Adding upstream version 2.6.12.upstream/2.6.12upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

11 files changed, 901 insertions, 0 deletions

diff --git a/reg-tests/server/cli_add_check_server.vtc b/reg-tests/server/cli_add_check_server.vtc
new file mode 100644
index 0000000..c63710c
--- /dev/null
+++ b/reg-tests/server/cli_add_check_server.vtc
@@ -0,0 +1,161 @@
+varnishtest "Add/Delete server via cli with check support"
+
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev3)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
+feature ignore_unknown_macro
+
+barrier b1 cond 2 -cyclic
+barrier b2 cond 2 -cyclic
+
+server s1 {
+	rxreq
+	txresp
+} -start
+
+server s2 {
+} -start
+
+# used for agent checks
+server s3 {
+	recv 5
+	send "ready up\n"
+	barrier b2 sync
+} -start
+
+syslog S1 -level notice {
+	recv
+	expect ~ ".*Server be1/s1 is UP/READY \\(leaving forced maintenance\\)."
+	recv
+	expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/s1 succeeded.+reason: Layer7 check passed, code: 200, check duration: [[:digit:]]+ms.+status: 1/1 UP"
+
+	barrier b1 sync
+
+	recv
+	expect ~ ".*Server be1/s2 is UP/READY \\(leaving forced maintenance\\)."
+	recv
+	expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/s2 failed.+reason: Layer7 timeout, check duration: [[:digit:]]+ms.+status: 0/1 DOWN"
+
+	barrier b1 sync
+
+	recv
+	expect ~ ".*Server be1/s2 was DOWN and now enters maintenance."
+
+	recv
+	expect ~ ".*Server be1/s3 is UP/READY \\(leaving forced maintenance\\)."
+
+	recv
+	expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Agent check for server be1/s3 succeeded.+reason: Layer7 check passed, code: 0, info: \"via agent : up\", check duration: [[:digit:]]+ms.+status: 1/1 UP"
+
+	barrier b1 sync
+	barrier b2 sync
+
+	recv
+	expect ~ ".*Server be1/s4 is UP/READY \\(leaving forced maintenance\\)."
+	recv
+	expect ~ "Health check for server be1/s4 failed"
+
+	barrier b1 sync
+
+	recv
+	expect ~ ".*Server be1/s5 is UP/READY \\(leaving forced maintenance\\)."
+	recv
+	expect ~ "Health check for server be1/s5 succeeded."
+} -start
+
+haproxy h1 -conf {
+	global
+		stats socket "${tmpdir}/h1/stats" level admin
+
+	backend be1
+		option log-health-checks
+		option httpchk GET /
+		log ${S1_addr}:${S1_port} daemon
+
+	frontend fe-proxy
+		mode http
+		bind "fd@${hapsrv}" accept-proxy
+		http-request return status 200
+} -start
+
+# check on a functional server
+haproxy h1 -cli {
+	send "add server be1/s1 ${s1_addr}:${s1_port} check inter 200ms rise 1 fall 1"
+	expect ~ "New server registered."
+
+	send "enable server be1/s1"
+	expect ~ ".*"
+	send "enable health be1/s1"
+	expect ~ ".*"
+
+	barrier b1 sync
+
+	send "disable server be1/s1"
+	expect ~ ".*"
+
+	send "del server be1/s1"
+	expect ~ "Server deleted."
+}
+
+server s2 -break
+
+# check on a disabled server
+haproxy h1 -cli {
+	send "add server be1/s2 ${s2_addr}:${s2_port} check inter 200ms rise 1 fall 1"
+	expect ~ "New server registered."
+
+	send "enable server be1/s2"
+	expect ~ ".*"
+	send "enable health be1/s2"
+	expect ~ ".*"
+
+	barrier b1 sync
+
+	send "disable server be1/s2"
+	expect ~ ".*"
+
+	send "del server be1/s2"
+	expect ~ "Server deleted."
+}
+
+# agent check
+haproxy h1 -cli {
+	send "add server be1/s3 ${s1_addr}:${s1_port} agent-check agent-addr ${s3_addr} agent-port ${s3_port} agent-send 'hello' agent-inter 200ms rise 1 fall 1"
+	expect ~ "New server registered."
+
+	send "enable agent be1/s3"
+	expect ~ ".*"
+
+	barrier b1 sync
+
+	send "disable agent be1/s3; disable server be1/s3"
+	expect ~ ".*"
+
+	send "del server be1/s3"
+	expect ~ "Server deleted."
