Browse Source

haproxy: bump to version 1.6.9 mainline and pending patches

Signed-off-by: heil <heil@terminal-consulting.de>
lilik-openwrt-22.03
heil 8 years ago
parent
commit
079d911cfb
31 changed files with 1390 additions and 270 deletions
  1. +53
    -16
      net/haproxy/Makefile
  2. +0
    -131
      net/haproxy/patches/0001-BUG-MAJOR-fix-listening-IP-address-storage-for-front.patch
  3. +53
    -0
      net/haproxy/patches/0001-BUG-MINOR-Fix-OSX-compilation-errors.patch
  4. +31
    -0
      net/haproxy/patches/0002-BUG-MINOR-displayed-PCRE-version-is-running-release.patch
  5. +0
    -39
      net/haproxy/patches/0002-CLEANUP-connection-fix-double-negation-on-memcmp.patch
  6. +0
    -52
      net/haproxy/patches/0003-BUG-MEDIUM-sticktables-segfault-in-some-configuratio.patch
  7. +49
    -0
      net/haproxy/patches/0003-MINOR-show-Built-with-PCRE-version.patch
  8. +0
    -32
      net/haproxy/patches/0004-BUG-MINOR-http-add-header-header-name-copied-twice.patch
  9. +25
    -0
      net/haproxy/patches/0004-MINOR-show-Running-on-zlib-version.patch
  10. +66
    -0
      net/haproxy/patches/0005-MINOR-Add-fe_req_rate-sample-fetch.patch
  11. +134
    -0
      net/haproxy/patches/0006-MEDIUM-make-SO_REUSEPORT-configurable.patch
  12. +29
    -0
      net/haproxy/patches/0007-BUG-MINOR-vars-use-sess-and-not-s-sess-in-action_sto.patch
  13. +47
    -0
      net/haproxy/patches/0008-BUG-MINOR-vars-make-smp_fetch_var-more-robust-agains.patch
  14. +31
    -0
      net/haproxy/patches/0009-BUG-MINOR-vars-smp_fetch_var-doesn-t-depend-on-HTTP-.patch
  15. +29
    -0
      net/haproxy/patches/0010-BUG-MINOR-ssl-Check-malloc-return-code.patch
  16. +70
    -0
      net/haproxy/patches/0011-BUG-MINOR-ssl-prevent-multiple-entries-for-the-same-.patch
  17. +31
    -0
      net/haproxy/patches/0012-BUG-MINOR-systemd-make-the-wrapper-return-a-non-null.patch
  18. +117
    -0
      net/haproxy/patches/0013-BUG-MINOR-systemd-always-restore-signals-before-exec.patch
  19. +41
    -0
      net/haproxy/patches/0014-BUG-MINOR-systemd-check-return-value-of-calloc.patch
  20. +41
    -0
      net/haproxy/patches/0015-MINOR-systemd-report-it-when-execve-fails.patch
  21. +144
    -0
      net/haproxy/patches/0016-BUG-MEDIUM-systemd-let-the-wrapper-know-that-haproxy.patch
  22. +32
    -0
      net/haproxy/patches/0017-BUILD-protocol-fix-some-build-errors-on-OpenBSD.patch
  23. +32
    -0
      net/haproxy/patches/0018-BUILD-log-iovec-requires-to-include-sys-uio.h-on-Ope.patch
  24. +32
    -0
      net/haproxy/patches/0019-BUILD-tcp-do-not-include-netinet-ip.h-for-IP_TTL.patch
  25. +48
    -0
      net/haproxy/patches/0020-BUILD-checks-remove-the-last-strcat-and-eliminate-a-.patch
  26. +39
    -0
      net/haproxy/patches/0021-BUILD-poll-remove-unused-hap_fd_isset-which-causes-a.patch
  27. +48
    -0
      net/haproxy/patches/0022-MINOR-cfgparse-few-memory-leaks-fixes.patch
  28. +33
    -0
      net/haproxy/patches/0023-MINOR-build-Allow-linking-to-device-atlas-library-fi.patch
  29. +32
    -0
      net/haproxy/patches/0024-DOC-Fix-typo-in-description-of-st-parameter-in-man-p.patch
  30. +39
    -0
      net/haproxy/patches/0025-BUG-MEDIUM-peers-on-shutdown-wake-up-the-appctx-not-.patch
  31. +64
    -0
      net/haproxy/patches/0026-BUG-MEDIUM-peers-fix-use-after-free-in-peer_session_.patch

+ 53
- 16
net/haproxy/Makefile View File

@ -1,6 +1,6 @@
#
# Copyright (C) 2010-2013 OpenWrt.org
# Copyright (C) 2009-2014 Thomas Heil <heil@terminal-consulting.de>
# Copyright (C) 2010-2016 OpenWrt.org
# Copyright (C) 2009-2016 Thomas Heil <heil@terminal-consulting.de>
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
@ -9,14 +9,16 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=haproxy
PKG_VERSION:=1.5.18
PKG_RELEASE:=04
PKG_VERSION:=1.6.9
PKG_RELEASE:=26
PKG_SOURCE:=haproxy-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://haproxy.1wt.eu/download/1.5/src/
PKG_SOURCE_URL:=http://haproxy.1wt.eu/download/1.6/src/
PKG_MD5SUM:=c52eee40eb66f290d6f089c339b9d2b3
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
PKG_MD5SUM:=21d35f114583ef731bc96af05b46c75a
PKG_MAINTAINER:=Thomas Heil <heil@terminal-consulting.de>
PKG_LICENSE:=GPL-2.0
MAINTAINER:=Thomas Heil <heil@terminal-consulting.de>
include $(INCLUDE_DIR)/package.mk
@ -28,6 +30,18 @@ define Package/haproxy/Default
URL:=http://haproxy.1wt.eu/
endef
define Download/lua533
FILE:=lua-5.3.3.tar.gz
URL:=http://www.lua.org/ftp/
MD5SUM:=703f75caa4fdf4a911c1a72e67a27498
endef
define Build/Prepare
$(call Build/Prepare/Default)
tar -zxvf $(DL_DIR)/lua-5.3.3.tar.gz -C $(PKG_BUILD_DIR)
ln -s $(PKG_BUILD_DIR)/lua-5.3.3 $(PKG_BUILD_DIR)/lua
endef
define Package/haproxy/Default/conffiles
/etc/haproxy.cfg
endef
@ -49,7 +63,7 @@ endef
define Package/haproxy/description
$(call Package/haproxy/Default/description)
This package is built with SSL support.
This package is built with SSL and LUA support.
endef
define Package/haproxy-nossl
@ -76,28 +90,48 @@ else
endif
ifeq ($(BUILD_VARIANT),ssl)
USE_OPENSSL=USE_OPENSSL=1
ADDON+=USE_OPENSSL=1
ADDON+=USE_LUA=1
ADDON+=LUA_LIB_NAME="lua533"
ADDON+=LUA_INC="$(STAGING_DIR)/lua-5.3.3/include"
ADDON+=LUA_LIB="$(STAGING_DIR)/lua-5.3.3/lib"
ADDON+=ADDLIB="-lcrypto -lm"
else
USE_OPENSSL=
ADDON:=USE_OPENSSL=0
ADDON+=ADDLIB="-lm"
endif
define Build/Compile
make TARGET=$(LINUX_TARGET) -C $(PKG_BUILD_DIR)/lua INSTALL_TOP="$(STAGING_DIR)/lua-5.3.3/" linux install
mv $(STAGING_DIR)/lua-5.3.3/lib/liblua.a $(STAGING_DIR)/lua-5.3.3/lib/liblua533.a
$(MAKE) TARGET=$(LINUX_TARGET) -C $(PKG_BUILD_DIR) \
DESTDIR="$(PKG_INSTALL_DIR)" \
CC="$(TARGET_CC)" \
CFLAGS="$(TARGET_CFLAGS) -fno-align-jumps -fno-align-functions -fno-align-labels -fno-align-loops -pipe -fomit-frame-pointer -fhonour-copts" \
LD="$(TARGET_CC)" \
LDFLAGS="$(TARGET_LDFLAGS)" \
PCREDIR="$(STAGING_DIR)/usr" \
$(LUA)
PCREDIR="$(STAGING_DIR)/usr/include" \
SMALL_OPTS="-DBUFSIZE=16384 -DMAXREWRITE=1030 -DSYSTEM_MAXCONN=165530 " \
USE_LINUX_TPROXY=1 USE_LINUX_SPLICE=1 USE_REGPARM=1 $(USE_OPENSSL) \
USE_LINUX_TPROXY=1 USE_LINUX_SPLICE=1 USE_REGPARM=1 USE_OPENSSL=1 \
USE_ZLIB=yes USE_PCRE=1 \
VERSION="$(PKG_VERSION)-patch$(PKG_RELEASE)" \
IGNOREGIT=1
$(MAKE) TARGET=$(LINUX_TARGET) -C $(PKG_BUILD_DIR) \
DESTDIR="$(PKG_INSTALL_DIR)" \
install
$(MAKE) -C $(PKG_BUILD_DIR)/contrib/halog \
CC="$(TARGET_CC) $(TARGET_CFLAGS) $(TARGET_LDFLAGS)" \
OPTIMIZE="" \
DESTDIR="$(PKG_INSTALL_DIR)" \
CC="$(TARGET_CC)" \
CFLAGS="$(TARGET_CFLAGS) -fno-align-jumps -fno-align-functions -fno-align-labels -fno-align-loops -pipe -fomit-frame-pointer -fhonour-copts" \
LD="$(TARGET_CC)" \
LDFLAGS="$(TARGET_LDFLAGS)" \
ADDLIB="-lcrypto" \
VERSION="$(PKG_VERSION)-patch$(PKG_RELEASE)" \
halog
endef
@ -114,9 +148,10 @@ endef
Package/haproxy-nossl/install = $(Package/haproxy/install)
define Package/halog
MENU:=1
$(call Package/haproxy/Default)
$(call Package/haproxy)
TITLE+= halog
DEPENDS:=haproxy
endef
@ -130,6 +165,8 @@ define Package/halog/install
$(INSTALL_BIN) $(PKG_BUILD_DIR)/contrib/halog/halog $(1)/usr/bin/
endef
$(eval $(call BuildPackage,haproxy-nossl))
$(eval $(call Download,lua533))
$(eval $(call BuildPackage,haproxy))
$(eval $(call BuildPackage,halog))
$(eval $(call BuildPackage,haproxy-nossl))

