[MRE] haproxy

[Lucas Kanashiro]

This bug tracks an update for the HAProxy package in the following Ubuntu
releases to the versions below:

 * Kinetic (22.10): HAProxy 2.4.22
 * Jammy (22.04): HAProxy 2.4.22
 * Focal (20.04): HAProxy 2.0.31

These updates include bugfixes only following the SRU policy exception defined
at https://wiki.ubuntu.com/HAProxyUpdates.

[Upstream changes]

Changelog of version 2.4.22:

http://git.haproxy.org/?p=haproxy-2.4.git;a=blob;f=CHANGELOG;h=d59309ffed498206bd15775e59bca154ee9d4b0d;hb=HEAD

Important bug fixes in 2.4.22 according to the upstream changelog:

- BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized
- BUG/MAJOR: mworker: fix infinite loop on master with no proxies.
- BUG/MAJOR: stick-tables: do not try to index a server name for applets
- BUG/MAJOR: stick-table: don't process store-response rules for applets
- BUG/MAJOR: fcgi: Fix uninitialized reserved bytes
- BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned
- BUG/CRITICAL: http: properly reject empty http header field names

I fixes CVE-2023-25725.

Changelog of version 2.0.31:

http://git.haproxy.org/?p=haproxy-2.0.git;a=blob;f=CHANGELOG;h=4b5713fb700f1d2a308ea8fdd18ef098efe0310a;hb=HEAD

Important bug fixes in 2.0.31 according to the upstream changelog:

- BUG/MAJOR: stick-tables: do not try to index a server name for applets
- BUG/MAJOR: stick-table: don't process store-response rules for applets
- BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned
- BUG/CRITICAL: http: properly reject empty http header field names

It fixes CVE-2023-25725.

[Test Plan]

Upstream CI tests results for 2.4.22:

https://github.com/lucaskanashiro/haproxy/actions?query=branch%3Abranch-v2.4.22

Upstream CI tests results for 2.0.31:

https://github.com/lucaskanashiro/haproxy/actions?query=branch%3Abranch-v2.0.31

Upstream is not pushing the stable branches to Github, so I am running the tests in my fork (the results above). I sent an email to their mailing list to see if they can push those changes to Github but no one replied to me so far.

autopkgtest summary in Kinetic:

autopkgtest [18:52:16]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
proxy-localhost PASS
proxy-ssl-termination PASS
proxy-ssl-pass-through PASS

autopkgtest summary in Jammy:

autopkgtest [18:37:20]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
proxy-localhost PASS

autopkgtest summary in Focal:

autopkgtest [18:17:03]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
proxy-localhost PASS

[Regression Potential]

HAProxy itself does not have many reverse dependencies, however, any upgrade is
a risk to introduce some breakage to other packages. Whenever a test failure is
detected, we will be on top of it and make sure it doesn't affect existing
users.

[Steve Langasek (vorlon)]

Hello Lucas, or anyone else affected,

Accepted haproxy into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/haproxy/2.0.31-0ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Steve Langasek (vorlon)]

Hello Lucas, or anyone else affected,

Accepted haproxy into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/haproxy/2.4.22-0ubuntu0.22.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Steve Langasek (vorlon)]

Hello Lucas, or anyone else affected,

Accepted haproxy into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/haproxy/2.4.22-0ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Lucas Kanashiro (lucaskanashiro)]

# Kinetic

autopkgtest summary against version in -proposed:

autopkgtest [09:49:22]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
proxy-localhost PASS
proxy-ssl-termination PASS
proxy-ssl-pass-through PASS

# Jammy

autopkgtest summary against version in -proposed:

autopkgtest [09:47:22]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
proxy-localhost PASS
proxy-ssl-termination PASS
proxy-ssl-pass-through PASS

# Focal

autopkgtest summary against version in -proposed:

autopkgtest [09:47:15]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
proxy-localhost PASS
proxy-ssl-termination PASS
proxy-ssl-pass-through PASS

[Launchpad Janitor (janitor)]

This bug was fixed in the package haproxy - 2.0.31-0ubuntu0.1

---------------
haproxy (2.0.31-0ubuntu0.1) focal; urgency=medium

  * New upstream release (LP: #2012557).
    - Major and critical bug fixes according to the upstream changelog:
      + BUG/MAJOR: stick-tables: do not try to index a server name for applets
      + BUG/MAJOR: stick-table: don't process store-response rules for applets
      + BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is
        realigned
      + BUG/CRITICAL: http: properly reject empty http header field names
    - Remove patches applied by upstream in debian/patches:
      + CVE-2023-0056.patch
      + CVE-2023-25725.patch
    - Refresh existing patches in debian/patches:
      + 0002-Use-dpkg-buildflags-to-build-halog.patch
  * Backport DEP-8 tests from Lunar:
    - d/t/proxy-ssl-termination
    - d/t/proxy-ssl-pass-through

 -- Lucas Kanashiro <email address hidden> Wed, 22 Mar 2023 17:39:46 -0300

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for haproxy has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package haproxy - 2.4.22-0ubuntu0.22.04.1

---------------
haproxy (2.4.22-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream release (LP: #2012557).
    - Major and critical bug fixes according to the upstream changelog:
      + BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized
      + BUG/MAJOR: mworker: fix infinite loop on master with no proxies.
      + BUG/MAJOR: stick-tables: do not try to index a server name for applets
      + BUG/MAJOR: stick-table: don't process store-response rules for applets
      + BUG/MAJOR: fcgi: Fix uninitialized reserved bytes
      + BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned
      + BUG/CRITICAL: http: properly reject empty http header field names
    - Remove patches applied by upstream in debian/patches:
      + CVE-2023-0056.patch
      + CVE-2023-25725.patch
      + CVE-2023-0836.patch
    - Refresh existing patches in debian/patches:
      + haproxy.service-start-after-syslog.patch
      + reproducible.patch
  * Backport DEP-8 tests from Lunar:
    - d/t/proxy-ssl-termination
    - d/t/proxy-ssl-pass-through

 -- Lucas Kanashiro <email address hidden> Wed, 22 Mar 2023 18:18:54 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package haproxy - 2.4.22-0ubuntu0.22.10.1

---------------
haproxy (2.4.22-0ubuntu0.22.10.1) kinetic; urgency=medium

  * New upstream release (LP: #2012557).
    - Major and critical bug fixes according to the upstream changelog:
      + BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized
      + BUG/MAJOR: mworker: fix infinite loop on master with no proxies.
      + BUG/MAJOR: stick-tables: do not try to index a server name for applets
      + BUG/MAJOR: stick-table: don't process store-response rules for applets
      + BUG/MAJOR: fcgi: Fix uninitialized reserved bytes
      + BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned
      + BUG/CRITICAL: http: properly reject empty http header field names
    - Remove patches applied by upstream in debian/patches:
      + CVE-2023-0056.patch
      + CVE-2023-25725.patch
      + CVE-2023-0836.patch
    - Refresh existing patches in debian/patches:
      + reproducible.patch

 -- Lucas Kanashiro <email address hidden> Wed, 22 Mar 2023 18:39:05 -0300