+}
+
+# check PROXY protocol interaction with checks
+haproxy h1 -cli {
+	# no explicit check-send-proxy
+	# The health check should failed.
+	send "add server be1/s4 ${h1_hapsrv_addr}:${h1_hapsrv_port} send-proxy check rise 1 fall 1"
+	expect ~ "New server registered."
+
+	send "enable server be1/s4"
+	expect ~ ".*"
+	send "enable health be1/s4"
+	expect ~ ".*"
+
+	barrier b1 sync
+
+	# explicit check-send-proxy : health check should succeeded
+	send "add server be1/s5 ${h1_hapsrv_addr}:${h1_hapsrv_port} send-proxy check rise 1 fall 1 check-send-proxy"
+	expect ~ "New server registered."
+
+	send "enable server be1/s5"
+	expect ~ ".*"
+	send "enable health be1/s5"
+	expect ~ ".*"
+}
+
+syslog S1 -wait
diff --git a/reg-tests/server/cli_add_server.vtc b/reg-tests/server/cli_add_server.vtc
new file mode 100644
index 0000000..8c29305
--- /dev/null
+++ b/reg-tests/server/cli_add_server.vtc
@@ -0,0 +1,87 @@
+varnishtest "Add server via cli"
+
+feature ignore_unknown_macro
+
+#REQUIRE_VERSION=2.4
+
+server s1 {
+	rxreq
+	txresp
+} -start
+
+haproxy h1 -conf {
+	defaults
+		mode http
+		timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+	frontend fe
+		bind "fd@${feS}"
+		default_backend test
+
+	backend test
+		balance random
+
+	backend other
+		balance static-rr
+
+	backend other2
+		balance random
+		mode tcp
+} -start
+
+client c1 -connect ${h1_feS_sock} {
+	txreq
+	rxresp
+	expect resp.status == 503
+} -run
+
+haproxy h1 -cli {
+	# non existent backend
+	send "add server foo/s1 ${s1_addr}:${s1_port}"
+	expect ~ "No such backend."
+
+	# missing address
+	send "add server test/s1"
+	expect ~ "'server' expects <name> and <addr>\\[:<port>\\] as arguments."
+
+	# invalid load-balancing algo
+	send "add server other/s1 ${s1_addr}:${s1_port}"
+	expect ~ "Backend must use a dynamic load balancing to support dynamic servers."
+
+	# invalid mux proto
+	send "add server other2/s1 ${s1_addr}:${s1_port} proto h2"
+	expect ~ "MUX protocol is not usable for server."
+
+	# valid command
+	send "add server test/s1 ${s1_addr}:${s1_port}"
+	expect ~ "New server registered."
+
+	# duplicate server
+	send "add server test/s1 ${s1_addr}:${s1_port}"
+	expect ~ "Already exists a server with the same name in backend."
+
+	# valid command
+	# specify the proto, it should be accepted for this backend
+	send "add server test/s2 ${s1_addr}:${s1_port} proto h2"
+	expect ~ "New server registered."
+}
+
+# dynamic servers are created on MAINT mode and should not be available at first
+client c2 -connect ${h1_feS_sock} {
+	txreq
+	rxresp
+	expect resp.status == 503
+} -run
+
+haproxy h1 -cli {
+	send "enable server test/s1"
+	expect ~ ".*"
+}
+
+client c3 -connect ${h1_feS_sock} {
+	txreq
+	rxresp
+	expect resp.status == 200
+} -run
diff --git a/reg-tests/server/cli_add_ssl_server.vtc b/reg-tests/server/cli_add_ssl_server.vtc
new file mode 100644
index 0000000..95caf3f
--- /dev/null
+++ b/reg-tests/server/cli_add_ssl_server.vtc
@@ -0,0 +1,110 @@
+varnishtest "Add server via cli with SSL activated"
+
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
+feature cmd "command -v socat"
+feature ignore_unknown_macro
+
+barrier b1 cond 2 -cyclic
+
+syslog S1 -level notice {
+	recv
+	expect ~ ".*Server li-ssl/s1 is UP/READY \\(leaving forced maintenance\\)."
+	recv
+	expect ~ ".*Server li-ssl/s2 is UP/READY \\(leaving forced maintenance\\)."
