gmane.comp.web.pound.general

Re: [Pound Mailing List] send source IP of HTTP requests to web servers in the cluster

Andreas Hilboll — 2013-05-21T08:53:23

Hi Pat,

if I'm not mistaken, the IP address you're looking for is being put into
the X-Forwarded-For header by pound. So you just need to adapt your
nginx logging directive. See, e.g., here:

   https://syslog.tv/2011/08/10/nginx-log-real-ip-from-pound/

Hope that helps,
Andreas.

On 21.05.2013 10:38, Pat Erler wrote:


--
To unsubscribe send an email with subject unsubscribe to pound-Ws3YcLWMCpvhvxM+mQhndA< at >public.gmane.org
Please contact roseg-Ws3YcLWMCps< at >public.gmane.org for questions.

Re: [Pound Mailing List] send source IP of HTTP requests to web servers in the cluster

Scott McKeown — 2013-05-21T08:52:39

Hi Pat,

You will need to rebuild your version of pound with the TProxy Patch.

A slightly out dated How To can be found at *
http://blog.loadbalancer.org/transparent-proxy-of-ssl-traffic-using-pound-to-haproxy-backend-patch-and-howto/
* however, the whole principle is still the same.

Also depending on what OS your running on you may need to modify your
Kernel to allow TProxy use but most modern/new Kernels already have this
enabled Centos 6.x does for example.


~Yours,
Scott


On 21 May 2013 09:38, Pat Erler <perler-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

[Pound Mailing List] send source IP of HTTP requests to web servers in the cluster

Pat Erler — 2013-05-21T08:38:36

hi,

we have some nginx servers clustered behind a pound server and wonder if it
is possible to have the original source IP, as it is received by pound,
relayed to the nginx server (so that it appears in the logs there)?

regards,

PAT

[Pound Mailing List] Error forwarding audio stream icecast2

Nicolas Favrod-Coune — 2013-05-13T17:34:29

Hi everyone,

I got a problem. I have a server that is a host for virtual machines.
The host is directly on the web and is used as a proxy with pound. Example
values : IP : 1.1.1.1 and domain xyz.com

One of the VirtualMachine is an Icecast2 server. (http://icecast.org),
running on port 80. so I did my pound config to point it like on
stream.xyz.com.

Here's my setup:


ListenHTTP
        Address 1.1.1.1
        Port    80

        ## allow PUT and DELETE also (by default only GET, POST and HEAD)?:
        xHTTP           1

        Service
                HeadRequire "Host:.*stream.xyz.com.*"
                BackEnd
                        Address 192.168.1.100
                        Port 80
                End
        End
End


Then, I have two problems :
---

First of all, the HTTP header of icecast server is "SOURCE" :
May 13 18:55:52 Host pound: - 33:33:33:33 - source [13/May/2013:18:55:37
+0200] "SOURCE /mount HTTP/1.0" 200 - "" "butt-0.1.12"

I manage to add this header by recompile last version, add

RE: [Pound Mailing List] Defining multiple URL patterns in a Service

Joe Gooch — 2013-05-07T15:38:41

My staging branch now includes a URLMatch directive, which accepts a value of “Or” or “And”.

Joe

From: Conor McCarthy [mailto:mr.spuratic-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org]
Sent: Tuesday, May 07, 2013 8:51 AM
To: pound-Ws3YcLWMCps< at >public.gmane.org
Subject: Re: [Pound Mailing List] Defining multiple URL patterns in a Service

On 3 May 2013 15:39, Joe Gooch <mrwizard-A6NxGpb0uxwybS5Ee8rs3A< at >public.gmane.org<mailto:mrwizard< at >k12system.com>> wrote:
If it were me, I'd implement OrUrl directives and AndUrl directives and ensure they could only use one or the other in the config.

I could see a use case where OrUrl's would be useful for programs that are generating the config... I agree if the config is being modified manually, a pipe syntax in the regex is easy enough to do, and probably more efficient. (fewer regex calls)  However, a url like (A|B|C|D|E|F|G|H|I|J|K|L|M) where each letter is actually 15-20 characters sounds like a management nightmare to me.

