[Pound/epel7] Rebase the GoodData patches
Lubomir Rintel
lkundrak at fedoraproject.org
Fri Oct 24 14:27:54 UTC 2014
commit bca4e881b1a788a289d97c799cf6edbe5e6d7b48
Author: Lubomir Rintel <lkundrak at v3.sk>
Date: Fri Oct 24 16:27:33 2014 +0200
Rebase the GoodData patches
.gitignore | 1 +
...-Signal-an-error-if-a-terminating-chunk-i.patch | 8 ++--
...-Do-not-return-NULL-data-from-get_thr_arg.patch | 6 +-
...eaders-to-the-backend-as-soon-as-they-are.patch | 15 ++++---
...e-period-option-wait-for-all-worker-threa.patch | 29 +++++++------
...load-configuration-on-SIGHUP-SIGINT-witho.patch | 33 ++++++++-------
Pound.spec | 44 ++++++++++++++-----
sources | 2 +-
8 files changed, 83 insertions(+), 55 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index 6fdb0e2..ea667d7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@ Pound-2.5.tgz
/Pound-2.6.tgz
/Pound-2.7b.tgz
/Pound-2.7c.tgz
+/Pound-2.7d.tgz
diff --git a/0001-copy_chunks-Signal-an-error-if-a-terminating-chunk-i.patch b/0001-copy_chunks-Signal-an-error-if-a-terminating-chunk-i.patch
index a2de118..84b37bc 100644
--- a/0001-copy_chunks-Signal-an-error-if-a-terminating-chunk-i.patch
+++ b/0001-copy_chunks-Signal-an-error-if-a-terminating-chunk-i.patch
@@ -1,7 +1,7 @@
-From 10d15bb63b86931e4668a9b12ac8ad7bc7a7bbbe Mon Sep 17 00:00:00 2001
+From 1e667d0636f065cb7d569852d1ddd58c935082fc Mon Sep 17 00:00:00 2001
From: Lubomir Rintel <lubo.rintel at gooddata.com>
Date: Wed, 23 Apr 2014 15:44:37 +0200
-Subject: [PATCH] copy_chunks: Signal an error if a terminating chunk is
+Subject: [PATCH 1/5] copy_chunks: Signal an error if a terminating chunk is
missing
This means that the client disconnected abruptly, without completing the
@@ -16,7 +16,7 @@ client to hit and run, wasting a backend connection while disconnecting his one
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/http.c b/http.c
-index 5076872..f4f3bea 100755
+index dfb10e5..d6196cb 100644
--- a/http.c
+++ b/http.c
@@ -184,13 +184,19 @@ copy_chunks(BIO *const cl, BIO *const be, LONG *res_bytes, const int no_write, c
@@ -42,5 +42,5 @@ index 5076872..f4f3bea 100755
cont = STRTOL(buf, NULL, 16);
else {
--
-1.8.3.1
+1.9.3
diff --git a/0001-Do-not-return-NULL-data-from-get_thr_arg.patch b/0002-Do-not-return-NULL-data-from-get_thr_arg.patch
similarity index 82%
rename from 0001-Do-not-return-NULL-data-from-get_thr_arg.patch
rename to 0002-Do-not-return-NULL-data-from-get_thr_arg.patch
index 7f8ec82..b0229e8 100644
--- a/0001-Do-not-return-NULL-data-from-get_thr_arg.patch
+++ b/0002-Do-not-return-NULL-data-from-get_thr_arg.patch
@@ -1,7 +1,7 @@
-From 2d25c2a5a16076339c35ba7541ded5007854931b Mon Sep 17 00:00:00 2001
+From 860b11af3e47dd3e0c2a8a07d2c2bcf5983295a2 Mon Sep 17 00:00:00 2001
From: Miroslav Spousta <miroslav.spousta at gooddata.com>
Date: Sat, 8 Jun 2013 22:34:13 +0200
-Subject: [PATCH 1/3] Do not return NULL data from get_thr_arg
+Subject: [PATCH 2/5] Do not return NULL data from get_thr_arg
get_thr_arg() always waits for non-NULL argument. It prevents "NULL
get_thr_arg" log message.
