Quantcast
Channel: Serverphorums.com
Viewing all 23908 articles
Browse latest View live

Re: Will HAProxy community supports mailers section?

$
0
0
Hi Rajesh,

Rajesh Kolli wrote:
> i am getting this error if i use mailers section in my configuration.

The ability to send mail alerts (and thus to configure this with a
mailers section) was added in HAProxy 1.6. If you use an older version,
this feature is not yet available to you.

Once you update to a newer version (e.g. the current version 1.7.8), the
feature should be usable for you.

Regards,
Holger

Re: Will HAProxy community supports mailers section?

$
0
0
On Thu, Aug 24, 2017 at 06:50:51PM +0530, Rajesh Kolli wrote:
> Hi Daniel,
>
> Thanks for your quick response...
>
> i am getting this error if i use mailers section in my configuration.
> ---------------------------------------------------------------------------------------------------------
> [root@DS-11-82-R7-CLST-Node1 ~]# systemctl status haproxy.service -l
> haproxy.service - HAProxy Load Balancer
> Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled)
> Active: inactive (dead) since Thu 2017-08-24 18:43:23 IST; 4s ago
> Process: 6511 ExecStart=/usr/sbin/haproxy-systemd-wrapper -f
> /etc/haproxy/haproxy.cfg -p /run/haproxy.pid (code=exited, status=0/SUCCESS)
> Main PID: 6511 (code=exited, status=0/SUCCESS)
>
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 systemd[1]: Starting HAProxy Load
> Balancer...
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 systemd[1]: Started HAProxy Load
> Balancer.
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:81] : unknown
> keyword 'mailers' in 'listen' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:82] : unknown
> keyword 'mailer' in 'listen' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:117] :
> unknown keyword 'email-alert' in 'backend' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:119] :
> unknown keyword 'email-alert' in 'backend' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:120] :
> unknown keyword 'email-alert' in 'backend' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : Error(s) found in configuration file :
> /etc/haproxy/haproxy.cfg
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : Fatal errors found in configuration.
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> haproxy-systemd-wrapper: exit, haproxy RC=256
>

Hello Rajesh,

you are most likely running a version in which mailers is not implemented
(<1.6).

Jérôme

Re: Will HAProxy community supports mailers section?

$
0
0
Hi Daniel,

I have changed my config file according to you, even though i am getting
the same error.
---------------------
haproxy.service - HAProxy Load Balancer
Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled)
Active: inactive (dead) since Thu 2017-08-24 19:04:14 IST; 6s ago
Process: 7641 ExecStart=/usr/sbin/haproxy-systemd-wrapper -f
/etc/haproxy/haproxy.cfg -p /run/haproxy.pid (code=exited, status=0/SUCCESS)
Main PID: 7641 (code=exited, status=0/SUCCESS)

Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 systemd[1]: Starting HAProxy Load
Balancer...
Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 systemd[1]: Started HAProxy Load
Balancer.
Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
[ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:9]: unknown
keyword 'mailers' out of section.
Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
[ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:10]: unknown
keyword 'mailer' out of section.
Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
[ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:121] :
unknown keyword 'email-alert' in 'backend' section
Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
[ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:123] :
unknown keyword 'email-alert' in 'backend' section
Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
[ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:124] :
unknown keyword 'email-alert' in 'backend' section
Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
[ALERT] 235/190414 (7642) : Error(s) found in configuration file :
/etc/haproxy/haproxy.cfg
Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
[ALERT] 235/190414 (7642) : Fatal errors found in configuration.
Aug 24 19:04:15 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
haproxy-systemd-wrapper: exit, haproxy RC=256


On Thu, Aug 24, 2017 at 6:57 PM, Daniel Heitepriem <
daniel.heitepriem@pribas.com> wrote:

