3311195234
- Update to version 3.3.4+git0.c2bffae0a: * [RELEASE] Released version 3.3.4 * BUG/MINOR: backend: check delay MUX before conn_prepare() * BUG/MINOR: acme: fix X509_NAME leak when X509_set_issuer_name() fails * CLEANUP: mux-h1: Remove unneeded null check * BUG/MEDIUM: ssl: SSL backend sessions used after free * CI: github: disable windows.yml by default on unofficials repo * CI: vtest: move the vtest2 URL to vinyl-cache.org * MINOR: stconn: Add missing SC_FL_NO_FASTFWD flag in sc_show_flags * BUG/MINOR: http-ana: Stop to wait for body on client error/abort * CLEANUP: compression: Remove unused static buffers * BUG/MINOR: flt-trace: Properly compute length of the first DATA block * DEV: term-events: Fix hanshake events decoding * BUG/MEDIUM: applet: Fix test on shut flags for legacy applets (v2) * BUG/MEDIUM: mux-h1: Stop sending vi fast-forward for unexpected states * BUG/MEDIUM: mux-h2/quic: Stop sending via fast-forward if stream is closed * BUG/MEDIUM: h3: reject frontend CONNECT as currently not implemented * BUG/MAJOR: Revert "MEDIUM: mux-quic: add BUG_ON if sending on locally closed QCS" * BUG/MINOR: ssl: error with ssl-f-use when no "crt" * BUG/MINOR: ssl: clarify ssl-f-use errors in post-section parsing * BUG/MINOR: ssl: fix leak in ssl-f-use parser upon error * BUG/MINOR: ssl: double-free on error path w/ ssl-f-use parser * BUG/MINOR: ssl: lack crtlist_dup_ssl_conf() declaration * BUG/MINOR: deviceatlas: set cache_size on hot-reloaded atlas instance * BUG/MINOR: deviceatlas: fix deinit to only finalize when initialized * BUG/MINOR: deviceatlas: fix resource leak on hot-reload compile failure * BUG/MINOR: deviceatlas: fix double-checked locking race in checkinst * BUG/MINOR: deviceatlas: fix cookie vlen using wrong length after extraction * BUG/MINOR: deviceatlas: fix off-by-one in da_haproxy_conv() * BUG/MEDIUM: deviceatlas: fix resource leaks on init error paths
Marcus Rueckert2026-02-19 13:53:50 +00:00
83adac273f
Accepting request 1332730 from server:http
Ana Guerrero2026-02-12 16:30:48 +00:00
00adb23abc
- Update to version 3.3.3+git0.465d8e2fc: (boo#1257976 CVE-2026-26081 CVE-2026-26080) * [RELEASE] Released version 3.3.3 * BUG/MAJOR: quic: fix parsing frame type * BUG/MAJOR: quic: reject invalid token * BUG/MINOR: backend: fix access on shared counters array * BUG/MINOR: quic: ensure handshake speed up is only run once per conn * BUG/MINOR: ssl: SSL_CERT_DIR environment variable doesn't affect haproxy * MINOR: activity: allow to switch per-task lock/memory profiling at runtime * MEDIUM: activity: apply and use new finegrained task profiling settings * MINOR: activity: support setting/clearing lock/memory watching for task profiling * BUG/MINOR: startup: handle a possible strdup() failure * BUG/MINOR: startup: fix allocation error message of progname string * BUG/MINOR: config: Fix setting of alt_proto * MEDIUM: backend: make "balance random" consider req rate when loads are equal * DOC: config: mention the limitation on server id range for consistent hash * BUG/MEDIUM: lb-chash: always properly initialize lb_nodes with dynamic servers * CLEANUP: lb-chash: free lb_nodes from chash's deinit(), not global * BUG/MINOR: cpu-topo: count cores not cpus to distinguish core types * CLEANUP: haproxy: fix bad line wrapping in run_poll_loop() * BUG/MEDIUM: threads: Atomically set TH_FL_SLEEPING and clr FL_NOTIFIED
Marcus Rueckert2026-02-12 15:18:38 +00:00
d9e587087b
Accepting request 1331681 from server:http
Ana Guerrero2026-02-06 18:11:22 +00:00
a79c16c530
Accepting request 1329868 from server:http
Ana Guerrero2026-01-30 17:22:20 +00:00
89ba0f6e79
Accepting request 1329868 from server:http
Ana Guerrero2026-01-30 17:22:20 +00:00
10ab59f5c4
