diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index a4a4483b4..1328136a1 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -10,12 +10,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=haproxy -PKG_VERSION:=1.8.14 -PKG_RELEASE:=5 +PKG_VERSION:=1.8.15 +PKG_RELEASE:=1 PKG_SOURCE:=haproxy-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://www.haproxy.org/download/1.8/src/ -PKG_HASH:=b17e402578be85e58af7a3eac99b1f675953bea9f67af2e964cf8bdbd1bd3fdf +PKG_HASH:=7113862f1146d7de8b8e64f45826ab3533c7f7f7b7767e24c08f7c762202a032 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION) PKG_LICENSE:=GPL-2.0 diff --git a/net/haproxy/get-latest-patches.sh b/net/haproxy/get-latest-patches.sh index 4612ccdae..39e46a4f3 100755 --- a/net/haproxy/get-latest-patches.sh +++ b/net/haproxy/get-latest-patches.sh @@ -1,7 +1,7 @@ #!/bin/bash CLONEURL=http://git.haproxy.org/git/haproxy-1.8.git -BASE_TAG=v1.8.14 +BASE_TAG=v1.8.15 TMP_REPODIR=tmprepo PATCHESDIR=patches diff --git a/net/haproxy/patches/0000-MINOR-threads-Make-sure-threads_sync_pipe-is-initialized-before-using-it.patch b/net/haproxy/patches/0000-MINOR-threads-Make-sure-threads_sync_pipe-is-initialized-before-using-it.patch deleted file mode 100644 index 00bc94490..000000000 --- a/net/haproxy/patches/0000-MINOR-threads-Make-sure-threads_sync_pipe-is-initialized-before-using-it.patch +++ /dev/null @@ -1,38 +0,0 @@ -commit 14844e448b637fea2770bcb03a43a010c4c8176d -Author: Olivier Houchard -Date: Thu Sep 27 14:55:34 2018 +0200 - - MINOR: threads: Make sure threads_sync_pipe is initialized before using it. - - thread_want_sync() might be called before thread_sync_init() was called, - at least when reading the server state file, as apply_server_state() is called - before thread_sync_init(). So make sure the threads_sync_pipe was initialized - before writing to it, if it was not, there's no thread, so no need to sync - anything anyway, and if we don't check it we'll end up writing a 'S' on - stdin. - - this only applies to 1.8. - -diff --git a/src/hathreads.c b/src/hathreads.c -index 97ed31c5..9dba4356 100644 ---- a/src/hathreads.c -+++ b/src/hathreads.c -@@ -28,7 +28,7 @@ void thread_sync_io_handler(int fd) - #ifdef USE_THREAD - - static HA_SPINLOCK_T sync_lock; --static int threads_sync_pipe[2]; -+static int threads_sync_pipe[2] = {-1, -1}; - static unsigned long threads_want_sync = 0; - volatile unsigned long threads_want_rdv_mask = 0; - volatile unsigned long threads_harmless_mask = 0; -@@ -76,7 +76,8 @@ void thread_want_sync() - if (all_threads_mask & (all_threads_mask - 1)) { - if (threads_want_sync & tid_bit) - return; -- if (HA_ATOMIC_OR(&threads_want_sync, tid_bit) == tid_bit) -+ if (HA_ATOMIC_OR(&threads_want_sync, tid_bit) == tid_bit && -+ threads_sync_pipe[1] != -1) - shut_your_big_mouth_gcc(write(threads_sync_pipe[1], "S", 1)); - } - else { diff --git a/net/haproxy/patches/0001-DOC-clarify-force-private-cache-is-an-option.patch b/net/haproxy/patches/0001-DOC-clarify-force-private-cache-is-an-option.patch deleted file mode 100644 index 3358f6337..000000000 --- a/net/haproxy/patches/0001-DOC-clarify-force-private-cache-is-an-option.patch +++ /dev/null @@ -1,39 +0,0 @@ -commit 18aff2297ce844362f28ea5317c289ba154bd33d -Author: Lukas Tribus -Date: Mon Oct 1 02:00:16 2018 +0200 - - DOC: clarify force-private-cache is an option - - "boolean" may confuse users into thinking they need to provide - additional arguments, like false or true. This is a simple option - like many others, so lets not confuse the users with internals. - - Also