Browse Source
haproxy: bump to version 1.5.16
[RELEASE] Released version 1.5.16
Released version 1.5.16 with the following main changes :
- BUG/BUILD: replace haproxy-systemd-wrapper with $(EXTRA) in install-bin.
- BUG/MINOR: acl: don't use record layer in req_ssl_ver
- BUG: http: do not abort keep-alive connections on server timeout
- BUG/MEDIUM: http: switch the request channel to no-delay once done.
- MINOR: config: extend the default max hostname length to 64 and beyond
- BUG/MEDIUM: http: don't enable auto-close on the response side
- BUG/MEDIUM: stream: fix half-closed timeout handling
- BUG/MEDIUM: cli: changing compression rate-limiting must require admin level
- BUILD: freebsd: double declaration
- BUG/MEDIUM: sample: urlp can't match an empty value
- BUG/MEDIUM: peers: table entries learned from a remote are pushed to others after a random delay.
- BUG/MEDIUM: peers: old stick table updates could be repushed.
- CLEANUP: haproxy: using _GNU_SOURCE instead of __USE_GNU macro.
- BUG/MINOR: chunk: make chunk_dup() always check and set dst->size
- MINOR: chunks: ensure that chunk_strcpy() adds a trailing zero
- MINOR: chunks: add chunk_strcat() and chunk_newstr()
- MINOR: chunk: make chunk_initstr() take a const string
- BUG/MEDIUM: config: Adding validation to stick-table expire value.
- BUG/MEDIUM: sample: http_date() doesn't provide the right day of the week
- BUG/MEDIUM: channel: fix miscalculation of available buffer space.
- BUG/MINOR: stream: don't force retries if the server is DOWN
- MINOR: unix: don't mention free ports on EAGAIN
- BUG/CLEANUP: CLI: report the proper field states in "show sess"
- MINOR: stats: send content-length with the redirect to allow keep-alive
- BUG: stream_interface: Reuse connection even if the output channel is empty
- DOC: remove old tunnel mode assumptions
- DOC: add server name at rate-limit sessions example
- BUG/MEDIUM: ssl: fix off-by-one in ALPN list allocation
- BUG/MEDIUM: ssl: fix off-by-one in NPN list allocation
- BUG/MEDIUM: stats: stats bind-process doesn't propagate the process mask correctly
- BUG/MINOR: http: Be sure to process all the data received from a server
- BUG/MEDIUM: chunks: always reject negative-length chunks
- BUG/MINOR: systemd: ensure we don't miss signals
- BUG/MINOR: systemd: report the correct signal in debug message output
- BUG/MINOR: systemd: propagate the correct signal to haproxy
- MINOR: systemd: ensure a reload doesn't mask a stop
- CLEANUP: stats: Avoid computation with uninitialized bits.
- CLEANUP: pattern: Ignore unknown samples in pat_match_ip().
- CLEANUP: map: Avoid memory leak in out-of-memory condition.
- BUG/MINOR: tcpcheck: conf parsing error when no port configured on server and last rule is a CONNECT with no port
- BUG/MINOR: tcpcheck: fix incorrect list usage resulting in failure to load certain configs
- MINOR: cfgparse: warn when uid parameter is not a number
- MINOR: cfgparse: warn when gid parameter is not a number
- BUG/MINOR: standard: Avoid free of non-allocated pointer
- BUG/MINOR: pattern: Avoid memory leak on out-of-memory condition
- CLEANUP: http: fix a build warning introduced by a recent fix
- BUG/MINOR: log: GMT offset not updated when entering/leaving DST
Signed-off-by: heil <heil@terminal-consulting.de>
lilik-openwrt-22.03
heil
9 years ago
14 changed files with 3 additions and 666 deletions
Unified View
Diff Options
-
+3 -3net/haproxy/Makefile
-
+0 -34net/haproxy/patches/0001-BUG-BUILD-replace-haproxy-systemd-wrapper-with-EXTRA.patch
-
+0 -69net/haproxy/patches/0002-BUG-MINOR-acl-don-t-use-record-layer-in-req_ssl_ver.patch
-
+0 -37net/haproxy/patches/0003-BUG-http-do-not-abort-keep-alive-connections-on-serv.patch
-
+0 -112net/haproxy/patches/0004-BUG-MEDIUM-http-switch-the-request-channel-to-no-del.patch
-
+0 -52net/haproxy/patches/0005-MINOR-config-extend-the-default-max-hostname-length-.patch
-
+0 -49net/haproxy/patches/0006-BUG-MEDIUM-http-don-t-enable-auto-close-on-the-respo.patch
-
+0 -88net/haproxy/patches/0007-BUG-MEDIUM-stream-fix-half-closed-timeout-handling.patch
-
+0 -36net/haproxy/patches/0008-BUG-MEDIUM-cli-changing-compression-rate-limiting-mu.patch
-
+0 -31net/haproxy/patches/0009-BUILD-freebsd-double-declaration.patch
-
+0 -53net/haproxy/patches/0010-BUG-MEDIUM-sample-urlp-can-t-match-an-empty-value.patch
-
+0 -31net/haproxy/patches/0011-BUG-MEDIUM-peers-table-entries-learned-from-a-remote.patch
-
+0 -28net/haproxy/patches/0012-BUG-MEDIUM-peers-old-stick-table-updates-could-be-re.patch
-
+0 -43net/haproxy/patches/0013-CLEANUP-haproxy-using-_GNU_SOURCE-instead-of-__USE_G.patch
+ 3