+	recv
+	expect ~ "Health check for server li-ssl/s2 failed"
+
+	barrier b1 sync
+
+	recv
+	expect ~ ".*Server li-ssl/s3 is UP/READY \\(leaving forced maintenance\\)."
+	recv
+	expect ~ "Health check for server li-ssl/s3 succeeded."
+} -start
+
+haproxy h1 -conf {
+	global
+		stats socket "${tmpdir}/h1/stats" level admin
+
+	defaults
+		mode http
+		timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+		option log-health-checks
+		option httpchk GET /
+
+	# proxy to attach a ssl server
+	listen li-ssl
+		bind "fd@${feSsl}"
+		balance random
+		log ${S1_addr}:${S1_port} daemon
+
+	# frontend used to respond to ssl connection
+	frontend fe-ssl-term
+		bind "fd@${feSslTerm}" ssl crt ${testdir}/common.pem
+		http-request return status 200
+} -start
+
+### SSL SUPPORT
+# 1. first create a ca-file using CLI
+# 2. create an SSL server and use it
+
+client c1 -connect ${h1_feSsl_sock} {
+	txreq
+	rxresp
+	expect resp.status == 503
+} -run
+
+shell {
+	echo "new ssl ca-file common.pem" | socat "${tmpdir}/h1/stats" -
+	printf "set ssl ca-file common.pem <<\n$(cat ${testdir}/common.pem)\n\n" | socat "${tmpdir}/h1/stats" -
+	echo "commit ssl ca-file common.pem" | socat "${tmpdir}/h1/stats" -
+} -run
+
+haproxy h1 -cli {
+    send "show ssl ca-file common.pem"
+    expect ~ ".*SHA1 FingerPrint: 9A6418E498C43EDBCF5DD3C4C6FCD1EE0D7A946D"
+}
+
+haproxy h1 -cli {
+	# non existent backend
+	send "add server li-ssl/s1 ${h1_feSslTerm_addr}:${h1_feSslTerm_port} ssl ca-file common.pem verify none"
+	expect ~ "New server registered."
+
+	send "enable server li-ssl/s1"
+	expect ~ ".*"
+}
+
+client c2 -connect ${h1_feSsl_sock} {
+	txreq
+	rxresp
+	expect resp.status == 200
+} -run
+
+# test interaction between SSL and checks for dynamic servers
+haproxy h1 -cli {
+	# no explicit check-ssl
+	# The health check should failed.
+	send "add server li-ssl/s2 ${h1_feSslTerm_addr}:${h1_feSslTerm_port} ssl verify none check"
+	expect ~ "New server registered."
+
+	send "enable server li-ssl/s2"
+	expect ~ ".*"
+	send "enable health li-ssl/s2"
+	expect ~ ".*"
+
+	barrier b1 sync
+
+	# explicit check-ssl : health check should succeeded
+	send "add server li-ssl/s3 ${h1_feSslTerm_addr}:${h1_feSslTerm_port} ssl verify none check check-ssl"
+	expect ~ "New server registered."
+
+	send "enable server li-ssl/s3"
+	expect ~ ".*"
+	send "enable health li-ssl/s3"
+	expect ~ ".*"
+}
+
+syslog S1 -wait
diff --git a/reg-tests/server/cli_add_track_server.vtc b/reg-tests/server/cli_add_track_server.vtc
new file mode 100644
index 0000000..318f236
--- /dev/null
+++ b/reg-tests/server/cli_add_track_server.vtc
@@ -0,0 +1,242 @@
+varnishtest "Add/Delete server via cli with track support"
+
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
+feature ignore_unknown_macro
+
+
+# just use to provide s1_{addr,port} macros
+server s1 {
+}
+
+
+# scenario 1
+# -> 3 dynamic servers, delete the first one
+syslog S1 {
+	recv notice
+	expect ~ "Server be1/s1 is UP/READY"
+	recv notice
+	expect ~ "Server be1/s2 is UP/READY"
+	recv notice
+	expect ~ "Server be1/s3 is UP/READY"
+
+	recv alert
+	expect ~ "Server be1/srv is going DOWN for maintenance."
+	recv alert
+	expect ~ "Server be1/s3 is going DOWN for maintenance."
+	recv alert
+	expect ~ "Server be1/s2 is going DOWN for maintenance."
+	recv alert
+	expect ~ "Server be1/s1 is going DOWN for maintenance."
