Browse Source
haproxy: bugfix release 1.5.13
Released version 1.5.13 with the following main changes : - BUG/MINOR: check: fix tcpcheck error message - CLEANUP: deinit: remove codes for cleaning p->block_rules - DOC: Update doc about weight, act and bck fields in the statistics - MINOR: ssl: add a destructor to free allocated SSL ressources - BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value being overwritten - MEDIUM: ssl: replace standards DH groups with custom ones - BUG/MINOR: debug: display (null) in place of "meth" - BUG/MINOR: cfgparse: fix typo in 'option httplog' error message - BUG/MEDIUM: cfgparse: segfault when userlist is misused - BUG/MEDIUM: stats: properly initialize the scope before dumping stats - BUG/MEDIUM: http: don't forward client shutdown without NOLINGER except for tunnels - CLEANUP: checks: fix double usage of cur / current_step in tcp-checks - BUG/MEDIUM: checks: do not dereference head of a tcp-check at the end - CLEANUP: checks: simplify the loop processing of tcp-checks - BUG/MAJOR: checks: always check for end of list before proceeding - BUG/MEDIUM: checks: do not dereference a list as a tcpcheck struct - BUG/MEDIUM: peers: apply a random reconnection timeout - BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id - MEDIUM: init: don't stop proxies in parent process when exiting - MINOR: peers: store the pointer to the signal handler - MEDIUM: peers: unregister peers that were never started - MEDIUM: config: propagate the table's process list to the peers sections - MEDIUM: init: stop any peers section not bound to the correct process - MEDIUM: config: validate that peers sections are bound to exactly one process - MAJOR: peers: allow peers section to be used with nbproc > 1 - DOC: relax the peers restriction to single-process - CLEANUP: config: fix misleading information in error message. - MINOR: config: report the number of processes using a peers section in the error case - BUG/MEDIUM: config: properly compute the default number of processes for a proxy Signed-off-by: heil <heil@terminal-consulting.de>lilik-openwrt-22.03
heil
10 years ago
19 changed files with 3 additions and 1534 deletions
Split View
Diff Options
-
+3 -3net/haproxy/Makefile
-
+0 -32net/haproxy/patches/0001-BUG-MEDIUM-stats-properly-initialize-the-scope-befor.patch
-
+0 -82net/haproxy/patches/0002-BUG-MEDIUM-http-don-t-forward-client-shutdown-withou.patch
-
+0 -28net/haproxy/patches/0003-BUG-MINOR-check-fix-tcpcheck-error-message.patch
-
+0 -178net/haproxy/patches/0004-CLEANUP-checks-fix-double-usage-of-cur-current_step-.patch
-
+0 -53net/haproxy/patches/0005-BUG-MEDIUM-checks-do-not-dereference-head-of-a-tcp-c.patch
-
+0 -82net/haproxy/patches/0006-CLEANUP-checks-simplify-the-loop-processing-of-tcp-c.patch
-
+0 -90net/haproxy/patches/0007-BUG-MAJOR-checks-always-check-for-end-of-list-before.patch
-
+0 -116net/haproxy/patches/0008-BUG-MEDIUM-checks-do-not-dereference-a-list-as-a-tcp.patch
-
+0 -77net/haproxy/patches/0009-BUG-MEDIUM-peers-apply-a-random-reconnection-timeout.patch
-
+0 -33net/haproxy/patches/0010-DOC-Update-doc-about-weight-act-and-bck-fields-in-th.patch
-
+0 -64net/haproxy/patches/0011-MINOR-ssl-add-a-destructor-to-free-allocated-SSL-res.patch
-
+0 -98net/haproxy/patches/0012-BUG-MEDIUM-ssl-fix-tune.ssl.default-dh-param-value-b.patch
-
+0 -29net/haproxy/patches/0013-BUG-MINOR-cfgparse-fix-typo-in-option-httplog-error-.patch
-
+0 -41net/haproxy/patches/0014-BUG-MEDIUM-cfgparse-segfault-when-userlist-is-misuse.patch
-
+0 -427net/haproxy/patches/0015-MEDIUM-ssl-replace-standards-DH-groups-with-custom-o.patch
-
+0 -28net/haproxy/patches/0016-BUG-MINOR-debug-display-null-in-place-of-meth.patch
-
+0 -36net/haproxy/patches/0017-CLEANUP-deinit-remove-codes-for-cleaning-p-block_rul.patch
-
+0 -37net/haproxy/patches/0018-BUG-MINOR-ssl-fix-smp_fetch_ssl_fc_session_id.patch
+ 3
- 3
net/haproxy/Makefile
View File
+ 0
- 32
net/haproxy/patches/0001-BUG-MEDIUM-stats-properly-initialize-the-scope-befor.patch
View File
| @ -1,32 +0,0 @@ | |||
| From 0aa5899911bbc765ba16ce52a80fa76230781779 Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Mon, 4 May 2015 18:07:56 +0200 | |||
| Subject: [PATCH 1/2] BUG/MEDIUM: stats: properly initialize the scope before | |||
| dumping stats | |||
| Issuing a "show sess all" prior to a "show stat" on the CLI results in no | |||
| proxy being dumped because the scope_len union member was not properly | |||
| reinitialized. | |||
| This fix must be backported into 1.5. | |||
| (cherry picked from commit 6bcb95da5b9cb143088102b460c7bcb37c1b3d81) | |||
| --- | |||
| src/dumpstats.c | 2 ++ | |||
| 1 file changed, 2 insertions(+) | |||
| diff --git a/src/dumpstats.c b/src/dumpstats.c | |||
| index b616478..ca084ac 100644 | |||
| --- a/src/dumpstats.c | |||
| +++ b/src/dumpstats.c | |||
| @@ -1109,6 +1109,8 @@ static int stats_sock_parse_request(struct stream_interface *si, char *line) | |||
| arg++; | |||
| } | |||
| + appctx->ctx.stats.scope_str = 0; | |||
| + appctx->ctx.stats.scope_len = 0; | |||
| appctx->ctx.stats.flags = 0; | |||
| if (strcmp(args[0], "show") == 0) { | |||
| if (strcmp(args[1], "stat") == 0) { | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 82
net/haproxy/patches/0002-BUG-MEDIUM-http-don-t-forward-client-shutdown-withou.patch
View File
| @ -1,82 +0,0 @@ | |||
| From 294e4676a3b775a7accb50eb8428f293c218b5e2 Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Mon, 11 May 2015 18:30:33 +0200 | |||
| Subject: [PATCH 2/2] BUG/MEDIUM: http: don't forward client shutdown without | |||
| NOLINGER except for tunnels | |||
| There's an issue related with shutting down POST transfers or closing the | |||
| connection after the end of the upload : the shutdown is forwarded to the | |||
| server regardless of the abortonclose option. The problem it causes is that | |||
| during a scan, brute force or whatever, it becomes possible that all source | |||
| ports are exhausted with all sockets in TIME_WAIT state. | |||
| There are multiple issues at once in fact : | |||
| - no action is done for the close, it automatically happens at the lower | |||
| layers thanks for channel_auto_close(), so we cannot act on NOLINGER ; | |||
| - we *do* want to continue to send a clean shutdown in tunnel mode because | |||
| some protocols transported over HTTP may need this, regardless of option | |||
| abortonclose, thus we can't set the option inconditionally | |||
| - for all other modes, we do want to close the dirty way because we're | |||
| certain whether we've sent everything or not, and we don't want to eat | |||
| all source ports. | |||
| The solution is a bit complex and applies to DONE/TUNNEL states : | |||
| 1) disable automatic close for everything not a tunnel and not just | |||
| keep-alive / server-close. Force-close is now covered, as is HTTP/1.0 | |||
| which implicitly works in force-close mode ; | |||
| 2) when processing option abortonclose, we know we can disable lingering | |||
| if the client has closed and the connection is not in tunnel mode. | |||
| Since the last case above leads to a situation where the client side reports | |||
| an error, we know the connection will not be reused, so leaving the flag on | |||
| the stream-interface is safe. A client closing in the middle of the data | |||
| transmission already aborts the transaction so this case is not a problem. | |||
| This fix must be backported to 1.5 where the problem was detected. | |||
| (cherry picked from commit bbfb6c40854925367ae5f9e8b22c5c9a18dc69d5) | |||
| --- | |||
| src/proto_http.c | 14 ++++++++++---- | |||
| 1 file changed, 10 insertions(+), 4 deletions(-) | |||
| diff --git a/src/proto_http.c b/src/proto_http.c | |||
| index 0ac3a47..5db64b5 100644 | |||
| --- a/src/proto_http.c | |||
| +++ b/src/proto_http.c | |||
| @@ -5452,9 +5452,10 @@ int http_request_forward_body(struct session *s, struct channel *req, int an_bit | |||
| msg->sov -= msg->next; | |||
| msg->next = 0; | |||
| - /* for keep-alive we don't want to forward closes on DONE */ | |||
| - if ((txn->flags & TX_CON_WANT_MSK) == TX_CON_WANT_KAL || | |||
| - (txn->flags & TX_CON_WANT_MSK) == TX_CON_WANT_SCL) | |||
| + /* we don't want to forward closes on DONE except in | |||
| + * tunnel mode. | |||
| + */ | |||
| + if ((txn->flags & TX_CON_WANT_MSK) != TX_CON_WANT_TUN) | |||
| channel_dont_close(req); | |||
| if (http_resync_states(s)) { | |||
| /* some state changes occurred, maybe the analyser | |||
| @@ -5478,10 +5479,15 @@ int http_request_forward_body(struct session *s, struct channel *req, int an_bit | |||
| * want to monitor the client's connection and forward | |||
| * any shutdown notification to the server, which will | |||
| * decide whether to close or to go on processing the | |||
| - * request. | |||
| + * request. We only do that in tunnel mode, and not in | |||
| + * other modes since it can be abused to exhaust source | |||
| + * ports. | |||
| */ | |||
| if (s->be->options & PR_O_ABRT_CLOSE) { | |||
| channel_auto_read(req); | |||
| + if ((req->flags & (CF_SHUTR|CF_READ_NULL)) && | |||
| + ((txn->flags & TX_CON_WANT_MSK) != TX_CON_WANT_TUN)) | |||
| + s->si[1].flags |= SI_FL_NOLINGER; | |||
| channel_auto_close(req); | |||
| } | |||
| else if (s->txn.meth == HTTP_METH_POST) { | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 28
