From e14c8a0cca36793e92e6e0e2af9964cec916a589 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Mar 05 2015 13:29:16 +0000
Subject: import haproxy-1.5.4-2.el7


---

diff --git a/.gitignore b/.gitignore
index 32d3ce3..bd5626b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/haproxy-1.5.2.tar.gz
+SOURCES/haproxy-1.5.4.tar.gz
diff --git a/.haproxy.metadata b/.haproxy.metadata
index b5c9af9..1918205 100644
--- a/.haproxy.metadata
+++ b/.haproxy.metadata
@@ -1 +1 @@
-d8668cbbf58524a6b4c6f5c434cc76b531235c8e SOURCES/haproxy-1.5.2.tar.gz
+3387f1038128fb3291fff8be9b94808e32cc0f8d SOURCES/haproxy-1.5.4.tar.gz
diff --git a/SOURCES/halog-unused-variables.patch b/SOURCES/halog-unused-variables.patch
index a00e616..37b66ea 100644
--- a/SOURCES/halog-unused-variables.patch
+++ b/SOURCES/halog-unused-variables.patch
@@ -1,5 +1,5 @@
---- contrib/halog/halog.c.orig	2014-06-27 14:22:26.464296394 -0500
-+++ contrib/halog/halog.c	2014-06-27 14:23:07.915599498 -0500
+--- contrib/halog/halog.c.orig	2014-07-25 01:56:07.000000000 -0500
++++ contrib/halog/halog.c	2014-07-25 15:24:56.996876765 -0500
 @@ -462,7 +462,7 @@ int convert_date(const char *field)
  {
  	unsigned int h, m, s, ms;
diff --git a/SOURCES/halog.1 b/SOURCES/halog.1
new file mode 100644
index 0000000..39a9711
--- /dev/null
+++ b/SOURCES/halog.1
@@ -0,0 +1,108 @@
+.TH HALOG "1" "July 2013" "halog" "User Commands"
+.SH NAME
+halog \- HAProxy log statistics reporter
+.SH SYNOPSIS
+.B halog
+[\fI-h|--help\fR]
+.br
+.B halog
+[\fIoptions\fR] <LOGFILE
+.SH DESCRIPTION
+.B halog
+reads HAProxy log data from stdin and extracts and displays lines matching
+user-specified criteria.
+.SH OPTIONS
+.SS Input filters \fR(several filters may be combined)
+.TP
+\fB\-H\fR
+Only match lines containing HTTP logs (ignore TCP)
+.TP
+\fB\-E\fR
+Only match lines without any error (no 5xx status)
+.TP
+\fB\-e\fR
+Only match lines with errors (status 5xx or negative)
+.TP
+\fB\-rt\fR|\fB\-RT\fR <time>
+Only match response times larger|smaller than <time>
+.TP
+\fB\-Q\fR|\fB\-QS\fR
+Only match queued requests (any queue|server queue)
+.TP
+\fB\-tcn\fR|\fB\-TCN\fR <code>
+Only match requests with/without termination code <code>
+.TP
+\fB\-hs\fR|\fB\-HS\fR <[min][:][max]>
+Only match requests with HTTP status codes within/not within min..max. Any of
+them may be omitted. Exact code is checked for if no ':' is specified.
+.SS
+Modifiers
+.TP
+\fB\-v\fR
+Invert the input filtering condition
+.TP
+\fB\-q\fR
+Don't report errors/warnings
+.TP
+\fB\-m\fR <lines>
+Limit output to the first <lines> lines
+.SS
+Output filters \fR\- only one may be used at a time
+.TP
+\fB\-c\fR
+Only report the number of lines that would have been printed
+.TP
+\fB\-pct\fR
+Output connect and response times percentiles
+.TP
+\fB\-st\fR
+Output number of requests per HTTP status code
+.TP
+\fB\-cc\fR
+Output number of requests per cookie code (2 chars)
+.TP
+\fB\-tc\fR
+Output number of requests per termination code (2 chars)
+.TP
+\fB\-srv\fR
+Output statistics per server (time, requests, errors)
+.TP
+\fB\-u\fR*
+Output statistics per URL (time, requests, errors)
+.br
+Additional characters indicate the output sorting key:
+.RS
+.TP
+\fB\-u\fR
+URL
+.TP
+\fB\-uc\fR
+Request count
+.TP
+\fB\-ue\fR
+Error count
+.TP
+\fB\-ua\fR
+Average response time
+.TP
+\fB\-ut\fR
+Average total time
+.TP
+\fB\-uao\fR, \fB\-uto\fR