> Hi Rajesh,
>
> as far as I know (but may be wrong) the "mailers" config has to be defined
> before any listen, frontend or backend directives. Also the "email-alert"
> has to be defined after the backend. So in your case it would look like
> this:
>
>
> #---------------------------------------------------------------------
> # Global settings
> #---------------------------------------------------------------------
> global
> log 127.0.0.1 local2
>
> chroot /var/lib/haproxy
> pidfile /var/run/haproxy.pid
> maxconn 4000
> user haproxy
> group haproxy
> daemon
>
> stats socket /var/lib/haproxy/stats
>
> #---------------------------------------------------------------------
> # common defaults that all the 'listen' and 'backend' sections will
> # use if not designated in their block
> #---------------------------------------------------------------------
> defaults
> mode http
> log global
> option httplog
> option dontlognull
> # option log-health-checks
> option http-server-close
> option forwardfor except 127.0.0.0/8
> option redispatch
> retries 3
> timeout http-request 10s
> timeout queue 1m
> timeout connect 10s
> timeout client 1m
> timeout server 1m
> timeout http-keep-alive 10s
> timeout check 10s
> maxconn 3000
>
> mailers mta
> mailer smtp1 127.0.0.1:25
>
> #---------------------------------------------------------------------
> #HAProxy Monitoring Config
> #---------------------------------------------------------------------
> listen haproxy3-monitoring
> bind :8080 #Haproxy Monitoring run on port 8080
> mode http
> option forwardfor
> option httpclose
> stats enable
> stats show-legends
> stats refresh 5s
> stats uri /stats #URL for HAProxy
> monitoring
> stats realm Haproxy\ Statistics
> stats auth root:sangbe #User and Password for login to the
> monitoring dashboard
> stats admin if TRUE
> default_backend app #This is optionally for
> monitoring backend
>
> #---------------------------------------------------------------------
> # main frontend which proxys to the backends
> #---------------------------------------------------------------------
> frontend main
> bind :80
> option http-server-close
> option forwardfor
> default_backend app
>
>
> backend app
> balance roundrobin
> # option httpchk #HEAD / HTTP/1.1\r\nHost:\ localhost #Check the
> server application is up and healty - 200 status code
> server 11-80-R7-CLST-Node1 10.10.11.80:80 check
> server DS-11-81-R7-CLST-Node2 10.10.11.81:80 check
>
> email-alert mailers mta
> # email-alert level alert
> email-alert from redmine@netrovert.net
> email-alert to rajesh.kolli@netrovert.net
>
> Regards,
> Daniel
>
> Am 24.08.17 um 15:20 schrieb Rajesh Kolli:
>
> Hi Daniel,
>
> Thanks for your quick response...
>
> i am getting this error if i use mailers section in my configuration.
> ------------------------------------------------------------
> ---------------------------------------------
> [root@DS-11-82-R7-CLST-Node1 ~]# systemctl status haproxy.service -l
> haproxy.service - HAProxy Load Balancer
> Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled)
> Active: inactive (dead) since Thu 2017-08-24 18:43:23 IST; 4s ago
> Process: 6511 ExecStart=/usr/sbin/haproxy-systemd-wrapper -f
> /etc/haproxy/haproxy.cfg -p /run/haproxy.pid (code=exited, status=0/SUCCESS)
> Main PID: 6511 (code=exited, status=0/SUCCESS)
>
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 systemd[1]: Starting HAProxy Load
> Balancer...
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 systemd[1]: Started HAProxy Load
> Balancer.
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:81] : unknown
> keyword 'mailers' in 'listen' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:82] : unknown
> keyword 'mailer' in 'listen' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:117] :
> unknown keyword 'email-alert' in 'backend' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:119] :
> unknown keyword 'email-alert' in 'backend' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:120] :
> unknown keyword 'email-alert' in 'backend' section
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : Error(s) found in configuration file :
> /etc/haproxy/haproxy.cfg
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> [ALERT] 235/184323 (6512) : Fatal errors found in configuration.
> Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> haproxy-systemd-wrapper: exit, haproxy RC=256
>
> ------------------------------------------------------------
> ------------------------------------
> Here is my config file
>
> [root@DS-11-82-R7-CLST-Node1 ~]# cat /etc/haproxy/haproxy.cfg
> #---------------------------------------------------------------------
> # Global settings
> #---------------------------------------------------------------------
> global
> log 127.0.0.1 local2
>
> chroot /var/lib/haproxy
> pidfile /var/run/haproxy.pid
> maxconn 4000
> user haproxy
> group haproxy
> daemon
>
> stats socket /var/lib/haproxy/stats
>
> #---------------------------------------------------------------------
> # common defaults that all the 'listen' and 'backend' sections will
> # use if not designated in their block
> #---------------------------------------------------------------------
> defaults
> mode http
> log global
> option httplog
> option dontlognull
> # option log-health-checks
> option http-server-close
> option forwardfor except 127.0.0.0/8
> option redispatch
> retries 3
> timeout http-request 10s
> timeout queue 1m
> timeout connect 10s
> timeout client 1m
> timeout server 1m
> timeout http-keep-alive 10s
> timeout check 10s
> maxconn 3000
>
> #---------------------------------------------------------------------
> #HAProxy Monitoring Config
> #---------------------------------------------------------------------
> listen haproxy3-monitoring
> bind :8080 #Haproxy Monitoring run on port 8080
> mode http
> option forwardfor
> option httpclose
> stats enable
> stats show-legends
> stats refresh 5s
> stats uri /stats #URL for HAProxy
> monitoring
> stats realm Haproxy\ Statistics
> stats auth root:sangbe #User and Password for login to the
> monitoring dashboard
> stats admin if TRUE
> default_backend app #This is optionally for
> monitoring backend
>
> mailers mta
> mailer smtp1 127.0.0.1:25
>
> #---------------------------------------------------------------------
> # main frontend which proxys to the backends
> #---------------------------------------------------------------------
> frontend main
> bind :80
> option http-server-close
> option forwardfor
> default_backend app
>
>
> backend app
> balance roundrobin
> # option httpchk #HEAD / HTTP/1.1\r\nHost:\ localhost #Check the
> server application is up and healty - 200 status code
> email-alert mailers mta
> # email-alert level alert
> email-alert from redmine@netrovert.net
> email-alert to rajesh.kolli@netrovert.net
> server 11-80-R7-CLST-Node1 10.10.11.80:80 check
> server DS-11-81-R7-CLST-Node2 10.10.11.81:80 check
> ------------------------------------------------------------
> --------------------
>
> I am using postfix on my machine to send emails and i have configured
> postfix with gmail to send emails.
>
> Could you help on it or suggest something.
>
> On Thu, Aug 24, 2017 at 6:36 PM, Daniel Heitepriem <
> daniel.heitepriem@pribas.com> wrote:
>
>> Hi Rajesh,
>>
>> the community version supports mailers. Here is a working section from
>> my configuration:
>>
>> mailers mymailserver
>> mailer smtp1 10.1.0.251:25
>>
>> frontend frontend_CHANGEME
>>
>> bind *:443 ssl crt /opt/etc/haproxy/haproxy-t.pem force-tlsv12
>> no-sslv3
>>
>> #################################################################
>> # backend configuration
>> #################################################################
>>
>> backend booking-backend
>> compression algo gzip
>> compression type text/html text/plain text/css
>> server server1-t server1-t:8443 check ssl verify none maxconn 4000
>>
>> backend vakanz-backend
>> compression algo gzip
>> compression type text/html text/plain text/css application/xml
>> server server2-t server2-t:8080 check verify none force-tlsv12 backup
>> server server3-t server3-t:8443 check ssl verify none no-sslv3
>>
>> email-alert mailers mymailserver
>> email-alert from haproxy-t@mydomain.com
>> email-alert to myname@mydomain.com
>>
>> I hope it helps
>>
>> Regards,
>> Daniel
>>
>> Am 24.08.17 um 14:35 schrieb Rajesh Kolli:
>> > Hello,
>> >
>> > I am new to HAProxy, present i am using community version of haproxy,
>> > and i am trying to configure alerting in my configuration, after i
>> > configure "mailers" section and after restart of service it is
>> > throwing "unknown keyword mailers" in frontend.
>> >
>> > Now, my doubt is... will HAProxy community supports mailers/alerting?
>> >
>> > Thanks in advance if you suggest something on this.
>> >
>> > Thanks and Regards
>> >
>> > Rajesh Kolli
>> >
>> >
>>
>
>
>
> --
>
>
>
>
> *Thanks & Regards Rajesh Kolli *
>
>


--




*Thanks & RegardsRajesh Kolli*

Re: Will HAProxy community supports mailers section?

$
0
0
Hi,

I am using latest version.

[root@DS-11-82-R7-CLST-Node1 ~]# haproxy -v

HA-Proxy version 1.7.8 2017/07/07
Copyright 2000-2017 Willy Tarreau <willy@haproxy.org>



On Thu, Aug 24, 2017 at 6:59 PM, Jérôme Magnin <jmagnin@haproxy.com> wrote:

> On Thu, Aug 24, 2017 at 06:50:51PM +0530, Rajesh Kolli wrote:
> > Hi Daniel,
> >
> > Thanks for your quick response...
> >
> > i am getting this error if i use mailers section in my configuration.
> > ------------------------------------------------------------
> ---------------------------------------------
> > [root@DS-11-82-R7-CLST-Node1 ~]# systemctl status haproxy.service -l
> > haproxy.service - HAProxy Load Balancer
> > Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled)
> > Active: inactive (dead) since Thu 2017-08-24 18:43:23 IST; 4s ago
> > Process: 6511 ExecStart=/usr/sbin/haproxy-systemd-wrapper -f
> > /etc/haproxy/haproxy.cfg -p /run/haproxy.pid (code=exited,
> status=0/SUCCESS)
> > Main PID: 6511 (code=exited, status=0/SUCCESS)
> >
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 systemd[1]: Starting HAProxy Load
> > Balancer...
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 systemd[1]: Started HAProxy Load
> > Balancer.
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> > [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:81] :
> unknown
> > keyword 'mailers' in 'listen' section
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> > [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:82] :
> unknown
> > keyword 'mailer' in 'listen' section
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> > [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:117] :
> > unknown keyword 'email-alert' in 'backend' section
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> > [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:119] :
> > unknown keyword 'email-alert' in 'backend' section
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> > [ALERT] 235/184323 (6512) : parsing [/etc/haproxy/haproxy.cfg:120] :
> > unknown keyword 'email-alert' in 'backend' section
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> > [ALERT] 235/184323 (6512) : Error(s) found in configuration file :
> > /etc/haproxy/haproxy.cfg
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> > [ALERT] 235/184323 (6512) : Fatal errors found in configuration.
> > Aug 24 18:43:23 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[6511]:
> > haproxy-systemd-wrapper: exit, haproxy RC=256
> >
>
> Hello Rajesh,
>
> you are most likely running a version in which mailers is not implemented
> (<1.6).
>
> Jérôme
>



