upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-04-02 07:37:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
HAProxy - Load balancer
11451 commits 30 branches 411 tags 338 MiB
C 98.1%
Shell 0.9%
Makefile 0.5%
Lua 0.2%
Python 0.1%
Find a file
Tim Duesterhus 488ee7fb6e BUG/MAJOR: proxy_protocol: Properly validate TLV lengths 
This patch fixes PROXYv2 parsing when the payload of the TCP connection is
fused with the PROXYv2 header within a single recv() call.

Previously HAProxy ignored the PROXYv2 header length when attempting to
parse the TLV, possibly interpreting the first byte of the payload as a
TLV type.

This patch adds proper validation. It ensures that:

1. TLV parsing stops when the end of the PROXYv2 header is reached.
2. TLV lengths cannot exceed the PROXYv2 header length.
3. The PROXYv2 header ends together with the last TLV, not allowing for
   "stray bytes" to be ignored.

A reg-test was added to ensure proper behavior.

This patch tries to find the sweat spot between a small and easily
backportable one, and a cleaner one that's more easily adaptable to
older versions, hence why it merges the "if" and "while" blocks which
causes a reindent of the whole block. It should be used as-is for
versions 1.9 to 2.1, the block about PP2_TYPE_AUTHORITY should be
dropped for 2.0 and the block about CRC32C should be dropped for 1.8.

This bug was introduced when TLV parsing was added. This happened in commit
b3e54fe387. This commit was first released
with HAProxy 1.6-dev1.

A similar issue was fixed in commit 7209c204bd.

This patch must be backported to HAProxy 1.6+.
2020-03-06 11:11:22 +01:00
.github BUILD: enable ERR=1 in github cygwin builds 2020-02-15 16:32:38 +01:00
contrib CLEANUP: contrib/spoa_example: Fix several typos 2020-03-04 15:30:00 +01:00
doc DOC: assorted typo fixes in the documentation and Makefile 2020-03-06 10:49:55 +01:00
ebtree BUILD: ebtree: improve architecture-specific alignment 2020-02-25 10:34:49 +01:00
examples CLEANUP: removed obsolete examples an move a few to better places 2019-06-15 21:25:06 +02:00
include OPTIM: startup: fast unique_id allocation for acl. 2020-03-06 08:11:58 +01:00
reg-tests BUG/MAJOR: proxy_protocol: Properly validate TLV lengths 2020-03-06 11:11:22 +01:00
scripts SCRIPTS: announce-release: use mutt -H instead of -i to include the draft 2020-02-15 15:24:28 +01:00
src BUG/MAJOR: proxy_protocol: Properly validate TLV lengths 2020-03-06 11:11:22 +01:00
tests TESTS: Add a stress-test for mt_lists. 2019-09-23 18:16:08 +02:00
.cirrus.yml BUILD: cirrus-ci: suppress OS version check when installing packages 2020-02-27 16:16:59 +01:00
.gitignore DOC: create a BRANCHES file to explain the life cycle 2019-06-15 22:00:14 +02:00
.travis.yml BUILD: travis-ci: enable s390x builds 2020-02-25 11:58:43 +01:00
BRANCHES DOC: create a BRANCHES file to explain the life cycle 2019-06-15 22:00:14 +02:00
CHANGELOG [RELEASE] Released version 2.2-dev3 2020-02-25 18:14:02 +01:00
CONTRIBUTING DOC: assorted typo fixes in the documentation and Makefile 2020-03-06 10:49:55 +01:00
INSTALL DOC: assorted typo fixes in the documentation and Makefile 2020-03-06 10:49:55 +01:00
LICENSE LICENSE: add licence exception for OpenSSL 2012-09-07 13:52:26 +02:00
MAINTAINERS DOC: wurfl: added point of contact in MAINTAINERS file 2019-04-23 11:00:23 +02:00
Makefile DOC: assorted typo fixes in the documentation and Makefile 2020-03-06 10:49:55 +01:00
README DOC: create a BRANCHES file to explain the life cycle 2019-06-15 22:00:14 +02:00
ROADMAP DOC: update the outdated ROADMAP file 2019-06-15 21:59:54 +02:00
SUBVERS BUILD: use format tags in VERDATE and SUBVERS files 2013-12-10 11:22:49 +01:00
VERDATE [RELEASE] Released version 2.2-dev3 2020-02-25 18:14:02 +01:00
VERSION [RELEASE] Released version 2.2-dev3 2020-02-25 18:14:02 +01:00

README 

The HAProxy documentation has been split into a number of different files for
ease of use.

Please refer to the following files depending on what you're looking for :

  - INSTALL for instructions on how to build and install HAProxy
  - BRANCHES to understand the project's life cycle and what version to use
  - LICENSE for the project's license
  - CONTRIBUTING for the process to follow to submit contributions

The more detailed documentation is located into the doc/ directory :

  - doc/intro.txt for a quick introduction on HAProxy
  - doc/configuration.txt for the configuration's reference manual
  - doc/lua.txt for the Lua's reference manual
  - doc/SPOE.txt for how to use the SPOE engine
  - doc/network-namespaces.txt for how to use network namespaces under Linux
  - doc/management.txt for the management guide
  - doc/regression-testing.txt for how to use the regression testing suite
  - doc/peers.txt for the peers protocol reference
  - doc/coding-style.txt for how to adopt HAProxy's coding style
  - doc/internals for developer-specific documentation (not all up to date)