+ 0
- 131
net/haproxy/patches/0001-BUG-MAJOR-fix-listening-IP-address-storage-for-front.patch View File

@ -1,131 +0,0 @@
From a72d39058a7a5d004e0c6b69a91663591bb3bf89 Mon Sep 17 00:00:00 2001
From: Vincent Bernat <vincent@bernat.im>
Date: Thu, 19 May 2016 11:15:51 +0200
Subject: [PATCH 1/4] BUG/MAJOR: fix listening IP address storage for frontends
When compiled with GCC 6, the IP address specified for a frontend was
ignored and HAProxy was listening on all addresses instead. This is
caused by an incomplete copy of a "struct sockaddr_storage".
With the GNU Libc, "struct sockaddr_storage" is defined as this:
struct sockaddr_storage
{
sa_family_t ss_family;
unsigned long int __ss_align;
char __ss_padding[(128 - (2 * sizeof (unsigned long int)))];
};
Doing an aggregate copy (ss1 = ss2) is different than using memcpy():
only members of the aggregate have to be copied. Notably, padding can be
or not be copied. In GCC 6, some optimizations use this fact and if a
"struct sockaddr_storage" contains a "struct sockaddr_in", the port and
the address are part of the padding (between sa_family and __ss_align)
and can be not copied over.
Therefore, we replace any aggregate copy by a memcpy(). There is another
place using the same pattern. We also fix a function receiving a "struct
sockaddr_storage" by copy instead of by reference. Since it only needs a
read-only copy, the function is converted to request a reference.
This is a backport for 1.5 of 6e6158 and 6e46ff1.
---
src/cfgparse.c | 4 ++--
src/connection.c | 2 +-
src/proto_http.c | 12 ++++++------
src/proto_tcp.c | 2 +-
4 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/src/cfgparse.c b/src/cfgparse.c
index 39abf6b..9331415 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -280,7 +280,7 @@ int str2listener(char *str, struct proxy *curproxy, struct bind_conf *bind_conf,
}
/* OK the address looks correct */
- ss = *ss2;
+ memcpy(&ss, ss2, sizeof(ss));
for (; port <= end; port++) {
l = (struct listener *)calloc(1, sizeof(struct listener));
@@ -291,7 +291,7 @@ int str2listener(char *str, struct proxy *curproxy, struct bind_conf *bind_conf,
l->bind_conf = bind_conf;
l->fd = fd;
- l->addr = ss;
+ memcpy(&l->addr, &ss, sizeof(ss));
l->xprt = &raw_sock;
l->state = LI_INIT;
diff --git a/src/connection.c b/src/connection.c
index dab1c90..09fd04e 100644
--- a/src/connection.c
+++ b/src/connection.c
@@ -620,7 +620,7 @@ int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connec
const char pp2_signature[] = PP2_SIGNATURE;
int ret = 0;
struct proxy_hdr_v2 *hdr = (struct proxy_hdr_v2 *)buf;
- struct sockaddr_storage null_addr = {0};
+ struct sockaddr_storage null_addr = { .ss_family = 0 };
struct sockaddr_storage *src = &null_addr;
struct sockaddr_storage *dst = &null_addr;
#ifdef USE_OPENSSL
diff --git a/src/proto_http.c b/src/proto_http.c
index b3aa4d8..0b13c5e 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -3220,15 +3220,15 @@ int http_handle_stats(struct session *s, struct channel *req)
/* Sets the TOS header in IPv4 and the traffic class header in IPv6 packets
* (as per RFC3260 #4 and BCP37 #4.2 and #5.2).
*/
-static inline void inet_set_tos(int fd, struct sockaddr_storage from, int tos)
+static inline void inet_set_tos(int fd, struct sockaddr_storage *from, int tos)
{
#ifdef IP_TOS
- if (from.ss_family == AF_INET)
+ if (from->ss_family == AF_INET)
setsockopt(fd, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
#endif
#ifdef IPV6_TCLASS
- if (from.ss_family == AF_INET6) {
- if (IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&from)->sin6_addr))
+ if (from->ss_family == AF_INET6) {
+ if (IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)from)->sin6_addr))
/* v4-mapped addresses need IP_TOS */
setsockopt(fd, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
else
@@ -3366,7 +3366,7 @@ http_req_get_intercept_rule(struct proxy *px, struct list *rules, struct session
case HTTP_REQ_ACT_SET_TOS:
if ((cli_conn = objt_conn(s->req->prod->end)) && conn_ctrl_ready(cli_conn))
- inet_set_tos(cli_conn->t.sock.fd, cli_conn->addr.from, rule->arg.tos);
+ inet_set_tos(cli_conn->t.sock.fd, &cli_conn->addr.from, rule->arg.tos);
break;
case HTTP_REQ_ACT_SET_MARK:
@@ -3563,7 +3563,7 @@ http_res_get_intercept_rule(struct proxy *px, struct list *rules, struct session
case HTTP_RES_ACT_SET_TOS:
if ((cli_conn = objt_conn(s->req->prod->end)) && conn_ctrl_ready(cli_conn))
- inet_set_tos(cli_conn->t.sock.fd, cli_conn->addr.from, rule->arg.tos);
+ inet_set_tos(cli_conn->t.sock.fd, &cli_conn->addr.from, rule->arg.tos);
break;
case HTTP_RES_ACT_SET_MARK:
diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index cfa62f7..8c06441 100644
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -394,7 +394,7 @@ int tcp_connect_server(struct connection *conn, int data, int delack)
struct sockaddr_storage sa;
ret = 1;
- sa = src->source_addr;
+ memcpy(&sa, &src->source_addr, sizeof(sa));
do {
/* note: in case of retry, we may have to release a previously
--
2.7.3

+ 53
- 0
net/haproxy/patches/0001-BUG-MINOR-Fix-OSX-compilation-errors.patch View File

@ -0,0 +1,53 @@
From 42ccea00f69abdd1bb748494f7e17d8369ccae31 Mon Sep 17 00:00:00 2001
From: Dinko Korunic <dinko.korunic@gmail.com>
Date: Fri, 9 Sep 2016 09:41:15 +0200
Subject: [PATCH 01/26] BUG/MINOR: Fix OSX compilation errors
SOL_IPV6 is not defined on OSX, breaking the compile. Also libcrypt is
not available for installation neither in Macports nor as a Brew recipe,
so we're disabling implicit dependancy.
Signed-off-by: Dinko Korunic <dinko.korunic@gmail.com>
(cherry picked from commit 7276f3aa3d687fca64bb9becc66c8e0dbb8b378a)
---
Makefile | 1 -
src/proto_tcp.c | 4 ++--
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/Makefile b/Makefile
index 1bf778d..1d0f2bc 100644
--- a/Makefile
+++ b/Makefile
@@ -301,7 +301,6 @@ ifeq ($(TARGET),osx)
USE_POLL = implicit
USE_KQUEUE = implicit
USE_TPROXY = implicit
- USE_LIBCRYPT = implicit
else
ifeq ($(TARGET),openbsd)
# This is for OpenBSD >= 3.0
diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index 2c81fb4..4f5d88d 100644
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -206,7 +206,7 @@ int tcp_bind_socket(int fd, int flags, struct sockaddr_storage *local, struct so
case AF_INET6:
if (flags && ip6_transp_working) {
if (0
-#if defined(IPV6_TRANSPARENT)
+#if defined(IPV6_TRANSPARENT) && defined(SOL_IPV6)
|| (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == 0)
#endif
#if defined(IP_FREEBIND)
@@ -854,7 +854,7 @@ int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
break;
case AF_INET6:
if (1
-#if defined(IPV6_TRANSPARENT)
+#if defined(IPV6_TRANSPARENT) && defined(SOL_IPV6)
&& (setsockopt(fd, SOL_IPV6, IPV6_TRANSPARENT, &one, sizeof(one)) == -1)
#endif
#if defined(IP_FREEBIND)
--
2.7.3

+ 31
- 0
net/haproxy/patches/0002-BUG-MINOR-displayed-PCRE-version-is-running-release.patch View File

@ -0,0 +1,31 @@
From 3a011f15a8d61cd0088cc0e46743bdc7699db1af Mon Sep 17 00:00:00 2001
From: Lukas Tribus <luky-37@hotmail.com>
Date: Mon, 12 Sep 2016 21:42:00 +0000
Subject: [PATCH 02/26] BUG/MINOR: displayed PCRE version is running release
pcre_version() returns the running PCRE release, not the release
haproxy was built with.
This simple string fix should be backported to supported releases,
as the output may be confusing.
(cherry picked from commit d64788d9c610163756cac6c91220875e51cba3ef)
---
src/haproxy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/haproxy.c b/src/haproxy.c
index d70cf63..44d32b9 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -347,7 +347,7 @@ void display_build_opts()
#endif
#ifdef USE_PCRE
- printf("Built with PCRE version : %s", pcre_version());
+ printf("Running on PCRE version : %s", pcre_version());
printf("\nPCRE library supports JIT : ");
#ifdef USE_PCRE_JIT
{
--
2.7.3

