a lot of useful ressources by searching how make ssh and
https work on the same port with haproxy. This is a common case on
using http and tcp stuff on the same port (to bypass corporate proxies
I presume).

Joris


>
> --
> Regards
> Nitesh Kumar Gupta

Re: Need Help

[Nitesh Kumar Gupta]

But how it will be conditional
Mean suppose if I want anything that will access help that should go to TCP
rest should work with normal http or HTTPS
How can I configure this one
On Sep 18, 2015 7:05 AM, "Jeff Palmer"  wrote:

> You can have haproxy listen in both http mode, and tcp mode.  You'll
> just need to setup multiple frontends.
>
>
> something like:
>
> frontend myhttpservice
>   bind *:80
>   mode http
>   ...
>
>
> frontend mytcpservice
>   bind *:3306
>   mode tcp
>   ...
>
>
>
> If I misunderstood the request,  please feel free to post again, and
> clarify what you are asking to have haproxy do.
>
>
>
> On Thu, Sep 17, 2015 at 9:13 PM, Nitesh Kumar Gupta
>  wrote:
> > Hi,
> >
> > I want to setup haproxy in way there that will work on both http and
> https
> > and also tpc but that will be conditional mean if any perticular link
> will
> > come that will go via tcp
> >
> > So can you help me how can i setup this
> >
> > --
> > Regards
> > Nitesh Kumar Gupta
>
>
>
> --
> Jeff Palmer
> https://PalmerIT.net
>

Need Help

[Nitesh Kumar Gupta]

Hi,

I want to setup haproxy in way there that will work on both http and https
and also tpc but that will be conditional mean if any perticular link will
come that will go via tcp

So can you help me how can i setup this

-- 
Regards
Nitesh Kumar Gupta

Re: Need Help

[Jeff Palmer]

You can have haproxy listen in both http mode, and tcp mode.  You'll
just need to setup multiple frontends.


something like:

frontend myhttpservice
  bind *:80
  mode http
  ...


frontend mytcpservice
  bind *:3306
  mode tcp
  ...



If I misunderstood the request,  please feel free to post again, and
clarify what you are asking to have haproxy do.



On Thu, Sep 17, 2015 at 9:13 PM, Nitesh Kumar Gupta
 wrote:
> Hi,
>
> I want to setup haproxy in way there that will work on both http and https
> and also tpc but that will be conditional mean if any perticular link will
> come that will go via tcp
>
> So can you help me how can i setup this
>
> --
> Regards
> Nitesh Kumar Gupta



-- 
Jeff Palmer
https://PalmerIT.net

Re: Need Help

[Jeff Palmer]

Can you give us an example scenario?   Tell us the actual services you
want to use on the frontends and backends.  and how you would envision
your conditions to work?



On Thu, Sep 17, 2015 at 9:39 PM, Nitesh Kumar Gupta
 wrote:
> But how it will be conditional
> Mean suppose if I want anything that will access help that should go to TCP
> rest should work with normal http or HTTPS
> How can I configure this one
>
> On Sep 18, 2015 7:05 AM, "Jeff Palmer"  wrote:
>>
>> You can have haproxy listen in both http mode, and tcp mode.  You'll
>> just need to setup multiple frontends.
>>
>>
>> something like:
>>
>> frontend myhttpservice
>>   bind *:80
>>   mode http
>>   ...
>>
>>
>> frontend mytcpservice
>>   bind *:3306
>>   mode tcp
>>   ...
>>
>>
>>
>> If I misunderstood the request,  please feel free to post again, and
>> clarify what you are asking to have haproxy do.
>>
>>
>>
>> On Thu, Sep 17, 2015 at 9:13 PM, Nitesh Kumar Gupta
>>  wrote:
>> > Hi,
>> >
>> > I want to setup haproxy in way there that will work on both http and
>> > https
>> > and also tpc but that will be conditional mean if any perticular link
>> > will
>> > come that will go via tcp
>> >
>> > So can you help me how can i setup this
>> >
>> > --
>> > Regards
>> > Nitesh Kumar Gupta
>>
>>
>>
>> --
>> Jeff Palmer
>> https://PalmerIT.net



-- 
Jeff Palmer
https://PalmerIT.net

Re: Need Help

[Nitesh Kumar Gupta]

We have 4 servers where tomcat is running

server1
server2
server3
server4


and what i want the normal request will serve by the load balanced server
via http or https
server1
server2
server3

but if any request coming to access /portal that should routed through mode
tpc with port 80 or 443 to server4


IS that making clear you or need more explanation


On Fri, Sep 18, 2015 at 7:11 AM, Jeff Palmer  wrote:

> Can you give us an example scenario?   Tell us the actual services you
> want to use on the frontends and backends.  and how you would envision
> your conditions to work?
>
>
>
> On Thu, Sep 17, 2015 at 9:39 PM, Nitesh Kumar Gupta
>  wrote:
> > But how it will be conditional
> > Mean suppose if I want anything that will access help that should go to
> TCP
> > rest should work with normal http or HTTPS
> > How can I configure this one
> >
> > On Sep 18, 2015 7:05 AM, "Jeff Palmer"  wrote:
> >>
> >> You can have haproxy listen in both http mode, and tcp mode.  You'll
> >> just need to setup multiple frontends.
> >>
> >>
> >> something like:
> >>
> >> frontend myhttpservice
> >>   bind *:80
> >>   mode http
> >>   ...
> >>
> >>
> >> frontend mytcpservice
> >>   bind *:3306
> >>   mode tcp
> >>   ...
> >>
> >>
> >>
> >> If I misunderstood the request,  please feel free to post again, and
> >> clarify what you are asking to have haproxy do.
> >>
> >>
> >>
> >> On Thu, Sep 17, 2015 at 9:13 PM, Nitesh Kumar Gupta
> >>  wrote:
> >> > Hi,
> >> >
> >> > I want to setup haproxy in way there that will work on both http and
> >> > https
> >> > and also tpc but that will be conditional mean if any perticular link
> >> > will
> >> > come that will go via tcp
> >> >
> >> > So can you help me how can i setup this
> >> >
> >> > --
> >> > Regards
> >> > Nitesh Kumar Gupta
> >>
> >>
> >>
> >> --
> >> Jeff Palmer
> >> https://PalmerIT.net
>
>
>
> --
> Jeff Palmer
> https://PalmerIT.net
>



-- 
Regards
Nitesh Kumar Gupta

Re: Need Help

[Jeff Palmer]

Oh, I see now.   so you want this to all be over the same port?


If so, your frontend would have to be in mode tcp, and you'll lose
some of the benefits of http mode.   With that said,  the following
should work:


frontend foo
  bind *:80
  mode tcp
  tcp-request inspect-delay 5s
  tcp request content accept if HTTP

  use_backend be_http if HTTP
  default_backend be_tcp


backend be_http
  mode http
  server s1 10.10.10.1:80 check
  server s2 10.10.10.2:80 check
  server s3 10.10.10.3:80 check

backend be_tcp
  mode tcp
  ...
  (add whatever your tcp config is for server 4)




Please note,  I have not tested this, but in theory it should work.
it won't actually match a pattern of a client requesting /portal,
it'll just be looking for traffic coming in and then figuring out if
it's http traffic or not.  if not,  it gets sent to the "be_tcp"
backend.
Also,  for the sake of brevity,  I did not add a frontend for https,
which would traditionally listen on port 443,  however other than the
SSL-centric part of the config,  it should be nearly identical.

Is this closer to what you are looking for? I know it's not exactly
what you asked for since it's not pattern matching on the URI,  but I
don't believe that is possible with the frontend in TCP mode.  Someone
please correct me if I'm incorrect.









On Thu, Sep 17, 2015 at 9:48 PM, Nitesh Kumar Gupta
 wrote:
> We have 4 servers where tomcat is running
>
> server1
> server2
> server3
> server4
>
>
> and what i want the normal request will serve by the load balanced server
> via http or https
> server1
> server2
> server3
>
> but if any request coming to access /portal that should routed through mode
> tpc with port 80 or 443 to server4
>
>
> IS that making clear you or need more explanation
>
>
> On Fri, Sep 18, 2015 at 7:11 AM, Jeff Palmer  wrote:
>>
>> Can you give us an example scenario?   Tell us the actual services you
>> want to use on the frontends and backends.  and how you would envision
>> your conditions to work?
>>
>>
>>
>> On Thu, Sep 17, 2015 at 9:39 PM, Nitesh Kumar Gupta
>>  wrote:
>> > But how it will be conditional
>> > Mean suppose if I want anything that will access help that should go to
>> > TCP
>> > rest should work with normal http or HTTPS
>> > How can I configure this one
>> >
>> > On Sep 18, 2015 7:05 AM, "Jeff Palmer"  wrote:
>> >>
>> >> You can have haproxy listen in both http mode, and tcp mode.  You'll
>> >> just need to setup multiple frontends.
>> >>
>> >>
>> >> something like:
>> >>
>> >> frontend myhttpservice
>> >>   bind *:80
>> >>   mode http
>> >>   ...
>> >>
>> >>
>> >> frontend mytcpservice
>> >>   bind *:3306
>> >>   mode tcp
>> >>   ...
>> >>
>> >>
>> >>
>> >> If I misunderstood the request,  please feel free to post again, and
>> >> clarify what you are asking to have haproxy do.
>> >>
>> >>
>> >>
>> >> On Thu, Sep 17, 2015 at 9:13 PM, Nitesh Kumar Gupta
>> >>  wrote:
>> >> > Hi,
>> >> >
>> >> > I want to setup haproxy in way there that will work on both http and
>> >> > https
>> >> > and also tpc but that will be conditional mean if any perticular link
>> >> > will
>> >> > come that will go via tcp
>> >> >
>> >> > So can you help me how can i setup this
>> >> >
>> >> > --
>> >> > Regards
>> >> > Nitesh Kumar Gupta
>> >>
>> >>
>> >>
>> >> --
>> >> Jeff Palmer
>> >> https://PalmerIT.net
>>
>>
>>
>> --
>> Jeff Palmer
>> https://PalmerIT.net
>
>
>
>
> --
> Regards
> Nitesh Kumar Gupta



-- 
Jeff Palmer
https://PalmerIT.net

Re: Need Help

[Nitesh Kumar Gupta]

Thanks will try and let you know if it works
On Sep 18, 2015 7:44 AM, "Jeff Palmer"  wrote:

> Oh, I see now.   so you want this to all be over the same port?
>
>
> If so, your frontend would have to be in mode tcp, and you'll lose
> some of the benefits of http mode.   With that said,  the following
> should work:
>
>
> frontend foo
>   bind *:80
>   mode tcp
>   tcp-request inspect-delay 5s
>   tcp request content accept if HTTP
>
>   use_backend be_http if HTTP
>   default_backend be_tcp
>
>
> backend be_http
>   mode http
>   server s1 10.10.10.1:80 check
>   server s2 10.10.10.2:80 check
>   server s3 10.10.10.3:80 check
>
> backend be_tcp
>   mode tcp
>   ...
>   (add whatever your tcp config is for server 4)
>
>
>
>
> Please note,  I have not tested this, but in theory it should work.
> it won't actually match a pattern of a client requesting /portal,
> it'll just be looking for traffic coming in and then figuring out if
> it's http traffic or not.  if not,  it gets sent to the "be_tcp"
> backend.
> Also,  for the sake of brevity,  I did not add a frontend for https,
> which would traditionally listen on port 443,  however other than the
> SSL-centric part of the config,  it should be nearly identical.
>
> Is this closer to what you are looking for? I know it's not exactly
> what you asked for since it's not pattern matching on the URI,  but I
> don't believe that is possible with the frontend in TCP mode.  Someone
> please correct me if I'm incorrect.
>
>
>
>
>
>
>
>
>
> On Thu, Sep 17, 2015 at 9:48 PM, Nitesh Kumar Gupta
>  wrote:
> > We have 4 servers where tomcat is running
> >
> > server1
> > server2
> > server3
> > server4
> >
> >
> > and what i want the normal request will serve by the load balanced server
> > via http or https
> > server1
> > server2
> > server3
> >
> > but if any request coming to access /portal that should routed through
> mode
> > tpc with port 80 or 443 to server4
> >
> >
> > IS that making clear you or need more explanation
> >
> >
> > On Fri, Sep 18, 2015 at 7:11 AM, Jeff Palmer  wrote:
> >>
> >> Can you give us an example scenario?   Tell us the actual services you
> >> want to use on the frontends and backends.  and how you would envision
> >> your conditions to work?
> >>
> >>
> >>
> >> On Thu, Sep 17, 2015 at 9:39 PM, Nitesh Kumar Gupta
> >>  wrote:
> >> > But how it will be conditional
> >> > Mean suppose if I want anything that will access help that should go
> to
> >> > TCP
> >> > rest should work with normal http or HTTPS
> >> > How can I configure this one
> >> >
> >> > On Sep 18, 2015 7:05 AM, "Jeff Palmer"  wrote:
> >> >>
> >> >> You can have haproxy listen in both http mode, and tcp mode.  You'll
> >> >> just need to setup multiple frontends.
> >> >>
> >> >>
> >> >> something like:
> >> >>
> >> >> frontend myhttpservice
> >> >>   bind *:80
> >> >>   mode http
> >> >>   ...
> >> >>
> >> >>
> >> >> frontend mytcpservice
> >> >>   bind *:3306
> >> >>   mode tcp
> >> >>   ...
> >> >>
> >> >>
> >> >>
> >> >> If I misunderstood the request,  please feel free to post again, and
> >> >> clarify what you are asking to have haproxy do.
> >> >>
> >> >>
> >> >>
> >> >> On Thu, Sep 17, 2015 at 9:13 PM, Nitesh Kumar Gupta
> >> >>  wrote:
> >> >> > Hi,
> >> >> >
> >> >> > I want to setup haproxy in way there that will work on both http
> and
> >> >> > https
> >> >> > and also tpc but that will be conditional mean if any perticular
> link
> >> >> > will
> >> >> > come that will go via tcp
> >> >> >
> >> >> > So can you help me how can i setup this
> >> >> >
> >> >> > --
> >> >> > Regards
> >> >> > Nitesh Kumar Gupta
> >> >>
> >> >>
> >> >>
> >> >> --
> >> >> Jeff Palmer
> >> >> https://PalmerIT.net
> >>
> >>
> >>
> >> --
> >> Jeff Palmer
> >> https://PalmerIT.net
> >
> >
> >
> >
> > --
> > Regards
> > Nitesh Kumar Gupta
>
>
>
> --
> Jeff Palmer
> https://PalmerIT.net
>

Re: Need Help

[Jeff Palmer]

Please do,  I'd be interested in knowing if it worked in reality, the
way I suspect it'd work in theory!