net/haproxy/patches/0003-BUG-MINOR-check-fix-tcpcheck-error-message.patch
View File
| @ -1,28 +0,0 @@ | |||
| From 68e4fc2b9910dd090c5e729203b72444f75aaa75 Mon Sep 17 00:00:00 2001 | |||
| From: Baptiste Assmann <bedis9@gmail.com> | |||
| Date: Fri, 1 May 2015 08:09:29 +0200 | |||
| Subject: [PATCH 3/8] BUG/MINOR: check: fix tcpcheck error message | |||
| add the keyword 'string' when required (error in a tcpcheck expect | |||
| string) | |||
| (cherry picked from commit 96a5c9b57738c05ecce7822093b9c4118123dc1e) | |||
| --- | |||
| src/checks.c | 2 +- | |||
| 1 file changed, 1 insertion(+), 1 deletion(-) | |||
| diff --git a/src/checks.c b/src/checks.c | |||
| index 71debb6..8b53f97 100644 | |||
| --- a/src/checks.c | |||
| +++ b/src/checks.c | |||
| @@ -614,7 +614,7 @@ static void chk_report_conn_err(struct connection *conn, int errno_bck, int expi | |||
| } | |||
| else if (check->last_started_step && check->last_started_step->action == TCPCHK_ACT_EXPECT) { | |||
| if (check->last_started_step->string) | |||
| - chunk_appendf(chk, " (string '%s')", check->last_started_step->string); | |||
| + chunk_appendf(chk, " (expect string '%s')", check->last_started_step->string); | |||
| else if (check->last_started_step->expect_regex) | |||
| chunk_appendf(chk, " (expect regex)"); | |||
| } | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 178
net/haproxy/patches/0004-CLEANUP-checks-fix-double-usage-of-cur-current_step-.patch
View File
| @ -1,178 +0,0 @@ | |||
| From 4f889006269e4d3f802de46f280ed198a15e3a69 Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Wed, 13 May 2015 11:23:01 +0200 | |||
| Subject: [PATCH 4/8] CLEANUP: checks: fix double usage of cur / current_step | |||
| in tcp-checks | |||
| This cleanup is a preliminary requirement to the upcoming fixes for | |||
| the bug that affect tcp-check's improper use of lists. It will have | |||
| to be backported to 1.5 though it will not easily apply. | |||
| There are two variables pointing to the current rule within the loop, | |||
| and either one or the other is used depending on the code blocks, | |||
| making it much harder to apply checks to fix the list walking bug. | |||
| So first get rid of "cur" and only focus on current_step. | |||
| (cherry picked from commit ce8c42a37a44a1e0cb94e81abb7cc2baf3d0ef80) | |||
| [wt: 1.5 doesn't have comments so this patch differs significantly | |||
| from 1.6, but it's needed for the next batch of fixes] | |||
| --- | |||
| src/checks.c | 57 ++++++++++++++++++++++++++++----------------------------- | |||
| 1 file changed, 28 insertions(+), 29 deletions(-) | |||
| diff --git a/src/checks.c b/src/checks.c | |||
| index 8b53f97..cfdfe8c 100644 | |||
| --- a/src/checks.c | |||
| +++ b/src/checks.c | |||
| @@ -1859,7 +1859,7 @@ static int tcpcheck_get_step_id(struct server *s) | |||
| static void tcpcheck_main(struct connection *conn) | |||
| { | |||
| char *contentptr; | |||
| - struct tcpcheck_rule *cur, *next; | |||
| + struct tcpcheck_rule *next; | |||
| int done = 0, ret = 0; | |||
| struct check *check = conn->owner; | |||
| struct server *s = check->server; | |||
| @@ -1916,15 +1916,11 @@ static void tcpcheck_main(struct connection *conn) | |||
| check->bo->o = 0; | |||
| check->bi->p = check->bi->data; | |||
| check->bi->i = 0; | |||
| - cur = check->current_step = LIST_ELEM(head->n, struct tcpcheck_rule *, list); | |||
| + check->current_step = LIST_ELEM(head->n, struct tcpcheck_rule *, list); | |||
| t->expire = tick_add(now_ms, MS_TO_TICKS(check->inter)); | |||
| if (s->proxy->timeout.check) | |||
| t->expire = tick_add_ifset(now_ms, s->proxy->timeout.check); | |||
| } | |||
| - /* keep on processing step */ | |||
| - else { | |||
| - cur = check->current_step; | |||
| - } | |||
| /* It's only the rules which will enable send/recv */ | |||
| __conn_data_stop_both(conn); | |||
| @@ -1934,7 +1930,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| * or if we're about to send a string that does not fit in the remaining space. | |||
| */ | |||
| if (check->bo->o && | |||
| - (&cur->list == head || | |||
| + (&check->current_step->list == head || | |||
| check->current_step->action != TCPCHK_ACT_SEND || | |||
| check->current_step->string_len >= buffer_total_space(check->bo))) { | |||
| @@ -1949,14 +1945,17 @@ static void tcpcheck_main(struct connection *conn) | |||
| } | |||
| /* did we reach the end ? If so, let's check that everything was sent */ | |||
| - if (&cur->list == head) { | |||
| + if (&check->current_step->list == head) { | |||
| if (check->bo->o) | |||
| goto out_need_io; | |||
| break; | |||
| } | |||
| - /* have 'next' point to the next rule or NULL if we're on the last one */ | |||
| - next = (struct tcpcheck_rule *)cur->list.n; | |||
| + /* have 'next' point to the next rule or NULL if we're on the | |||
| + * last one, connect() needs this. | |||
| + */ | |||
| + next = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + | |||
| if (&next->list == head) | |||
| next = NULL; | |||
| @@ -2058,8 +2057,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| } | |||
| /* allow next rule */ | |||
| - cur = (struct tcpcheck_rule *)cur->list.n; | |||
| - check->current_step = cur; | |||
| + check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| /* don't do anything until the connection is established */ | |||
| if (!(conn->flags & CO_FL_CONNECTED)) { | |||
| @@ -2113,8 +2111,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| *check->bo->p = '\0'; /* to make gdb output easier to read */ | |||
| /* go to next rule and try to send */ | |||
| - cur = (struct tcpcheck_rule *)cur->list.n; | |||
| - check->current_step = cur; | |||
| + check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| } /* end 'send' */ | |||
| else if (check->current_step->action == TCPCHK_ACT_EXPECT) { | |||
| if (unlikely(check->result == CHK_RES_FAILED)) | |||
| @@ -2167,14 +2164,14 @@ static void tcpcheck_main(struct connection *conn) | |||
| goto out_end_tcpcheck; | |||
| } | |||
| - if (!done && (cur->string != NULL) && (check->bi->i < cur->string_len) ) | |||
| + if (!done && (check->current_step->string != NULL) && (check->bi->i < check->current_step->string_len) ) | |||
| continue; /* try to read more */ | |||
| tcpcheck_expect: | |||
| - if (cur->string != NULL) | |||
| - ret = my_memmem(contentptr, check->bi->i, cur->string, cur->string_len) != NULL; | |||
| - else if (cur->expect_regex != NULL) | |||
| - ret = regex_exec(cur->expect_regex, contentptr); | |||
| + if (check->current_step->string != NULL) | |||
| + ret = my_memmem(contentptr, check->bi->i, check->current_step->string, check->current_step->string_len) != NULL; | |||
| + else if (check->current_step->expect_regex != NULL) | |||
| + ret = regex_exec(check->current_step->expect_regex, contentptr); | |||
| if (!ret && !done) | |||
| continue; /* try to read more */ | |||
| @@ -2182,11 +2179,11 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* matched */ | |||
| if (ret) { | |||
| /* matched but we did not want to => ERROR */ | |||
| - if (cur->inverse) { | |||
| + if (check->current_step->inverse) { | |||
| /* we were looking for a string */ | |||
| - if (cur->string != NULL) { | |||
| + if (check->current_step->string != NULL) { | |||
| chunk_printf(&trash, "TCPCHK matched unwanted content '%s' at step %d", | |||
| - cur->string, tcpcheck_get_step_id(s)); | |||
| + check->current_step->string, tcpcheck_get_step_id(s)); | |||
| } | |||
| else { | |||
| /* we were looking for a regex */ | |||
| @@ -2198,8 +2195,9 @@ static void tcpcheck_main(struct connection *conn) | |||
| } | |||
| /* matched and was supposed to => OK, next step */ | |||
| else { | |||
| - cur = (struct tcpcheck_rule*)cur->list.n; | |||
| - check->current_step = cur; | |||
| + /* allow next rule */ | |||
| + check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + | |||
| if (check->current_step->action == TCPCHK_ACT_EXPECT) | |||
| goto tcpcheck_expect; | |||
| __conn_data_stop_recv(conn); | |||
| @@ -2208,9 +2206,10 @@ static void tcpcheck_main(struct connection *conn) | |||
| else { | |||
| /* not matched */ | |||
| /* not matched and was not supposed to => OK, next step */ | |||
| - if (cur->inverse) { | |||
| - cur = (struct tcpcheck_rule*)cur->list.n; | |||
| - check->current_step = cur; | |||
| + if (check->current_step->inverse) { | |||
| + /* allow next rule */ | |||
| + check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + | |||
| if (check->current_step->action == TCPCHK_ACT_EXPECT) | |||
| goto tcpcheck_expect; | |||
| __conn_data_stop_recv(conn); | |||
| @@ -2218,9 +2217,9 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* not matched but was supposed to => ERROR */ | |||
| else { | |||
| /* we were looking for a string */ | |||
| - if (cur->string != NULL) { | |||
| + if (check->current_step->string != NULL) { | |||
| chunk_printf(&trash, "TCPCHK did not match content '%s' at step %d", | |||
| - cur->string, tcpcheck_get_step_id(s)); | |||
| + check->current_step->string, tcpcheck_get_step_id(s)); | |||
| } | |||
| else { | |||
| /* we were looking for a regex */ | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 53
net/haproxy/patches/0005-BUG-MEDIUM-checks-do-not-dereference-head-of-a-tcp-c.patch
View File
| @ -1,53 +0,0 @@ | |||
| From b94a6d5a37499ce6649ad58f4a8c4664779abd8b Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Wed, 13 May 2015 11:38:17 +0200 | |||