@@ -23,5 +23,5 @@ index 3643f70..42a869d 100644
if((res = first) != NULL)
if((first = first->next) == NULL)
--
-1.8.3.1
+1.9.3
diff --git a/0001-Flush-the-headers-to-the-backend-as-soon-as-they-are.patch b/0003-Flush-the-headers-to-the-backend-as-soon-as-they-are.patch
similarity index 81%
rename from 0001-Flush-the-headers-to-the-backend-as-soon-as-they-are.patch
rename to 0003-Flush-the-headers-to-the-backend-as-soon-as-they-are.patch
index 73134e1..ba391c3 100644
--- a/0001-Flush-the-headers-to-the-backend-as-soon-as-they-are.patch
+++ b/0003-Flush-the-headers-to-the-backend-as-soon-as-they-are.patch
@@ -1,7 +1,8 @@
-From 413b3ca3dd56ca174b4dc732793584ed1e5db9ba Mon Sep 17 00:00:00 2001
+From a03456de5ddbf798a89ee1aef39325ff0c45da83 Mon Sep 17 00:00:00 2001
From: Lubomir Rintel <lubo.rintel at gooddata.com>
Date: Wed, 21 Mar 2012 12:46:07 +0100
-Subject: [PATCH] Flush the headers to the backend as soon as they are received
+Subject: [PATCH 3/5] Flush the headers to the backend as soon as they are
+ received
No need to wait and backend can process them as we read body potentially
slightly increasing performance. Also, if this is a new connection and backend
@@ -9,14 +10,14 @@ has aggressive first-byte timeout (such as Varnish in default configuration),
this will prevent the backend from time-ing out when a client has a long delay
between headers and body (as is customary for busy Internet Exporer <= 8).
---
- http.c | 12 ++++++++++++
- 1 files changed, 12 insertions(+), 0 deletions(-)
+ http.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
diff --git a/http.c b/http.c
-index bb2ce8b..8ce704a 100755
+index d6196cb..9f8c87d 100644
--- a/http.c
+++ b/http.c
-@@ -1103,6 +1103,18 @@ do_http(thr_arg *arg)
+@@ -1164,6 +1164,18 @@ do_http(thr_arg *arg)
BIO_puts(be, "\r\n");
}
@@ -36,5 +37,5 @@ index bb2ce8b..8ce704a 100755
/* had Transfer-encoding: chunked so read/write all the chunks (HTTP/1.1 only) */
if(copy_chunks(cl, be, NULL, cur_backend->be_type, lstn->max_req)) {
--
-1.7.1
+1.9.3
diff --git a/0002-Remove-Grace-period-option-wait-for-all-worker-threa.patch b/0004-Remove-Grace-period-option-wait-for-all-worker-threa.patch
similarity index 92%
rename from 0002-Remove-Grace-period-option-wait-for-all-worker-threa.patch
rename to 0004-Remove-Grace-period-option-wait-for-all-worker-threa.patch
index 167f44a..acca4be 100644
--- a/0002-Remove-Grace-period-option-wait-for-all-worker-threa.patch
+++ b/0004-Remove-Grace-period-option-wait-for-all-worker-threa.patch
@@ -1,7 +1,7 @@
-From cb410bbe77e366571df1144851d95b52de5a5c1b Mon Sep 17 00:00:00 2001
+From 2ddbba545040235c3cd6bb72a27f3452ef681498 Mon Sep 17 00:00:00 2001
From: Miroslav Spousta <miroslav.spousta at gooddata.com>
Date: Sun, 9 Jun 2013 23:12:39 +0200
-Subject: [PATCH 2/3] Remove Grace period option, wait for all worker threads
+Subject: [PATCH 4/5] Remove Grace period option, wait for all worker threads
to finish
When worker is required to shut down (by SIGHUP/SIGINT), it waits for all busy
@@ -18,23 +18,24 @@ on exit.