+Average times computed on valid ('OK') requests
+.TP
+\fB\-uba\fR
+Average bytes returned
+.TP
+\fB\-ubt\fR
+Total bytes returned
+.RE
+.SH "SEE ALSO"
+.BR haproxy (1)
+.SH AUTHOR
+.PP
+\fBhalog\fR was written by Willy Tarreau <w@1wt.eu> and is part of \fBhaproxy\fR(1).
+.PP
+This  manual page was written by Apollon Oikonomopoulos <apoikos@gmail.com> for the Debian project (but may
+be used by others).
+
diff --git a/SOURCES/haproxy-dont-update-msg-sov.patch b/SOURCES/haproxy-dont-update-msg-sov.patch
deleted file mode 100644
index 098073a..0000000
--- a/SOURCES/haproxy-dont-update-msg-sov.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From b4d05093bc89f71377230228007e69a1434c1a0c Mon Sep 17 00:00:00 2001
-From: Willy Tarreau <w@1wt.eu>
-Date: Mon, 1 Sep 2014 20:35:55 +0200
-Subject: [PATCH] BUG/CRITICAL: http: don't update msg->sov once data start to
- leave the buffer
-
-Commit bb2e669 ("BUG/MAJOR: http: correctly rewind the request body
-after start of forwarding") was incorrect/incomplete. It used to rely on
-CF_READ_ATTACHED to stop updating msg->sov once data start to leave the
-buffer, but this is unreliable because since commit a6eebb3 ("[BUG]
-session: clear BF_READ_ATTACHED before next I/O") merged in 1.5-dev1,
-this flag is only ephemeral and is cleared once all analysers have
-seen it. So we can start updating msg->sov again each time we pass
-through this place with new data. With a sufficiently large amount of
-data, it is possible to make msg->sov wrap and validate the if()
-condition at the top, causing the buffer to advance by about 2GB and
-crash the process.
-
-Note that the offset cannot be controlled by the attacker because it is
-a sum of millions of small random sizes depending on how many bytes were
-read by the server and how many were left in the buffer, only because
-of the speed difference between reading and writing. Also, nothing is
-written, the invalid pointer resulting from this operation is only read.
-
-Many thanks to James Dempsey for reporting this bug and to Chris Forbes for
-narrowing down the faulty area enough to make its root cause analysable.
-
-This fix must be backported to haproxy 1.5.
-(cherry picked from commit a2d002aeb669a9bbca2dcd3e6be71615f435e9e6)
----
- include/types/channel.h | 2 +-
- src/proto_http.c        | 8 ++++----
- src/stream_interface.c  | 4 ++--
- 3 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/include/types/channel.h b/include/types/channel.h
-index 88a52a4..8bc3958 100644
---- a/include/types/channel.h
-+++ b/include/types/channel.h
-@@ -105,7 +105,7 @@
- #define CF_STREAMER       0x00010000  /* the producer is identified as streaming data */
- #define CF_STREAMER_FAST  0x00020000  /* the consumer seems to eat the stream very fast */
- 
--/* unused: 0x00040000 */
-+#define CF_WROTE_DATA     0x00040000  /* some data were sent from this buffer */
- #define CF_ANA_TIMEOUT    0x00080000  /* the analyser timeout has expired */
- #define CF_READ_ATTACHED  0x00100000  /* the read side is attached for the first time */
- #define CF_KERN_SPLICING  0x00200000  /* kernel splicing desired for this channel */
-diff --git a/src/proto_http.c b/src/proto_http.c
-index a47f0a1..4d27b2c 100644
---- a/src/proto_http.c
-+++ b/src/proto_http.c
-@@ -4886,8 +4886,8 @@ void http_end_txn_clean_session(struct session *s)
