summaryrefslogtreecommitdiff
path: root/include/haproxy
Commit message (Collapse)AuthorAgeFilesLines
* MINOR: clock: provide a function to automatically adjust now_offsetWilly Tarreau2023-05-171-0/+1
| | | | | | | | | Right now there's no way to enforce a specific value of now_ms upon startup in order to compensate for the time it takes to load a config, specifically when dealing with the health check startup. For this we'd need to force the now_offset value to compensate for the last known value of the current date. This patch exposes a function to do exactly this.
* MINOR: stats: report the boot time in "show info"Willy Tarreau2023-05-171-0/+1
| | | | | | | | | Just like we have the uptime in "show info", let's add the boot time. It's trivial to collect as it's just the difference between the ready date and the start date, and will allow users to monitor this element in order to take action before it starts becoming problematic. Here the boot time is reported in milliseconds, so this allows to even observe sub-second anomalies in startup delays.
* MINOR: clock: measure the total boot timeWilly Tarreau2023-05-171-0/+1
| | | | | | | | | | | | | | | Some huge configs take a significant amount of time to start and this can cause some trouble (e.g. health checks getting delayed and grouped, process not responding to the CLI etc). For example, some configs might start fast in certain environments and slowly in other ones just due to the use of a wrong DNS server that delays all libc's resolutions. Let's first start by measuring it by keeping a copy of the most recently known ready date, once before calling check_config_validity() and then refine it when leaving this function. A last call is finally performed just before deciding to split between master and worker processes, and it covers the whole boot. It's trivial to collect and even allows to get rid of a call to clock_update_date() in function check_config_validity() that was used in hope to better schedule future events.
* MINOR: mux-quic: uninline qc_attach_sc()Amaury Denoyelle2023-05-161-44/+2
| | | | | | | Uninline and move qc_attach_sc() function to implementation source file. This will be useful for next commit to add traces in it. This should be backported up to 2.7.
* MINOR: mux-quic: properly report end-of-stream on recvAmaury Denoyelle2023-05-161-0/+1
| | | | | | | | | | | | | | | | MUX is responsible to put EOS on stream when read channel is closed. This happens if underlying connection is closed or a RESET_STREAM is received. FIN STREAM is ignored in this case. For connection closure, simply check for CO_FL_SOCK_RD_SH. For RESET_STREAM reception, a new flag QC_CF_RECV_RESET has been introduced. It is set when RESET_STREAM is received, unless we already received all data. This is conform to QUIC RFC which allows to ignore a RESET_STREAM in this case. During RESET_STREAM processing, input buffer is emptied so EOS can be reported right away on recv_buf operation. This should be backported up to 2.7.
* BUILD: ssl: get0_verified chain is available on libreSSLWilliam Lallemand2023-05-151-0/+4
| | | | Define HAVE_SSL_get0_verified_chain when it's using libreSSL >= 3.3.6.
* BUILD: ssl: ssl_c_r_dn fetches uses functiosn only available since 1.1.1William Lallemand2023-05-151-0/+1
| | | | | | | | Fix the openssl build with older openssl version by disabling the new ssl_c_r_dn fetch. This also disable the ssl_client_samples.vtc file for OpenSSL version older than 1.1.1
* MINOR: ssl: add new sample ssl_c_r_dnAbhijeet Rastogi2023-05-151-0/+1
| | | | | | This patch addresses #1514, adds the ability to fetch DN of the root ca that was in the chain when client certificate was verified during SSL handshake.
* BUG/MINOR: mux-quic: differentiate failure on qc_stream_desc allocAmaury Denoyelle2023-05-121-1/+1
| | | | | | | | | | | | | | | | | | | qc_stream_buf_alloc() can fail for two reasons : * limit of Tx buffer per connection reached * allocation failure The first case is properly treated. A flag QC_CF_CONN_FULL is set on the connection to interrupt emission. It is cleared when a buffer became available after in order ACK reception and the MUX tasklet is woken up. The allocation failure was handled with the same mechanism which in this case is not appropriate and could lead to a connection transfer freeze. Instead, prefer to close the connection with a QUIC internal error code. To differentiate the two causes, qc_stream_buf_alloc() API was changed to return the number of available buffers to the caller. This must be backported up to 2.6.
