MINOR: ssl: add 'ssl_npn' sample/acl to extract TLS/NPN information

This may be used to distinguish between SPDY versions for example.
DOC: fix minor typo on http-send-name-header

The "server" keyword documentation had a reference on "http-send-server-name"
instead of "http-send-name-header".
BUILD: ssl: fix shctx build on older compilers

gcc < 3 breaks on shctx because of the missing arg in the lock macros.
We don't need the arg at all, it's not used.
MEDIUM: ssl: add support for the "npn" bind keyword

The ssl_npn match could not work by itself because clients do not use
the NPN extension unless the server advertises the protocols it supports.
Thanks to Simone Bordet for the explanations on how to get it right.
BUG: ssl: fix ssl_sni ACLs to correctly process regular expressions

ssl_sni_reg was using acl_parse_str which is wrong since we're parsing
a regex. Additionally, neither _end nor _reg may be looked up.
MINOR: chunk: provide string compare functions

It's sometimes needed to be able to compare a zero-terminated string with a
chunk, so we now have two functions to do that, one strcmp() equivalent and
one strcasecmp() equivalent.
MINOR: sample: accept fetch keywords without parenthesis

fetch keywords which support arguments do not support being called
without parenthesis even if all arguments are optional. Let's fix
this to allow fetch keywords without parenthesis as is already done
in ACLs.
MEDIUM: sample: pass an empty list instead of a null for fetch args

ACL and sample fetches use args list and it is really not convenient to
check for null args everywhere. Now for empty args we pass a constant
list of end of lists. It will allow us to remove many useless checks.
MINOR: ssl: improve socket behaviour upon handshake abort.

While checking haproxy's SSL stack with www.ssllabs.com, it appeared that
immediately closing upon a failed handshake caused a TCP reset to be emitted.
This is because OpenSSL does not consume pending data in the socket buffers.
One side effect is that if the reset packet is lost, the client might not get
it. So now when a handshake fails, we try to clean the socket buffers before
closing, resulting in a clean FIN instead of an RST.
BUG/MEDIUM: http: set DONTWAIT on data when switching to tunnel mode

Jaroslaw Bojar diagnosed an issue when haproxy switches to tunnel mode
after a transfer. The response data are sent with the MSG_MORE flag,
causing them to be needlessly queued in the kernel. In order to fix this,
we set the CF_NEVER_WAIT flag on the channels when switching to tunnel
mode.

One issue remained with client-side keep-alive : if the response is sent
before the end of the request, it suffers the same issue for the same
reason. This is easily addressed by setting the CF_SEND_DONTWAIT flag
on the channel when the response has been parsed and we're waiting for
the other side.

The same issue is present in 1.4 so the fix must be backported.
DOC: make it clear what the HTTP request size is

Please consider the following patch for configuration.txt to clarify meaning
of bufsize, maxrewrite and the size of HTTP request which can be processed.
MINOR: sample: manage binary to string type convertion in stick-table and samples.

Binary type is converted to a null terminated hexa string.
MINOR: acl: add parse and match primitives to use binary type on ACLs

Binary ACL match patterns can now be entered as hex digit strings.
MINOR: sample: export 'sample_get_trash_chunk(void)'

This will be used on external fetch modules.
MEDIUM: listener: provide a fallback for accept4() when not supported

It happens that on some systems, the libc is recent enough to permit
building with accept4() but the kernel does not support it. The result
is then a disaster since no connection is accepted. We now detect this
and automatically fall back to accept() and fcntl() when this happens.
BUG/MAJOR: connection: risk of crash on certain tricky close scenario

In some circumstances, if the connection to the server is aborted while
some data were planned to be sent and the poller reported an ability to
send, then conn_fd_handler() would still call conn->data->send(), causing
the data layer to dereference the now NULL conn->xprt and crash.

So we have to check for conn->xprt validity before calling the data
layer.

This issue was introduced after 1.5-dev12 so it does not need any backport
and does not affect any released version.

Special thanks go to Cristian Ditoiu who once again provided amazing help
to troubleshoot this bug !
MEDIUM: cli: allow the stats socket to be bound to a specific set of processes

Using "stats bind-process", it becomes possible to indicate to haproxy which
process will get the incoming connections to the stats socket. It will also
shut down the warning when nbproc > 1.
BUG/MEDIUM: acls using IPv6 subnets patterns incorrectly match IPs

Some tests revealed that IPs not in the range of IPv6 subnets incorrectly
matched (for example "acl BUG src 2804::/16" applied to a src IP "127.0.0.1").

This is caused by the acl_match_ip() function applies a mask in host byte
order, whereas it should be in network byte order.
BUG/MAJOR: fix a segfault on option http_proxy and url_ip acl

url2sa() mistakenly uses "addr" as a reference. This causes a segfault when
option http_proxy or url_ip are used.

This bug was introduced in haproxy 1.5 and doesn't need to be backported.
MEDIUM: http: accept IPv6 values with (s)hdr_ip acl

Commit ceb4ac9c states that IPv6 values are accepted by "hdr_ip" acl,
but the code didn't allow it. This patch provides the ability to accept IPv6
values.