From patchwork Sat Aug 8 13:07:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10128 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hHLvC4vNwz3wp9 for ; Sat, 08 Aug 2026 13:09:11 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hHLv34JbFz7N3 for ; Sat, 08 Aug 2026 13:09:03 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hHLsM0VfYz378R for ; Sat, 08 Aug 2026 13:07:35 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hHLsJ3Jpgz377H for ; Sat, 08 Aug 2026 13:07:32 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hHLs823n9z5tY; Sat, 08 Aug 2026 13:07:24 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786194444; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Mj81F4retAVzlNbfQoCGQ9KtEa6pILWFJUJrNgwyqWM=; b=IqiUSo0NVaXfrXQyMChUGQzS4/IZ7/1sK6L9rDJ3mj0PdGm2+MVgglFLTrZl3sDAaMjGk7 0usSBug9aZVTx/Cw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786194444; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Mj81F4retAVzlNbfQoCGQ9KtEa6pILWFJUJrNgwyqWM=; b=Czl6Uaa4BEyAu7iZQBfVH93V3PnImGRuuGN5rZw3r5NFHRIy0vAEIRat5haDpTG968lMSc SCtYT+WhPD/Q6k8xN7ppNQJd+exKdkroqNffSHADcKuWN0dH43nzK+7MdW+GDDRSjgSr8l bquZlzcDtfwFHaG4SN5z2QNXmdKlt/DR2I4zzBr6HP1hs38wR03cD0en32yXSxEQFy4rch FdMX1hz27SSITxjR8xlhtQ1j76UoeLSkdGZjwWDkUtzr5oB8Axr4rX2oP8jJGvWVyAluZo ml/vi8PomG3XNqMACJ+Ui4ASPMHiYh3gRgIAFbZMcPU/H+97UBskeA83IdiW/w== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] haproxy: Update to version 3.4.3 Date: Sat, 8 Aug 2026 15:07:05 +0200 Message-ID: <20260808130705.2668733-3-adolf.belka@ipfire.org> In-Reply-To: <20260808130705.2668733-1-adolf.belka@ipfire.org> References: <20260808130705.2668733-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 3.4.2 to 3.4.3 - No change in rootfile - Changelog 3.4.3 This release contains one important fix and a handful of security hardening fixes reported by Red Hat/AISLE Research and others, on top of the usual set of bug fixes. * ssl/ocsp: An issue about missing lock was fixed. The OCSP stapling callback read the cached OCSP response buffer without any lock, while the buffer can be freed and replaced at any moment by a "set ssl ocsp-response" CLI command, the ocsp-update task, or a reload. A concurrent update could either crash the worker (use-after-free) or leak freed/reused heap contents to a remote client requesting the stapled response. The reads are now protected by the existing OCSP tree lock. This was reported and fixes by Matt Suiche from Tolmo Inc. * QUIC/H3 : Three bugs were fixed around QUIC/H3 stream shutdown and error handling. A parser desync could occur when an H3 error was detected in the middle of a multi-frame buffer, causing the caller to remove only part of the data and restart parsing at a wrong offset, which usually produced a new, unrelated error or an unwarranted full connection closure. A QCS instance could also be wrongly freed if a STOP_SENDING was still scheduled for it, most impactful on the backend side where a server could keep emitting data on a stream haproxy already considered closed. Finally, shutting down a stream's read side (e.g. an aborted request) did not always send a STOP_SENDING to the peer, so a server backend could keep sending data for a request haproxy no longer cared about. * fd: A deadlock when closing file descriptors of other thread groups was fixed. Destroying a listener while holding the listener lock could deadlock when it needed to close an fd belonging to another thread group and another thread was waiting on the same listener lock. This was easier to reproduce with a suspend/resume loop on ABNS sockets. The fd is now closed using a reference-counting scheme instead of thread isolation, avoiding the deadlock. * tcpcheck: The internal proxy used to parse "healthcheck" sections was not added to the proxies list, so its initialization was not fully finalized; this notably broke some arguments such as regular expressions and could lead to crashes because of a NULL pointer dereference at runtime. * applet: An issue leading to a stale task expiration date was fixed. When an applet was waiting for a connection (e.g. the Lua Socket applet) and reads were re-enabled once the connection became available, this was usually done from the connection's context, so the applet's task expiration date was not refreshed. With small timeouts