- Update to version 3.3.2+git3.bc0fb5969: * BUG/MEDIUM: applet: Fix test on shut flags for legacy applets * DOC: internals: cleanup few typos in master-worker documentation * MEDIUM: h1: strictly verify quoting in chunk extensions
Marcus Rueckert2026-01-30 13:28:31 +00:00
7a84663f26
- Update to version 3.3.2+git3.bc0fb5969: * BUG/MEDIUM: applet: Fix test on shut flags for legacy applets * DOC: internals: cleanup few typos in master-worker documentation * MEDIUM: h1: strictly verify quoting in chunk extensions
Marcus Rueckert2026-01-30 13:28:31 +00:00
e675ce1878
- refresh haproxy-1.6.0-makefile_lib.patch - Readd USE_RELRO_NOW=1, USE_STACKPROTECTOR=1, USE_PIE=1 - adapt haproxy-1.6.0-sec-options.patch so the build no longer complains about unused options - drop CPU="%{_target_cpu}" as it is unused - migrate to DEBUG_CFLAGS to OPT_CFLAGS
Marcus Rueckert2025-11-20 17:27:39 +00:00
a01a004086
- refresh haproxy-1.6.0-makefile_lib.patch - Readd USE_RELRO_NOW=1, USE_STACKPROTECTOR=1, USE_PIE=1 - adapt haproxy-1.6.0-sec-options.patch so the build no longer complains about unused options - drop CPU="%{_target_cpu}" as it is unused - migrate to DEBUG_CFLAGS to OPT_CFLAGS
Marcus Rueckert2025-11-20 17:27:39 +00:00
ca9c399490
- Readd USE_RELRO_NOW=1, USE_STACKPROTECTOR=1, USE_PIE=1, USE_SYSTEMD=1 all of them are still used.
Marcus Rueckert2025-11-20 14:42:06 +00:00
5fdce62cc7
- Remove checks for not supported openSUSE versions
Peter Varkoly2025-11-07 20:11:51 +00:00
5d12f13da9
- Remove checks for not supported openSUSE versions
Peter Varkoly2025-11-07 20:11:51 +00:00
b9559ba947
Accepting request 1316410 from server:http
Ana Guerrero2025-11-07 17:23:22 +00:00
c8f5d47eff
Accepting request 1316410 from server:http
Ana Guerrero2025-11-07 17:23:22 +00:00
a197d2d9f1
- Update to version 3.2.8+git0.9200f398d: * [RELEASE] Released version 3.2.8 * BUG/MINOR: acme: wrong dns-01 challenge in the log * BUG/MEDIUM: server: close a race around ready_srv when deleting a server * BUG/MEDIUM: connections: permit to permanently remove an idle conn * BUG/MEDIUM: mux-h2: make sure not to move a dead connection to idle * BUG/MEDIUM: mux-h1: fix 414 / 431 status code reporting * SCRIPTS: build-ssl: fix rpath in AWS-LC install for openssl and bssl bin * OPTIM: backend: skip conn reuse for incompatible proxies * BUG/MINOR: resolvers: ensure fair round robin iteration * BUG/MINOR: ssl: returns when SSL_CTX_new failed during init * BUG/MINOR: resolvers: Apply dns-accept-family setting on additional records * BUG/MINOR: init: Do not close previously created fd in stdio_quiet * MINOR: http: fix 405,431,501 default errorfile * MINOR: ssl-sample: add ssl_fc_early_rcvd() to detect use of early data * DOC: config: slightly clarify the ssl_fc_has_early() behavior * BUG/MEDIUM: ssl: Crash because of dangling ckch_store reference in a ckch instance * MINOR: backend: srv_is_up converter * MINOR: backend: srv_queue helper * BUG/MEDIUM: cli: do not return ACKs one char at a time * MINOR: cli: create cli_raw_rcv_buf() from the generic applet_raw_rcv_buf() * MINOR: applet: do not put SE_FL_WANT_ROOM on rcv_buf() if the channel is empty * BUG/MEDIUM: mt_list: Use atomic operations to prevent compiler optims * BUG/MINOR: stick-tables: properly index string-type keys * BUG/MEDIUM: applet: Improve again spinning loops detection with the new API * BUG/MEDIUM: mt_lists: Avoid el->prev = el->next = el
Marcus Rueckert2025-11-07 10:20:42 +00:00
6f282eee19