On Thu, Sep 17, 2015 at 10:29 PM, Nitesh Kumar Gupta
 wrote:
> Thanks will try and let you know if it works
>
> On Sep 18, 2015 7:44 AM, "Jeff Palmer"  wrote:
>>
>> Oh, I see now.   so you want this to all be over the same port?
>>
>>
>> If so, your frontend would have to be in mode tcp, and you'll lose
>> some of the benefits of http mode.   With that said,  the following
>> should work:
>>
>>
>> frontend foo
>>   bind *:80
>>   mode tcp
>>   tcp-request inspect-delay 5s
>>   tcp request content accept if HTTP
>>
>>   use_backend be_http if HTTP
>>   default_backend be_tcp
>>
>>
>> backend be_http
>>   mode http
>>   server s1 10.10.10.1:80 check
>>   server s2 10.10.10.2:80 check
>>   server s3 10.10.10.3:80 check
>>
>> backend be_tcp
>>   mode tcp
>>   ...
>>   (add whatever your tcp config is for server 4)
>>
>>
>>
>>
>> Please note,  I have not tested this, but in theory it should work.
>> it won't actually match a pattern of a client requesting /portal,
>> it'll just be looking for traffic coming in and then figuring out if
>> it's http traffic or not.  if not,  it gets sent to the "be_tcp"
>> backend.
>> Also,  for the sake of brevity,  I did not add a frontend for https,
>> which would traditionally listen on port 443,  however other than the
>> SSL-centric part of the config,  it should be nearly identical.
>>
>> Is this closer to what you are looking for? I know it's not exactly
>> what you asked for since it's not pattern matching on the URI,  but I
>> don't believe that is possible with the frontend in TCP mode.  Someone
>> please correct me if I'm incorrect.
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> On Thu, Sep 17, 2015 at 9:48 PM, Nitesh Kumar Gupta
>>  wrote:
>> > We have 4 servers where tomcat is running
>> >
>> > server1
>> > server2
>> > server3
>> > server4
>> >
>> >
>> > and what i want the normal request will serve by the load balanced
>> > server
>> > via http or https
>> > server1
>> > server2
>> > server3
>> >
>> > but if any request coming to access /portal that should routed through
>> > mode
>> > tpc with port 80 or 443 to server4
>> >
>> >
>> > IS that making clear you or need more explanation
>> >
>> >
>> > On Fri, Sep 18, 2015 at 7:11 AM, Jeff Palmer  wrote:
>> >>
>> >> Can you give us an example scenario?   Tell us the actual services you
>> >> want to use on the frontends and backends.  and how you would envision
>> >> your conditions to work?
>> >>
>> >>
>> >>
>> >> On Thu, Sep 17, 2015 at 9:39 PM, Nitesh Kumar Gupta
>> >>  wrote:
>> >> > But how it will be conditional
>> >> > Mean suppose if I want anything that will access help that should go
>> >> > to
>> >> > TCP
>> >> > rest should work with normal http or HTTPS
>> >> > How can I configure this one
>> >> >
>> >> > On Sep 18, 2015 7:05 AM, "Jeff Palmer"  wrote:
>> >> >>
>> >> >> You can have haproxy listen in both http mode, and tcp mode.  You'll
>> >> >> just need to setup multiple frontends.
>> >> >>
>> >> >>
>> >> >> something like:
>> >> >>
>> >> >> frontend myhttpservice
>> >> >>   bind *:80
>> >> >>   mode http
>> >> >>   ...
>> >> >>
>> >> >>
>> >> >> frontend mytcpservice
>> >> >>   bind *:3306
>> >> >>   mode tcp
>> >> >>   ...
>> >> >>
>> >> >>
>> >> >>
>> >> >> If I misunderstood the request,  please feel free to post again, and
>> >> >> clarify what you are asking to have haproxy do.
>> >> >>
>> >> >>
>> >> >>
>> >> >> On Thu, Sep 17, 2015 at 9:13 PM, Nitesh Kumar Gupta
>> >> >>  wrote:
>> >> >> > Hi,
>> >> >> >
>> >> >> > I want to setup haproxy in way there that will work on both http
>> >> >> > and
>> >> >> > https
>> >> >> > and also tpc but that will be conditional mean if any perticular
>> >> >> > link
>> >> >> > will
>> >> >> > come that will go via tcp
>> >> >> >
>> >> >> > So can you help me how can i setup this
>> >> >> >
>> >> >> > --
>> >> >> > Regards
>> >> >> > Nitesh Kumar Gupta
>> >> >>
>> >> >>
>> >> >>
>> >> >> --
>> >> >> Jeff Palmer
>> >> >> https://PalmerIT.net
>> >>
>> >>
>> >>
>> >> --
>> >> Jeff Palmer
>> >> https://PalmerIT.net
>> >
>> >
>> >
>> >
>> > --
>> > Regards
>> > Nitesh Kumar Gupta
>>
>>
>>
>> --
>> Jeff Palmer
>> https://PalmerIT.net



-- 
Jeff Palmer
https://PalmerIT.net

Re: Need help about ACLs settings

[Thierry FOURNIER]

On Fri, 12 Jun 2015 14:46:42 +0200
Thibault Labrut thibault.lab...@enioka.com wrote:

 Hi,
 
 Thx for your help.
 
 But now I’ve an other issue.
 
 When we put on a bottom in form, the url is :
 http://foo.domain.com:42/index.htm.
 
 I want rewrite url like this : http://foo.domain.com/index.htm
 
 For this operation, I use the function rspirep in backend (LB)
 
 rspirep ^Location:\ (.*):30200(.*)  Location:\ \1\2
 
 But without success.


This configuration seems to be ok. Do you have more context ? A full
configuration file ?

Note that in your example you declares a port 42, and in your example,
the port 30200 is matched.

Thierry


 
 Cordialement,
 -- 
 Thibault Labrut
 enioka
 24 galerie Saint-Marc
 75002 Paris
 +33 615 700 935
 +33 144 618 314
 
 De :  Thierry t...@thierry.1s.fr
 Date :  jeudi 11 juin 2015 17:21
 À :  Thibault Labrut thibault.lab...@enioka.com
 Cc :  haproxy@formilux.org haproxy@formilux.org
 Objet :  Re: Need help about ACLs settings
 
 On Thu, 11 Jun 2015 16:51:14 +0200
 Thibault Labrut thibault.lab...@enioka.com wrote:
 
   Hi Thierry,
   
   If I understand your propsition, my settings shourld be like this :
 
 
 You must add option forwardfor in the RP frontend.
 
 Thierry
 
 
 
   ‹ RP settings (no change)
   
   # Frontend
   frontend http_test
   bind xx.xx.xx.xx:42
   capture request header Host len 200
   
   # ACL
   acl acl_test src 12.34.56.78 (IP client)
   use_backend test if acl_test
   
   # Backend
   backend test
   server srv_ test test.maycompany.local:42 check
   
   ‹ LB settings
   # Frontend
   frontend http_test
   bind xx.xx.xx.xx:42
   capture request header Host len 200
   
   # ACL (new acl setting)
   acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78
   use_backend test if acl_test
   
   # Backend
   backend test
   balance roundrobin
   server test01 xx.xx.xx.xx:42 check
   server test02 xx.xx.xx.xx:42 check
   
   Thibault Labrut.
   
   De :  Thierry FOURNIER tfourn...@haproxy.com
   Date :  jeudi 11 juin 2015 11:56
   À :  Thibault Labrut t.lab...@pickup-services.com
   Cc :  haproxy@formilux.org haproxy@formilux.org
   Objet :  Re: Need help about ACLs settings
   
   On Thu, 11 Jun 2015 09:06:43 +
   Thibault LABRUT t.lab...@pickup-services.com wrote:
   
 Hello,
 
 I¹m going to install HA Proxy.
 
 My architecture is as folows :
 - 2 servers in DMZ = reverse proxy (RP)
 - 2 servers in LAN = Load balancing (LB)
 
 Several applications contact RP with different IP adress but with 
  always
 de
same port.
 
 With the settings as below the connection is up :
 
 RP settings
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 default_backend test
 
 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check
 
 LB settings
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 default_backend test
 
 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check
 
 But in this case the connection is down :
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 
 # ACL
 acl acl_test src 12.34.56.78 (IP client)
 use_backend test if acl_test
 
 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check
 
 LB settings
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 
 # ACL
 acl acl_test src 12.34.56.78
 use_backend test if acl_test
 
 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check
 
 Can you say me what is the problem with my settings?
 
   
   
   Hi,
   
   If I understand, you have two HAProxy chained, RP is in front and LB is
   in back.
   
   In this case, the connexions received by the LB load balancer cannot
   known the original IP source, because the connexions are established by
   the LB load balancer with its own IP.
   
   You can use the header x-forwarded-for for string the original ip
   source. The directive is option forwardfor. On the LB HAProxy, you
   can use a sample taht returns the content of the header
   x-forwarded-for, like this:
   
  acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78
   
   best regards
   Thierry
   
   
 Best Regards,
 
 Thibault Labrut.
   
   
   
 
 
 


-- 
Thierry FOURNIER thierry.fourn...@arpalert.org

Re: Need help about ACLs settings

[Thibault Labrut]

Hi,

Thx for your help.

But now I’ve an other issue.

When we put on a bottom in form, the url is :
http://foo.domain.com:42/index.htm.

I want rewrite url like this : http://foo.domain.com/index.htm

For this operation, I use the function rspirep in backend (LB)

rspirep ^Location:\ (.*):30200(.*)  Location:\ \1\2

But without success.

Cordialement,
-- 
Thibault Labrut
enioka
24 galerie Saint-Marc
75002 Paris
+33 615 700 935
+33 144 618 314

De :  Thierry t...@thierry.1s.fr
Date :  jeudi 11 juin 2015 17:21
À :  Thibault Labrut thibault.lab...@enioka.com
Cc :  haproxy@formilux.org haproxy@formilux.org
Objet :  Re: Need help about ACLs settings

On Thu, 11 Jun 2015 16:51:14 +0200
Thibault Labrut thibault.lab...@enioka.com wrote:

  Hi Thierry,
  
  If I understand your propsition, my settings shourld be like this :


You must add option forwardfor in the RP frontend.

Thierry



  ‹ RP settings (no change)
  
  # Frontend
  frontend http_test
  bind xx.xx.xx.xx:42
  capture request header Host len 200
  
  # ACL
  acl acl_test src 12.34.56.78 (IP client)
  use_backend test if acl_test
  
  # Backend
  backend test
  server srv_ test test.maycompany.local:42 check
  
  ‹ LB settings
  # Frontend
  frontend http_test
  bind xx.xx.xx.xx:42
  capture request header Host len 200
  
  # ACL (new acl setting)
  acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78
  use_backend test if acl_test
  
  # Backend
  backend test
  balance roundrobin
  server test01 xx.xx.xx.xx:42 check
  server test02 xx.xx.xx.xx:42 check
  
  Thibault Labrut.
  
  De :  Thierry FOURNIER tfourn...@haproxy.com
  Date :  jeudi 11 juin 2015 11:56
  À :  Thibault Labrut t.lab...@pickup-services.com
  Cc :  haproxy@formilux.org haproxy@formilux.org
  Objet :  Re: Need help about ACLs settings
  
  On Thu, 11 Jun 2015 09:06:43 +
  Thibault LABRUT t.lab...@pickup-services.com wrote:
  
Hello,

I¹m going to install HA Proxy.

My architecture is as folows :
- 2 servers in DMZ = reverse proxy (RP)
- 2 servers in LAN = Load balancing (LB)

Several applications contact RP with different IP adress but with always
de
   same port.

With the settings as below the connection is up :

RP settings

# Frontend
frontend http_test
bind xx.xx.xx.xx:42
capture request header Host len 200
default_backend test

# Backend
backend test
server srv_ test test.maycompany.local:42 check

LB settings

# Frontend
frontend http_test
bind xx.xx.xx.xx:42
capture request header Host len 200
default_backend test

# Backend
backend test
balance roundrobin
server test01 xx.xx.xx.xx:42 check
server test02 xx.xx.xx.xx:42 check

But in this case the connection is down :

# Frontend
frontend http_test
bind xx.xx.xx.xx:42
capture request header Host len 200

# ACL
acl acl_test src 12.34.56.78 (IP client)
use_backend test if acl_test

# Backend
backend test
server srv_ test test.maycompany.local:42 check

LB settings

# Frontend
frontend http_test
bind xx.xx.xx.xx:42
capture request header Host len 200

# ACL
acl acl_test src 12.34.56.78
use_backend test if acl_test

# Backend
backend test
balance roundrobin
server test01 xx.xx.xx.xx:42 check
server test02 xx.xx.xx.xx:42 check

Can you say me what is the problem with my settings?

  
  
  Hi,
  
  If I understand, you have two HAProxy chained, RP is in front and LB is
  in back.
  
  In this case, the connexions received by the LB load balancer cannot
  known the original IP source, because the connexions are established by
  the LB load balancer with its own IP.
  
  You can use the header x-forwarded-for for string the original ip
  source. The directive is option forwardfor. On the LB HAProxy, you
  can use a sample taht returns the content of the header
  x-forwarded-for, like this:
  
 acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78
  
  best regards
  Thierry
  
  
Best Regards,

Thibault Labrut.
  
  
  

Re: Need help about ACLs settings

[Baptiste]

On Thu, Jun 11, 2015 at 11:06 AM, Thibault LABRUT
t.lab...@pickup-services.com wrote:
 Hello,

 I’m going to install HA Proxy.

 My architecture is as folows :
 - 2 servers in DMZ = reverse proxy (RP)
 - 2 servers in LAN = Load balancing (LB)

 Several applications contact RP with different IP adress but with always de
 same port.

 With the settings as below the connection is up :

 RP settings

 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 default_backend test

 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check

 LB settings

 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 default_backend test

 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check

 But in this case the connection is down :

 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200

 # ACL
 acl acl_test src 12.34.56.78 (IP client)
 use_backend test if acl_test

 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check

 LB settings

 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200

 # ACL
 acl acl_test src 12.34.56.78
 use_backend test if acl_test

 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check

 Can you say me what is the problem with my settings?

 Best Regards,

 Thibault Labrut.



Hi Thibault,

In the second case, you don't have any default backend.
So you'll get a 503 unless you are 12.34.56.78.

Baptiste

Re: Need help about ACLs settings

[Thierry FOURNIER]

On Thu, 11 Jun 2015 09:06:43 +
Thibault LABRUT t.lab...@pickup-services.com wrote:

 Hello,
 
 I’m going to install HA Proxy.
 