--




*Thanks & RegardsRajesh Kolli*

Re: Two way authentication issue

$
0
0
Hello,

Sorry I was confused about what the client wanted. First I thought hat they want to talk ssl with the backend but they actually want a client certificate authentication. I have modified my haproxy.cfg with the following configurations:

log /dev/log local0
log 127.0.0.1 local2
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 600 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
maxconn 20000
#Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3
tune.ssl.default-dh-param 2048
defaults
log global
mode http
option forwardfor
option http-server-close
option httplog
option dontlognull
timeout connect 5000ms
timeout client 300s
timeout server 300s
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
stats enable
stats hide-version
# stats scope .
stats uri /admin?stats
stats realm Haproxy\ Statistics
stats auth admin:K1l1m4ndj4r0
stats refresh 5s
frontend http-in
bind 10.0.0.2:80
redirect scheme https code 301 if !{ ssl_fc }
frontend https-in
bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt
mode http
acl client_ssl path_beg /service/ws
redirect location https://10.0.0.2/service/ws if client_ssl
default_backend idfusion_all
frontend apidev
bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt ca-file /etc/ssl/certs/ca-certificates.crt verify required
mode http
reqadd X-Forwarded-Proto:\ https if { ssl_fc }
acl client_ssl path_beg /service/ws
redirect location https://10.0.0.2/ if !client_ssl
default_backend idfusion_all
option forwardfor
backend idfusion_all
mode http
balance leastconn
timeout connect 1s
timeout server 300s
timeout queue 30s
option redispatch
retries 3
cookie rc_cookie_vers insert indirect nocache secure
server usloft4778 192.168.0.1:8080 cookie rc_cookie_vers check inter 1000 fastinter 500 rise 2 fall 1
server loft10179 192.168.0.1:8080 cookie rc_cookie_vers check inter 1000 fastinter 500 rise 2 fall 1

This configuration is working on some browsers like safari but it does not work with Firefox or chrome since I am having SSL_ERROR_HANDSHAKE_FAILURE_ALERT

Any idea how to fix it?

Regards,
Peter

> On 23 Aug 2017, at 10:42, Yann Cézard <ycezard@viareport.com> wrote:
>
> Hi Peter,
>
> On 23/08/2017 00:48, Keresztes Péter-Zoltán wrote:
>> Hello,
>>
>> I am trying to setup haproxy with two way authentication. While the frontend looks good one of the backends is giving me headaches with ssl handshake failures.
>>
>> Here is how the frontends and backends does look like:
>>
>> frontend http-in
>> bind 69.64.57.197:80
>> redirect scheme https code 301 if !{ ssl_fc }
>>
>> frontend https-in
>> bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt
>> mode http
>> acl client_ssl path_beg /service/ws
>> use_backend test_client_ssl if client_ssl
>> default_backend test_all
>>
>> backend test_all
>> mode http
>> balance leastconn
>> timeout connect 1s
>> timeout server 300s
>> timeout queue 30s
>> option redispatch
>> retries 3
>> cookie rc_cookie_vers insert indirect nocache secure
>> server usloft4778 192.168.0.1:8080 cookie rc_cookie_vers check inter 1000 fastinter 500 rise 2 fall 1
>> server loft10179 192.168.0.2:8080 cookie rc_cookie_vers check inter 1000 fastinter 500 rise 2 fall 1
>>
>> backend test_client_ssl
>> mode http
>> balance leastconn
>> timeout connect 1s
>> timeout server 300s
>> timeout queue 30s
>> option httpchk GET "/service/ws" "HTTP/1.0"
>> cookie rc_cookie_vers insert indirect nocache secure
>> server usloft4778 192.168.0.1:8080 ssl verify required ca-file /etc/ssl/certs/ca_full.crt crt /etc/ssl/certs/client.crt
>> server loft10179 192.168.0.2:8080 ssl verify required ca-file /etc/ssl/certs/ca_full.crt crt /etc/ssl/certs/client.crt
> You are using the same server:port for both HTTP and HTTPS backends, I
> doubt those backend are able to speak HTTP and HTTPS
> on the same port.
> Not sure what you are trying to achieve, but the config you sent means
> that you want :
> - to connect to the backend in HTTP mode if path does not begin with
> /service/ws
> - to connect to the backend in HTTPS mode + client verification if the
> path begins with /service/ws
>
> Not sure what you are trying to do though :
> 1. two way auth between client and HAProxy ?
> 2. two way auth between HAProxy and backend servers ?
>
> For the first one, you'll have to configure that in the frontend
> (https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/ https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/)
> For the second one, you'll probably have to check the ports you used
> between HAproxy and your backends.
>>
>> Any suggestion to make this work?
>>
>> Thanks in advance
>> Peter
> Hope this helps,
>
> Yann
> --------------------------- DISCLAIMER ------------------------- This message and any attachment are proprietary and confidential information and might be legally privileged in your country. These elements are intended solely for the addressee. Any unauthorized use or disclosure, in whole or in part, is prohibited. E-mails are subject to any alteration, change or falsification. The sender declines any liability to this message and any attachment. If you are not the intended recipient of this message, please delete this message and notify immediately the sender. --------------------------------------------------------------------

Re: Will HAProxy community supports mailers section?

$
0
0
On 08/24/2017 03:35 PM, Rajesh Kolli wrote:
> Hi Daniel,
>
> I have changed my config file according to you, even though i am getting
> the same error.
> ---------------------
> haproxy.service - HAProxy Load Balancer
> Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled)
> Active: inactive (dead) since Thu 2017-08-24 19:04:14 IST; 6s ago
> Process: 7641 ExecStart=/usr/sbin/haproxy-systemd-wrapper -f
> /etc/haproxy/haproxy.cfg -p /run/haproxy.pid (code=exited, status=0/SUCCESS)
> Main PID: 7641 (code=exited, status=0/SUCCESS)
>
> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 systemd[1]: Starting HAProxy Load
> Balancer...
> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 systemd[1]: Started HAProxy Load
> Balancer.
> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
> [ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:9]:
> unknown keyword 'mailers' out of section.
> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
> [ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:10]:
> unknown keyword 'mailer' out of section.
> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
> [ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:121] :
> unknown keyword 'email-alert' in 'backend' section

Well I would at least say that your haproxy does not support
"email-alert" keyword ;)

If I configure a 1.7 haproxy *without* any "mailers" section *but* with
a "email-alert mailers mta" setting in "backend" sections the parser
does not say it does not known "email-alert" keyword. It says: unable to
find "mailers" mta.

So even your haproxy could support "mailers" keyword, as it does not
support "email-alert", this would be for nothing ;)

You should try the same thing: remove/comment your "mailers" section,
and see if you still have "unknown keyword 'email-alert' in 'backend'
section".

AFAIK, "email-alert" may be followed by a "mailers" keyword ;)

Or perhaps I have missed something.

RE: HAProxy 1.7.8 compile problem with new OpenSSL

$
0
0
I
​n case you still need it:



# Install required libraries
sudo yum -y update
sudo yum -y install make gcc perl pcre-devel zlib-devel openssl-devel

# Install Updated Openssl-1.1.0f
wget https://www.openssl.org/source/openssl-1.1.0f.tar.gz
tar -zxf openssl-1.1.0f.tar.gz
cd openssl-1.1.0f
../config
make
sudo make install
sudo cp -f /usr/local/bin/openssl /usr/bin
sudo cp -f /usr/local/lib64/libssl.so.1.1 /usr/lib64
sudo cp -f /usr/local/lib64/libcrypto.so.1.1 /usr/lib64
cd /usr/lib64
sudo ln -sf libssl.so.1.1 libssl.so
sudo ln -sf libcrypto.so.1.1 libcrypto.so
sudo ldconfig

# Install HAProxy 1.5 and Upgrade to 1.7
sudo yum -y install haproxy # Install Generic Version (1.5) this will
create necessary folders, config files, etc.
wget https://www.haproxy.org/download/1.7/src/haproxy-1.7.8.tar.gz
tar -xzf haproxy-1.7.8.tar.gz
cd haproxy-1.7.8
make TARGET=linux2628 USE_PCRE=1 USE_PCRE_JIT=1 USE_OPENSSL=1 USE_ZLIB=1
USE_REGPARM=1
sudo make install
sudo cp -f /usr/local/sbin/haproxy /usr/sbin # Overwrite version 1.5
with new 1.7
sudo service haproxy start
sudo chkconfig haproxy on




Respectfully,

*Denis Astahov*

RE: HAProxy 1.7.8 compile problem with new OpenSSL

$
0
0
Thanks.
I see you solved the problem by copying the new version directly to /usr/bin and /usr/lib64.

