From 60138d90b8a79e1a8a542590c1eac114ad2fead9 Mon Sep 17 00:00:00 2001 From: Christian Lachner Date: Sat, 22 Sep 2018 16:51:36 +0200 Subject: [PATCH] haproxy: Update HAProxy to v1.8.14 - Update haproxy download URL and hash - Removed all obsolete patches - This fixes CVE-2018-14645 (See: https://nvd.nist.gov/vuln/detail/CVE-2018-14645) Signed-off-by: Christian Lachner --- net/haproxy/Makefile | 6 +- net/haproxy/get-latest-patches.sh | 2 +- ...ck-the-queues-once-enabling-a-server.patch | 46 --- ...from-draining-the-proxys-connections.patch | 52 --- ...putation-in-dns_get_ip_from_response.patch | 43 --- ...allow-prevent-IP-address-duplication.patch | 158 -------- ...ible-CLOSE-WAIT-state-with-n-headers.patch | 72 ---- ...e-double-width-CAS-on-x86_64-and-arm.patch | 186 ---------- ...-double-CAS-implementation-for-ARMv7.patch | 41 --- ...-certain-variables-in-no-thread-case.patch | 172 --------- ...e-after-the-change-to-the-sync-point.patch | 31 -- ...nt-a-more-flexible-rendez-vous-point.patch | 340 ------------------ ...-MEDIUM-cli-make-show-fd-thread-safe.patch | 50 --- ...empty-connections-reported-as-errors.patch | 43 --- ...loading-a-keytype-cert-from-a-bundle.patch | 27 -- ...certifile-causes-unpredictable-error.patch | 28 -- ...-MINOR-map-fix-map_regm-with-backref.patch | 48 --- ...in-set-server-fqdn-requires-resolver.patch | 29 -- ...-consistent-naming-for-TLS-protocols.patch | 49 --- ...-lua-socket-timeouts-are-not-applied.patch | 42 --- ...-commands-against-concurrent-updates.patch | 212 ----------- ...mmands-against-concurrent-operations.patch | 188 ---------- ...-spelling-error-in-configuration-doc.patch | 24 -- ...DIUM-unix-provide-a---drain-function.patch | 57 --- ...lua-Bad-HTTP-client-request-duration.patch | 56 --- ...-connection-with-care-in-mux_pt_wake.patch | 33 -- 26 files changed, 4 insertions(+), 2031 deletions(-) delete mode 100644 net/haproxy/patches/0000-BUG-MEDIUM-servers-check-the-queues-once-enabling-a-server.patch delete mode 100644 net/haproxy/patches/0001-BUG-MEDIUM-queue-prevent-a-backup-server-from-draining-the-proxys-connections.patch delete mode 100644 net/haproxy/patches/0002-MINOR-dns-fix-wrong-score-computation-in-dns_get_ip_from_response.patch delete mode 100644 net/haproxy/patches/0003-MINOR-dns-new-DNS-options-to-allow-prevent-IP-address-duplication.patch delete mode 100644 net/haproxy/patches/0004-BUG-MEDIUM-lua-possible-CLOSE-WAIT-state-with-n-headers.patch delete mode 100644 net/haproxy/patches/0005-MINOR-threads-Introduce-double-width-CAS-on-x86_64-and-arm.patch delete mode 100644 net/haproxy/patches/0006-BUG-MEDIUM-threads-fix-the-double-CAS-implementation-for-ARMv7.patch delete mode 100644 net/haproxy/patches/0007-MINOR-threads-add-more-consistency-between-certain-variables-in-no-thread-case.patch delete mode 100644 net/haproxy/patches/0008-BUG-MEDIUM-threads-fix-the-no-thread-case-after-the-change-to-the-sync-point.patch delete mode 100644 net/haproxy/patches/0009-MEDIUM-hathreads-implement-a-more-flexible-rendez-vous-point.patch delete mode 100644 net/haproxy/patches/0010-BUG-MEDIUM-cli-make-show-fd-thread-safe.patch delete mode 100644 net/haproxy/patches/0011-BUG-MINOR-ssl-empty-connections-reported-as-errors.patch delete mode 100644 net/haproxy/patches/0012-BUG-MEDIUM-ssl-fix-missing-error-loading-a-keytype-cert-from-a-bundle.patch delete mode 100644 net/haproxy/patches/0013-BUG-MEDIUM-ssl-loading-dh-param-from-certifile-causes-unpredictable-error.patch