 My architecture is as folows :
 - 2 servers in DMZ = reverse proxy (RP)
 - 2 servers in LAN = Load balancing (LB)
 
 Several applications contact RP with different IP adress but with always de 
 same port.
 
 With the settings as below the connection is up :
 
 RP settings
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 default_backend test
 
 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check
 
 LB settings
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 default_backend test
 
 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check
 
 But in this case the connection is down :
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 
 # ACL
 acl acl_test src 12.34.56.78 (IP client)
 use_backend test if acl_test
 
 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check
 
 LB settings
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 
 # ACL
 acl acl_test src 12.34.56.78
 use_backend test if acl_test
 
 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check
 
 Can you say me what is the problem with my settings?
 


Hi,

If I understand, you have two HAProxy chained, RP is in front and LB is
in back.

In this case, the connexions received by the LB load balancer cannot
known the original IP source, because the connexions are established by
the LB load balancer with its own IP.

You can use the header x-forwarded-for for string the original ip
source. The directive is option forwardfor. On the LB HAProxy, you
can use a sample taht returns the content of the header
x-forwarded-for, like this:

   acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78

best regards
Thierry


 Best Regards,
 
 Thibault Labrut.

Re: Need help about ACLs settings

[Thibault Labrut]

Hi Thierry,

If I understand your propsition, my settings shourld be like this :

‹ RP settings (no change)

# Frontend
frontend http_test
bind xx.xx.xx.xx:42
capture request header Host len 200

# ACL
acl acl_test src 12.34.56.78 (IP client)
use_backend test if acl_test

# Backend
backend test
server srv_ test test.maycompany.local:42 check

‹ LB settings
# Frontend
frontend http_test
bind xx.xx.xx.xx:42
capture request header Host len 200

# ACL (new acl setting)
acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78
use_backend test if acl_test

# Backend
backend test
balance roundrobin
server test01 xx.xx.xx.xx:42 check
server test02 xx.xx.xx.xx:42 check

Thibault Labrut.

De :  Thierry FOURNIER tfourn...@haproxy.com
Date :  jeudi 11 juin 2015 11:56
À :  Thibault Labrut t.lab...@pickup-services.com
Cc :  haproxy@formilux.org haproxy@formilux.org
Objet :  Re: Need help about ACLs settings

On Thu, 11 Jun 2015 09:06:43 +
Thibault LABRUT t.lab...@pickup-services.com wrote:

  Hello,
  
  I¹m going to install HA Proxy.
  
  My architecture is as folows :
  - 2 servers in DMZ = reverse proxy (RP)
  - 2 servers in LAN = Load balancing (LB)
  
  Several applications contact RP with different IP adress but with always de
 same port.
  
  With the settings as below the connection is up :
  
  RP settings
  
  # Frontend
  frontend http_test
  bind xx.xx.xx.xx:42
  capture request header Host len 200
  default_backend test
  
  # Backend
  backend test
  server srv_ test test.maycompany.local:42 check
  
  LB settings
  
  # Frontend
  frontend http_test
  bind xx.xx.xx.xx:42
  capture request header Host len 200
  default_backend test
  
  # Backend
  backend test
  balance roundrobin
  server test01 xx.xx.xx.xx:42 check
  server test02 xx.xx.xx.xx:42 check
  
  But in this case the connection is down :
  
  # Frontend
  frontend http_test
  bind xx.xx.xx.xx:42
  capture request header Host len 200
  
  # ACL
  acl acl_test src 12.34.56.78 (IP client)
  use_backend test if acl_test
  
  # Backend
  backend test
  server srv_ test test.maycompany.local:42 check
  
  LB settings
  
  # Frontend
  frontend http_test
  bind xx.xx.xx.xx:42
  capture request header Host len 200
  
  # ACL
  acl acl_test src 12.34.56.78
  use_backend test if acl_test
  
  # Backend
  backend test
  balance roundrobin
  server test01 xx.xx.xx.xx:42 check
  server test02 xx.xx.xx.xx:42 check
  
  Can you say me what is the problem with my settings?
  


Hi,

If I understand, you have two HAProxy chained, RP is in front and LB is
in back.

In this case, the connexions received by the LB load balancer cannot
known the original IP source, because the connexions are established by
the LB load balancer with its own IP.

You can use the header x-forwarded-for for string the original ip
source. The directive is option forwardfor. On the LB HAProxy, you
can use a sample taht returns the content of the header
x-forwarded-for, like this:

   acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78

best regards
Thierry


  Best Regards,
  
  Thibault Labrut.

Re: Need help about ACLs settings

[Baptiste]

Or enable the proxy-protocol :
  
http://cbonte.github.io/haproxy-dconv/snapshot/configuration-1.5.html#send-proxy
  
http://cbonte.github.io/haproxy-dconv/snapshot/configuration-1.5.html#accept-proxy

Baptiste

On Thu, Jun 11, 2015 at 11:56 AM, Thierry FOURNIER
tfourn...@haproxy.com wrote:
 On Thu, 11 Jun 2015 09:06:43 +
 Thibault LABRUT t.lab...@pickup-services.com wrote:

 Hello,

 I’m going to install HA Proxy.

 My architecture is as folows :
 - 2 servers in DMZ = reverse proxy (RP)
 - 2 servers in LAN = Load balancing (LB)

 Several applications contact RP with different IP adress but with always de 
 same port.

 With the settings as below the connection is up :

 RP settings

 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 default_backend test

 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check

 LB settings

 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 default_backend test

 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check

 But in this case the connection is down :

 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200

 # ACL
 acl acl_test src 12.34.56.78 (IP client)
 use_backend test if acl_test

 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check

 LB settings

 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200

 # ACL
 acl acl_test src 12.34.56.78
 use_backend test if acl_test

 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check

 Can you say me what is the problem with my settings?



 Hi,

 If I understand, you have two HAProxy chained, RP is in front and LB is
 in back.

 In this case, the connexions received by the LB load balancer cannot
 known the original IP source, because the connexions are established by
 the LB load balancer with its own IP.

 You can use the header x-forwarded-for for string the original ip
 source. The directive is option forwardfor. On the LB HAProxy, you
 can use a sample taht returns the content of the header
 x-forwarded-for, like this:

acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78

 best regards
 Thierry


 Best Regards,

 Thibault Labrut.

Re: Need help about ACLs settings

[Thierry]

On Thu, 11 Jun 2015 16:51:14 +0200
Thibault Labrut thibault.lab...@enioka.com wrote:

 Hi Thierry,
 
 If I understand your propsition, my settings shourld be like this :


You must add option forwardfor in the RP frontend.

Thierry



 ‹ RP settings (no change)
 
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 
 # ACL
 acl acl_test src 12.34.56.78 (IP client)
 use_backend test if acl_test
 
 # Backend
 backend test
 server srv_ test test.maycompany.local:42 check
 
 ‹ LB settings
 # Frontend
 frontend http_test
 bind xx.xx.xx.xx:42
 capture request header Host len 200
 
 # ACL (new acl setting)
 acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78
 use_backend test if acl_test
 
 # Backend
 backend test
 balance roundrobin
 server test01 xx.xx.xx.xx:42 check
 server test02 xx.xx.xx.xx:42 check
 
 Thibault Labrut.
 
 De :  Thierry FOURNIER tfourn...@haproxy.com
 Date :  jeudi 11 juin 2015 11:56
 À :  Thibault Labrut t.lab...@pickup-services.com
 Cc :  haproxy@formilux.org haproxy@formilux.org
 Objet :  Re: Need help about ACLs settings
 
 On Thu, 11 Jun 2015 09:06:43 +
 Thibault LABRUT t.lab...@pickup-services.com wrote:
 
   Hello,
   
   I¹m going to install HA Proxy.
   
   My architecture is as folows :
   - 2 servers in DMZ = reverse proxy (RP)
   - 2 servers in LAN = Load balancing (LB)
   
   Several applications contact RP with different IP adress but with always de
  same port.
   
   With the settings as below the connection is up :
   
   RP settings
   
   # Frontend
   frontend http_test
   bind xx.xx.xx.xx:42
   capture request header Host len 200
   default_backend test
   
   # Backend
   backend test
   server srv_ test test.maycompany.local:42 check
   
   LB settings
   
   # Frontend
   frontend http_test
   bind xx.xx.xx.xx:42
   capture request header Host len 200
   default_backend test
   
   # Backend
   backend test
   balance roundrobin
   server test01 xx.xx.xx.xx:42 check
   server test02 xx.xx.xx.xx:42 check
   
   But in this case the connection is down :
   
   # Frontend
   frontend http_test
   bind xx.xx.xx.xx:42
   capture request header Host len 200
   
   # ACL
   acl acl_test src 12.34.56.78 (IP client)
   use_backend test if acl_test
   
   # Backend
   backend test
   server srv_ test test.maycompany.local:42 check
   
   LB settings
   
   # Frontend
   frontend http_test
   bind xx.xx.xx.xx:42
   capture request header Host len 200
   
   # ACL
   acl acl_test src 12.34.56.78
   use_backend test if acl_test
   
   # Backend
   backend test
   balance roundrobin
   server test01 xx.xx.xx.xx:42 check
   server test02 xx.xx.xx.xx:42 check
   
   Can you say me what is the problem with my settings?
   
 
 
 Hi,
 
 If I understand, you have two HAProxy chained, RP is in front and LB is
 in back.
 
 In this case, the connexions received by the LB load balancer cannot
 known the original IP source, because the connexions are established by
 the LB load balancer with its own IP.
 
 You can use the header x-forwarded-for for string the original ip
 source. The directive is option forwardfor. On the LB HAProxy, you
 can use a sample taht returns the content of the header
 x-forwarded-for, like this:
 
acl acl_test fhdr(x-forwarded-for) -m ipv4 12.34.56.78
 
 best regards
 Thierry
 
 
   Best Regards,
   
   Thibault Labrut.
 
 
 

Re: Need help with HAProxy configuration mixed content http and https

[Tu Nguyen]

Thanks Baptise,
Let me give this a try.

On May 21, 2015, at 5:26 AM, Baptiste bed...@gmail.com wrote:

it seems your client get connected using HTTPs on the HTTP port of haproxy.
you must make your application aware that SSL offloading is being performed by 
a device in front of it.
Some hints:
http://blog.haproxy.com/2013/02/26/ssl-offloading-impact-on-web-applications/ 
http://blog.haproxy.com/2013/02/26/ssl-offloading-impact-on-web-applications/

Baptiste

On Wed, May 20, 2015 at 9:41 AM, Tu Nguyen nguyenhongtu...@gmail.com 
mailto:nguyenhongtu...@gmail.com wrote:
Hi Baptiste,

This is all my configuration.
be_game5_http is be_host01_http, I changed it because of sensitive reason. I’m 
sorry if it made you confused!
Here is haproxy log:

# this log generated when I visit host01.vn http://host01.vn/

May 20 14:21:36 localhost haproxy[22380]: 123.30.173.99:41879 
http://123.30.173.99:41879/ [20/May/2015:14:21:36.235] fe_http 
be_host01_http/HOST_9 0/0/0/6/7 200 12764 - -  1/1/0/1/0 0/0 GET / 
HTTP/1.1
May 20 14:21:36 localhost haproxy[22380]: 123.30.173.99:41879 
http://123.30.173.99:41879/ [20/May/2015:14:21:36.242] fe_http 
be_host01_http/HOST_10 290/0/0/1/291 304 348 - -  1/1/0/1/0 0/0 GET 
/static/css/fancybox/jquery.fancybox-1.3.4.css HTTP/1.1
May 20 14:21:36 localhost haproxy[22380]: 123.30.173.99:41879 
http://123.30.173.99:41879/ [20/May/2015:14:21:36.534] fe_http 
be_host01_http/HOST_9 39/0/0/1/40 304 349 - -  2/2/0/1/0 0/0 GET 
/static/js/default/jquery-1.8.3.min.js HTTP/1.1
May 20 14:21:36 localhost haproxy[22380]: 123.30.173.99:41879 
http://123.30.173.99:41879/ [20/May/2015:14:21:36.574] fe_http 
be_host01_http/HOST_10 82/0/1/0/83 304 348 - -  2/2/0/1/0 0/0 GET 
/static/js/fancybox/jquery.fancybox-1.3.4.min.js HTTP/1.1

# this log generated when I visit https://host01.vn https://host01.vn/

May 20 14:21:56 localhost haproxy[22380]: 123.30.173.99:32217 
http://123.30.173.99:32217/ [20/May/2015:14:21:36.568] fe_http 
fe_http/NOSRV -1/-1/-1/-1/19768 400 0 - - CR-- 1/1/0/0/0 0/0 BADREQ

There are some images when I visit host01.vn http://host01.vn/, with tcp 
mode, it works:
qq2015052...@2x.png

With mode http, it doesn’t work:
qq2015052...@2x.png

Thanks and Best regards,
Tu Nguyen,

On May 20, 2015, at 1:56 PM, Baptiste bed...@gmail.com 
mailto:bed...@gmail.com wrote:

On Wed, May 20, 2015 at 6:49 AM, Tu Nguyen nguyenhongtu...@gmail.com 
mailto:nguyenhongtu...@gmail.com wrote:
 Hello,
 I’m new to HAProxy. I’m trying to set up HA to handle mixed content site 
 (http and https). My site runs on http except login box which needs https.
 When I apply the configure with mode tcp, everything is fine. But I cannot 
 modify header, which I need to identify user’s real IP.
 So I want to use mode http and when I do that, the content of login box does 
 not appear ( all css, static files cannot be loaded)
 Could you please tell me if anyway to fix this problem or HAProxy does not 
 support this yet?
 
