BUG/MEDIUM: fix broken send_proxy on FreeBSD

David Berard reported that send-proxy was broken on FreeBSD and tracked the
issue to be an error returned by send(). We already had the same issue in
the past in another area which was addressed by the following commit :

   0ea0cf6 BUG: raw_sock: also consider ENOTCONN in addition to EAGAIN

In fact, on Linux send() returns EAGAIN when the connection is not yet
established while other OSes return ENOTCONN. Let's consider ENOTCONN for
send-proxy there as the same as EAGAIN.

David confirmed that this change properly fixed the issue.

Another place was affected as well (health checks with send-proxy), and
was fixed.

This fix does not need any backport since it only affects 1.5.
MEDIUM: stick-tables: flush old entries upon soft-stop

When a process with large stick tables is replaced by a new one and remains
present until the last connection finishes, it keeps these data in memory
for nothing since they will never be used anymore by incoming connections,
except during syncing with the new process. This is especially problematic
when dealing with long session protocols such as WebSocket as it becomes
possible to stack many processes and eat a lot of memory.

So the idea here is to know if a table still needs to be synced or not,
and to purge all unused entries once the sync is complete. This means that
after a few hundred milliseconds when everything has been synchronized with
the new process, only a few entries will remain allocated (only the ones
held by sessions during the restart) and all the remaining memory will be
freed.

Note that we carefully do that only after the grace period is expired so as
not to impact a possible proxy that needs to accept a few more connections
before leaving.

Doing this required to add a sync counter to the stick tables, to know how
many peer sync sessions are still in progress in order not to flush the entries
until all synchronizations are completed.
MINOR: tcp: add new "close" action for tcp-response

This new action immediately closes the connection with the server
when the condition is met. The first such rule executed ends the
rules evaluation. The main purpose of this action is to force a
connection to be finished between a client and a server after an
exchange when the application protocol expects some long time outs
to elapse first. The goal is to eliminate idle connections which
take signifiant resources on servers with certain protocols.
MINOR: payload: provide the "res.len" fetch method

This fetch method returns the response buffer len, similarly
to req.len for the request. Previously it was only possible
to rely on "res.payload(0,size) -m found" to find if at least
that amount of data was available, which was a bit tricky.
BUILD: add SSL_INC/SSL_LIB variables to force the path to openssl

When trying to build with various versions of openssl, forcing the
path is still cumbersome. Let's add SSL_INC and SSL_LIB similar to
PCRE_INC and PCRE_LIB to allow forcing the path to the SSL includes
and libs.
BUG/MEDIUM: ssl: potential memory leak using verifyhost

If server certificate presents dns aliases, a memory leak appears
on health checks when 'verifyhost' statement is used.
BUILD: ssl: compilation issue with openssl v0.9.6.

Failed to compile with openssl 0.9.6 since the 'verifyhost' feature.
BUG/MINOR: fix forcing fastinter in "on-error"

health_adjust() should requeue the task after changing its expire timer.

I noticed it on devel servers without load. We have long inter (10 seconds)
and short fasinter (100ms). But according to webserver logs, after a failed
request next check request was called with same 10s interval.

This patch should probably be backported to 1.4 which has the same feature.
MINOR: http: compute response time before processing headers

At the moment, HTTP response time is computed after response headers are
processed. This can misleadingly assign to the server some heavy local
processing (eg: regex), and also prevents response headers from passing
information related to the response time (which can sometimes be useful
for stats).

Let's retrieve the reponse time before processing the headers instead.

Note that in order to remain compatible with what was previously done,
we disable the response time when we get a 502 or any bad response. This
should probably be changed in 1.6 since it does not make sense anymore
to lose this information.
BUG/MINOR: acl: fix improper string size assignment in proxy argument

This minor bug was found using the coccinelle script "da.cocci". The
len was initialized twice instead of setting the size. It's harmless
since no operations are performed on this empty string but needs to
be fixed anyway.
DOC: add missing options to the manpage

Document -L, -v(v), -C, -dS and -dM, as they were missing from the manpage.

Signed-off-by: Apollon Oikonomopoulos <apoikos@gmail.com>
DOC: add manpage references to all system calls

Add a man section to every system call reference, giving users pointers to the
respective manpages.

Signed-off-by: Apollon Oikonomopoulos <apoikos@gmail.com>
DOC: update manpage reference to haproxy-en.txt

The manpage refers to haproxy-en.txt, which is obsolete. Update the reference
to point to configuration.txt, together with the location on Debian systems.

Also capitalize "Debian".

Signed-off-by: Apollon Oikonomopoulos <apoikos@gmail.com>
DOC: remove -s and -l options from the manpage

These options are no longer supported since 1.3, so remove them from the
manpage.

Signed-off-by: Apollon Oikonomopoulos <apoikos@gmail.com>
DOC: ssl: update build instructions to use new SSL_* variables

Since commit 9a05945bd ("BUILD: add SSL_INC/SSL_LIB variables to force the
path to openssl") we have SSL_INC and SSL_LIB to point to the libssl
installation.

This commits updates the build instructions in README accordingly.
DOC: fix typo in comments

Hi Willy,

There is a patch to fix typo in comments, please check the attachment
for you information.

The commit log is as below:

commit 9824d1b3740ac2746894f1aa611c795366c84210
Author: Godbach <nylzhaowei@gmail.com>
Date:   Mon Sep 30 11:05:42 2013 +0800

    DOC: fix typo in comments

      0x20000000 -> 0x40000000
      vuf -> buf
      ethod -> Method

    Signed-off-by: Godbach <nylzhaowei@gmail.com>

--
Best Regards,
Godbach

From 9824d1b3740ac2746894f1aa611c795366c84210 Mon Sep 17 00:00:00 2001
From: Godbach <nylzhaowei@gmail.com>
Date: Mon, 30 Sep 2013 11:05:42 +0800
Subject: [PATCH] DOC: fix typo in comments

  0x20000000 -> 0x40000000
  vuf -> buf
  ethod -> Method

Signed-off-by: Godbach <nylzhaowei@gmail.com>
BUG/MINOR: deinit: free server map which is allocated in init_server_map()

Both static-rr and hash with type map-based call init_server_map() to allocate
server map, so the server map should be freed while doing cleanup if one of
the above load balance algorithms is used.

Signed-off-by: Godbach <nylzhaowei@gmail.com>
[wt: removed the unneeded "if" before the free]
BUG/MINOR: ssl: potential memory leaks using ssl_c_key_alg or ssl_c_sig_alg.

The leak occurs in an error case which practically never happens.
MINOR: ssl: optimization of verifyhost on wildcard certificates.

Optimizes verifyhost on wildcard certificates avoiding travel several times
the same string.
BUG/MINOR: ssl: verifyhost does not match empty strings on wildcard.

RFC6125 does not specify if wildcard matches empty strings but
classical browsers implementations does.
After the fix foo*bar.exemple.om matches foobar.exemple.com.