+ 0
- 39
net/haproxy/patches/0002-CLEANUP-connection-fix-double-negation-on-memcmp.patch View File

@ -1,39 +0,0 @@
From fab41521192c6f62f0284faf53d6ad40955ef3db Mon Sep 17 00:00:00 2001
From: David CARLIER <devnexen@gmail.com>
Date: Thu, 24 Mar 2016 09:22:36 +0000
Subject: [PATCH 2/4] CLEANUP: connection: fix double negation on memcmp()
Nothing harmful in here, just clarify that it applies to the whole
expression.
(cherry picked from commit 42ff05e2d3d10e8a1e070e66e8883c5eabe196d7)
(cherry picked from commit c4809151b4c9ccc312cb451e99fd556e867242fc)
---
src/connection.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/connection.c b/src/connection.c
index 09fd04e..af18878 100644
--- a/src/connection.c
+++ b/src/connection.c
@@ -289,7 +289,7 @@ int conn_recv_proxy(struct connection *conn, int flag)
if (trash.len < 9) /* shortest possible line */
goto missing;
- if (!memcmp(line, "TCP4 ", 5) != 0) {
+ if (memcmp(line, "TCP4 ", 5) == 0) {
u32 src3, dst3, sport, dport;
line += 5;
@@ -330,7 +330,7 @@ int conn_recv_proxy(struct connection *conn, int flag)
((struct sockaddr_in *)&conn->addr.to)->sin_port = htons(dport);
conn->flags |= CO_FL_ADDR_FROM_SET | CO_FL_ADDR_TO_SET;
}
- else if (!memcmp(line, "TCP6 ", 5) != 0) {
+ else if (memcmp(line, "TCP6 ", 5) == 0) {
u32 sport, dport;
char *src_s;
char *dst_s, *sport_s, *dport_s;
--
2.7.3

+ 0
- 52
net/haproxy/patches/0003-BUG-MEDIUM-sticktables-segfault-in-some-configuratio.patch View File

@ -1,52 +0,0 @@
From 294c8d2f81847e0e2d26aa0700564ac2f6aaffa6 Mon Sep 17 00:00:00 2001
From: Thierry Fournier <thierry.fournier@ozon.io>
Date: Mon, 6 Jun 2016 18:28:05 +0200
Subject: [PATCH 3/4] BUG/MEDIUM: sticktables: segfault in some configuration
error cases
When a stick table is tracked, and another one is used later on the
configuration, a segfault occurs.
The function "smp_create_src_stkctr" can return a NULL value, and
its value is not tested, so one other function try to dereference
a NULL pointer. This patch just add a verification of the NULL
pointer.
The problem is reproduced with this configuration:
listen www
mode http
bind :12345
tcp-request content track-sc0 src table IPv4
http-request allow if { sc0_inc_gpc0(IPv6) gt 0 }
server dummy 127.0.0.1:80
backend IPv4
stick-table type ip size 10 expire 60s store gpc0
backend IPv6
stick-table type ipv6 size 10 expire 60s store gpc0
Thank to kabefuna@gmail.com for the bug report.
This patch must be backported in the 1.6 and 1.5 version.
(cherry picked from commit 6fc340ff07171bb85d11d835fa4158bbdef240a0)
(cherry picked from commit 4693e2302271252044038c9be38487fb16218e5b)
---
src/session.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/session.c b/src/session.c
index 4e84803..fbd5094 100644
--- a/src/session.c
+++ b/src/session.c
@@ -2908,7 +2908,7 @@ smp_fetch_sc_inc_gpc0(struct proxy *px, struct session *l4, void *l7, unsigned i
smp->flags = SMP_F_VOL_TEST;
smp->type = SMP_T_UINT;
smp->data.uint = 0;
- if (stkctr_entry(stkctr) != NULL) {
+ if (stkctr && stkctr_entry(stkctr)) {
void *ptr;
/* First, update gpc0_rate if it's tracked. Second, update its
--
2.7.3

+ 49
- 0
net/haproxy/patches/0003-MINOR-show-Built-with-PCRE-version.patch View File

@ -0,0 +1,49 @@
From dcdd2ae7d6809f45c5f6bbe2ba6fe9c70802bb42 Mon Sep 17 00:00:00 2001
From: Lukas Tribus <luky-37@hotmail.com>
Date: Mon, 12 Sep 2016 21:42:07 +0000
Subject: [PATCH 03/26] MINOR: show Built with PCRE version
Inspired by PCRE's pcre_version.c and improved with Willy's
suggestions. Reusable parts have been added to
include/common/standard.h.
(cherry picked from commit dcbc5c5ecf6506b5ad55b98bbec910b29f011f14)
---
include/common/standard.h | 9 +++++++++
src/haproxy.c | 3 +++
2 files changed, 12 insertions(+)
diff --git a/include/common/standard.h b/include/common/standard.h
index 6098550..26a52ff 100644
--- a/include/common/standard.h
+++ b/include/common/standard.h
@@ -1065,4 +1065,13 @@ static inline void *my_realloc2(void *ptr, size_t size)
return ret;
}
+/* HAP_STRING() makes a string from a literal while HAP_XSTRING() first
+ * evaluates the argument and is suited to pass macros.
+ *
+ * They allow macros like PCRE_MAJOR to be defined without quotes, which
+ * is convenient for applications that want to test its value.
+ */
+#define HAP_STRING(...) #__VA_ARGS__
+#define HAP_XSTRING(...) HAP_STRING(__VA_ARGS__)
+
#endif /* _COMMON_STANDARD_H */
diff --git a/src/haproxy.c b/src/haproxy.c
index 44d32b9..37d700b 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -347,6 +347,9 @@ void display_build_opts()
#endif
#ifdef USE_PCRE
+ printf("Built with PCRE version : %s\n", (HAP_XSTRING(Z PCRE_PRERELEASE)[1] == 0)?
+ HAP_XSTRING(PCRE_MAJOR.PCRE_MINOR PCRE_DATE) :
+ HAP_XSTRING(PCRE_MAJOR.PCRE_MINOR) HAP_XSTRING(PCRE_PRERELEASE PCRE_DATE));
printf("Running on PCRE version : %s", pcre_version());
printf("\nPCRE library supports JIT : ");
#ifdef USE_PCRE_JIT
--
2.7.3

+ 0
- 32
net/haproxy/patches/0004-BUG-MINOR-http-add-header-header-name-copied-twice.patch View File

@ -1,32 +0,0 @@
From cba3bd6e5ce9b0be83c701c3c7a103d01d5b516d Mon Sep 17 00:00:00 2001
From: Thierry Fournier <thierry.fournier@ozon.io>
Date: Wed, 1 Jun 2016 13:36:20 +0200
Subject: [PATCH 4/4] BUG/MINOR: http: add-header: header name copied twice
The header name is copied two time in the buffer. The first copy is a printf-like
function writing the name and the http separators in the buffer, and the second
form is a memcopy. This seems to be inherited from some changes. This patch
removes the printf like, format.
This patch must be backported in 1.6 and 1.5 versions
(cherry picked from commit 53c1a9b7cb8f3fe79b5492218363b6c0ff608fc1)
(cherry picked from commit d281d68d3aa010f7e1a635c92ab486f7f2c666b9)
---
src/proto_http.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/src/proto_http.c b/src/proto_http.c
index 0b13c5e..8801592 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -3399,7 +3399,6 @@ http_req_get_intercept_rule(struct proxy *px, struct list *rules, struct session
case HTTP_REQ_ACT_SET_HDR:
case HTTP_REQ_ACT_ADD_HDR:
- chunk_printf(&trash, "%s: ", rule->arg.hdr_add.name);
memcpy(trash.str, rule->arg.hdr_add.name, rule->arg.hdr_add.name_len);
trash.len = rule->arg.hdr_add.name_len;
trash.str[trash.len++] = ':';
--
2.7.3

+ 25
- 0
net/haproxy/patches/0004-MINOR-show-Running-on-zlib-version.patch View File

@ -0,0 +1,25 @@
From 9d59ff222cc81ee356594cfa780349dd91376fd9 Mon Sep 17 00:00:00 2001
From: Lukas Tribus <luky-37@hotmail.com>
Date: Mon, 12 Sep 2016 21:42:14 +0000
Subject: [PATCH 04/26] MINOR: show Running on zlib version
(cherry picked from commit 255cc5184dc8483e4377d9de25670bd6e226cdba)
---
src/haproxy.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/haproxy.c b/src/haproxy.c
index 37d700b..9f5878a 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -287,6 +287,7 @@ void display_build_opts()
#ifdef USE_ZLIB
printf("Built with zlib version : " ZLIB_VERSION "\n");
+ printf("Running on zlib version : %s\n", zlibVersion());
#elif defined(USE_SLZ)
printf("Built with libslz for stateless compression.\n");
#else /* USE_ZLIB */
--
2.7.3

+ 66
- 0
net/haproxy/patches/0005-MINOR-Add-fe_req_rate-sample-fetch.patch View File