 This is my HAProxy config, below:
 
 ##
 # HAPROXY 1.5.12
 ##
 
 global
daemon
user haproxy
group haproxy
chroot /home/haproxy
maxconn 1
stats socket /tmp/haproxy
pidfile /var/run/haproxy.pid
log 127.0.0.1   local1
  tune.ssl.default-dh-param 2048
 
 defaults
#mode http
retries 3
option redispatch
timeout connect 5ms
timeout client 5ms
timeout server 5ms
errorfile 400 /prefix/haproxy/errors/400.http
errorfile 403 /prefix/haproxy/errors/403.http
errorfile 408 /dev/null
errorfile 500 /prefix/haproxy/errors/500.http
errorfile 502 /prefix/haproxy/errors/502.http
errorfile 503 /prefix/haproxy/errors/503.http
errorfile 504 /prefix/haproxy/errors/504.http
 
 
  FRONTEND
 
 frontend fe_https
  bind *:443 ssl crt /prefix/haproxy/ca/domain01.pem
  mode http
  option httpclose
  option forwardfor
 
  acl ssl_host01.vn http://ssl_host01.vn/ hdr(host) -i host01.vn 
 http://host01.vn/ www.host01.vn http://www.host01.vn/
  use_backend be_host01_https if ssl_host01.vn http://ssl_host01.vn/
 
 frontend fe_http
  bind *:80
  log global
  mode http
  option httplog
  option forwardfor
 
  acl host01.vn http://host01.vn/ hdr(host) -i host01.vn http://host01.vn/ 
 www.host01.vn http://www.host01.vn/
  use_backend be_host01_http if host01.vn http://host01.vn/
  BACKEND
 
 backend be_host01_https
  mode http
  option httplog
  option forwardfor
  log global
  balance roundrobin
 
  server SSL_HOST_1 10.0.0.1:80 http://10.0.0.1/ check
  server SSL_HOST_2 10.0.0.2:80 http://10.0.0.2/ check
 
 backend be_host01_http
  mode http
  log global
  balance roundrobin
 
  server HOST_9 10.0.0.1:80 http://10.0.0.1/ check
  server HOST_10 10.0.0.2:80 http://10.0.0.2/ check
 
 ## END
 
 Thanks in advanced,
 
 Tu Nguyen,


Hi Tu,

Could you share also logs generated by HAProxy when trying to acess login page?
Also, your HTTP frontend points to a backend whose name is
be_game5_http. Could you confirm this is a 

Re: Need help with HAProxy configuration mixed content http and https

[Baptiste]

On Wed, May 20, 2015 at 6:49 AM, Tu Nguyen nguyenhongtu...@gmail.com wrote:
 Hello,
 I’m new to HAProxy. I’m trying to set up HA to handle mixed content site 
 (http and https). My site runs on http except login box which needs https.
 When I apply the configure with mode tcp, everything is fine. But I cannot 
 modify header, which I need to identify user’s real IP.
 So I want to use mode http and when I do that, the content of login box does 
 not appear ( all css, static files cannot be loaded)
 Could you please tell me if anyway to fix this problem or HAProxy does not 
 support this yet?

 This is my HAProxy config, below:

 ##
 # HAPROXY 1.5.12
 ##

 global
 daemon
 user haproxy
 group haproxy
 chroot /home/haproxy
 maxconn 1
 stats socket /tmp/haproxy
 pidfile /var/run/haproxy.pid
 log 127.0.0.1   local1
   tune.ssl.default-dh-param 2048

 defaults
 #mode http
 retries 3
 option redispatch
 timeout connect 5ms
 timeout client 5ms
 timeout server 5ms
 errorfile 400 /prefix/haproxy/errors/400.http
 errorfile 403 /prefix/haproxy/errors/403.http
 errorfile 408 /dev/null
 errorfile 500 /prefix/haproxy/errors/500.http
 errorfile 502 /prefix/haproxy/errors/502.http
 errorfile 503 /prefix/haproxy/errors/503.http
 errorfile 504 /prefix/haproxy/errors/504.http


  FRONTEND

 frontend fe_https
   bind *:443 ssl crt /prefix/haproxy/ca/domain01.pem
   mode http
   option httpclose
   option forwardfor

   acl ssl_host01.vn hdr(host) -i host01.vn www.host01.vn
   use_backend be_host01_https if ssl_host01.vn

 frontend fe_http
   bind *:80
   log global
   mode http
   option httplog
   option forwardfor

   acl host01.vn hdr(host) -i host01.vn www.host01.vn
   use_backend be_game5_http if host01.vn

  BACKEND

 backend be_host01_https
   mode http
   option httplog
   option forwardfor
   log global
   balance roundrobin

   server SSL_HOST_1 10.0.0.1:80 check
   server SSL_HOST_2 10.0.0.2:80 check

 backend be_host01_http
   mode http
   log global
   balance roundrobin

   server HOST_9 10.0.0.1:80 check
   server HOST_10 10.0.0.2:80 check

 ## END

 Thanks in advanced,

 Tu Nguyen,


Hi Tu,

Could you share also logs generated by HAProxy when trying to acess login page?
Also, your HTTP frontend points to a backend whose name is
be_game5_http. Could you confirm this is a typo or you did not forward
all your configuration?

Baptiste

Need help with HAProxy configuration mixed content http and https

[Tu Nguyen]

Hello,
I’m new to HAProxy. I’m trying to set up HA to handle mixed content site (http 
and https). My site runs on http except login box which needs https.
When I apply the configure with mode tcp, everything is fine. But I cannot 
modify header, which I need to identify user’s real IP.
So I want to use mode http and when I do that, the content of login box does 
not appear ( all css, static files cannot be loaded)
Could you please tell me if anyway to fix this problem or HAProxy does not 
support this yet?

This is my HAProxy config, below:

##
# HAPROXY 1.5.12
##

global
daemon
user haproxy
group haproxy
chroot /home/haproxy
maxconn 1
stats socket /tmp/haproxy
pidfile /var/run/haproxy.pid
log 127.0.0.1   local1
  tune.ssl.default-dh-param 2048

defaults
#mode http
retries 3
option redispatch
timeout connect 5ms
timeout client 5ms
timeout server 5ms
errorfile 400 /prefix/haproxy/errors/400.http
errorfile 403 /prefix/haproxy/errors/403.http
errorfile 408 /dev/null
errorfile 500 /prefix/haproxy/errors/500.http
errorfile 502 /prefix/haproxy/errors/502.http
errorfile 503 /prefix/haproxy/errors/503.http
errorfile 504 /prefix/haproxy/errors/504.http


 FRONTEND

frontend fe_https
  bind *:443 ssl crt /prefix/haproxy/ca/domain01.pem
  mode http
  option httpclose
  option forwardfor

  acl ssl_host01.vn hdr(host) -i host01.vn www.host01.vn
  use_backend be_host01_https if ssl_host01.vn

frontend fe_http
  bind *:80
  log global
  mode http
  option httplog
  option forwardfor

  acl host01.vn hdr(host) -i host01.vn www.host01.vn
  use_backend be_game5_http if host01.vn

 BACKEND

backend be_host01_https
  mode http
  option httplog
  option forwardfor
  log global
  balance roundrobin

  server SSL_HOST_1 10.0.0.1:80 check
  server SSL_HOST_2 10.0.0.2:80 check

backend be_host01_http
  mode http
  log global
  balance roundrobin

  server HOST_9 10.0.0.1:80 check
  server HOST_10 10.0.0.2:80 check

## END

Thanks in advanced,

Tu Nguyen,
  

Re: Need help with url rewrite

[Baptiste]

On Fri, Jul 4, 2014 at 8:42 PM, Jeffrey Scott Flesher Gmail
jeffrey.scott.fles...@gmail.com wrote:
 If a Picture is worth a 1000 Words:
 If the url does not have any path like this:
 http://mad-news.net/

 acl has_ww_uri path_beg -i /ww
 returns false

 reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri
 http://mad-news.net/ww/en/
 it adds the ww, the program with is wthttpd (Wt) defaults to en for language
 control
 Just to show you how the site looks at port 8060:
 http://mad-news.net:8060/ww/en/
 If I comment the code, the site looks fine.

 Note: I want only the first path to work:
 http://mad-news.net/this/ww  fails to work for the rule, it does this:
 http://mad-news.net/ww/this/this/ww
 which is not what I want, so how do I write a rule to cover this?

 Note: If the ww is not there, the Wt app will ignore the request, results in
 404 http://wittywizard.org/ vs http://wittywizard.org/ww.
 There is no way around this behavior is I want to have a pretty URL.

 My whole config, Note that it works the same in 1.4 and 1.5, but this is:
 HA-Proxy version 1.5.1 2014/06/24:

 global

 log 127.0.0.1 local0
 log 127.0.0.1 local1 notice
 maxconn 4096
 user haproxy
 group haproxy
 daemon
 # pidfile /var/run/haproxy.pid
 # stats socket /var/run/haproxy.stat mode 600
 # stats socket /tmp/haproxy

 defaults
 log global
 modehttp
 option  httplog
 option  dontlognull
 retries 3
 option  redispatch
 maxconn1000
 #contimeout 5000 # haproxy 1.4
 timeout connect 5000
 #clitimeout 5 # haproxy 1.4
 timeout client 5
 #srvtimeout 5 # haproxy 1.4
 timeout server 5

 frontend wt
 bind 216.224.185.71:80
 # Set inside Witty Wizard main.cpp
 acl has_ww_uri path_beg -i /ww
 reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri
 redirect prefix http://wittywizard.org code 301 if { hdr(host) -i
 www.wittywizard.org }
 # Note: see wthttpd.sh session-id-prefix
 acl srv1 url_sub wtd=wt-8060
 acl srv1_up nbsrv(bck1) gt 0
 use_backend bck1 if srv1_up srv1
 # Second Thread
 # Note: see wthttpd.sh session-id-prefix
 # acl srv2  url_sub wtd=wt-8061
 # acl srv2_up nbsrv(bck2) gt 0
 # use_backend bck2 if srv2_up srv2 has_ww_uri
 #
 default_backend bck_lb
 #
 backend bck_lb
 balance roundrobin
 #server srv1 108.59.251.28:8060 track bck1/srv1
 server srv1 216.224.185.71:8060 track bck1/srv1

 backend bck1
 balance roundrobin
 #server srv1 108.59.251.28:8060 check
 server srv1 216.224.185.71:8060 check

 backend bck2
 balance roundrobin
 #server srv2 108.59.251.28:8061 check
 server srv2 216.224.185.71:8060 check

 As you can see, the path seems to have changed, not sure what is going on,
 any ideas?

 Thanks

 On Thu, 2014-07-03 at 22:40 +0200, Baptiste wrote:

 On Thu, Jul 3, 2014 at 9:38 PM, Jeffrey Scott Flesher Gmail
 jeffrey.scott.fles...@gmail.com wrote:
 I have a url that always begins with ww, ie http://domain.tdl/ww/en/..., I
 want to rewrite the url to include the ww,
 I tried the below, it works, but changes the path or something,
 because it cause the resources like css and images to not appear (404),
 does anyone know how to fix this or do this the right way?

 acl has_ww_uri path_beg -i /ww
 reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri


 Hi Jeffrey,

 Can you clarify a bit your question, cause you're confusing me.
 please send us an example of what you get in HAProxy and how you want
 it out after HAProxy has rewritten it.

 Baptiste



Jeffrey,

I'm sorry, I can't answer you, because I can't understand what you
mean in your emails.

Baptiste

Re: Need help with url rewrite

[Jeffrey Scott Flesher Gmail]

If a Picture is worth a 1000 Words:
If the url does not have any path like this:
http://mad-news.net/
acl has_ww_uri path_beg -i /ww
returns false
reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri
http://mad-news.net/ww/en/
it adds the ww, the program with is wthttpd (Wt) defaults to en for
language control
Just to show you how the site looks at port 8060:
http://mad-news.net:8060/ww/en/
If I comment the code, the site looks fine.

Note: I want only the first path to work:
http://mad-news.net/this/ww  fails to work for the rule, it does this:
http://mad-news.net/ww/this/this/ww
which is not what I want, so how do I write a rule to cover this?

Note: If the ww is not there, the Wt app will ignore the request,
results in 404 http://wittywizard.org/ vs http://wittywizard.org/ww.
There is no way around this behavior is I want to have a pretty URL.

My whole config, Note that it works the same in 1.4 and 1.5, but this
is: HA-Proxy version 1.5.1 2014/06/24:

global

log 127.0.0.1 local0 
log 127.0.0.1 local1 notice
maxconn 4096
user haproxy
group haproxy
daemon
# pidfile /var/run/haproxy.pid
# stats socket /var/run/haproxy.stat mode 600
# stats socket /tmp/haproxy

defaults
log global
modehttp
option  httplog
option  dontlognull
retries 3
option  redispatch
maxconn1000
#contimeout 5000 # haproxy 1.4
timeout connect 5000
#clitimeout 5 # haproxy 1.4
timeout client 5
#srvtimeout 5 # haproxy 1.4
timeout server 5

frontend wt
bind 216.224.185.71:80
# Set inside Witty Wizard main.cpp
acl has_ww_uri path_beg -i /ww
reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri
redirect prefix http://wittywizard.org code 301 if { hdr(host) -i 
www.wittywizard.org }
# Note: see wthttpd.sh session-id-prefix
acl srv1 url_sub wtd=wt-8060
acl srv1_up nbsrv(bck1) gt 0
use_backend bck1 if srv1_up srv1
# Second Thread
# Note: see wthttpd.sh session-id-prefix
# acl srv2  url_sub wtd=wt-8061
# acl srv2_up nbsrv(bck2) gt 0
# use_backend bck2 if srv2_up srv2 has_ww_uri
#
default_backend bck_lb
#
backend bck_lb
balance roundrobin
#server srv1 108.59.251.28:8060 track bck1/srv1
server srv1 216.224.185.71:8060 track bck1/srv1

backend bck1
balance roundrobin
#server srv1 108.59.251.28:8060 check
server srv1 216.224.185.71:8060 check

backend bck2
balance roundrobin
#server srv2 108.59.251.28:8061 check
server srv2 216.224.185.71:8060 check

As you can see, the path seems to have changed, not sure what is going on, any 
ideas?

Thanks

On Thu, 2014-07-03 at 22:40 +0200, Baptiste wrote:

 On Thu, Jul 3, 2014 at 9:38 PM, Jeffrey Scott Flesher Gmail
 jeffrey.scott.fles...@gmail.com wrote:
  I have a url that always begins with ww, ie http://domain.tdl/ww/en/..., I
  want to rewrite the url to include the ww,
  I tried the below, it works, but changes the path or something,
  because it cause the resources like css and images to not appear (404),
  does anyone know how to fix this or do this the right way?
 
  acl has_ww_uri path_beg -i /ww
  reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri
 
 
 Hi Jeffrey,
 
 Can you clarify a bit your question, cause you're confusing me.
 please send us an example of what you get in HAProxy and how you want
 it out after HAProxy has rewritten it.
 