I did this:

tar xvf /apps/Config/openssl-1.0.2-latest.tar.gz

cd openssl-1.0.2l

./config shared

make

make install

echo /usr/local/ssl/lib > /etc/ld.so.conf.d/libssl.conf

ldconfig

cd /tmp

tar xvf /apps/Config/haproxy-1.7.9.tar.gz

cd haproxy-1.7.9

yum install pcre-devel openssl-devel (If necessary.)

make TARGET=linux2628 USE_PCRE=1 USE_SLZ=1 USE_OPENSSL=1 SSL_INC=/usr/local/ssl/include/openssl SSL_LIB=/usr/local/ssl/lib

make install

My main problem was the missing “shared” option for the “./config” command.

I see you use the following 2 make options:

USE_PCRE_JIT=1 USE_REGPARM=1

I didn’t notice them in the docs.
Are they recommended?

From: Denis Astahov [mailto:denis@trinimbus.com]
Sent: August-24-17 11:26 AM
To: Norman Branitsky <Norman.Branitsky@micropact.com>
Cc: haproxy@formilux.org
Subject: RE: HAProxy 1.7.8 compile problem with new OpenSSL

In case you still need it:

# Install required libraries
sudo yum -y update
sudo yum -y install make gcc perl pcre-devel zlib-devel openssl-devel

# Install Updated Openssl-1.1.0f
wget https://www.openssl.org/source/openssl-1.1.0f.tar.gz
tar -zxf openssl-1.1.0f.tar.gz
cd openssl-1.1.0f
./config
make
sudo make install
sudo cp -f /usr/local/bin/openssl /usr/bin
sudo cp -f /usr/local/lib64/libssl.so.1.1 /usr/lib64
sudo cp -f /usr/local/lib64/libcrypto.so.1.1 /usr/lib64
cd /usr/lib64
sudo ln -sf libssl.so.1.1 libssl.so
sudo ln -sf libcrypto.so.1.1 libcrypto.so
sudo ldconfig

# Install HAProxy 1.5 and Upgrade to 1.7
sudo yum -y install haproxy # Install Generic Version (1.5) this will create necessary folders, config files, etc.
wget https://www.haproxy.org/download/1.7/src/haproxy-1.7.8.tar.gz
tar -xzf haproxy-1.7.8.tar.gz
cd haproxy-1.7.8
make TARGET=linux2628 USE_PCRE=1 USE_PCRE_JIT=1 USE_OPENSSL=1 USE_ZLIB=1 USE_REGPARM=1
sudo make install
sudo cp -f /usr/local/sbin/haproxy /usr/sbin # Overwrite version 1.5 with new 1.7
sudo service haproxy start
sudo chkconfig haproxy on

Respectfully,

Denis Astahov

Re: Will HAProxy community supports mailers section?

$
0
0
Hi All,

Thanks for your support.

Earlier I have upgraded from 1.4 to 1.7 using source then haproxy working
but alerting is not working.

I have checked haproxy version using cli command and it has given 1.7.x but
if I query rpm then it's giving 1.4.x then I realized that upgrade has some
issue.

At least, I have download latest rpm RedHat and installed it then every
thing is working and alerts too working.

On 24 Aug 2017 7:57 pm, "Frederic Lecaille" <flecaille@haproxy.com> wrote:

> On 08/24/2017 03:35 PM, Rajesh Kolli wrote:
>
>> Hi Daniel,
>>
>> I have changed my config file according to you, even though i am getting
>> the same error.
>> ---------------------
>> haproxy.service - HAProxy Load Balancer
>> Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled)
>> Active: inactive (dead) since Thu 2017-08-24 19:04:14 IST; 6s ago
>> Process: 7641 ExecStart=/usr/sbin/haproxy-systemd-wrapper -f
>> /etc/haproxy/haproxy.cfg -p /run/haproxy.pid (code=exited,
>> status=0/SUCCESS)
>> Main PID: 7641 (code=exited, status=0/SUCCESS)
>>
>> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 systemd[1]: Starting HAProxy Load
>> Balancer...
>> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 systemd[1]: Started HAProxy Load
>> Balancer.
>> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
>> [ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:9]:
>> unknown keyword 'mailers' out of section.
>> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
>> [ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:10]:
>> unknown keyword 'mailer' out of section.
>> Aug 24 19:04:14 DS-11-82-R7-CLST-Node1 haproxy-systemd-wrapper[7641]:
>> [ALERT] 235/190414 (7642) : parsing [/etc/haproxy/haproxy.cfg:121] :
>> unknown keyword 'email-alert' in 'backend' section
>>
>
> Well I would at least say that your haproxy does not support "email-alert"
> keyword ;)
>
> If I configure a 1.7 haproxy *without* any "mailers" section *but* with a
> "email-alert mailers mta" setting in "backend" sections the parser does not
> say it does not known "email-alert" keyword. It says: unable to find
> "mailers" mta.
>
> So even your haproxy could support "mailers" keyword, as it does not
> support "email-alert", this would be for nothing ;)
>
> You should try the same thing: remove/comment your "mailers" section, and
> see if you still have "unknown keyword 'email-alert' in 'backend' section".
>
> AFAIK, "email-alert" may be followed by a "mailers" keyword ;)
>
> Or perhaps I have missed something.
>

Re: Two way authentication issue

$
0
0
Hi Peter,

There are several things which looks really wrong in your config.

Are you sure this configuration is validated by haproxy ? Or did you only reload
and it in facts still uses the old conf ?

On 24/08/2017 15:48, Keresztes Péter-Zoltán wrote:
Hello,

Sorry I was confused about what the client wanted. First I thought hat they want to talk ssl with the backend but they actually want a client certificate authentication. I have modified my haproxy.cfg with the following configurations:

[...]
frontend http-in
bind 10.0.0.2:80
redirect scheme https code 301 if !{ ssl_fc }
frontend https-in
bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt
mode http
That part looks wrong :
acl client_ssl path_beg /service/ws
redirect location https://10.0.0.2/service/ws if client_ssl
It looks like a redirect loop to me.
default_backend idfusion_all
frontend apidev
bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt ca-file /etc/ssl/certs/ca-certificates.crt verify required
=> you defined two times the same ip:port, how HAProxy is supposed to know which one the user is asking for ?
I would be surprised if it doesn't throw an error with such a configuration..
[...]

This configuration is working on some browsers like safari but it does not work with Firefox or chrome since I am having SSL_ERROR_HANDSHAKE_FAILURE_ALERT

Any idea how to fix it?
You didn't explain what you wanted to achieve, but my guess is that you want clients
to be cert authenticated/validated to access the /service/ws path, and you don't care for other
paths if the client are cert validated or not (you just want to have HTTPS)..
In that case, look at https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/
(Phase 2: Client Certificate optional)
=> use "verify optional"
=> ensure { ssl_fc_has_crt } if accessing /service/ws

Hope this helps,

Yann

Regards,
Peter

On 23 Aug 2017, at 10:42, Yann Cézard <ycezard@viareport.com<mailto:ycezard@viareport.com>> wrote:

Hi Peter,

On 23/08/2017 00:48, Keresztes Péter-Zoltán wrote:
Hello,

I am trying to setup haproxy with two way authentication. While the frontend looks good one of the backends is giving me headaches with ssl handshake failures.