- 	s->req->cons->conn_retries = 0;  /* used for logging too */
- 	s->req->cons->exp       = TICK_ETERNITY;
- 	s->req->cons->flags    &= SI_FL_DONT_WAKE; /* we're in the context of process_session */
--	s->req->flags &= ~(CF_SHUTW|CF_SHUTW_NOW|CF_AUTO_CONNECT|CF_WRITE_ERROR|CF_STREAMER|CF_STREAMER_FAST|CF_NEVER_WAIT|CF_WAKE_CONNECT);
--	s->rep->flags &= ~(CF_SHUTR|CF_SHUTR_NOW|CF_READ_ATTACHED|CF_READ_ERROR|CF_READ_NOEXP|CF_STREAMER|CF_STREAMER_FAST|CF_WRITE_PARTIAL|CF_NEVER_WAIT);
-+	s->req->flags &= ~(CF_SHUTW|CF_SHUTW_NOW|CF_AUTO_CONNECT|CF_WRITE_ERROR|CF_STREAMER|CF_STREAMER_FAST|CF_NEVER_WAIT|CF_WAKE_CONNECT|CF_WROTE_DATA);
-+	s->rep->flags &= ~(CF_SHUTR|CF_SHUTR_NOW|CF_READ_ATTACHED|CF_READ_ERROR|CF_READ_NOEXP|CF_STREAMER|CF_STREAMER_FAST|CF_WRITE_PARTIAL|CF_NEVER_WAIT|CF_WROTE_DATA);
- 	s->flags &= ~(SN_DIRECT|SN_ASSIGNED|SN_ADDR_SET|SN_BE_ASSIGNED|SN_FORCE_PRST|SN_IGNORE_PRST);
- 	s->flags &= ~(SN_CURR_SESS|SN_REDIRECTABLE|SN_SRV_REUSED);
- 
-@@ -5430,7 +5430,7 @@ int http_request_forward_body(struct session *s, struct channel *req, int an_bit
- 			 * such as last chunk of data or trailers.
- 			 */
- 			b_adv(req->buf, msg->next);
--			if (unlikely(!(s->rep->flags & CF_READ_ATTACHED)))
-+			if (unlikely(!(s->req->flags & CF_WROTE_DATA)))
- 				msg->sov -= msg->next;
- 			msg->next = 0;
- 
-@@ -5482,7 +5482,7 @@ int http_request_forward_body(struct session *s, struct channel *req, int an_bit
-  missing_data:
- 	/* we may have some pending data starting at req->buf->p */
- 	b_adv(req->buf, msg->next);
--	if (unlikely(!(s->rep->flags & CF_READ_ATTACHED)))
-+	if (unlikely(!(s->req->flags & CF_WROTE_DATA)))
- 		msg->sov -= msg->next + MIN(msg->chunk_len, req->buf->i);
- 
- 	msg->next = 0;
-diff --git a/src/stream_interface.c b/src/stream_interface.c
-index 67a5234..9f7e979 100644
---- a/src/stream_interface.c
-+++ b/src/stream_interface.c
-@@ -658,7 +658,7 @@ static void si_conn_send(struct connection *conn)
- 	if (chn->pipe && conn->xprt->snd_pipe) {
- 		ret = conn->xprt->snd_pipe(conn, chn->pipe);
- 		if (ret > 0)
--			chn->flags |= CF_WRITE_PARTIAL;
-+			chn->flags |= CF_WRITE_PARTIAL | CF_WROTE_DATA;
- 
- 		if (!chn->pipe->data) {
- 			put_pipe(chn->pipe);
-@@ -702,7 +702,7 @@ static void si_conn_send(struct connection *conn)
- 
- 		ret = conn->xprt->snd_buf(conn, chn->buf, send_flag);
- 		if (ret > 0) {
--			chn->flags |= CF_WRITE_PARTIAL;
-+			chn->flags |= CF_WRITE_PARTIAL | CF_WROTE_DATA;
- 
- 			if (!chn->buf->o) {
- 				/* Always clear both flags once everything has been sent, they're one-shot */
--- 
-1.9.3
-
diff --git a/SOURCES/iprange-return-type.patch b/SOURCES/iprange-return-type.patch
new file mode 100644
index 0000000..f330f7a
--- /dev/null
+++ b/SOURCES/iprange-return-type.patch
@@ -0,0 +1,17 @@
+--- contrib/iprange/iprange.c.orig	2014-06-27 14:01:26.020159479 -0500
++++ contrib/iprange/iprange.c	2014-06-27 14:01:42.149275554 -0500
+@@ -111,7 +111,7 @@ static void usage(const char *argv0)
+ 		"\n", argv0);
+ }
+ 
+-main(int argc, char **argv)
++int main(int argc, char **argv)
+ {
+ 	char line[MAXLINE];
+ 	int l, lnum;
+@@ -198,4 +198,5 @@ main(int argc, char **argv)
+ 			convert_range(sa, da, he, NULL);
+ 		}
+ 	}
++	exit(0);
+ }
diff --git a/SPECS/haproxy.spec b/SPECS/haproxy.spec
index 20c2e60..dc987c6 100644
--- a/SPECS/haproxy.spec
+++ b/SPECS/haproxy.spec
@@ -7,21 +7,22 @@
 %global _hardened_build 1
 