+
+	recv notice
+	expect ~ "Server be1/srv is UP/READY"
+	recv notice
+	expect ~ "Server be1/s3 is UP/READY"
+	recv notice
+	expect ~ "Server be1/s2 is UP/READY"
+} -start
+
+# scenario 2
+# -> 3 dynamic servers, delete the middle one
+syslog S2 {
+	recv notice
+	expect ~ "Server be2/s1 is UP/READY"
+	recv notice
+	expect ~ "Server be2/s2 is UP/READY"
+	recv notice
+	expect ~ "Server be2/s3 is UP/READY"
+
+	recv alert
+	expect ~ "Server be2/srv is going DOWN for maintenance."
+	recv alert
+	expect ~ "Server be2/s3 is going DOWN for maintenance."
+	recv alert
+	expect ~ "Server be2/s2 is going DOWN for maintenance."
+	recv alert
+	expect ~ "Server be2/s1 is going DOWN for maintenance."
+
+	recv notice
+	expect ~ "Server be2/srv is UP/READY"
+	recv notice
+	expect ~ "Server be2/s3 is UP/READY"
+	recv notice
+	expect ~ "Server be2/s1 is UP/READY"
+} -start
+
+# scenario 3
+# -> 3 dynamic servers, delete all of them
+syslog S3 {
+	recv notice
+	expect ~ "Server be3/s1 is UP/READY"
+	recv notice
+	expect ~ "Server be3/s2 is UP/READY"
+	recv notice
+	expect ~ "Server be3/s3 is UP/READY"
+
+	recv alert
+	expect ~ "Server be3/s1 is going DOWN for maintenance."
+	recv alert
+	expect ~ "Server be3/s3 is going DOWN for maintenance."
+	recv alert
+	expect ~ "Server be3/s2 is going DOWN for maintenance."
+
+	recv alert
+	expect ~ "Server be3/srv is going DOWN for maintenance."
+
+	recv notice
+	expect ~ "Server be3/srv is UP/READY"
+} -start
+
+
+haproxy h1 -conf {
+	global
+		stats socket "${tmpdir}/h1/stats" level admin
+
+	backend be_check
+		server srv_check ${s1_addr}:${s1_port} check
+		server srv_no_check ${s1_addr}:${s1_port}
+
+	backend be1
+		log ${S1_addr}:${S1_port} daemon
+		server srv ${s1_addr}:${s1_port} check
+
+	backend be2
+		log ${S2_addr}:${S2_port} daemon
+		server srv ${s1_addr}:${s1_port} check
+
+	backend be3
+		log ${S3_addr}:${S3_port} daemon
+		server srv ${s1_addr}:${s1_port} check
+} -start
+
+
+###
+# check the support of the 'track' keyword on 'add server' CLI command.
+# rejection must happen if track on a non-checked or a dynamic server
+###
+haproxy h1 -cli {
+	# invalid command: track on a non-checked server
+	send "add server be_check/s1 ${s1_addr}:${s1_port} track be_check/srv_no_check"
+	expect ~ "unable to use be_check/srv_no_check for tracking as it does not have any check nor agent enabled."
+
+	# valid track usage
+	send "add server be_check/s1 ${s1_addr}:${s1_port} track be_check/srv_check"
+	expect ~ "New server registered."
+
+	# invalid command: track on a dynamic server
+	send "add server be_check/s3 ${s1_addr}:${s1_port} track be_check/s1"
+	expect ~ "unable to use be_check/s1 for tracking as it is a dynamic server."
+}
+
+###
+# scenario 1
+#
+# Add 3 dynamic servers with tracking on be1/srv
+# Disable be1/srv, S1 should report all servers DOWN
+# Delete the first dynamic server, enable be1/srv, S1 should report s1 and s3 UP
+####
+haproxy h1 -cli {
+	send "add server be1/s1 ${s1_addr}:${s1_port} track be1/srv"
+	expect ~ "New server registered."
+	send "enable server be1/s1"
+	expect ~ ".*"
+
+	send "add server be1/s2 ${s1_addr}:${s1_port} track be1/srv"
+	expect ~ "New server registered."
+	send "enable server be1/s2"
+	expect ~ ".*"
+
+	send "add server be1/s3 ${s1_addr}:${s1_port} track be1/srv"
+	expect ~ "New server registered."