- 3
net/haproxy/Makefile
View File
+ 0
- 34
net/haproxy/patches/0001-BUG-BUILD-replace-haproxy-systemd-wrapper-with-EXTRA.patch
View File
| @ -1,34 +0,0 @@ | |||||
| From 4818bc3035bccc00d8c3fc9b14ec37366cac3059 Mon Sep 17 00:00:00 2001 | |||||
| From: Jerome Duval <jerome.duval@gmail.com> | |||||
| Date: Mon, 2 Nov 2015 17:47:43 +0000 | |||||
| Subject: [PATCH 01/10] BUG/BUILD: replace haproxy-systemd-wrapper with | |||||
| $(EXTRA) in install-bin. | |||||
| [wt: this should be backported to 1.6 and 1.5 as well since some platforms | |||||
| don't build the systemd-wrapper] | |||||
| (cherry picked from commit 796d2fc136359c31c5c35f00c0751890ab42a016) | |||||
| (cherry picked from commit 9d0b47d96825b0584ea81c826a96ed8babcc016b) | |||||
| --- | |||||
| Makefile | 5 ++--- | |||||
| 1 file changed, 2 insertions(+), 3 deletions(-) | |||||
| diff --git a/Makefile b/Makefile | |||||
| index 9556069..e3199b2 100644 | |||||
| --- a/Makefile | |||||
| +++ b/Makefile | |||||
| @@ -719,10 +719,9 @@ install-doc: | |||||
| install -m 644 doc/$$x.txt "$(DESTDIR)$(DOCDIR)" ; \ | |||||
| done | |||||
| -install-bin: haproxy haproxy-systemd-wrapper | |||||
| +install-bin: haproxy $(EXTRA) | |||||
| install -d "$(DESTDIR)$(SBINDIR)" | |||||
| - install haproxy "$(DESTDIR)$(SBINDIR)" | |||||
| - install haproxy-systemd-wrapper "$(DESTDIR)$(SBINDIR)" | |||||
| + install haproxy $(EXTRA) "$(DESTDIR)$(SBINDIR)" | |||||
| install: install-bin install-man install-doc | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 69
net/haproxy/patches/0002-BUG-MINOR-acl-don-t-use-record-layer-in-req_ssl_ver.patch
View File
| @ -1,69 +0,0 @@ | |||||
| From 1af6a324c3206902f69bd2c9838e94ffb4cee3ae Mon Sep 17 00:00:00 2001 | |||||
| From: Lukas Tribus <luky-37@hotmail.com> | |||||
| Date: Thu, 5 Nov 2015 13:59:30 +0100 | |||||
| Subject: [PATCH 02/10] BUG/MINOR: acl: don't use record layer in req_ssl_ver | |||||
| MIME-Version: 1.0 | |||||
| Content-Type: text/plain; charset=UTF-8 | |||||
| Content-Transfer-Encoding: 8bit | |||||
| The initial record layer version in a SSL handshake may be set to TLSv1.0 | |||||
| or similar for compatibility reasons, this is allowed as per RFC5246 | |||||
| Appendix E.1 [1]. Some implementations are Openssl [2] and NSS [3]. | |||||
| A related issue has been fixed some time ago in commit 57d229747 | |||||
| ("BUG/MINOR: acl: req_ssl_sni fails with SSLv3 record version"). | |||||
| Fix this by using the real client hello version instead of the record | |||||
| layer version. | |||||
| This was reported by Julien Vehent and analyzed by Cyril Bonté. | |||||
| The initial patch is from Julien Vehent as well. | |||||
| This should be backported to stable series, the req_ssl_ver keyword was | |||||
| first introduced in 1.3.16. | |||||
| [1] https://tools.ietf.org/html/rfc5246#appendix-E.1 | |||||
| [2] https://github.com/openssl/openssl/commit/4a1cf50187659e60c5867ecbbc36e37b2605d2c3 | |||||
| [3] https://bugzilla.mozilla.org/show_bug.cgi?id=774547 | |||||
| (cherry picked from commit c93242cab986087f06a4655d14fec18eecb7f5f4) | |||||
| (cherry picked from commit b048a6eb3d9cb518e4a378e20ba2a801afec553c) | |||||
| --- | |||||
| src/payload.c | 11 +++++++---- | |||||
| 1 file changed, 7 insertions(+), 4 deletions(-) | |||||
| diff --git a/src/payload.c b/src/payload.c | |||||
| index f62163c..b8f1ca3 100644 | |||||
| --- a/src/payload.c | |||||
| +++ b/src/payload.c | |||||
| @@ -148,21 +148,24 @@ smp_fetch_req_ssl_ver(struct proxy *px, struct session *s, void *l7, unsigned in | |||||
| data = (const unsigned char *)s->req->buf->p; | |||||
| if ((*data >= 0x14 && *data <= 0x17) || (*data == 0xFF)) { | |||||
| /* SSLv3 header format */ | |||||
| - if (bleft < 5) | |||||
| + if (bleft < 11) | |||||
| goto too_short; | |||||
| - version = (data[1] << 16) + data[2]; /* version: major, minor */ | |||||
| + version = (data[1] << 16) + data[2]; /* record layer version: major, minor */ | |||||
| msg_len = (data[3] << 8) + data[4]; /* record length */ | |||||
| /* format introduced with SSLv3 */ | |||||
| if (version < 0x00030000) | |||||
| goto not_ssl; | |||||
| - /* message length between 1 and 2^14 + 2048 */ | |||||
| - if (msg_len < 1 || msg_len > ((1<<14) + 2048)) | |||||
| + /* message length between 6 and 2^14 + 2048 */ | |||||
| + if (msg_len < 6 || msg_len > ((1<<14) + 2048)) | |||||
| goto not_ssl; | |||||
| bleft -= 5; data += 5; | |||||
| + | |||||
| + /* return the client hello client version, not the record layer version */ | |||||
| + version = (data[4] << 16) + data[5]; /* client hello version: major, minor */ | |||||