@ -0,0 +1,66 @@
From 7397526d0c80251b3006b1b45af754f5ad7adb76 Mon Sep 17 00:00:00 2001
From: Nenad Merdanovic <nmerdan@anine.io>
Date: Mon, 3 Oct 2016 04:57:37 +0200
Subject: [PATCH 05/26] MINOR: Add fe_req_rate sample fetch
The fe_req_rate is similar to fe_sess_rate, but fetches the number
of HTTP requests per second instead of connections/sessions per second.
Signed-off-by: Nenad Merdanovic <nmerdan@anine.io>
(cherry picked from commit ad9a7e9770e673a70fb56ab95be18bf88666d92a)
---
doc/configuration.txt | 5 +++++
src/frontend.c | 14 ++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/doc/configuration.txt b/doc/configuration.txt
index d4b1744..d18c399 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -12253,6 +12253,11 @@ fe_conn([<frontend>]) : integer
statistics to servers in HTTP headers. See also the "dst_conn", "be_conn",
"fe_sess_rate" fetches.
+fe_req_rate([<frontend>]) : integer
+ Returns an integer value corresponding to the number of HTTP requests per
+ second sent to a frontend. This number can differ from "fe_sess_rate" in
+ situations where client-side keep-alive is enabled.
+
fe_sess_rate([<frontend>]) : integer
Returns an integer value corresponding to the sessions creation rate on the
frontend, in number of new sessions per second. This is used with ACLs to
diff --git a/src/frontend.c b/src/frontend.c
index 74ec0ab..5cc6202 100644
--- a/src/frontend.c
+++ b/src/frontend.c
@@ -167,6 +167,19 @@ smp_fetch_fe_id(const struct arg *args, struct sample *smp, const char *kw, void
return 1;
}
+/* set temp integer to the number of HTTP requests per second reaching the frontend.
+ * Accepts exactly 1 argument. Argument is a frontend, other types will cause
+ * an undefined behaviour.
+ */
+static int
+smp_fetch_fe_req_rate(const struct arg *args, struct sample *smp, const char *kw, void *private)
+{
+ smp->flags = SMP_F_VOL_TEST;
+ smp->data.type = SMP_T_SINT;
+ smp->data.u.sint = read_freq_ctr(&args->data.prx->fe_req_per_sec);
+ return 1;
+}
+
/* set temp integer to the number of connections per second reaching the frontend.
* Accepts exactly 1 argument. Argument is a frontend, other types will cause
* an undefined behaviour.
@@ -200,6 +213,7 @@ smp_fetch_fe_conn(const struct arg *args, struct sample *smp, const char *kw, vo
static struct sample_fetch_kw_list smp_kws = {ILH, {
{ "fe_conn", smp_fetch_fe_conn, ARG1(1,FE), NULL, SMP_T_SINT, SMP_USE_INTRN, },
{ "fe_id", smp_fetch_fe_id, 0, NULL, SMP_T_SINT, SMP_USE_FTEND, },
+ { "fe_req_rate", smp_fetch_fe_req_rate, ARG1(1,FE), NULL, SMP_T_SINT, SMP_USE_INTRN, },
{ "fe_sess_rate", smp_fetch_fe_sess_rate, ARG1(1,FE), NULL, SMP_T_SINT, SMP_USE_INTRN, },
{ /* END */ },
}};
--
2.7.3

+ 134
- 0
net/haproxy/patches/0006-MEDIUM-make-SO_REUSEPORT-configurable.patch View File

@ -0,0 +1,134 @@
From 3dd981c016ac7ad636ee546c2b9b685f7e8500d4 Mon Sep 17 00:00:00 2001
From: Lukas Tribus <luky-37@hotmail.com>
Date: Mon, 12 Sep 2016 21:42:20 +0000
Subject: [PATCH 06/26] MEDIUM: make SO_REUSEPORT configurable
With Linux officially introducing SO_REUSEPORT support in 3.9 and
its mainstream adoption we have seen more people running into strange
SO_REUSEPORT related issues (a process management issue turning into
hard to diagnose problems because the kernel load-balances between the
new and an obsolete haproxy instance).
Also some people simply want the guarantee that the bind fails when
the old process is still bound.
This change makes SO_REUSEPORT configurable, introducing the command
line argument "-dR" and the noreuseport configuration directive.
A backport to 1.6 should be considered.
(cherry picked from commit a0bcbdcb04d52c3ca71045f90aac33d9dd7965bf)
---
doc/configuration.txt | 5 +++++
include/types/global.h | 1 +
src/cfgparse.c | 5 +++++
src/haproxy.c | 10 ++++++++++
src/proto_tcp.c | 6 +++---
5 files changed, 24 insertions(+), 3 deletions(-)
diff --git a/doc/configuration.txt b/doc/configuration.txt
index d18c399..e725ce2 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -570,6 +570,7 @@ The following keywords are supported in the "global" section :
- nopoll
- nosplice
- nogetaddrinfo
+ - noreuseport
- spread-checks
- server-state-base
- server-state-file
@@ -1090,6 +1091,10 @@ nogetaddrinfo
Disables the use of getaddrinfo(3) for name resolving. It is equivalent to
the command line argument "-dG". Deprecated gethostbyname(3) will be used.
+noreuseport
+ Disables the use of SO_REUSEPORT - see socket(7). It is equivalent to the
+ command line argument "-dR".
+
spread-checks <0..50, in percent>
Sometimes it is desirable to avoid sending agent and health checks to
servers at exact intervals, for instance when many logical servers are
diff --git a/include/types/global.h b/include/types/global.h
index 61f0391..2e24d3f 100644
--- a/include/types/global.h
+++ b/include/types/global.h
@@ -63,6 +63,7 @@
/* platform-specific options */
#define GTUNE_USE_SPLICE (1<<4)
#define GTUNE_USE_GAI (1<<5)
+#define GTUNE_USE_REUSEPORT (1<<6)
/* Access level for a stats socket */
#define ACCESS_LVL_NONE 0
diff --git a/src/cfgparse.c b/src/cfgparse.c
index 55086fd..f2a104d 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -662,6 +662,11 @@ int cfg_parse_global(const char *file, int linenum, char **args, int kwm)
goto out;
global.tune.options &= ~GTUNE_USE_GAI;
}
+ else if (!strcmp(args[0], "noreuseport")) {
+ if (alertif_too_many_args(0, file, linenum, args, &err_code))
+ goto out;
+ global.tune.options &= ~GTUNE_USE_REUSEPORT;
+ }
else if (!strcmp(args[0], "quiet")) {
if (alertif_too_many_args(0, file, linenum, args, &err_code))
goto out;
diff --git a/src/haproxy.c b/src/haproxy.c
index 9f5878a..a657dc4 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -452,6 +452,9 @@ void usage(char *name)
#if defined(USE_GETADDRINFO)
" -dG disables getaddrinfo() usage\n"
#endif
+#if defined(SO_REUSEPORT)
+ " -dR disables SO_REUSEPORT usage\n"
+#endif
" -dV disables SSL verify on servers side\n"
" -sf/-st [pid ]* finishes/terminates old pids.\n"
"\n",
@@ -623,6 +626,9 @@ void init(int argc, char **argv)
#if defined(USE_GETADDRINFO)
global.tune.options |= GTUNE_USE_GAI;
#endif
+#if defined(SO_REUSEPORT)
+ global.tune.options |= GTUNE_USE_REUSEPORT;
+#endif
pid = getpid();
progname = *argv;
@@ -666,6 +672,10 @@ void init(int argc, char **argv)
else if (*flag == 'd' && flag[1] == 'G')
global.tune.options &= ~GTUNE_USE_GAI;
#endif
+#if defined(SO_REUSEPORT)
+ else if (*flag == 'd' && flag[1] == 'R')
+ global.tune.options &= ~GTUNE_USE_REUSEPORT;
+#endif
else if (*flag == 'd' && flag[1] == 'V')
global.ssl_server_verify = SSL_SERVER_VERIFY_NONE;
else if (*flag == 'V')
diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index 4f5d88d..0f20fde 100644
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -824,10 +824,10 @@ int tcp_bind_listener(struct listener *listener, char *errmsg, int errlen)
setsockopt(fd, SOL_SOCKET, SO_LINGER, &nolinger, sizeof(struct linger));
#ifdef SO_REUSEPORT
- /* OpenBSD supports this. As it's present in old libc versions of Linux,
- * it might return an error that we will silently ignore.
+ /* OpenBSD and Linux 3.9 support this. As it's present in old libc versions of
+ * Linux, it might return an error that we will silently ignore.
*/
- if (!ext)
+ if (!ext && (global.tune.options & GTUNE_USE_REUSEPORT))
setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
#endif
--
2.7.3

+ 29
- 0
net/haproxy/patches/0007-BUG-MINOR-vars-use-sess-and-not-s-sess-in-action_sto.patch View File

@ -0,0 +1,29 @@
From 21877a43afd6300518140c415ccec2dba0a0591f Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Fri, 21 Oct 2016 17:13:24 +0200
Subject: [PATCH 07/26] BUG/MINOR: vars: use sess and not s->sess in
action_store()
This causes the stream to be dereferenced when not needed. It will
cause trouble when variables are used outside of a stream.
(cherry picked from commit 108a8fd8be0c78a4bf147a2028fd9bda3343c93c)
---
src/vars.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/vars.c b/src/vars.c
index 56fade5..b22c3bf 100644
--- a/src/vars.c
+++ b/src/vars.c
@@ -507,7 +507,7 @@ static enum act_return action_store(struct act_rule *rule, struct proxy *px,
/* Process the expression. */
memset(&smp, 0, sizeof(smp));
- if (!sample_process(px, s->sess, s, dir|SMP_OPT_FINAL,
+ if (!sample_process(px, sess, s, dir|SMP_OPT_FINAL,
rule->arg.vars.expr, &smp))
return ACT_RET_CONT;
--
2.7.3

+ 47
- 0
net/haproxy/patches/0008-BUG-MINOR-vars-make-smp_fetch_var-more-robust-agains.patch View File