delete mode 100644 net/haproxy/patches/0014-BUG-MINOR-map-fix-map_regm-with-backref.patch delete mode 100644 net/haproxy/patches/0015-DOC-dns-explain-set-server-fqdn-requires-resolver.patch delete mode 100644 net/haproxy/patches/0016-DOC-ssl-Use-consistent-naming-for-TLS-protocols.patch delete mode 100644 net/haproxy/patches/0017-BUG-MEDIUM-lua-socket-timeouts-are-not-applied.patch delete mode 100644 net/haproxy/patches/0018-BUG-MEDIUM-cli-threads-protect-all-proxy-commands-against-concurrent-updates.patch delete mode 100644 net/haproxy/patches/0019-BUG-MEDIUM-cli-threads-protect-some-server-commands-against-concurrent-operations.patch delete mode 100644 net/haproxy/patches/0020-DOC-Fix-spelling-error-in-configuration-doc.patch delete mode 100644 net/haproxy/patches/0021-BUG-MEDIUM-unix-provide-a---drain-function.patch delete mode 100644 net/haproxy/patches/0022-BUG-MINOR-lua-Bad-HTTP-client-request-duration.patch delete mode 100644 net/haproxy/patches/0023-BUG-MEDIUM-mux_pt-dereference-the-connection-with-care-in-mux_pt_wake.patch diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index 2c1866504..268501d72 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -10,12 +10,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=haproxy -PKG_VERSION:=1.8.13 -PKG_RELEASE:=2 +PKG_VERSION:=1.8.14 +PKG_RELEASE:=1 PKG_SOURCE:=haproxy-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://www.haproxy.org/download/1.8/src/ -PKG_HASH:=2bf5dafbb5f1530c0e67ab63666565de948591f8e0ee2a1d3c84c45e738220f1 +PKG_HASH:=b17e402578be85e58af7a3eac99b1f675953bea9f67af2e964cf8bdbd1bd3fdf PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION) PKG_LICENSE:=GPL-2.0 diff --git a/net/haproxy/get-latest-patches.sh b/net/haproxy/get-latest-patches.sh index 77ed6415a..4612ccdae 100755 --- a/net/haproxy/get-latest-patches.sh +++ b/net/haproxy/get-latest-patches.sh @@ -1,7 +1,7 @@ #!/bin/bash CLONEURL=http://git.haproxy.org/git/haproxy-1.8.git -BASE_TAG=v1.8.13 +BASE_TAG=v1.8.14 TMP_REPODIR=tmprepo PATCHESDIR=patches diff --git a/net/haproxy/patches/0000-BUG-MEDIUM-servers-check-the-queues-once-enabling-a-server.patch b/net/haproxy/patches/0000-BUG-MEDIUM-servers-check-the-queues-once-enabling-a-server.patch deleted file mode 100644 index ba5c02292..000000000 --- a/net/haproxy/patches/0000-BUG-MEDIUM-servers-check-the-queues-once-enabling-a-server.patch +++ /dev/null @@ -1,46 +0,0 @@ -commit ef9b56022c656df34044103a317b7b890ced6628 -Author: Willy Tarreau -Date: Tue Aug 7 10:14:53 2018 +0200 - - BUG/MEDIUM: servers: check the queues once enabling a server - - Commit 64cc49c ("MAJOR: servers: propagate server status changes - asynchronously.") heavily changed the way the server states are - updated since they became asynchronous. During this change, some - code was lost, which is used to shut down some sessions from a - backup server and to pick pending connections from a proxy once - a server is turned back from maintenance to ready state. The - effect is that when temporarily disabling a server, connections - stay in the backend's queue, and when re-enabling it, they are - not picked and they expire in the backend's queue. Now they're - properly picked again. - - This fix must be backported to 1.8. - - (cherry picked from commit 6a78e61694d69beb49c0e8486be9550f5e8b7d08) - Signed-off-by: Willy Tarreau - -diff --git a/src/server.c b/src/server.c -index 3d6a4093..fbed6cd4 100644 ---- a/src/server.c -+++ b/src/server.c -@@ -4774,6 +4774,19 @@ void srv_update_status(struct server *s) - if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0) - set_backend_down(s->proxy); - -+ /* If the server is set with "on-marked-up shutdown-backup-sessions", -+ * and it's not a backup server and its effective weight is > 0, -+ * then it can accept new connections, so we shut down all streams -+ * on all backup servers. -+ */ -+ if ((s->onmarkedup & HANA_ONMARKEDUP_SHUTDOWNBACKUPSESSIONS) && -+ !(s->flags & SRV_F_BACKUP) && s->next_eweight) -+ srv_shutdown_backup_streams(s->proxy, SF_ERR_UP); -+ -+ /* check if we can handle some connections queued at the proxy. We -+ * will take as many as we can handle. -+ */ -+ xferred = pendconn_grab_from_px(s); - } - else if (s->next_admin & SRV_ADMF_MAINT) { - /* remaining in maintenance mode, let's inform precisely about the diff --git a/net/haproxy/patches/0001-BUG-MEDIUM-queue-prevent-a-backup-server-from-draining-the-proxys-connections.patch b/net/haproxy/patches/0001-BUG-MEDIUM-queue-prevent-a-backup-server-from-draining-the-proxys-connections.patch deleted file mode 100644 index 54d3b8c30..000000000 --- a/net/haproxy/patches/0001-BUG-MEDIUM-queue-prevent-a-backup-server-from-draining-the-proxys-connections.patch +++ /dev/null @@ -1,52 +0,0 @@ -commit 5550143cd6de58c6e733e389c6946e3dd26e89c0 -Author: Willy Tarreau -Date: Tue Aug 7 10:44:58 2018 +0200 - - BUG/MEDIUM: queue: prevent a backup server from draining the proxy's connections - - When switching back from a backup to an active server, the backup server - currently continues to drain the proxy's connections, which is a problem - because it's not expected to be able to pick them. - - This patch ensures that a backup server will only pick backend connections - if there is no active server and it is the selected backup server or all - backup servers are supposed to be used. - - This issue seems to have existed forever, so this fix should be backported - to all stable versions. - - (cherry picked from commit a8694654ba021bf1e0e560a98ab5e70dc44d212e) - Signed-off-by: Willy Tarreau - -diff --git a/src/queue.c b/src/queue.c -index 1c730c75..b0b89426 100644 ---- a/src/queue.c -+++ b/src/queue.c -@@ -117,7 +117,10 @@ static int pendconn_process_next_strm(struct server *srv, struct proxy *px) - } - - ps_found: -- if (srv_currently_usable(rsrv) && px->nbpend) { -+ if (srv_currently_usable(rsrv) && px->nbpend && -+ (!(srv->flags & SRV_F_BACKUP) || -+ (!px->srv_act && -+ (srv == px->lbprm.fbck || (px->options & PR_O_USE_ALL_BK))))) { - struct pendconn *pp; - - list_for_each_entry(pp, &px->pendconns, list) { -@@ -287,6 +290,15 @@ int pendconn_grab_from_px(struct server *s) - if (!srv_currently_usable(s)) - return 0; - -+ /* if this is a backup server and there are active servers or at -+ * least another backup server was elected, then this one must -+ * not dequeue requests from the proxy. -+ */ -+ if ((s->flags & SRV_F_BACKUP) && -+ (s->proxy->srv_act || -+ ((s != s->proxy->lbprm.fbck) && !