this could cause the task to appear scheduled in the past, triggering a BUG_ON() in sc_notify(). This was fixed by moving the changes in the applet's context. Related to this issue, a bug about lua cosockets was fixed. the Lua cosocket timeout being applied on the wrong side. It was applied to both the client and server sides, while it must only apply to the server side. * stats: Two issues about the stats page, reported by Red Hat/AISLE Research, were fixed. Proxies updated through the stats page while in "stats admin" mode were not subject to the "stats scope" filtering, meaning a scope meant to restrict which proxies are visible/actionable could be silently bypassed on POST requests. Separately, POST requests to the stats interface did not validate that the Origin (or Referer) header matched the Host, which is now checked to mitigate CSRF attacks. * cache: A leak preventing the cache from reserving rows under "Vary" was fixed. When a secondary cache entry matching a request with a "Vary" header was still incomplete (being written by another stream), the request was forwarded without reattaching its row to the available list, leaking it. Over a Vary-heavy workload this eventually exhausted the cache and prevented any further row reservation. * ssl-gencert: A memory leak on every certificate generation was fixed. Two temporary buffers were not freed after generating a certificate on the fly, leaking memory each time a new SNI triggered certificate generation. This issue was reported by Red Hat/AISLE Research. * sample/protobuf/net-helper: buffer overflows after pointer-shift converters, reported by Red Hat/AISLE Research and Charles Vosburgh, were fixed. Several converters (protobuf/ungrpc field extraction, eth.data, eth.src, ip.data, bytes(), ltrim()) move the sample's data pointer forward on success but did not shrink the sample's recorded buffer capacity accordingly. A converter chained afterwards that relies on that capacity (e.g. padding via memset()) could then write past the end of the buffer, leading to heap corruption or a worker crash. All the affected converters now adjust the capacity together with the pointer. * protobuf: A nested-path validation bypass reported by Red Hat/AISLE Research was fixed. The protobuf field lookup used for the protobuf()/ungrpc() converters did not strictly enforce hierarchical boundaries, so a flat sibling field could incorrectly satisfy a nested-path lookup (e.g. matching a root-level field as if it were nested under a parent). The lookup was rewritten as a strict, non-recursive path walker that correctly bounds each nesting level. Separately, a crash because of deprecated protobuf group wire types was fixed. These wire types are now explicitly rejected. * proxy/server: Some CLI commands dumping info were not protected against concurrent proxy/server/backend deletion. "show servers conn/state", "show backend" and "show errors" all loop over lists of proxies or servers and may yield in case of a large output; if the entry the dump was paused on got deleted (e.g. via dynamic backend/server removal) in the meantime, the worker could crash on restart. These commands now rely on the existing watcher mechanism, already used by "show stat", to survive concurrent deletion. Separately, the check refusing to delete a server still attached to streams was not exhaustive: two paths (a failed connection attempt still referencing the server, and cookie persistence set very early) were not covered by the existing counters, allowing a server to be deleted while still referenced. A new per-thread-group stream counter now tracks this reliably. * ssl: A kTLS splicing regression and a wrongly typo'd macro were fixed. A wrong macro name (USE_VANILLA_OPENSSL instead of HAVE_VANILLA_OPENSSL) could let kTLS start splicing while data was still pending in OpenSSL's internal buffers, causing data not to be properly read. Separately, when kTLS splicing received a non-application-data record (e.g. a TLSv1.3 KeyUpdate), splicing failed outright instead of falling back to a regular recvmsg() long enough to consume the record and resume splicing afterwards. * mux-h1: The case of header names were not being adjusted on some outgoing messages. When a map was configured to adjust the case of some header names for