| } else { | |||||
| /* SSLv2 header format, only supported for hello (msg type 1) */ | |||||
| int rlen, plen, cilen, silen, chlen; | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 37
net/haproxy/patches/0003-BUG-http-do-not-abort-keep-alive-connections-on-serv.patch
View File
| @ -1,37 +0,0 @@ | |||||
| From ef8a113d59e89b2214adf7ab9f9b0b75905a7050 Mon Sep 17 00:00:00 2001 | |||||
| From: lsenta <laurent.senta@gmail.com> | |||||
| Date: Fri, 13 Nov 2015 10:44:22 +0100 | |||||
| Subject: [PATCH 03/10] BUG: http: do not abort keep-alive connections on | |||||
| server timeout | |||||
| When a server timeout is detected on the second or nth request of a keep-alive | |||||
| connection, HAProxy closes the connection without writing a response. | |||||
| Some clients would fail with a remote disconnected exception and some | |||||
| others would retry potentially unsafe requests. | |||||
| This patch removes the special case and makes sure a 504 timeout is | |||||
| written back whenever a server timeout is handled. | |||||
| Signed-off-by: lsenta <laurent.senta@gmail.com> | |||||
| (cherry picked from commit 1e1f41d0f3473d86da84dc3785b7d7cbef6e9044) | |||||
| (cherry picked from commit 1f279c0b116f7fbc208793fffbd256c3c736fc52) | |||||
| --- | |||||
| src/proto_http.c | 2 -- | |||||
| 1 file changed, 2 deletions(-) | |||||
| diff --git a/src/proto_http.c b/src/proto_http.c | |||||
| index 17742c6..e7e1785 100644 | |||||
| --- a/src/proto_http.c | |||||
| +++ b/src/proto_http.c | |||||
| @@ -5782,8 +5782,6 @@ int http_wait_for_response(struct session *s, struct channel *rep, int an_bit) | |||||
| else if (rep->flags & CF_READ_TIMEOUT) { | |||||
| if (msg->err_pos >= 0) | |||||
| http_capture_bad_message(&s->be->invalid_rep, s, msg, msg->msg_state, s->fe); | |||||
| - else if (txn->flags & TX_NOT_FIRST) | |||||
| - goto abort_keep_alive; | |||||
| s->be->be_counters.failed_resp++; | |||||
| if (objt_server(s->target)) { | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 112
net/haproxy/patches/0004-BUG-MEDIUM-http-switch-the-request-channel-to-no-del.patch
View File
| @ -1,112 +0,0 @@ | |||||
| From c0d56134320e507c82952f3d2a03f76b701945cb Mon Sep 17 00:00:00 2001 | |||||
| From: Willy Tarreau <w@1wt.eu> | |||||
| Date: Wed, 18 Nov 2015 11:59:55 +0100 | |||||
| Subject: [PATCH 04/10] BUG/MEDIUM: http: switch the request channel to | |||||
| no-delay once done. | |||||
| There's an issue when sending POST data that came in a second packet, | |||||
| the CF_NEVER_WAIT flag is not always set on the request channel, while | |||||
| the server is waiting for the request. We must always set this flag in | |||||
| this case since we're not going to shut down after sending, contrary | |||||
| to the response side. | |||||
| Note that option http-no-delay works around this issue. | |||||
| Reproducer : | |||||
| listen px | |||||
| mode http | |||||
| timeout client 10s | |||||
| timeout server 5s | |||||
| timeout connect 3s | |||||
| option http-server-close | |||||
| #option http-no-delay | |||||
| bind :8001 | |||||
| server s1 127.0.0.1:8003 | |||||
| $ (printf "POST / HTTP/1.1\r\nTransfer-encoding: chunked\r\n\r\n"; sleep 0.01; printf "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n") | nc6 0 8001 | |||||
| Before this fix : | |||||
| 12:03:31.946763 epoll_wait(3, {{EPOLLIN, {u32=5, u64=5}}}, 200, 1000) = 1 | |||||
| 12:03:32.634175 accept4(5, {sa_family=AF_INET, sin_port=htons(53849), sin_addr=inet_addr("127.0.0.1")}, [16], SOCK_NONBLOCK) = 6 | |||||
| 12:03:32.634318 setsockopt(6, SOL_TCP, TCP_NODELAY, [1], 4) = 0 | |||||
| 12:03:32.634434 accept4(5, 0x7ffccfbb2cf0, [128], SOCK_NONBLOCK) = -1 EAGAIN (Resource temporarily unavailable) | |||||
| 12:03:32.634574 recvfrom(6, "POST / HTTP/1.1\r\nTransfer-encodi"..., 8192, 0, NULL, NULL) = 47 | |||||
| 12:03:32.634809 setsockopt(6, SOL_TCP, TCP_QUICKACK, [1], 4) = 0 | |||||
| 12:03:32.634952 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 7 | |||||
| 12:03:32.635031 fcntl(7, F_SETFL, O_RDONLY|O_NONBLOCK) = 0 | |||||
| 12:03:32.635089 setsockopt(7, SOL_TCP, TCP_NODELAY, [1], 4) = 0 | |||||
| 12:03:32.635153 connect(7, {sa_family=AF_INET, sin_port=htons(8003), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress) | |||||
| 12:03:32.635315 epoll_wait(3, {}, 200, 0) = 0 | |||||
| 12:03:32.635394 sendto(7, "POST / HTTP/1.1\r\nTransfer-encodi"..., 66, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 66 | |||||
| 12:03:32.635527 recvfrom(6, 0x7f0224e66024, 8192, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) | |||||