 Name:           haproxy
-Version:        1.5.2
-Release:        3%{?dist}
-Summary:        HA-Proxy is a TCP/HTTP reverse proxy for high availability environments
+Version:        1.5.4
+Release:        2%{?dist}
+Summary:        TCP/HTTP proxy and load balancer for high availability environments
 
 Group:          System Environment/Daemons
 License:        GPLv2+
 
-URL:            http://haproxy.1wt.eu/
-Source0:        http://haproxy.1wt.eu/download/1.5/src/haproxy-%{version}.tar.gz
+URL:            http://www.haproxy.org/
+Source0:        http://www.haproxy.org/download/1.5/src/haproxy-%{version}.tar.gz
 Source1:        %{name}.service
 Source2:        %{name}.cfg
 Source3:        %{name}.logrotate
+Source4:        halog.1
 
 Patch0:         halog-unused-variables.patch
-Patch1:         haproxy-dont-update-msg-sov.patch
+Patch1:         iprange-return-type.patch
 
 BuildRequires:  pcre-devel
 BuildRequires:  zlib-devel
@@ -34,124 +35,135 @@ Requires(preun):    systemd
 Requires(postun):   systemd
 
 %description
-HA-Proxy is a TCP/HTTP reverse proxy which is particularly suited for high
+HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high
 availability environments. Indeed, it can:
-- route HTTP requests depending on statically assigned cookies
-- spread the load among several servers while assuring server persistence
-  through the use of HTTP cookies
-- switch to backup servers in the event a main one fails
-- accept connections to special ports dedicated to service monitoring
-- stop accepting connections without breaking existing ones
-- add/modify/delete HTTP headers both ways
-- block requests matching a particular pattern
-
+ - route HTTP requests depending on statically assigned cookies
+ - spread load among several servers while assuring server persistence
+   through the use of HTTP cookies
+ - switch to backup servers in the event a main server fails
+ - accept connections to special ports dedicated to service monitoring
+ - stop accepting connections without breaking existing ones
+ - add, modify, and delete HTTP headers in both directions
+ - block requests matching particular patterns
+ - report detailed status to authenticated users from a URI
+   intercepted by the application
 
