From 107b83e1defb65e2cf481edbace920f33bfd706b Mon Sep 17 00:00:00 2001 From: heil Date: Wed, 2 Dec 2015 12:06:32 +0100 Subject: [PATCH] haproxy: bump to version 1.5.15 - integrate pending patches Signed-off-by: heil --- net/haproxy/Makefile | 6 +- ...e-haproxy-systemd-wrapper-with-EXTRA.patch | 34 ++++++ ...ssing-some-ARGC_-entries-in-fmt_dire.patch | 64 ---------- ...on-t-use-record-layer-in-req_ssl_ver.patch | 69 +++++++++++ ...-usesrc-root-privileges-requirements.patch | 27 ----- ...abort-keep-alive-connections-on-serv.patch | 37 ++++++ ...building-against-libssl-without-SSLv.patch | 51 -------- ...switch-the-request-channel-to-no-del.patch | 112 ++++++++++++++++++ ...OpenBSD-versions-where-haproxy-works.patch | 26 ---- ...ttp-sample-gmtime-localtime-can-fail.patch | 33 ------ ...end-the-default-max-hostname-length-.patch | 52 ++++++++ ...don-t-enable-auto-close-on-the-respo.patch | 49 ++++++++ ...OC-typo-in-redirect-302-code-meaning.patch | 27 ----- ...eam-fix-half-closed-timeout-handling.patch | 88 ++++++++++++++ ...n-that-ms-is-left-padded-with-zeroes.patch | 27 ----- ...hanging-compression-rate-limiting-mu.patch | 36 ++++++ ...UP-.gitignore-ignore-more-test-files.patch | 50 -------- ...009-BUILD-freebsd-double-declaration.patch | 31 +++++ ...re-finally-ignore-everything-but-wha.patch | 44 ------- ...mple-urlp-can-t-match-an-empty-value.patch | 53 +++++++++ ...it-a-warning-on-a-frontend-without-l.patch | 46 ------- ...ers-ensure-that-src_-inc-clr-_gpc0-c.patch | 93 --------------- .../patches/0012-DOC-ssl-missing-LF.patch | 27 ----- ...of-http-request-using-ssl_fc_session.patch | 30 ----- ...p-remove-stupid-HTTP_METH_NONE-entry.patch | 78 ------------ ...on-t-call-http_send_name_header-afte.patch | 49 -------- ...make-str2sa_range-report-unresolvabl.patch | 36 ------ 27 files changed, 564 insertions(+), 711 deletions(-) create mode 100644 net/haproxy/patches/0001-BUG-BUILD-replace-haproxy-systemd-wrapper-with-EXTRA.patch delete mode 100644 net/haproxy/patches/0001-BUG-MINOR-log-missing-some-ARGC_-entries-in-fmt_dire.patch create mode 100644 net/haproxy/patches/0002-BUG-MINOR-acl-don-t-use-record-layer-in-req_ssl_ver.patch delete mode 100644 net/haproxy/patches/0002-DOC-usesrc-root-privileges-requirements.patch create mode 100644 net/haproxy/patches/0003-BUG-http-do-not-abort-keep-alive-connections-on-serv.patch delete mode 100644 net/haproxy/patches/0003-BUILD-ssl-Allow-building-against-libssl-without-SSLv.patch create mode 100644 net/haproxy/patches/0004-BUG-MEDIUM-http-switch-the-request-channel-to-no-del.patch delete mode 100644 net/haproxy/patches/0004-DOC-MINOR-fix-OpenBSD-versions-where-haproxy-works.patch delete mode 100644 net/haproxy/patches/0005-BUG-MINOR-http-sample-gmtime-localtime-can-fail.patch create mode 100644 net/haproxy/patches/0005-MINOR-config-extend-the-default-max-hostname-length-.patch create mode 100644 net/haproxy/patches/0006-BUG-MEDIUM-http-don-t-enable-auto-close-on-the-respo.patch delete mode 100644 net/haproxy/patches/0006-DOC-typo-in-redirect-302-code-meaning.patch create mode 100644 net/haproxy/patches/0007-BUG-MEDIUM-stream-fix-half-closed-timeout-handling.patch delete mode 100644 net/haproxy/patches/0007-DOC-mention-that-ms-is-left-padded-with-zeroes.patch create mode 100644 net/haproxy/patches/0008-BUG-MEDIUM-cli-changing-compression-rate-limiting-mu.patch delete mode 100644 net/haproxy/patches/0008-CLEANUP-.gitignore-ignore-more-test-files.patch create mode 100644 net/haproxy/patches/0009-BUILD-freebsd-double-declaration.patch delete mode 100644 net/haproxy/patches/0009-CLEANUP-.gitignore-finally-ignore-everything-but-wha.patch create mode 100644 net/haproxy/patches/0010-BUG-MEDIUM-sample-urlp-can-t-match-an-empty-value.patch delete mode 100644 