| 12:03:32.635651 epoll_ctl(3, EPOLL_CTL_ADD, 6, {EPOLLIN|0x2000, {u32=6, u64=6}}) = 0 | |||||
| 12:03:32.635782 epoll_wait(3, {}, 200, 0) = 0 | |||||
| 12:03:32.635842 recvfrom(7, 0x7f0224e66024, 8192, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) | |||||
| 12:03:32.635924 epoll_ctl(3, EPOLL_CTL_ADD, 7, {EPOLLIN|0x2000, {u32=7, u64=7}}) = 0 | |||||
| 12:03:32.636027 epoll_wait(3, {{EPOLLIN, {u32=6, u64=6}}}, 200, 1000) = 1 | |||||
| 12:03:32.644892 recvfrom(6, "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n", 8192, 0, NULL, NULL) = 27 | |||||
| 12:03:32.645016 epoll_wait(3, {}, 200, 0) = 0 | |||||
| 12:03:32.645105 sendto(7, "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n", 27, MSG_DONTWAIT|MSG_NOSIGNAL|MSG_MORE, NULL, 0) = 27 | |||||
| After the fix : | |||||
| 11:59:12.538617 connect(7, {sa_family=AF_INET, sin_port=htons(8003), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress) | |||||
| 11:59:12.538787 epoll_wait(3, {}, 200, 0) = 0 | |||||
| 11:59:12.538867 sendto(7, "POST / HTTP/1.1\r\nTransfer-encodi"..., 66, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 66 | |||||
| 11:59:12.539031 recvfrom(6, 0x7f832ce45024, 8192, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) | |||||
| 11:59:12.539161 epoll_ctl(3, EPOLL_CTL_ADD, 6, {EPOLLIN|0x2000, {u32=6, u64=6}}) = 0 | |||||
| 11:59:12.539259 epoll_wait(3, {}, 200, 0) = 0 | |||||
| 11:59:12.539337 recvfrom(7, 0x7f832ce45024, 8192, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) | |||||
| 11:59:12.539421 epoll_ctl(3, EPOLL_CTL_ADD, 7, {EPOLLIN|0x2000, {u32=7, u64=7}}) = 0 | |||||
| 11:59:12.539499 epoll_wait(3, {{EPOLLIN, {u32=6, u64=6}}}, 200, 1000) = 1 | |||||
| 11:59:12.548519 recvfrom(6, "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n", 8192, 0, NULL, NULL) = 27 | |||||
| 11:59:12.548844 epoll_wait(3, {}, 200, 0) = 0 | |||||
| 11:59:12.549012 sendto(7, "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n", 27, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 27 | |||||
| 11:59:12.549454 epoll_wait(3, {}, 200, 1000) = 0 | |||||
| This fix must be backported to 1.6, 1.5 and 1.4. | |||||
| (cherry picked from commit 7f876a1eeb14ffae708327aad8a0b4b029da5e26) | |||||
| (cherry picked from commit 712a5339f384db62796aa4d4901e091dd7fd24dd) | |||||
| --- | |||||
| src/proto_http.c | 9 +++++++-- | |||||
| 1 file changed, 7 insertions(+), 2 deletions(-) | |||||
| diff --git a/src/proto_http.c b/src/proto_http.c | |||||
| index e7e1785..b32e778 100644 | |||||
| --- a/src/proto_http.c | |||||
| +++ b/src/proto_http.c | |||||
| @@ -5001,6 +5001,13 @@ int http_sync_req_state(struct session *s) | |||||
| */ | |||||
| chn->cons->flags |= SI_FL_NOHALF; | |||||
| + /* In any case we've finished parsing the request so we must | |||||
| + * disable Nagle when sending data because 1) we're not going | |||||
| + * to shut this side, and 2) the server is waiting for us to | |||||
| + * send pending data. | |||||
| + */ | |||||
| + chn->flags |= CF_NEVER_WAIT; | |||||
| + | |||||
| if (txn->rsp.msg_state == HTTP_MSG_ERROR) | |||||
| goto wait_other_side; | |||||
| @@ -5015,7 +5022,6 @@ int http_sync_req_state(struct session *s) | |||||
| /* if any side switches to tunnel mode, the other one does too */ | |||||
| channel_auto_read(chn); | |||||
| txn->req.msg_state = HTTP_MSG_TUNNEL; | |||||
| - chn->flags |= CF_NEVER_WAIT; | |||||
| goto wait_other_side; | |||||
| } | |||||
| @@ -5048,7 +5054,6 @@ int http_sync_req_state(struct session *s) | |||||
| if ((txn->flags & TX_CON_WANT_MSK) == TX_CON_WANT_TUN) { | |||||
| channel_auto_read(chn); | |||||
| txn->req.msg_state = HTTP_MSG_TUNNEL; | |||||
| - chn->flags |= CF_NEVER_WAIT; | |||||
| } | |||||
| } | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 52
net/haproxy/patches/0005-MINOR-config-extend-the-default-max-hostname-length-.patch
View File
| @ -1,52 +0,0 @@ | |||||
| From e77015cdc18ab74aba61cdf57de56d06be5c2a4d Mon Sep 17 00:00:00 2001 | |||||
| From: Willy Tarreau <w@1wt.eu> | |||||
| Date: Wed, 14 Jan 2015 11:48:58 +0100 | |||||
| Subject: [PATCH 05/10] MINOR: config: extend the default max hostname length | |||||
| to 64 and beyond | |||||
| Some users reported that the default max hostname length of 32 is too | |||||
| short in some environments. This patch does two things : | |||||
| - it relies on the system's max hostname length as found in MAXHOSTNAMELEN | |||||
| if it is set. This is the most logical thing to do as the system libs | |||||
| generally present the appropriate value supported by the system. This | |||||
| value is 64 on Linux and 256 on Solaris, to give a few examples. | |||||
