BUILD: adjust makefile for AIX 5.1

AIX 5.1 has trouble with ss_family which is __ss_family there.
Just remap it in the makefile and provide a new target.
BUG/MEDIUM: pattern: fix wrong definition of the pat_prune_fcts array

Commit 6f7203d ("MEDIUM: pattern: add prune function") introduced an
array of functions pat_prune_fcts[] but unfortunately declared it in
pattern.h without marking it "extern", resulting in each file including
it having its own copy.
CLEANUP: pattern: move array definitions to proto/ and not types/

All symbol definitions should be in proto/ and not types/.
BUG/MINOR: reject malformed HTTP/0.9 requests

RFC 1945 (§4.1) defines an HTTP/0.9 request ("Simple-Request") as:

  Simple-Request  = "GET" SP Request-URI CRLF

HAProxy tries to automatically upgrade HTTP/0.9 requests to
to HTTP/1.0, by appending "HTTP/1.0" to the request and setting the
Request-URI to "/" if it was not present. The latter however is
RFC-incompatible, as HTTP/0.9 requests must already have a Request-URI
according to the definition above. Additionally,
http_upgrade_v09_to_v10() does not check whether the request method is
indeed GET (the mandatory method for HTTP/0.9).

As a result, any single- or double-word request line is regarded as a
valid HTTP request. We fix this by failing in http_upgrade_v09_to_v10()
if the request method is not GET or the request URI is not present.
BUG/MAJOR: counters: check for null-deref when looking up an alternate table

Constructions such as sc0_get_gpc0(foo) allow to look up the same key as
the current key but in an alternate table. A check was missing to ensure
we already have a key, resulting in a crash if this lookup is performed
before the associated track-sc rule.

This bug was reported on the mailing list by Neil@iamafreeman and
narrowed down further by Lukas Tribus and Thierry Fournier.

This bug was introduced in 1.5-dev20 by commit "0f791d4 MEDIUM: counters:
support looking up a key in an alternate table".
MINOR: ssl: add ssl_fc_unique_id to fetch TLS Unique ID

The TLS unique id, or unique channel binding, is a byte string that can be
pulled from a TLS connection and it is unique to that connection. It is
defined in RFC 5929 section 3.  The value is used by various upper layer
protocols as part of an extra layer of security.  For example XMPP
(RFC 6120) and EST (RFC 7030).

Add the ssl_fc_unique_id keyword and corresponding sample fetch method.
Value is retrieved from OpenSSL and base64 encoded as described in RFC
5929 section 3.
BUILD: ssl: previous patch failed

This is a minor error, s/SMP_T_CSTR/SMP_T_STR + SMP_F_CONST.
BUG/MINOR: acl: req_ssl_sni fails with SSLv3 record version

SNI is a TLS extension and requires at least TLSv1.0 or later, however
the version in the record layer may be SSLv3, not necessarily TLSv1.0.

GnuTLS for example does this.

Relax the record layer version check in smp_fetch_ssl_hello_sni() to
allow fetching SNI values from clients indicating SSLv3 in the record
layer (maintaining the TLSv1.0+ check in the actual handshake version).

This was reported and analyzed by Pravin Tatti.
BUG/MINOR: build: add missing objects in osx and bsd Makefiles

Commits 98634f0c7b8, ed66c297c26 and d5f624dde78 updated the main
makefile with new objects src/hash.o, src/pattern.o and src/map.o,
but missed to update Makefile.bsd and Makefile.osx.

This will fix some of the build failures reported by Jorge Severino
under OpenBSD.
DOC: fix a few config typos.

Here's a small patch that fixes a few typos in
configuration.txt (and one in haproxy.1).
BUILD/MEDIUM: standard: get rid of the last strcpy()

OpenBSD complains about our use of strcpy() in standard.c. The checks
were OK and we didn't fall into the category of "almost always misused",
but it's very simple to fix it so better do it before a problem happens.

src/standard.o(.text+0x26ab): In function `str2sa_range':
src/standard.c:718: warning: strcpy() is almost always misused, please use strlcpy()
BUILD/MEDIUM: standard: get rid of sprintf()

OpenBSD complains about the use of sprintf in human_time() :

src/standard.o(.text+0x1c40): In function `human_time':
src/standard.c:2067: warning: sprintf() is often misused, please use snprintf()

We can easily get around this by having a pointer to the end of the string and
using snprintf() instead.
BUILD/MEDIUM: cfgparse: get rid of sprintf()

A few occurrences of sprintf() were causing harmless warnings on OpenBSD :

src/cfgparse.o(.text+0x259e): In function `cfg_parse_global':
src/cfgparse.c:1044: warning: sprintf() is often misused, please use snprintf()

These ones were easy to get rid of, so better do it.
BUILD/MEDIUM: checks: get rid of sprintf()

OpenBSD complains about our use of sprintf() here :

src/checks.o(.text+0x44db): In function `process_chk':
src/checks.c:766: warning: sprintf() is often misused, please use snprintf()

This case was not really clean since the introduction of global.node BTW.
Better change the API to support a size argument in the function and enforce
the limit.
BUILD/MEDIUM: http: remove calls to sprintf()

OpenBSD complains about this use of sprintf() :

src/proto_http.o(.text+0xb0e6): In function `http_process_request':
src/proto_http.c:4127: warning: sprintf() is often misused, please use snprintf()

Here there's no risk as the strings are way shorter than the buffer size
but let's fix it anyway.
BUG/MEDIUM: systemd-wrapper: fix locating of haproxy binary

OpenBSD complains this way due to strncat() :

src/haproxy-systemd-wrapper.o(.text+0xd5): In function `spawn_haproxy':
src/haproxy-systemd-wrapper.c:33: warning: strcat() is almost always misused, please use strlcat()

In fact, the code before strncat() here is wrong, because it may
dereference a NULL if /proc/self/exe is not readable. So fix it
and get rid of strncat() at the same time.

No backport is needed.
BUG/MINOR: build: handle whitespaces in wc -l output

Certain implementations (for example ksh/OpenBSD) prefix the
'wc -l' output with whitespaces. This breaks the build since
689e4d733 ("BUILD: simplify the date and version retrieval in
the makefile").

Fix this by piping the wc output into tr -dc '0-9'.

Workaround is to build with IGNOREGIT=1.

HAProxy-1.4 is affected as well.
BUG/MINOR: Fix name lookup ordering when compiled with USE_GETADDRINFO

When compiled with USE_GETADDRINFO, make sure we use getaddrinfo(3) to
perform name lookups. On default dual-stack setups this will change the
behavior of using IPv6 first. Global configuration option
'nogetaddrinfo' can be used to revert to deprecated gethostbyname(3).
MEDIUM: ssl: Add standardized DH parameters >= 1024 bits

This patch adds standardized (rfc 2409 / rfc 3526)
DH parameters with prime lengths of 1024, 2048, 3072, 4096, 6144 and
8192 bits, based on the private key size.
BUILD/MINOR: ssl: remove one call to sprintf()

Lukas reported another OpenBSD complaint about this use of sprintf() that
I missed :

src/ssl_sock.o(.text+0x2a79): In function `bind_parse_crt':
src/ssl_sock.c:3015: warning: sprintf() is often misused, please use snprintf()

This one was even easier to handle. Note that some of these calls could
be simplified by checking the snprintf output size instead of doing the
preliminary size computation.