* MINOR: mux-quic: remove dedicated function to handle standalone FINAmaury Denoyelle2023-05-121-2/+0
| | | | | | | | | | | | | | Remove QUIC MUX function qcs_http_handle_standalone_fin(). The purpose of this function was only used when receiving an empty STREAM frame with FIN bit. Besides, it was called by each application protocol which could have different approach and render the function purpose unclear. Invocation of qcs_http_handle_standalone_fin() have been replaced by explicit code in both H3 and HTTP/0.9 module. In the process, use htx_set_eom() to reliably put EOM on the HTX message. This should be backported up to 2.7, along with the previous patch which introduced htx_set_eom().
* MINOR: htx: add function to set EOM reliablyAmaury Denoyelle2023-05-121-0/+18
| | | | | | | | | | | | Implement a new HTX utility function htx_set_eom(). If the HTX message is empty, it will first add a dummy EOT block. This is a small trick needed to ensure readers will detect the HTX buffer as not empty and retrieve the EOM flag. Replace the H2 code related by a htx_set_eom() invocation. QUIC also has the same code which will be replaced in the next commit. This should be backported up to 2.7 before the related QUIC patch.
* MINOR: master/cli: also implement the timed prompt on the master CLIWilly Tarreau2023-05-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | This provides more consistency between the master and the worker. When "prompt timed" is passed on the master, the timed mode is toggled. When enabled, for a master it will show the master process' uptime, and for a worker it will show this worker's uptime. Example: master> prompt timed [0:00:00:50] master> show proc #<PID> <type> <reloads> <uptime> <version> 11940 master 1 [failed: 0] 0d00h02m10s 2.8-dev11-474c14-21 # workers 11955 worker 0 0d00h00m59s 2.8-dev11-474c14-21 # old workers 11942 worker 1 0d00h02m10s 2.8-dev11-474c14-21 # programs [0:00:00:58] master> @!11955 [0:00:01:03] 11955> @!11942 [0:00:02:17] 11942> @ [0:00:01:10] master>
* MINOR: cli: add an option to display the uptime in the CLI's promptWilly Tarreau2023-05-111-0/+1
| | | | | | | | Entering "prompt timed" toggles reporting of the process' uptime in the prompt, which will report days, hours, minutes and seconds since it was started. As discussed with Tim in issue #2145, this can be convenient to roughly estimate the time between two outputs, as well as detecting that a process failed to be reloaded for example.
* CLEANUP: acl: discard prune_acl_cond() functionAurelien DARRAGON2023-05-111-3/+0
| | | | | Thanks to previous commit, we have no more use for prune_acl_cond(), let's remove it to prevent code duplication.
* MINOR: proxy: add http_free_redirect_rule() functionAurelien DARRAGON2023-05-111-0/+1
| | | | | | | | | | | Adding http_free_redirect_rule() function to free a single redirect rule since it may be required to free rules outside of free_proxy() function. This patch is required for an upcoming bugfix. [for 2.2, free_proxy function did not exist (first seen in 2.4), thus http_free_redirect_rule() needs to be deducted from haproxy.c deinit() function if the patch is required]
* MINOR: stconn: Add a cross-reference between SE descriptorChristopher Faulet2023-05-111-0/+3
| | | | | | | | | | A xref is added between the endpoint descriptors. It is created when the server endpoint is attached to the SC and it is destroyed when an endpoint is detached. This xref is not used for now. But it will be useful to retrieve info about an endpoint for the opposite side. It is also the warranty there is still a endpoint attached on the other side.
* MINOR: stats: report the listener's protocol along with the address in statsWilly Tarreau2023-05-111-0/+1
| | | | | | | | | | | When "optioon socket-stats" is used in a frontend, its listeners have their own stats and will appear in the stats page. And when the stats page has "stats show-legends", then a tooltip appears on each such socket with ip:port and ID. The problem is that since QUIC arrived, it was not possible to distinguish the TCP listeners from the QUIC ones because no protocol indication was mentioned. Now we add a "proto" legend there with the protocol name, so we can see "tcp4" or "quic6" and figure how the socket is bound.