| Subject: [PATCH 5/8] BUG/MEDIUM: checks: do not dereference head of a | |||
| tcp-check at the end | |||
| When the end of the list is reached, the current step's action is checked | |||
| to know if we must poll or not. Unfortunately, the main reason for going | |||
| there is that we walked past the end of list and current_step points to | |||
| the head. We cannot dereference ->action since it does not belong to this | |||
| structure and can definitely crash if the address is not mapped. | |||
| This bug is unlikely to cause a crash since the action appears just after | |||
| the list, and corresponds to the "char *check_req" pointer in the proxy | |||
| struct, and it seems that we can't go there with current_step being null. | |||
| At worst it can cause the check to register for recv events. | |||
| This fix needs to be backported to 1.5 since the code is incorrect there | |||
| as well. | |||
| (cherry picked from commit 53c5a049e1f4dbf67412472e23690dc6b3c8d0f8) | |||
| --- | |||
| src/checks.c | 5 +++-- | |||
| 1 file changed, 3 insertions(+), 2 deletions(-) | |||
| diff --git a/src/checks.c b/src/checks.c | |||
| index cfdfe8c..a887be1 100644 | |||
| --- a/src/checks.c | |||
| +++ b/src/checks.c | |||
| @@ -2237,10 +2237,12 @@ static void tcpcheck_main(struct connection *conn) | |||
| goto out_end_tcpcheck; | |||
| out_need_io: | |||
| + /* warning, current_step may now point to the head */ | |||
| if (check->bo->o) | |||
| __conn_data_want_send(conn); | |||
| - if (check->current_step->action == TCPCHK_ACT_EXPECT) | |||
| + if (&check->current_step->list != head && | |||
| + check->current_step->action == TCPCHK_ACT_EXPECT) | |||
| __conn_data_want_recv(conn); | |||
| return; | |||
| @@ -2256,7 +2258,6 @@ static void tcpcheck_main(struct connection *conn) | |||
| conn->flags |= CO_FL_ERROR; | |||
| __conn_data_stop_both(conn); | |||
| - | |||
| return; | |||
| } | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 82
net/haproxy/patches/0006-CLEANUP-checks-simplify-the-loop-processing-of-tcp-c.patch
View File
| @ -1,82 +0,0 @@ | |||
| From ebb2bceb34d7787453548627ed0e99c60354672b Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Wed, 13 May 2015 11:59:14 +0200 | |||
| Subject: [PATCH 6/8] CLEANUP: checks: simplify the loop processing of | |||
| tcp-checks | |||
| There is some unobvious redundancy between the various ways we can leave | |||
| the loop. Some of them can be factored out. So now we leave the loop when | |||
| we can't go further, whether it's caused by reaching the end of the rules | |||
| or by a blocking I/O. | |||
| (cherry picked from commit 263013d031d754c9f96de0d0cb5afcc011af6441) | |||
| [wt: this patch is required for the next fix] | |||
| --- | |||
| src/checks.c | 26 ++++++++++++++------------ | |||
| 1 file changed, 14 insertions(+), 12 deletions(-) | |||
| diff --git a/src/checks.c b/src/checks.c | |||
| index a887be1..a0c42f2 100644 | |||
| --- a/src/checks.c | |||
| +++ b/src/checks.c | |||
| @@ -1926,8 +1926,10 @@ static void tcpcheck_main(struct connection *conn) | |||
| __conn_data_stop_both(conn); | |||
| while (1) { | |||
| - /* we have to try to flush the output buffer before reading, at the end, | |||
| - * or if we're about to send a string that does not fit in the remaining space. | |||
| + /* We have to try to flush the output buffer before reading, at | |||
| + * the end, or if we're about to send a string that does not fit | |||
| + * in the remaining space. That explains why we break out of the | |||
| + * loop after this control. | |||
| */ | |||
| if (check->bo->o && | |||
| (&check->current_step->list == head || | |||
| @@ -1940,16 +1942,12 @@ static void tcpcheck_main(struct connection *conn) | |||
| __conn_data_stop_both(conn); | |||
| goto out_end_tcpcheck; | |||
| } | |||
| - goto out_need_io; | |||
| + break; | |||
| } | |||
| } | |||
| - /* did we reach the end ? If so, let's check that everything was sent */ | |||
| - if (&check->current_step->list == head) { | |||
| - if (check->bo->o) | |||
| - goto out_need_io; | |||
| + if (&check->current_step->list == head) | |||
| break; | |||
| - } | |||
| /* have 'next' point to the next rule or NULL if we're on the | |||
| * last one, connect() needs this. | |||
| @@ -2131,7 +2129,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| } | |||
| } | |||
| else | |||
| - goto out_need_io; | |||
| + break; | |||
| } | |||
| /* mark the step as started */ | |||
| @@ -2233,10 +2231,14 @@ static void tcpcheck_main(struct connection *conn) | |||
| } /* end expect */ | |||
| } /* end loop over double chained step list */ | |||
| - set_server_check_status(check, HCHK_STATUS_L7OKD, "(tcp-check)"); | |||
| - goto out_end_tcpcheck; | |||
| + /* We're waiting for some I/O to complete, we've reached the end of the | |||
| + * rules, or both. Do what we have to do, otherwise we're done. | |||
| + */ | |||
| + if (&check->current_step->list == head && !check->bo->o) { | |||
| + set_server_check_status(check, HCHK_STATUS_L7OKD, "(tcp-check)"); | |||
| + goto out_end_tcpcheck; | |||
| + } | |||
| - out_need_io: | |||
| /* warning, current_step may now point to the head */ | |||
| if (check->bo->o) | |||
| __conn_data_want_send(conn); | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 90
net/haproxy/patches/0007-BUG-MAJOR-checks-always-check-for-end-of-list-before.patch
View File
| @ -1,90 +0,0 @@ | |||
| From 97fccc87f1297d189ee80735e5b8746c34956eda Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Wed, 13 May 2015 12:08:21 +0200 | |||
| Subject: [PATCH 7/8] BUG/MAJOR: checks: always check for end of list before | |||
| proceeding | |||
| This is the most important fix of this series. There's a risk of endless | |||
| loop and crashes caused by the fact that we go past the head of the list | |||
| when skipping to next rule, without checking if it's still a valid element. | |||
| Most of the time, the ->action field is checked, which points to the proxy's | |||
| check_req pointer (generally NULL), meaning the element is confused with a | |||
| TCPCHK_ACT_SEND action. | |||
| The situation was accidently made worse with the addition of tcp-check | |||
| comment since it also skips list elements. However, since the action that | |||
| makes it go forward is TCPCHK_ACT_COMMENT (3), there's little chance to | |||
| see this as a valid pointer, except on 64-bit machines where it can match | |||
| the end of a check_req string pointer. | |||
| This fix heavily depends on previous cleanup and both must be backported | |||
| to 1.5 where the bug is present. | |||
| (cherry picked from commit f2c87353a7f8160930b5f342bb6d6ad0991ee3d1) | |||
| [wt: this patch differs significantly from 1.6 since we don't have comments] | |||
| --- | |||
| src/cfgparse.c | 4 +++- | |||
| src/checks.c | 12 ++++++++++++ | |||
| 2 files changed, 15 insertions(+), 1 deletion(-) | |||
| diff --git a/src/cfgparse.c b/src/cfgparse.c | |||
| index 746c7eb..dba59d1 100644 | |||
| --- a/src/cfgparse.c | |||
| +++ b/src/cfgparse.c | |||
| @@ -4368,7 +4368,9 @@ stats_error_parsing: | |||
| l = (struct list *)&curproxy->tcpcheck_rules; | |||
| if (l->p != l->n) { | |||
| tcpcheck = (struct tcpcheck_rule *)l->n; | |||
| - if (tcpcheck && tcpcheck->action != TCPCHK_ACT_CONNECT) { | |||
| + | |||
| + if (&tcpcheck->list != &curproxy->tcpcheck_rules | |||
| + && tcpcheck->action != TCPCHK_ACT_CONNECT) { | |||
| Alert("parsing [%s:%d] : first step MUST also be a 'connect' when there is a 'connect' step in the tcp-check ruleset.\n", | |||
| file, linenum); | |||
| err_code |= ERR_ALERT | ERR_FATAL; | |||
| diff --git a/src/checks.c b/src/checks.c | |||
| index a0c42f2..e13d561 100644 | |||
| --- a/src/checks.c | |||
| +++ b/src/checks.c | |||
| @@ -2057,6 +2057,9 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* allow next rule */ | |||
| check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + if (&check->current_step->list == head) | |||
| + break; | |||
| + | |||
| /* don't do anything until the connection is established */ | |||
| if (!(conn->flags & CO_FL_CONNECTED)) { | |||
| /* update expire time, should be done by process_chk */ | |||
| @@ -2110,6 +2113,9 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* go to next rule and try to send */ | |||
| check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + | |||
| + if (&check->current_step->list == head) | |||
| + break; | |||
| } /* end 'send' */ | |||
| else if (check->current_step->action == TCPCHK_ACT_EXPECT) { | |||
| if (unlikely(check->result == CHK_RES_FAILED)) | |||
| @@ -2196,6 +2202,9 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* allow next rule */ | |||
| check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + if (&check->current_step->list == head) | |||
| + break; | |||
| + | |||
| if (check->current_step->action == TCPCHK_ACT_EXPECT) | |||
| goto tcpcheck_expect; | |||
| __conn_data_stop_recv(conn); | |||
| @@ -2208,6 +2217,9 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* allow next rule */ | |||
| check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + if (&check->current_step->list == head) | |||
| + break; | |||
| + | |||
| if (check->current_step->action == TCPCHK_ACT_EXPECT) | |||
| goto tcpcheck_expect; | |||
| __conn_data_stop_recv(conn); | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 116