- Update to version 3.2.8+git0.9200f398d: * [RELEASE] Released version 3.2.8 * BUG/MINOR: acme: wrong dns-01 challenge in the log * BUG/MEDIUM: server: close a race around ready_srv when deleting a server * BUG/MEDIUM: connections: permit to permanently remove an idle conn * BUG/MEDIUM: mux-h2: make sure not to move a dead connection to idle * BUG/MEDIUM: mux-h1: fix 414 / 431 status code reporting * SCRIPTS: build-ssl: fix rpath in AWS-LC install for openssl and bssl bin * OPTIM: backend: skip conn reuse for incompatible proxies * BUG/MINOR: resolvers: ensure fair round robin iteration * BUG/MINOR: ssl: returns when SSL_CTX_new failed during init * BUG/MINOR: resolvers: Apply dns-accept-family setting on additional records * BUG/MINOR: init: Do not close previously created fd in stdio_quiet * MINOR: http: fix 405,431,501 default errorfile * MINOR: ssl-sample: add ssl_fc_early_rcvd() to detect use of early data * DOC: config: slightly clarify the ssl_fc_has_early() behavior * BUG/MEDIUM: ssl: Crash because of dangling ckch_store reference in a ckch instance * MINOR: backend: srv_is_up converter * MINOR: backend: srv_queue helper * BUG/MEDIUM: cli: do not return ACKs one char at a time * MINOR: cli: create cli_raw_rcv_buf() from the generic applet_raw_rcv_buf() * MINOR: applet: do not put SE_FL_WANT_ROOM on rcv_buf() if the channel is empty * BUG/MEDIUM: mt_list: Use atomic operations to prevent compiler optims * BUG/MINOR: stick-tables: properly index string-type keys * BUG/MEDIUM: applet: Improve again spinning loops detection with the new API * BUG/MEDIUM: mt_lists: Avoid el->prev = el->next = el
Marcus Rueckert2025-11-07 10:20:42 +00:00
201c119ea0
Accepting request 1313209 from server:http
Ana Guerrero2025-10-23 14:38:28 +00:00
54b33ff210
Accepting request 1313209 from server:http
Ana Guerrero2025-10-23 14:38:28 +00:00
59e4f51c4d
- Fix apparmor profile: - we need attach disconnected for the systemd notify socket - more access for the cpu scheduling support in haproxy
Marcus Rueckert2025-10-07 13:32:14 +00:00
dda00b7aca
- Fix apparmor profile: - we need attach disconnected for the systemd notify socket - more access for the cpu scheduling support in haproxy
Marcus Rueckert2025-10-07 13:32:14 +00:00
4405c77806
Accepting request 1308350 from server:http
Ana Guerrero2025-10-01 16:57:31 +00:00
79c6ca3d21
Accepting request 1308350 from server:http
Ana Guerrero2025-10-01 16:57:31 +00:00
8082a1c3ca
- Update to version 3.2.5+git0.ba0fd6b8e: * [RELEASE] Released version 3.2.5 * BUG/MEDIUM: pattern: fix possible infinite loops on deletion (try 2) * DEBUG: stick-tables: export stktable_add_pend_updates() for better reporting * BUG/MEDIUM: ring: invert the length check to avoid an int overflow * BUG/MINOR: resolvers: always normalize FQDN from response * BUG/MINOR: ocsp: Crash when updating CA during ocsp updates * BUG/MEDIUM: http_ana: fix potential NULL deref in http_process_req_common() * BUG/MINOR: ocsp: prototype inconsistency * BUG/MINOR: ssl: Fix potential NULL deref in trace callback * BUG/MINOR: ssl: Potential NULL deref in trace macro * BUG/MEDIUM: jws: return size_t in JWS functions * BUG/MINOR: acme: null pointer dereference upon allocation failure * BUG/MAJOR: stream: Force channel analysis on successful synchronous send * BUG/MAJOR: stream: Remove READ/WRITE events on channels after analysers eval * BUG/MINOR: stick-table: make sure never to miss a process_table_expire update * BUG/MEDIUM: stick-tables: don't loop on non-expirable entries * BUG/MINOR: activity: fix reporting of task latency * BUG/MEDIUM: ssl: create the mux immediately on early data * BUG/MEDIUM: h1: Allow reception if we have early data * BUG/MEDIUM: checks: fix ALPN inheritance from server * OPTIM: check: do not delay MUX for ALPN if SSL not active * BUG/MEDIUM: mux-h2: Reinforce conditions to report an error to app-layer stream * BUG/MEDIUM: mux-h2: Report RST/error to app-layer stream during 0-copy fwding * BUG/MINOR: mux-h2: Remove H2_CF_DEM_DFULL flags when the demux buffer is reset * BUG/MEDIUM: mux-h2: Restart reading when mbuf ring is no longer full * BUG/MEDIUM: mux-h2; Don't block reveives in H2_CS_ERROR and H2_CS_ERROR2 states * BUG/MEDIUM: mux-h2: Reset MUX blocking flags when a send error is caught * CLEANUP: quic: fix typo in quic_tx trace * BUG/MINOR: cpu_topo: work around a small bug in musl's CPU_ISSET()