 %prep
 %setup -q
 %patch0 -p0
-%patch1 -p1
+%patch1 -p0
 
 %build
-# No configure script is present, it is all done via make flags
-# Kernels of Fedora 11 and up and EL 6 and up are newer than 2.6.28,
-# so using linux2628 as target.
-
-# Recommended optimization option for x86 builds
 regparm_opts=
 %ifarch %ix86 x86_64
 regparm_opts="USE_REGPARM=1"
 %endif
 
-make %{?_smp_mflags} CPU="generic" TARGET="linux2628" USE_OPENSSL=1 USE_PCRE=1 USE_ZLIB=1 ${regparm_opts} ADDINC="%{optflags}" USE_LINUX_TPROXY=1 ADDLIB="%{__global_ldflags}"
+%{__make} %{?_smp_mflags} CPU="generic" TARGET="linux2628" USE_OPENSSL=1 USE_PCRE=1 USE_ZLIB=1 ${regparm_opts} ADDINC="%{optflags}" USE_LINUX_TPROXY=1 ADDLIB="%{__global_ldflags}"
 
-# build the halog contrib program.
 pushd contrib/halog
-make ${halog} OPTIMIZE="%{optflags}"
+%{__make} halog OPTIMIZE="%{optflags}"
+popd
+
+pushd contrib/iprange
+%{__make} iprange OPTIMIZE="%{optflags}"
 popd
 
 %install
-make install-bin DESTDIR=%{buildroot} PREFIX=%{_prefix}
-make install-man DESTDIR=%{buildroot} PREFIX=%{_prefix}
+%{__make} install-bin DESTDIR=%{buildroot} PREFIX=%{_prefix}
+%{__make} install-man DESTDIR=%{buildroot} PREFIX=%{_prefix}
 
 %{__install} -p -D -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/%{name}.service
 %{__install} -p -D -m 0644 %{SOURCE2} %{buildroot}%{haproxy_confdir}/%{name}.cfg
 %{__install} -p -D -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/%{name}
+%{__install} -p -D -m 0644 %{SOURCE4} %{buildroot}%{_mandir}/man1/halog.1
 %{__install} -d -m 0755 %{buildroot}%{haproxy_home}
 %{__install} -d -m 0755 %{buildroot}%{haproxy_datadir}
 %{__install} -d -m 0755 %{buildroot}%{_bindir}
 %{__install} -p -m 0755 ./contrib/halog/halog %{buildroot}%{_bindir}/halog
+%{__install} -p -m 0755 ./contrib/iprange/iprange %{buildroot}%{_bindir}/iprange
+%{__install} -p -m 0644 ./examples/errorfiles/* %{buildroot}%{haproxy_datadir}
 
-for httpfile in $(find ./examples/errorfiles/ -type f) 
+for httpfile in $(find ./examples/errorfiles/ -type f)
 do
     %{__install} -p -m 0644 $httpfile %{buildroot}%{haproxy_datadir}
 done
 
-# convert all text files to utf8
-for textfile in $(find ./ -type f -name '*.txt')
+%{__rm} -rf ./examples/errorfiles/
+
+find ./examples/* -type f ! -name "*.cfg" -exec %{__rm} -f "{}" \;
+
+for textfile in $(find ./ -type f -name "*.txt" -o -name README)
 do
-    mv $textfile $textfile.old
+    %{__mv} $textfile $textfile.old
     iconv --from-code ISO8859-1 --to-code UTF-8 --output $textfile $textfile.old
-    rm -f $textfile.old
+    %{__rm} -f $textfile.old
 done
 