| - otherwise it defaults to 64 | |||||
| It is still possible to override this value by defining MAX_HOSTNAME_LEN at | |||||
| build time. After some observation time, this patch may be backported to | |||||
| 1.5 if it does not cause any build issue, as it is harmless and may help | |||||
| some users. | |||||
| (cherry picked from commit 75abcb3106e2c27ef983df885558cf94e01f717a) | |||||
| Cc: Lukas Tribus <luky-37@hotmail.com> | |||||
| Cc: jose.castro.leon@cern.ch | |||||
| [wt: no issue reported so far and Jose rightfully asked for it in 1.5] | |||||
| --- | |||||
| include/common/defaults.h | 8 ++++++-- | |||||
| 1 file changed, 6 insertions(+), 2 deletions(-) | |||||
| diff --git a/include/common/defaults.h b/include/common/defaults.h | |||||
| index 0075509..a191b8a 100644 | |||||
| --- a/include/common/defaults.h | |||||
| +++ b/include/common/defaults.h | |||||
| @@ -190,8 +190,12 @@ | |||||
| /* Maximum host name length */ | |||||
| #ifndef MAX_HOSTNAME_LEN | |||||
| -#define MAX_HOSTNAME_LEN 32 | |||||
| -#endif | |||||
| +#if MAXHOSTNAMELEN | |||||
| +#define MAX_HOSTNAME_LEN MAXHOSTNAMELEN | |||||
| +#else | |||||
| +#define MAX_HOSTNAME_LEN 64 | |||||
| +#endif // MAXHOSTNAMELEN | |||||
| +#endif // MAX_HOSTNAME_LEN | |||||
| /* Maximum health check description length */ | |||||
| #ifndef HCHK_DESC_LEN | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 49
net/haproxy/patches/0006-BUG-MEDIUM-http-don-t-enable-auto-close-on-the-respo.patch
View File
| @ -1,49 +0,0 @@ | |||||
| From 3de8e7ab8d9125402cc1a8fb48ee475ee21d7d4c Mon Sep 17 00:00:00 2001 | |||||
| From: Willy Tarreau <w@1wt.eu> | |||||
| Date: Wed, 25 Nov 2015 20:11:11 +0100 | |||||
| Subject: [PATCH 06/10] BUG/MEDIUM: http: don't enable auto-close on the | |||||
| response side | |||||
| There is a bug where "option http-keep-alive" doesn't force a response | |||||
| to stay in keep-alive if the server sends the FIN along with the response | |||||
| on the second or subsequent response. The reason is that the auto-close | |||||
| was forced enabled when recycling the HTTP transaction and it's never | |||||
| disabled along the response processing chain before the SHUTR gets a | |||||
| chance to be forwarded to the client side. The MSG_DONE state of the | |||||
| HTTP response properly disables it but too late. | |||||
| There's no more reason for enabling auto-close here, because either it | |||||
| doesn't matter in non-keep-alive modes because the connection is closed, | |||||
| or it is automatically enabled by process_stream() when it sees there's | |||||
| no analyser on the stream. | |||||
| This bug also affects 1.5 so a backport is desired. | |||||
| (cherry picked from commit 714ea78c9a09fe6a35a1f2d86af8f7fc9abb64d1) | |||||
| (cherry picked from commit a15091be17f27fcf4e3a84338df1a8b732e396a1) | |||||
| --- | |||||
| src/proto_http.c | 6 ++++-- | |||||
| 1 file changed, 4 insertions(+), 2 deletions(-) | |||||
| diff --git a/src/proto_http.c b/src/proto_http.c | |||||
| index b32e778..5facfbb 100644 | |||||
| --- a/src/proto_http.c | |||||
| +++ b/src/proto_http.c | |||||
| @@ -4946,11 +4946,13 @@ void http_end_txn_clean_session(struct session *s) | |||||
| s->rep->flags |= CF_EXPECT_MORE; | |||||
| } | |||||
| - /* we're removing the analysers, we MUST re-enable events detection */ | |||||
| + /* we're removing the analysers, we MUST re-enable events detection. | |||||
| + * We don't enable close on the response channel since it's either | |||||
| + * already closed, or in keep-alive with an idle connection handler. | |||||
| + */ | |||||
| channel_auto_read(s->req); | |||||
| channel_auto_close(s->req); | |||||
| channel_auto_read(s->rep); | |||||
| - channel_auto_close(s->rep); | |||||
| /* we're in keep-alive with an idle connection, monitor it */ | |||||
| si_idle_conn(s->req->cons); | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 88
net/haproxy/patches/0007-BUG-MEDIUM-stream-fix-half-closed-timeout-handling.patch
View File
| @ -1,88 +0,0 @@ | |||||
| From 9154bc92ed11c6de75573dec341b6a0ce68bd0eb Mon Sep 17 00:00:00 2001 | |||||
| From: Willy Tarreau <w@1wt.eu> | |||||
| Date: Wed, 25 Nov 2015 20:17:27 +0100 | |||||
| Subject: [PATCH 07/10] BUG/MEDIUM: stream: fix half-closed timeout handling | |||||
| client-fin and server-fin are bogus. They are applied on the write | |||||
| side after a SHUTR was seen. The immediate effect is that sometimes | |||||
| if a SHUTR was seen after a SHUTW on the same side, the timeout is | |||||
| enabled again regardless of the fact that the output is already | |||||
