BUG/MEDIUM: Consistently use 'check' in process_chk

I am not entirely sure that this is a bug, but it seems
to me that it may cause a problem if there agent-check is
configured and there is some kind of error making a connection for it.

Signed-off-by: Simon Horman <horms@verge.net.au>
(cherry picked from commit ccaabcdfca23851af6fd83f4f3265284d283e2ab)
BUG/MINOR: ssl: rejects OCSP response without nextupdate.

To cache an OCSP Response without expiration time is not safe.
(cherry picked from commit 13a6b48e241c0a50b501446992ab4fda2529f317)
BUG/MEDIUM: ssl: Fix to not serve expired OCSP responses.

For some browsers (firefox), an expired OCSP Response causes unwanted behavior.

Haproxy stops serving OCSP response if nextupdate date minus
the supported time skew (#define OCSP_MAX_RESPONSE_TIME_SKEW) is
in the past.
(cherry picked from commit 4f3c87a5d942d4d0649c35805ff4e335970b87d4)
BUG/MINOR: ssl: Fix OCSP resp update fails with the same certificate configured twice.
(cherry picked from commit 1d3865b096b43b9a6d6a564ffb424ffa6f1ef79f)
BUG/MAJOR: session: revert all the crappy client-side timeout changes

This is the 3rd regression caused by the changes below. The latest to
date was reported by Finn Arne Gangstad. If a server responds with no
content-length and the client's FIN is never received, either we leak
the client-side FD or we spin at 100% CPU if timeout client-fin is set.

Enough is enough. The amount of tricks needed to cover these side-effects
starts to look like used toilet paper stacked over a chocolate cake. I
don't want to eat that cake anymore!

All this to avoid reporting a server-side timeout when a client stops
uploading data and haproxy expires faster than the server... A lot of
"ifs" resulting in a technically valid log that doesn't always please
users, and whose alternative causes that many issues for all others
users.

So let's revert this crap merged since 1.5-dev25 :
  Revert "CLEANUP: http: don't clear CF_READ_NOEXP twice"
    This reverts commit 1592d1e72a4a2d25a554c299ae95a3e6cad80bf1.
  Revert "BUG/MEDIUM: http: clear CF_READ_NOEXP when preparing a new transaction"
    This reverts commit 77d29029af1c44216b190dd7442964b9d8f45257.
  Revert "BUG/MEDIUM: session: don't clear CF_READ_NOEXP if analysers are not called"
    This reverts commit 0943757a2144761c60e416b5ed07baa76934f5a4.
  Revert "BUG/MEDIUM: http: disable server-side expiration until client has sent the body"
    This reverts commit 3bed5e9337fd6eeab0f0006ebefcbe98ee5c4f9f.
  Revert "BUG/MEDIUM: http: correctly report request body timeouts"
    This reverts commit b9edf8fbecc9d1b5c82794735adcc367a80a4ae2.
  Revert "BUG/MEDIUM: http/session: disable client-side expiration only after body"
    This reverts commit b1982e27aaff2a92a389a9f1bc847e3bb8fdb4f2.

If a cleaner AND SAFER way to do something equivalent in 1.6-dev, we *might*
consider backporting it to 1.5, but given the vicious bugs that have surfaced
since, I doubt it will happen any time soon.

Fortunately, that crap never made it into 1.4 so no backport is needed.
(cherry picked from commit 6f0a7bac282c9b2082dc763977b7721b6b002089)
BUG/MINOR: logs: properly initialize and count log sockets

Commit 81ae195 ("[MEDIUM] add support for logging via a UNIX socket")
merged in 1.3.14 introduced a few minor issues with log sockets. All
of them happen only when a failure is encountered when trying to set
up the logging socket (eg: socket family is not available or is
temporarily short in resources).

The first socket which experiences an error causes the socket setup
loop to abort, possibly preventing any log from being sent if it was
the first logger. The second issue is that if this socket finally
succeeds after a second attempt, errors are reported for the wrong
logger (eg: logger #1 failed instead of #2).  The last point is that
we now have multiple loggers, and it's a waste of time to walk over
their list for every log while they're almost always properly set up.

So in order to fix all this, let's merge the two lists. If a logger
experiences an error, it simply sends an alert and skips to the next
one. That way they don't prevent messages from being sent and are
all properly accounted for.
(cherry picked from commit c7c7be21bf6c7e9afd897d4bf451dc450187a77e)
BUG/MINOR: config: http-request replace-header arg typo

http-request replace-header was introduced with a typo which prevents it
to be conditionned by an ACL.
This patch fixes this issue.
(cherry picked from commit 92df370621b6e1286ef273310ad47371456a5cf0)
[RELEASE] Released version 1.5.1

Released version 1.5.1 with the following main changes :
    - BUG/MINOR: config: http-request replace-header arg typo
    - BUG/MINOR: ssl: rejects OCSP response without nextupdate.
    - BUG/MEDIUM: ssl: Fix to not serve expired OCSP responses.
    - BUG/MINOR: ssl: Fix OCSP resp update fails with the same certificate configured twice.     (cherry picked from commit 1d3865b096b43b9a6d6a564ffb424ffa6f1ef79f)
    - BUG/MEDIUM: Consistently use 'check' in process_chk
    - BUG/MAJOR: session: revert all the crappy client-side timeout changes
    - BUG/MINOR: logs: properly initialize and count log sockets
BUG/MEDIUM: http: fetch "base" is not compatible with set-header

The sample fetch function "base" makes use of the trash which is also
used by set-header/add-header etc... everything which builds a formated
line. So we end up with some junk in the header if base is in use. Let's
fix this as all other fetches by using a trash chunk instead.