 Baptiste

Need help with url rewrite

[Jeffrey Scott Flesher Gmail]

I have a url that always begins with ww, ie http://domain.tdl/ww/en/..., I want 
to rewrite the url to include the ww, 
I tried the below, it works, but changes the path or something,
because it cause the resources like css and images to not appear (404),
does anyone know how to fix this or do this the right way?

acl has_ww_uri path_beg -i /ww
reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri

Re: Need help with url rewrite

[Baptiste]

On Thu, Jul 3, 2014 at 9:38 PM, Jeffrey Scott Flesher Gmail
jeffrey.scott.fles...@gmail.com wrote:
 I have a url that always begins with ww, ie http://domain.tdl/ww/en/..., I
 want to rewrite the url to include the ww,
 I tried the below, it works, but changes the path or something,
 because it cause the resources like css and images to not appear (404),
 does anyone know how to fix this or do this the right way?

 acl has_ww_uri path_beg -i /ww
 reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri


Hi Jeffrey,

Can you clarify a bit your question, cause you're confusing me.
please send us an example of what you get in HAProxy and how you want
it out after HAProxy has rewritten it.

Baptiste

Re: Need help with url rewrite

[Jeffrey Scott Flesher Gmail]

I have a URL lets say:
http://example.com
I want it to be rewritten by haproxy to:
http://example.com/ww

All I want is for haproxy to rewrite the URL only if it does not have
any path, ie http://example.com, then add the ww to it, so it becomes
http://example.com/ww
I do not have Apache on the server, so not mod_rewrite.
I hope this is clear enough, not sure how else to say it.

Thanks

On Thu, 2014-07-03 at 22:40 +0200, Baptiste wrote:

 On Thu, Jul 3, 2014 at 9:38 PM, Jeffrey Scott Flesher Gmail
 jeffrey.scott.fles...@gmail.com wrote:
  I have a url that always begins with ww, ie http://domain.tdl/ww/en/..., I
  want to rewrite the url to include the ww,
  I tried the below, it works, but changes the path or something,
  because it cause the resources like css and images to not appear (404),
  does anyone know how to fix this or do this the right way?
 
  acl has_ww_uri path_beg -i /ww
  reqirep ^([^\ :]*)\ /(.*) \1\ /ww/\2 if !has_ww_uri
 
 
 Hi Jeffrey,
 
 Can you clarify a bit your question, cause you're confusing me.
 please send us an example of what you get in HAProxy and how you want
 it out after HAProxy has rewritten it.
 
 Baptiste

RE: Need help with haproxy config

[Lukas Tribus]

Hi Jeffrey,


 Below is my haproxy config, I have 1 server and 1 backend for testing 
 This is a Wt wthttpd app, with no Apache loaded, 
 Problem I have is that the path to the app seems to change when running from 
 port 80 or haproxy, 
 meaning I lost all my style sheets and resources, not sure what the path is 
 at this point. 
 if I pull the site up with the port address mad-news.net:8060/ww/en/, the 
 path is fine,

We don't know your app, we cannot possibly tell whats happening here. You need 
to track and
troubleshoot this down to a single HTTP request to understand the problem. If, 
and only if
you have the exact description of what is happening on the HTTP level, then we 
can probably
tell you what you need to fix in your configuration.



 Also it crashes after running a while, 
 I have monit loaded, so eventually (minute or two) it will restart,

Whats crashing? HAProxy? Post the output of haproxy -vv then and provide a 
coredump or
a gdb backtrace [1].



Regards,

Lukas



[1] http://www.cyberciti.biz/tips/linux-core-dumps.html 
  

Re: Need help with configuration file

[Scott McKeown]

Hi Jeffrey,

The 'AND' key word is implicit and therefore you do not need to include it
in your ACL's also the 'if' word is only needed once so for example your
use_backend statement should look something like this:

use_backend bck1 if srv1_up srv1 has_ww_uri
use_backend bck2 if srv2_up srv2 has_ww_uri

Other than that your config file looks OK to me.




On 20 June 2014 06:44, Jeffrey Scott Flesher Gmail 
jeffrey.scott.fles...@gmail.com wrote:

  Below is the configuration, what I need is for all urls like
 http//domain.tdl/ww/...
 to use back end 1 or 2 or default load balancer,
 and all other request to go to Apache, but I get an error:
 [ALERT] 170/013846 (5151) : parsing [/etc/haproxy/haproxy.cfg:43] : error
 detected while parsing switching rule.
 at:
 use_backend bck1 if srv1_up srv1 and if has_ww_uri
 use_backend bck2 if srv2_up srv2 and if has_ww_uri
 is there something I did wrong in my use of and?
 I will use my IP address in place of 0.0.0.0
 I also want to redirect www to root,
 and have a status page,
 thanks for any help.

 # nano /etc/haproxy/haproxy.cfg
 global
 log 127.0.0.1 local0
 log 127.0.0.1 local1 notice
 maxconn 4096
 user haproxy
 group haproxy
 daemon
 stats socket/tmp/haproxy

 defaults
 log global
 modehttp
 option  httplog
 option  dontlognull
 option  http-server-close
 option  http-pretend-keepalive
 option  forwardfor
 option  originalto
 retries 3
 option  redispatch
 maxconn2048
 contimeout 5000
 clitimeout 5
 srvtimeout 5
 option httpclose

 frontend wt
 bind 0.0.0.0:80
 # option http-server-close  # HTTP keepalive without killing Apache
 redirect prefix http://domain.com code 301 if { hdr(host) -i
 www.domain.com }
 #
 acl has_ww_uri path_beg -i /ww
 #
 acl srv1 url_sub wtd=wt1
 acl srv2 url_sub wtd=wt2
 acl srv1_up nbsrv(bck1) gt 0
 acl srv2_up nbsrv(bck2) gt 0
 use_backend bck1 if srv1_up srv1 and if has_ww_uri
 use_backend bck2 if srv2_up srv2 and if has_ww_uri
 use_backend bck_lb if has_ww_uri
 default_backend apache

 backend apache
 # option http-server-close # HTTP keepalive without killing Apache
 # set the maxconn parameter below to match Apache's MaxClients minus
 one or two connections so that you can still directly connect to it.
 server srv 127.0.0.1:8080 maxconn 254

 backend bck_lb
 balance roundrobin
 server srv1 0.0.0.0:8088 track bck1/srv1
 server srv2 0.0.0.0:8089 track bck2/srv2

 backend bck1
 balance roundrobin
 server srv1 0.0.0.0:8088 check

 backend bck2
 balance roundrobin
 server srv2 0.0.0.0:8089 check

 # haproxy stat http://domain.tld:1936/haproxy?stats
 http://domain.tdl:1936/haproxy?stats
 listen stats :1936
 mode http
 stats enable
 stats hide-version
 stats realm Haproxy\ Statistics
 stats uri /
 stats auth userName:Password
 # EOF #




-- 
With Kind Regards.

Scott McKeown
Loadbalancer.org
http://www.loadbalancer.org

Need help with configuration file

[Jeffrey Scott Flesher Gmail]

Below is the configuration, what I need is for all urls like
http//domain.tdl/ww/... 
to use back end 1 or 2 or default load balancer, 
and all other request to go to Apache, but I get an error:
[ALERT] 170/013846 (5151) : parsing [/etc/haproxy/haproxy.cfg:43] :
error detected while parsing switching rule.
at:
use_backend bck1 if srv1_up srv1 and if has_ww_uri
use_backend bck2 if srv2_up srv2 and if has_ww_uri
is there something I did wrong in my use of and?
I will use my IP address in place of 0.0.0.0
I also want to redirect www to root,
and have a status page,
thanks for any help.

# nano /etc/haproxy/haproxy.cfg
global
log 127.0.0.1 local0 
log 127.0.0.1 local1 notice
maxconn 4096
user haproxy
group haproxy
daemon
stats socket/tmp/haproxy 

defaults
log global
modehttp
option  httplog
option  dontlognull
option  http-server-close
option  http-pretend-keepalive
option  forwardfor
option  originalto
retries 3
option  redispatch
maxconn2048
contimeout 5000
clitimeout 5
srvtimeout 5
option httpclose

frontend wt
bind 0.0.0.0:80
# option http-server-close  # HTTP keepalive without killing Apache
redirect prefix http://domain.com code 301 if { hdr(host) -i
www.domain.com } 
#
acl has_ww_uri path_beg -i /ww  
#
acl srv1 url_sub wtd=wt1
acl srv2 url_sub wtd=wt2
acl srv1_up nbsrv(bck1) gt 0
acl srv2_up nbsrv(bck2) gt 0
use_backend bck1 if srv1_up srv1 and if has_ww_uri
use_backend bck2 if srv2_up srv2 and if has_ww_uri
use_backend bck_lb if has_ww_uri 
default_backend apache

backend apache
# option http-server-close # HTTP keepalive without killing Apache
# set the maxconn parameter below to match Apache's MaxClients minus
one or two connections so that you can still directly connect to it.
server srv 127.0.0.1:8080 maxconn 254

backend bck_lb
balance roundrobin
server srv1 0.0.0.0:8088 track bck1/srv1
server srv2 0.0.0.0:8089 track bck2/srv2

backend bck1
balance roundrobin
server srv1 0.0.0.0:8088 check

backend bck2
balance roundrobin
server srv2 0.0.0.0:8089 check

# haproxy stat http://domain.tld:1936/haproxy?stats 
listen stats :1936  
mode http   
stats enable
stats hide-version  
stats realm Haproxy\ Statistics 
stats uri / 
stats auth userName:Password
# EOF #

RE: Need help with 1.5 crashing when browser refreshed

[Lukas Tribus]

Hi Kevin,


 With the line commented out it ended up with:
 Built with PCRE version : 8.02 2010-03-19

 The crash still occurred just as before.

Ok, can you post the full output of haproxy -vv please.



 Next I decided to try without SSL and it didn’t crash. Compiled with
 SSL it crashes even if I’m not using an SSL in the config.
 So PCRE and SSL = crash. PCRE without SSL is fine. SSL without PCRE is
 also fine.

Thats odd.



 Seems like we’re narrowing it down. Where do we go from here?

I think we need a full coredump here...

Compile haproxy without compiler optimizations by adding the following CFLAGS:
 $ make CFLAGS=-g -O0 (USE_PCRE=1 [...])


Make sure Mac OS has core dumping enabled:
http://krypted.com/mac-security/core-dumps-in-mac-os-x/
http://stackoverflow.com/questions/9412156/how-to-generate-core-dumps-in-mac-os-x
http://stackoverflow.com/questions/2080918/where-are-core-dumps-written-to-in-mac-os-x


Then reproduce the crash, and provide the executable along with the coredump.
Remember that the coredump may contain sensitive informations like passwords
and IP addresses, so if thats a problem, I suggest you sent it privately to
Willy (upload it somewhere and send the link).


You could also feed the coredump to gdb directly and provide the gdb backtrace
(but the coredump itself may be needed anyway):

 $ gdb /path/to/executable /path/to/coredump
 (gdb) backtrace full
 (gdb) quit




Regards,

Lukas 

Re: Need help with 1.5 crashing when browser refreshed

[Kevin]

On Oct 13, 2013, at 5:39 AM, Lukas Tribus luky...@hotmail.com wrote:

 Hi Kevin,
 
 
 With the line commented out it ended up with:
 Built with PCRE version : 8.02 2010-03-19
 
 The crash still occurred just as before.
 
 Ok, can you post the full output of haproxy -vv please.

HA-Proxy version 1.5-dev19 2013/06/17
Copyright 2000-2013 Willy Tarreau w...@1wt.eu

Build options :
  TARGET  = generic
  CPU = generic
  CC  = gcc
  CFLAGS  = -g -O0
  OPTIONS = USE_POLL=1 USE_KQUEUE=1 USE_OPENSSL=1 USE_PCRE=1

Default settings :
  maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200

Encrypted password support via crypt(3): no
Built without zlib support (USE_ZLIB not set)
Compression algorithms supported : identity
Built with OpenSSL version : OpenSSL 0.9.8r 8 Feb 2011
Running on OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.02 2010-03-19
PCRE library supports JIT : no (USE_PCRE_JIT not set)

Available polling systems :
 kqueue : pref=300,  test result OK
   poll : pref=200,  test result OK
 select : pref=150,  test result OK
Total: 3 (3 usable), will use queue.


- Kevin

Re: Need help with 1.5 crashing when browser refreshed

[Kevin]

On Oct 12, 2013, at 12:38 AM, Willy Tarreau w...@1wt.eu wrote:
 
 So everything is normal but it crashes. At this time, I'm inclined to
 believe the following causes in order of most to least likely :
 
  - bug in libpcre 8.33
 
  - bug in how haproxy uses libpcre which is revealed by 8.33
 
  - general bug in haproxy that is revealed on your platform when pcre
is used
 
 For last point, you could attempt something, run haproxy with the -dM
 argument. It enables memory poisonning which consists in filling all
 structures with a byte before using them. This immediately catches
 pointers that are dereferenced before being initialized. You may want
 to test with and without libpcre. Maybe it will crash from the very
 first request when using libpcre now, proving there is something wrong
 in our code.


I couldn’t notice any difference running it with -dM.

- Kevin

RE: Need help with 1.5 crashing when browser refreshed

[Lukas Tribus]

Hi Kevin,

what I also see different between those 2 builds is that the openssl
seems to be build with OpenSSL 0.9.8y in your former, working build
and OpenSSL 0.9.8r in the latter, crashing build, but always runs with
0.9.8y:


 Built with OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013
 Running on OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013

 Built with OpenSSL version : OpenSSL 0.9.8r 8 Feb 2011
 Running on OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013


So I wonder if something changed on your side between those 2 builds or
whether the Makefile is screwing with the paths when compiling with PCRE.

Could this be related to the fact that we call pcre-config call in the
Makefile, as per discussion in the thread Static haproxy/openssl build
error?

Could you try what happens if you apply the patch from:
http://article.gmane.org/gmane.comp.web.haproxy/13547

(basically removing the line with shell pcre-config --prefix from the
Makefile).


Not sure if this could be a reason for the crash, but we should probably
look into it as well.




Regards,

Lukas 

Re: Need help with 1.5 crashing when browser refreshed

[Kevin]

On Oct 12, 2013, at 7:47 AM, Lukas Tribus luky...@hotmail.com wrote:

 So I wonder if something changed on your side between those 2 builds or
 whether the Makefile is screwing with the paths when compiling with PCRE.
 
 Could this be related to the fact that we call pcre-config call in the
 Makefile, as per discussion in the thread Static haproxy/openssl build
 error?
 
 Could you try what happens if you apply the patch from:
 http://article.gmane.org/gmane.comp.web.haproxy/13547
 
 (basically removing the line with shell pcre-config --prefix from the
 Makefile).

I tried it.

With the line commented out it ended up with: 
Built with PCRE version : 8.02 2010-03-19

The crash still occurred just as before.

Next I decided to try without SSL and it didn’t crash. Compiled with SSL it 
crashes even if I’m not using an SSL in the config.

So PCRE and SSL = crash. PCRE without SSL is fine. SSL without PCRE is also 
fine.