mode change 100644 => 100755 config.c
mode change 100644 => 100755 pound.8
mode change 100644 => 100755 pound.c
+ mode change 100644 => 100755 pound.h
diff --git a/config.c b/config.c
old mode 100644
new mode 100755
-index 077fa60..c39be84
+index ca70443..30037c9
--- a/config.c
+++ b/config.c
@@ -79,7 +79,7 @@ static regex_t Err414, Err500, Err501, Err503, MaxRequest, HeadRemove, RewriteL
static regex_t Service, ServiceName, URL, HeadRequire, HeadDeny, BackEnd, Emergency, Priority, HAport, HAportAddr;
static regex_t Redirect, RedirectN, TimeOut, Session, Type, TTL, ID, DynScale;
- static regex_t ClientCert, AddHeader, DisableSSLv2, SSLAllowClientRenegotiation, SSLHonorCipherOrder, Ciphers;
--static regex_t CAlist, VerifyList, CRLlist, NoHTTPS11, Grace, Include, ConnTO, IgnoreCase, HTTPS, HTTPSCert;
-+static regex_t CAlist, VerifyList, CRLlist, NoHTTPS11, Include, ConnTO, IgnoreCase, HTTPS, HTTPSCert;
+ static regex_t ClientCert, AddHeader, DisableProto, SSLAllowClientRenegotiation, SSLHonorCipherOrder, Ciphers;
+-static regex_t CAlist, VerifyList, CRLlist, NoHTTPS11, Grace, Include, ConnTO, IgnoreCase, HTTPS;
++static regex_t CAlist, VerifyList, CRLlist, NoHTTPS11, Include, ConnTO, IgnoreCase, HTTPS;
static regex_t Disabled, Threads, CNName, Anonymise;
static regmatch_t matches[5];
-@@ -1277,8 +1277,6 @@ parse_file(void)
+@@ -1305,8 +1305,6 @@ parse_file(void)
def_facility = facilitynames[i].c_val;
break;
}
@@ -43,7 +44,7 @@ index 077fa60..c39be84
} else if(!regexec(&LogLevel, lin, 4, matches, 0)) {
log_level = atoi(lin + matches[1].rm_so);
} else if(!regexec(&Client, lin, 4, matches, 0)) {
-@@ -1378,7 +1376,6 @@ config_parse(const int argc, char **const argv)
+@@ -1406,7 +1404,6 @@ config_parse(const int argc, char **const argv)
|| regcomp(&Threads, "^[ \t]*Threads[ \t]+([1-9][0-9]*)[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
|| regcomp(&LogFacility, "^[ \t]*LogFacility[ \t]+([a-z0-9-]+)[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
|| regcomp(&LogLevel, "^[ \t]*LogLevel[ \t]+([0-5])[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
@@ -51,7 +52,7 @@ index 077fa60..c39be84
|| regcomp(&Alive, "^[ \t]*Alive[ \t]+([1-9][0-9]*)[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
|| regcomp(&SSLEngine, "^[ \t]*SSLEngine[ \t]+\"(.+)\"[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
|| regcomp(&Control, "^[ \t]*Control[ \t]+\"(.+)\"[ \t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
-@@ -1514,7 +1511,6 @@ config_parse(const int argc, char **const argv)
+@@ -1541,7 +1538,6 @@ config_parse(const int argc, char **const argv)
numthreads = 128;
alive_to = 30;
daemonize = 1;
@@ -59,7 +60,7 @@ index 077fa60..c39be84
services = NULL;
listeners = NULL;
-@@ -1540,7 +1536,6 @@ config_parse(const int argc, char **const argv)
+@@ -1567,7 +1563,6 @@ config_parse(const int argc, char **const argv)
regfree(&Threads);
regfree(&LogFacility);
regfree(&LogLevel);
@@ -70,7 +71,7 @@ index 077fa60..c39be84
diff --git a/pound.8 b/pound.8
old mode 100644
new mode 100755
-index bda2fd8..08c6a22
+index 76b5a06..b665ebe