net/haproxy/patches/0010-MEDIUM-config-emit-a-warning-on-a-frontend-without-l.patch delete mode 100644 net/haproxy/patches/0011-BUG-MEDIUM-counters-ensure-that-src_-inc-clr-_gpc0-c.patch delete mode 100644 net/haproxy/patches/0012-DOC-ssl-missing-LF.patch delete mode 100644 net/haproxy/patches/0013-DOC-fix-example-of-http-request-using-ssl_fc_session.patch delete mode 100644 net/haproxy/patches/0014-BUG-MINOR-http-remove-stupid-HTTP_METH_NONE-entry.patch delete mode 100644 net/haproxy/patches/0015-BUG-MAJOR-http-don-t-call-http_send_name_header-afte.patch delete mode 100644 net/haproxy/patches/0016-BUG-MINOR-tools-make-str2sa_range-report-unresolvabl.patch diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index c5e1948df3..5138e7c3da 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=haproxy -PKG_VERSION:=1.5.14 -PKG_RELEASE:=16 +PKG_VERSION:=1.5.15 +PKG_RELEASE:=10 PKG_SOURCE:=haproxy-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=http://haproxy.1wt.eu/download/1.5/src/ PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION) -PKG_MD5SUM:=ad9d7262b96ba85a0f8c6acc6cb9edde +PKG_MD5SUM:=eeaa35744f84c92184cd735ee56dd0a3 PKG_MAINTAINER:=Thomas Heil PKG_LICENSE:=GPL-2.0 diff --git a/net/haproxy/patches/0001-BUG-BUILD-replace-haproxy-systemd-wrapper-with-EXTRA.patch b/net/haproxy/patches/0001-BUG-BUILD-replace-haproxy-systemd-wrapper-with-EXTRA.patch new file mode 100644 index 0000000000..0a294674e6 --- /dev/null +++ b/net/haproxy/patches/0001-BUG-BUILD-replace-haproxy-systemd-wrapper-with-EXTRA.patch @@ -0,0 +1,34 @@ +From 4818bc3035bccc00d8c3fc9b14ec37366cac3059 Mon Sep 17 00:00:00 2001 +From: Jerome Duval +Date: Mon, 2 Nov 2015 17:47:43 +0000 +Subject: [PATCH 01/10] BUG/BUILD: replace haproxy-systemd-wrapper with + $(EXTRA) in install-bin. + +[wt: this should be backported to 1.6 and 1.5 as well since some platforms + don't build the systemd-wrapper] +(cherry picked from commit 796d2fc136359c31c5c35f00c0751890ab42a016) +(cherry picked from commit 9d0b47d96825b0584ea81c826a96ed8babcc016b) +--- + Makefile | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/Makefile b/Makefile +index 9556069..e3199b2 100644 +--- a/Makefile ++++ b/Makefile +@@ -719,10 +719,9 @@ install-doc: + install -m 644 doc/$$x.txt "$(DESTDIR)$(DOCDIR)" ; \ + done + +-install-bin: haproxy haproxy-systemd-wrapper ++install-bin: haproxy $(EXTRA) + install -d "$(DESTDIR)$(SBINDIR)" +- install haproxy "$(DESTDIR)$(SBINDIR)" +- install haproxy-systemd-wrapper "$(DESTDIR)$(SBINDIR)" ++ install haproxy $(EXTRA) "$(DESTDIR)$(SBINDIR)" + + install: install-bin install-man install-doc + +-- +2.4.10 + diff --git a/net/haproxy/patches/0001-BUG-MINOR-log-missing-some-ARGC_-entries-in-fmt_dire.patch b/net/haproxy/patches/0001-BUG-MINOR-log-missing-some-ARGC_-entries-in-fmt_dire.patch deleted file mode 100644 index 72db4528b8..0000000000 --- a/net/haproxy/patches/0001-BUG-MINOR-log-missing-some-ARGC_-entries-in-fmt_dire.patch +++ /dev/null @@ -1,64 +0,0 @@ -From df0a5960987b3cb663dcfa93d29c21acc13cd3e3 Mon Sep 17 00:00:00 2001 -From: Willy Tarreau -Date: Thu, 9 Jul 2015 11:20:00 +0200 -Subject: [PATCH 1/4] BUG/MINOR: log: missing some ARGC_* entries in - fmt_directives() - -ARGC_CAP was not added to fmt_directives() which is used to format -error messages when failing to parse log format expressions. The -whole switch/case has been reorganized to match the declaration -order making it easier to spot missing values. The default is not -the "log" directive anymore but "undefined" asking to report the -bug. - -Backport to 1.5 is not strictly needed but is desirable at least -for code sanity. -(cherry picked from commit 53e1a6d31743b1bef6063ff30b812521391ae3c3) ---- - src/log.c | 24 ++++++++++++++---------- - 1 file changed, 14 insertions(+), 10 deletions(-) - -diff --git a/src/log.c b/src/log.c -index 1a5ad25..f0a3072 100644 ---- a/src/log.c -+++ b/src/log.c -@@ -167,22 +167,26 @@ struct logformat_var_args var_args_list[] = { - static inline const char *fmt_directive(const struct proxy *curproxy) - { - switch (curproxy->conf.args.ctx) { -- case ARGC_UIF: -- return "unique-id-format"; -+ case ARGC_ACL: -+ return "acl"; -+ case ARGC_STK: -+ return "stick"; -+ case ARGC_TRK: -+ return "track-sc"; -+ case ARGC_LOG: -+ return "log-format"; - case ARGC_HRQ: - return "http-request"; - case ARGC_HRS: - return "http-response"; -- case ARGC_STK: -- return "stick"; -- case ARGC_TRK: -- return "track-sc"; break; -+ case ARGC_UIF: -+ return "unique-id-format"; - case ARGC_RDR: -- return "redirect"; break; -- case ARGC_ACL: -- return "acl"; break; -+ return "redirect"; -+ case ARGC_CAP: -+ return "capture"; - default: -- return "log-format"; -+ return "undefined(please report this bug)"; /* must never happen */ - } - } - --- -2.3.6 - diff --git a/net/haproxy/patches/0002-BUG-MINOR-acl-don-t-use-record-layer-in-req_ssl_ver.patch b/net/haproxy/patches/0002-BUG-MINOR-acl-don-t-use-record-layer-in-req_ssl_ver.patch new file mode 100644 index 0000000000..daac5d4b96 --- /dev/null +++ b/net/haproxy/patches/0002-BUG-MINOR-acl-don-t-use-record-layer-in-req_ssl_ver.patch @@ -0,0 +1,69 @@ +From 1af6a324c3206902f69bd2c9838e94ffb4cee3ae Mon Sep 17 00:00:00 2001 +From: Lukas Tribus +Date: Thu, 5 Nov 2015 13:59:30 +0100 +Subject: [PATCH 02/10] BUG/MINOR: acl: don't use record layer in req_ssl_ver +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The initial record layer version in a SSL handshake may be set to TLSv1.0 +or similar for compatibility reasons, this is allowed as per RFC5246 +Appendix E.1 [1]. Some implementations are Openssl [2] and NSS [3]. + +A related issue has been fixed some time ago in commit 57d229747 +("BUG/MINOR: acl: req_ssl_sni fails with SSLv3 record version"). + +Fix this by using the real client hello version instead of the record +layer version. + +This was reported by Julien Vehent and analyzed by Cyril Bonté. +The initial patch is from Julien Vehent as well. + +This should be backported to stable series, the req_ssl_ver keyword was +first introduced in 1.3.16. + +[1] https://tools.ietf.org/html/rfc5246#appendix-E.1 +[2] https://github.com/openssl/openssl/commit/4a1cf50187659e60c5867ecbbc36e37b2605d2c3 +[3] https://bugzilla.mozilla.org/show_bug.cgi?id=774547 +(cherry picked from commit c93242cab986087f06a4655d14fec18eecb7f5f4) +(cherry picked from commit b048a6eb3d9cb518e4a378e20ba2a801afec553c) +--- + src/payload.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/src/payload.c b/src/payload.c +index f62163c..b8f1ca3 100644 +--- a/src/payload.c ++++ b/src/payload.c +@@ -148,21 +148,24 @@ smp_fetch_req_ssl_ver(struct proxy *px, struct session *s, void *l7, unsigned in + data = (const unsigned char *)s->req->buf->p; + if ((*data >= 0x14 && *data <= 0x17) || (*data == 0xFF)) { + /* SSLv3 header format */ +- if (bleft < 5) ++ if (bleft < 11) + goto too_short; + +- version = (data[1] << 16) + data[2]; /* version: major, minor */ ++ version = (data[1] << 16) + data[2]; /* record layer version: major, minor */ + msg_len = (data[3] << 8) + data[4]; /* record length */ + + /* format introduced with SSLv3 */ + if (version < 0x00030000) + goto not_ssl; + +- /* message length between 1 and 2^14 + 2048 */ +- if (msg_len < 1 || msg_len > ((1<<14) + 2048)) ++ /* message length between 6 and 2^14 + 2048 */ ++ if (msg_len < 6 || msg_len > ((1<<14) + 2048)) + goto not_ssl; + + bleft -= 5; data += 5; ++ ++ /* return the client hello client version, not the record layer version */ ++ version = (data[4] << 16) + data[5]; /* client hello version: major, minor */ + } else { + /* SSLv2 