Seems like we’re narrowing it down. Where do we go from here?

- Kevin

Re: Need help with 1.5 crashing when browser refreshed

[Kevin]

My initial builds were done using HomeBrew for both 1.4.24 and 1.5dev19. 

It is configured with the following arguments to make:
TARGET=generic USE_KQUEUE=1 USE_POLL=1 USE_PCRE=1

The 1.5dev19 settings add to those:
USE_OPENSSL=1 USE_ZLIB=1 ADDLIB=-lcrypto

When I did my test compiles I duplicated those parameters. I read that 
somewhere that the OSX makefile didn’t work so I didn’t spend any time trying 
it since it seemed the homebrew options worked fine with 1.4.24 in my testing.

Here is the -vv output from the currently working version.

HA-Proxy version 1.5-dev19 2013/06/17
Copyright 2000-2013 Willy Tarreau w...@1wt.eu

Build options :
  TARGET  = generic
  CPU = generic
  CC  = gcc
  CFLAGS  = -O2 -g -fno-strict-aliasing
  OPTIONS = USE_ZLIB=1 USE_POLL=1 USE_KQUEUE=1 USE_OPENSSL=1

Default settings :
  maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200

Encrypted password support via crypt(3): no
Built with zlib version : 1.2.5
Compression algorithms supported : identity, deflate, gzip
Built with OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013
Running on OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built without PCRE support (using libc's regex instead)

Available polling systems :
 kqueue : pref=300,  test result OK
   poll : pref=200,  test result OK
 select : pref=150,  test result OK
Total: 3 (3 usable), will use queue.


Here is the -vv from the originally compiled version that exhibits the bug.

HA-Proxy version 1.5-dev19 2013/06/17
Copyright 2000-2013 Willy Tarreau w...@1wt.eu

Build options :
  TARGET  = generic
  CPU = generic
  CC  = cc
  CFLAGS  = 
  OPTIONS = USE_ZLIB=1 USE_POLL=1 USE_KQUEUE=1 USE_OPENSSL=1 USE_PCRE=1

Default settings :
  maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200

Encrypted password support via crypt(3): no
Built with zlib version : 1.2.5
Compression algorithms supported : identity, deflate, gzip
Built with OpenSSL version : OpenSSL 0.9.8r 8 Feb 2011
Running on OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.33 2013-05-28
PCRE library supports JIT : no (USE_PCRE_JIT not set)

Available polling systems :
 kqueue : pref=300,  test result OK
   poll : pref=200,  test result OK
 select : pref=150,  test result OK
Total: 3 (3 usable), will use kqueue.



- Kevin

On Oct 11, 2013, at 12:58 AM, Willy Tarreau w...@1wt.eu wrote:

 Hi Kevin,
 
 On Thu, Oct 10, 2013 at 08:28:07PM -0500, Kevin wrote:
 So after some more troubleshooting the problem seems to be related to PCRE.
 If I compile without it I don?t see the problem. In 1.4 there  does not
 appear to be any issue using PCRE.
 
 OK, thanks for tracking this down. I'm not seeing changes specific to
 PCRE in 1.5 except the support for the JIT version which is not enabled
 by default (you need USE_PCRE_JIT for this).
 
 Just a quick question, are you using the GNU make file (Makefile) or
 the OSX Makefile (Makefile.osx) to build haproxy ?
 
 Could you please send the complete output of haproxy -vv ?
 
 It's also possible that you're hitting a completely different bug
 that is triggerred by the use of PCRE but not related to it (eg: a
 use after free or something like this).
 
 Thanks,
 Willy
 
 
 

Re: Need help with 1.5 crashing when browser refreshed

[Willy Tarreau]

Hi Kevin,

On Fri, Oct 11, 2013 at 07:39:32PM -0500, Kevin wrote:
 My initial builds were done using HomeBrew for both 1.4.24 and 1.5dev19. 
 
 It is configured with the following arguments to make:
 TARGET=generic USE_KQUEUE=1 USE_POLL=1 USE_PCRE=1
 
 The 1.5dev19 settings add to those:
 USE_OPENSSL=1 USE_ZLIB=1 ADDLIB=-lcrypto
 
 When I did my test compiles I duplicated those parameters. I read that
 somewhere that the OSX makefile didn?t work so I didn?t spend any time trying
 it since it seemed the homebrew options worked fine with 1.4.24 in my
 testing.

OK.

 Here is the -vv output from the currently working version.
 
 HA-Proxy version 1.5-dev19 2013/06/17
 Copyright 2000-2013 Willy Tarreau w...@1wt.eu
 
 Build options :
   TARGET  = generic
   CPU = generic
   CC  = gcc
   CFLAGS  = -O2 -g -fno-strict-aliasing
   OPTIONS = USE_ZLIB=1 USE_POLL=1 USE_KQUEUE=1 USE_OPENSSL=1
 
 Default settings :
   maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200
 
 Encrypted password support via crypt(3): no
 Built with zlib version : 1.2.5
 Compression algorithms supported : identity, deflate, gzip
 Built with OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013
 Running on OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013
 OpenSSL library supports TLS extensions : yes
 OpenSSL library supports SNI : yes
 OpenSSL library supports prefer-server-ciphers : yes
 Built without PCRE support (using libc's regex instead)
 
 Available polling systems :
  kqueue : pref=300,  test result OK
poll : pref=200,  test result OK
  select : pref=150,  test result OK
 Total: 3 (3 usable), will use queue.
 
 
 Here is the -vv from the originally compiled version that exhibits the bug.
 
 HA-Proxy version 1.5-dev19 2013/06/17
 Copyright 2000-2013 Willy Tarreau w...@1wt.eu
 
 Build options :
   TARGET  = generic
   CPU = generic
   CC  = cc
   CFLAGS  = 
   OPTIONS = USE_ZLIB=1 USE_POLL=1 USE_KQUEUE=1 USE_OPENSSL=1 USE_PCRE=1
 
 Default settings :
   maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200
 
 Encrypted password support via crypt(3): no
 Built with zlib version : 1.2.5
 Compression algorithms supported : identity, deflate, gzip
 Built with OpenSSL version : OpenSSL 0.9.8r 8 Feb 2011
 Running on OpenSSL version : OpenSSL 0.9.8y 5 Feb 2013
 OpenSSL library supports TLS extensions : yes
 OpenSSL library supports SNI : yes
 OpenSSL library supports prefer-server-ciphers : yes
 Built with PCRE version : 8.33 2013-05-28
 PCRE library supports JIT : no (USE_PCRE_JIT not set)
 
 Available polling systems :
  kqueue : pref=300,  test result OK
poll : pref=200,  test result OK
  select : pref=150,  test result OK
 Total: 3 (3 usable), will use kqueue.

So everything is normal but it crashes. At this time, I'm inclined to
believe the following causes in order of most to least likely :

  - bug in libpcre 8.33

  - bug in how haproxy uses libpcre which is revealed by 8.33

  - general bug in haproxy that is revealed on your platform when pcre
is used

For last point, you could attempt something, run haproxy with the -dM
argument. It enables memory poisonning which consists in filling all
structures with a byte before using them. This immediately catches
pointers that are dereferenced before being initialized. You may want
to test with and without libpcre. Maybe it will crash from the very
first request when using libpcre now, proving there is something wrong
in our code.

Thanks,
Willy

Need help with 1.5 crashing when browser refreshed

[Kevin]

I am having an issue with the 1.5dev19 and the latest snapshot. It crashes 
sometimes when loading our site. It’s repeatable simply by refreshing the 
browser several times rapidly. 

I’ve tried using poll instead of kqueue and there was no change. Version 1.4 
does not display the problem.

I was hoping to get some help debugging this if possible. I’m not that familiar 
with the current C tools, but have some experience from years ago so if someone 
would point me to some info on setting this up to run in a debugger I’ll look 
into it further.

Thanks,
Kevin 


Process: haproxy [36011]
Path:/usr/local/Cellar/haproxy/1.5-dev19/bin/haproxy
Identifier:  haproxy
Version: 0
Code Type:   X86-64 (Native)
Parent Process:  launchd [1]
User ID: 0

Date/Time:   2013-10-10 10:53:42.811 -0500
OS Version:  Mac OS X 10.8.5 (12F37)
Report Version:  10

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x

VM Regions Near 0x:
-- shared memory  7fe1b000-7fe1c000 [4K] r-x/r-x 
SM=SHM  


Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   haproxy 0x00010d6ffc8c session_accept + 95
1   haproxy 0x00010d6c3e73 listener_accept + 469
2   haproxy 0x00010d70da01 _do_poll + 1209
3   haproxy 0x00010d6bbd0c run_poll_loop + 51
4   haproxy 0x00010d6bc427 main + 1759
5   libdyld.dylib   0x7fff8e65f7e1 start + 1

Thread 0 crashed with X86 Thread State (64-bit):
 rax: 0x7fb1c406ce00  rbx: 0x  rcx: 0x0001  
rdx: 0x00010d73c018
 rdi: 0x  rsi: 0x  rbp: 0x7fff52546bd0  
rsp: 0x7fff52546b80
  r8: 0x00010d73bc44   r9: 0x00010d73bc08  r10: 0x0040  
r11: 0x7fb1c406ce00
 r12: 0x0013  r13: 0x7fff52546bf0  r14: 0x7fb1c406ce00  
r15: 0x7fb1c400c400
 rip: 0x00010d6ffc8c  rfl: 0x00010206  cr2: 0x
Logical CPU: 6

Re: Need help with 1.5 crashing when browser refreshed

[Kevin]

So after some more troubleshooting the problem seems to be related to PCRE. If 
I compile without it I don’t see the problem. In 1.4 there  does not appear to 
be any issue using PCRE.

Any ideas?

- Kevin


On Oct 10, 2013, at 4:23 PM, Kevin k...@gatorgraphics.com wrote:

 I am having an issue with the 1.5dev19 and the latest snapshot. It crashes 
 sometimes when loading our site. It’s repeatable simply by refreshing the 
 browser several times rapidly. 
 
 I’ve tried using poll instead of kqueue and there was no change. Version 1.4 
 does not display the problem.
 
 I was hoping to get some help debugging this if possible. I’m not that 
 familiar with the current C tools, but have some experience from years ago so 
 if someone would point me to some info on setting this up to run in a 
 debugger I’ll look into it further.
 
 Thanks,
 Kevin 

Re: Need help with 1.5 crashing when browser refreshed

[Willy Tarreau]

Hi Kevin,

On Thu, Oct 10, 2013 at 08:28:07PM -0500, Kevin wrote:
 So after some more troubleshooting the problem seems to be related to PCRE.
 If I compile without it I don?t see the problem. In 1.4 there  does not
 appear to be any issue using PCRE.

OK, thanks for tracking this down. I'm not seeing changes specific to
PCRE in 1.5 except the support for the JIT version which is not enabled
by default (you need USE_PCRE_JIT for this).

Just a quick question, are you using the GNU make file (Makefile) or
the OSX Makefile (Makefile.osx) to build haproxy ?

Could you please send the complete output of haproxy -vv ?

It's also possible that you're hitting a completely different bug
that is triggerred by the use of PCRE but not related to it (eg: a
use after free or something like this).

Thanks,
Willy

Re: NTLM/Issues With HaProxy to SQUID need help...

[David Touzeau]

-Original Message- 
From: Willy Tarreau 
Sent: Wednesday, December 05, 2012 8:13 AM 
To: David Touzeau 
Cc: haproxy@formilux.org 
Subject: Re: NTLM/Issues With HaProxy to SQUID need help... 

Hi David,

[ your MUA still emits those Ctrl-M at the end of each line ]

On Tue, Dec 04, 2012 at 11:09:09PM +0100, David Touzeau wrote:
 HI all
 
  
 I have 3 Squid servers connected to my Active Directory (about 1500 users)
 
 I have setup HaProxy to balance connections from users to the 3 squid servers 
 in order to go Internet.
 
  
 When connecting browsers trough HaProxy:
 
 
 
 When starting the browser, Squid Proxy display an authentication popup in 
 order to access to internet.
 
 It seems the NTLM Windows session did not pass trough HaProxy.
 
  
 When connecting browsers directly to one of the 3 squid servers:
 
 
 
 No authentication popup is displayed and NTLM session is correctly sended to 
 Squid Proxy.
 
  
 I would like to know if there a tip/suggestion to let HaProxy pass NTLM 
 authentication ?

The problem with NTLM-based auth is that it's broken by design, and even
documented as such. I'm always amazed that people continue to try to use
it, because it's clearly documented that NTLM auth can only work when the
authenticating server owns a DIRECT connection to the client. Not only it
does not work in other cases, but it's a major security issue to use it
that way, because if the auth succeeds, there is a risk that several users
share the same connection with the authenticated user's credentials (and
I used to confirm this in the past, it's very funny, if you're the user).

The problem is that NTLM authenticates the CONNECTION and not requests.
As soon as you have proxies, reverse proxies, load balancers, etc... in
the chain, the connection may be shared by anybody. For more pointers on
the breakage in the NTLM spec :

  http://tools.ietf.org/html/rfc4559 (click Errata at top)
  http://www.rfc-editor.org/errata_search.php?rfc=4559

The Negotiate authentication scheme violates basic HTTP
principles, in that it attaches information to the connection
on which the handshake happened, and furthermore uses syntax
in the WWW-Authenticate and Authorization header fields that
is in violation of the base ABNF definitions. 

  http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-21#page-11

   HTTP is defined as a stateless protocol, meaning that each request
   message can be understood in isolation.  Many implementations depend
   on HTTP's stateless design in order to reuse proxied connections or
   dynamically load balance requests across multiple servers.  Hence,
   servers MUST NOT assume that two requests on the same connection are
   from the same user agent unless the connection is secured and
   specific to that agent.  Some non-standard HTTP extensions (e.g.,
   [RFC4559]) have been known to violate this requirement, resulting in
   security and interoperability problems.


In your case, what is happening is that haproxy receives a connection from
a client, squid responds with a challenge that haproxy transmits to the
client, then haproxy closes the server connection, and when the client
reposts the request with the challenge, haproxy establishes a new connection
to squid, which is not the same as previous one, so the challenge fails.

If you are certain that your clients *DIRECTLY* connect to haproxy, you
can make haproxy work in tunnel mode. It will then only check the first
request of each connection, forward to squid and keep the connection
active without analyzing it anymore. That way, the client will be able
to forward his challenge response to squid. You'll obviously miss logs,
and you won't be able to apply useful load balancing algorithms (eg: no
URL hash to improve cache hit ratio). When using tunnel mode, you should
use the leastconn LB algo. To use this mode, remove any httpclose,
forceclose and http-server-close options.