--- a/pound.8
+++ b/pound.8
@@ -296,16 +296,6 @@ wait for a connection to the back-end (in seconds). Default: the
@@ -172,7 +173,9 @@ index 42a869d..09c5f16
(void)unlink(ctrl_name);
exit(0);
diff --git a/pound.h b/pound.h
-index add7ae5..492413c 100755
+old mode 100644
+new mode 100755
+index 5e53f40..15ed71c
--- a/pound.h
+++ b/pound.h
@@ -272,7 +272,6 @@ extern int numthreads, /* number of worker threads */
@@ -184,5 +187,5 @@ index add7ae5..492413c 100755
extern regex_t HEADER, /* Allowed header */
--
-1.8.3.1
+1.9.3
diff --git a/0003-Allow-to-reload-configuration-on-SIGHUP-SIGINT-witho.patch b/0005-Allow-to-reload-configuration-on-SIGHUP-SIGINT-witho.patch
similarity index 97%
rename from 0003-Allow-to-reload-configuration-on-SIGHUP-SIGINT-witho.patch
rename to 0005-Allow-to-reload-configuration-on-SIGHUP-SIGINT-witho.patch
index bb39ee4..ec6e918 100644
--- a/0003-Allow-to-reload-configuration-on-SIGHUP-SIGINT-witho.patch
+++ b/0005-Allow-to-reload-configuration-on-SIGHUP-SIGINT-witho.patch
@@ -1,7 +1,7 @@
-From 08576ea0e6423d648ae4698eff7e87b86076074c Mon Sep 17 00:00:00 2001
+From 276c5135ecbaee29612a5baed01d9f260f8b3826 Mon Sep 17 00:00:00 2001
From: Miroslav Spousta <miroslav.spousta at gooddata.com>
Date: Fri, 14 Jun 2013 16:55:31 +0200
-Subject: [PATCH 3/3] Allow to reload configuration on SIGHUP/SIGINT without
+Subject: [PATCH 5/5] Allow to reload configuration on SIGHUP/SIGINT without
service outage
When SIGHUP/SIGINT is received, signal old child to shut down, reload
@@ -16,12 +16,13 @@ kill them when signaled with SIGTERM/SIGQUIT.
pound.h | 31 ++++
svc.c | 139 +++++++++++++++
5 files changed, 520 insertions(+), 262 deletions(-)
+ mode change 100644 => 100755 svc.c
diff --git a/config.c b/config.c
-index c39be84..a4b8d51 100755
+index 30037c9..cb972a8 100755
--- a/config.c
+++ b/config.c
-@@ -719,10 +719,10 @@ parse_HTTP(void)
+@@ -734,10 +734,10 @@ parse_HTTP(void)
memset(res, 0, sizeof(LISTENER));
res->to = clnt_to;
res->rewr_loc = 1;
@@ -36,7 +37,7 @@ index c39be84..a4b8d51 100755
res->log_level = log_level;
if(regcomp(&res->verb, xhttp[0], REG_ICASE | REG_NEWLINE | REG_EXTENDED))
conf_err("xHTTP bad default pattern - aborted");
-@@ -922,10 +922,10 @@ parse_HTTPS(void)
+@@ -937,10 +937,10 @@ parse_HTTPS(void)
res->to = clnt_to;
res->rewr_loc = 1;
@@ -49,9 +50,9 @@ index c39be84..a4b8d51 100755
+ res->err501 = strdup("This method may not be used.");
+ res->err503 = strdup("The service is not available. Please try again later.");
res->allow_client_reneg = 0;
- res->disable_ssl_v2 = 0;
res->log_level = log_level;
-@@ -1437,6 +1437,7 @@ config_parse(const int argc, char **const argv)
+ if(regcomp(&res->verb, xhttp[0], REG_ICASE | REG_NEWLINE | REG_EXTENDED))
+@@ -1464,6 +1464,7 @@ config_parse(const int argc, char **const argv)
exit(1);
}
@@ -60,10 +61,10 @@ index c39be84..a4b8d51 100755
check_only = 0;
conf_name = F_CONF;
diff --git a/pound.8 b/pound.8
-index 08c6a22..e31fa60 100755
+index b665ebe..afffd2e 100755
--- a/pound.8
+++ b/pound.8
-@@ -912,6 +912,15 @@ server is re-opened as necessary.