header format, only supported for hello (msg type 1) */ + int rlen, plen, cilen, silen, chlen; +-- +2.4.10 + diff --git a/net/haproxy/patches/0002-DOC-usesrc-root-privileges-requirements.patch b/net/haproxy/patches/0002-DOC-usesrc-root-privileges-requirements.patch deleted file mode 100644 index 0af6565800..0000000000 --- a/net/haproxy/patches/0002-DOC-usesrc-root-privileges-requirements.patch +++ /dev/null @@ -1,27 +0,0 @@ -From ea31f225c2c93a25b8bef7a9241a89cecfd9d350 Mon Sep 17 00:00:00 2001 -From: Baptiste Assmann -Date: Fri, 17 Jul 2015 21:59:42 +0200 -Subject: [PATCH 2/4] DOC: usesrc root privileges requirements - -The "usesrc" parameter of the source statement requires root privileges. -(cherry picked from commit 91bd337d90cb347feda34b01402f3471c8a4833c) ---- - doc/configuration.txt | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/doc/configuration.txt b/doc/configuration.txt -index 6714afb..64697a4 100644 ---- a/doc/configuration.txt -+++ b/doc/configuration.txt -@@ -6117,6 +6117,8 @@ source [:] [interface ] - is possible at the server level using the "source" server option. Refer to - section 5 for more information. - -+ In order to work, "usesrc" requires root privileges. -+ - Examples : - backend private - # Connect to the servers using our 192.168.1.200 source address --- -2.3.6 - diff --git a/net/haproxy/patches/0003-BUG-http-do-not-abort-keep-alive-connections-on-serv.patch b/net/haproxy/patches/0003-BUG-http-do-not-abort-keep-alive-connections-on-serv.patch new file mode 100644 index 0000000000..10fcc865f6 --- /dev/null +++ b/net/haproxy/patches/0003-BUG-http-do-not-abort-keep-alive-connections-on-serv.patch @@ -0,0 +1,37 @@ +From ef8a113d59e89b2214adf7ab9f9b0b75905a7050 Mon Sep 17 00:00:00 2001 +From: lsenta +Date: Fri, 13 Nov 2015 10:44:22 +0100 +Subject: [PATCH 03/10] BUG: http: do not abort keep-alive connections on + server timeout + +When a server timeout is detected on the second or nth request of a keep-alive +connection, HAProxy closes the connection without writing a response. +Some clients would fail with a remote disconnected exception and some +others would retry potentially unsafe requests. + +This patch removes the special case and makes sure a 504 timeout is +written back whenever a server timeout is handled. + +Signed-off-by: lsenta +(cherry picked from commit 1e1f41d0f3473d86da84dc3785b7d7cbef6e9044) +(cherry picked from commit 1f279c0b116f7fbc208793fffbd256c3c736fc52) +--- + src/proto_http.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/src/proto_http.c b/src/proto_http.c +index 17742c6..e7e1785 100644 +--- a/src/proto_http.c ++++ b/src/proto_http.c +@@ -5782,8 +5782,6 @@ int http_wait_for_response(struct session *s, struct channel *rep, int an_bit) + else if (rep->flags & CF_READ_TIMEOUT) { + if (msg->err_pos >= 0) + http_capture_bad_message(&s->be->invalid_rep, s, msg, msg->msg_state, s->fe); +- else if (txn->flags & TX_NOT_FIRST) +- goto abort_keep_alive; + + s->be->be_counters.failed_resp++; + if (objt_server(s->target)) { +-- +2.4.10 + diff --git a/net/haproxy/patches/0003-BUILD-ssl-Allow-building-against-libssl-without-SSLv.patch b/net/haproxy/patches/0003-BUILD-ssl-Allow-building-against-libssl-without-SSLv.patch deleted file mode 100644 index 074cedc84f..0000000000 --- a/net/haproxy/patches/0003-BUILD-ssl-Allow-building-against-libssl-without-SSLv.patch +++ /dev/null @@ -1,51 +0,0 @@ -From eee374c28ea8ea22834ff14515b5584bc3e0c7b5 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?J=C3=A9r=C3=A9mie=20Courr=C3=A8ges-Anglas?