MEDIUM: config: support per-listener backlog and maxconn

With SSL, connections are much more expensive, so it is important to be
able to limit concurrent connections per listener in order to limit the
memory usage.
MINOR: session: do not send an HTTP/500 error on SSL sockets

If a session fails its initialization, we don't want to send HTTP/500
over the socket if it's not a raw data layer.
MEDIUM: config: implement maxsslconn in the global section

SSL connections take a huge amount of memory, and unfortunately openssl
does not check malloc() returns and easily segfaults when too many
connections are used.

The only solution against this is to provide a global maxsslconn setting
to reject SSL connections above the limit in order to avoid reaching
unsafe limits.
BUG: tcp: close socket fd upon connect error

When the data layer fails to initialize (eg: out of memory for SSL), we
must close the socket fd we just allocated.
MEDIUM: connection: improve error handling around the data layer

Better avoid calling the data functions upon error or handshake than
having to put conditions everywhere, which are too easy to forget (one
check for CO_FL_ERROR was missing, but this was harmless).
MINOR: config: make the tasks "nice" value configurable on "bind" lines.

This is very convenient to reduce SSL processing priority compared to
other traffic. This applies to CPU usage only, but has a direct impact
on latency under congestion.
LICENSE: add licence exception for OpenSSL

According to OpenSSL FAQ, GPL programs need an exception to use OpenSSL.

    http://openssl.org/support/faq.html#LEGAL2
BUILD: shut a gcc warning introduced by commit 269ab31

Usual warning on unchecked write() on which no operation is possible.
MEDIUM: config: centralize handling of SSL config per bind line

SSL config holds many parameters which are per bind line and not per
listener. Let's use a per-bind line config instead of having it
replicated for each listener.

At the moment we only do this for the SSL part but this should probably
evolved to handle more of the configuration and maybe even the state per
bind line.
BUILD: makefile: report USE_OPENSSL status in build options
CONTRIB: halog: sort URLs by avg bytes_read or total bytes_read

The patch attached to this mail brings ability to sort URLs by
averaged bytes read and total bytes read in HALog tool.
In most cases, bytes read is also the object size.
The purpose of this patch is to know which URL consume the most
bandwith, in average or in total.
It may be interesting as well to know the standard deviation (ecart
type in french) for some counters (like bytes_read).

The results:
- Sorting by average bytes read per URL:
./halog -uba <~/tmp/haproxy.log | column -t | head
2246 lines in, 302 lines out, 194 parsing errors
18    0    5101     283    5101   283    126573  2278327  /lib/exe/js.php
1     0    1        1      1      1      106734  106734   /wp-admin/images/screenshots/theme-customizer.png
2     0    2        1      2      1      106511  213022   /wp-admin/css/wp-admin.css
1     0    1        1      1      1      96698   96698    /wp-admin/images/screenshots/captions-1.png
1     0    1        1      1      1      73165   73165    /wp-admin/images/screenshots/flex-header-1.png
4     0    0        0      0      0      64832   259328   /cuisine/wp-content/plugins/stats/open-flash-chart.swf
1     0    0        0      0      0      48647   48647    /wp-admin/images/screenshots/flex-header-3.png
1     0    0        0      0      0      44046   44046    /wp-admin/images/screenshots/captions-2.png
1     0    1        1      1      1      38830   38830    /wp-admin/images/screenshots/flex-header-2.png

- Sorting by total bytes read per URL:
./halog -ubt <~/tmp/haproxy.log | column -t | head
2246 lines in, 302 lines out, 194 parsing errors
18    0    5101     283    5101   283    126573  2278327  /lib/exe/js.php
60    0    14387    239    14387  239    10081   604865   /lib/exe/css.php
64    2    8820     137    8819   142    7742    495524   /doku.php
14    0    250      17     250    17     24045   336632   /wp-admin/load-scripts.php
71    0    6422     90     6422   90     4048    287419   /wp-admin/
4     0    0        0      0      0      64832   259328   /cuisine/wp-content/plugins/stats/open-flash-chart.swf
2     0    2        1      2      1      106511  213022   /wp-admin/css/wp-admin.css
31    3    5423     174    5040   180    6804    210931   /index
10    0    429      42     429    42     18009   180093   /cuisine/files/2011/10/tarte_figue_amande-e1318281546905-225x300.jpg
MEDIUM: ssl: add support for SNI and wildcard certificates

A side effect of this change is that the "ssl" keyword on "bind" lines is now
just a boolean and that "crt" is needed to designate certificate files or
directories.