+@@ -945,6 +945,15 @@ server is re-opened as necessary.
attempts to resolve the names of the hosts that appear in various requests and/or responses.
That means it need a functioning resolver of some kind (be it /etc/hosts, DNS or something
else).
@@ -759,7 +760,7 @@ index 09c5f16..1de7013 100755
}
}
diff --git a/pound.h b/pound.h
-index 492413c..8e6b1aa 100755
+index 15ed71c..de5f8b1 100755
--- a/pound.h
+++ b/pound.h
@@ -416,6 +416,12 @@ typedef struct _listener {
@@ -775,7 +776,7 @@ index 492413c..8e6b1aa 100755
typedef struct _thr_arg {
int sock;
LISTENER *lstn;
-@@ -508,6 +514,11 @@ extern int cpURL(char *, char *, int);
+@@ -509,6 +515,11 @@ extern int cpURL(char *, char *, int);
extern void addr2str(char *, const int, const struct addrinfo *, const int);
/*
@@ -787,7 +788,7 @@ index 492413c..8e6b1aa 100755
* Return a string representation for a back-end address
*/
#define str_be(BUF, LEN, BE) addr2str((BUF), (LEN), &(BE)->addr, 0)
-@@ -639,3 +650,23 @@ extern void *thr_timer(void *);
+@@ -640,3 +651,23 @@ extern void *thr_timer(void *);
* listens to client requests and calls the appropriate functions
*/
extern void *thr_control(void *);
@@ -812,7 +813,9 @@ index 492413c..8e6b1aa 100755
+ */
+void signal_all(PID *list, int signal);
diff --git a/svc.c b/svc.c
-index 22a6711..8f16827 100755
+old mode 100644
+new mode 100755
+index 0bad4e8..d8f4313
--- a/svc.c
+++ b/svc.c
@@ -305,6 +305,18 @@ addr2str(char *const res, const int res_len, const struct addrinfo *addr, const
@@ -834,7 +837,7 @@ index 22a6711..8f16827 100755
* Parse a URL, possibly decoding hexadecimal-encoded characters
*/
int
-@@ -1823,3 +1835,130 @@ SSLINFO_callback(const SSL *ssl, int where, int rc)
+@@ -1838,3 +1850,130 @@ SSLINFO_callback(const SSL *ssl, int where, int rc)
*reneg_state = RENEG_REJECT;
}
}
@@ -966,5 +969,5 @@ index 22a6711..8f16827 100755
+ }
+}
--
-1.8.3.1
+1.9.3
diff --git a/Pound.spec b/Pound.spec
index adbe25d..1095119 100644
--- a/Pound.spec
+++ b/Pound.spec
@@ -1,4 +1,4 @@
-%global alpha c
+%global alpha d
%global pound_user pound
%global pound_group pound
%global pound_home %{_localstatedir}/lib/pound
@@ -6,7 +6,7 @@
Name: Pound
Version: 2.7
-Release: 0.1%{?alpha:.%{alpha}}%{?dist}.1
+Release: 0.4%{?alpha:.%{alpha}}%{?dist}.1
Epoch: 1
Summary: Reverse proxy and load balancer
Group: System Environment/Daemons
@@ -35,23 +35,24 @@ Source1: pound.service
Source2: pound.cfg
Patch0: pound-remove-owner.patch
-# Internet Explorer reliability fix
-# http://www.apsis.ch/pound/pound_list/archive/2014/2014-04/1398260962000#1398260962000
-Patch1: 0001-Flush-the-headers-to-the-backend-as-soon-as-they-are.patch
+# DoS security fix
+# http://www.apsis.ch/pound/pound_list/archive/2014/2014-04/1398260922000#1398260922000
+Patch1: 0001-copy_chunks-Signal-an-error-if-a-terminating-chunk-i.patch