= -Date: Sat, 25 Jul 2015 16:50:52 -0600 -Subject: [PATCH 3/4] BUILD: ssl: Allow building against libssl without SSLv3. - -If SSLv3 is explicitely requested but not available, warn the user and -bail out. -(cherry picked from commit 17c3f6284cf605e47f6525c077bc644c45272849) ---- - src/ssl_sock.c | 16 ++++++++++++++-- - 1 file changed, 14 insertions(+), 2 deletions(-) - -diff --git a/src/ssl_sock.c b/src/ssl_sock.c -index 7d77d36..2ae45ec 100644 ---- a/src/ssl_sock.c -+++ b/src/ssl_sock.c -@@ -1405,8 +1405,14 @@ int ssl_sock_prepare_ctx(struct bind_conf *bind_conf, SSL_CTX *ctx, struct proxy - ssloptions |= SSL_OP_NO_TLSv1_2; - if (bind_conf->ssl_options & BC_SSL_O_NO_TLS_TICKETS) - ssloptions |= SSL_OP_NO_TICKET; -- if (bind_conf->ssl_options & BC_SSL_O_USE_SSLV3) -+ if (bind_conf->ssl_options & BC_SSL_O_USE_SSLV3) { -+#ifndef OPENSSL_NO_SSL3 - SSL_CTX_set_ssl_version(ctx, SSLv3_server_method()); -+#else -+ Alert("SSLv3 support requested but unavailable.\n"); -+ cfgerr++; -+#endif -+ } - if (bind_conf->ssl_options & BC_SSL_O_USE_TLSV10) - SSL_CTX_set_ssl_version(ctx, TLSv1_server_method()); - #if SSL_OP_NO_TLSv1_1 -@@ -1750,8 +1756,14 @@ int ssl_sock_prepare_srv_ctx(struct server *srv, struct proxy *curproxy) - options |= SSL_OP_NO_TLSv1_2; - if (srv->ssl_ctx.options & SRV_SSL_O_NO_TLS_TICKETS) - options |= SSL_OP_NO_TICKET; -- if (srv->ssl_ctx.options & SRV_SSL_O_USE_SSLV3) -+ if (srv->ssl_ctx.options & SRV_SSL_O_USE_SSLV3) { -+#ifndef OPENSSL_NO_SSL3 - SSL_CTX_set_ssl_version(srv->ssl_ctx.ctx, SSLv3_client_method()); -+#else -+ Alert("SSLv3 support requested but unavailable."); -+ cfgerr++; -+#endif -+ } - if (srv->ssl_ctx.options & SRV_SSL_O_USE_TLSV10) - SSL_CTX_set_ssl_version(srv->ssl_ctx.ctx, TLSv1_client_method()); - #if SSL_OP_NO_TLSv1_1 --- -2.3.6 - diff --git a/net/haproxy/patches/0004-BUG-MEDIUM-http-switch-the-request-channel-to-no-del.patch b/net/haproxy/patches/0004-BUG-MEDIUM-http-switch-the-request-channel-to-no-del.patch new file mode 100644 index 0000000000..9f74e1fd0e --- /dev/null +++ b/net/haproxy/patches/0004-BUG-MEDIUM-http-switch-the-request-channel-to-no-del.patch @@ -0,0 +1,112 @@ +From c0d56134320e507c82952f3d2a03f76b701945cb Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Wed, 18 Nov 2015 11:59:55 +0100 +Subject: [PATCH 04/10] BUG/MEDIUM: http: switch the request channel to + no-delay once done. + +There's an issue when sending POST data that came in a second packet, +the CF_NEVER_WAIT flag is not always set on the request channel, while +the server is waiting for the request. We must always set this flag in +this case since we're not going to shut down after sending, contrary +to the response side. + +Note that option http-no-delay works around this issue. + +Reproducer : + +listen px + mode http + timeout client 10s + timeout server 5s + timeout connect 3s + option http-server-close + #option http-no-delay + bind :8001 + server s1 127.0.0.1:8003 + +$ (printf "POST / HTTP/1.1\r\nTransfer-encoding: chunked\r\n\r\n"; sleep 0.01; printf "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n") | nc6 0 8001 + +Before this fix : + +12:03:31.946763 epoll_wait(3, {{EPOLLIN, {u32=5, u64=5}}}, 200, 1000) = 1 +12:03:32.634175 accept4(5, {sa_family=AF_INET, sin_port=htons(53849), sin_addr=inet_addr("127.0.0.1")}, [16], SOCK_NONBLOCK) = 6 +12:03:32.634318 setsockopt(6, SOL_TCP, TCP_NODELAY, [1], 4) = 0 +12:03:32.634434 accept4(5, 0x7ffccfbb2cf0, [128], SOCK_NONBLOCK) = -1 EAGAIN (Resource temporarily unavailable) +12:03:32.634574 recvfrom(6, "POST / HTTP/1.1\r\nTransfer-encodi"..., 8192, 0, NULL, NULL) = 47 +12:03:32.634809 setsockopt(6, SOL_TCP, TCP_QUICKACK, [1], 4) = 0 +12:03:32.634952 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 7 +12:03:32.635031 fcntl(7, F_SETFL, O_RDONLY|O_NONBLOCK) = 0 +12:03:32.635089 setsockopt(7, SOL_TCP, TCP_NODELAY, [1], 4) = 0 +12:03:32.635153 connect(7, {sa_family=AF_INET, sin_port=htons(8003), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress) +12:03:32.635315 epoll_wait(3, {}, 