Even if OrUrl directives were automagica

Re: [Pound Mailing List] Defining multiple URL patterns in a Service

Conor McCarthy — 2013-05-07T12:51:02


"OrURL" handles my requirement neatly, I can only think of one marginal use
case for
"AndURL" since "and" is implicit in a regexp:

   AndURL "^/myapplication"
   AndURL" \.asp$"

Which is of course equivalent to "^/myapplication.*\.asp$", but for
non-trivial expressions
it's arguably easier to read, maintain or generate.

On platforms where PCRE is not available, you might usefully use AndURL to
partially kludge some features (lookarounds or non-greedy matching).

Since the expressions are compiled at config read time, the typical
overheads should
be minimal, at least for ^$ anchored expressions.

C.

Joe

[Pound Mailing List] HAport script

Kristine Putnam — 2013-05-03T20:48:30

I have scoured the archives, and I am wondering if anybody has an HAport script I could look at? I have a custom page that checks that all of the necessary services are responding, I just need a script to run on the HAport that tests this url and dumps the connection should the test fail. I can write scripts that get contents of webpages, but I've never written a daemon/like script that listens to external connections, so I need a lot of references. 

Thanks in advance, sorry for the newb question :/ 

-Kriss

Re: [Pound Mailing List] PCI-DSS Compliance with Pound

Andreas Hilboll — 2013-05-03T18:48:38

Thanks, Joe, I ended up using your 2.7b branch, and everything went very
smoothly.

Cheers, A.

RE: [Pound Mailing List] Defining multiple URL patterns in a Service

Joe Gooch — 2013-05-03T14:39:35

If it were me, I'd implement OrUrl directives and AndUrl directives and ensure they could only use one or the other in the config.

I could see a use case where OrUrl's would be useful for programs that are generating the config... I agree if the config is being modified manually, a pipe syntax in the regex is easy enough to do, and probably more efficient. (fewer regex calls)  However, a url like (A|B|C|D|E|F|G|H|I|J|K|L|M) where each letter is actually 15-20 characters sounds like a management nightmare to me.

Even if OrUrl directives were automagically translated into "(pat1|pat2|pat3|pat4)" by pound and compiled as one regex, it would likely be an improvement.

As far as AndUrl directives, do you have an example of a use case where that would be useful?  I get that ors can be handled natively and ands are more difficult... But what pair (or more) of patterns might one use?  I'm finding it hard to conceptualize a time when someone would want to do that.

Joe

Re: [Pound Mailing List] Defining multiple URL patterns in a Service

Robert Segall — 2013-05-03T12:12:54

There is a reason for it: it is easy to write an OR regular expression,
but AND expressions can be more difficult.

Re: [Pound Mailing List] Defining multiple URL patterns in a Service

Conor McCarthy — 2013-05-03T11:47:31


Excellent, thanks!

The specific use case is sets of URLs which require different Backend
(and possibly Session) settings, so it's simplest to have  a config like:

ListenHTTP

    Address 10.1.2.3
    ....

    ## special URLs
    Service
        URL "^/url1"
        URL "^/url2"
        URL ....

        Backend
            ...
        End
    End

    ## default
    Service
        ...
    End
End

After a while a single URL regex with multiple grouped alternatives becomes
troublesome and error prone.

Regards,
 Conor.

Re: [Pound Mailing List] PCI-DSS Compliance with Pound

Emilio Campos — 2013-04-29T21:36:02

BTW, some planed date for marking 2.7 like stable?

Regards


2013/4/29 Joe Gooch <mrwizard-A6NxGpb0uxwybS5Ee8rs3A< at >public.gmane.org>

RE: [Pound Mailing List] PCI-DSS Compliance with Pound

Joe Gooch — 2013-04-29T19:41:39

It is our stable branch, after all.  Though I will say Pound betas have always been very stable compared to other projects I've seen. :)

Joe


--
To unsubscribe send an email with subject unsubscribe to pound-Ws3YcLWMCpvhvxM+mQhndA< at >public.gmane.org
Please contact roseg-Ws3YcLWMCps< at >public.gmane.org for questions.