net/haproxy/patches/0008-BUG-MEDIUM-checks-do-not-dereference-a-list-as-a-tcp.patch
View File
| @ -1,116 +0,0 @@ | |||
| From 5bff05986c501d9ffb67873b60472f9c2a2e41be Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Wed, 13 May 2015 12:24:53 +0200 | |||
| Subject: [PATCH 8/8] BUG/MEDIUM: checks: do not dereference a list as a | |||
| tcpcheck struct | |||
| The method used to skip to next rule in the list is wrong, it assumes | |||
| that the list element starts at the same offset as the rule. It happens | |||
| to be true on most architectures since the list is the first element for | |||
| now but it's definitely wrong. Now the code doesn't crash anymore when | |||
| the struct list is moved anywhere else in the struct tcpcheck_rule. | |||
| This fix must be backported to 1.5. | |||
| (cherry picked from commit 5581c27b579cbfc53afb0ca04cdeebe7e2200131) | |||
| [wt: changes from 1.6 : no tcp-check comments, check becomes s->proxy] | |||
| --- | |||
| src/cfgparse.c | 18 +++++++----------- | |||
| src/checks.c | 15 +++++++++------ | |||
| 2 files changed, 16 insertions(+), 17 deletions(-) | |||
| diff --git a/src/cfgparse.c b/src/cfgparse.c | |||
| index dba59d1..e04eff8 100644 | |||
| --- a/src/cfgparse.c | |||
| +++ b/src/cfgparse.c | |||
| @@ -4362,20 +4362,16 @@ stats_error_parsing: | |||
| const char *ptr_arg; | |||
| int cur_arg; | |||
| struct tcpcheck_rule *tcpcheck; | |||
| - struct list *l; | |||
| /* check if first rule is also a 'connect' action */ | |||
| - l = (struct list *)&curproxy->tcpcheck_rules; | |||
| - if (l->p != l->n) { | |||
| - tcpcheck = (struct tcpcheck_rule *)l->n; | |||
| + tcpcheck = LIST_NEXT(&curproxy->tcpcheck_rules, struct tcpcheck_rule *, list); | |||
| - if (&tcpcheck->list != &curproxy->tcpcheck_rules | |||
| - && tcpcheck->action != TCPCHK_ACT_CONNECT) { | |||
| - Alert("parsing [%s:%d] : first step MUST also be a 'connect' when there is a 'connect' step in the tcp-check ruleset.\n", | |||
| - file, linenum); | |||
| - err_code |= ERR_ALERT | ERR_FATAL; | |||
| - goto out; | |||
| - } | |||
| + if (&tcpcheck->list != &curproxy->tcpcheck_rules | |||
| + && tcpcheck->action != TCPCHK_ACT_CONNECT) { | |||
| + Alert("parsing [%s:%d] : first step MUST also be a 'connect' when there is a 'connect' step in the tcp-check ruleset.\n", | |||
| + file, linenum); | |||
| + err_code |= ERR_ALERT | ERR_FATAL; | |||
| + goto out; | |||
| } | |||
| cur_arg = 2; | |||
| diff --git a/src/checks.c b/src/checks.c | |||
| index e13d561..27a23b2 100644 | |||
| --- a/src/checks.c | |||
| +++ b/src/checks.c | |||
| @@ -1444,7 +1444,10 @@ static int connect_chk(struct task *t) | |||
| quickack = check->type == 0 || check->type == PR_O2_TCPCHK_CHK; | |||
| if (check->type == PR_O2_TCPCHK_CHK && !LIST_ISEMPTY(&s->proxy->tcpcheck_rules)) { | |||
| - struct tcpcheck_rule *r = (struct tcpcheck_rule *) s->proxy->tcpcheck_rules.n; | |||
| + struct tcpcheck_rule *r; | |||
| + | |||
| + r = LIST_NEXT(&s->proxy->tcpcheck_rules, struct tcpcheck_rule *, list); | |||
| + | |||
| /* if first step is a 'connect', then tcpcheck_main must run it */ | |||
| if (r->action == TCPCHK_ACT_CONNECT) { | |||
| tcpcheck_main(conn); | |||
| @@ -1952,7 +1955,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* have 'next' point to the next rule or NULL if we're on the | |||
| * last one, connect() needs this. | |||
| */ | |||
| - next = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + next = LIST_NEXT(&check->current_step->list, struct tcpcheck_rule *, list); | |||
| if (&next->list == head) | |||
| next = NULL; | |||
| @@ -2055,7 +2058,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| } | |||
| /* allow next rule */ | |||
| - check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + check->current_step = LIST_NEXT(&check->current_step->list, struct tcpcheck_rule *, list); | |||
| if (&check->current_step->list == head) | |||
| break; | |||
| @@ -2112,7 +2115,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| *check->bo->p = '\0'; /* to make gdb output easier to read */ | |||
| /* go to next rule and try to send */ | |||
| - check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + check->current_step = LIST_NEXT(&check->current_step->list, struct tcpcheck_rule *, list); | |||
| if (&check->current_step->list == head) | |||
| break; | |||
| @@ -2200,7 +2203,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* matched and was supposed to => OK, next step */ | |||
| else { | |||
| /* allow next rule */ | |||
| - check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + check->current_step = LIST_NEXT(&check->current_step->list, struct tcpcheck_rule *, list); | |||
| if (&check->current_step->list == head) | |||
| break; | |||
| @@ -2215,7 +2218,7 @@ static void tcpcheck_main(struct connection *conn) | |||
| /* not matched and was not supposed to => OK, next step */ | |||
| if (check->current_step->inverse) { | |||
| /* allow next rule */ | |||
| - check->current_step = (struct tcpcheck_rule *)check->current_step->list.n; | |||
| + check->current_step = LIST_NEXT(&check->current_step->list, struct tcpcheck_rule *, list); | |||
| if (&check->current_step->list == head) | |||
| break; | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 77
net/haproxy/patches/0009-BUG-MEDIUM-peers-apply-a-random-reconnection-timeout.patch
View File
| @ -1,77 +0,0 @@ | |||
| From 76a06b2804bcdba0fb2c19f834bdb511ce3cf344 Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Wed, 20 May 2015 10:39:04 +0200 | |||
| Subject: [PATCH 09/10] BUG/MEDIUM: peers: apply a random reconnection timeout | |||
| Commit 9ff95bb ("BUG/MEDIUM: peers: correctly configure the client timeout") | |||
| uncovered an old bug in the peers : upon disconnect, we reconnect immediately. | |||
| This sometimes results in both ends to do the same thing in parallel causing | |||
| a loop of connect/accept/close/close that can last several seconds. The risk | |||
| of occurrence of the trouble increases with latency, and is emphasized by the | |||
| fact that idle connections are now frequently recycled (after 5s of idle). | |||
| In order to avoid this we must apply a random delay before reconnecting. | |||
| Fortunately the mechanism already supports a reconnect delay, so here we | |||
| compute the random timeout when killing a session. The delay is 50ms plus | |||
| a random between 0 and 2 seconds. Ideally an exponential back-off would | |||
| be preferred but it's preferable to keep the fix simple. | |||
| This bug was reported by Marco Corte. | |||
| This fix must be backported to 1.5 since the fix above was backported into | |||
| 1.5.12. | |||
| (cherry picked from commit b4e34da692d8a7f6837ad16b3389f5830dbc11d2) | |||
| --- | |||
| src/peers.c | 14 +++++++++++--- | |||
| 1 file changed, 11 insertions(+), 3 deletions(-) | |||
| diff --git a/src/peers.c b/src/peers.c | |||
| index b196d88..159f0a4 100644 | |||
| --- a/src/peers.c | |||
| +++ b/src/peers.c | |||
| @@ -1063,6 +1063,7 @@ static void peer_session_forceshutdown(struct session * session) | |||
| { | |||
| struct stream_interface *oldsi = NULL; | |||
| struct appctx *appctx = NULL; | |||
| + struct peer_session *ps; | |||
| int i; | |||
| for (i = 0; i <= 1; i++) { | |||
| @@ -1079,6 +1080,14 @@ static void peer_session_forceshutdown(struct session * session) | |||
| if (!appctx) | |||
| return; | |||
| + ps = (struct peer_session *)appctx->ctx.peers.ptr; | |||
| + /* we're killing a connection, we must apply a random delay before | |||
| + * retrying otherwise the other end will do the same and we can loop | |||
| + * for a while. | |||
| + */ | |||
| + if (ps) | |||
| + ps->reconnect = tick_add(now_ms, MS_TO_TICKS(50 + random() % 2000)); | |||
| + | |||
| /* call release to reinit resync states if needed */ | |||
| peer_session_release(oldsi); | |||
| appctx->st0 = PEER_SESS_ST_END; | |||
| @@ -1352,8 +1361,8 @@ static struct task *process_peer_sync(struct task * task) | |||
| if (!ps->session) { | |||
| /* no active session */ | |||
| if (ps->statuscode == 0 || | |||
| - ps->statuscode == PEER_SESS_SC_SUCCESSCODE || | |||
| ((ps->statuscode == PEER_SESS_SC_CONNECTCODE || | |||
| + ps->statuscode == PEER_SESS_SC_SUCCESSCODE || | |||
| ps->statuscode == PEER_SESS_SC_CONNECTEDCODE) && | |||
| tick_is_expired(ps->reconnect, now_ms))) { | |||
| /* connection never tried | |||
| @@ -1364,8 +1373,7 @@ static struct task *process_peer_sync(struct task * task) | |||
| /* retry a connect */ | |||
| ps->session = peer_session_create(ps->peer, ps); | |||
| } | |||
| - else if (ps->statuscode == PEER_SESS_SC_CONNECTCODE || | |||
| - ps->statuscode == PEER_SESS_SC_CONNECTEDCODE) { | |||
| + else if (!tick_is_expired(ps->reconnect, now_ms)) { | |||
| /* If previous session failed during connection | |||
| * but reconnection timer is not expired */ | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 33
net/haproxy/patches/0010-DOC-Update-doc-about-weight-act-and-bck-fields-in-th.patch
View File
| @ -1,33 +0,0 @@ | |||
| From ac372e18c422841a9f1197b4238637c470e8edca Mon Sep 17 00:00:00 2001 | |||
| From: Pavlos Parissis <pavlos.parissis@gmail.com> | |||
| Date: Sat, 2 May 2015 20:30:44 +0200 | |||
| Subject: [PATCH 10/10] DOC: Update doc about weight, act and bck fields in the | |||
| statistics | |||