Here is how the frontends and backends does look like:

frontend http-in
bind 69.64.57.197:80
redirect scheme https code 301 if !{ ssl_fc }

frontend https-in
bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt
mode http
acl client_ssl path_beg /service/ws
use_backend test_client_ssl if client_ssl
default_backend test_all

backend test_all
mode http
balance leastconn
timeout connect 1s
timeout server 300s
timeout queue 30s
option redispatch
retries 3
cookie rc_cookie_vers insert indirect nocache secure
server usloft4778 192.168.0.1:8080 cookie rc_cookie_vers check inter 1000 fastinter 500 rise 2 fall 1
server loft10179 192.168.0.2:8080 cookie rc_cookie_vers check inter 1000 fastinter 500 rise 2 fall 1

backend test_client_ssl
mode http
balance leastconn
timeout connect 1s
timeout server 300s
timeout queue 30s
option httpchk GET "/service/ws" "HTTP/1.0"
cookie rc_cookie_vers insert indirect nocache secure
server usloft4778 192.168.0.1:8080 ssl verify required ca-file /etc/ssl/certs/ca_full.crt crt /etc/ssl/certs/client.crt
server loft10179 192.168.0.2:8080 ssl verify required ca-file /etc/ssl/certs/ca_full.crt crt /etc/ssl/certs/client.crt
You are using the same server:port for both HTTP and HTTPS backends, I
doubt those backend are able to speak HTTP and HTTPS
on the same port.
Not sure what you are trying to achieve, but the config you sent means
that you want :
- to connect to the backend in HTTP mode if path does not begin with
/service/ws
- to connect to the backend in HTTPS mode + client verification if the
path begins with /service/ws

Not sure what you are trying to do though :
1. two way auth between client and HAProxy ?
2. two way auth between HAProxy and backend servers ?

For the first one, you'll have to configure that in the frontend
(https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/)
For the second one, you'll probably have to check the ports you used
between HAproxy and your backends.

Any suggestion to make this work?

Thanks in advance
Peter
Hope this helps,

Yann
--------------------------- DISCLAIMER ------------------------- This message and any attachment are proprietary and confidential information and might be legally privileged in your country. These elements are intended solely for the addressee. Any unauthorized use or disclosure, in whole or in part, is prohibited. E-mails are subject to any alteration, change or falsification. The sender declines any liability to this message and any attachment. If you are not the intended recipient of this message, please delete this message and notify immediately the sender. --------------------------------------------------------------------


--------------------------- DISCLAIMER ------------------------- This message and any attachment are proprietary and confidential information and might be legally privileged in your country. These elements are intended solely for the addressee. Any unauthorized use or disclosure, in whole or in part, is prohibited. E-mails are subject to any alteration, change or falsification. The sender declines any liability to this message and any attachment. If you are not the intended recipient of this message, please delete this message and notify immediately the sender. --------------------------------------------------------------------

[PHP-DEV] GOOD Benchmark Results for PHP Master 2017-08-23

$
0
0
Results for project PHP master, build date 2017-08-23 19:23:20-07:00
commit: cf1d42e
previous commit: 3cb6407
revision date: 2017-08-24 02:31:52+02:00
environment: Haswell-EP
cpu: Intel(R) Xeon(R) CPU E5-2699 v3 @ 2.30GHz 2x18 cores, stepping 2, LLC 45 MB
mem: 128 GB
os: CentOS 7.1
kernel: Linux 3.10.0-229.4.2.el7.x86_64

Baseline results were generated using release php-7.0.0, with hash 60fffd2 from
2015-12-01 04:16:47+00:00

-------------------------------------------------------------------------------------------
benchmark relative change since change since current rev run
std_dev* last run baseline with PGO
-------------------------------------------------------------------------------------------
:-| Wordpress 4.2.2 cgi -T10000 0.24% 0.57% 4.42% 8.88%
:-| Drupal 7.36 cgi -T10000 0.17% -0.02% 3.70% 5.56%
:-| MediaWiki 1.23.9 cgi -T5000 0.15% 0.51% 4.47% 3.64%
:-| bench.php cgi -T100 0.01% 0.33% 45.45% -0.12%
:-| micro_bench.php cgi -T10 0.01% 0.78% 29.02% 2.55%
:-) mandelbrot.php cgi -T100 0.01% 4.41% 45.28% 0.17%
-------------------------------------------------------------------------------------------

* Relative Standard Deviation (Standard Deviation/Average)

If this is not displayed properly please visit our results page here: http://languagesperformance.intel.com/good-benchmark-results-for-php-master-2017-08-23/

Note: Benchmark results for Wordpress, Drupal, MediaWiki are measured in
fetches/second while all others are measured in seconds.
More details on measurements methodology at:
https://01.org/lp/documentation/php-environment-setup.

Subject Label Legend:
Attributes are determined based on the performance evolution of the workloads
compared to the previous measurement iteration.
NEUTRAL: performance did not change by more than 1% for any workload
GOOD: performance improved by more than 1% for at least one workload and there
is no regression greater than 1%
BAD: performance dropped by more than 1% for at least one workload and there is
no improvement greater than 1%
UGLY: performance improved by more than 1% for at least one workload and also
dropped by more than 1% for at least one workload


Our lab does a nightly source pull and build of the PHP project and measures
performance changes against the previous stable version and the previous nightly
measurement. This is provided as a service to the community so that quality
issues with current hardware can be identified quickly.

Intel technologies' features and benefits depend on system configuration and may
require enabled hardware, software or service activation. Performance varies
depending on system configuration.


--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php

[PHP-DEV] Re: [PHP-WEBMASTER] Subscribe Function Seems to be down for several days

$
0
0
Hi Hannes,

I replied to your reply below on 16-Aug. Has there been any progress in
getting the subscriber list working?

Alan


On 8/16/2017 10:25 AM, Hannes Magnusson wrote:
> how are you trying to subscribe?
>
> Are you submitting the http://php.net/mailing-lists.php form? In which
> case, which mirror are you looking at? Could you try another mirror?
> If that still doesn't work, try sending empty mail to
> <the-mailing-list-you-want-to-subscribe-to>-subscribe@lists.php.net
> (e.g. internals-subscribe@lists.php.net)
>
> If you are not using that form, but are sending the subscribe email,
> please forward the full original reply you get.
>
> -Hannes
>
>
> On Tue, Aug 15, 2017 at 9:40 AM, Alan Feuerbacher <alanf00@comcast.net> wrote:
>> On 8/3/2017 9:06 AM, Andreas Heigl wrote:
>>>
>>> Seems like the mailinglist needs some love… again…
>>>
>>> Cheers
>>>
>>> Andreas
>>>
>>>
>>> Am 03.08.17 um 17:02 schrieb Alan Feuerbacher:
>>>>
>>>> I've been trying for several days to subscribe to a PHP mailing list,
>>>> but I keep getting the message "We were unable to subscribe you due to
>>>> some technical problems. Please try again later."
>>>>
>>>> Is there any way to fix this?
>>>>
>>
>> Hi,
>>
>> It has been close to two weeks since I emailed PHP about the mailing lists.
>> Has there been any activity getting it working again?
>>
>> Alan
>


--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] Contravariance and the "empty type"

$
0
0
This discussion made me have another look at the Generics RFC,
https://wiki.php.net/rfc/generics

It seems to me that the proposal violates LSP, because it does not
correctly implement contravariance.
Look at the part where it talks about instanceof.

interface Feline {}
class Cat implements Feline {}
class Tiger implements Feline {}

class Box<T is Feline> {
function entrap(T $feline) {}
}

$feline_box = new Box<Feline>();
$cat_box = new Box<Cat>();
$tiger_box = new Box<Tiger>();

$cat = new Cat();
$tiger = new Tiger();

assert($feline_box instanceof Box<Feline>); // -> ok.
assert($tiger_box instanceof Box<Feline>); // -> ok.
assert($cat_box instanceof Box<Feline>); // -> ok.

assert($cat instanceof Feline); // -> ok.
assert($tiger instanceof Feline); // -> ok.