RE: [Pound Mailing List] PCI-DSS Compliance with Pound

jacob anderson — 2013-04-29T15:57:32

Wow, thanks Joe! Keeping 2.6 alive for us xenophobic IT administrators is very helpful. :)

RE: [Pound Mailing List] Defining multiple URL patterns in a Service

Joe Gooch — 2013-04-29T14:57:10

The documentation says you can have multiple directives… It doesn’t indicate whether they’re and-ed or or-ed together.  (The fact that it calls them conditions leads me to believe they’re restrictive)  I also agree the code appears to be doing an And relation.

Personally it’s never occurred to me to try to use multiple URL directives.

I agree in your case Or is what you want.  I’m having a hard time thinking of a reason you might want to use Ands…  Maybe some sort of exclusionary rule using negative lookaheads.. but with regular expressions I would think you could do that on one line as well.

“Or” logic committed to stage_for_upstream/v2.7b

Joe

From: Conor McCarthy [mailto:mr.spuratic-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org]
Sent: Tuesday, April 23, 2013 11:12 AM
To: pound-Ws3YcLWMCps< at >public.gmane.org
Subject: Re: [Pound Mailing List] Defining multiple URL patterns in a Service


On 2013-01-30 18:58:24, Alan McGinlay wrote:


































The documentation implies an

RE: [Pound Mailing List] PCI-DSS Compliance with Pound

Joe Gooch — 2013-04-29T14:40:09

My suggestion to anyone who needs PCI-DSS compliance is to run my branch here:
https://github.com/goochjj/pound/tree/stage_for_upstream/v2.7b

Zip here: https://github.com/goochjj/pound/archive/stage_for_upstream/v2.7b.zip

This is based on 2.7b, and includes a bunch of patches that I usually include in pound, to do things like SNI, CertDir includes, IncludeDir, PCRE redirects, etc.


If you don't feel comfortable running a 2.7 branch, or don't want to include those patches, I've rolled a new branch:
https://github.com/goochjj/pound/tree/pcidss/v2.6
Zip here: https://github.com/goochjj/pound/archive/pcidss/v2.6.zip

Which includes only the XSRF, SSLv2, SSL compression and cipher enhancements against a 2.6 baseline.


Joe


--
To unsubscribe send an email with subject unsubscribe to pound-Ws3YcLWMCpvhvxM+mQhndA< at >public.gmane.org
Please contact roseg-Ws3YcLWMCps< at >public.gmane.org for questions.

Re: [Pound Mailing List] PCI-DSS Compliance with Pound

Andreas Hilboll — 2013-04-29T08:34:21

Hi Lubomir,

thanks!


So this won't work on 2.6? Is there a patch available for 2.6? I'm not
too keen on using a version which is labeled "experimental".



From the message I can't tell whether the patch is for 2.6 or 2.7. Can
you enlighten me? I'd really like to stick to 2.6.


No problem, as I'm already doing that (I need a larger MAXBUF setting
than used in the Debian packageS).

Thanks again,
Andreas.


--
To unsubscribe send an email with subject unsubscribe to pound-Ws3YcLWMCpvhvxM+mQhndA< at >public.gmane.org
Please contact roseg-Ws3YcLWMCps< at >public.gmane.org for questions.

Re: [Pound Mailing List] PCI-DSS Compliance with Pound

Lubomir Rintel — 2013-04-29T08:16:40

Hello Andreas,

On Mon, Apr 29, 2013 at 9:57 AM, Andreas Hilboll <lists-ErRc0a+FHVSELgA04lAiVw< at >public.gmane.org> wrote:


Pound 2.7a contains a fix, at GoodData we use the following configuration:

        Ciphers "!EXPORT:!SSLv2:!MD5:!aNULL:!NULL:!LOW:RC4:RSA:ALL"
        SSLHonorCipherOrder 1

For 2012-4929, I need to turn off SSL Compression.