| Reorder description of the mentioned fields in order to match the | |||
| order of types | |||
| (cherry picked from commit 1f673c72c11d011bbd24e309d3155384eddf7a46) | |||
| --- | |||
| doc/configuration.txt | 6 +++--- | |||
| 1 file changed, 3 insertions(+), 3 deletions(-) | |||
| diff --git a/doc/configuration.txt b/doc/configuration.txt | |||
| index a9d497e..6f5eeb1 100644 | |||
| --- a/doc/configuration.txt | |||
| +++ b/doc/configuration.txt | |||
| @@ -13240,9 +13240,9 @@ S (Servers). | |||
| server. The server value counts the number of times that server was | |||
| switched away from. | |||
| 17. status [LFBS]: status (UP/DOWN/NOLB/MAINT/MAINT(via)...) | |||
| - 18. weight [..BS]: server weight (server), total weight (backend) | |||
| - 19. act [..BS]: server is active (server), number of active servers (backend) | |||
| - 20. bck [..BS]: server is backup (server), number of backup servers (backend) | |||
| + 18. weight [..BS]: total weight (backend), server weight (server) | |||
| + 19. act [..BS]: number of active servers (backend), server is active (server) | |||
| + 20. bck [..BS]: number of backup servers (backend), server is backup (server) | |||
| 21. chkfail [...S]: number of failed checks. (Only counts checks failed when | |||
| the server is up.) | |||
| 22. chkdown [..BS]: number of UP->DOWN transitions. The backend counter counts | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 64
net/haproxy/patches/0011-MINOR-ssl-add-a-destructor-to-free-allocated-SSL-res.patch
View File
| @ -1,64 +0,0 @@ | |||
| From 269a02fbb332da8faf6c2a614d45d5b5018816d1 Mon Sep 17 00:00:00 2001 | |||
| From: Remi Gacogne <rgacogne@aquaray.fr> | |||
| Date: Thu, 28 May 2015 16:39:47 +0200 | |||
| Subject: [PATCH 11/14] MINOR: ssl: add a destructor to free allocated SSL | |||
| ressources | |||
| Using valgrind or another memory leak tracking tool is easier | |||
| when the memory internally allocated by OpenSSL is cleanly released | |||
| at shutdown. | |||
| (cherry picked from commit d3a23c3eb8c0950d26204568a133207099923494) | |||
| --- | |||
| src/ssl_sock.c | 36 ++++++++++++++++++++++++++++++++++++ | |||
| 1 file changed, 36 insertions(+) | |||
| diff --git a/src/ssl_sock.c b/src/ssl_sock.c | |||
| index d0f4d01..a78fc6a 100644 | |||
| --- a/src/ssl_sock.c | |||
| +++ b/src/ssl_sock.c | |||
| @@ -4717,6 +4717,42 @@ static void __ssl_sock_init(void) | |||
| cfg_register_keywords(&cfg_kws); | |||
| } | |||
| +__attribute__((destructor)) | |||
| +static void __ssl_sock_deinit(void) | |||
| +{ | |||
| +#ifndef OPENSSL_NO_DH | |||
| + if (local_dh_1024) { | |||
| + DH_free(local_dh_1024); | |||
| + local_dh_1024 = NULL; | |||
| + } | |||
| + | |||
| + if (local_dh_2048) { | |||
| + DH_free(local_dh_2048); | |||
| + local_dh_2048 = NULL; | |||
| + } | |||
| + | |||
| + if (local_dh_4096) { | |||
| + DH_free(local_dh_4096); | |||
| + local_dh_4096 = NULL; | |||
| + } | |||
| + | |||
| + if (local_dh_8192) { | |||
| + DH_free(local_dh_8192); | |||
| + local_dh_8192 = NULL; | |||
| + } | |||
| +#endif | |||
| + | |||
| + ERR_remove_state(0); | |||
| + ERR_free_strings(); | |||
| + | |||
| + EVP_cleanup(); | |||
| + | |||
| +#if OPENSSL_VERSION_NUMBER >= 0x00907000L | |||
| + CRYPTO_cleanup_all_ex_data(); | |||
| +#endif | |||
| +} | |||
| + | |||
| + | |||
| /* | |||
| * Local variables: | |||
| * c-indent-level: 8 | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 98
net/haproxy/patches/0012-BUG-MEDIUM-ssl-fix-tune.ssl.default-dh-param-value-b.patch
View File
| @ -1,98 +0,0 @@ | |||
| From 5d769ca828fdb055052b3dbc232864bdf2853c9f Mon Sep 17 00:00:00 2001 | |||
| From: Remi Gacogne <rgacogne@aquaray.fr> | |||
| Date: Thu, 28 May 2015 16:23:00 +0200 | |||
| Subject: [PATCH 12/14] BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value | |||
| being overwritten | |||
| MIME-Version: 1.0 | |||
| Content-Type: text/plain; charset=UTF-8 | |||
| Content-Transfer-Encoding: 8bit | |||
| Hervé Commowick reported that the logic used to avoid complaining about | |||
| ssl-default-dh-param not being set when static DH params are present | |||
| in the certificate file was clearly wrong when more than one sni_ctx | |||
| is used. | |||
| This patch stores whether static DH params are being used for each | |||
| SSL_CTX individually, and does not overwrite the value of | |||
| tune.ssl.default-dh-param. | |||
| (cherry picked from commit 4f902b88323927c9d25d391a809e3678ac31df41) | |||
| --- | |||
| src/ssl_sock.c | 28 +++++++++++++++++++++++----- | |||
| 1 file changed, 23 insertions(+), 5 deletions(-) | |||
| diff --git a/src/ssl_sock.c b/src/ssl_sock.c | |||
| index a78fc6a..0f7819b 100644 | |||
| --- a/src/ssl_sock.c | |||
| +++ b/src/ssl_sock.c | |||
| @@ -47,6 +47,9 @@ | |||
| #ifdef SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB | |||
| #include <openssl/ocsp.h> | |||
| #endif | |||
| +#ifndef OPENSSL_NO_DH | |||
| +#include <openssl/dh.h> | |||
| +#endif | |||
| #include <common/buffer.h> | |||
| #include <common/compat.h> | |||
| @@ -107,6 +110,7 @@ int sslconns = 0; | |||
| int totalsslconns = 0; | |||
| #ifndef OPENSSL_NO_DH | |||
| +static int ssl_dh_ptr_index = -1; | |||
| static DH *local_dh_1024 = NULL; | |||
| static DH *local_dh_2048 = NULL; | |||
| static DH *local_dh_4096 = NULL; | |||
| @@ -1076,10 +1080,12 @@ int ssl_sock_load_dh_params(SSL_CTX *ctx, const char *file) | |||
| if (dh) { | |||
| ret = 1; | |||
| SSL_CTX_set_tmp_dh(ctx, dh); | |||
| - /* Setting ssl default dh param to the size of the static DH params | |||
| - found in the file. This way we know that there is no use | |||
| - complaining later about ssl-default-dh-param not being set. */ | |||
| - global.tune.ssl_default_dh_param = DH_size(dh) * 8; | |||
| + | |||
| + if (ssl_dh_ptr_index >= 0) { | |||
| + /* store a pointer to the DH params to avoid complaining about | |||
| + ssl-default-dh-param not being set for this SSL_CTX */ | |||
| + SSL_CTX_set_ex_data(ctx, ssl_dh_ptr_index, dh); | |||
| + } | |||
| } | |||
| else { | |||
| /* Clear openssl global errors stack */ | |||
| @@ -1274,6 +1280,12 @@ static int ssl_sock_load_cert_file(const char *path, struct bind_conf *bind_conf | |||
| * the tree, so it will be discovered and cleaned in time. | |||
| */ | |||
| #ifndef OPENSSL_NO_DH | |||
| + /* store a NULL pointer to indicate we have not yet loaded | |||
| + a custom DH param file */ | |||
| + if (ssl_dh_ptr_index >= 0) { | |||
| + SSL_CTX_set_ex_data(ctx, ssl_dh_ptr_index, NULL); | |||
| + } | |||
| + | |||
| ret = ssl_sock_load_dh_params(ctx, path); | |||
| if (ret < 0) { | |||
| if (err) | |||
| @@ -1593,7 +1605,9 @@ int ssl_sock_prepare_ctx(struct bind_conf *bind_conf, SSL_CTX *ctx, struct proxy | |||
| /* If tune.ssl.default-dh-param has not been set and | |||
| no static DH params were in the certificate file. */ | |||
| - if (global.tune.ssl_default_dh_param == 0) { | |||
| + if (global.tune.ssl_default_dh_param == 0 && | |||
| + (ssl_dh_ptr_index == -1 || | |||
| + SSL_CTX_get_ex_data(ctx, ssl_dh_ptr_index) == NULL)) { | |||
| ciphers = ctx->cipher_list; | |||
| if (ciphers) { | |||
| @@ -4715,6 +4729,10 @@ static void __ssl_sock_init(void) | |||
| bind_register_keywords(&bind_kws); | |||
| srv_register_keywords(&srv_kws); | |||
| cfg_register_keywords(&cfg_kws); | |||
| + | |||
| +#ifndef OPENSSL_NO_DH | |||
| + ssl_dh_ptr_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL); | |||
| +#endif | |||
| } | |||
| __attribute__((destructor)) | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 29
net/haproxy/patches/0013-BUG-MINOR-cfgparse-fix-typo-in-option-httplog-error-.patch
View File
| @ -1,29 +0,0 @@ | |||
| From 629b1c000b26f0031246b9b529680b275a14118f Mon Sep 17 00:00:00 2001 | |||
| From: William Lallemand <wlallemand@haproxy.com> | |||
| Date: Thu, 28 May 2015 18:02:48 +0200 | |||
| Subject: [PATCH 13/14] BUG/MINOR: cfgparse: fix typo in 'option httplog' error | |||
| message | |||
| The error message was displaying the wrong argument when 'option | |||
| httplog' took a wrong argument. | |||
| (cherry picked from commit 77063bc0c6ceb4257c4e2c08411811ecc48be1aa) | |||
| --- | |||
| src/cfgparse.c | 2 +- | |||
| 1 file changed, 1 insertion(+), 1 deletion(-) | |||
| diff --git a/src/cfgparse.c b/src/cfgparse.c | |||
| index e04eff8..3c3383d 100644 | |||
| --- a/src/cfgparse.c | |||
| +++ b/src/cfgparse.c | |||
| @@ -3792,7 +3792,7 @@ stats_error_parsing: | |||
| curproxy->options2 |= PR_O2_CLFLOG; | |||
| logformat = clf_http_log_format; | |||
| } else { | |||
| - Alert("parsing [%s:%d] : keyword '%s' only supports option 'clf'.\n", file, linenum, args[2]); | |||
| + Alert("parsing [%s:%d] : keyword '%s' only supports option 'clf'.\n", file, linenum, args[1]); | |||
| err_code |= ERR_ALERT | ERR_FATAL; | |||
| goto out; | |||
| } | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 41
net/haproxy/patches/0014-BUG-MEDIUM-cfgparse-segfault-when-userlist-is-misuse.patch
View File
| @ -1,41 +0,0 @@ | |||
| From faf3315f77c527e6e1d027deb7e853cdf6af5858 Mon Sep 17 00:00:00 2001 | |||
| From: William Lallemand <wlallemand@haproxy.com> | |||
| Date: Thu, 28 May 2015 18:03:51 +0200 | |||
| Subject: [PATCH 14/14] BUG/MEDIUM: cfgparse: segfault when userlist is misused | |||
| If the 'userlist' keyword parsing returns an error and no userlist were | |||
| previously created. The parsing of 'user' and 'group' leads to NULL | |||