@ -0,0 +1,47 @@
From ff403602edc917b8bef2062dc0d5dec2017e3232 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Fri, 21 Oct 2016 17:14:35 +0200
Subject: [PATCH 08/26] BUG/MINOR: vars: make smp_fetch_var() more robust
against misuses
smp_fetch_var() may be called from everywhere since it just reads a
variable. It must ensure that the stream exists before trying to return
a stream-dependant variable. For now there is no impact but it will
cause trouble with tcp-request session rules.
(cherry picked from commit 7513d001c8a6b7d1cf8e7d5469942cd39d6e8160)
---
src/vars.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/src/vars.c b/src/vars.c
index b22c3bf..4a0c4ed 100644
--- a/src/vars.c
+++ b/src/vars.c
@@ -242,11 +242,21 @@ static int smp_fetch_var(const struct arg *args, struct sample *smp, const char
/* Check the availibity of the variable. */
switch (var_desc->scope) {
- case SCOPE_SESS: vars = &smp->sess->vars; break;
- case SCOPE_TXN: vars = &smp->strm->vars_txn; break;
+ case SCOPE_SESS:
+ vars = &smp->sess->vars;
+ break;
+ case SCOPE_TXN:
+ if (!smp->strm)
+ return 0;
+ vars = &smp->strm->vars_txn;
+ break;
case SCOPE_REQ:
case SCOPE_RES:
- default: vars = &smp->strm->vars_reqres; break;
+ default:
+ if (!smp->strm)
+ return 0;
+ vars = &smp->strm->vars_reqres;
+ break;
}
if (vars->scope != var_desc->scope)
return 0;
--
2.7.3

+ 31
- 0
net/haproxy/patches/0009-BUG-MINOR-vars-smp_fetch_var-doesn-t-depend-on-HTTP-.patch View File

@ -0,0 +1,31 @@
From 3810ab9e71a19e7f04a9e18580abc77c276d0ff1 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Fri, 21 Oct 2016 17:17:18 +0200
Subject: [PATCH 09/26] BUG/MINOR: vars: smp_fetch_var() doesn't depend on HTTP
but on the session
Thus the SMP_USE_HTTP_ANY dependency is incorrect, we have to depend on
SMP_USE_L5_CLI (the session). It's particularly important for session-wide
variables which are kept across HTTP requests. For now there is no impact
but it will make a difference with tcp-request session rules.
(cherry picked from commit 87846e42a478fe2aa0fbc1e162ba5fb227be49b7)
---
src/vars.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/vars.c b/src/vars.c
index 4a0c4ed..a3dd85c 100644
--- a/src/vars.c
+++ b/src/vars.c
@@ -654,7 +654,7 @@ static int vars_max_size_reqres(char **args, int section_type, struct proxy *cur
static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
- { "var", smp_fetch_var, ARG1(1,STR), smp_check_var, SMP_T_STR, SMP_USE_HTTP_ANY },
+ { "var", smp_fetch_var, ARG1(1,STR), smp_check_var, SMP_T_STR, SMP_USE_L5CLI },
{ /* END */ },
}};
--
2.7.3

+ 29
- 0
net/haproxy/patches/0010-BUG-MINOR-ssl-Check-malloc-return-code.patch View File

@ -0,0 +1,29 @@
From 2d7ed4ae91383cd35fe07cd34d01c23b4a5d03f5 Mon Sep 17 00:00:00 2001
From: "Thierry FOURNIER / OZON.IO" <thierry.fournier@ozon.io>
Date: Thu, 6 Oct 2016 10:35:29 +0200
Subject: [PATCH 10/26] BUG/MINOR: ssl: Check malloc return code
If malloc() can't allocate memory and return NULL, a segfaut will raises.
This patch should be backported in the 1.6 and 1.5 version.
(cherry picked from commit 7a3bd3b9dc43509bb1869389dcf91e35c0155f9b)
---
src/ssl_sock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 0535a3b..5f9a203 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1572,6 +1572,8 @@ static int ssl_sock_add_cert_sni(SSL_CTX *ctx, struct bind_conf *s, char *name,
int j, len;
len = strlen(name);
sc = malloc(sizeof(struct sni_ctx) + len + 1);
+ if (!sc)
+ return order;
for (j = 0; j < len; j++)
sc->name.key[j] = tolower(name[j]);
sc->name.key[len] = 0;
--
2.7.3

+ 70
- 0
net/haproxy/patches/0011-BUG-MINOR-ssl-prevent-multiple-entries-for-the-same-.patch View File

@ -0,0 +1,70 @@
From b2b0eab46a8ae36f2dd49159e65c90c1089a0f96 Mon Sep 17 00:00:00 2001
From: "Thierry FOURNIER / OZON.IO" <thierry.fournier@ozon.io>
Date: Thu, 6 Oct 2016 10:56:48 +0200
Subject: [PATCH 11/26] BUG/MINOR: ssl: prevent multiple entries for the same
certificate
Today, the certificate are indexed int he SNI tree using their CN and the
list of thier AltNames. So, Some certificates have the same names in the
CN and one of the AltNames entries.
Typically Let's Encrypt duplicate the the DNS name in the CN and the
AltName.
This patch prevents the creation of identical entries in the trees. It
checks the same DNS name and the same SSL context.
If the same certificate is registered two time it will be duplicated.
This patch should be backported in the 1.6 and 1.5 version.
(cherry picked from commit 07c3d78c2c0693ee37db71c34723597638b6ab3f)
---
src/ssl_sock.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 5f9a203..ad8054d 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1556,6 +1556,7 @@ static int ssl_sock_add_cert_sni(SSL_CTX *ctx, struct bind_conf *s, char *name,
{
struct sni_ctx *sc;
int wild = 0, neg = 0;
+ struct ebmb_node *node;
if (*name == '!') {
neg = 1;
@@ -1571,12 +1572,27 @@ static int ssl_sock_add_cert_sni(SSL_CTX *ctx, struct bind_conf *s, char *name,
if (*name) {
int j, len;
len = strlen(name);
+ for (j = 0; j < len && j < trash.size; j++)
+ trash.str[j] = tolower(name[j]);
+ if (j >= trash.size)
+ return order;
+ trash.str[j] = 0;
+
+ /* Check for duplicates. */
+ if (wild)
+ node = ebst_lookup(&s->sni_w_ctx, trash.str);
+ else
+ node = ebst_lookup(&s->sni_ctx, trash.str);
+ for (; node; node = ebmb_next_dup(node)) {
+ sc = ebmb_entry(node, struct sni_ctx, name);
+ if (sc->ctx == ctx && sc->neg == neg)
+ return order;
+ }
+
sc = malloc(sizeof(struct sni_ctx) + len + 1);
if (!sc)
return order;
- for (j = 0; j < len; j++)
- sc->name.key[j] = tolower(name[j]);
- sc->name.key[len] = 0;
+ memcpy(sc->name.key, trash.str, len + 1);
sc->ctx = ctx;
sc->order = order++;
sc->neg = neg;
--
2.7.3

+ 31
- 0
net/haproxy/patches/0012-BUG-MINOR-systemd-make-the-wrapper-return-a-non-null.patch View File

@ -0,0 +1,31 @@
From 03c706d71e2d314670d2ebb4dfa48fd3b793b361 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Tue, 25 Oct 2016 15:50:47 +0200
Subject: [PATCH 12/26] BUG/MINOR: systemd: make the wrapper return a non-null
status code on error
When execv() fails to execute the haproxy executable, it's important to
return an error instead of pretending everything is cool. This fix should
be backported to 1.6 and 1.5 in order to improve the overall reliability
under systemd.
(cherry picked from commit 7643d09dca4d0eed97ba3c29d4f4fd1f037f96ae)
---
src/haproxy-systemd-wrapper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/haproxy-systemd-wrapper.c b/src/haproxy-systemd-wrapper.c
index d118ec6..a78e75b 100644
--- a/src/haproxy-systemd-wrapper.c
+++ b/src/haproxy-systemd-wrapper.c
@@ -94,7 +94,7 @@ static void spawn_haproxy(char **pid_strv, int nb_pid)
fprintf(stderr, "\n");
execv(argv[0], argv);
- exit(0);
+ exit(1);
}
}
--
2.7.3

+ 117
- 0
net/haproxy/patches/0013-BUG-MINOR-systemd-always-restore-signals-before-exec.patch View File