+	send "enable server be1/s3"
+	expect ~ ".*"
+
+	send "disable server be1/srv"
+	expect ~ ".*"
+
+	send "del server be1/s1"
+	expect ~ "Server deleted."
+
+	send "enable server be1/srv"
+	expect ~ ".*"
+}
+
+###
+# scenario 2
+#
+# Add 3 dynamic servers with tracking on be2/srv
+# Disable be2/srv, S3 should report all servers DOWN
+# Delete the second dynamic server, enable be2/srv, S2 should report s2 and s3 UP
+####
+haproxy h1 -cli {
+	send "add server be2/s1 ${s1_addr}:${s1_port} track be2/srv"
+	expect ~ "New server registered."
+	send "enable server be2/s1"
+	expect ~ ".*"
+
+	send "add server be2/s2 ${s1_addr}:${s1_port} track be2/srv"
+	expect ~ "New server registered."
+	send "enable server be2/s2"
+	expect ~ ".*"
+
+	send "add server be2/s3 ${s1_addr}:${s1_port} track be2/srv"
+	expect ~ "New server registered."
+	send "enable server be2/s3"
+	expect ~ ".*"
+
+	send "disable server be2/srv"
+	expect ~ ".*"
+
+	send "del server be2/s2"
+	expect ~ "Server deleted."
+
+	send "enable server be2/srv"
+	expect ~ ".*"
+}
+
+###
+# scenario 3
+#
+# Add 3 dynamic servers with tracking on be3/srv
+# Delete all of them, disable/enable be3/srv, only be3/srv should be reported
+# as DOWN/UP.
+####
+haproxy h1 -cli {
+	# create server 1, track on be3/srv
+	send "add server be3/s1 ${s1_addr}:${s1_port} track be3/srv"
+	expect ~ "New server registered."
+	send "enable server be3/s1"
+	expect ~ ".*"
+
+	# create server 2, track on be3/srv
+	send "add server be3/s2 ${s1_addr}:${s1_port} track be3/srv"
+	expect ~ "New server registered."
+	send "enable server be3/s2"
+	expect ~ ".*"
+
+	# create server 3, track on be3/srv
+	send "add server be3/s3 ${s1_addr}:${s1_port} track be3/srv"
+	expect ~ "New server registered."
+	send "enable server be3/s3"
+	expect ~ ".*"
+
+	# delete all dynamic servers
+	send "disable server be3/s1; del server be3/s1"
+	expect ~ "Server deleted."
+	send "disable server be3/s3; del server be3/s3"
+	expect ~ "Server deleted."
+	send "disable server be3/s2; del server be3/s2"
+	expect ~ "Server deleted."
+
+	# disable / enable the static server
+	send "disable server be3/srv"
+	expect ~ ".*"
+	send "enable server be3/srv"
+	expect ~ ".*"
+}
+
+
+syslog S1 -wait
+syslog S2 -wait
+syslog S3 -wait
diff --git a/reg-tests/server/cli_delete_dynamic_server.vtc b/reg-tests/server/cli_delete_dynamic_server.vtc
new file mode 100644
index 0000000..e667641
--- /dev/null
+++ b/reg-tests/server/cli_delete_dynamic_server.vtc
@@ -0,0 +1,94 @@
+# This script is to test the proper behavior with dynamic servers insertion and
+# deletion, in particular with the load-balancing of requests.
+#
+varnishtest "Delete server via cli"
+
+feature ignore_unknown_macro
+
+#REQUIRE_VERSION=2.4
+
+# static server
+server s1 -repeat 3 {
+	rxreq
+	txresp \
+	  -body "resp from s1"
+} -start
+
+# use as a dynamic server, added then deleted via CLI
+server s2 -repeat 3 {
+	rxreq
+	txresp \
+	  -body "resp from s2"
+} -start
+
+haproxy h1 -conf {
+	defaults
+		mode http
+		timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+	frontend fe
+		bind "fd@${feS}"
+		default_backend test
+
+	backend test
+		server s1 ${s1_addr}:${s1_port}
+} -start
+
+# add a new dynamic server to be able to delete it then
+haproxy h1 -cli {
+	# add a dynamic server and enable it
+	send "add server test/s2 ${s2_addr}:${s2_port}"
+	expect ~ "New server registered."
+
+	send "enable server test/s2"
+	expect ~ ".*"
+}
+
+haproxy h1 -cli {
+	# non existent backend
+	send "del server foo/s1"
+	expect ~ "No such backend."