| derefence. | |||
| The userlist pointer is now tested to prevent this issue. | |||
| (cherry picked from commit 4ac9f546120d42be8147e3d90588e7b9738af0cc) | |||
| --- | |||
| src/cfgparse.c | 5 +++++ | |||
| 1 file changed, 5 insertions(+) | |||
| diff --git a/src/cfgparse.c b/src/cfgparse.c | |||
| index 3c3383d..392a78d 100644 | |||
| --- a/src/cfgparse.c | |||
| +++ b/src/cfgparse.c | |||
| @@ -5668,6 +5668,9 @@ cfg_parse_users(const char *file, int linenum, char **args, int kwm) | |||
| goto out; | |||
| } | |||
| + if (!userlist) | |||
| + goto out; | |||
| + | |||
| for (ag = userlist->groups; ag; ag = ag->next) | |||
| if (!strcmp(ag->name, args[1])) { | |||
| Warning("parsing [%s:%d]: ignoring duplicated group '%s' in userlist '%s'.\n", | |||
| @@ -5718,6 +5721,8 @@ cfg_parse_users(const char *file, int linenum, char **args, int kwm) | |||
| err_code |= ERR_ALERT | ERR_FATAL; | |||
| goto out; | |||
| } | |||
| + if (!userlist) | |||
| + goto out; | |||
| for (newuser = userlist->users; newuser; newuser = newuser->next) | |||
| if (!strcmp(newuser->user, args[1])) { | |||
| -- | |||
| 2.0.5 | |||
+ 0
- 427
net/haproxy/patches/0015-MEDIUM-ssl-replace-standards-DH-groups-with-custom-o.patch
View File
| @ -1,427 +0,0 @@ | |||
| From 2ad3ec1ab5379a16b16aba48a42ced27b170534e Mon Sep 17 00:00:00 2001 | |||
| From: Remi Gacogne <rgacogne@aquaray.fr> | |||
| Date: Fri, 29 May 2015 16:26:17 +0200 | |||
| Subject: [PATCH 15/18] MEDIUM: ssl: replace standards DH groups with custom | |||
| ones | |||
| MIME-Version: 1.0 | |||
| Content-Type: text/plain; charset=UTF-8 | |||
| Content-Transfer-Encoding: 8bit | |||
| It is likely that powerful adversaries have been pre-computing the | |||
| standardized DH groups, because being widely used have made them | |||
| valuable targets. While users are advised to generate their own | |||
| DH parameters, replace the ones we ship by values been randomly | |||
| generated for this product only. | |||
| [wt: replaced dh1024_p, dh2048_p, and dh4096_p with locally-generated | |||
| ones as recommended by Rémi] | |||
| (cherry picked from commit d3a341a96fb6107d2b8e3d7a9c0afa2ff43bb0b6) | |||
| --- | |||
| src/ssl_sock.c | 340 +++++++++++++++++---------------------------------------- | |||
| 1 file changed, 102 insertions(+), 238 deletions(-) | |||
| diff --git a/src/ssl_sock.c b/src/ssl_sock.c | |||
| index 0f7819b..93aab8b 100644 | |||
| --- a/src/ssl_sock.c | |||
| +++ b/src/ssl_sock.c | |||
| @@ -114,7 +114,6 @@ static int ssl_dh_ptr_index = -1; | |||
| static DH *local_dh_1024 = NULL; | |||
| static DH *local_dh_2048 = NULL; | |||
| static DH *local_dh_4096 = NULL; | |||
| -static DH *local_dh_8192 = NULL; | |||
| #endif /* OPENSSL_NO_DH */ | |||
| #ifdef SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB | |||
| @@ -766,32 +765,28 @@ static int ssl_sock_switchctx_cbk(SSL *ssl, int *al, struct bind_conf *s) | |||
| static DH * ssl_get_dh_1024(void) | |||
| { | |||
| -#if OPENSSL_VERSION_NUMBER < 0x0090801fL | |||
| - static const unsigned char rfc_2409_prime_1024[] = { | |||
| - 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, | |||
| - 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, | |||
| - 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, | |||
| - 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, | |||
| - 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, | |||
| - 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, | |||
| - 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, | |||
| - 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, | |||
| - 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, | |||
| - 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE6,0x53,0x81, | |||
| - 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF, | |||
| - }; | |||
| -#endif | |||
| + static unsigned char dh1024_p[]={ | |||
| + 0xFA,0xF9,0x2A,0x22,0x2A,0xA7,0x7F,0xE1,0x67,0x4E,0x53,0xF7, | |||
| + 0x56,0x13,0xC3,0xB1,0xE3,0x29,0x6B,0x66,0x31,0x6A,0x7F,0xB3, | |||
| + 0xC2,0x68,0x6B,0xCB,0x1D,0x57,0x39,0x1D,0x1F,0xFF,0x1C,0xC9, | |||
| + 0xA6,0xA4,0x98,0x82,0x31,0x5D,0x25,0xFF,0x8A,0xE0,0x73,0x96, | |||
| + 0x81,0xC8,0x83,0x79,0xC1,0x5A,0x04,0xF8,0x37,0x0D,0xA8,0x3D, | |||
| + 0xAE,0x74,0xBC,0xDB,0xB6,0xA4,0x75,0xD9,0x71,0x8A,0xA0,0x17, | |||
| + 0x9E,0x2D,0xC8,0xA8,0xDF,0x2C,0x5F,0x82,0x95,0xF8,0x92,0x9B, | |||
| + 0xA7,0x33,0x5F,0x89,0x71,0xC8,0x2D,0x6B,0x18,0x86,0xC4,0x94, | |||
| + 0x22,0xA5,0x52,0x8D,0xF6,0xF6,0xD2,0x37,0x92,0x0F,0xA5,0xCC, | |||
| + 0xDB,0x7B,0x1D,0x3D,0xA1,0x31,0xB7,0x80,0x8F,0x0B,0x67,0x5E, | |||
| + 0x36,0xA5,0x60,0x0C,0xF1,0x95,0x33,0x8B, | |||
| + }; | |||
| + static unsigned char dh1024_g[]={ | |||
| + 0x02, | |||
| + }; | |||
| + | |||
| DH *dh = DH_new(); | |||
| if (dh) { | |||
| -#if OPENSSL_VERSION_NUMBER >= 0x0090801fL | |||
| - dh->p = get_rfc2409_prime_1024(NULL); | |||
| -#else | |||
| - dh->p = BN_bin2bn(rfc_2409_prime_1024, sizeof rfc_2409_prime_1024, NULL); | |||
| -#endif | |||
| - /* See RFC 2409, Section 6 "Oakley Groups" | |||
| - for the reason why 2 is used as generator. | |||
| - */ | |||
| - BN_dec2bn(&dh->g, "2"); | |||
| + dh->p = BN_bin2bn(dh1024_p, sizeof dh1024_p, NULL); | |||
| + dh->g = BN_bin2bn(dh1024_g, sizeof dh1024_g, NULL); | |||
| + | |||
| if (!dh->p || !dh->g) { | |||
| DH_free(dh); | |||
| dh = NULL; | |||
| @@ -802,43 +797,39 @@ static DH * ssl_get_dh_1024(void) | |||
| static DH *ssl_get_dh_2048(void) | |||
| { | |||
| -#if OPENSSL_VERSION_NUMBER < 0x0090801fL | |||
| - static const unsigned char rfc_3526_prime_2048[] = { | |||
| - 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, | |||
| - 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, | |||
| - 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, | |||
| - 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, | |||
| - 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, | |||
| - 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, | |||
| - 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, | |||
| - 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, | |||
| - 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, | |||
| - 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D, | |||
| - 0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36, | |||
| - 0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, | |||
| - 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56, | |||
| - 0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D, | |||
| - 0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08, | |||
| - 0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, | |||
| - 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2, | |||
| - 0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9, | |||
| - 0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C, | |||
| - 0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, | |||
| - 0x15,0x72,0x8E,0x5A,0x8A,0xAC,0xAA,0x68,0xFF,0xFF,0xFF,0xFF, | |||
| - 0xFF,0xFF,0xFF,0xFF, | |||
| - }; | |||
| -#endif | |||
| + static unsigned char dh2048_p[]={ | |||
| + 0xEC,0x86,0xF8,0x70,0xA0,0x33,0x16,0xEC,0x05,0x1A,0x73,0x59, | |||
| + 0xCD,0x1F,0x8B,0xF8,0x29,0xE4,0xD2,0xCF,0x52,0xDD,0xC2,0x24, | |||
| + 0x8D,0xB5,0x38,0x9A,0xFB,0x5C,0xA4,0xE4,0xB2,0xDA,0xCE,0x66, | |||
| + 0x50,0x74,0xA6,0x85,0x4D,0x4B,0x1D,0x30,0xB8,0x2B,0xF3,0x10, | |||
| + 0xE9,0xA7,0x2D,0x05,0x71,0xE7,0x81,0xDF,0x8B,0x59,0x52,0x3B, | |||
| + 0x5F,0x43,0x0B,0x68,0xF1,0xDB,0x07,0xBE,0x08,0x6B,0x1B,0x23, | |||
| + 0xEE,0x4D,0xCC,0x9E,0x0E,0x43,0xA0,0x1E,0xDF,0x43,0x8C,0xEC, | |||
| + 0xBE,0xBE,0x90,0xB4,0x51,0x54,0xB9,0x2F,0x7B,0x64,0x76,0x4E, | |||
| + 0x5D,0xD4,0x2E,0xAE,0xC2,0x9E,0xAE,0x51,0x43,0x59,0xC7,0x77, | |||
| + 0x9C,0x50,0x3C,0x0E,0xED,0x73,0x04,0x5F,0xF1,0x4C,0x76,0x2A, | |||
| + 0xD8,0xF8,0xCF,0xFC,0x34,0x40,0xD1,0xB4,0x42,0x61,0x84,0x66, | |||
| + 0x42,0x39,0x04,0xF8,0x68,0xB2,0x62,0xD7,0x55,0xED,0x1B,0x74, | |||
| + 0x75,0x91,0xE0,0xC5,0x69,0xC1,0x31,0x5C,0xDB,0x7B,0x44,0x2E, | |||
| + 0xCE,0x84,0x58,0x0D,0x1E,0x66,0x0C,0xC8,0x44,0x9E,0xFD,0x40, | |||
| + 0x08,0x67,0x5D,0xFB,0xA7,0x76,0x8F,0x00,0x11,0x87,0xE9,0x93, | |||
| + 0xF9,0x7D,0xC4,0xBC,0x74,0x55,0x20,0xD4,0x4A,0x41,0x2F,0x43, | |||
| + 0x42,0x1A,0xC1,0xF2,0x97,0x17,0x49,0x27,0x37,0x6B,0x2F,0x88, | |||
| + 0x7E,0x1C,0xA0,0xA1,0x89,0x92,0x27,0xD9,0x56,0x5A,0x71,0xC1, | |||
| + 0x56,0x37,0x7E,0x3A,0x9D,0x05,0xE7,0xEE,0x5D,0x8F,0x82,0x17, | |||
| + 0xBC,0xE9,0xC2,0x93,0x30,0x82,0xF9,0xF4,0xC9,0xAE,0x49,0xDB, | |||
| + 0xD0,0x54,0xB4,0xD9,0x75,0x4D,0xFA,0x06,0xB8,0xD6,0x38,0x41, | |||
| + 0xB7,0x1F,0x77,0xF3, | |||
| + }; | |||
| + static unsigned char dh2048_g[]={ | |||
| + 0x02, | |||
| + }; | |||
| + | |||
| DH *dh = DH_new(); | |||
| if (dh) { | |||
| -#if OPENSSL_VERSION_NUMBER >= 0x0090801fL | |||
| - dh->p = get_rfc3526_prime_2048(NULL); | |||
| -#else | |||
| - dh->p = BN_bin2bn(rfc_3526_prime_2048, sizeof rfc_3526_prime_2048, NULL); | |||
| -#endif | |||
| - /* See RFC 3526, Section 3 "2048-bit MODP Group" | |||
| - for the reason why 2 is used as generator. | |||
| - */ | |||
| - BN_dec2bn(&dh->g, "2"); | |||
| + dh->p = BN_bin2bn(dh2048_p, sizeof dh2048_p, NULL); | |||
| + dh->g = BN_bin2bn(dh2048_g, sizeof dh2048_g, NULL); | |||
| + | |||
| if (!dh->p || !dh->g) { | |||
| DH_free(dh); | |||
| dh = NULL; | |||