$feline_box->entrap($cat); // -> ok.
$cat_box->entrap($cat); // -> ok.
$tiger_box->entrap($cat); // -> Fatal error: Uncaught TypeError.


So, even with generics, we still need to think about contravariance.

We need to distinguish 3 types of type parameter on classes:
1. Those which are used in method return types.
2. Those which are used in method parameter types.
3. Those which are used in both.

For these 3 cases, the following rules would need to apply:
1. Contravariance.
2. Covariance
3. Identity.

E.g.

interface Fruit;
interface Banana extends Fruit;

interface Grower<T is Fruit> {
function grow() : T;
}

interface Processor<T is Fruit> {
function process(T $fruit) : T;
}

interface Eater<T is Fruit> {
function eat(T $fruit);
}

// Covariance
var_dump(new Grower<Banana> instanceof Grower<Fruit>); // => (bool) true
var_dump(new Grower<Fruit> instanceof Grower<Banana>); // => (bool) false

// Identity
var_dump(new Processor<Banana> instanceof Processor<Fruit>); // => (bool) false
var_dump(new Processor<Fruit> instanceof Processor<Banana>); // => (bool) false

// Contravariance
var_dump(new Eater<Banana> instanceof Eater<Fruit>); // => (bool) false
var_dump(new Eater<Fruit> instanceof Eater<Banana>); // => (bool) true


The only supertype for all Eater<*> types would be Eater<EMPTY_TYPE>.
This super-eater has the absolute fruit allergy.




On Wed, Aug 23, 2017 at 9:18 AM, Michał Brzuchalski
<michal@brzuchalski.com> wrote:
> Hi Andreas,
>
> 2017-08-22 21:11 GMT+02:00 Andreas Hennings <andreas@dqxtech.net>:
>
>> On Tue, Aug 22, 2017 at 10:39 AM, Nikita Popov <nikita.ppv@gmail.com>
>> wrote:
>> > On Tue, Aug 22, 2017 at 4:27 AM, Andreas Hennings <andreas@dqxtech.net>
>> > wrote:
>> >>
>> >> Hello list,
>> >> for a while I had this thought about contravariance and an "empty type".
>> >> I don't expect too much of it, for now I just want to share the idea.
>> >> Maybe this concept even exists somewhere in a different language, and
>> >> I am not aware of it.
>> >>
>> >> I think it has some overlap with generics,
>> >> https://wiki.php.net/rfc/generics.
>> >>
>> >> ------------
>> >>
>> >> I think I am not the first one to suggest allowing contravariance for
>> >> method parameters.
>> >> E.g. here, "PHP RFC: Parameter Type Widening"
>> >> https://wiki.php.net/rfc/parameter-no-type-variance
>> >>
>> >> From this RFC:
>> >> > Unfortunately “true” contravariance for class types isn't part of this
>> >> > RFC, as implementing that is far more difficult, and would require
>> >> > additional rules about autoloading and/or class compilation, which
>> might
>> >> > only be acceptable at a major release.
>> >>
>> >> For anyone not familiar with the term:
>> >>
>> >> interface I {
>> >> function foo(J $arg);
>> >> }
>> >>
>> >> interface J extends I {
>> >> function foo(I $arg);
>> >> }
>> >>
>> >> So: While return types in a child method should be either the same or
>> >> more narrow, the parameter types should be either the same or more
>> >> permissive.
>> >> Without this it would break Liskov substitution.
>> >>
>> >> ---------------
>> >>
>> >> Now for my actual proposal: The "empty type".
>> >> We can think of a type (class/interface or primitive) as a set or a
>> >> constraint on the kind of values that it allows.
>> >> There is a special type, "mixed", which allows all values. We could
>> >> also think of it as the union of all types.
>> >>
>> >> A natural extension of this concept, on the other end, would be a type
>> >> "nothing" or "empty", which would allow no values at all.
>> >> We could think of this as the intersection of all types.
>> >> In fact it is already sufficient to intersect just two distinct
>> >> primitive types to get this empty type:
>> >> "All values that are at the same time string and integer" clearly is
>> >> an empty type.
>> >>
>> >> How would this ever be useful?
>> >> If we write a base class or interface for a category of interfaces
>> >> that have a similar signature.
>> >>
>> >> interface Fruit {..}
>> >> interface Apple extends Fruit {..}
>> >> interface Banana extends Fruit {..}
>> >>
>> >> interface AbstractFruitEater {
>> >> function eat(EMPTY_TYPE $fruit);
>> >> }
>> >>
>> >> interface BananaEater extends AbstractFoodEater {
>> >> function eat(Banana $banana);
>> >> }
>> >>
>> >> interface AppleEater extends AbstractFoodEater {
>> >> function eat(Apple $apple);
>> >> }
>> >>
>> >> One could imagine a component that has a list of AbstractFruitEater
>> >> objects, and chooses one that is suitable for the given fruit, using
>> >> instanceof.
>> >> I think the correct term is "chain of responsibility".
>> >>
>> >> function eatApple(array $fruitEaters, Apple $apple) {
>> >> foreach ($fruitEaters as $eater) {
>> >> if ($eater instanceof AppleEater) {
>> >> $eater->eat($apple);
>> >> break;
>> >> }
>> >> }
>> >> }
>> >>
>> >> --------------------
>> >>
>> >> We can go one step further.
>> >>
>> >> The natural parameter type to use for param $fruit in
>> >> AbstractFruitEater::foo() would not be the global EMPTY_TYPE, but
>> >> something more specific:
>> >> The projected intersection of all real and hypothetical children of
>> >> interface Fruit.
>> >> Obviously this does not and cannot exist as a class or interface.
>> >>
>> >> Practically, for the values it allows, this is the same as the global
>> >> EMPTY_TYPE.
>> >> But unlike the EMPTY_TYPE, this would poses a restriction on the
>> >> parameter type in child interfaces.
>> >>
>> >> What would be the syntax / notation for such a projected hypothetical
>> >> subtype?
>> >> I don't know. Let's say INTERSECT_CHILDREN<Fruit>
>> >>
>> >> So, would the following work?
>> >>
>> >> interface Food {..}
>> >> interface Fruit extends Food {..}
>> >> interface Banana extends Fruit {..}
>> >>
>> >> interface AbstractFoodEater {
>> >> function eat(INTERSECT_CHILDREN<Food> $food);
>> >> }
>> >>
>> >> interface AbstractFruitEater extends AbstractFoodEater {
>> >> function eat(INTERSECT_CHILDREN<Fruit> $fruit);
>> >> }
>> >>
>> >> interface BananaEater extends AbstractFruitEater {
>> >> function eat(Banana $banana);
>> >> }
>> >>
>> >> I'm not sure.
>> >> Liskov would not care. Both AbstractFoodEater and AbstractFruitEater
>> >> are useless on their own.
>> >> Maybe there are other logical conflicts which I don't see.
>> >>
>> >>
>> >> ----------
>> >>
>> >> Obviously with generics this base interface would no longer be relevant.
>> >> https://wiki.php.net/rfc/generics
>> >>
>> >> interface FruitEater<FruitType> {
>> >> function eat(FruitType $fruit);
>> >> }
>> >>
>> >> // This is not really necessary.
>> >> interface BananaEater extends FruitEater<Banana> {
>> >> function eat(Banana $banana);
>> >> }
>> >>
>> >> So, would the "empty type" become obsolete? Maybe.
>> >> I did not arrive at a final conclusion yet. It still seems too
>> >> interesting to let it go.
>> >>
>> >> -- Andreas
>> >
>> >
>> > What's the purpose of this construction? I get the general idea (work
>> around
>> > LSP variance restrictions without generics), but I don't see how the
>> > practical use would look like.
>>
>> To be honest I am still not fully convinced myself.
>> I just couldn't resist because this idea was haunting me for too long.
>>
>> > After all, using the empty type as an
>> > argument implies that the method may not ever be called, so wouldn't an
>> > interface using it be essentially useless?
>> >
>> > Nikita
>>
>> Interfaces like AbstractFruitEater would mainly be used to categorize
>> its child interfaces, and as a formalized constraint on method
>> ::eat().
>>
>> Any child interface of AbstractFruitEater must have a method eat(),
>> which must have exactly one required parameter (and as many optional
>> parameters as it wants). This parameter must have a type hint
>> compatible with the constraint mentioned above (in case of EMPTY_TYPE,
>> there is no constraint on the parameter type, it could as well be
>> "mixed").
>>
>> Any component that wants to call $eater->eat($apple) on an $eater of
>> type AbstractFruitEater, needs to do one of two things first:
>> - Use reflection to check for the first parameter's type, if it allows
>> Apple.
>> - Use instanceof to check if it implements AppleEater.
>>
>> If the $eater was only type-hinted as "object" instead of
>> AbstractFruitEater, the reflection would have to do more work. It
>> would have to check if a method eat() exists, and then check the first
>> parameter's type.
>>
>> A component I might have built with the EMPTY_TYPE or with
>> INTERSECT_CHILDREN<Food> would be something like this:
>>
>>
>> // Base interface for eaters that only eat a specific fruit type.
>> interface AbstractSpecificFruitEater {
>> function eat(INTERSECT_CHILDREN<Food> $fruit);
>> }
>>
>> // Interface for eaters that eat any fruit.
>> // This could extend AbstractSpecificFruitEater, but doesn't have to.
>> interface FruitEater /* extends AbstractSpecificFruitEater */ {
>> function eat(Fruit $fruit);
>> }
>>
>> class ChainedFruitEater implements FruitEater {
>> private $eaters = [];
>> public function addSpecificEater(AbstractSpecificFruitEater $eater) {
>> $paramClass = (new
>> \ReflectionObject($eater))->getMethod('eat')->
>> getParameters()[0]->getClass();
>> $this->eaters[$paramClass] = $eater;
>> }
>> public function eat(Fruit $fruit) {
>> if (null !== $specificEater = $this->findSuitableEater($fruit)) {
>> $specificEater->eat($fruit);
>> return true;
>> }
>> else {
>> return false;
>> }
>> }
>> private function findSuitableEater(Fruit $fruit) {
>> foreach ($this->eaters as $paramClass => $eater) {
>> if ($fruit instanceof $paramClass) {
>> return $eater;
>> }
>> }
>> }
>> }
>>
>>
>> Without the EMPTY_TYPE or INTERSECT_CHILDREN<Food>, the interface
>> AbstractSpecificFruitEater could not define a method ::eat().
>>
>> Classes implementing AbstractSpecificFruitEater would not know that a
>> method ::eat() is required, and what structure it must have.
>>
>> The reflection line would need to check if the method exists, if the
>> method is public and non-static, if the parameter exists, if it has a
>> type hint class.
>>
>>
>> In the end I implemented this another way.
>> My specific fruit eaters now always accept any fruit, but do an
>> instanceof check inside. They have an added method like
>> "acceptsFruitClass($class)".
>>
>> I don't know if I would replace my current implementation with the code
>> above.
>> I think I rather wait for generics.
>>
>>
>> NOTE: When I say "type hint", I do not distinguish what is currently
>> implemented natively, what is in the @param PhpDoc, and what might be
>> implemented natively in the future. E.g. I don't even know if "mixed"
>> or "object" is currently implemented or not in latest PHP 7.
>>
>>
> "object" type hint and return type is a part of current 7.2 release,
> "mixed" not
>
>
>> --
>> PHP Internals - PHP Runtime Development Mailing List
>> To unsubscribe, visit: http://www.php.net/unsub.php
>>
>>
>
>
> --
> regards / pozdrawiam,
> --
> Michał Brzuchalski
> about.me/brzuchal
> brzuchalski.com