+
+	# non existent server
+	send "del server test/other"
+	expect ~ "No such server."
+}
+
+# first check that both servers are active
+client c1 -connect ${h1_feS_sock} {
+	txreq
+	rxresp
+	expect resp.body == "resp from s1"
+
+	txreq
+	rxresp
+	expect resp.body == "resp from s2"
+} -run
+
+# delete the dynamic server
+haproxy h1 -cli {
+	# server not in maintenance mode
+	send "del server test/s2"
+	expect ~ "Only servers in maintenance mode can be deleted."
+
+	send "disable server test/s2"
+	expect ~ ".*"
+
+	# valid command
+	send "del server test/s2"
+	expect ~ "Server deleted."
+}
+
+# now check that only the first server is used
+client c2 -connect ${h1_feS_sock} {
+	txreq
+	rxresp
+	expect resp.body == "resp from s1"
+
+	txreq
+	rxresp
+	expect resp.body == "resp from s1"
+} -run
+
diff --git a/reg-tests/server/cli_delete_server.vtc b/reg-tests/server/cli_delete_server.vtc
new file mode 100644
index 0000000..61d241c
--- /dev/null
+++ b/reg-tests/server/cli_delete_server.vtc
@@ -0,0 +1,60 @@
+# This script is to test the ability to remove servers, unless they are
+# referenced by some elements from the configuration.
+#
+varnishtest "Delete server via cli"
+
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"
+feature ignore_unknown_macro
+
+haproxy h1 -conf {
+	defaults
+		mode http
+		timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+	frontend fe
+		bind "fd@${feS}"
+		acl s1_full srv_sess_rate(test/s1) gt 50
+		default_backend test
+
+	backend test
+		use-server s3 unless { always_false }
+		server s1 ${s1_addr}:${s1_port}          # referenced in ACL
+		server s2 ${s1_addr}:${s1_port} check    # referenced in track
+		server s3 ${s1_addr}:${s1_port} track s2 # referenced in use-server
+		server s4 ${s1_addr}:${s1_port}          # removable server
+} -start
+
+haproxy h1 -cli {
+	# non existent backend
+	send "del server foo/s1"
+	expect ~ "No such backend."
+
+	# non existent server
+	send "del server test/other"
+	expect ~ "No such server."
+
+	# server referenced in ACL
+	send "del server test/s1"
+	expect ~ "This server cannot be removed at runtime due to other configuration elements pointing to it."
+
+	# tracked server
+	send "del server test/s2"
+	expect ~ "This server cannot be removed at runtime due to other configuration elements pointing to it."
+
+	# tracked server
+	send "del server test/s3"
+	expect ~ "This server cannot be removed at runtime due to other configuration elements pointing to it."
+
+	# server in running mode
+	send "del server test/s4"
+	expect ~ "Only servers in maintenance mode can be deleted."
+
+	send "disable server test/s4"
+	expect ~ ".*"
+
+	# valid command
+	send "del server test/s4"
+	expect ~ "Server deleted."
+}
diff --git a/reg-tests/server/cli_delete_server_lua.vtc b/reg-tests/server/cli_delete_server_lua.vtc
new file mode 100644
index 0000000..396cd21
--- /dev/null
+++ b/reg-tests/server/cli_delete_server_lua.vtc
@@ -0,0 +1,43 @@
+# This script is to check that servers that are referenced by a lua script
+# cannot be removed at runtime.
+varnishtest "Delete lua server via cli"
+
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(LUA)'"
+feature ignore_unknown_macro
+
+server s1 {
+	rxreq
+	txresp
+} -start
+
+haproxy h1 -conf {
+	global
+		lua-load ${testdir}/get_srv_stats.lua
+
+	defaults
+		mode http
+		timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+	frontend fe
+		bind "fd@${feS}"
+		default_backend test
+
+	backend test
+		http-request add-header s1-stats %[lua.get_srv_stats(s1)]
+		server s1 ${s1_addr}:${s1_port}          # referenced in lua script
+} -start
+
+# make a request to force the execution of the lua script which references a
+# server
+client c1 -connect ${h1_feS_sock} {
+	txreq
+	rxresp
+} -run
+
+haproxy h1 -cli {
+	send "experimental-mode on; del server test/s1"
+	expect ~ "This server cannot be removed at runtime due to other configuration elements pointing to it."