200, 0) = 0 +12:03:32.635394 sendto(7, "POST / HTTP/1.1\r\nTransfer-encodi"..., 66, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 66 +12:03:32.635527 recvfrom(6, 0x7f0224e66024, 8192, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) +12:03:32.635651 epoll_ctl(3, EPOLL_CTL_ADD, 6, {EPOLLIN|0x2000, {u32=6, u64=6}}) = 0 +12:03:32.635782 epoll_wait(3, {}, 200, 0) = 0 +12:03:32.635842 recvfrom(7, 0x7f0224e66024, 8192, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) +12:03:32.635924 epoll_ctl(3, EPOLL_CTL_ADD, 7, {EPOLLIN|0x2000, {u32=7, u64=7}}) = 0 +12:03:32.636027 epoll_wait(3, {{EPOLLIN, {u32=6, u64=6}}}, 200, 1000) = 1 +12:03:32.644892 recvfrom(6, "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n", 8192, 0, NULL, NULL) = 27 +12:03:32.645016 epoll_wait(3, {}, 200, 0) = 0 +12:03:32.645105 sendto(7, "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n", 27, MSG_DONTWAIT|MSG_NOSIGNAL|MSG_MORE, NULL, 0) = 27 + +After the fix : + +11:59:12.538617 connect(7, {sa_family=AF_INET, sin_port=htons(8003), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress) +11:59:12.538787 epoll_wait(3, {}, 200, 0) = 0 +11:59:12.538867 sendto(7, "POST / HTTP/1.1\r\nTransfer-encodi"..., 66, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 66 +11:59:12.539031 recvfrom(6, 0x7f832ce45024, 8192, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) +11:59:12.539161 epoll_ctl(3, EPOLL_CTL_ADD, 6, {EPOLLIN|0x2000, {u32=6, u64=6}}) = 0 +11:59:12.539259 epoll_wait(3, {}, 200, 0) = 0 +11:59:12.539337 recvfrom(7, 0x7f832ce45024, 8192, 0, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) +11:59:12.539421 epoll_ctl(3, EPOLL_CTL_ADD, 7, {EPOLLIN|0x2000, {u32=7, u64=7}}) = 0 +11:59:12.539499 epoll_wait(3, {{EPOLLIN, {u32=6, u64=6}}}, 200, 1000) = 1 +11:59:12.548519 recvfrom(6, "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n", 8192, 0, NULL, NULL) = 27 +11:59:12.548844 epoll_wait(3, {}, 200, 0) = 0 +11:59:12.549012 sendto(7, "10\r\nAZERTYUIOPQSDFGH\r\n0\r\n\r\n", 27, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 27 +11:59:12.549454 epoll_wait(3, {}, 200, 1000) = 0 + +This fix must be backported to 1.6, 1.5 and 1.4. +(cherry picked from commit 7f876a1eeb14ffae708327aad8a0b4b029da5e26) +(cherry picked from commit 712a5339f384db62796aa4d4901e091dd7fd24dd) +--- + src/proto_http.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/proto_http.c b/src/proto_http.c +index e7e1785..b32e778 100644 +--- a/src/proto_http.c ++++ b/src/proto_http.c +@@ -5001,6 +5001,13 @@ int http_sync_req_state(struct session *s) + */ + chn->cons->flags |= SI_FL_NOHALF; + ++ /* In any case we've finished parsing the request so we must ++ * disable Nagle when sending data because 1) we're not going ++ * to shut this side, and 2) the server is waiting for us to ++ * send pending data. ++ */ ++ chn->flags |= CF_NEVER_WAIT; ++ + if (txn->rsp.msg_state == HTTP_MSG_ERROR) + goto wait_other_side; + +@@ -5015,7 +5022,6 @@ int http_sync_req_state(struct session *s) + /* if any side switches to tunnel mode, the other one does too */ + channel_auto_read(chn); + txn->req.msg_state = HTTP_MSG_TUNNEL; +- chn->flags |= CF_NEVER_WAIT; + goto wait_other_side; + } + +@@ -5048,7 +5054,6 @@ int http_sync_req_state(struct session *s) + if ((txn->flags & TX_CON_WANT_MSK) == TX_CON_WANT_TUN) { + channel_auto_read(chn); + txn->req.msg_state = HTTP_MSG_TUNNEL; +- chn->flags |= CF_NEVER_WAIT; + } + } + +-- +2.4.10 + diff --git a/net/haproxy/patches/0004-DOC-MINOR-fix-OpenBSD-versions-where-haproxy-works.patch b/net/haproxy/patches/0004-DOC-MINOR-fix-OpenBSD-versions-where-haproxy-works.patch deleted file mode 100644 index c769228fa5..0000000000 --- a/net/haproxy/patches/0004-DOC-MINOR-fix-OpenBSD-versions-where-haproxy-works.patch +++ /dev/null @@ -1,26 +0,0 @@ -From e4766ba031e1fea8f2ca139316dc4e8209e960c2 Mon Sep 17 00:00:00 2001 -From: Daniel Jakots -Date: Wed, 29 Jul 2015 08:03:08 +0200 -Subject: [PATCH 4/4] DOC/MINOR: fix OpenBSD versions where haproxy works - -(cherry picked from commit 17d228be14762b282e5262262c45ecee4c265552) ---- - README | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/README b/README -index add7f06..e267730 100644 ---- a/README -+++ b/README -@@ -39,7 +39,7 @@ and assign it to the TARGET variable : - - solaris for Solaris 8 or 10 (others untested) - - freebsd for FreeBSD 5 to 10 (others untested) - - osx for Mac OS/X -- - openbsd for OpenBSD 3.1 to 5.2 (others untested) -+ - openbsd for OpenBSD 3.1 and above - - aix51 for AIX 5.1 - - aix52 for AIX 5.2 - - cygwin for Cygwin --- -2.3.6 - diff --git a/net/haproxy/patches/0005-BUG-MINOR-http-sample-gmtime-localtime-can-fail.patch b/net/haproxy/patches/0005-BUG-MINOR-http-sample-gmtime-localtime-can-fail.patch deleted file mode 100644 index 23012ba0c6..0000000000 --- a/net/haproxy/patches/0005-BUG-MINOR-http-sample-gmtime-localtime-can-fail.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 955587271031d66e9b7a768e3bb18dae00b60cc6 Mon Sep 17 00:00:00 2001 -From: Thierry FOURNIER -Date: Wed, 8 Jul 2015 00:15:20 +0200 -Subject: [PATCH 05/13] BUG/MINOR: http/sample: gmtime/localtime can fail - -The man said that gmtime() and localtime() can return a NULL value. -This is not tested. It appears that all the values of a 32 bit integer -are valid, but it is better to check the return of these functions. - -However, if the integer move from 32 bits to 64 bits, some 64 values -can be unsupported. -(cherry picked from commit fac9ccfb705702f211f99e67d5f5d5129002086a) -[wt: we only have sample_conv_date() in 1.5] ---- - src/proto_http.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/proto_http.c b/src/proto_http.c -index 5db64b5..02dc42b 100644 ---- a/src/proto_http.c -+++ b/src/proto_http.c -@@ -11249,6 +11249,8 @@ static int sample_conv_http_date(const struct arg *args, struct sample *smp) - curr_date += args[0].data.sint; - - tm = gmtime(&curr_date); -+ if (!tm) -+ return 0; - - temp = get_trash_chunk(); - temp->len = snprintf(temp->str, temp->size - temp->len, --- -2.4.6 - diff --git a/net/haproxy/patches/0005-MINOR-config-extend-the-default-max-hostname-length-.patch b/net/haproxy/patches/0005-MINOR-config-extend-the-default-max-hostname-length-.patch new file mode 100644 index 0000000000..69e8f4f7b7 --- /dev/null +++ b/net/haproxy/patches/0005-MINOR-config-extend-the-default-max-hostname-length-.patch @@ -0,0 +1,52 @@ +From e77015cdc18ab74aba61cdf57de56d06be5c2a4d Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Wed, 14 Jan 2015 11:48:58 +0100 +Subject: [PATCH 05/10] MINOR: config: extend the default max hostname length + to 64 and beyond + +Some users reported that the default max hostname length of 32 is too +short in some environments. This patch does two things : + + - it relies on the system's max hostname length as found in MAXHOSTNAMELEN + if it is set. This is the most logical thing to do as the system libs + generally present the appropriate value supported by the system. This + value is 64 on Linux and 256 on Solaris, to give a few examples. + + - otherwise it defaults to 64 + +It is still possible to override this value by defining MAX_HOSTNAME_LEN at +build time. After some observation time, this patch may be backported to +1.5 if it does not cause any build issue, as it is harmless and may help +some users. +(cherry picked from commit 75abcb3106e2c27ef983df885558cf94e01f717a) + +Cc: Lukas Tribus +Cc: jose.castro.leon@cern.ch + +[wt: no issue reported so far and Jose rightfully asked for it in 1.5] +--- + include/common/defaults.h | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/include/common/defaults.h b/include/common/defaults.h +index 0075509..a191b8a 100644 +--- a/include/common/defaults.h ++++ b/include/common/defaults.h +@@ -190,8 +190,12 @@ + + /* Maximum host name length */ + #ifndef MAX_HOSTNAME_LEN +-#define MAX_HOSTNAME_LEN 32 +-#endif ++#if MAXHOSTNAMELEN ++#define MAX_HOSTNAME_LEN MAXHOSTNAMELEN ++#else ++#define MAX_HOSTNAME_LEN 64 ++#endif // MAXHOSTNAMELEN ++#endif // MAX_HOSTNAME_LEN + + /* Maximum health check description length */ + #ifndef HCHK_DESC_LEN +-- +2.4.10 + diff --git a/net/haproxy/patches/0006-BUG-MEDIUM-http-don-t-enable-auto-close-on-the-respo.patch b/net/haproxy/patches/0006-BUG-MEDIUM-http-don-t-enable-auto-close-on-the-respo.patch new file mode 100644 index 0000000000..58d44f0437 --- /dev/null +++ b/net/haproxy/patches/0006-BUG-MEDIUM-http-don-t-enable-auto-close-on-the-respo.patch @@ -0,0 +1,49 @@ +From 3de8e7ab8d9125402cc1a8fb48ee475ee21d7d4c Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Wed, 25 Nov 2015 20:11:11 +0100 +Subject: [PATCH 06/10] BUG/MEDIUM: http: don't enable auto-close on the + response side + +There is a bug where "option http-keep-alive" doesn't force a response +to stay in keep-alive if the server sends the FIN along with the response +on the second or subsequent response. The reason is that the auto-close +was forced enabled when recycling the HTTP transaction and it's never +disabled along the response processing chain before the SHUTR gets a +chance to be forwarded to the client side. The MSG_DONE state of the +HTTP response properly disables it but too late. + +There's no more reason for enabling auto-close here, because either it +doesn't matter in non-keep-alive modes because the connection is closed, +or it is automatically enabled by process_stream() when it sees there's +no analyser on the stream. + +This bug also affects 1.5 so a backport is desired. +(cherry picked from commit 714ea78c9a09fe6a35a1f2d86af8f7fc9abb64d1) +(cherry picked from commit a15091be17f27fcf4e3a84338df1a8b732e396a1) +--- + src/proto_http.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/proto_http.c b/src/proto_http.c +index b32e778..5facfbb 100644 +--- a/src/proto_http.c ++++ b/src/proto_http.c +@@ -4946,11 +4946,13 @@ void http_end_txn_clean_session(struct session *s) + s->rep->flags |= CF_EXPECT_MORE; + } + +- /* we're removing the analysers, we MUST re-enable events detection */ ++ /* we're removing the analysers, we MUST re-enable events detection. ++ * We don't enable close on the response channel since it's either ++ * already closed, or in keep-alive with an idle connection handler. ++ */ + channel_auto_read(s->req); + channel_auto_close(s->req); + channel_auto_read(s->rep); +- channel_auto_close(s->rep); + + /* we're in keep-alive with an idle connection, monitor it */ + si_idle_conn(s->req->cons); +-- +2.4.10 + diff --git a/net/haproxy/patches/0006-DOC-typo-in-redirect-302-code-meaning.patch b/net/haproxy/patches/0006-DOC-typo-in-redirect-302-code-meaning.patch deleted file mode 100644 index 9b962807c8..0000000000 --- a/net/haproxy/patches/0006-DOC-typo-in-redirect-302-code-meaning.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 6c7351bdd0778bc171a2b54faed058eadc8c9d0d Mon Sep 17 00:00:00 2001 -From: Baptiste Assmann -Date: Mon, 3 Aug 2015 11:42:50 +0200 -Subject: [PATCH 06/13] DOC: typo in 'redirect', 302 code meaning - -302 means a temprary move, not a permanent one -(cherry picked from commit ea849c0cca63b1b56c9c36f9c3504caa5e826816) ---- - doc/configuration.txt | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/doc/configuration.txt b/doc/configuration.txt -index 64697a4..e8d8b2a 100644 ---- a/doc/configuration.txt -+++ b/doc/configuration.txt -@@ -5443,7 +5443,7 @@ redirect scheme [code ]