Note that much refcounting was needed to have the free() work correctly due to
the number of cert aliases which can make a context be shared by multiple names.
BUILD: report openssl build settings in haproxy -vv

Since it's common enough to discover that some config options are not
supported due to some openssl version or build options, we report the
relevant ones in "haproxy -vv".
MEDIUM: ssl: add sample fetches for is_ssl, ssl_has_sni, ssl_sni_*

This allows SNI presence and value to be checked on incoming SSL connections.
It is usable both for ACLs and stick tables.
DOC: add a special acknowledgement for the stud project

Really, the quality of their code deserves it, it would have been much
harder to figure how to get all the things right at once without looking
there from time to time !
DOC: add missing SSL options for servers and listeners
BUILD: automatically add -lcrypto for SSL

Some platforms need it. Libz is still not enabled by default because there is
no reason to add this dependency everywhere by default.
DOC: add some info about openssl build in the README
[RELEASE] Released version 1.5-dev12

Released version 1.5-dev12 with the following main changes :
    - CONTRIB: halog: sort URLs by avg bytes_read or total bytes_read
    - MEDIUM: ssl: add support for prefer-server-ciphers option
    - MINOR: IPv6 support for transparent proxy
    - MINOR: protocol: add SSL context to listeners if USE_OPENSSL is defined
    - MINOR: server: add SSL context to servers if USE_OPENSSL is defined
    - MEDIUM: connection: add a new handshake flag for SSL (CO_FL_SSL_WAIT_HS).
    - MEDIUM: ssl: add new files ssl_sock.[ch] to provide the SSL data layer
    - MEDIUM: config: add the 'ssl' keyword on 'bind' lines
    - MEDIUM: config: add support for the 'ssl' option on 'server' lines
    - MEDIUM: ssl: protect against client-initiated renegociation
    - BUILD: add optional support for SSL via the USE_OPENSSL flag
    - MEDIUM: ssl: add shared memory session cache implementation.
    - MEDIUM: ssl: replace OpenSSL's session cache with the shared cache
    - MINOR: ssl add global setting tune.sslcachesize to set SSL session cache size.
    - MEDIUM: ssl: add support for SNI and wildcard certificates
    - DOC: Typos cleanup
    - DOC: fix name for "option independant-streams"
    - DOC: specify the default value for maxconn in the context of a proxy
    - BUG/MINOR: to_log erased with unique-id-format
    - LICENSE: add licence exception for OpenSSL
    - BUG/MAJOR: cookie prefix doesn't support cookie-less servers
    - BUILD: add an AIX 5.2 (and later) target.
    - MEDIUM: fd/si: move peeraddr from struct fdinfo to struct connection
    - MINOR: halog: use the more recent dual-mode fgets2 implementation
    - BUG/MEDIUM: ebtree: ebmb_insert() must not call cmp_bits on full-length matches
    - CLEANUP: halog: make clean should also remove .o files
    - OPTIM: halog: make use of memchr() on platforms which provide a fast one
    - OPTIM: halog: improve cold-cache behaviour when loading a file
    - BUG/MINOR: ACL implicit arguments must be created with unresolved flag
    - MINOR: replace acl_fetch_{path,url}* with smp_fetch_*
    - MEDIUM: pattern: add the "base" sample fetch method
    - OPTIM: i386: make use of kernel-mode-linux when available
    - BUG/MINOR: tarpit: fix condition to return the HTTP 500 message
    - BUG/MINOR: polling: some events were not set in various pollers
    - MINOR: http: add the urlp_val ACL match
    - BUG: stktable: tcp_src_to_stktable_key() must return NULL on invalid families
    - MINOR: stats/cli: add plans to support more stick-table actions
    - MEDIUM: stats/cli: add support for "set table key" to enter values