legacy applications, it was not applied to the low-level error messages generated during th request parsing. And for all other messages, "Sec-Websocket-Key" and "Sec-Websocket-Accept" headers, inserted by the H1 multiplexer, were also concerned. * http-fetch: Two crashes reachable from health-check configurations were fixed. "res.body"/"res.hdr"/... and similar response fetches assumed the health-check receive buffer always held an HTX message, which is only true for actual HTTP checks; on a plain TCP check, a hostile/misbehaving server could craft the first bytes of its reply to be misinterpreted as HTX internal fields, causing a wild read and worker crash (or leaking arbitrary process memory). Separately, "capture.req.hdr"/"capture.res.hdr" only validated the upper bound of their index argument, so a negative capture id was accepted at boot and dereferenced an out-of-bounds array entry at runtime, crashing the worker on the very first request. * tools: Converter to encode URLs was fixed to avoid silent truncation. encode_chunk(), used among others by the url_enc converter and OCSP encoding, used to silently truncate its output when the destination was too small, which could produce a partially-encoded URL. It can now fail explicitly instead; the url_enc converter and OCSP code were updated accordingly. * slz: Several issues were fixed in the SLZ library. A stream alternating many literals in the 144-255 range with cheap back-references could keep inflating indefinitely instead of falling back to a stored block, exceeding the library's documented worst-case output size by several percent. A new accounting mechanism now bounds this overhead. Practical impact on haproxy requires tune.bufsize above ~43 kB with the default reserve. Five small correctness fixes inherited from upstream libslz were also backported: Avoid reading up to a few bytes past the end of very short inputs on architectures without fast unaligned access; stop appending an extra, misplaced block to an already-finished deflate/gzip/zlib stream (which could corrupt the trailing checksum in ~2% of fuzzed streams); fix the Adler32 checksum accumulator sign handling on 32-bit systems (affecting the zlib format only); avoid an undefined-behaviour signed left shift when assembling input words byte by byte; and use the exact bit cost when deciding whether to emit the last literals of a block as a stored block, avoiding compressed output slightly larger than the documented worst case. * peers: A heap overflow when replicating large stick-table dictionary entries was fixed. peer_prepare_updatemsg() never verified that a stick-table entry's dictionary value (e.g. server_key, up to ~16 kB) actually fit in the update message being built. Since the peers protocol is plain-text and unauthenticated, a rogue or compromised peer could plant an oversized entry that overflows the 16 kB trash buffer as soon as the victim replicates ("teaches") it, confirmed as a heap-buffer-overflow write. The function now checks the available room before encoding and fails clea nly if it doesn't fit. This was reported and fixes by Matt Suiche from Tolmo Inc. * chunk: The code was reviewed to avoid retrieving a large trash buffer by mistake. All call sites of the trash-chunk allocation helpers were reviewed to make sure a large buffer is only handed out when the caller's own buffer is already large and genuinely needs it, preventing unexpected extra memory usage. Several call sites were switched to the new get_best_trash_chunk()/alloc_best_trash_chunk() helpers. * resolvers: Possible conflicts between the internal backend used for the "default" resolvers sections and regular backends with the same name were fixed. Since a "default" resolvers section is now created automatically, a same-named internal TCP backend proxy also appeared, and a config using "default_backend default" could either fail with a confusing "mode" error or silently route real traffic to the internal resolvers backend. Resolvers no longer need to be looked up by name in the proxies index, so they are no longer indexed there. Fixes GitHub issue #3445. * server-template: Duplicated entries created from a "server-template" line did not properly inherit several settings that are only initialized once for the base line by