--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php

[PHP-DEV] Request access to wiki for RFC on implementing missing pdo_sqlite features

Re: Two way authentication issue

$
0
0
Hello

Basically what I need is when I browse /service/ws to use client certificate authentication otherwise for everything else to use normal ssl termination
This configuration was validated by haproxy and it told that it was correct and it works but not with Firefox and google chrome.

Please help me with some suggestion cause I really need to make this work

Regards
Peter
> On 24 Aug 2017, at 19:18, Yann Cézard <ycezard@viareport.com> wrote:
>
> Hi Peter,
>
> There are several things which looks really wrong in your config.
>
> Are you sure this configuration is validated by haproxy ? Or did you only reload
> and it in facts still uses the old conf ?
>
> On 24/08/2017 15:48, Keresztes Péter-Zoltán wrote:
>> Hello,
>>
>> Sorry I was confused about what the client wanted. First I thought hat they want to talk ssl with the backend but they actually want a client certificate authentication. I have modified my haproxy.cfg with the following configurations:
>>
>> [...]
>> frontend http-in
>> bind 10.0.0.2:80
>> redirect scheme https code 301 if !{ ssl_fc }
>> frontend https-in
>> bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt
>> mode http
> That part looks wrong :
>> acl client_ssl path_beg /service/ws
>> redirect location https://10.0.0.2/service/ws https://10.0.0.2/service/ws if client_ssl
> It looks like a redirect loop to me.
Probably but I couldn’t think at anything else on how to force the haproxy to use the client certificate when that path is used.

>> default_backend idfusion_all
>> frontend apidev
>> bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt ca-file /etc/ssl/certs/ca-certificates.crt verify required
> => you defined two times the same ip:port, how HAProxy is supposed to know which one the user is asking for ?
> I would be surprised if it doesn't throw an error with such a configuration.
Don’t know if this supposed to work or not but it’s actually working