# Logging verbosity fix
# http://www.apsis.ch/pound/pound_list/archive/2014/2014-04/1398260973000#1398260973000
-Patch2: 0001-Do-not-return-NULL-data-from-get_thr_arg.patch
+Patch2: 0002-Do-not-return-NULL-data-from-get_thr_arg.patch
+
+# Internet Explorer reliability fix
+# http://www.apsis.ch/pound/pound_list/archive/2014/2014-04/1398260962000#1398260962000
+Patch3: 0003-Flush-the-headers-to-the-backend-as-soon-as-they-are.patch
# Restart robustness fixes
# http://www.apsis.ch/pound/pound_list/archive/2014/2014-04/1398261217000#1398261217000
-Patch3: 0002-Remove-Grace-period-option-wait-for-all-worker-threa.patch
+Patch4: 0004-Remove-Grace-period-option-wait-for-all-worker-threa.patch
# http://www.apsis.ch/pound/pound_list/archive/2014/2014-04/1398261218000#1398261218000
-Patch4: 0003-Allow-to-reload-configuration-on-SIGHUP-SIGINT-witho.patch
+Patch5: 0005-Allow-to-reload-configuration-on-SIGHUP-SIGINT-witho.patch
-# DoS security fix
-# http://www.apsis.ch/pound/pound_list/archive/2014/2014-04/1398260922000#1398260922000
-Patch5: 0001-copy_chunks-Signal-an-error-if-a-terminating-chunk-i.patch
%description
The Pound program is a reverse proxy, load balancer and
@@ -80,7 +81,7 @@ make %{?_smp_mflags}
make install DESTDIR=%{buildroot}
%{__install} -d %{buildroot}%{pound_home}
-%{__install} -p -D -m 755 %{SOURCE1} %{buildroot}%{_unitdir}/pound.service
+%{__install} -p -D -m 644 %{SOURCE1} %{buildroot}%{_unitdir}/pound.service
%{__install} -p -D -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/pound.cfg
mkdir -p %{buildroot}%{_sysconfdir}/pki/tls/certs
@@ -142,6 +143,25 @@ exit 0
%attr(-,%{pound_user},%{pound_group}) %dir %{pound_home}
%changelog
+* Fri Oct 24 2014 Lubomir Rintel <lkundrak at v3.sk> - 1:2.7-0.4.d.1
+- Rebase the GoodData patches
+
+* Fri Oct 24 2014 Lubomir Rintel <lkundrak at v3.sk> - 1:2.7-0.4.d
+- Update to 2.7d:
+- added "Disable PROTO" directives (fix for Poodle vulnerability)
+- added Cert, Disable and Cipher directives for HTTPS back-ends. The
+ directive HTTPS "cert" no longer supported.
+- fixed address comparison for RewriteLocation (IPv4/IPv6 problem -
+
+* Fri Sep 19 2014 Pete Zaitcev <zaitcev at redhat.com> - 1:2.7-0.4.c
+- chmod 644 pound.service # avoids warnings in messages
+
+* Fri Aug 15 2014 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1:2.7-0.3.c
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Fri Jun 06 2014 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1:2.7-0.2.c
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
* Wed Apr 23 2014 Lubomir Rintel (GoodData) <lubo.rintel at gooddata.com> - 1:2.7-0.1.c.1
- Add a couple of robustness/reliability fixes, submitted upstream
diff --git a/sources b/sources
index 0ad451e..623cfc2 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-56dace6b79c6be1d25b31355269c380a Pound-2.7c.tgz
+e68a18cd46c6437849402929a26fce1f Pound-2.7d.tgz
More information about the scm-commits
mailing list