* MEDIUM: mux-quic: adjust transport layer error handlingAmaury Denoyelle2023-05-111-0/+1
| | | | | | | | | | | | | | | Following previous patch, error notification from quic_conn has been adjusted to rely on standard connection flags. Most notably, CO_FL_ERROR on the connection instance when a fatal error is detected. Check for CO_FL_ERROR is implemented by qc_send(). If set the new flag QC_CF_ERR_CONN will be set for the MUX instance. This flag is similar to the local error flag and will abort most of the futur processing. To ensure stream upper layer is also notified, qc_wake_some_streams() called by qc_process() will put the stream on error if this new flag is set. This should be backported up to 2.7.
* MEDIUM: quic: streamline error notificationAmaury Denoyelle2023-05-112-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | When an error is detected at quic-conn layer, the upper MUX must be notified. Previously, this was done relying on quic_conn flag QUIC_FL_CONN_NOTIFY_CLOSE set and the MUX wake callback called on connection closure. Adjust this mechanism to use an approach more similar to other transport layers in haproxy. On error, connection flags are updated with CO_FL_ERROR, CO_FL_SOCK_RD_SH and CO_FL_SOCK_WR_SH. The MUX is then notified when the error happened instead of just before the closing. To reflect this change, qc_notify_close() has been renamed qc_notify_err(). This function must now be explicitely called every time a new error condition arises on the quic_conn layer. To ensure MUX send is disabled on error, qc_send_mux() now checks CO_FL_SOCK_WR_SH. If set, the function returns an error. This should prevent the MUX from sending data on closing or draining state. To complete this patch, MUX layer must now check for CO_FL_ERROR explicitely. This will be the subject of the following commit. This should be backported up to 2.7.
* MINOR: mux-quic: add traces for stream wakeAmaury Denoyelle2023-05-111-7/+9
| | | | | | | Add traces for when an upper layer stream is woken up by the MUX. This should help to diagnose frozen stream issues. This should be backported up to 2.7.
* MINOR: stats: report the number of times the global maxconn was reachedWilly Tarreau2023-05-112-0/+4
| | | | | | | | | | | | | | | | | | As discussed a few times over the years, it's quite difficult to know how often we stop accepting connections because the global maxconn was reached. This is not easy to know because when we reach the limit we stop accepting but we don't know if incoming connections are pending, so it's not possible to know how many were delayed just because of this. However, an interesting equivalent metric consist in counting the number of times an accepted incoming connection resulted in the limit being reached. I.e. "we've accepted the last one for now". That doesn't imply any other one got delayed but it's a factual indicator that something might have been delayed. And by counting the number of such events, it becomes easier to know whether some limits need to be adjusted because they're reached often, or if it's exceptionally rare. The metric is reported as a counter in show info and on the stats page in the info section right next to "maxconn".
* MINOR: stats: report the total number of warnings issuedWilly Tarreau2023-05-112-0/+2
| | | | | | Now in "show info" we have a TotalWarnings field that reports the total number of warnings issued since the process started. It's also reported in the the stats page next to the uptime.
* DEBUG: list: add DEBUG_LIST to purposely corrupt list heads after deleteWilly Tarreau2023-05-111-0/+5
| | | | | | | | | | LIST_DELETE doesn't affect the previous pointers of the stored element. This can sometimes hide bugs when such a pointer is reused by accident in a LIST_NEXT() or equivalent after having been detached for example, or ia another LIST_DELETE is performed again, something that LIST_DEL_INIT() is immune to. By compiling with -DDEBUG_LIST, we'll replace a freshly detached list element with two invalid pointers that will cause a crash in case of accidental misuse. It's not enabled by default.
* BUG/MINOR: quic: Possible crash when dumping version informationFrédéric Lécaille2023-05-102-17/+3
| | | | | | | | | | | ->others member of tp_version_information structure pointed to a buffer in the TLS stack used to parse the transport parameters. There is no garantee that this buffer is available until the connection is released. Do not dump the available versions selected by the client anymore, but displayed the chosen one (selected by the client for this connection) and the negotiated one. Must be backported to 2.7 and 2.6.
