MEDIUM: tcp: add explicit support for delayed ACK in connect()

Commit 24db47e0 tried to improve support for delayed ACK upon connect
but it was incomplete, because checks with the proxy protocol would
always enable polling for data receive and there was no way of
distinguishing data polling and delayed ack.

So we add a distinct delack flag to the connect() function so that
the caller decides whether or not to use a delayed ack regardless
of pending data (eg: when send-proxy is in use). Doing so covers all
combinations of { (check with data), (sendproxy), (smart-connect) }.
BUG/MEDIUM: connection: always disable polling upon error

Commit 0ffde2cc in 1.5-dev13 tried to always disable polling on file
descriptors when errors were encountered. Unfortunately it did not
always succeed in doing so because it relied on detecting polling
changes to disable it. Let's use a dedicated conn_stop_polling()
function that is inconditionally called upon error instead.

This managed to stop a busy loop observed when a health check makes
use of the send-proxy protocol and fails before the connection can
be established.
MINOR: connection: abort earlier when errors are detected

If an uncaught CO_FL_ERROR flag on a connection is detected, we
immediately go to the wakeup function. This ensures that even if
an error is asynchronously delivered, we don't risk re-enabling
polling or doing unexpected things in the handshake handlers.
BUG/MEDIUM: checks: report handshake failures

Up to now, only data layer failures were reported to the task, but
if a handshake failed from the beginning, the error was not reported
as a failure.
BUG/MEDIUM: connection: local_send_proxy must wait for connection to establish

The conn_local_send_proxy() function has to retrieve the local and remote
addresses, but the getpeername() and getsockname() functions may fail until
the connection is established. So now we catch this error and poll for write
when this happens.
MINOR: tcp: add support for the "v6only" bind option

This option forces a socket to bind to IPv6 only when it uses the
default address (eg: ":::80").
MINOR: stats: also report the computed compression savings in html stats

It's interesting to know the average compression ratio obtained on
frontends and backends without having to compute it by hand, so let's
report it in the HTML stats.
MINOR: stats: report the total number of compressed responses per front/back

Depending on the content-types and accept-encoding fields, some responses
might or might not be compressed. Let's have a counter of the number of
compressed responses and report it in the stats to help improve compression
usage.

Some cosmetic issues were fixed in the CSV output too (missing commas at the
end).
MINOR: tcp: add support for the "v4v6" bind option

Commit 9b6700f added "v6only". As suggested by Vincent Bernat, it is
sometimes useful to have the opposite option to force binding to the
two protocols when the system is configured to bind to v6 only by
default. This option does exactly this. v6only still has precedence.
DOC: stats: document the comp_rsp stats column

This was forgotten in recent patch 5e16cbc3.
BUILD: buffer: fix another isprint() warning on solaris

This one came with commit recent be0efd8. Solaris wants ints, not chars.
MINOR: cli: add support for the "show sess all" command

Sometimes when debugging haproxy, it is important to take a full
snapshot of all sessions and their respective states. Till now it
was complicated to do because we had to use scripts and sessions
would vanish between two runs.

Now with this command we have the same output as "show sess $id"
but for all sessions in the table. This is a debugging command only,
it should only be used by developers as it is never guaranteed to
perfectly work !
BUG/MAJOR: cli: show sess <id> may randomly corrupt the back-ref list

show sess <id> puts a backref into the session it's dumping. If the output
is interrupted, the backref cannot always be removed because it's only done
in the I/O handler. This can randomly corrupt the backref list when the
session closes, because it passes the pointer to the next session which
itself might be watched.

The case is hard to reproduce (hundreds of attempts) but monitoring systems
might encounter it frequently.

Thus we have to add a release handler which does the cleanup even when the
I/O handler is not called.

This issue should also be present in 1.4 so the patch should be backported.
MINOR: cli: improve output format for show sess $ptr

This change removes pointers for known types (stream_interface, ...),
adds buffer pointers and sizes, and moves buffer information to their
own line. The output is cleaner with shorter lines and slightly more
lines.
[RELEASE] Released version 1.5-dev14