fixes an additional typo. - - Should be backported to 1.8 and 1.7. - - (cherry picked from commit 2793578eaf934bbf28f742a35f3a1ae656280324) - Signed-off-by: Christopher Faulet - -diff --git a/doc/configuration.txt b/doc/configuration.txt -index c69033b1..580194ec 100644 ---- a/doc/configuration.txt -+++ b/doc/configuration.txt -@@ -1651,7 +1651,7 @@ tune.ssl.cachesize - this value to 0 disables the SSL session cache. - - tune.ssl.force-private-cache -- This boolean disables SSL session cache sharing between all processes. It -+ This option disables SSL session cache sharing between all processes. It - should normally not be used since it will force many renegotiations due to - clients hitting a random process. But it may be required on some operating - systems where none of the SSL cache synchronization method may be used. In -@@ -6535,7 +6535,7 @@ option smtpchk - yes | no | yes | yes - Arguments : - is an optional argument. It is the "hello" command to use. It can -- be either "HELO" (for SMTP) or "EHLO" (for ESTMP). All other -+ be either "HELO" (for SMTP) or "EHLO" (for ESMTP). All other - values will be turned into the default command ("HELO"). - - is the domain name to present to the server. It may only be diff --git a/net/haproxy/patches/0002-BUG-MINOR-connection-avoid-null-pointer-dereference-in-send-proxy-v2.patch b/net/haproxy/patches/0002-BUG-MINOR-connection-avoid-null-pointer-dereference-in-send-proxy-v2.patch deleted file mode 100644 index 9ab8e34f1..000000000 --- a/net/haproxy/patches/0002-BUG-MINOR-connection-avoid-null-pointer-dereference-in-send-proxy-v2.patch +++ /dev/null @@ -1,47 +0,0 @@ -commit f6d20e718131aa2b468ff0a6c42e20c0b900e58b -Author: Ilya Shipitsin -Date: Sat Sep 15 00:50:05 2018 +0500 - - BUG/MINOR: connection: avoid null pointer dereference in send-proxy-v2 - - found by coverity. - - [wt: this bug was introduced by commit 404d978 ("MINOR: add ALPN - information to send-proxy-v2"). It might be triggered by a health - check on a server using ppv2 or by an applet making use of such a - server, if at all configurable]. - - This needs to be backported to 1.8. - - (cherry picked from commit ca56fce8bd271928b18d38b439bd35bd273fe8d4) - Signed-off-by: Christopher Faulet - -diff --git a/src/connection.c b/src/connection.c -index 8c5af156..7403e8ae 100644 ---- a/src/connection.c -+++ b/src/connection.c -@@ -874,6 +874,7 @@ int conn_recv_netscaler_cip(struct connection *conn, int flag) - return 0; - } - -+/* Note: is explicitly allowed to be NULL */ - int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote) - { - int ret = 0; -@@ -985,6 +986,7 @@ static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const - return length + sizeof(*tlv); - } - -+/* Note: is explicitly allowed to be NULL */ - int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote) - { - const char pp2_signature[] = PP2_SIGNATURE; -@@ -1060,7 +1062,7 @@ int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connec - } - } - -- if (conn_get_alpn(remote, &value, &value_len)) { -+ if (remote && conn_get_alpn(remote, &value, &value_len)) { - if ((buf_len - ret) < sizeof(struct tlv)) - return 0; - ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value); diff --git a/net/haproxy/patches/0003-BUG-MINOR-backend-check-that-the-mux-installed-properly.patch b/net/haproxy/patches/0003-BUG-MINOR-backend-check-that-the-mux-installed-properly.patch deleted file mode 100644 index d63a9216c..000000000 --- a/net/haproxy/patches/0003-BUG-MINOR-backend-check-that-the-mux-installed-properly.patch +++ /dev/null @@ -1,43 +0,0 @@ -commit e725a7f9bfd8b7fe2e74c62c7c6bf2b9ebf83772 -Author: Willy Tarreau -Date: Wed Oct 3 10:20:19 2018 +0200 - - BUG/MINOR: backend: check that the mux installed properly - - The return value from conn_install_mux() was not checked, so if an - inconsistency happens in the code, or a memory allocation fails while - initializing the mux, we can crash while using an uninitialized mux. - In practice the code inconsistency does not really happen since we - cannot configure such a situation, except during development, but - the out of memory condition could definitely happen. - - This should be backported to 1.8 (the code is a bit different there, - there are two calls to conn_install_mux()). - - (cherry picked from commit 33dd4ef81245bb868b22f99b9be45d0791131eec) - Signed-off-by: Christopher Faulet - -diff --git a/src/backend.c b/src/backend.c -index 2b6167dc..fc1eac0d 100644 ---- a/src/backend.c -+++ b/src/backend.c -@@ -1163,7 +1163,8 @@ int connect_server(struct stream *s) - if (srv) { - conn_prepare(srv_conn, protocol_by_family(srv_conn->addr.to.ss_family), srv->xprt); - /* XXX: Pick the right mux, when we finally have one */ -- conn_install_mux(srv_conn, &mux_pt_ops, srv_cs); -+ if (conn_install_mux(srv_conn, &mux_pt_ops, srv_cs) < 0) -+ return SF_ERR_INTERNAL; - } - else if (obj_type(s->target) == OBJ_TYPE_PROXY) { - /* proxies exclusively run on raw_sock right now */ -@@ -1171,7 +1172,8 @@ int connect_server(struct stream *s) - if (!objt_cs(s->si[1].end) || !objt_cs(s->si[1].end)->conn->ctrl) - return SF_ERR_INTERNAL; - /* XXX: Pick the right mux, when we finally have one */ -- conn_install_mux(srv_conn, &mux_pt_ops, srv_cs); -+ if (conn_install_mux(srv_conn, &mux_pt_ops, srv_cs) < 0) -+ return SF_ERR_INTERNAL; - } - else - return SF_ERR_INTERNAL; /* how did we get there ? */ diff --git a/net/haproxy/patches/0004-BUG-MEDIUM-buffers-Make-sure-we-dont-wrap-in-buffer_insert_line2-replace2.patch b/net/haproxy/patches/0004-BUG-MEDIUM-buffers-Make-sure-we-dont-wrap-in-buffer_insert_line2-replace2.patch deleted file mode 100644 index e365cd5c8..000000000 --- a/net/haproxy/patches/0004-BUG-MEDIUM-buffers-Make-sure-we-dont-wrap-in-buffer_insert_line2-replace2.patch +++ /dev/null @@ -1,40 +0,0 @@ -commit 45e9f3c660c872e93588cf1c0b74c192f2c8c3d5 -Author: Olivier Houchard -Date: Wed Sep 26 15:09:58 2018 +0200 - - BUG/MEDIUM: buffers: Make sure we don't wrap in buffer_insert_line2/replace2. - - In buffer_insert_line2() and buffer_replace2(), we can't afford to wrap, - so don't use b_tail to check if we do, directly use b->p + b->i instead. - - This should be backported to previous versions. - - (cherry picked from commit 363c745569b6ffd8f095d2b7758131d08aa27219) - Signed-off-by: Christopher Faulet - - [cf: This patch was adapted and its commit message too. Because of the - refactoring of the buffer's API in 1.9, the original patch fixes same bug in - ci_insert_line2/b_rep_blk.] - -diff --git a/src/buffer.c b/src/buffer.c -index 167b75ae..6ad38a02 100644 ---- a/src/buffer.c -+++ b/src/buffer.c -@@ -107,7 +107,7 @@ int buffer_replace2(struct buffer *b, char *pos, char *end, const char *str, int - - delta = len - (end - pos); - -- if (bi_end(b) + delta > b->data + b->size) -+ if (b->p + b->i + delta > b->data + b->size) - return 0; /* no space left */ - - if (buffer_not_empty(b) && -@@ -146,7 +146,7 @@ int buffer_insert_line2(struct buffer *b, char *pos, const char *str, int len) - - delta = len + 2; - -- if (bi_end(b) + delta >= b->data + b->size) -+ if (b->p + b->i + delta >= b->data + b->size) - return 0; /* no space left */ - - if (buffer_not_empty(b) && diff --git a/net/haproxy/patches/0005-MEDIUM-ssl-add-support-for-ciphersuites-option-for-TLSv1-3.patch b/net/haproxy/patches/0005-MEDIUM-ssl-add-support-for-ciphersuites-option-for-TLSv1-3.patch deleted file mode 100644 index ac2cd136f..000000000 --- a/net/haproxy/patches/0005-MEDIUM-ssl-add-support-for-ciphersuites-option-for-TLSv1-3.patch +++ /dev/null @@ -1,473 +0,0 @@ -commit 4be76416751aa22992a44f2f5cfdba506809fd89 -Author: Dirkjan Bussink -Date: Fri Sep 14 11:14:21 2018 +0200 - - MEDIUM: ssl: add support for ciphersuites option for TLSv1.3 - - OpenSSL released support for TLSv1.3. It also added a separate function - SSL_CTX_set_ciphersuites that is used to set the ciphers used in the - TLS 1.3 handshake. This change adds support for that new configuration - option by adding a ciphersuites configuration variable that works - essentially the same as the existing ciphers setting. - - Note that it should likely be backported to 1.8 in order to ease usage - of the now released openssl-1.1.1. - - (cherry picked from commit 415150f7640b06740fa832363d186c5c6565338e) - Signed-off-by: Willy Tarreau - -diff --git a/doc/configuration.txt b/doc/configuration.txt -index 580194ec..7a268386 100644 ---- a/doc/configuration.txt -+++ b/doc/configuration.txt -@@ -580,8 +580,10 @@ The following keywords are supported in the "global" section : - - setenv - - stats - - ssl-default-bind-ciphers -+ - ssl-default-bind-ciphersuites - - ssl-default-bind-options - - ssl-default-server-ciphers -+ - ssl-default-server-ciphersuites - - ssl-default-server-options - - ssl-dh-param-file - - ssl-server-verify -@@ -984,11 +986,25 @@ setenv - ssl-default-bind-ciphers - This setting is only available when support for OpenSSL was built in. It sets - the default string describing the list of cipher algorithms ("cipher suite") -- that are negotiated during the SSL/TLS handshake for all "bind" lines which -- do not explicitly define theirs. The format of the string is defined in -- "man 1 ciphers" from OpenSSL man pages, and can be for instance a string such -- as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes). Please check the -- "bind" keyword for more information. -+ that are negotiated during the SSL/TLS handshake except for TLSv1.3 for all -+ "bind" lines which do not explicitly define theirs. The format of the string -+ is defined in "man 1 ciphers" from OpenSSL man pages, and can be for instance -+ a string such as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes). For -+ TLSv1.3 cipher configuration, please check the "ssl-default-bind-ciphersuites" -+ keyword. Please check the "bind" keyword for more information. -+ -+ssl-default-bind-ciphersuites -+ This setting is only available when support for OpenSSL was built in and -+ OpenSSL 1.1.1 or later was used to build HAProxy. It sets the default string -+ describing the list of cipher algorithms ("cipher suite") that are negotiated -+ during the TLSv1.3 handshake for all "bind" lines which do not explicitly define -+ theirs. The format of the string is defined in -+ "man 1 ciphers" from OpenSSL man pages under the section "ciphersuites", and can -+ be for instance a string such as -+ "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" -+ (without quotes). For cipher configuration for TLSv1.2 and earlier, please check -+ the "ssl-default-bind-ciphers" keyword. Please check the "bind" keyword for more -+ information. - - ssl-default-bind-options [