This bug was reported by Baptiste Assmann, and also affects 1.5.
(cherry picked from commit 3caf2afabe89fb0ef0886cd1d8ea99ef21ec3491)
BUG/MINOR: ssl: Fix external function in order not to return a pointer on an internal trash buffer.

'ssl_sock_get_common_name' applied to a connection was also renamed
'ssl_sock_get_remote_common_name'. Currently, this function is only used
with protocol PROXYv2 to retrieve the client certificate's common name.
A further usage could be to retrieve the server certificate's common name
on an outgoing connection.
(cherry picked from commit 0abf836ecb32767fa1f9ad598f3e236e073491bd)
BUG/MINOR: counters: do not untrack counters before logging

Baptiste Assmann reported a corner case in the releasing of stick-counters:
we release content-aware counters before logging. In the past it was not a
problem, but since now we can log them it, it prevents one from logging
their value. Simply switching the log production and the release of the
counter fixes the issue.

This should be backported into 1.5.
(cherry picked from commit d713bcc326da5d1ac80adab666d7710f3e37650c)
BUG/MAJOR: sample: correctly reinitialize sample fetch context before calling sample_process()

We used to only clear flags when reusing the static sample before calling
sample_process(), but that's not enough because there's a context in samples
that can be used by some fetch functions such as auth, headers and cookies,
and not reinitializing it risks that a pointer of a different type is used
in the wrong context.

An example configuration which triggers the case consists in mixing hdr()
and http_auth_group() which both make use of contexts :

     http-request add-header foo2 %[hdr(host)],%[http_auth_group(foo)]

The solution is simple, initialize all the sample and not just the flags.
This fix must be backported into 1.5 since it was introduced in 1.5-dev19.
(cherry picked from commit 6c616e0b96106dd33d183afbda31e72799e967c3)
MINOR: stick-table: make stktable_fetch_key() indicate why it failed

stktable_fetch_key() does not indicate whether it returns NULL because
the input sample was not found or because it's unstable. It causes trouble
with track-sc* rules. Just like with sample_fetch_string(), we want it to
be able to give more information to the caller about what it found. Thus,
now we use the pointer to a sample passed by the caller, and fill it with
the information we have about the sample. That way, even if we return NULL,
the caller has the ability to check whether a sample was found and if it is
still changing or not.
(cherry picked from commit b5975defba61e7ef37ae771614166d0970ede04e)
BUG/MEDIUM: counters: fix track-sc* to wait on unstable contents

I've been facing multiple configurations which involved track-sc* rules
in tcp-request content without the "if ..." to force it to wait for the
contents, resulting in random behaviour with contents sometimes retrieved
and sometimes not.

Reading the doc doesn't make it clear either that the tracking will be
performed only if data are already there and that waiting on an ACL is
the only way to avoid this.

Since this behaviour is not natural and we now have the ability to fix
it, this patch ensures that if input data are still moving, instead of
silently dropping them, we naturally wait for them to stabilize up to
the inspect-delay. This way it's not needed anymore to implement an
ACL-based condition to force to wait for data, eventhough the behaviour
is not changed for when an ACL is present.

The most obvious usage will be when track-sc is followed by any HTTP
sample expression, there's no need anymore for adding "if HTTP".

It's probably worth backporting this to 1.5 to avoid further configuration
issues. Note that it requires previous patch.
(cherry picked from commit 1b71eb581ec1637879f725421efb95ad69f0ea4f)
BUILD: remove TODO from the spec file and add README

This used to cause a build failure since 1.5.0, as reported by
Timothy Shelton. The proxy protocol doc was also added.
(cherry picked from commit ca3094d0b1531ce62fc1970aa7396a01330bb5c1)
MINOR: log: make MAX_SYSLOG_LEN overridable at build time

This value was set in log.h without any #ifndef around, so when one
wanted to change it, a patch was needed. Let's move it to defaults.h
with the usual #ifndef so that it's easier to change it.
(cherry picked from commit 4e957907aa117c07214ab84ba2a58f2fc1666931)
MEDIUM: log: support a user-configurable max log line length

With all the goodies supported by logformat, people find that the limit
of 1024 chars for log lines is too short. Some servers do not support
larger lines and can simply drop them, so changing the default value is
not always the best choice.

This patch takes a different approach. Log line length is specified per
log server on the "log" line, with a value between 80 and 65535. That
way it's possibly to satisfy all needs, even with some fat local servers
and small remote ones.
(cherry picked from commit 18324f574f349d510622ff45635de899437a3a11)
MINOR: stats: fix minor typo in HTML page

There is a very small typo in the statistics interface: a "set" in
lowercase where allothers are uppercase "Set".
(cherry picked from commit 8c27bcaea0116247ee055c5481a63507de4fe6e4)
BUG/MEDIUM: unix: do not unlink() abstract namespace sockets upon failure.

When bind() fails (function uxst_bind_listener()), the fail path doesn't
consider the abstract namespace and tries to unlink paths held in
uninitiliazed memory (tempname and backname). See the strace excerpt;
the strings still hold the path from test1.

===============================================================================================
23722 bind(5, {sa_family=AF_FILE, path=@"test2"}, 110) = -1 EADDRINUSE (Address already in use)
23722 unlink("/tmp/test1.sock.23722.tmp") = -1 ENOENT (No such file or directory)
23722 close(5)                          = 0
23722 unlink("/tmp/test1.sock.23722.bak") = -1 ENOENT (No such file or directory)
===============================================================================================

This patch should be backported to 1.5.
(cherry picked from commit 7319b64fc4c9b7e04726816c6cc02f6ecf66a0a4)
DOC: provide an example of how to use ssl_c_sha1

As suggested by Aydan Yumerefendi, a little bit of examples never hurts.
(cherry picked from commit 2d0caa38e040b081903e50faa56bae52599b3949)