srv_settings_init(). The field, used to select an alternative protocol such as MPTCP, was not copied to server-template duplicates, resulting in the wrong protocol being selected on connect. The "check-reuse-pool" flag, forcefully enabled for rHTTP servers, was not propagated either, causing health checks to always fail on rHTTP server-template entries. And the QUIC transport was never set up for these duplicates at all, since it was only performed in _srv_parse_init(), preventing any QUIC communication on server-template entries with a quic4/6 address. All three settings are now properly duplicated/initialized in srv_settings_cpy(), or moved to a callback that also runs for duplicates. A related improvement makes parsing error messages usable for server-template lines, which used to show "server-template be/(null)" instead of the template's name. * cebtree: A bug in the duplicate-key detection of the lookup shortcut was fixed. It could make a lookup return the wrong entry among a list of duplicates, or make the walk to the previous/next duplicate fail to find it, as soon as the tree was deep enough to enter the shortcut path. This affects the cebis_tree used since 3.3 to index server names (conf.name), where it could sometimes let a duplicate server name go undetected. And, as usual, the bunch of minor fixes here and there, mainly raised during AI-assisted code reviews. Most were never noticed: * HTX API: Some bugs about how the HTX API was used were fixed here and there. * http-act: Double-frees and a couple of state bugs on parsing errors were fixed. * http-fetch/http/http-ana/http-htx: Few out-of-bounds reads and a missing NULL/allocation check were fixed. * h1: The right error offset is now reported for an authority/Host mismatch when "accept-unsafe-violations-in-http-request" option is enabled * http-conv: The last input character could be lost when calling url-dec converter, when the input buffer was full. This was fixed by failing the converter in that case. * http-rules: A crash on error path when parsing "set-cookie-fmt" redirect rule was fixed. * mux-h1: An extra 200ms delay was observed on some H2-to-H1 messages because the end of the message was not always properly detected. This case is now properly handled. * sample: Two edge cases in be2hex() and bytes() were fixed. * shctx: An issue in the shctx was fixed. This notably broke revalidation of cached responses whose ETag was stored beyond the first block, causing a full 200 response to be served instead of a 304. * ssl: "show ssl sni -f " command was silently falling back to the first proxy when the given frontend did not exist. An error is now reported. * stream: Custom per-request timeouts/retries set on listeners via "set-timeout" and "set-retries" action are now preserved, except when the stream is routed to a diffent backend. The configuration manual was updated to document this case. Otherwise, two changes were backported: * htx: To avoid trouble with large buffers, it is no longer possible to handle HTTP headers exceeding the size of a regular buffer. It is mandatory to avoid interoperability issues with H2 and H3. * ssl: tune.ssl.keyupdate-rate-limit global directive was added to mitigate costly TLSv1.3 KeyUpdate floods. Processing a TLSv1.3 KeyUpdate is CPU-expensive and there is normally little reason to receive many of them. This new tunable caps the number of KeyUpdates accepted per second (default 100, 0 disables the limit). Signed-off-by: Adolf Belka --- lfs/haproxy | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/haproxy b/lfs/haproxy index 8004ef479..030219275 100644 --- a/lfs/haproxy +++ b/lfs/haproxy @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = The Reliable, High Performance TCP/HTTP Load Balancer -VER = 3.4.2 +VER = 3.4.3 # From: https://www.haproxy.org/download/ @@ -36,7 +36,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = haproxy -PAK_VER = 35 +PAK_VER = 36 DEPS = @@ -54,7 +54,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a6f5c1d84d2c0082fd40792edbf97477499703c062b58de794db874bcab9f62b2df792c3fbde88196f8c7412d0d5b8cbbe0e38197caa817cac071cad3bab1e9a +$(DL_FILE)_BLAKE2 = 75e8edf463e1e9a53a17aee51ef5995c800fe8e1bc043bb08aee55eb528b937f382f2488a8c7e155bbe5fad979c268cbc427d9317ef2bc9ac117940e7ac5bdd0 install : $(TARGET)