| @@ -849,175 +840,60 @@ static DH *ssl_get_dh_2048(void) | |||
| static DH *ssl_get_dh_4096(void) | |||
| { | |||
| -#if OPENSSL_VERSION_NUMBER < 0x0090801fL | |||
| - static const unsigned char rfc_3526_prime_4096[] = { | |||
| - 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, | |||
| - 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, | |||
| - 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, | |||
| - 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, | |||
| - 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, | |||
| - 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, | |||
| - 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, | |||
| - 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, | |||
| - 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, | |||
| - 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D, | |||
| - 0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36, | |||
| - 0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, | |||
| - 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56, | |||
| - 0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D, | |||
| - 0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08, | |||
| - 0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, | |||
| - 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2, | |||
| - 0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9, | |||
| - 0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C, | |||
| - 0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, | |||
| - 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D, | |||
| - 0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64, | |||
| - 0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57, | |||
| - 0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, | |||
| - 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0, | |||
| - 0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B, | |||
| - 0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73, | |||
| - 0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, | |||
| - 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0, | |||
| - 0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31, | |||
| - 0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20, | |||
| - 0xA9,0x21,0x08,0x01,0x1A,0x72,0x3C,0x12,0xA7,0x87,0xE6,0xD7, | |||
| - 0x88,0x71,0x9A,0x10,0xBD,0xBA,0x5B,0x26,0x99,0xC3,0x27,0x18, | |||
| - 0x6A,0xF4,0xE2,0x3C,0x1A,0x94,0x68,0x34,0xB6,0x15,0x0B,0xDA, | |||
| - 0x25,0x83,0xE9,0xCA,0x2A,0xD4,0x4C,0xE8,0xDB,0xBB,0xC2,0xDB, | |||
| - 0x04,0xDE,0x8E,0xF9,0x2E,0x8E,0xFC,0x14,0x1F,0xBE,0xCA,0xA6, | |||
| - 0x28,0x7C,0x59,0x47,0x4E,0x6B,0xC0,0x5D,0x99,0xB2,0x96,0x4F, | |||
| - 0xA0,0x90,0xC3,0xA2,0x23,0x3B,0xA1,0x86,0x51,0x5B,0xE7,0xED, | |||
| - 0x1F,0x61,0x29,0x70,0xCE,0xE2,0xD7,0xAF,0xB8,0x1B,0xDD,0x76, | |||
| - 0x21,0x70,0x48,0x1C,0xD0,0x06,0x91,0x27,0xD5,0xB0,0x5A,0xA9, | |||
| - 0x93,0xB4,0xEA,0x98,0x8D,0x8F,0xDD,0xC1,0x86,0xFF,0xB7,0xDC, | |||
| - 0x90,0xA6,0xC0,0x8F,0x4D,0xF4,0x35,0xC9,0x34,0x06,0x31,0x99, | |||
| - 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF, | |||
| + static unsigned char dh4096_p[]={ | |||
| + 0xDE,0x16,0x94,0xCD,0x99,0x58,0x07,0xF1,0xF7,0x32,0x96,0x11, | |||
| + 0x04,0x82,0xD4,0x84,0x72,0x80,0x99,0x06,0xCA,0xF0,0xA3,0x68, | |||
| + 0x07,0xCE,0x64,0x50,0xE7,0x74,0x45,0x20,0x80,0x5E,0x4D,0xAD, | |||
| + 0xA5,0xB6,0xED,0xFA,0x80,0x6C,0x3B,0x35,0xC4,0x9A,0x14,0x6B, | |||
| + 0x32,0xBB,0xFD,0x1F,0x17,0x8E,0xB7,0x1F,0xD6,0xFA,0x3F,0x7B, | |||
| + 0xEE,0x16,0xA5,0x62,0x33,0x0D,0xED,0xBC,0x4E,0x58,0xE5,0x47, | |||
| + 0x4D,0xE9,0xAB,0x8E,0x38,0xD3,0x6E,0x90,0x57,0xE3,0x22,0x15, | |||
| + 0x33,0xBD,0xF6,0x43,0x45,0xB5,0x10,0x0A,0xBE,0x2C,0xB4,0x35, | |||
| + 0xB8,0x53,0x8D,0xAD,0xFB,0xA7,0x1F,0x85,0x58,0x41,0x7A,0x79, | |||
| + 0x20,0x68,0xB3,0xE1,0x3D,0x08,0x76,0xBF,0x86,0x0D,0x49,0xE3, | |||
| + 0x82,0x71,0x8C,0xB4,0x8D,0x81,0x84,0xD4,0xE7,0xBE,0x91,0xDC, | |||
| + 0x26,0x39,0x48,0x0F,0x35,0xC4,0xCA,0x65,0xE3,0x40,0x93,0x52, | |||
| + 0x76,0x58,0x7D,0xDD,0x51,0x75,0xDC,0x69,0x61,0xBF,0x47,0x2C, | |||
| + 0x16,0x68,0x2D,0xC9,0x29,0xD3,0xE6,0xC0,0x99,0x48,0xA0,0x9A, | |||
| + 0xC8,0x78,0xC0,0x6D,0x81,0x67,0x12,0x61,0x3F,0x71,0xBA,0x41, | |||
| + 0x1F,0x6C,0x89,0x44,0x03,0xBA,0x3B,0x39,0x60,0xAA,0x28,0x55, | |||
| + 0x59,0xAE,0xB8,0xFA,0xCB,0x6F,0xA5,0x1A,0xF7,0x2B,0xDD,0x52, | |||
| + 0x8A,0x8B,0xE2,0x71,0xA6,0x5E,0x7E,0xD8,0x2E,0x18,0xE0,0x66, | |||
| + 0xDF,0xDD,0x22,0x21,0x99,0x52,0x73,0xA6,0x33,0x20,0x65,0x0E, | |||
| + 0x53,0xE7,0x6B,0x9B,0xC5,0xA3,0x2F,0x97,0x65,0x76,0xD3,0x47, | |||
| + 0x23,0x77,0x12,0xB6,0x11,0x7B,0x24,0xED,0xF1,0xEF,0xC0,0xE2, | |||
| + 0xA3,0x7E,0x67,0x05,0x3E,0x96,0x4D,0x45,0xC2,0x18,0xD1,0x73, | |||
| + 0x9E,0x07,0xF3,0x81,0x6E,0x52,0x63,0xF6,0x20,0x76,0xB9,0x13, | |||
| + 0xD2,0x65,0x30,0x18,0x16,0x09,0x16,0x9E,0x8F,0xF1,0xD2,0x10, | |||
| + 0x5A,0xD3,0xD4,0xAF,0x16,0x61,0xDA,0x55,0x2E,0x18,0x5E,0x14, | |||
| + 0x08,0x54,0x2E,0x2A,0x25,0xA2,0x1A,0x9B,0x8B,0x32,0xA9,0xFD, | |||
| + 0xC2,0x48,0x96,0xE1,0x80,0xCA,0xE9,0x22,0x17,0xBB,0xCE,0x3E, | |||
| + 0x9E,0xED,0xC7,0xF1,0x1F,0xEC,0x17,0x21,0xDC,0x7B,0x82,0x48, | |||
| + 0x8E,0xBB,0x4B,0x9D,0x5B,0x04,0x04,0xDA,0xDB,0x39,0xDF,0x01, | |||
| + 0x40,0xC3,0xAA,0x26,0x23,0x89,0x75,0xC6,0x0B,0xD0,0xA2,0x60, | |||
| + 0x6A,0xF1,0xCC,0x65,0x18,0x98,0x1B,0x52,0xD2,0x74,0x61,0xCC, | |||
| + 0xBD,0x60,0xAE,0xA3,0xA0,0x66,0x6A,0x16,0x34,0x92,0x3F,0x41, | |||
| + 0x40,0x31,0x29,0xC0,0x2C,0x63,0xB2,0x07,0x8D,0xEB,0x94,0xB8, | |||
| + 0xE8,0x47,0x92,0x52,0x93,0x6A,0x1B,0x7E,0x1A,0x61,0xB3,0x1B, | |||
| + 0xF0,0xD6,0x72,0x9B,0xF1,0xB0,0xAF,0xBF,0x3E,0x65,0xEF,0x23, | |||
| + 0x1D,0x6F,0xFF,0x70,0xCD,0x8A,0x4C,0x8A,0xA0,0x72,0x9D,0xBE, | |||
| + 0xD4,0xBB,0x24,0x47,0x4A,0x68,0xB5,0xF5,0xC6,0xD5,0x7A,0xCD, | |||
| + 0xCA,0x06,0x41,0x07,0xAD,0xC2,0x1E,0xE6,0x54,0xA7,0xAD,0x03, | |||
| + 0xD9,0x12,0xC1,0x9C,0x13,0xB1,0xC9,0x0A,0x43,0x8E,0x1E,0x08, | |||
| + 0xCE,0x50,0x82,0x73,0x5F,0xA7,0x55,0x1D,0xD9,0x59,0xAC,0xB5, | |||
| + 0xEA,0x02,0x7F,0x6C,0x5B,0x74,0x96,0x98,0x67,0x24,0xA3,0x0F, | |||
| + 0x15,0xFC,0xA9,0x7D,0x3E,0x67,0xD1,0x70,0xF8,0x97,0xF3,0x67, | |||
| + 0xC5,0x8C,0x88,0x44,0x08,0x02,0xC7,0x2B, | |||
| }; | |||
| -#endif | |||
| - DH *dh = DH_new(); | |||
| - if (dh) { | |||
| -#if OPENSSL_VERSION_NUMBER >= 0x0090801fL | |||
| - dh->p = get_rfc3526_prime_4096(NULL); | |||
| -#else | |||
| - dh->p = BN_bin2bn(rfc_3526_prime_4096, sizeof rfc_3526_prime_4096, NULL); | |||
| -#endif | |||
| - /* See RFC 3526, Section 5 "4096-bit MODP Group" | |||
| - for the reason why 2 is used as generator. | |||
| - */ | |||
| - BN_dec2bn(&dh->g, "2"); | |||
| - if (!dh->p || !dh->g) { | |||
| - DH_free(dh); | |||
| - dh = NULL; | |||
| - } | |||
| - } | |||
| - return dh; | |||
| -} | |||
| + static unsigned char dh4096_g[]={ | |||
| + 0x02, | |||
| + }; | |||
| -static DH *ssl_get_dh_8192(void) | |||
| -{ | |||
| -#if OPENSSL_VERSION_NUMBER < 0x0090801fL | |||
| - static const unsigned char rfc_3526_prime_8192[] = { | |||
| - 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, | |||
| - 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, | |||
| - 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, | |||
| - 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, | |||
| - 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, | |||
| - 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, | |||
| - 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, | |||
| - 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, | |||
| - 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, | |||
| - 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D, | |||
| - 0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36, | |||
| - 0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, | |||
| - 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56, | |||
| - 0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D, | |||
| - 0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08, | |||
| - 0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, | |||
| - 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2, | |||
| - 0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9, | |||
| - 0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C, | |||
| - 0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, | |||
| - 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D, | |||
| - 0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64, | |||
| - 0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57, | |||
| - 0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, | |||
| - 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0, | |||
| - 0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B, | |||
| - 0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73, | |||
| - 0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, | |||
| - 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0, | |||
| - 0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31, | |||
| - 0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20, | |||
| - 0xA9,0x21,0x08,0x01,0x1A,0x72,0x3C,0x12,0xA7,0x87,0xE6,0xD7, | |||
| - 0x88,0x71,0x9A,0x10,0xBD,0xBA,0x5B,0x26,0x99,0xC3,0x27,0x18, | |||
| - 0x6A,0xF4,0xE2,0x3C,0x1A,0x94,0x68,0x34,0xB6,0x15,0x0B,0xDA, | |||
| - 0x25,0x83,0xE9,0xCA,0x2A,0xD4,0x4C,0xE8,0xDB,0xBB,0xC2,0xDB, | |||