+}
diff --git a/reg-tests/server/cli_set_fdqn.vtc b/reg-tests/server/cli_set_fdqn.vtc
new file mode 100644
index 0000000..86f32b6
--- /dev/null
+++ b/reg-tests/server/cli_set_fdqn.vtc
@@ -0,0 +1,32 @@
+varnishtest "Set server FQDN via CLI crash"
+
+feature ignore_unknown_macro
+
+# for "set server <srv> fqdn"
+#REGTEST_TYPE=bug
+
+# Do nothing. Is there only to create s1_* macros
+server s1 {
+} -start
+
+haproxy h1 -conf {
+    defaults
+        mode http
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+    frontend myfrontend
+        bind "fd@${my_fe}"
+        default_backend test
+
+    backend test
+        server www1 ${s1_addr}:${s1_port}
+} -start
+
+haproxy h1 -cli {
+    send "set server test/www1 fqdn foo.fqdn"
+    expect ~ "set server <b>/<s> fqdn failed because no resolution is configured."
+    send "show servers state test"
+    expect ~ "test 1 www1 ${s1_addr} .* - ${s1_port}"
+} -wait
diff --git a/reg-tests/server/cli_set_ssl.vtc b/reg-tests/server/cli_set_ssl.vtc
new file mode 100644
index 0000000..fa6fe68
--- /dev/null
+++ b/reg-tests/server/cli_set_ssl.vtc
@@ -0,0 +1,60 @@
+varnishtest "Set server ssl via CLI"
+
+feature ignore_unknown_macro
+
+# for "set server <srv> ssl"
+#REQUIRE_VERSION=2.4
+#REGTEST_TYPE=devel
+#REQUIRE_OPTIONS=OPENSSL
+
+# Do nothing. Is there only to create s1_* macros
+server s1 {
+} -start
+
+haproxy h1 -conf {
+    global
+        ssl-server-verify none
+
+    defaults
+        mode http
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+    frontend myfrontend
+        bind "fd@${my_fe}"
+        default_backend test0
+
+    backend test0
+        server www0 ${s1_addr}:${s1_port} no-ssl
+        default-server ssl
+        server www1 ${s1_addr}:${s1_port} no-ssl
+
+    backend test1
+        server www0 ${s1_addr}:${s1_port} no-ssl
+} -start
+
+haproxy h1 -cli {
+    # supported case
+    send "show servers state test0"
+    expect ~ "test0 2 www1 ${s1_addr} .* - ${s1_port} - -1"
+    send "set server test0/www1 ssl on"
+    expect ~ "server ssl setting updated"
+    send "show servers state test0"
+    expect ~ "test0 2 www1 ${s1_addr} .* - ${s1_port} - 1"
+    send "set server test0/www1 ssl off"
+    expect ~ "server ssl setting updated"
+    send "show servers state test0"
+    expect ~ "test0 2 www1 ${s1_addr} .* - ${s1_port} - 0"
+
+    # unsupported cases
+    send "show servers state test0"
+    expect ~ "test0 1 www0 ${s1_addr} .* - ${s1_port} - -1"
+    send "set server test0/www0 ssl on"
+    expect ~ "'set server <srv> ssl' cannot be set"
+
+    send "show servers state test1"
+    expect ~ "test1 1 www0 ${s1_addr} .* - ${s1_port} - -1"
+    send "set server test1/www0 ssl on"
+    expect ~ "'set server <srv> ssl' cannot be set"
+} -wait
diff --git a/reg-tests/server/common.pem b/reg-tests/server/common.pem
new file mode 120000
index 0000000..a4433d5
--- /dev/null
+++ b/reg-tests/server/common.pem
@@ -0,0 +1 @@
+../ssl/common.pem
\ No newline at end of file
diff --git a/reg-tests/server/get_srv_stats.lua b/reg-tests/server/get_srv_stats.lua
new file mode 100644
index 0000000..105b954
--- /dev/null
+++ b/reg-tests/server/get_srv_stats.lua
@@ -0,0 +1,11 @@
+local function lua_get_srv_stats(txn, name)
+	for _, backend in pairs(core.backends) do
+		for _, server in pairs(backend.servers) do
+			if server.name == name then
+				return server:get_stats()
+			end
+		end
+	end
+end
+
+core.register_fetches('get_srv_stats', lua_get_srv_stats)