@ -0,0 +1,117 @@
From 7a7eada6f4ecfc54325a18cf20c3035994a901c4 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Tue, 25 Oct 2016 16:49:31 +0200
Subject: [PATCH 13/26] BUG/MINOR: systemd: always restore signals before
execve()
Since signals are inherited, we must restore them before calling execve()
and intercept them again after a failed execve(). In order to cleanly deal
with the SIGUSR2/SIGHUP loops where we re-exec the wrapper, we ignore these
two signals during a re-exec, and restore them to defaults when spawning
haproxy.
This should be backported to 1.6 and 1.5.
(cherry picked from commit 4351ea61fbddf88c960179d60b0e0f1b090f0b70)
---
src/haproxy-systemd-wrapper.c | 49 ++++++++++++++++++++++++++++++++++++-------
1 file changed, 41 insertions(+), 8 deletions(-)
diff --git a/src/haproxy-systemd-wrapper.c b/src/haproxy-systemd-wrapper.c
index a78e75b..84d2e17 100644
--- a/src/haproxy-systemd-wrapper.c
+++ b/src/haproxy-systemd-wrapper.c
@@ -28,6 +28,11 @@ static char *pid_file = "/run/haproxy.pid";
static int wrapper_argc;
static char **wrapper_argv;
+static void setup_signal_handler();
+static void pause_signal_handler();
+static void reset_signal_handler();
+
+
/* returns the path to the haproxy binary into <buffer>, whose size indicated
* in <buffer_size> must be at least 1 byte long.
*/
@@ -76,6 +81,8 @@ static void spawn_haproxy(char **pid_strv, int nb_pid)
char **argv = calloc(4 + main_argc + nb_pid + 1, sizeof(char *));
int i;
int argno = 0;
+
+ reset_signal_handler();
locate_haproxy(haproxy_bin, 512);
argv[argno++] = haproxy_bin;
for (i = 0; i < main_argc; ++i)
@@ -127,6 +134,34 @@ static void signal_handler(int signum)
caught_signal = signum;
}
+static void setup_signal_handler()
+{
+ struct sigaction sa;
+
+ memset(&sa, 0, sizeof(struct sigaction));
+ sa.sa_handler = &signal_handler;
+ sigaction(SIGUSR2, &sa, NULL);
+ sigaction(SIGHUP, &sa, NULL);
+ sigaction(SIGINT, &sa, NULL);
+ sigaction(SIGTERM, &sa, NULL);
+}
+
+static void pause_signal_handler()
+{
+ signal(SIGUSR2, SIG_IGN);
+ signal(SIGHUP, SIG_IGN);
+ signal(SIGINT, SIG_DFL);
+ signal(SIGTERM, SIG_DFL);
+}
+
+static void reset_signal_handler()
+{
+ signal(SIGUSR2, SIG_DFL);
+ signal(SIGHUP, SIG_DFL);
+ signal(SIGINT, SIG_DFL);
+ signal(SIGTERM, SIG_DFL);
+}
+
/* handles SIGUSR2 and SIGHUP only */
static void do_restart(int sig)
{
@@ -134,7 +169,11 @@ static void do_restart(int sig)
fprintf(stderr, SD_NOTICE "haproxy-systemd-wrapper: re-executing on %s.\n",
sig == SIGUSR2 ? "SIGUSR2" : "SIGHUP");
+ /* don't let the other process take one of those signals by accident */
+ pause_signal_handler();
execv(wrapper_argv[0], wrapper_argv);
+ /* failed, let's reinstall the signal handler and continue */
+ setup_signal_handler();
}
/* handles SIGTERM and SIGINT only */
@@ -168,7 +207,8 @@ static void init(int argc, char **argv)
int main(int argc, char **argv)
{
int status;
- struct sigaction sa;
+
+ setup_signal_handler();
wrapper_argc = argc;
wrapper_argv = argv;
@@ -176,13 +216,6 @@ int main(int argc, char **argv)
--argc; ++argv;
init(argc, argv);
- memset(&sa, 0, sizeof(struct sigaction));
- sa.sa_handler = &signal_handler;
- sigaction(SIGUSR2, &sa, NULL);
- sigaction(SIGHUP, &sa, NULL);
- sigaction(SIGINT, &sa, NULL);
- sigaction(SIGTERM, &sa, NULL);
-
if (getenv(REEXEC_FLAG) != NULL) {
/* We are being re-executed: restart HAProxy gracefully */
int i;
--
2.7.3

+ 41
- 0
net/haproxy/patches/0014-BUG-MINOR-systemd-check-return-value-of-calloc.patch View File

@ -0,0 +1,41 @@
From 106cb89907ea6eab0073708bb8d6f56d7fc64509 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Tue, 25 Oct 2016 17:05:56 +0200
Subject: [PATCH 14/26] BUG/MINOR: systemd: check return value of calloc()
The wrapper is not the best reliable thing in the universe, so start
by adding at least the minimum expected controls :-/
To be backported to 1.5 and 1.6.
(cherry picked from commit 3747ea07ce6b647b86559383f7d09b42550d42f3)
---
src/haproxy-systemd-wrapper.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/haproxy-systemd-wrapper.c b/src/haproxy-systemd-wrapper.c
index 84d2e17..15c48ca 100644
--- a/src/haproxy-systemd-wrapper.c
+++ b/src/haproxy-systemd-wrapper.c
@@ -77,11 +77,17 @@ static void spawn_haproxy(char **pid_strv, int nb_pid)
pid = fork();
if (!pid) {
- /* 3 for "haproxy -Ds -sf" */
- char **argv = calloc(4 + main_argc + nb_pid + 1, sizeof(char *));
+ char **argv;
int i;
int argno = 0;
+ /* 3 for "haproxy -Ds -sf" */
+ argv = calloc(4 + main_argc + nb_pid + 1, sizeof(char *));
+ if (!argv) {
+ fprintf(stderr, SD_NOTICE "haproxy-systemd-wrapper: failed to calloc(), please try again later.\n");
+ exit(1);
+ }
+
reset_signal_handler();
locate_haproxy(haproxy_bin, 512);
argv[argno++] = haproxy_bin;
--
2.7.3

+ 41
- 0
net/haproxy/patches/0015-MINOR-systemd-report-it-when-execve-fails.patch View File

@ -0,0 +1,41 @@
From 3bc0a399d2875e9e0627a70906c1403eef60ec60 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Tue, 25 Oct 2016 16:51:40 +0200
Subject: [PATCH 15/26] MINOR: systemd: report it when execve() fails
It's important to know that a signal sent to the wrapper had no effect
because something failed during execve(). Ideally more info (strerror)
should be reported. It would be nice to backport this to 1.6 and 1.5.
(cherry picked from commit a785269b4e09114224062081f02b443b6008c524)
---
src/haproxy-systemd-wrapper.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/haproxy-systemd-wrapper.c b/src/haproxy-systemd-wrapper.c
index 15c48ca..f4fcab1 100644
--- a/src/haproxy-systemd-wrapper.c
+++ b/src/haproxy-systemd-wrapper.c
@@ -107,8 +107,12 @@ static void spawn_haproxy(char **pid_strv, int nb_pid)
fprintf(stderr, "\n");
execv(argv[0], argv);
+ fprintf(stderr, SD_NOTICE "haproxy-systemd-wrapper: execv(%s) failed, please try again later.\n", argv[0]);
exit(1);
}
+ else if (pid == -1) {
+ fprintf(stderr, SD_NOTICE "haproxy-systemd-wrapper: failed to fork(), please try again later.\n");
+ }
}
static int read_pids(char ***pid_strv)
@@ -180,6 +184,7 @@ static void do_restart(int sig)
execv(wrapper_argv[0], wrapper_argv);
/* failed, let's reinstall the signal handler and continue */
setup_signal_handler();
+ fprintf(stderr, SD_NOTICE "haproxy-systemd-wrapper: re-exec(%s) failed.\n", wrapper_argv[0]);
}
/* handles SIGTERM and SIGINT only */
--
2.7.3

+ 144
- 0
net/haproxy/patches/0016-BUG-MEDIUM-systemd-let-the-wrapper-know-that-haproxy.patch View File

@ -0,0 +1,144 @@
From ff81ac47267c4e0227d1e3fbc5b1dedfd81a2a2f Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Tue, 25 Oct 2016 17:20:24 +0200
Subject: [PATCH 16/26] BUG/MEDIUM: systemd: let the wrapper know that haproxy
has completed or failed
Pierre Cheynier found that there's a persistent issue with the systemd
wrapper. Too fast reloads can lead to certain old processes not being
signaled at all and continuing to run. The problem was tracked down as
a race between the startup and the signal processing : nothing prevents
the wrapper from starting new processes while others are still starting,
and the resulting pid file will only contain the latest pids in this
case. This can happen with large configs and/or when a lot of SSL
certificates are involved.
In order to solve this we want the wrapper to wait for the new processes
to complete their startup. But we also want to ensure it doesn't wait for
nothing in case of error.
The solution found here is to create a pipe between the wrapper and the
sub-processes. The wrapper waits on the pipe and the sub-processes are
expected to close this pipe once they completed their startup. That way
we don't queue up new processes until the previous ones have registered
their pids to the pid file. And if anything goes wrong, the wrapper is
immediately released. The only thing is that we need the sub-processes
to know the pipe's file descriptor. We pass it in an environment variable
called HAPROXY_WRAPPER_FD.
It was confirmed both by Pierre and myself that this completely solves
the "zombie" process issue so that only the new processes continue to
listen on the sockets.
It seems that in the future this stuff could be moved to the haproxy
master process, also getting rid of an environment variable.
This fix needs to be backported to 1.6 and 1.5.
(cherry picked from commit b957109727f7fed556c049d40bacf45f0df211db)
---
src/haproxy-systemd-wrapper.c | 36 ++++++++++++++++++++++++++++++++++++
src/haproxy.c | 10 ++++++++++
2 files changed, 46 insertions(+)
diff --git a/src/haproxy-systemd-wrapper.c b/src/haproxy-systemd-wrapper.c
index f4fcab1..b426f96 100644
--- a/src/haproxy-systemd-wrapper.c
+++ b/src/haproxy-systemd-wrapper.c
@@ -65,16 +65,30 @@ static void locate_haproxy(char *buffer, size_t buffer_size)
return;
}
+/* Note: this function must not exit in case of error (except in the child), as
+ * it is only dedicated the starting a new haproxy process. By keeping the
+ * process alive it will ensure that future signal delivery may get rid of
+ * the issue. If the first startup fails, the wrapper will notice it and
+ * return an error thanks to wait() returning ECHILD.
+ */
static void spawn_haproxy(char **pid_strv, int nb_pid)
{
char haproxy_bin[512];
pid_t pid;
int main_argc;
char **main_argv;
+ int pipefd[2];
+ char fdstr[20];
+ int ret;
main_argc = wrapper_argc - 1;
main_argv = wrapper_argv + 1;
+ if (pipe(pipefd) != 0) {
+ fprintf(stderr, SD_NOTICE "haproxy-systemd-wrapper: failed to create a pipe, please try again later.\n");
+ return;
+ }
+
pid = fork();
if (!pid) {
char **argv;
@@ -89,6 +103,15 @@ static void spawn_haproxy(char **pid_strv, int nb_pid)
}
reset_signal_handler();
+
+ close(pipefd[0]); /* close the read side */
+
+ snprintf(fdstr, sizeof(fdstr), "%d", pipefd[1]);
+ if (setenv("HAPROXY_WRAPPER_FD", fdstr, 1) != 0) {
+ fprintf(stderr, SD_NOTICE "haproxy-systemd-wrapper: failed to setenv(), please try again later.\n");
+ exit(1);
+ }
+
locate_haproxy(haproxy_bin, 512);
argv[argno++] = haproxy_bin;
for (i = 0; i < main_argc; ++i)
@@ -113,6 +136,19 @@ static void spawn_haproxy(char **pid_strv, int nb_pid)
else if (pid == -1) {
fprintf(stderr, SD_NOTICE "haproxy-systemd-wrapper: failed to fork(), please try again later.\n");
}
+
+ /* The parent closes the write side and waits for the child to close it
+ * as well. Also deal the case where the fd would unexpectedly be 1 or 2
+ * by silently draining all data.
+ */
+ close(pipefd[1]);
+
+ do {
+ char c;
+ ret = read(pipefd[0], &c, sizeof(c));
+ } while ((ret > 0) || (ret == -1 && errno == EINTR));
+ /* the child has finished starting up */
+ close(pipefd[0]);
}
static int read_pids(char ***pid_strv)
diff --git a/src/haproxy.c b/src/haproxy.c
index a657dc4..2d476f2 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -1843,6 +1843,7 @@ int main(int argc, char **argv)
int ret = 0;
int *children = calloc(global.nbproc, sizeof(int));
int proc;
+ char *wrapper_fd;
/* the father launches the required number of processes */
for (proc = 0; proc < global.nbproc; proc++) {
@@ -1879,6 +1880,15 @@ int main(int argc, char **argv)
close(pidfd);
}
+ /* each child must notify the wrapper that it's ready by closing the requested fd */
+ wrapper_fd = getenv("HAPROXY_WRAPPER_FD");
+ if (wrapper_fd) {
+ int pipe_fd = atoi(wrapper_fd);
+
+ if (pipe_fd >= 0)
+ close(pipe_fd);
+ }
+
/* We won't ever use this anymore */
free(oldpids); oldpids = NULL;
free(global.chroot); global.chroot = NULL;
--
2.7.3

