MINOR: stats: show soft-stopped servers in different color

A "soft-stopped" server (weight 0) can be missed easily in the
webinterface. Fix this by using a specific class (and color).

Signed-off-by: Lukas Tribus <luky-37@hotmail.com>
BUG/MEDIUM: stats: allocate the stats frontend also on "stats bind-process"

Bryan Talbot reported that a config with only "stats bind-process 1" in
the global section would crash during parsing. This bug was introduced
with this new statement in 1.5-dev13. The stats frontend must be allocated
if it was not yet.

No backport is needed. The workaround consists in having previously declared
any other stats keyword (generally stats socket).
MINOR: compression: acl "res.comp" and fetch "res.comp_algo"

Implements the "res.comp" ACL which is a boolean returning 1 when a
response has been compressed by HAProxy or 0 otherwise.

Implements the "res.comp_algo" fetch which contains the name of the
algorithm HAProxy used to compress the response.
BUG/MEDIUM: stats: fix a regression when dealing with POST requests

In 1.5-dev17 (commit 1facd6d6), we reorganized the way HTTP stats
requests are handled. When moving the code, we dropped a "return 0"
which happens upon incomplete POST request, so we now end up with
the next return 1 which causes processing to go on with next
analyser. This causes incomplete POST requests to try to forward
the request to servers, resulting in either a 404 or a 503 depending
on the configuration.

This patch fixes this regression to restore the previous behaviour.
It's not enough though, as it happens that the stats code is handled
after all http header processing but in the same function. The net
effect is that incomplete requests cause the headers manipulation to
be performed multiple times, possibly resulting in multiple headers
in the request buffer. Since the stats requests are not meant to be
forwarded, it's not an issue yet but this is something to take care
of later.

A remaining issue that's not handled yet is that if the client does
not send the complete POST headers, then the request is finally
forwarded. This is not a regression, it has always been there and
seems to be caused by the lack of timeout processing when waiting
for the POST body. The solution to this issue would be to move the
handling of stats requests into a dedicated analyser placed after
http_process_request_body().

Bug reported by Guillaume de Lafond.
BUG/MEDIUM: Fix crt-list file parsing error: filtered name was ignored.

Also add support for multiple filtered names on same certificate (per line).
BUG/MINOR: fix unterminated ACL array in compression

Recent commit 727db8b4 was lacking a NULL ACL descriptor to terminate
the array, causing a random behaviour upon startup. No backport is needed.
BUG/MINOR: config: "source" does not work in defaults section

Source function will not work with the following line in default section:
     source 0.0.0.0 usesrc clientip
even that related settings by iptables and ip rule have been set correctly.
But it can work well in backend setcion.

The reason is that the operation in line 1815 in cfgparse.c as below:
     curproxy->conn_src.opts = defproxy.conn_src.opts & ~CO_SRC_TPROXY_MASK;

clears three low bits of conn_src.opts which stores the configuration of
'usesrc'. Without correct bits set, the source address function can not
work well. They should be copied to the backend proxy without being modified.

Since conn_src.tproxy_addr had not copied from defproxy to backend proxy
while initializing backend proxy, source function will not work well
with explicit source address set in default section either.

Signed-off-by: Godbach <nylzhaowei@gmail.com>

Note: the bug was introduced in 1.5-dev16 with commit ef9a3605
BUILD: last fix broke non-linux platforms

src.tproxy_addr only exists on linux.
BUG/MEDIUM: ssl: EDH ciphers are not usable if no DH parameters present in pem file.

Uses default defined DH parameters when none present in pem file.
MINOR: init: indicate the SSL runtime version on -vv.

It happens that openssl's API can differ between versions, causing some
serious trouble if the version used at runtime is not the same as used
for building.

Now we report the two versions separately along with a warning if the
version differs (except the patch version).
BUG/MEDIUM: shctx: makes the code independent on SSL runtime version.

struct SSL(ssl_st) defintion changed between openssl versions and must not be dereferenced.
BUG/MEDIUM: compression: the deflate algorithm must use global settings as well

Global compression settings (windowsize and memlevel) were only considered
for the gzip algorithm but not the deflate algorithm. Since a single allocator
is used for both algos, if gzip was first initialized the memory with parameters
smaller than default, then initializing deflate after with default settings
would result in overusing the small allocated areas.

To fix this, we make use of deflateInit2() for deflate_init() as well.

Thanks to Godbach for reporting this bug, introduced by in 1.5-dev13 by commit
8b52bb38. No backport is needed.
BUILD: stdbool is not portable (again)

Another build issue on Solaris without c99. Please don't use stdbool.
DOC: readme: add a small reminder about restrictions to respect in the code

For code portability, we need to respect a few restrictions (mainly no C99 etc).
MINOR: ebtree: add new eb_next_dup/eb_prev_dup() functions to visit duplicates

Sometimes it's very useful to visit duplicates of a same node, but doing
so from the application is not convenient because keys have to be compared,
while all the information is available during the next/prev steps.

Let's introduce a couple of new eb_next_dup/eb_prev_dup functions to visit
only duplicates of the current node and return NULL once it's done. Now we
have all 3 combinations :
  - next        : returns next node in the tree
  - next_dup    : returns next dup in the sub-tree
  - next_unique : returns next value after skipping dups

(cherry picked from commit 3327b8ae6866f3878322a1a29e70b450226d216d)
MEDIUM: ssl: improve crt-list format to support negation

Improve the crt-list file format to allow a rule to negate a certain SNI :

        <crtfile> [[!]<snifilter> ...]

This can be useful when a domain supports a wildcard but you don't want to
deliver the wildcard cert for certain specific domains.
BUG/MINOR: acl: fix a double free during exit when using PCRE_JIT

When freeing ACL regex, we don't want to perform the free() in regex_free()
as it's already performed in free_pattern(). The double free only happens
when using PCRE_JIT when freeing everything during exit so it's harmless
but exhibits libc errors during a reload/restart.

Bug reported by Seri.
REORG: tproxy: prepare the transparent proxy defines for accepting other OSes

This patch does not change the logic of the code, it only changes the
way OS-specific defines are tested.

At the moment the transparent proxy code heavily depends on Linux-specific
defines. This first patch introduces a new define "CONFIG_HAP_TRANSPARENT"
which is set every time the defines used by transparent proxy are present.
This also means that with an up-to-date libc, it should not be necessary
anymore to force CONFIG_HAP_LINUX_TPROXY during the build, as the flags
will automatically be detected.

The CTTPROXY flags still remain separate because this older API doesn't
work the same way.

A new line has been added in the version output for haproxy -vv to indicate
what transparent proxy support is available.
MINOR: tproxy: add support for FreeBSD

FreeBSD uses (IPPROTO_IP, IP_BINDANY) and (IPPROTO_IPV6, IPV6_BINDANY)
to enable transparent proxy on a socket.

This patch adds support for the relevant setsockopt() calls.
MINOR: tproxy: add support for OpenBSD

OpenBSD uses (SOL_SOCKET, SO_BINDANY) to enable transparent
proxy on a socket.

This patch adds support for the relevant setsockopt() calls.