| - 0x04,0xDE,0x8E,0xF9,0x2E,0x8E,0xFC,0x14,0x1F,0xBE,0xCA,0xA6, | |||
| - 0x28,0x7C,0x59,0x47,0x4E,0x6B,0xC0,0x5D,0x99,0xB2,0x96,0x4F, | |||
| - 0xA0,0x90,0xC3,0xA2,0x23,0x3B,0xA1,0x86,0x51,0x5B,0xE7,0xED, | |||
| - 0x1F,0x61,0x29,0x70,0xCE,0xE2,0xD7,0xAF,0xB8,0x1B,0xDD,0x76, | |||
| - 0x21,0x70,0x48,0x1C,0xD0,0x06,0x91,0x27,0xD5,0xB0,0x5A,0xA9, | |||
| - 0x93,0xB4,0xEA,0x98,0x8D,0x8F,0xDD,0xC1,0x86,0xFF,0xB7,0xDC, | |||
| - 0x90,0xA6,0xC0,0x8F,0x4D,0xF4,0x35,0xC9,0x34,0x02,0x84,0x92, | |||
| - 0x36,0xC3,0xFA,0xB4,0xD2,0x7C,0x70,0x26,0xC1,0xD4,0xDC,0xB2, | |||
| - 0x60,0x26,0x46,0xDE,0xC9,0x75,0x1E,0x76,0x3D,0xBA,0x37,0xBD, | |||
| - 0xF8,0xFF,0x94,0x06,0xAD,0x9E,0x53,0x0E,0xE5,0xDB,0x38,0x2F, | |||
| - 0x41,0x30,0x01,0xAE,0xB0,0x6A,0x53,0xED,0x90,0x27,0xD8,0x31, | |||
| - 0x17,0x97,0x27,0xB0,0x86,0x5A,0x89,0x18,0xDA,0x3E,0xDB,0xEB, | |||
| - 0xCF,0x9B,0x14,0xED,0x44,0xCE,0x6C,0xBA,0xCE,0xD4,0xBB,0x1B, | |||
| - 0xDB,0x7F,0x14,0x47,0xE6,0xCC,0x25,0x4B,0x33,0x20,0x51,0x51, | |||
| - 0x2B,0xD7,0xAF,0x42,0x6F,0xB8,0xF4,0x01,0x37,0x8C,0xD2,0xBF, | |||
| - 0x59,0x83,0xCA,0x01,0xC6,0x4B,0x92,0xEC,0xF0,0x32,0xEA,0x15, | |||
| - 0xD1,0x72,0x1D,0x03,0xF4,0x82,0xD7,0xCE,0x6E,0x74,0xFE,0xF6, | |||
| - 0xD5,0x5E,0x70,0x2F,0x46,0x98,0x0C,0x82,0xB5,0xA8,0x40,0x31, | |||
| - 0x90,0x0B,0x1C,0x9E,0x59,0xE7,0xC9,0x7F,0xBE,0xC7,0xE8,0xF3, | |||
| - 0x23,0xA9,0x7A,0x7E,0x36,0xCC,0x88,0xBE,0x0F,0x1D,0x45,0xB7, | |||
| - 0xFF,0x58,0x5A,0xC5,0x4B,0xD4,0x07,0xB2,0x2B,0x41,0x54,0xAA, | |||
| - 0xCC,0x8F,0x6D,0x7E,0xBF,0x48,0xE1,0xD8,0x14,0xCC,0x5E,0xD2, | |||
| - 0x0F,0x80,0x37,0xE0,0xA7,0x97,0x15,0xEE,0xF2,0x9B,0xE3,0x28, | |||
| - 0x06,0xA1,0xD5,0x8B,0xB7,0xC5,0xDA,0x76,0xF5,0x50,0xAA,0x3D, | |||
| - 0x8A,0x1F,0xBF,0xF0,0xEB,0x19,0xCC,0xB1,0xA3,0x13,0xD5,0x5C, | |||
| - 0xDA,0x56,0xC9,0xEC,0x2E,0xF2,0x96,0x32,0x38,0x7F,0xE8,0xD7, | |||
| - 0x6E,0x3C,0x04,0x68,0x04,0x3E,0x8F,0x66,0x3F,0x48,0x60,0xEE, | |||
| - 0x12,0xBF,0x2D,0x5B,0x0B,0x74,0x74,0xD6,0xE6,0x94,0xF9,0x1E, | |||
| - 0x6D,0xBE,0x11,0x59,0x74,0xA3,0x92,0x6F,0x12,0xFE,0xE5,0xE4, | |||
| - 0x38,0x77,0x7C,0xB6,0xA9,0x32,0xDF,0x8C,0xD8,0xBE,0xC4,0xD0, | |||
| - 0x73,0xB9,0x31,0xBA,0x3B,0xC8,0x32,0xB6,0x8D,0x9D,0xD3,0x00, | |||
| - 0x74,0x1F,0xA7,0xBF,0x8A,0xFC,0x47,0xED,0x25,0x76,0xF6,0x93, | |||
| - 0x6B,0xA4,0x24,0x66,0x3A,0xAB,0x63,0x9C,0x5A,0xE4,0xF5,0x68, | |||
| - 0x34,0x23,0xB4,0x74,0x2B,0xF1,0xC9,0x78,0x23,0x8F,0x16,0xCB, | |||
| - 0xE3,0x9D,0x65,0x2D,0xE3,0xFD,0xB8,0xBE,0xFC,0x84,0x8A,0xD9, | |||
| - 0x22,0x22,0x2E,0x04,0xA4,0x03,0x7C,0x07,0x13,0xEB,0x57,0xA8, | |||
| - 0x1A,0x23,0xF0,0xC7,0x34,0x73,0xFC,0x64,0x6C,0xEA,0x30,0x6B, | |||
| - 0x4B,0xCB,0xC8,0x86,0x2F,0x83,0x85,0xDD,0xFA,0x9D,0x4B,0x7F, | |||
| - 0xA2,0xC0,0x87,0xE8,0x79,0x68,0x33,0x03,0xED,0x5B,0xDD,0x3A, | |||
| - 0x06,0x2B,0x3C,0xF5,0xB3,0xA2,0x78,0xA6,0x6D,0x2A,0x13,0xF8, | |||
| - 0x3F,0x44,0xF8,0x2D,0xDF,0x31,0x0E,0xE0,0x74,0xAB,0x6A,0x36, | |||
| - 0x45,0x97,0xE8,0x99,0xA0,0x25,0x5D,0xC1,0x64,0xF3,0x1C,0xC5, | |||
| - 0x08,0x46,0x85,0x1D,0xF9,0xAB,0x48,0x19,0x5D,0xED,0x7E,0xA1, | |||
| - 0xB1,0xD5,0x10,0xBD,0x7E,0xE7,0x4D,0x73,0xFA,0xF3,0x6B,0xC3, | |||
| - 0x1E,0xCF,0xA2,0x68,0x35,0x90,0x46,0xF4,0xEB,0x87,0x9F,0x92, | |||
| - 0x40,0x09,0x43,0x8B,0x48,0x1C,0x6C,0xD7,0x88,0x9A,0x00,0x2E, | |||
| - 0xD5,0xEE,0x38,0x2B,0xC9,0x19,0x0D,0xA6,0xFC,0x02,0x6E,0x47, | |||
| - 0x95,0x58,0xE4,0x47,0x56,0x77,0xE9,0xAA,0x9E,0x30,0x50,0xE2, | |||
| - 0x76,0x56,0x94,0xDF,0xC8,0x1F,0x56,0xE8,0x80,0xB9,0x6E,0x71, | |||
| - 0x60,0xC9,0x80,0xDD,0x98,0xED,0xD3,0xDF,0xFF,0xFF,0xFF,0xFF, | |||
| - 0xFF,0xFF,0xFF,0xFF, | |||
| - }; | |||
| -#endif | |||
| DH *dh = DH_new(); | |||
| if (dh) { | |||
| -#if OPENSSL_VERSION_NUMBER >= 0x0090801fL | |||
| - dh->p = get_rfc3526_prime_8192(NULL); | |||
| -#else | |||
| - dh->p = BN_bin2bn(rfc_3526_prime_8192, sizeof rfc_3526_prime_8192, NULL); | |||
| -#endif | |||
| - /* See RFC 3526, Section 7 "8192-bit MODP Group" | |||
| - for the reason why 2 is used as generator. | |||
| - */ | |||
| - BN_dec2bn(&dh->g, "2"); | |||
| + dh->p = BN_bin2bn(dh4096_p, sizeof dh4096_p, NULL); | |||
| + dh->g = BN_bin2bn(dh4096_g, sizeof dh4096_g, NULL); | |||
| + | |||
| if (!dh->p || !dh->g) { | |||
| DH_free(dh); | |||
| dh = NULL; | |||
| @@ -1045,10 +921,7 @@ static DH *ssl_get_tmp_dh(SSL *ssl, int export, int keylen) | |||
| keylen = global.tune.ssl_default_dh_param; | |||
| } | |||
| - if (keylen >= 8192) { | |||
| - dh = local_dh_8192; | |||
| - } | |||
| - else if (keylen >= 4096) { | |||
| + if (keylen >= 4096) { | |||
| dh = local_dh_4096; | |||
| } | |||
| else if (keylen >= 2048) { | |||
| @@ -1643,10 +1516,6 @@ int ssl_sock_prepare_ctx(struct bind_conf *bind_conf, SSL_CTX *ctx, struct proxy | |||
| if (local_dh_4096 == NULL) { | |||
| local_dh_4096 = ssl_get_dh_4096(); | |||
| } | |||
| - if (global.tune.ssl_default_dh_param >= 8192 && | |||
| - local_dh_8192 == NULL) { | |||
| - local_dh_8192 = ssl_get_dh_8192(); | |||
| - } | |||
| } | |||
| } | |||
| } | |||
| @@ -4753,11 +4622,6 @@ static void __ssl_sock_deinit(void) | |||
| DH_free(local_dh_4096); | |||
| local_dh_4096 = NULL; | |||
| } | |||
| - | |||
| - if (local_dh_8192) { | |||
| - DH_free(local_dh_8192); | |||
| - local_dh_8192 = NULL; | |||
| - } | |||
| #endif | |||
| ERR_remove_state(0); | |||
| -- | |||
| 2.3.6 | |||
+ 0
- 28
net/haproxy/patches/0016-BUG-MINOR-debug-display-null-in-place-of-meth.patch
View File
| @ -1,28 +0,0 @@ | |||
| From c51fe0fb249db735c5b103ec99559a0254d58441 Mon Sep 17 00:00:00 2001 | |||
| From: Thierry FOURNIER <tfournier@haproxy.com> | |||
| Date: Wed, 3 Jun 2015 20:12:04 +0200 | |||
| Subject: [PATCH 16/18] BUG/MINOR: debug: display (null) in place of "meth" | |||
| The array which contains names of types, miss the METH entry. | |||
| [wt: should be backported to 1.5 as well] | |||
| (cherry picked from commit 4c2479e1c455e2cc46c02cfc28ea2a185f9a7747) | |||
| --- | |||
| src/sample.c | 1 + | |||
| 1 file changed, 1 insertion(+) | |||
| diff --git a/src/sample.c b/src/sample.c | |||
| index 87c9f60..59c80b2 100644 | |||
| --- a/src/sample.c | |||
| +++ b/src/sample.c | |||
| @@ -40,6 +40,7 @@ const char *smp_to_type[SMP_TYPES] = { | |||
| [SMP_T_IPV6] = "ipv6", | |||
| [SMP_T_STR] = "str", | |||
| [SMP_T_BIN] = "bin", | |||
| + [SMP_T_METH] = "meth", | |||
| }; | |||
| /* static sample used in sample_process() when <p> is NULL */ | |||
| -- | |||
| 2.3.6 | |||
+ 0
- 36
net/haproxy/patches/0017-CLEANUP-deinit-remove-codes-for-cleaning-p-block_rul.patch
View File
| @ -1,36 +0,0 @@ | |||
| From 793a74065926b0da87120d4b1e6330234475505c Mon Sep 17 00:00:00 2001 | |||
| From: Godbach <nylzhaowei@gmail.com> | |||
| Date: Tue, 9 Jun 2015 19:41:52 +0800 | |||
| Subject: [PATCH 17/18] CLEANUP: deinit: remove codes for cleaning | |||
| p->block_rules | |||
| Since all rules listed in p->block_rules have been moved to the beginning of | |||
| the http-request rules in check_config_validity(), there is no need to clean | |||
| p->block_rules in deinit(). | |||
| Signed-off-by: Godbach <nylzhaowei@gmail.com> | |||
| (cherry picked from commit 28b48ccbc879a552f988e6e1db22941e3362b4db) | |||
| --- | |||
| src/haproxy.c | 6 ------ | |||
| 1 file changed, 6 deletions(-) | |||
| diff --git a/src/haproxy.c b/src/haproxy.c | |||
| index 0dddd53..eac6f44 100644 | |||
| --- a/src/haproxy.c | |||
| +++ b/src/haproxy.c | |||
| @@ -1020,12 +1020,6 @@ void deinit(void) | |||
| free(cwl); | |||
| } | |||
| - list_for_each_entry_safe(cond, condb, &p->block_rules, list) { | |||
| - LIST_DEL(&cond->list); | |||
| - prune_acl_cond(cond); | |||
| - free(cond); | |||
| - } | |||
| - | |||
| list_for_each_entry_safe(cond, condb, &p->mon_fail_cond, list) { | |||
| LIST_DEL(&cond->list); | |||
| prune_acl_cond(cond); | |||
| -- | |||
| 2.3.6 | |||
+ 0
- 37
net/haproxy/patches/0018-BUG-MINOR-ssl-fix-smp_fetch_ssl_fc_session_id.patch
View File
| @ -1,37 +0,0 @@ | |||
| From 69760db11dfca4a8d8fbd34cec25c334f77add67 Mon Sep 17 00:00:00 2001 | |||
| From: Willy Tarreau <w@1wt.eu> | |||
| Date: Wed, 17 Jun 2015 18:34:14 +0200 | |||
| Subject: [PATCH 18/18] BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id | |||
| Dmitry Sivachenko reported the following build warning using Clang | |||
| which is a real bug : | |||
| src/ssl_sock.c:4104:44: warning: address of 'smp->data.str.len' will always | |||
| evaluate to 'true' [-Wpointer-bool-conversion] | |||
| if (!smp->data.str.str || !&smp->data.str.len) | |||
| The impact is very low however, it will return an empty session_id | |||
| instead of no session id when none is found. | |||
| The fix should be backported to 1.5. | |||
| (cherry picked from commit 745d4127582a8c66e2e8ce35f746a78e867960af) | |||
| --- | |||
| src/ssl_sock.c | 2 +- | |||
| 1 file changed, 1 insertion(+), 1 deletion(-) | |||
| diff --git a/src/ssl_sock.c b/src/ssl_sock.c | |||
| index 93aab8b..7d77d36 100644 | |||
| --- a/src/ssl_sock.c | |||
| +++ b/src/ssl_sock.c | |||
| @@ -3540,7 +3540,7 @@ smp_fetch_ssl_fc_session_id(struct proxy *px, struct session *l4, void *l7, unsi | |||
| return 0; | |||
| smp->data.str.str = (char *)SSL_SESSION_get_id(sess, (unsigned int *)&smp->data.str.len); | |||
| - if (!smp->data.str.str || !&smp->data.str.len) | |||
| + if (!smp->data.str.str || !smp->data.str.len) | |||
| return 0; | |||
| return 1; | |||
| -- | |||
| 2.3.6 | |||