Skip to content

Commit 9156d5f

Browse files
committed
BUG/MEDIUM: log: parsing log-forward options may result in segfault
As reported by GH user @HiggsTeilchen on haproxy#3250, the use of "option dont-parse-log" may result in segmentation fault when parsing the configuration. In fact, "option assume-rfc6587-ntf" is also affected. The reason behind this is that cfg_parse_log_forward() leverages the cfg_parse_listen_match_option() function to check for generic proxy options that are relevant in the PR_MODE_SYSLOG context. And while it is not documented, this function assumes that the currently evaluated proxy is stored in the global variable 'curproxy', which cfg_parse_log_forward() doesn't offer. cfg_parse_listen_match_option() uses curproxy to check the currently evaluated proxy's capabilities is compatible with the option, so if a proxy with the frontend capability was defined earlier in the config, parsing would succeed, if curproxy points to proxy without the frontend capabilty (ie: backend), a warning would be emitted to tell that the option would be ignored while it is perfectly valid for the log-forward proxy, and if no proxy was defined earlier in the config a segfault would be triggered. To fix the issue, we explicitly make "curproxy" global variable point to the log-forward proxy being parsed in cfg_parse_log_forward() before leveraging cfg_parse_listen_match_option() to check for compatible options. It must be backported with 834e9af ("MINOR: log: add options eval for log-forward"), which was introduced in 3.2 precisely.
1 parent 14e890d commit 9156d5f

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

src/log.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6276,7 +6276,10 @@ int cfg_parse_log_forward(const char *file, int linenum, char **args, int kwm)
62766276

62776277
/* only consider options that are frontend oriented and log oriented, such options may be set
62786278
* in px->options2 because px->options is already full of tcp/http oriented options
6279+
* also, cfg_parse_listen_match_option() assumes global curproxy variable points to
6280+
* currently evaluated proxy
62796281
*/
6282+
curproxy = cfg_log_forward;
62806283
if (cfg_parse_listen_match_option(file, linenum, kwm, cfg_opts3, &err_code, args,
62816284
PR_MODE_SYSLOG, PR_CAP_FE,
62826285
&cfg_log_forward->options3, &cfg_log_forward->no_options3))

0 commit comments

Comments
 (0)