| closed. This results in the timeout event not to be processed and | |||||
| a busy poll loop to happen until another timeout on the stream gets | |||||
| rid of it. Note that haproxy continues its job during this, it's just | |||||
| that it eats all the CPU trying to handle an event that it ignores. | |||||
| An reproducible case consists in having a client stop reading data from | |||||
| a server to ensure data remain in the response buffer, then the client | |||||
| sends a shutdown(write). If abortonclose is enabled on haproxy, the | |||||
| shutdown is passed to the server side and the server responds with a | |||||
| SHUTR that cannot immediately be forwarded to the client since the | |||||
| buffer is full. During this time the event is ignored and the task is | |||||
| woken again in loops. | |||||
| It is worth noting that the timeout handling since 1.5 is a bit fragile | |||||
| and that it might be possible that other similar conditions still exist, | |||||
| so the timeout handling should be audited regarding this issue. | |||||
| Many thanks to BaiYang for providing detailed information showing the | |||||
| problem in action. | |||||
| This bug also affects 1.5 thus the fix must be backported. | |||||
| (cherry picked from commit f25b3573d65fd2411c7537b7b0a4817b478df909) | |||||
| [Note for 1.5, it's in session.c here] | |||||
| (cherry picked from commit 44e86286159474a52dc74f80d3271504cc6f1550) | |||||
| --- | |||||
| src/session.c | 16 ---------------- | |||||
| 1 file changed, 16 deletions(-) | |||||
| diff --git a/src/session.c b/src/session.c | |||||
| index 7520a85..2b2ad78 100644 | |||||
| --- a/src/session.c | |||||
| +++ b/src/session.c | |||||
| @@ -2213,10 +2213,6 @@ struct task *process_session(struct task *t) | |||||
| if (unlikely((s->req->flags & (CF_SHUTW|CF_SHUTW_NOW|CF_AUTO_CLOSE|CF_SHUTR)) == | |||||
| (CF_AUTO_CLOSE|CF_SHUTR))) { | |||||
| channel_shutw_now(s->req); | |||||
| - if (tick_isset(s->fe->timeout.clientfin)) { | |||||
| - s->rep->wto = s->fe->timeout.clientfin; | |||||
| - s->rep->wex = tick_add(now_ms, s->rep->wto); | |||||
| - } | |||||
| } | |||||
| /* shutdown(write) pending */ | |||||
| @@ -2241,10 +2237,6 @@ struct task *process_session(struct task *t) | |||||
| if (s->req->prod->flags & SI_FL_NOHALF) | |||||
| s->req->prod->flags |= SI_FL_NOLINGER; | |||||
| si_shutr(s->req->prod); | |||||
| - if (tick_isset(s->fe->timeout.clientfin)) { | |||||
| - s->rep->wto = s->fe->timeout.clientfin; | |||||
| - s->rep->wex = tick_add(now_ms, s->rep->wto); | |||||
| - } | |||||
| } | |||||
| /* it's possible that an upper layer has requested a connection setup or abort. | |||||
| @@ -2391,10 +2383,6 @@ struct task *process_session(struct task *t) | |||||
| if (unlikely((s->rep->flags & (CF_SHUTW|CF_SHUTW_NOW|CF_AUTO_CLOSE|CF_SHUTR)) == | |||||
| (CF_AUTO_CLOSE|CF_SHUTR))) { | |||||
| channel_shutw_now(s->rep); | |||||
| - if (tick_isset(s->be->timeout.serverfin)) { | |||||
| - s->req->wto = s->be->timeout.serverfin; | |||||
| - s->req->wex = tick_add(now_ms, s->req->wto); | |||||
| - } | |||||
| } | |||||
| /* shutdown(write) pending */ | |||||
| @@ -2417,10 +2405,6 @@ struct task *process_session(struct task *t) | |||||
| if (s->rep->prod->flags & SI_FL_NOHALF) | |||||
| s->rep->prod->flags |= SI_FL_NOLINGER; | |||||
| si_shutr(s->rep->prod); | |||||
| - if (tick_isset(s->be->timeout.serverfin)) { | |||||
| - s->req->wto = s->be->timeout.serverfin; | |||||
| - s->req->wex = tick_add(now_ms, s->req->wto); | |||||
| - } | |||||
| } | |||||
| if (s->req->prod->state == SI_ST_DIS || s->req->cons->state == SI_ST_DIS) | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 36
net/haproxy/patches/0008-BUG-MEDIUM-cli-changing-compression-rate-limiting-mu.patch
View File
| @ -1,36 +0,0 @@ | |||||
| From 07ccb48add8c8cb0dd8a0f7d3f4994866d0ef32e Mon Sep 17 00:00:00 2001 | |||||
| From: Willy Tarreau <w@1wt.eu> | |||||
| Date: Thu, 26 Nov 2015 18:32:39 +0100 | |||||
| Subject: [PATCH 08/10] BUG/MEDIUM: cli: changing compression rate-limiting | |||||
| must require admin level | |||||
| Right now it's possible to change the global compression rate limiting | |||||
| without the CLI being at the admin level. | |||||
| This fix must be backported to 1.6 and 1.5. | |||||
| (cherry picked from commit a1c2b2c4f3e65d198a0a4b25a4f655f7b307a855) | |||||
| (cherry picked from commit 9e5f1489c9f2d6926729890f249f7ebb9d3bfd43) | |||||
| --- | |||||
| src/dumpstats.c | 6 ++++++ | |||||
| 1 file changed, 6 insertions(+) | |||||
| diff --git a/src/dumpstats.c b/src/dumpstats.c | |||||