* BUG/MINOR: mux-quic: fix transport VS app CONNECTION_CLOSEAmaury Denoyelle2023-05-091-1/+1
| | | | | | | | | | | | | | | | A recent series of patch were introduced to streamline error generation by QUIC MUX. However, a regression was introduced : every error generated by the MUX was built as CONNECTION_CLOSE_APP frame, whereas it should be only for H3/QPACK errors. Fix this by adding an argument <app> in qcc_set_error. When false, a standard CONNECTION_CLOSE is used as error. This bug was detected by QUIC tracker with the following tests "stop_sending" and "server_flow_control" which requires a CONNECTION_CLOSE frame. This must be backported up to 2.7.
* DOC: stconn: Update comments about ABRT/SHUT for stconn structureChristopher Faulet2023-05-091-19/+20
| | | | | | The comment for the stconn structure was still referencing the SHUTR/SHUTW flags. These flags were replaced and we now use ABRT/SHUT flags in comments. The comment itself was slightly updated to be accurate.
* MEDIUM: stconn: Be sure to always be able to unblock a SC that needs roomChristopher Faulet2023-05-091-2/+4
| | | | | | | | | | | When sc_need_room() is called, the caller cannot request more free space than a minimum value to be sure it is always possible to unblock it. it is a safety guard to not freeze any SC on NEED_ROOM condition. At worse it will lead to some wakeups un excess at the edge. To keep things simple, the following minimum is used: (global.tune.bufsize - global.tune.maxrewrite - sizeof(struct htx))
* CLEANUP: quic: Rename several <buf> variables in quic_frame.(c|h)Frédéric Lécaille2023-05-091-2/+2
| | | | | | | | Most of the function in quic_frame.c and quic_frame.h manipulate <buf> buffer position variables which have nothing to see with struct buffer variables. Rename them to <pos> Should be backported to 2.7.
* CLEANUP: quic: No more used q_buf structureFrédéric Lécaille2023-05-091-14/+0
| | | | | | This definition is no more used. Should be backported to 2.7.
* BUILD: quic: fix build warning when threads are disabledWilly Tarreau2023-05-071-1/+1
| | | | | | Commit e83f937cc ("MEDIUM: quic: use a global CID trees list") uses a local variable "tree" used only for locks, but when threads are disabled it spews a warning about this unused variable.
* CLEANUP: fix a few reported typos in code commentsWilly Tarreau2023-05-071-1/+1
| | | | | | These are only the few relevant changes among those reported here: https://github.com/haproxy/haproxy/actions/runs/4856148287/jobs/8655397661
* MINOR: config: allow cpu-map to take commas in lists of rangesWilly Tarreau2023-05-051-1/+1
| | | | | | | | | | | | | | | | | | | | The function that cpu-map uses to parse CPU sets, parse_cpu_set(), was etended in 2.4 with commit a80823543 ("MINOR: cfgparse: support the comma separator on parse_cpu_set") to support commas between ranges. But since it was quite late in the development cycle, by then it was decided not to add a last-minute surprise and not to magically support commas in cpu-map, hence the "comma_allowed" argument. Since then we know that it was not the best choice, because the comma is silently ignored in the cpu-map syntax, causing all sorts of surprises in field with threads running on a single node for example. In addition it's quite common to copy-paste a taskset line and put it directly into the haproxy configuration. This commit relaxes this rule an finally allows cpu-map to support commas between ranges. It simply consists in removing the comma_allowed argument in the parse_cpu_set() function. The doc was updated to reflect this.
* MINOR: hlua: declare hlua_yieldk() functionAurelien DARRAGON2023-05-051-0/+1
| | | | Declaring hlua_yieldk() function to make it usable from hlua_fcn.c.
* MINOR: hlua: declare hlua_gethlua() functionAurelien DARRAGON2023-05-051-0/+1
| | | | Declaring hlua_gethlua() function to make it usable from hlua_fcn.c.
* MINOR: hlua: declare hlua_{ref,pushref,unref} functionsAurelien DARRAGON2023-05-051-0/+3
| | | | | Declaring hlua_{ref,pushref,unref} functions to make them usable from hlua_fcn.c to simplify reference handling.