Hoping this helps,
Willy

Thanks Willy for this clarification but if i turn to tunnel mode,did i lose the 
x-forwarded-for HTTP header ?

Re: NTLM/Issues With HaProxy to SQUID need help...

[Jonathan Matthews]

On 5 December 2012 12:47, David Touzeau da...@articatech.com wrote:
 Thanks Willy for this clarification but if i turn to tunnel mode,did i lose
 the x-forwarded-for HTTP header ?

Yes, on all but the first request I believe.

Jonathan
-- 
Jonathan Matthews // Oxford, London, UK
http://www.jpluscplusm.com/contact.html

NTLM/Issues With HaProxy to SQUID need help...

[David Touzeau]

HI all

 
I have 3 Squid servers connected to my Active Directory (about 1500 users)

I have setup HaProxy to balance connections from users to the 3 squid servers 
in order to go Internet.

 
When connecting browsers trough HaProxy:



When starting the browser, Squid Proxy display an authentication popup in order 
to access to internet.

It seems the NTLM Windows session did not pass trough HaProxy.

 
When connecting browsers directly to one of the 3 squid servers:



No authentication popup is displayed and NTLM session is correctly sended to 
Squid Proxy.

 
I would like to know if there a tip/suggestion to let HaProxy pass NTLM 
authentication ?

 
Best regards.

Re: NTLM/Issues With HaProxy to SQUID need help...

[Willy Tarreau]

Hi David,

[ your MUA still emits those Ctrl-M at the end of each line ]

On Tue, Dec 04, 2012 at 11:09:09PM +0100, David Touzeau wrote:
 HI all
 
  
 I have 3 Squid servers connected to my Active Directory (about 1500 users)
 
 I have setup HaProxy to balance connections from users to the 3 squid servers 
 in order to go Internet.
 
  
 When connecting browsers trough HaProxy:
 
 
 
 When starting the browser, Squid Proxy display an authentication popup in 
 order to access to internet.
 
 It seems the NTLM Windows session did not pass trough HaProxy.
 
  
 When connecting browsers directly to one of the 3 squid servers:
 
 
 
 No authentication popup is displayed and NTLM session is correctly sended to 
 Squid Proxy.
 
  
 I would like to know if there a tip/suggestion to let HaProxy pass NTLM 
 authentication ?

The problem with NTLM-based auth is that it's broken by design, and even
documented as such. I'm always amazed that people continue to try to use
it, because it's clearly documented that NTLM auth can only work when the
authenticating server owns a DIRECT connection to the client. Not only it
does not work in other cases, but it's a major security issue to use it
that way, because if the auth succeeds, there is a risk that several users
share the same connection with the authenticated user's credentials (and
I used to confirm this in the past, it's very funny, if you're the user).

The problem is that NTLM authenticates the CONNECTION and not requests.
As soon as you have proxies, reverse proxies, load balancers, etc... in
the chain, the connection may be shared by anybody. For more pointers on
the breakage in the NTLM spec :

  http://tools.ietf.org/html/rfc4559 (click Errata at top)
  http://www.rfc-editor.org/errata_search.php?rfc=4559

The Negotiate authentication scheme violates basic HTTP
principles, in that it attaches information to the connection
on which the handshake happened, and furthermore uses syntax
in the WWW-Authenticate and Authorization header fields that
is in violation of the base ABNF definitions. 

  http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-21#page-11

   HTTP is defined as a stateless protocol, meaning that each request
   message can be understood in isolation.  Many implementations depend
   on HTTP's stateless design in order to reuse proxied connections or
   dynamically load balance requests across multiple servers.  Hence,
   servers MUST NOT assume that two requests on the same connection are
   from the same user agent unless the connection is secured and
   specific to that agent.  Some non-standard HTTP extensions (e.g.,
   [RFC4559]) have been known to violate this requirement, resulting in
   security and interoperability problems.


In your case, what is happening is that haproxy receives a connection from
a client, squid responds with a challenge that haproxy transmits to the
client, then haproxy closes the server connection, and when the client
reposts the request with the challenge, haproxy establishes a new connection
to squid, which is not the same as previous one, so the challenge fails.

If you are certain that your clients *DIRECTLY* connect to haproxy, you
can make haproxy work in tunnel mode. It will then only check the first
request of each connection, forward to squid and keep the connection
active without analyzing it anymore. That way, the client will be able
to forward his challenge response to squid. You'll obviously miss logs,
and you won't be able to apply useful load balancing algorithms (eg: no
URL hash to improve cache hit ratio). When using tunnel mode, you should
use the leastconn LB algo. To use this mode, remove any httpclose,
forceclose and http-server-close options.

Hoping this helps,
Willy

Re: current_con , need help

[Willy Tarreau]

Hi Benoit,

On Tue, Nov 06, 2012 at 03:16:27PM +0100, Benoit GEORGELIN (web4all) wrote:
 Hi everybody , 
 
 I try to figured out and understand more the information in haproxy web
 interface regarding : 
 
 Current conns 
 Queue 
 Session Rate 
 Sessions 
 
 Because I have a problem on my infrastructure since 2 days. 
 my Current conns jump from about 600 to 1800 in few second and I don't know
 if this is a consequence of a workload on the backends who goes dead or if
 it's because of the 1800 currents connections 
 Are the current connection growing even if there is not any backend ? Or
 there is no relation about crash from backends ? 

Concurrent connections generally are the result of a server slowing down.
Since you generally can't control the visitors request rate, if your servers
take twice as much time as usual, you'll see twice as many connections as
usual.

However, when a server is detected as down, its active connections are
completed (unless you used some of the special observe/on-error settings),
and pending connections are redistributed to other servers. If none remains,
they're dropped (precisely an error is returned and the connection is closed).

So normally if a server is completely dead you should see very few conns.

It is perfectly possible that your server went ill because of the load. You
will find this in the logs. Check for logs lines with flags sH which mean
server timeout while waiting for response headers. And check the numbers
that follow, they indicate the number of concurrent connections when that
request was logged. The number of conns is for the process/frontend/backend/
server/#retries. You'll see at what point the server started to fail
requests. Then you can put a limit slightly below that point in the
configuration using the maxconn setting on server lines. You may have
to tweak this a bit before finding the optimal value. Don't go to low,
it's a bit addictive, as many servers tend to work much faster with
lower values but as a result will accept less long requests at a time too.

 Can someone explain this information: 
 Current conns 
   = number of TCP connections from clients to the element showing this
  value (eg: frontend, backend, server)
 Queue 
   = number of requests pending in the queue (backend, server). Only
  happens when maxconn is set on server lines.

 Session Rate 
   = number of new connections per second

 Sessions 
   = total number of elapsed connections from the start of the process.

 I did not find in the documentation what that mean 
 
 For exemple, 1 current connection mean 1 sessions a least right ? 
 1 current connection is from client to haproxy and the sessions is from
 haproxy to backend servers so 1 current connexion can have more than 1
 sessions ? 

It's almost that. A connection is just what you see when doing netstat,
basically a TCP connection which is established and accepted by haproxy.
It becomes a session when it passes minimal validation tests (eg: anti
DDoS rules) and is fully allocated and initialized (buffers, ...). A
session carries up to two connections, one to the client and one to the
server, and links them together. Over a session, any number of HTTP
requests may flow.

If you're interested, take a look at the entities files in doc/internal,
there are some drawings (not very detailed, just a bit high-level).

Regards,
Willy

Re: Need help with HAProxy

[Chris Sarginson]

Could this be related to the number of concurrent connections being run?

maxconn 1024 under global seems quite low, and if your servers are 
holding connections open due to responding slowly could this be the cause?


Chris

On 13/01/2012 03:37, John Lauro wrote:


If the refused connection concerns you, and you can't avoid starting 
haproxy, one option is to put up a firewall rule to block syn packets 
while haproxy reloads, and then unblock.  That way clients will retry 
the connection in about 3 seconds instead of being refused.

Need help with HAProxy

[contractor]

I am using HAProxy on RedHat 5.5 and have below configuration.

global

daemon

maxconn 1024

log  127.0.0.1  local1 info



defaults

log global

balance roundrobin

mode http

retries3

option redispatch

timeout connect 30ms

timeout client  30ms

timeout server  30ms



listen epgs

bind *:80

server server1 127.0.0.1:8080 maxconn 1 check

server server2 epg.local.com:8080 maxconn 1 check

stats uri /stats

I started firing 5000 request to HAProxy using JMeter. While JMeter is firing 
the request I removed the server2 from configuration file and fired haproxy -f 
/etc/haproxy.cfg -p /var/run/haproxy.pid -sf $(cat /var/run/haproxy.pid) 
command. I noticed 2 connection refused errors in JMeter log.

2012/01/11 03:31:31 ERROR - jmeter.protocol.http.sampler.HTTPJavaImpl: 
readResponse:  java.net.ConnectException: Connection refused

2012/01/11 03:31:31 ERROR - jmeter.protocol.http.sampler.HTTPJavaImpl: 
readResponse: java.net.ConnectException: Connection refused

2012/01/11 03:31:31 ERROR - jmeter.protocol.http.sampler.HTTPJavaImpl: Cause: 
java.net.ConnectException: Connection refused

2012/01/11 03:31:31 ERROR - jmeter.protocol.http.sampler.HTTPJavaImpl: Cause: 
java.net.ConnectException: Connection refused

Do you know which configuration I should use to make HAProxy not drop any 
request and am i verifying it correctly too?

Thanks for your help in advance.

Manisha



This E-mail and any of its attachments may contain Time Warner Cable 
proprietary information, which is privileged, confidential, or subject to 
copyright belonging to Time Warner Cable. This E-mail is intended solely for 
the use of the individual or entity to which it is addressed. If you are not 
the intended recipient of this E-mail, you are hereby notified that any 
dissemination, distribution, copying, or action taken in relation to the 
contents of and attachments to this E-mail is strictly prohibited and may be 
unlawful. If you have received this E-mail in error, please notify the sender 
immediately and permanently delete the original and any copy of this E-mail and 
any printout.

RE: Need help with HAProxy

[John Lauro]

There is a brief time between the switchover from the old process to the
new where new connections can not be accepted.  Better to mark the backend
servers down without switching processes.  (Several ways to do that).



If the refused connection concerns you, and you can’t avoid starting
haproxy, one option is to put up a firewall rule to block syn packets
while haproxy reloads, and then unblock.  That way clients will retry the
connection in about 3 seconds instead of being refused.







From: Mahawar, Manisha (contractor)
[mailto:manisha.maha...@twc-contractor.com]
Sent: Thursday, January 12, 2012 5:03 PM
To: haproxy@formilux.org
Subject: Need help with HAProxy



I am using HAProxy on RedHat 5.5 and have below configuration.

global
daemon
maxconn 1024
log  127.0.0.1  local1 info

defaults
log global
balance roundrobin
mode http
retries3
option redispatch
timeout connect 30ms
timeout client  30ms
timeout server  30ms

listen epgs
bind *:80
server server1 127.0.0.1:8080 maxconn 1 check
server server2 epg.local.com:8080 maxconn 1 check
stats uri /stats

I started firing 5000 request to HAProxy using JMeter. While JMeter is
firing the request I removed the server2 from configuration file and fired
haproxy -f /etc/haproxy.cfg -p /var/run/haproxy.pid -sf $(cat
/var/run/haproxy.pid) command. I noticed 2 connection refused errors in
JMeter log.

2012/01/11 03:31:31 ERROR - jmeter.protocol.http.sampler.HTTPJavaImpl:
readResponse:  java.net.ConnectException: Connection refused
2012/01/11 03:31:31 ERROR - jmeter.protocol.http.sampler.HTTPJavaImpl:
readResponse: java.net.ConnectException: Connection refused
2012/01/11 03:31:31 ERROR - jmeter.protocol.http.sampler.HTTPJavaImpl:
Cause: java.net.ConnectException: Connection refused
2012/01/11 03:31:31 ERROR - jmeter.protocol.http.sampler.HTTPJavaImpl:
Cause: java.net.ConnectException: Connection refused

Do you know which configuration I should use to make HAProxy not drop any
request and am i verifying it correctly too?

Thanks for your help in advance.

Manisha





  _

This E-mail and any of its attachments may contain Time Warner Cable
proprietary information, which is privileged, confidential, or subject to
copyright belonging to Time Warner Cable. This E-mail is intended solely
for the use of the individual or entity to which it is addressed. If you
are not the intended recipient of this E-mail, you are hereby notified
that any dissemination, distribution, copying, or action taken in relation
to the contents of and attachments to this E-mail is strictly prohibited
and may be unlawful. If you have received this E-mail in error, please
notify the sender immediately and permanently delete the original and any
copy of this E-mail and any printout.

Re: Need Help

[Willy Tarreau]

On Wed, Jan 04, 2012 at 07:39:23PM +0530, Ravi Ranjan wrote:
 Hi,
 
 Thanks for your guidance.
 I am using stunnel too, but still its failing.

failing is not a useful term to describe your issues ! What are you
observing ? Are you sure that your servers *really* send the Location
header you're trying to replace, maybe they're sending relative links ?

Also, why are you running with ssl-hello-checks on port 80, are you
sure that your servers are considered up ? I doubt it.

You should enable logging and capture the Location response header :

listen example_ssl 0.0.0.0:1443
log 127.0.0.1:514 local0
option httplog
capture response header Location len 64
mode http
balance roundrobin
reqadd X-Is-Secure-Request:True
option httpclose
rspirep ^Location:\ https://www.example.com/(.*)   Location:\
https://example.com/\1
server apigee1 192.168.2.50:80 minconn 32000 maxconn 3200 check port 81 
inter 3
server apigee2 192.168.2.51:80 minconn 32000 maxconn 3200 check port 81 
inter 3

And ensure that your syslog is correctly listening to local UDP port
and logging the local0 facility to some file prior to testing.

Regards,
Willy

Need Help

[Ravi Ranjan]

Hi All,



Please can some one help me on setting rewrite rule for haproxy ssl.



I tried a lot but it fails.



Here is the config:



listen example_ssl 0.0.0.0:1443

 mode http

balance roundrobin

option ssl-hello-chk

reqadd X-Is-Secure-Request:True

option httpclose

rspirep ^Location:\ https://www.example.com/(.*)   Location:\
https://example.com/\1

server apigee1 192.168.2.50:80 minconn 32000 maxconn 3200 check
port 81 inter 3

server apigee2 192.168.2.51:80 minconn 32000 maxconn 3200 check
port 81 inter 3



Below is what I wanted:



Anything for example https://www.example.com/testing should be redirected
or rewritten to https://example.com/testing



Please can someone help on this.