| index b4be2cd..b1bbf31 100644 | |||||
| --- a/src/dumpstats.c | |||||
| +++ b/src/dumpstats.c | |||||
| @@ -1695,6 +1695,12 @@ static int stats_sock_parse_request(struct stream_interface *si, char *line) | |||||
| if (strcmp(args[3], "global") == 0) { | |||||
| int v; | |||||
| + if (s->listener->bind_conf->level < ACCESS_LVL_ADMIN) { | |||||
| + appctx->ctx.cli.msg = stats_permission_denied_msg; | |||||
| + appctx->st0 = STAT_CLI_PRINT; | |||||
| + return 1; | |||||
| + } | |||||
| + | |||||
| if (!*args[4]) { | |||||
| appctx->ctx.cli.msg = "Expects a maximum input byte rate in kB/s.\n"; | |||||
| appctx->st0 = STAT_CLI_PRINT; | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 31
net/haproxy/patches/0009-BUILD-freebsd-double-declaration.patch
View File
| @ -1,31 +0,0 @@ | |||||
| From 97ef6f99b8426ffdc97864fc8bb2d85c87cfdad0 Mon Sep 17 00:00:00 2001 | |||||
| From: Thierry FOURNIER <tfournier@arpalert.org> | |||||
| Date: Tue, 3 Nov 2015 19:17:37 +0100 | |||||
| Subject: [PATCH 09/10] BUILD: freebsd: double declaration | |||||
| On freebsd, the macro LIST_PREV already exists in the header file | |||||
| <sys/queue.h>, and this makes a build error. | |||||
| This patch removes the macros before declaring it. This ensure | |||||
| that the error doesn't occurs. | |||||
| (cherry picked from commit 1db96672c4cd264ebca8197bec93a5ce1b23aaa9) | |||||
| (cherry picked from commit 6cf9c6b270e57f05abf72cd61f4facb5b6980d57) | |||||
| --- | |||||
| include/common/mini-clist.h | 1 + | |||||
| 1 file changed, 1 insertion(+) | |||||
| diff --git a/include/common/mini-clist.h b/include/common/mini-clist.h | |||||
| index 3c3f001..404b6fa 100644 | |||||
| --- a/include/common/mini-clist.h | |||||
| +++ b/include/common/mini-clist.h | |||||
| @@ -144,6 +144,7 @@ struct cond_wordlist { | |||||
| * which contains list head <lh>, which is known as element <el> in | |||||
| * struct pt. | |||||
| */ | |||||
| +#undef LIST_PREV | |||||
| #define LIST_PREV(lh, pt, el) (LIST_ELEM((lh)->p, pt, el)) | |||||
| /* | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 53
net/haproxy/patches/0010-BUG-MEDIUM-sample-urlp-can-t-match-an-empty-value.patch
View File
| @ -1,53 +0,0 @@ | |||||
| From 0f836e1361933721c5689c7943143fd6cd260148 Mon Sep 17 00:00:00 2001 | |||||
| From: =?UTF-8?q?Cyril=20Bont=C3=A9?= <cyril.bonte@free.fr> | |||||
| Date: Thu, 26 Nov 2015 21:39:56 +0100 | |||||
| Subject: [PATCH 10/10] BUG/MEDIUM: sample: urlp can't match an empty value | |||||
| Currently urlp fetching samples were able to find parameters with an empty | |||||
| value, but the return code depended on the value length. The final result was | |||||
| that acls using urlp couldn't match empty values. | |||||
| Example of acl which always returned "false": | |||||
| acl MATCH_EMPTY urlp(foo) -m len 0 | |||||
| The fix consists in unconditionally return 1 when the parameter is found. | |||||
| This fix must be backported to 1.6 and 1.5. | |||||
| (cherry picked from commit ce1ef4df0135f9dc1cb6691395eacb487015fe3e) | |||||
| (cherry picked from commit 6bd426cf35c95985712369ed528c10a5f80ad8fd) | |||||
| [ note: in 1.5 we have value+value_l instead of vstart+vend ] | |||||
| --- | |||||
| src/proto_http.c | 10 ++++++---- | |||||
| 1 file changed, 6 insertions(+), 4 deletions(-) | |||||
| diff --git a/src/proto_http.c b/src/proto_http.c | |||||
| index 5facfbb..3af7880 100644 | |||||
| --- a/src/proto_http.c | |||||
| +++ b/src/proto_http.c | |||||
| @@ -11050,9 +11050,11 @@ find_url_param_pos(char* query_string, size_t query_string_l, | |||||
| } | |||||
| /* | |||||
| - * Given a url parameter name, returns its value and size into *value and | |||||
| - * *value_l respectively, and returns non-zero. If the parameter is not found, | |||||
| - * zero is returned and value/value_l are not touched. | |||||
| + * Given a url parameter name and a query string, find the next value. | |||||
| + * An empty url_param_name matches the first available parameter. | |||||
| + * If the parameter is found, 1 is returned and *value / *value_l are updated | |||||
| + * to respectively provide a pointer to the value and its length. | |||||
| + * Otherwise, 0 is returned and value/value_l are not modified. | |||||
| */ | |||||
| static int | |||||
| find_url_param_value(char* path, size_t path_l, | |||||
| @@ -11082,7 +11084,7 @@ find_url_param_value(char* path, size_t path_l, | |||||
| *value = value_start; | |||||
| *value_l = value_end - value_start; | |||||
| - return value_end != value_start; | |||||
| + return 1; | |||||
| } | |||||