* MINOR: mailers/hlua: disable email sending from luaAurelien DARRAGON2023-05-051-0/+1
| | | | | | | | | Exposing a new hlua function, available from body or init contexts, that forcefully disables the sending of email alerts even if the mailers are defined in haproxy configuration. This will help for sending email directly from lua. (prevent legacy email sending from intefering with lua)
* MINOR: checks/event_hdl: SERVER_CHECK eventAurelien DARRAGON2023-05-053-0/+23
| | | | | | | | | | Adding a new event type: SERVER_CHECK. This event is published when a server's check state ought to be reported. (check status change or check result) SERVER_CHECK event is provided as a server event with additional data carrying relevant check's context such as check's result and health.
* MINOR: server/event_hdl: add SERVER_ADMIN eventAurelien DARRAGON2023-05-052-0/+23
| | | | | | | | | | | | | Adding a new SERVER event in the event_hdl API. SERVER_ADMIN is implemented as an advanced server event. It is published each time the administrative state changes. (when s->cur_admin changes) SERVER_ADMIN data is an event_hdl_cb_data_server_admin struct that provides additional info related to the admin state change, but can be casted as a regular event_hdl_cb_data_server struct if additional info is not needed.
* MINOR: server/event_hdl: add SERVER_STATE eventAurelien DARRAGON2023-05-052-0/+56
| | | | | | | | | | | | | Adding a new SERVER event in the event_hdl API. SERVER_STATE is implemented as an advanced server event. It is published each time the server's effective state changes. (when s->cur_state changes) SERVER_STATE data is an event_hdl_cb_data_server_state struct that provides additional info related to the server state change, but can be casted as a regular event_hdl_cb_data_server struct if additional info is not needed.
* MINOR: hlua_fcn: add Server.get_proxy()Aurelien DARRAGON2023-05-051-0/+1
| | | | | Server.get_proxy(): get the proxy to which the server belongs (or nil if not available)
* MEDIUM: tree-wide: Change sc API to specify required free space to progressChristopher Faulet2023-05-052-5/+10
| | | | | | | | | sc_need_room() now takes the required free space to receive more data as parameter. All calls to this function are updated accordingly. For now, this value is set but not used. When we are waiting for a buffer, 0 is used. So we expect to be unblocked ASAP. However this must be reviewed because SC_FL_NEED_BUF is probably enough in this case and this flag is already set if the input buffer allocation fails.
* MINOR: stconn: Add a field to specify the room needed by the SC to progressChristopher Faulet2023-05-051-0/+4
| | | | | | | | | | | | | | | | | When the SC is blocked because it is waiting for room in the input buffer, it will be responsible to specify the minimum free space required to progress. In this commit, we only introduce the field in the stconn structure that will be used to store this value. It is a signed value with the following meaning: * -1: The SC is waiting for room but not based on the buffer state. It will be typically used during splicing when the pipe is full. In this case, only a successful send can unblock the SC. * >= 0; The minimum free space in the input buffer to unblock the SC. 0 is a special value to specify the SC must be unblocked ASAP, by the stream, at the end of process_stream() or when output data are consumed on the opposite side.
* MINOR: stats: Use the applet API to write dataChristopher Faulet2023-05-051-1/+1
| | | | | | | stats_putchk() is updated to use the applet API instead of the channel API to write data. To do so, the appctx is passed as parameter instead of the channel. This way, the applet does not need to take care to request more room it it fails to put data into the channel's buffer.
* MINOR: ssl: allow to change the signature algorithm for client authenticationWilliam Lallemand2023-05-052-0/+4
| | | | | | | | | | This commit introduces the keyword "client-sigalgs" for the bind line, which does the same as "sigalgs" but for the client authentication. "ssl-default-bind-client-sigalgs" allows to set the default parameter for all the bind lines. This patch should fix issue #2081.
* MINOR: ssl: allow to change the server signature algorithmWilliam Lallemand2023-05-043-0/+8
| | | | | | | | | This patch introduces the "sigalgs" keyword for the bind line, which allows to configure the list of server signature algorithms negociated during the handshake. Also available as "ssl-default-bind-sigalgs" in the default section. This patch was originally written by Bruno Henc.