Released version 1.5-dev14 with the following main changes :
    - DOC: fix minor typos
    - BUG/MEDIUM: compression: does not forward trailers
    - MINOR: buffer_dump with ASCII
    - BUG/MEDIUM: checks: mark the check as stopped after a connect error
    - BUG/MEDIUM: checks: ensure we completely disable polling upon success
    - BUG/MINOR: checks: don't mark the FD as closed before transport close
    - MEDIUM: checks: avoid accumulating TIME_WAITs during checks
    - MINOR: cli: report the msg state in full text in "show sess $PTR"
    - CLEANUP: checks: rename some server check flags
    - MAJOR: checks: rework completely bogus state machine
    - BUG/MINOR: checks: slightly clean the state machine up
    - MEDIUM: checks: avoid waking the application up for pure TCP checks
    - MEDIUM: checks: close the socket as soon as we have a response
    - BUG/MAJOR: checks: close FD on all timeouts
    - MINOR: checks: fix recv polling after connect()
    - MEDIUM: connection: provide a common conn_full_close() function
    - BUG/MEDIUM: checks: prevent TIME_WAITs from appearing also on timeouts
    - BUG/MAJOR: peers: the listener's maxaccept was not set and caused loops
    - MINOR: listeners: make the accept loop more robust when maxaccept==0
    - BUG/MEDIUM: acl: correctly resolve all args, not just the first one
    - BUG/MEDIUM: acl: make prue_acl_expr() correctly free ACL expressions upon exit
    - BUG/MINOR: stats: fix inversion of the report of a check in progress
    - MEDIUM: tcp: add explicit support for delayed ACK in connect()
    - BUG/MEDIUM: connection: always disable polling upon error
    - MINOR: connection: abort earlier when errors are detected
    - BUG/MEDIUM: checks: report handshake failures
    - BUG/MEDIUM: connection: local_send_proxy must wait for connection to establish
    - MINOR: tcp: add support for the "v6only" bind option
    - MINOR: stats: also report the computed compression savings in html stats
    - MINOR: stats: report the total number of compressed responses per front/back
    - MINOR: tcp: add support for the "v4v6" bind option
    - DOC: stats: document the comp_rsp stats column
    - BUILD: buffer: fix another isprint() warning on solaris
    - MINOR: cli: add support for the "show sess all" command
    - BUG/MAJOR: cli: show sess <id> may randomly corrupt the back-ref list
    - MINOR: cli: improve output format for show sess $ptr
MEDIUM: ssl: Experimental CyaSSL implementation

Cyassl 2.4.0 compil:
Required options:
--enable-opensslExtra
--enable-fortress (for verify)
--enable-sessioncerts (for certificate and session_id fetches)

Performances options:
--enable-singleThreaded (waiting for shared mem cache, commpil error on test files)
--enable-hugecache
--enable-fasthugemath
--enable-aesni (required gcc >= 4.4)

Futur required options:
--enable-ecc (for ECDH ciphers, does not compil)
--enable-crl (for CRL use)

Haproxy compil:
make TARGET=linux26 USE_CYASSL=1

Known bugs:
* Secure reneg initiate by server cause session failure.
* No differences between connection or handshake failure.

Missing:
* No shared memory cache cause renegotiate if nbproc > 1
* SSL cache size not settable (fixed at compil)
* No multiple certificates choice on SNI
* No 'crl-file' management (api unable to load CRLs from a single pem file)
* No NPN implementation
* No ECDH ciphers implementation (unable to build cyassl with --enable-ecc)
* no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 options not supported

Supported:
* SSLv3 TLSv1 TLSv1.1 TLSv1.2 protocols
  note: AES ciphers not usable en cyassl SSLv3
* force-sslv3 force-tlsv10 force-tlsv11 force-tlsv12 options supported
* Diffie Hellmann parameter loading supported (DH ciphers)
* 'verify required' partially supported on both sides:
  No 'crl-file' support
  Certificate request does not present CA names
* 'verify optional' partially supported:
  No 'crl-file' support
  Certificate request does not present CA names
  ca-ignore-err not supported
  crt-ignore-err supports only the value 'all'
* Client certificate sent to server supported

FETCHs and ACLs:
* ssl_c_ca_err       (unuspported) because verify is partially supported
* ssl_c_ca_err_depth (unsupported) because verify is partially supported
* ssl_c_err          (unsupported) because verify is partially supported
* ssl_c_i_dn         (partial)     returns only the full dn (no args)
* ssl_c_key_alg      (unsupported) missing api
* ssl_c_notafter     (unsupported) missing api
* ssl_c_notbefore    (unsupported) missing api
* ssl_c_sig_alg      (unsupported) missing api
* ssl_c_s_dn         (partial)     returns only the full dn (no args)
* ssl_c_serial       (supported)
* ssl_c_verify       (different)   returns the generic error ID 1 or 0 if verify succeed
* ssl_c_version      (unsupported) missing api
* ssl_f_*            (unsupported) missing api, no access to loaded certificate
* ssl_fc             (supported)
* ssl_fc_alg_keysize (unsupported) missing api
* ssl_fc_cipher      (different)   cyassl returns a cipher long name
* ssl_fc_has_crt     (supported)
* ssl_fc_has_sni     (unsupported) no SNI support
* ssl_fc_npn         (unsupported) no NPN support
* ssl_fc_protocol    (supported)
* ssl_fc_use_keysize (unsupported) missing api
* ssl_fc_session_id  (supported)
* ssl_fc_sni         (unsupported) no SNI support