| static int | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 31
net/haproxy/patches/0011-BUG-MEDIUM-peers-table-entries-learned-from-a-remote.patch
View File
| @ -1,31 +0,0 @@ | |||||
| From 96a1b4a969a5f3c9224d786c79e90d15a47094b0 Mon Sep 17 00:00:00 2001 | |||||
| From: Emeric Brun <ebrun@haproxy.com> | |||||
| Date: Wed, 16 Dec 2015 15:16:46 +0100 | |||||
| Subject: [PATCH 11/13] BUG/MEDIUM: peers: table entries learned from a remote | |||||
| are pushed to others after a random delay. | |||||
| New sticktable entries learned from a remote peer can be pushed to others after | |||||
| a random delay because they are not inserted at the right position in the updates | |||||
| tree. | |||||
| (cherry picked from commit 234fc3c31e751f8191b9b78fa5fd16663c2627fe) | |||||
| (cherry picked from commit 8b1a697362977b8392caca3efaf97a5a8a8c782b) | |||||
| --- | |||||
| src/peers.c | 2 +- | |||||
| 1 file changed, 1 insertion(+), 1 deletion(-) | |||||
| diff --git a/src/peers.c b/src/peers.c | |||||
| index 0564d3d..92b4df0 100644 | |||||
| --- a/src/peers.c | |||||
| +++ b/src/peers.c | |||||
| @@ -720,7 +720,7 @@ switchstate: | |||||
| ts = stktable_store(ps->table->table, newts, 0); | |||||
| newts = NULL; /* don't reuse it */ | |||||
| - ts->upd.key= (++ps->table->table->update)+(2^31); | |||||
| + ts->upd.key= (++ps->table->table->update)+(2147483648U); | |||||
| eb = eb32_insert(&ps->table->table->updates, &ts->upd); | |||||
| if (eb != &ts->upd) { | |||||
| eb32_delete(eb); | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 28
net/haproxy/patches/0012-BUG-MEDIUM-peers-old-stick-table-updates-could-be-re.patch
View File
| @ -1,28 +0,0 @@ | |||||
| From a320fd146f802a851a396b2cde491711a4fb87cf Mon Sep 17 00:00:00 2001 | |||||
| From: Emeric Brun <ebrun@haproxy.com> | |||||
| Date: Wed, 16 Dec 2015 15:28:12 +0100 | |||||
| Subject: [PATCH 12/13] BUG/MEDIUM: peers: old stick table updates could be | |||||
| repushed. | |||||
| Because the stick table updates tree was not properly initialized to EB_ROOT_UNIQUE. | |||||
| (cherry picked from commit 1c6235dbba0a67bad1d5e57ada88f28e1270a5cb) | |||||
| (cherry picked from commit 6e80935a77c8c2c67a982780a0f14c241f02f2aa) | |||||
| --- | |||||
| src/stick_table.c | 1 + | |||||
| 1 file changed, 1 insertion(+) | |||||
| diff --git a/src/stick_table.c b/src/stick_table.c | |||||
| index 48d5710..6310690 100644 | |||||
| --- a/src/stick_table.c | |||||
| +++ b/src/stick_table.c | |||||
| @@ -385,6 +385,7 @@ int stktable_init(struct stktable *t) | |||||
| if (t->size) { | |||||
| memset(&t->keys, 0, sizeof(t->keys)); | |||||
| memset(&t->exps, 0, sizeof(t->exps)); | |||||
| + t->updates = EB_ROOT_UNIQUE; | |||||
| t->pool = create_pool("sticktables", sizeof(struct stksess) + t->data_size + t->key_size, MEM_F_SHARED); | |||||
| -- | |||||
| 2.4.10 | |||||
+ 0
- 43
net/haproxy/patches/0013-CLEANUP-haproxy-using-_GNU_SOURCE-instead-of-__USE_G.patch
View File
| @ -1,43 +0,0 @@ | |||||
| From 21fab69d332bfafd0a214ee29d8ad0779a055988 Mon Sep 17 00:00:00 2001 | |||||
| From: David Carlier <devnexen@gmail.com> | |||||
| Date: Tue, 8 Dec 2015 21:43:09 +0000 | |||||
| Subject: [PATCH 13/13] CLEANUP: haproxy: using _GNU_SOURCE instead of | |||||
| __USE_GNU macro. | |||||
| In order to properly enable sched_setaffinity, in some versions of Linux, | |||||
| it is rather _GNU_SOURCE than __USE_GNU (spotted on Alpine Linux for instance), | |||||
| also for the sake of consistency as __USE_GNU seems not used across the code and | |||||
| for last, it seems on Linux it is the best way to enable non portable code. | |||||
| On Linux glibc's based versions, it seems _GNU_SOURCE defines __USE_GNU | |||||
| it should be safe enough. | |||||
| (cherry picked from commit 7ece096767d329d0ea04b70a1fb2c8b8a96b47e0) | |||||
| (cherry picked from commit 5a0ac35503f88a7bc8ee2c4f865354fa6cc25901) | |||||
| --- | |||||
| src/haproxy.c | 3 +-- | |||||
| 1 file changed, 1 insertion(+), 2 deletions(-) | |||||
| diff --git a/src/haproxy.c b/src/haproxy.c | |||||
| index b94252d..20480a1 100644 | |||||
| --- a/src/haproxy.c | |||||
| +++ b/src/haproxy.c | |||||
| @@ -25,6 +25,7 @@ | |||||
| * | |||||
| */ | |||||
| +#define _GNU_SOURCE | |||||
| #include <stdio.h> | |||||
| #include <stdlib.h> | |||||
| #include <unistd.h> | |||||
| @@ -47,9 +48,7 @@ | |||||
| #include <syslog.h> | |||||
| #include <grp.h> | |||||
| #ifdef USE_CPU_AFFINITY | |||||
| -#define __USE_GNU | |||||
| #include <sched.h> | |||||
| -#undef __USE_GNU | |||||
| #endif | |||||
| #ifdef DEBUG_FULL | |||||
| -- | |||||
| 2.4.10 | |||||