Peter Varkoly2025-09-24 08:26:00 +00:00
3263c21a09
- Update to version 3.2.5+git0.ba0fd6b8e: * [RELEASE] Released version 3.2.5 * BUG/MEDIUM: pattern: fix possible infinite loops on deletion (try 2) * DEBUG: stick-tables: export stktable_add_pend_updates() for better reporting * BUG/MEDIUM: ring: invert the length check to avoid an int overflow * BUG/MINOR: resolvers: always normalize FQDN from response * BUG/MINOR: ocsp: Crash when updating CA during ocsp updates * BUG/MEDIUM: http_ana: fix potential NULL deref in http_process_req_common() * BUG/MINOR: ocsp: prototype inconsistency * BUG/MINOR: ssl: Fix potential NULL deref in trace callback * BUG/MINOR: ssl: Potential NULL deref in trace macro * BUG/MEDIUM: jws: return size_t in JWS functions * BUG/MINOR: acme: null pointer dereference upon allocation failure * BUG/MAJOR: stream: Force channel analysis on successful synchronous send * BUG/MAJOR: stream: Remove READ/WRITE events on channels after analysers eval * BUG/MINOR: stick-table: make sure never to miss a process_table_expire update * BUG/MEDIUM: stick-tables: don't loop on non-expirable entries * BUG/MINOR: activity: fix reporting of task latency * BUG/MEDIUM: ssl: create the mux immediately on early data * BUG/MEDIUM: h1: Allow reception if we have early data * BUG/MEDIUM: checks: fix ALPN inheritance from server * OPTIM: check: do not delay MUX for ALPN if SSL not active * BUG/MEDIUM: mux-h2: Reinforce conditions to report an error to app-layer stream * BUG/MEDIUM: mux-h2: Report RST/error to app-layer stream during 0-copy fwding * BUG/MINOR: mux-h2: Remove H2_CF_DEM_DFULL flags when the demux buffer is reset * BUG/MEDIUM: mux-h2: Restart reading when mbuf ring is no longer full * BUG/MEDIUM: mux-h2; Don't block reveives in H2_CS_ERROR and H2_CS_ERROR2 states * BUG/MEDIUM: mux-h2: Reset MUX blocking flags when a send error is caught * CLEANUP: quic: fix typo in quic_tx trace * BUG/MINOR: cpu_topo: work around a small bug in musl's CPU_ISSET()
Peter Varkoly2025-09-24 08:26:00 +00:00
5af7ca5968
Accepting request 1287782 from server:http
Ana Guerrero2025-06-24 18:46:47 +00:00
9c370123d2
Accepting request 1287782 from server:http
Ana Guerrero2025-06-24 18:46:47 +00:00
195d2f83d3
Accepting request 1287667 from home:crameleon:branches:server:http
Peter Varkoly2025-06-23 04:08:39 +00:00
b3b2cffa89
Accepting request 1287667 from home:crameleon:branches:server:http
Peter Varkoly2025-06-23 04:08:39 +00:00
0ea7418fe3
Accepting request 1286645 from server:http
Ana Guerrero2025-06-18 15:58:33 +00:00
85c608291f
Accepting request 1286645 from server:http
Ana Guerrero2025-06-18 15:58:33 +00:00
66a98a2cf5
- modernize spec file with spec-cleaner. some changes (mostly whitespaces) got reverted for readability
Marcus Rueckert2025-06-11 10:51:33 +00:00
d17cfcaf2e
- modernize spec file with spec-cleaner. some changes (mostly whitespaces) got reverted for readability
Marcus Rueckert2025-06-11 10:51:33 +00:00
854e7a6f4d
- Add support to build against aws-lc with --with=awslc or in the project config `` %define _with_awslc 1 Macros: %_with_awslc 1 :Macros ``
Marcus Rueckert2025-06-11 10:46:53 +00:00
0ea3144fdc
- Add support to build against aws-lc with --with=awslc or in the project config `` %define _with_awslc 1 Macros: %_with_awslc 1 :Macros ``
Marcus Rueckert2025-06-11 10:46:53 +00:00
43b169d35f
VUL-0: CVE-2025-32464: haproxy: HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one. (bsc#1240971)
Peter Varkoly2025-06-04 08:22:46 +00:00
da01ec2c64
VUL-0: CVE-2025-32464: haproxy: HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one. (bsc#1240971)
Peter Varkoly2025-06-04 08:22:46 +00:00
Dominique Leuenberger
Marcus Rueckert
Ana Guerrero
Peter Varkoly