* CLEANUP: debug: remove the now unused ha_thread_dump_all_to_trash()Willy Tarreau2023-05-041-1/+0
| | | | | The function isn't used anymore since each call place performs its own loop. Let's get rid of it.
* MEDIUM: debug: simplify the thread dump mechanismWilly Tarreau2023-05-042-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The thread dump mechanism that is used by "show threads" and by the panic dump is overly complicated due to an initial misdesign. It firsts wakes all threads, then serializes their dumps, then releases them, while taking extreme care not to face colliding dumps. In fact this is not what we need and it reached a limit where big machines cannot dump all their threads anymore due to buffer size limitations. What is needed instead is to be able to dump *one* thread, and to let the requester iterate on all threads. That's what this patch does. It adds the thread_dump_buffer to the struct thread_ctx so that the requester offers the buffer to the thread that is about to be dumped. This buffer also serves as a lock. A thread at rest has a NULL, a valid pointer indicates the thread is using it, and 0x1 (NULL+1) is used by the dumped thread to tell the requester it's done. This makes sure that a given thread is dumped once at a time. In addition to this, the calling thread decides whether it accesses the thread by itself or via the debug signal handler, in order to get a backtrace. This is much saner because the calling thread is free to do whatever it wants with the buffer after each thread is dumped, and there is no dependency between threads, once they've dumped, they're free to continue (and possibly to dump for another requester if needed). Finally, when the THREAD_DUMP feature is disabled and the debug signal is not used, the requester accesses the thread by itself like before. For now we still have the buffer size limitation but it will be addressed in future patches.
* BUG/MINOR: time: fix NS_TO_TV macroAurelien DARRAGON2023-05-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | NS_TO_TV helper was implemented in 591fa59 ("MINOR: time: add conversions to/from nanosecond timestamps") Due to NS_TO_TV being implemented as a macro and not a function, we must take extra care when manipulating user input. In current implementation, 't' argument is not isolated within the macro. Because of this, NS_TO_TV(1 + 1) will expand to: ((const struct timeval){ .tv_sec = 1 + 1 / 1000000000ULL, .tv_usec = (1 + 1 % 1000000000ULL) / 1000U }) Instead of: ((const struct timeval){ .tv_sec = 2 / 1000000000ULL, .tv_usec = (2 % 1000000000ULL) / 1000U }) As such, NS_TO_TV usage in hlua_now() is currently incorrect and this results in unexpected values being passed to lua. In this patch, we're adding an extra parenthesis around 't' in NS_TO_TV() macro to make it safe against such usages. (that is: ensure proper argument expansion as if NS_TO_TV was implemented as a function) This is a 2.8 specific bug, no backport needed.
* MINOR: mux-quic: adjust local error APIAmaury Denoyelle2023-05-042-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | When a fatal error is detected by the QUIC MUX or H3 layer, the connection should be closed with a CONNECTION_CLOSE with an error code as the reason. Previously, a direct call was used to the quic_conn layer to try to close the connection. This API was adjusted to be more flexible. Now, when an error is detected, the function qcc_set_error() is called. This set the flag QC_CF_ERRL with the error code stored by the MUX. The connection will be closed soon so most of the operations are not conducted anymore. Connection is then finally closed during qc_send() via quic_conn layer if QC_CF_ERRL is set. This will set the flag QC_CF_ERRL_DONE which indicates that the MUX instance can be freed. This model is cleaner and brings the following improvments : - interaction with quic_conn layer for closure is centralized on a single function - CO_FL_ERROR is not set anymore. This was incorrect as this should be reserved to errors reported by the transport layer to be similar with other haproxy components. As a consequence, qcc_is_dead() has been adjusted to check for QC_CF_ERRL_DONE to release the MUX instance. This should be backported up to 2.7.
* MINOR: mux-quic: add trace event for local errorAmaury Denoyelle2023-05-041-0/+2
| | | | | | | Add a dedicated trace event QMUX_EV_QCC_ERR. This is used for locally detected error when a CONNECTION_CLOSE should be emitted. This should be backported up to 2.7.
View Lorry Controller Status