>> [...]
>>
>> This configuration is working on some browsers like safari but it does not work with Firefox or chrome since I am having SSL_ERROR_HANDSHAKE_FAILURE_ALERT
>>
>> Any idea how to fix it?
> You didn't explain what you wanted to achieve, but my guess is that you want clients
> to be cert authenticated/validated to access the /service/ws path, and you don't care for other
> paths if the client are cert validated or not (you just want to have HTTPS).
> In that case, look at https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/ https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/
> (Phase 2: Client Certificate optional)
> => use "verify optional"
> => ensure { ssl_fc_has_crt } if accessing /service/ws
>
> Hope this helps,
>
> Yann
>>
>> Regards,
>> Peter
>>
>>> On 23 Aug 2017, at 10:42, Yann Cézard <ycezard@viareport.com <mailto:ycezard@viareport.com>> wrote:
>>>
>>> Hi Peter,
>>>
>>> On 23/08/2017 00:48, Keresztes Péter-Zoltán wrote:
>>>> Hello,
>>>>
>>>> I am trying to setup haproxy with two way authentication. While the frontend looks good one of the backends is giving me headaches with ssl handshake failures.
>>>>
>>>> Here is how the frontends and backends does look like:
>>>>
>>>> frontend http-in
>>>> bind 69.64.57.197:80
>>>> redirect scheme https code 301 if !{ ssl_fc }
>>>>
>>>> frontend https-in
>>>> bind 10.0.0.2:443 ssl crt /etc/ssl/certs/veracityid.com.crt
>>>> mode http
>>>> acl client_ssl path_beg /service/ws
>>>> use_backend test_client_ssl if client_ssl
>>>> default_backend test_all
>>>>
>>>> backend test_all
>>>> mode http
>>>> balance leastconn
>>>> timeout connect 1s
>>>> timeout server 300s
>>>> timeout queue 30s
>>>> option redispatch
>>>> retries 3
>>>> cookie rc_cookie_vers insert indirect nocache secure
>>>> server usloft4778 192.168.0.1:8080 cookie rc_cookie_vers check inter 1000 fastinter 500 rise 2 fall 1
>>>> server loft10179 192.168.0.2:8080 cookie rc_cookie_vers check inter 1000 fastinter 500 rise 2 fall 1
>>>>
>>>> backend test_client_ssl
>>>> mode http
>>>> balance leastconn
>>>> timeout connect 1s
>>>> timeout server 300s
>>>> timeout queue 30s
>>>> option httpchk GET "/service/ws" "HTTP/1.0"
>>>> cookie rc_cookie_vers insert indirect nocache secure
>>>> server usloft4778 192.168.0.1:8080 ssl verify required ca-file /etc/ssl/certs/ca_full.crt crt /etc/ssl/certs/client.crt
>>>> server loft10179 192.168.0.2:8080 ssl verify required ca-file /etc/ssl/certs/ca_full.crt crt /etc/ssl/certs/client.crt
>>> You are using the same server:port for both HTTP and HTTPS backends, I
>>> doubt those backend are able to speak HTTP and HTTPS
>>> on the same port.
>>> Not sure what you are trying to achieve, but the config you sent means
>>> that you want :
>>> - to connect to the backend in HTTP mode if path does not begin with
>>> /service/ws
>>> - to connect to the backend in HTTPS mode + client verification if the
>>> path begins with /service/ws
>>>
>>> Not sure what you are trying to do though :
>>> 1. two way auth between client and HAProxy ?
>>> 2. two way auth between HAProxy and backend servers ?
>>>
>>> For the first one, you'll have to configure that in the frontend
>>> (https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/ https://www.haproxy.com/blog/ssl-client-certificate-management-at-application-level/)
>>> For the second one, you'll probably have to check the ports you used
>>> between HAproxy and your backends.
>>>>
>>>> Any suggestion to make this work?
>>>>
>>>> Thanks in advance
>>>> Peter
>>> Hope this helps,
>>>
>>> Yann
>>> --------------------------- DISCLAIMER ------------------------- This message and any attachment are proprietary and confidential information and might be legally privileged in your country. These elements are intended solely for the addressee. Any unauthorized use or disclosure, in whole or in part, is prohibited. E-mails are subject to any alteration, change or falsification. The sender declines any liability to this message and any attachment. If you are not the intended recipient of this message, please delete this message and notify immediately the sender. --------------------------------------------------------------------
>>
>
> --------------------------- DISCLAIMER ------------------------- This message and any attachment are proprietary and confidential information and might be legally privileged in your country. These elements are intended solely for the addressee. Any unauthorized use or disclosure, in whole or in part, is prohibited. E-mails are subject to any alteration, change or falsification. The sender declines any liability to this message and any attachment. If you are not the intended recipient of this message, please delete this message and notify immediately the sender. --------------------------------------------------------------------

Re: Two way authentication issue

$
0
0
Hello,


Am 25.08.2017 um 01:47 schrieb Keresztes Péter-Zoltán:
> Hello
>
> Basically what I need is when I browse /service/ws to use client certificate authentication otherwise for everything else to use normal ssl termination

this is not possible with Haproxy.

Also, never ever bind to the same port twice. The kernel will load-balance between the 2 frontends and the behavior will be undeterministic.


cheers,
lukas

Separated reverse proxy for different users

$
0
0
Hi, I'm relatively new to HTTP servers and absolutely new to nginx.
I have HTTP server which should ask user credentials and redirect every user
to its own reverse proxy.

The initial setting is:
server {
listen 80 default_server;
listen [::]:80 default_server ipv6only=on;
set $auth_status 100;
server_name localhost;
root /usr/share/nginx/html;
include /etc/nginx/default.d/*.conf;

location / {
try_files $uri $uri/ =404;
auth_basic "restricted content";
auth_basic_user_file "/home/secure/.passwords";
auth_request_set $auth_status $upstream_status;

if ($remote_user = "ivy") {
proxy_pass http://localhost:10080;
break;
}
if ($remote_user = "john") {
proxy_pass http://localhost:10081;
break;
}
}

It works OK. However, I think it's pretty ugly to have separated "if" per
user. Therefore, I want to add a map:
map $remote_user $rp_port {
include /home/secure/reverse_proxy.map;
}

The map contains:
ivy 10080;
john 10081;

From documentation I understood this should come before server definition.
Then I tried to replace all "ifs" in server body with:
proxy_pass http://localhost:$rp_port

This configuration gives following errors:
2017/08/25 06:29:38 [error] 26582#26582: *631 invalid port in upstream
"localhost:", client: ..., server: localhost, request: "GET / HTTP/1.1",
host: "..."
2017/08/25 06:29:48 [error] 26582#26582: *632 no resolver defined to resolve
localhost, client: ..., server: localhost, request: "GET / HTTP/1.1", host:
"..."

It's clear that I miss something in the documentation.
Please, help to build a map for reverse proxy by user authentication
properly.

Thank you.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,276150,276150#msg-276150

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx

Re: req.cook_cnt() broken?

$
0
0
On 24. Aug. 2017, at 01:50, Cyril Bonté <cyril.bonte@free.fr> wrote:
>
> You're right. currently, the code and the documentation don't say the same things.
>
> Can you try the attached patch ?
>
> --
> Cyril Bonté
> <cookie-noname-count.patch>

Thanks for the patch!

Tried against 1.8, 1.7.9, and 1.6.13 just now. Works as expected with all three. :D

Any chance of getting this fix backported to the 1.7 and ideally 1.6 branches?

It would come in handy on a production system currently running 1.6 that I cannot easily upgrade to 1.7.


Cheers,
Daniel


--
Daniel Schneller
Principal Cloud Engineer

CenterDevice GmbH | Hochstraße 11
| 42697 Solingen
tel: +49 1754155711 | Deutschland
daniel.schneller@centerdevice.de | www.centerdevice.de

Geschäftsführung: Dr. Patrick Peschlow, Dr. Lukas Pustina,
Michael Rosbach, Handelsregister-Nr.: HRB 18655,
HR-Gericht: Bonn, USt-IdNr.: DE-815299431

Unable to compile Nginx 1.12.1 with ModSecurity

$
0
0
Hello,
We have been using Nginx with ModSecurity for some time. We are moving from
Nginx 1.10 to 1.12. Following the same receipe as always, compiling Nginx
1.12.1 with ModSecurity 2.9.2 now gives error:

cc: error:
/home/rpmbuild/modsecurity-2.9.2/nginx/modsecurity/../../standalone/.libs/standalone.a:
No such file or directory
make[1]: *** [objs/nginx] Error 1
make[1]: Leaving directory `/home/rpmbuild/rpmbuild/BUILD/nginx-1.12.1'
make: *** [build] Error 2
error: Bad exit status from /var/tmp/rpm-tmp.TezlYj (%build)


Compiling Nginx 1.10.1 with ModSecurity 2.9.2 the same way works perfectly
fine.

What am I missing? Is there something that should be done differently when
compiling 1.12.1?

Regards,
Peter

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,276154,276154#msg-276154

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx

Re: [PHP-DEV] Re: [PHP-WEBMASTER] Subscribe Function Seems to be down for several days

Viewing all 23908 articles
Browse latest View live


Latest Images