This is what we use to address the issue (not sure what's needed in order
to get that patch merged):

http://www.apsis.ch/pound/pound_list/archive/2013/2013-02/1360766010000#1360766010000

Our setup with stock el6 openssl (1.0.0) yields the following result.
https://www.ssllabs.com/ssltest/analyze.html?d=secure.gooddata.com



You need to rebuild your package.
Maybe it would be a good idea to file bug reports with your distribution?



Hope that helps!

[Pound Mailing List] PCI-DSS Compliance with Pound

Andreas Hilboll — 2013-04-29T07:57:45

Hi,

a recent PCI-DSS scan revealed the following vulnerabilities on our
system:

CVE-2011-3389: SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Vulnerability
CVE-2012-4929: SSL/TLS Compression Algorithm Information Leakage
               Vulnerability

For 2011-3389, I need to disable ciphers deemed unsecure. The solution
for Apache would be this:

   SSLHonorCipherOrder On
   SSLCipherSuite RC4-SHA:HIGH:!ADH

For 2012-4929, I need to turn off SSL Compression.

How can I achieve these two points with Pound 2.6 on Debian Squeeze?

Thanks a lot for your help!
Andreas.

--
To unsubscribe send an email with subject unsubscribe to pound-Ws3YcLWMCpvhvxM+mQhndA< at >public.gmane.org
Please contact roseg-Ws3YcLWMCps< at >public.gmane.org for questions.

Re: [Pound Mailing List] Defining multiple URL patterns in a Service

Conor McCarthy — 2013-04-23T15:12:00

The documentation implies an "any" URL match logic, this does not match the
code, Pound-2.6/svc.c #412:

static int
match_service(const SERVICE *svc, const char *request, char **const headers)
{
    MATCHER *m;
    int     i, found;

    /* check for request */
    for(m = svc->url; m; m = m->next)
        if(regexec(&m->pat, request, 0, NULL, 0))
            return 0;

    /* check for required headers */
    /* ... */

    /* check for forbidden headers */
    /* ... */

    return 1;
}

regexec() returns 0 for a match, and non-zero (REG_NOMATCH) for no match.

The URL testing for-loop will "early out" as soon as a match fails, rejecting
that service as unsuitable: i.e. all URLs must match, just like HeadRequire and
HeadDeny (for these the man page is explicit).

I have patched my implementation as follows:

    int     i, found,check;

    /* check for request URL */
    check=0;
    for(m = svc->url; m; m = m->next) {
        check++;
        if(regexec(&m->pat, request, 0, NULL, 0)!=REG_NOMATCH) {

Re: [Pound Mailing List] Pound Failover

James Bensley — 2013-04-13T20:05:58

Hi All,

Thanks for all your responses!

I have successfully implemented this now using keepalived. I would
thoroughly recommend this to anyone looking for IP failover, is really
easy to do. Download & compile which is as easy as;

wget http://www.keepalived.org/software/keepalived-1.2.7.tar.gz
gunzip keepalived-1.2.7.tar.gz
tar -xf keepalived-1.2.7.tar
cd keepalived-1.2.7/
sudo apt-get install libpopt-dev snmp snmpd libnl1 libnl-dev
libssl-dev make libsnmp-dev
./configure --enable-snmp
make
sudo make install

Then the following basic config will get you up and running with a basic set up;

vrrp_instance pound_ips {
    state MASTER
    interface eth1
    virtual_router_id 10
    priority 100
    advert_int 1
    nopreempt
    virtual_ipaddress {
        192.168.0.250
    }
    authentication {
        auth_type PASS
        auth_pass bxUcbz52FE38
    }
}

That reall is the bare minimum which will get you up and running. I
made some notes here;
http://null.53bits.co.uk/index.php?page=keepalived

Cheers to al