MEDIUM: ssl: fix detection of ephemeral diffie-hellman key exchange by using the cipher description.

In OpenSSL, the name of a cipher using ephemeral diffie-hellman for key
 exchange can start with EDH, but also DHE, EXP-EDH or EXP1024-DHE.
We work around this issue by using the cipher's description instead of
the cipher's name.
Hopefully the description is less likely to change in the future.
DOC: fix remaining occurrences of "pattern extraction"
MINOR: log: allow the HTTP status code to be logged even in TCP frontends

Log format is defined in the frontend, and some frontends may be chained to
an HTTP backend. Sometimes it's very convenient to be able to log the HTTP
status code of these HTTP backends. This status is definitely present in
the internal structures, it's just that we used to limit it to be used in
HTTP frontends. So let's simply relax the check to allow it to be used in
TCP frontends as well.
MINOR: logs: don't limit HTTP header captures to HTTP frontends

Similar to previous patches, HTTP header captures are performed when
a TCP frontend switches to an HTTP backend, but are not possible to
report. So let's relax the check to explicitly allow them to be present
in TCP frontends.
MINOR: sample: improve sample_fetch_string() to report partial contents

Currently, all callers to sample_fetch_string() call it with SMP_OPT_FINAL.
Now we improve it to support the case where this option is not set, and to
make it return the original sample as-is. The purpose is to let the caller
check the SMP_F_MAY_CHANGE flag in the result and know that it should wait
to get complete contents. Currently this has no effect on existing code.
MINOR: capture: extend the captures to support non-header keys

This patch adds support for captures with no header name. The purpose
is to allow extra captures to be defined and logged along with the
header captures.
MINOR: tcp: prepare support for the "capture" action

A few minor entries will be needed to capture sample fetches in requests
or responses. This patch just prepares the code for this.
MEDIUM: tcp: add a new tcp-request capture directive

This new directive captures the specified fetch expression, converts
it to text and puts it into the next capture slot. The capture slots
are shared with header captures so that it is possible to dump all
captures at once or selectively in logs and header processing.

The purpose is to permit logs to contain whatever payload is found in
a request, for example bytes at a fixed location or the SNI of forwarded
SSL traffic.
MEDIUM: session: allow shorter retry delay if timeout connect is small

As discussed with Dmitry Sivachenko, the default 1-second connect retry
delay can be large for situations where the connect timeout is much smaller,
because it means that an active connection reject will take more time to be
retried than a silent drop, and that does not make sense.

This patch changes this so that the retry delay is the minimum of 1 second
and the connect timeout. That way people running with sub-second connect
timeout will benefit from the shorter reconnect.
MEDIUM: session: don't apply the retry delay when redispatching

The retry delay is only useful when sticking to a same server. During
a redispatch, it's useless and counter-productive if we're sure to
switch to another server, which is almost guaranteed when there's
more than one server and the balancing algorithm is round robin, so
better not pass via the turn-around state in this case. It could be
done as well for leastconn, but there's a risk of always killing the
delay after the recovery of a server in a farm where it's almost
guaranteed to take most incoming traffic. So better only kill the
delay when using round robin.
MEDIUM: session: redispatch earlier when possible

As discussed with Dmitry Sivachenko, is a server farm has more than one
active server, uses a guaranteed non-determinist algorithm (round robin),
and a connection was initiated from a non-persistent connection, there's
no point insisting to reconnect to the same server after a connect failure,
better redispatch upon the very first retry instead of insisting on the same
server multiple times.
MINOR: config: warn when tcp-check rules are used without option tcp-check

Since this case means that the rules will be ignored, better emit a warning.
MEDIUM: Break out check establishment into connect_chk()

This is in preparation for adding a new type of check that
uses a process rather than a socket.

Signed-off-by: Simon Horman <horms@verge.net.au>
BUG/MINOR: connection: make proxy protocol v1 support the UNKNOWN protocol

If haproxy receives a connection over a unix socket and forwards it to
another haproxy instance using proxy protocol v1, it sends an UNKNOWN
protocol, which is rejected by the other side. Make the receiver accept
the UNKNOWN protocol as per the spec, and only use the local connection's
address for this.
DOC: proxy protocol example parser was still wrong

Now that version and cmd are in the same byte, it is not possible
anymore to compare the version as a 13th byte.
DOC: minor updates to the proxy protocol doc

Update the release data, revision history and the link to the Forwarded
HTTP extension.
CLEANUP: connection: merge proxy proto v2 header and address block

This is in order to simplify the PPv2 header parsing code to look more
like the one provided as an example in the spec. No code change was
performed beyond just merging the proxy_addr union into the proxy_hdr_v2
struct.
MEDIUM: connection: add support for proxy protocol v2 in accept-proxy

The "accept-proxy" statement of bind lines was still limited to version
1 of the protocol, while send-proxy-v2 is now available on the server
lines. This patch adds support for parsing v2 of the protocol on incoming
connections. The v2 header is automatically recognized so there is no
need for a new option.
MEDIUM: Add port_to_str helper

This helper is similar to addr_to_str but
tries to convert the port rather than the address
of a struct sockaddr_storage.

This is in preparation for supporting
an external agent check.

Signed-off-by: Simon Horman <horms@verge.net.au>
MINOR: regex: fix a little configuration memory leak.

The function regfree free the memory allocated to the pattern buffer by
the compiling process. It is not freeing the buffer itself.