+ 32
- 0
net/haproxy/patches/0017-BUILD-protocol-fix-some-build-errors-on-OpenBSD.patch View File

@ -0,0 +1,32 @@
From 4fc2ce4a4bb83862679e40c09c684dbf266099f2 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Wed, 10 Aug 2016 18:24:48 +0200
Subject: [PATCH 17/26] BUILD: protocol: fix some build errors on OpenBSD
Building 1.6 and above on OpenBSD 5.2 fails due to protocol.c not
including sys/types.h before sys/socket.h :
In file included from src/protocol.c:14:
/usr/include/sys/socket.h:162: error: expected specifier-qualifier-list before 'u_int8_t'
This fix needs to be backported to 1.6.
(cherry picked from commit a6e3be7ae977ba907ec6ed028c5ab50a6a51886a)
---
src/protocol.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/protocol.c b/src/protocol.c
index 3caccb6..7884ef7 100644
--- a/src/protocol.c
+++ b/src/protocol.c
@@ -10,6 +10,7 @@
*
*/
+#include <sys/types.h>
#include <sys/socket.h>
#include <common/config.h>
--
2.7.3

+ 32
- 0
net/haproxy/patches/0018-BUILD-log-iovec-requires-to-include-sys-uio.h-on-Ope.patch View File

@ -0,0 +1,32 @@
From 27f28950d4f9e44e776db5a5d2bc8d07df45eb30 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Wed, 10 Aug 2016 18:30:56 +0200
Subject: [PATCH 18/26] BUILD: log: iovec requires to include sys/uio.h on
OpenBSD
The following commit merged into 1.6-dev6 broke the build on OpenBSD :
609ac2a ("MEDIUM: log: replace sendto() with sendmsg() in __send_log()")
Including sys/uio.h is enough to fix this. This fix needs to be backported
to 1.6.
(cherry picked from commit 077edcba2e5c25524b720f905417d9f0616cd252)
---
src/log.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/log.c b/src/log.c
index 1ddc06d..293a034 100644
--- a/src/log.c
+++ b/src/log.c
@@ -22,6 +22,7 @@
#include <errno.h>
#include <sys/time.h>
+#include <sys/uio.h>
#include <common/config.h>
#include <common/compat.h>
--
2.7.3

+ 32
- 0
net/haproxy/patches/0019-BUILD-tcp-do-not-include-netinet-ip.h-for-IP_TTL.patch View File

@ -0,0 +1,32 @@
From 2a63a2b7e32bba4a33c5f4081647124565929f6a Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Wed, 10 Aug 2016 18:42:17 +0200
Subject: [PATCH 19/26] BUILD: tcp: do not include netinet/ip.h for IP_TTL
On OpenBSD, netinet/ip.h fails unless in_systm.h is included. This
include was added by the silent-drop feature introduced with commit
2d392c2 ("MEDIUM: tcp: add new tcp action "silent-drop"") in 1.6-dev6,
but we don't need it, IP_TTL is defined in netinet/in.h, so let's drop
this useless include.
This fix needs to be backported to 1.6.
(cherry picked from commit 7f3e3c0159401cdf47575bc82304696b3a98a2ab)
---
src/proto_tcp.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index 0f20fde..83b862a 100644
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -31,7 +31,6 @@
#include <netinet/tcp.h>
#include <netinet/in.h>
-#include <netinet/ip.h>
#include <common/cfgparse.h>
#include <common/compat.h>
--
2.7.3

+ 48
- 0
net/haproxy/patches/0020-BUILD-checks-remove-the-last-strcat-and-eliminate-a-.patch View File

@ -0,0 +1,48 @@
From a581cf03110f13c61faeaf87efa5b4e2777087d0 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Wed, 10 Aug 2016 19:29:09 +0200
Subject: [PATCH 20/26] BUILD: checks: remove the last strcat and eliminate a
warning on OpenBSD
OpenBSD emits warnings on usages of strcpy, strcat and sprintf (and
probably a few others). Here we have a single such warning in all the code
reintroduced by commit 0ba0e4a ("MEDIUM: Support sending email alerts") in
1.6-dev1. Let's get rid of it, the open-coding of strcat is as small as its
usage and the the result is even more efficient.
This fix needs to be backported to 1.6.
(cherry picked from commit 64345aaaf0dc2739983902cce4667089ad926a49)
---
src/checks.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/checks.c b/src/checks.c
index 80b2fc3..55c13a9 100644
--- a/src/checks.c
+++ b/src/checks.c
@@ -3164,6 +3164,8 @@ static int add_tcpcheck_expect_str(struct list *list, const char *str)
static int add_tcpcheck_send_strs(struct list *list, const char * const *strs)
{
struct tcpcheck_rule *tcpcheck;
+ const char *in;
+ char *dst;
int i;
tcpcheck = calloc(1, sizeof *tcpcheck);
@@ -3181,10 +3183,11 @@ static int add_tcpcheck_send_strs(struct list *list, const char * const *strs)
free(tcpcheck);
return 0;
}
- tcpcheck->string[0] = '\0';
+ dst = tcpcheck->string;
for (i = 0; strs[i]; i++)
- strcat(tcpcheck->string, strs[i]);
+ for (in = strs[i]; (*dst = *in++); dst++);
+ *dst = 0;
LIST_ADDQ(list, &tcpcheck->list);
return 1;
--
2.7.3

+ 39
- 0
net/haproxy/patches/0021-BUILD-poll-remove-unused-hap_fd_isset-which-causes-a.patch View File

@ -0,0 +1,39 @@
From a19f5bfb0d1e606dc2eb80af903c229ca41d5057 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Wed, 10 Aug 2016 21:21:57 +0200
Subject: [PATCH 21/26] BUILD: poll: remove unused hap_fd_isset() which causes
a warning with clang
Clang reports that this function is not used :
src/ev_poll.c:34:28: warning: unused function 'hap_fd_isset' [-Wunused-function]
static inline unsigned int hap_fd_isset(int fd, unsigned int *evts)
It's been true since the rework of the pollers in 1.5 and it's unlikely we'll
ever need it anymore, so better remove it now to provide clean builds.
This fix can be backported to 1.6 and 1.5 now.
(cherry picked from commit 091e86e1ee8ec51bd5a3c1935666a822a51b9051)
---
src/ev_poll.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/src/ev_poll.c b/src/ev_poll.c
index 44a2b9b..80d88eb 100644
--- a/src/ev_poll.c
+++ b/src/ev_poll.c
@@ -31,11 +31,6 @@ static unsigned int *fd_evts[2];
static struct pollfd *poll_events = NULL;
-static inline unsigned int hap_fd_isset(int fd, unsigned int *evts)
-{
- return evts[fd / (8*sizeof(*evts))] & (1U << (fd & (8*sizeof(*evts) - 1)));
-}
-
static inline void hap_fd_set(int fd, unsigned int *evts)
{
evts[fd / (8*sizeof(*evts))] |= 1U << (fd & (8*sizeof(*evts) - 1));
--
2.7.3

+ 48
- 0
net/haproxy/patches/0022-MINOR-cfgparse-few-memory-leaks-fixes.patch View File