    - REORG/MEDIUM: fd: remove FD_STCLOSE from struct fdtab
    - REORG/MEDIUM: fd: remove checks for FD_STERROR in ev_sepoll
    - REORG/MEDIUM: fd: get rid of FD_STLISTEN
    - REORG/MINOR: connection: move declaration to its own include file
    - REORG/MINOR: checks: put a struct connection into the server
    - MINOR: connection: add flags to the connection struct
    - MAJOR: get rid of fdtab[].state and use connection->flags instead
    - MINOR: fd: add a new I/O handler to fdtab
    - MEDIUM: polling: prepare to call the iocb() function when defined.
    - MEDIUM: checks: make use of fdtab->iocb instead of cb[]
    - MEDIUM: protocols: use the generic I/O callback for accept callbacks
    - MINOR: connection: add a handler for fd-based connections
    - MAJOR: connection: replace direct I/O callbacks with the connection callback
    - MINOR: fd: make fdtab->owner a connection and not a stream_interface anymore
    - MEDIUM: connection: remove the FD_POLL_* flags only once
    - MEDIUM: connection: extract the send_proxy callback from proto_tcp
    - MAJOR: tcp: remove the specific I/O callbacks for TCP connection probes
    - CLEANUP: remove the now unused fdtab direct I/O callbacks
    - MAJOR: remove the stream interface and task management code from sock_*
    - MEDIUM: stream_interface: pass connection instead of fd in sock_ops
    - MEDIUM: stream_interface: centralize the SI_FL_ERR management
    - MAJOR: connection: add a new CO_FL_CONNECTED flag
    - MINOR: rearrange tcp_connect_probe() and fix wrong return codes
    - MAJOR: connection: call data layer handshakes from the handler
    - MEDIUM: fd: remove the EV_FD_COND_* primitives
    - MINOR: sock_raw: move calls to si_data_close upper
    - REORG: connection: replace si_data_close() with conn_data_close()
    - MEDIUM: sock_raw: introduce a read0 callback that is different from shutr
    - MAJOR: stream_int: use a common stream_int_shut*() functions regardless of the data layer
    - MAJOR: fd: replace all EV_FD_* macros with new fd_*_* inline calls
    - MEDIUM: fd: add fd_poll_{recv,send} for use when explicit polling is required
    - MEDIUM: connection: add definitions for dual polling mechanisms
    - MEDIUM: connection: make use of the new polling functions
    - MAJOR: make use of conn_{data|sock}_{poll|stop|want}* in connection handlers
    - MEDIUM: checks: don't use FD_WAIT_* anymore
    - MINOR: fd: get rid of FD_WAIT_*
    - MEDIUM: stream_interface: offer a generic function for connection updates
    - MEDIUM: stream-interface: offer a generic chk_rcv function for connections
    - MEDIUM: stream-interface: add a snd_buf() callback to sock_ops
    - MEDIUM: stream-interface: provide a generic stream_int_chk_snd_conn() function
    - MEDIUM: stream-interface: provide a generic si_conn_send_cb callback
    - MEDIUM: stream-interface: provide a generic stream_sock_read0() function
    - REORG/MAJOR: use "struct channel" instead of "struct buffer"
    - REORG/MAJOR: extract "struct buffer" from "struct channel"
    - MINOR: connection: provide conn_{data|sock}_{read0|shutw} functions
    - REORG: sock_raw: rename the files raw_sock*
    - MAJOR: raw_sock: extract raw_sock_to_buf() from raw_sock_read()
    - MAJOR: raw_sock: temporarily disable splicing
    - MINOR: stream-interface: add an rcv_buf callback to sock_ops
    - REORG: stream-interface: move sock_raw_read() to si_conn_recv_cb()
    - MAJOR: connection: split the send call into connection and stream interface
    - MAJOR: stream-interface: restore splicing mechanism
    - MAJOR: stream-interface: make conn_notify_si() more robust
    - MEDIUM: proxy-proto: don't use buffer flags in conn_si_send_proxy()