-
 %pre
-getent group %{haproxy_group} >/dev/null || groupadd \
-    -g 188 -r %{haproxy_group}
-getent passwd %{haproxy_user} >/dev/null || useradd \
-    -u 188 -r -g %{haproxy_group} -d %{haproxy_home} \
-    -s /sbin/nologin -c "haproxy" %{haproxy_user}
+getent group %{haproxy_group} >/dev/null || \
+       groupadd -g 188 -r %{haproxy_group}
+getent passwd %{haproxy_user} >/dev/null || \
+       useradd -u 188 -r -g %{haproxy_group} -d %{haproxy_home} \
+       -s /sbin/nologin -c "haproxy" %{haproxy_user}
 exit 0
 
-
 %post
 %systemd_post %{name}.service
 
-
 %preun
 %systemd_preun %{name}.service
 
-
 %postun
 %systemd_postun_with_restart %{name}.service
 
-
 %files
-%doc doc/*
-%doc examples/url-switching.cfg
-%doc examples/acl-content-sw.cfg
-%doc examples/content-sw-sample.cfg
-%doc examples/cttproxy-src.cfg
-%doc examples/haproxy.cfg
-%doc examples/tarpit.cfg
-%doc CHANGELOG LICENSE README
+%defattr(-,root,root,-)
+%doc doc/* examples/
+%doc CHANGELOG LICENSE README ROADMAP VERSION
+%dir %{haproxy_confdir}
 %dir %{haproxy_datadir}
 %{haproxy_datadir}/*
-%dir %{haproxy_confdir}
 %config(noreplace) %{haproxy_confdir}/%{name}.cfg
 %config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
 %{_unitdir}/%{name}.service
 %{_sbindir}/%{name}
 %{_sbindir}/%{name}-systemd-wrapper
 %{_bindir}/halog
-%{_mandir}/man1/%{name}.1.gz
+%{_bindir}/iprange
+%{_mandir}/man1/*
 %attr(-,%{haproxy_user},%{haproxy_group}) %dir %{haproxy_home}
 
 %changelog
-* Thu Sep 04 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.2-3
-- Fix remote client denial of service vulnerability (#1138191)
+* Tue Nov 18 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.4-2
+- Fix date in changelog
+
+* Tue Sep 02 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.4-1
+- Update to stable release 1.5.4 (#1111714)
+
+* Fri Jul 25 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.3-1
+- Update to stable release 1.5.3 (#1111714)
+
+* Tue Jul 15 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.2-1
+- Update to stable release 1.5.2 (#1111714)
+
+* Tue Jul 08 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.1-6
+- Cleanup spec file (#1068642)
+
+* Tue Jul 08 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.1-5
+- Minor changes to summary and description (#1067146)
 
-* Thu Jul 31 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.2-2
-- Bump release number (#1120228)
+* Tue Jul 08 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.1-4
+- Include iprange tool (#1078487)
 
-* Thu Jul 17 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.2-1
-- Update to stable release 1.5.2 (#1120228)
+* Tue Jul 08 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.1-3
+- Include man page for halog (#1078461)
 
-* Tue Jul 17 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.1-2
-- Build with openssl and zlib (#1120673)
+* Tue Jul 08 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.1-2
+- Build with openssl and zlib (#1112184)
 
-* Thu Jul 17 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.1-1
-- Update to stable release 1.5.1 (#1120228)
+* Tue Jul 08 2014 Ryan O'Hara <rohara@redhat.com> - 1.5.1-1
+- Update to stable release 1.5.1 (#1111714)
 
 * Fri Feb 28 2014 Ryan O'Hara <rohara@redhat.com> - 1.5-0.3.dev22
 - Use haproxy-systemd-wrapper in service file (#1067060)
@@ -269,7 +281,7 @@ exit 0
 - remove upstream patches, they are now part of source distribution
 
 * Sat Nov 22 2008 Jeremy Hinegardner <jeremy at hinegardner dot org> - 1.3.15.6-2
-- apply upstream patches 
+- apply upstream patches
 
 * Sat Nov 15 2008 Jeremy Hinegardner <jeremy at hinegardner dot org> - 1.3.15.6-1
 - update to 1.3.15.6