With Warm Regards

Ravi Ranjan

Re: Need Help

[Ravi Ranjan]

+Support.

With Warm Regards
Ravi Ranjan



On Wed, Jan 4, 2012 at 3:58 PM, Ravi Ranjan rran...@apigee.com wrote:

  Hi All,



 Please can some one help me on setting rewrite rule for haproxy ssl.



 I tried a lot but it fails.



 Here is the config:



 listen example_ssl 0.0.0.0:1443

  mode http

 balance roundrobin

 option ssl-hello-chk

 reqadd X-Is-Secure-Request:True

 option httpclose

 rspirep ^Location:\ https://www.example.com/(.*)   Location:\
 https://example.com/\1

 server apigee1 192.168.2.50:80 minconn 32000 maxconn 3200 check
 port 81 inter 3

 server apigee2 192.168.2.51:80 minconn 32000 maxconn 3200 check
 port 81 inter 3



 Below is what I wanted:



 Anything for example https://www.example.com/testing should be redirected
 or rewritten to https://example.com/testing



 Please can someone help on this.



 With Warm Regards

 Ravi Ranjan

Re: Need Help

[support]

__
Please type your reply at the top of the email...

--

 

 



Jonas Ramsin | JAN 04, 2012 11:57AM CET




Hi,
Not sure if this was meant for our Support team.







Mvh / Best regards  


Jonas Ramsin
Head of IT Operations
  
email:  jonas.ram...@apicasystem.com

mobile: +46 73 995 29 58
office: +46 8 400 27 312
Apica AB | Garvargatan 9 | 112 21 Stockholm | Sweden 
www.apicasystem.com 






--




 





Ravi | JAN 04, 2012 11:33AM CET  | Original message 

  




+Support.

With Warm Regards
Ravi Ranjan



On Wed, Jan 4, 2012 at 3:58 PM, Ravi Ranjan rran...@apigee.com wrote:

  Hi All,



 Please can some one help me on setting rewrite rule for haproxy ssl.



 I tried a lot but it fails.



 Here is the config:



 listen example_ssl 0.0.0.0:1443

  mode http

 balance roundrobin

 option ssl-hello-chk

 reqadd X-Is-Secure-Request:True

 option httpclose

 rspirep ^Location:\ https://www.example.com/(.*)   Location:\
 https://example.com/\1

 server apigee1 192.168.2.50:80 minconn 32000 maxconn 3200 check
 port 81 inter 3

 server apigee2 192.168.2.51:80 minconn 32000 maxconn 3200 check
 port 81 inter 3



 Below is what I wanted:



 Anything for example https://www.example.com/testing should be redirected
 or rewritten to https://example.com/testing



 Please can someone help on this.



 With Warm Regards

 Ravi Ranjan












--

For your reference this is Case #: 214

--


Support powered by Assistly



[[79c225eaff9e1fd1c35b4bf77649ec60c99f2f89-24229705]]

Re: Need Help

[Baptiste]

Hi,

As far as I can read, your configuration can't work.
From my understanding your traffic seems to be encripted, so HAProxy
can't manipulate it.
You must use stunnel or stud or pound in front of HAProxy in order to
decrypt traffic.
Then, your rewrite rule might work.

cheers


On Wed, Jan 4, 2012 at 11:28 AM, Ravi Ranjan rran...@apigee.com wrote:
 Hi All,



 Please can some one help me on setting rewrite rule for haproxy ssl.



 I tried a lot but it fails.



 Here is the config:



 listen example_ssl 0.0.0.0:1443

  mode http

     balance roundrobin

     option ssl-hello-chk

     reqadd X-Is-Secure-Request:True

     option httpclose

     rspirep ^Location:\ https://www.example.com/(.*)   Location:\
 https://example.com/\1

     server apigee1 192.168.2.50:80 minconn 32000 maxconn 3200 check port
 81 inter 3

     server apigee2 192.168.2.51:80 minconn 32000 maxconn 3200 check port
 81 inter 3



 Below is what I wanted:



 Anything for example https://www.example.com/testing should be redirected or
 rewritten to https://example.com/testing



 Please can someone help on this.



 With Warm Regards

 Ravi Ranjan

Re: Need Help

[Ravi Ranjan]

Hi,

Thanks for your guidance.
I am using stunnel too, but still its failing.

With Warm Regards
Ravi Ranjan



On Wed, Jan 4, 2012 at 7:37 PM, Baptiste bed...@gmail.com wrote:

 Hi,

 As far as I can read, your configuration can't work.
 From my understanding your traffic seems to be encripted, so HAProxy
 can't manipulate it.
 You must use stunnel or stud or pound in front of HAProxy in order to
 decrypt traffic.
 Then, your rewrite rule might work.

 cheers


 On Wed, Jan 4, 2012 at 11:28 AM, Ravi Ranjan rran...@apigee.com wrote:
  Hi All,
 
 
 
  Please can some one help me on setting rewrite rule for haproxy ssl.
 
 
 
  I tried a lot but it fails.
 
 
 
  Here is the config:
 
 
 
  listen example_ssl 0.0.0.0:1443
 
   mode http
 
  balance roundrobin
 
  option ssl-hello-chk
 
  reqadd X-Is-Secure-Request:True
 
  option httpclose
 
  rspirep ^Location:\ https://www.example.com/(.*)   Location:\
  https://example.com/\1
 
  server apigee1 192.168.2.50:80 minconn 32000 maxconn 3200 check
 port
  81 inter 3
 
  server apigee2 192.168.2.51:80 minconn 32000 maxconn 3200 check
 port
  81 inter 3
 
 
 
  Below is what I wanted:
 
 
 
  Anything for example https://www.example.com/testing should be
 redirected or
  rewritten to https://example.com/testing
 
 
 
  Please can someone help on this.
 
 
 
  With Warm Regards
 
  Ravi Ranjan

Re: Need help about reqrep (urgent)

[Willy Tarreau]

Hi,

On Fri, Sep 23, 2011 at 11:20:52AM +, DerekLiao wrote:
 Hey there,
 
   I
 have trouble with direct ??reqrep?? 
 
  what I want is :
 
 My main web site is : caipiao.aaa.com
 
 
 My second web site is: www.bbb.com
 
 My goal is redirect URL from caipiao.aaa.com/ kaijiang
 -www.bbb.com/result_aaa , but the URL in the browse still need
 to display caipiao.aaa.com/kaijiang
 
 what I did is:
 
 Frontend: 
 
  
 
 acl acl_dom_caipiao.aaa.com hdr_dom(host) caipiao.aaa.com
 
 acl acl_url_kaijiang path_beg 
 -i  /kaijiang
 
 use_backend cs_aaa_caipiaos_1   if acl_dom_caipiao.aaa.com 
 acl_url_kaijiang
 
  
 
 backend:
 
 backend cs_aaa_caipiaos_1
 
 reqrep
 ^([^\ ]*)\ /kaijiang(/.*) \1\ /result_aaa\2
 
 option httpchk  GET / HTTP/1.1\r\nHost:\ www.bbb.com
 
 server srv_aaa_caipiaos_1_01 www.bbb.com:80 check
 

Are you sure that your server does not also consider the Host
header and refuses to serve /result_aaa from caipiao.aaa.com ?

 when I access caipiao.aaa.com/kaijiang,  I get a 404 error, looks like reqrep 
 did not
 working~
 
 but if make a little change as below: 
 
 acl acl_url_result path_beg 
 -i/result_aaa
 
 use_backend cs_aaa_caipiaos_1   if acl_dom_caipiao.aaa.com 
 acl_url_result
 
 then I can access  caipiao.aaa.com/result_aaa directly,  So there should be a 
 problem on reqrep

Strange then.

 Could you help to analyze the root cause of this ?

What does your server say in its logs ? You'll have the useful information
there since you'll know how the request will have been rewritten.

Regards,
Willy

RE: Need help about reqrep (urgent)

[DerekLiao]

Is it set correctly
I only see 503/404 error on haproxy log, I already set debug level !  version 
1.4.14

I really need your help

My Skype account : derek.liao66

 Date: Sat, 24 Sep 2011 12:43:35 +0200
 From: w...@1wt.eu
 To: y...@hotmail.com
 CC: haproxy@formilux.org
 Subject: Re: Need help about reqrep (urgent)
 
 Hi,
 
 On Fri, Sep 23, 2011 at 11:20:52AM +, DerekLiao wrote:
  Hey there,
  
I
  have trouble with direct ??reqrep?? 
  
   what I want is :
  
  My main web site is : caipiao.aaa.com
  
  
  My second web site is: www.bbb.com
  
  My goal is redirect URL from caipiao.aaa.com/ kaijiang
  -www.bbb.com/result_aaa , but the URL in the browse still need
  to display caipiao.aaa.com/kaijiang
  
  what I did is:
  
  Frontend: 
  
   
  
  acl acl_dom_caipiao.aaa.com hdr_dom(host) 
  caipiao.aaa.com
  
  acl acl_url_kaijiang path_beg 
  -i  /kaijiang
  
  use_backend cs_aaa_caipiaos_1   if acl_dom_caipiao.aaa.com 
  acl_url_kaijiang
  
   
  
  backend:
  
  backend cs_aaa_caipiaos_1
  
  reqrep
  ^([^\ ]*)\ /kaijiang(/.*) \1\ /result_aaa\2
  
  option httpchk  GET / HTTP/1.1\r\nHost:\ www.bbb.com
  
  server srv_aaa_caipiaos_1_01 www.bbb.com:80 check
  
 
 Are you sure that your server does not also consider the Host
 header and refuses to serve /result_aaa from caipiao.aaa.com ?
 
  when I access caipiao.aaa.com/kaijiang,  I get a 404 error, looks like 
  reqrep did not
  working~
  
  but if make a little change as below: 
  
  acl acl_url_result path_beg 
  -i/result_aaa
  
  use_backend cs_aaa_caipiaos_1   if acl_dom_caipiao.aaa.com 
  acl_url_result
  
  then I can access  caipiao.aaa.com/result_aaa directly,  So there should be 
  a problem on reqrep
 
 Strange then.
 
  Could you help to analyze the root cause of this ?
 
 What does your server say in its logs ? You'll have the useful information
 there since you'll know how the request will have been rewritten.
 
 Regards,
 Willy
 
  

Re: Need help about reqrep (urgent)

[Willy Tarreau]

On Sat, Sep 24, 2011 at 10:46:23AM +, DerekLiao wrote:
 
 Is it set correctly

It does not indicate what's in it. What do you mean by correctly ?

 I only see 503/404 error on haproxy log, I already set debug level !  version 
 1.4.14

503s indicate that sometimes there is no server to connect to,
possibly because some health checks sometimes fail.

Regards,
Willy

RE: Need help about reqrep (urgent)

[DerekLiao]

health check is normal, I checked from haproxy monitor screen , 

How to check reqrep is working fine or not ?  I double the URI has not been 
replaced


 Date: Sat, 24 Sep 2011 12:52:01 +0200
 From: w...@1wt.eu
 To: y...@hotmail.com
 CC: haproxy@formilux.org
 Subject: Re: Need help about reqrep (urgent)
 
 On Sat, Sep 24, 2011 at 10:46:23AM +, DerekLiao wrote:
  
  Is it set correctly
 
 It does not indicate what's in it. What do you mean by correctly ?
 
  I only see 503/404 error on haproxy log, I already set debug level !  
  version 1.4.14
 
 503s indicate that sometimes there is no server to connect to,
 possibly because some health checks sometimes fail.
 
 Regards,
 Willy
 
  

Re: Need help about reqrep (urgent)

[Willy Tarreau]

On Sat, Sep 24, 2011 at 11:06:07AM +, DerekLiao wrote:
 
 health check is normal, I checked from haproxy monitor screen , 

OK, maybe it's your server which is returning 503 then.

 How to check reqrep is working fine or not ?

That's what I explained, in apache's logs.

 I double the URI has not been replaced

How did you check that then ? If you look at your request line in
haproxy's logs and compare it to the line in apache's logs, it should
become obvious if the replacement was partially, totally applied or
not at all.

Willy
 

RE: Need help about reqrep (urgent)

[DerekLiao]

is it possible to get detail rewrite infomation like apache error log does?

tcpdump, little bit diffcult ,too much taffice need to analyse

From: luky...@hotmail.com
To: y...@hotmail.com; w...@1wt.eu
CC: haproxy@formilux.org
Subject: RE: Need help about reqrep (urgent)
Date: Sat, 24 Sep 2011 13:20:49 +0200








tcpdump it on the haproxy box then. Somehow you need to understand what happens 
between haproxy and the backend.

Lukas

From: y...@hotmail.com
To: w...@1wt.eu
CC: haproxy@formilux.org
Subject: RE: Need help about reqrep (urgent)
Date: Sat, 24 Sep 2011 11:15:09 +








from haproxy, I can see the URI is /kaijiang which was not changed

I can't see the backend server's log, because it was out of my control, 
actually that is thirdparty company's web site 




 Date: Sat, 24 Sep 2011 13:11:05 +0200
 From: w...@1wt.eu
 To: y...@hotmail.com
 CC: haproxy@formilux.org
 Subject: Re: Need help about reqrep (urgent)
 
 On Sat, Sep 24, 2011 at 11:06:07AM +, DerekLiao wrote:
  
  health check is normal, I checked from haproxy monitor screen , 
 
 OK, maybe it's your server which is returning 503 then.
 
  How to check reqrep is working fine or not ?
 
 That's what I explained, in apache's logs.
 
  I double the URI has not been replaced
 
 How did you check that then ? If you look at your request line in
 haproxy's logs and compare it to the line in apache's logs, it should become 
 obvious if the replacement was partially, totally applied or
 not at all.
 
 Willy
  

  

Re: Need help about reqrep (urgent)

[Willy Tarreau]

On Sat, Sep 24, 2011 at 11:23:07AM +, DerekLiao wrote:
 
 is it possible to get detail rewrite infomation like apache error log does?

No, what haproxy logs is what it *receives*. That's why we're asking
for what is seen on the other side.

 tcpdump, little bit diffcult ,too much taffice need to analyse

You don't need to let it run for minutes, just a few seconds during a click.

Alternatively you can try to add a second rule after it to block the
rewritten request. If you see that the request is blocked, then you can
conclude it was properly rewritten :

reqrep ^([^\ ]*)\ /kaijiang(/.*) \1\ /result_aaa\2
reqdeny ^([^\ ]*)\ /result_aaa

BTW, we're all assuming that you have appropriately set option httpclose
or option http-server-close so that all requests are rewritten, not only
the first one. You might want to double-check.

Regards,
Willy