    - MAJOR: stream-interface: don't commit polling changes in every callback
    - MAJOR: stream-interface: fix splice not to call chk_snd by itself
    - MEDIUM: stream-interface: don't remove WAIT_DATA when a handshake is in progress
    - CLEANUP: connection: split sock_ops into data_ops, app_cp and si_ops
    - REORG: buffers: split buffers into chunk,buffer,channel
    - MAJOR: channel: remove the BF_OUT_EMPTY flag
    - REORG: buffer: move buffer_flush, b_adv and b_rew to buffer.h
    - MINOR: channel: rename bi_full to channel_full as it checks the whole channel
    - MINOR: buffer: provide a new buffer_full() function
    - MAJOR: channel: stop relying on BF_FULL to take action
    - MAJOR: channel: remove the BF_FULL flag
    - REORG: channel: move buffer_{replace,insert_line}* to buffer.{c,h}
    - CLEANUP: channel: usr CF_/CHN_ prefixes instead of BF_/BUF_
    - CLEANUP: channel: use "channel" instead of "buffer" in function names
    - REORG: connection: move the target pointer from si to connection
    - MAJOR: connection: move the addr field from the stream_interface
    - MEDIUM: stream_interface: remove CAP_SPLTCP/CAP_SPLICE flags
    - MEDIUM: proto_tcp: remove any dependence on stream_interface
    - MINOR: tcp: replace tcp_src_to_stktable_key with addr_to_stktable_key
    - MEDIUM: connection: add an ->init function to data layer
    - MAJOR: session: introduce embryonic sessions
    - MAJOR: connection: make the PROXY decoder a handshake handler
    - CLEANUP: frontend: remove the old proxy protocol decoder
    - MAJOR: connection: rearrange the polling flags.
    - MEDIUM: connection: only call tcp_connect_probe when nothing was attempted yet
    - MEDIUM: connection: complete the polling cleanups
    - MEDIUM: connection: avoid calling handshakes when polling is required
    - MAJOR: stream_interface: continue to update data polling flags during handshakes
    - CLEANUP: fd: remove fdtab->flags
    - CLEANUP: fdtab: flatten the struct and merge the spec struct with the rest
    - CLEANUP: includes: fix includes for a number of users of fd.h
    - MINOR: ssl: disable TCP quick-ack by default on SSL listeners
    - MEDIUM: config: add a "ciphers" keyword to set SSL cipher suites
    - MEDIUM: config: add "nosslv3" and "notlsv1" on bind and server lines
    - BUG: ssl: mark the connection as waiting for an SSL connection during the handshake
    - BUILD: http: rename error_message http_error_message to fix conflicts on RHEL
    - BUILD: ssl: fix shctx build on RHEL with futex
    - BUILD: include sys/socket.h to fix build failure on FreeBSD
    - BUILD: fix build error without SSL (ssl_cert)
    - BUILD: ssl: use MAP_ANON instead of MAP_ANONYMOUS
    - BUG/MEDIUM: workaround an eglibc bug which truncates the pidfiles when nbproc > 1
    - MEDIUM: config: support per-listener backlog and maxconn
    - MINOR: session: do not send an HTTP/500 error on SSL sockets
    - MEDIUM: config: implement maxsslconn in the global section
    - BUG: tcp: close socket fd upon connect error
    - MEDIUM: connection: improve error handling around the data layer
    - MINOR: config: make the tasks "nice" value configurable on "bind" lines.
    - BUILD: shut a gcc warning introduced by commit 269ab31
    - MEDIUM: config: centralize handling of SSL config per bind line
    - BUILD: makefile: report USE_OPENSSL status in build options
    - BUILD: report openssl build settings in haproxy -vv
    - MEDIUM: ssl: add sample fetches for is_ssl, ssl_has_sni, ssl_sni_*
    - DOC: add a special acknowledgement for the stud project
    - DOC: add missing SSL options for servers and listeners
    - BUILD: automatically add -lcrypto for SSL
    - DOC: add some info about openssl build in the README