commit 3b83956724bc05abc872b94ff98f4ba56f807826 Author: CentOS Sources Date: Tue May 17 04:46:32 2022 -0400 import haproxy-2.4.7-2.el9_0 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b0c7871 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/haproxy-2.4.7.tar.gz diff --git a/.haproxy.metadata b/.haproxy.metadata new file mode 100644 index 0000000..1fef6be --- /dev/null +++ b/.haproxy.metadata @@ -0,0 +1 @@ +d3f3a4ff293cb2d9ec2085cac324698d260e2739 SOURCES/haproxy-2.4.7.tar.gz diff --git a/SOURCES/bz1984786-fix-openssl-build.patch b/SOURCES/bz1984786-fix-openssl-build.patch new file mode 100644 index 0000000..bac19bd --- /dev/null +++ b/SOURCES/bz1984786-fix-openssl-build.patch @@ -0,0 +1,45 @@ +From f22b032956bc492dcf47b2a909f91a6fb2c6e49b Mon Sep 17 00:00:00 2001 +From: William Lallemand +Date: Wed, 2 Jun 2021 16:09:11 +0200 +Subject: [PATCH] BUILD: fix compilation for OpenSSL-3.0.0-alpha17 + +Some changes in the OpenSSL syntax API broke this syntax: + #if SSL_OP_NO_TLSv1_3 + +OpenSSL made this change which broke our usage in commit f04bb0bce490de847ed0482b8ec9eabedd173852: + +-# define SSL_OP_NO_TLSv1_3 (uint64_t)0x20000000 ++#define SSL_OP_BIT(n) ((uint64_t)1 << (uint64_t)n) ++# define SSL_OP_NO_TLSv1_3 SSL_OP_BIT(29) + +Which can't be evaluated by the preprocessor anymore. +This patch replace the test by an openssl version test. + +This fix part of #1276 issue. +--- + src/ssl_sock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/ssl_sock.c b/src/ssl_sock.c +index f596a831d..27a4c3531 100644 +--- a/src/ssl_sock.c ++++ b/src/ssl_sock.c +@@ -2217,13 +2217,13 @@ static void ssl_set_TLSv12_func(SSL *ssl, set_context_func c) { + : SSL_set_min_proto_version(ssl, TLS1_2_VERSION); + } + static void ctx_set_TLSv13_func(SSL_CTX *ctx, set_context_func c) { +-#if SSL_OP_NO_TLSv1_3 ++#if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L) + c == SET_MAX ? SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION) + : SSL_CTX_set_min_proto_version(ctx, TLS1_3_VERSION); + #endif + } + static void ssl_set_TLSv13_func(SSL *ssl, set_context_func c) { +-#if SSL_OP_NO_TLSv1_3 ++#if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L) + c == SET_MAX ? SSL_set_max_proto_version(ssl, TLS1_3_VERSION) + : SSL_set_min_proto_version(ssl, TLS1_3_VERSION); + #endif +-- +2.31.1 + diff --git a/SOURCES/bz2059438-fix-undound-loop-set-cookie2.patch b/SOURCES/bz2059438-fix-undound-loop-set-cookie2.patch new file mode 100644 index 0000000..2b80927 --- /dev/null +++ b/SOURCES/bz2059438-fix-undound-loop-set-cookie2.patch @@ -0,0 +1,48 @@ +From 0980912282f20a1db64d7ba0a9a825dfee3cb044 Mon Sep 17 00:00:00 2001 +From: Andrew McDermott +Date: Fri, 11 Feb 2022 18:26:49 +0000 +Subject: [PATCH] BUG/MAJOR: http/htx: prevent unbounded loop in + http_manage_server_side_cookies + +Ensure calls to http_find_header() terminate. If a "Set-Cookie2" +header is found then the while(1) loop in +http_manage_server_side_cookies() will never terminate, resulting in +the watchdog firing and the process terminating via SIGABRT. + +The while(1) loop becomes unbounded because an unmatched call to +http_find_header("Set-Cookie") will leave ctx->blk=NULL. Subsequent +calls to check for "Set-Cookie2" will now enumerate from the beginning +of all the blocks and will once again match on subsequent +passes (assuming a match first time around), hence the loop becoming +unbounded. + +This issue was introduced with HTX and this fix should be backported +to all versions supporting HTX. + +Many thanks to Grant Spence (gspence@redhat.com) for working through +this issue with me. + +(cherry picked from commit bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8) +Signed-off-by: Willy Tarreau +(cherry picked from commit d8ce72f63e115fa0952e6a58e81c3d15dfc0a509) +Signed-off-by: Willy Tarreau +--- + src/http_ana.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/http_ana.c b/src/http_ana.c +index 4c765cb39..0f40ab3ab 100644 +--- a/src/http_ana.c ++++ b/src/http_ana.c +@@ -3433,7 +3433,7 @@ static void http_manage_server_side_cookies(struct stream *s, struct channel *re + while (1) { + int is_first = 1; + +- if (!http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) { ++ if (is_cookie2 || !http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) { + if (!http_find_header(htx, ist("Set-Cookie2"), &ctx, 1)) + break; + is_cookie2 = 1; +-- +2.33.1 + diff --git a/SOURCES/halog.1 b/SOURCES/halog.1 new file mode 100644 index 0000000..39a9711 --- /dev/null +++ b/SOURCES/halog.1 @@ -0,0 +1,108 @@ +.TH HALOG "1" "July 2013" "halog" "User Commands" +.SH NAME +halog \- HAProxy log statistics reporter +.SH SYNOPSIS +.B halog +[\fI-h|--help\fR] +.br +.B halog +[\fIoptions\fR] +Only match response times larger|smaller than