From b21152be7a4b227df7fe722073d501c3891f7733 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Sun, 17 Jun 2007 23:41:40 +0200 Subject: [PATCH] [RELEASE] Released version 1.3.12 with the following main changes : - acl: smarter integer comparison support in ACLs - acl: specify the direction during fetches - acl: provide the argument length for fetch functions - acl: provide a reference to the expr to fetch() - acl: implement matching on header values - acl: support maching on 'path' component - acl: permit to return any header when no name specified - errorfile: use a local file to feed error messages - negation in ACL conds was not cleared between terms - fix segfault at exit when using captures - improve memory freeing upon exit - acl: support '-i' to ignore case when matching - str2net() must not change the const char * - provide default ACLs - acl: distinguish between request and response headers - added the 'use_backend' keyword for full content-switching - acl: added the TRUE and FALSE ACLs. - shut warnings 'is*' macros from ctype.h on solaris --- CHANGELOG | 19 ++++++ Makefile | 4 +- Makefile.bsd | 2 +- Makefile.osx | 2 +- examples/acl-content-sw.cfg | 130 ++++++++++++++++++++++++++++++++++++ examples/haproxy-small.spec | 5 +- examples/haproxy.spec | 5 +- include/common/version.h | 4 +- 8 files changed, 163 insertions(+), 8 deletions(-) create mode 100644 examples/acl-content-sw.cfg diff --git a/CHANGELOG b/CHANGELOG index b48265c21..e09ddaee2 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,25 @@ ChangeLog : =========== +2007/06/17 : 1.3.12 + - fix segfault at exit when using captures + - bug: negation in ACL conds was not cleared between terms + - errorfile: use a local file to feed error messages + - acl: support '-i' to ignore case when matching + - acl: smarter integer comparison with operators eq,lt,gt,le,ge + - acl: support maching on 'path' component + - acl: implement matching on header values + - acl: distinguish between request and response headers + - acl: permit to return any header when no name specified + - acl: provide default ACLs + - added the 'use_backend' keyword for full content-switching + - acl: specify the direction during fetches + - acl: provide the argument length for fetch functions + - acl: provide a reference to the expr to fetch() + - improve memory freeing upon exit + - str2net() must not change the const char * + - shut warnings 'is*' macros from ctype.h on solaris + 2007/06/03 : 1.3.11.4 - do not re-arm read timeout in SHUTR state ! - optimize I/O by detecting system starvation diff --git a/Makefile b/Makefile index 04fbd732f..39fa4d55d 100644 --- a/Makefile +++ b/Makefile @@ -120,9 +120,9 @@ VERDATE := $(shell date +%Y/%m/%d -d "`git-log HEAD^.. 2>/dev/null | grep -m 1 ^ else # Otherwise, use the hard-coded version of last tag, number of changes # since last tag, and release date. -VERSION := 1.3.11.4 +VERSION := 1.3.12 SUBVERS := -VERDATE := 2007/06/03 +VERDATE := 2007/06/17 endif #### build options diff --git a/Makefile.bsd b/Makefile.bsd index 3ace82672..14e70f463 100644 --- a/Makefile.bsd +++ b/Makefile.bsd @@ -2,7 +2,7 @@ # You should use it this way : # make TARGET=os CPU=cpu -VERSION := 1.3.11.4 +VERSION := 1.3.12 # Select target OS. TARGET must match a system for which COPTS and LIBS are # correctly defined below. diff --git a/Makefile.osx b/Makefile.osx index 3e91456c6..0a2aa7436 100644 --- a/Makefile.osx +++ b/Makefile.osx @@ -2,7 +2,7 @@ # You should use it this way : # make TARGET=os CPU=cpu -VERSION := 1.3.11.4 +VERSION := 1.3.12 # Select target OS. TARGET must match a system for which COPTS and LIBS are # correctly defined below. diff --git a/examples/acl-content-sw.cfg b/examples/acl-content-sw.cfg new file mode 100644 index 000000000..1872789ac --- /dev/null +++ b/examples/acl-content-sw.cfg @@ -0,0 +1,130 @@ +# This sample configuration makes extensive use of the ACLs. It requires +# HAProxy version 1.3.12 minimum. + +global + log loghost local0 + log localhost local0 err + maxconn 250 + uid 71 + gid 71 + chroot /var/empty + pidfile /var/run/haproxy.pid + daemon + quiet + +frontend http-in + bind :80 + mode http + log global + clitimeout 30000 + option httplog + option dontlognull + #option logasap + option httpclose + maxconn 100 + + capture request header Host len 20 + capture request header User-Agent len 16 + capture request header Content-Length len 10 + capture request header Referer len 20 + capture response header Content-Length len 10 + + # block any unwanted source IP addresses or networks + acl forbidden_src src 0.0.0.0/7 224.0.0.0/3 + acl forbidden_src src_port 0:1023 + block if forbidden_src + + # block requests beginning with http:// on wrong domains + acl dangerous_pfx url_beg -i http:// + acl valid_pfx url_reg -i ^http://[^/]*1wt\.eu/ + block if dangerous_pfx !valid_pfx + + # block apache chunk exploit, ... + acl forbidden_hdrs hdr_sub(transfer-encoding) -i chunked + acl forbidden_hdrs hdr_beg(host) -i apache- localhost + + # ... some HTTP content smugling and other various things + acl forbidden_hdrs hdr_cnt(host) gt 1 + acl forbidden_hdrs hdr_cnt(content-length) gt 1 + acl forbidden_hdrs hdr_val(content-length) lt 0 + acl forbidden_hdrs hdr_cnt(proxy-authorization) gt 0 + block if forbidden_hdrs + + # block annoying worms that fill the logs... + acl forbidden_uris url_reg -i .*(\.|%2e)(\.|%2e)(%2f|%5c|/|\\\\) + acl forbidden_uris url_sub -i %00