(s->proxy->options & PR_O_USE_ALL_BK)))) -+ return 0; -+ - HA_SPIN_LOCK(PROXY_LOCK, &s->proxy->lock); - maxconn = srv_dynamic_maxconn(s); - list_for_each_entry_safe(p, pback, &s->proxy->pendconns, list) { diff --git a/net/haproxy/patches/0002-MINOR-dns-fix-wrong-score-computation-in-dns_get_ip_from_response.patch b/net/haproxy/patches/0002-MINOR-dns-fix-wrong-score-computation-in-dns_get_ip_from_response.patch deleted file mode 100644 index aacb7f035..000000000 --- a/net/haproxy/patches/0002-MINOR-dns-fix-wrong-score-computation-in-dns_get_ip_from_response.patch +++ /dev/null @@ -1,43 +0,0 @@ -commit 7d395954136c45e1533f355068399fec5e606db1 -Author: Baptiste Assmann -Date: Fri Jun 22 13:03:50 2018 +0200 - - MINOR: dns: fix wrong score computation in dns_get_ip_from_response - - dns_get_ip_from_response() is used to compare the caller current IP to - the IP available in the records returned by the DNS server. - A scoring system is in place to get the best IP address available. - That said, in the current implementation, there are a couple of issues: - 1. a comment does not match what the code does - 2. the code does not match what the commet says (score value is not - incremented with '2') - - This patch fixes both issues. - - Backport status: 1.8 - - (cherry picked from commit 84221b4e9010810cf93b7ad7a31d825fa9fc26bf) - [wt: Baptiste explicitly asked for this one to be backported to stable] - Cc: Baptiste - Signed-off-by: Willy Tarreau - -diff --git a/src/dns.c b/src/dns.c -index 153a46b2..d8388ef1 100644 ---- a/src/dns.c -+++ b/src/dns.c -@@ -1027,10 +1027,13 @@ int dns_get_ip_from_response(struct dns_response_packet *dns_p, - } - - /* Check if the IP found in the record is already affected to a -- * member of a group. If yes, the score should be incremented -+ * member of a group. If not, the score should be incremented - * by 2. */ -- if (owner && snr_check_ip_callback(owner, ip, &ip_type)) -+ if (owner && snr_check_ip_callback(owner, ip, &ip_type)) { - continue; -+ } else { -+ score += 2; -+ } - - /* Check for current ip matching. */ - if (ip_type == currentip_sin_family && diff --git a/net/haproxy/patches/0003-MINOR-dns-new-DNS-options-to-allow-prevent-IP-address-duplication.patch b/net/haproxy/patches/0003-MINOR-dns-new-DNS-options-to-allow-prevent-IP-address-duplication.patch deleted file mode 100644 index e824bb082..000000000 --- a/net/haproxy/patches/0003-MINOR-dns-new-DNS-options-to-allow-prevent-IP-address-duplication.patch +++ /dev/null @@ -1,158 +0,0 @@ -commit c1bfcd002f54d1d84a99282d13f875c2649f3d70 -Author: Baptiste Assmann -Date: Fri Jun 22 15:04:43 2018 +0200 - - MINOR: dns: new DNS options to allow/prevent IP address duplication - - By default, HAProxy's DNS resolution at runtime ensure that there is no - IP address duplication in a backend (for servers being resolved by the - same hostname). - There are a few cases where people want, on purpose, to disable this - feature. - - This patch introduces a couple of new server side options for this purpose: - "resolve-opts allow-dup-ip" or "resolve-opts prevent-dup-ip". - - (cherry picked from commit 8e2d9430c0562ed74276d7f58e92706c384c0a36) - - [wt: this is backported to 1.8 upon request from Baptiste because it offers - the option to revert to 1.7 behaviour, which some people depend on. The - address deduplication used on 1.8 apparently is not suited to everyone] - Signed-off-by: Willy Tarreau - -diff --git a/doc/configuration.txt b/doc/configuration.txt -index 011533a0..1973bbf2 100644 ---- a/doc/configuration.txt -+++ b/doc/configuration.txt -@@ -11623,6 +11623,40 @@ rise - after consecutive successful health checks. This value defaults to 2 - if unspecified. See also the "check", "inter" and "fall" parameters. - -+resolve-opts