@ -0,0 +1,48 @@
From e871cc2f15ad121e1e840191f59c6c86d6d0580d Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Mon, 22 Aug 2016 23:27:42 +0100
Subject: [PATCH 22/26] MINOR: cfgparse: few memory leaks fixes.
Some minor memory leak during the config parsing.
(cherry picked from commit 70d604593d507f50fd99cebecee4b2c47c1d9b73)
---
src/cfgparse.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/cfgparse.c b/src/cfgparse.c
index f2a104d..b8289a2 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -1597,6 +1597,7 @@ int cfg_parse_global(const char *file, int linenum, char **args, int kwm)
if (logsrv->format < 0) {
Alert("parsing [%s:%d] : unknown log format '%s'\n", file, linenum, args[arg+3]);
err_code |= ERR_ALERT | ERR_FATAL;
+ free(logsrv);
goto out;
}
@@ -6777,9 +6778,10 @@ cfg_parse_users(const char *file, int linenum, char **args, int kwm)
}
ag->name = strdup(args[1]);
- if (!ag) {
+ if (!ag->name) {
Alert("parsing [%s:%d]: out of memory.\n", file, linenum);
err_code |= ERR_ALERT | ERR_ABORT;
+ free(ag);
goto out;
}
@@ -6794,6 +6796,9 @@ cfg_parse_users(const char *file, int linenum, char **args, int kwm)
Alert("parsing [%s:%d]: '%s' only supports 'users' option.\n",
file, linenum, args[0]);
err_code |= ERR_ALERT | ERR_FATAL;
+ free(ag->groupusers);
+ free(ag->name);
+ free(ag);
goto out;
}
}
--
2.7.3

+ 33
- 0
net/haproxy/patches/0023-MINOR-build-Allow-linking-to-device-atlas-library-fi.patch View File

@ -0,0 +1,33 @@
From 5370c6774a333b2b3989639275d4093fdc541db9 Mon Sep 17 00:00:00 2001
From: Bertrand Jacquin <bertrand@jacquin.bzh>
Date: Thu, 6 Oct 2016 00:32:39 +0100
Subject: [PATCH 23/26] MINOR: build: Allow linking to device-atlas library
file
DeviceAtlas might be installed in a location where a user might not have
enough permissions to write json.o and dac.o
(cherry picked from commit 3a2661d6b4218704c828c8a712c87d651bfe29b5)
---
Makefile | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Makefile b/Makefile
index 1d0f2bc..0242cae 100644
--- a/Makefile
+++ b/Makefile
@@ -615,8 +615,12 @@ endif
DEVICEATLAS_SRC =
DEVICEATLAS_INC = $(DEVICEATLAS_SRC)
DEVICEATLAS_LIB = $(DEVICEATLAS_SRC)
+ifeq ($(DEVICEATLAS_SRC),)
+OPTIONS_LDFLAGS += -lda
+else
OPTIONS_OBJS += $(DEVICEATLAS_LIB)/json.o
OPTIONS_OBJS += $(DEVICEATLAS_LIB)/dac.o
+endif
OPTIONS_OBJS += src/da.o
OPTIONS_CFLAGS += -DUSE_DEVICEATLAS $(if $(DEVICEATLAS_INC),-I$(DEVICEATLAS_INC))
BUILD_OPTIONS += $(call ignore_implicit,USE_DEVICEATLAS)
--
2.7.3

+ 32
- 0
net/haproxy/patches/0024-DOC-Fix-typo-in-description-of-st-parameter-in-man-p.patch View File

@ -0,0 +1,32 @@
From f95dc972e2e9e3c245862e45336ff4f014ad5666 Mon Sep 17 00:00:00 2001
From: Jorrit Schippers <jorrit@ncode.nl>
Date: Sat, 9 Apr 2016 20:30:38 +0200
Subject: [PATCH 24/26] DOC: Fix typo in description of `-st` parameter in man
page
extra "wait".
(cherry picked from commit 1458fdbe974562158fc40fd72d745d5fd644c939)
---
doc/haproxy.1 | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/doc/haproxy.1 b/doc/haproxy.1
index a836d5d..20c9343 100644
--- a/doc/haproxy.1
+++ b/doc/haproxy.1
@@ -149,9 +149,9 @@ PIDs. Technically speaking, \fBSIGTTOU\fP and \fBSIGUSR1\fP are sent.
.TP
\fB\-st <pidlist>\fP
Send TERMINATE signal to the pids in pidlist after startup. The processes
-which receive this signal will wait immediately terminate, closing all
-active sessions. This option must be specified last, followed by any number
-of PIDs. Technically speaking, \fBSIGTTOU\fP and \fBSIGTERM\fP are sent.
+which receive this signal will terminate immediately, closing all active
+sessions. This option must be specified last, followed by any number of
+PIDs. Technically speaking, \fBSIGTTOU\fP and \fBSIGTERM\fP are sent.
.SH LOGGING
Since HAProxy can run inside a chroot, it cannot reliably access /dev/log.
--
2.7.3

+ 39
- 0
net/haproxy/patches/0025-BUG-MEDIUM-peers-on-shutdown-wake-up-the-appctx-not-.patch View File

@ -0,0 +1,39 @@
From 6026323cd0c235d6ab7ec039e5d735e7ea2e28bf Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Mon, 31 Oct 2016 17:32:20 +0100
Subject: [PATCH 25/26] BUG/MEDIUM: peers: on shutdown, wake up the appctx, not
the stream
This part was missed when peers were ported to the new applet
infrastructure in 1.6, the main stream is woken up instead of the
appctx. This creates a race condition by which it is possible to
wake the stream at the wrong moment and miss an event. This bug
might be at least partially responsible for some of the CLOSE_WAIT
that were reported on peers session upon reload in version 1.6.
This fix must be backported to 1.6.
(cherry picked from commit 78c0c50705a5e9d48607b9377adf030bb9d97b34)
---
src/peers.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/src/peers.c b/src/peers.c
index 7e1523f..db1f608 100644
--- a/src/peers.c
+++ b/src/peers.c
@@ -1637,11 +1637,9 @@ static void peer_session_forceshutdown(struct stream * stream)
if (ps)
ps->reconnect = tick_add(now_ms, MS_TO_TICKS(50 + random() % 2000));
- /* call release to reinit resync states if needed */
- peer_session_release(appctx);
appctx->st0 = PEER_SESS_ST_END;
appctx->ctx.peers.ptr = NULL;
- task_wakeup(stream->task, TASK_WOKEN_MSG);
+ appctx_wakeup(appctx);
}
/* Pre-configures a peers frontend to accept incoming connections */
--
2.7.3

+ 64
- 0
net/haproxy/patches/0026-BUG-MEDIUM-peers-fix-use-after-free-in-peer_session_.patch View File

@ -0,0 +1,64 @@
From ab45181e36b6c4f7d31c5284035937c2d0be37eb Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Mon, 31 Oct 2016 17:46:57 +0100
Subject: [PATCH 26/26] BUG/MEDIUM: peers: fix use after free in
peer_session_create()
In case of resource allocation error, peer_session_create() frees
everything allocated and returns a pointer to the stream/session that
was put back into the free pool. This stream/session is then assigned
to ps->{stream,session} with no error control. This means that it is
perfectly possible to have a new stream or session being both used for
a regular communication and for a peer at the same time.
In fact it is the only way (for now) to explain a CLOSE_WAIT on peers
connections that was caught in this dump with the stream interface in
SI_ST_CON state while the error field proves the state ought to have
been SI_ST_DIS, very likely indicating two concurrent accesses on the
same area :
0x7dbd50: [31/Oct/2016:17:53:41.267510] id=0 proto=tcpv4
flags=0x23006, conn_retries=0, srv_conn=(nil), pend_pos=(nil)
frontend=myhost2 (id=4294967295 mode=tcp), listener=? (id=0)
backend=<NONE> (id=-1 mode=-) addr=127.0.0.1:41432
server=<NONE> (id=-1) addr=127.0.0.1:8521
task=0x7dbcd8 (state=0x08 nice=0 calls=2 exp=<NEVER> age=1m5s)
si[0]=0x7dbf48 (state=CLO flags=0x4040 endp0=APPCTX:0x7d99c8 exp=<NEVER>, et=0x000)
si[1]=0x7dbf68 (state=CON flags=0x50 endp1=CONN:0x7dc0b8 exp=<NEVER>, et=0x020)
app0=0x7d99c8 st0=11 st1=0 st2=0 applet=<PEER>
co1=0x7dc0b8 ctrl=tcpv4 xprt=RAW data=STRM target=PROXY:0x7fe62028a010
flags=0x0020b310 fd=7 fd.state=22 fd.cache=0 updt=0
req=0x7dbd60 (f=0x80a020 an=0x0 pipe=0 tofwd=0 total=0)
an_exp=<NEVER> rex=<NEVER> wex=<NEVER>
buf=0x78a3c0 data=0x78a3d4 o=0 p=0 req.next=0 i=0 size=0
res=0x7dbda0 (f=0x80402020 an=0x0 pipe=0 tofwd=0 total=0)
an_exp=<NEVER> rex=<NEVER> wex=<NEVER>
buf=0x78a3c0 data=0x78a3d4 o=0 p=0 rsp.next=0 i=0 size=0
Special thanks to Arnaud Gavara who provided lots of valuable input and
ran some validation testing on this patch.
This fix must be backported to 1.6 and 1.5. Note that in 1.5 the
session is not assigned from within the function so some extra checks
may be needed in the callers.
(cherry picked from commit b21d08e2492bfbf9d2341ce9f148cb9845927862)
---
src/peers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/peers.c b/src/peers.c
index db1f608..c8be59a 100644
--- a/src/peers.c
+++ b/src/peers.c
@@ -1747,7 +1747,7 @@ static struct stream *peer_session_create(struct peers *peers, struct peer *peer
out_free_appctx:
appctx_free(appctx);
out_close:
- return s;
+ return NULL;
}
/*
--
2.7.3

Loading…
Cancel
Save