haproxytech/spoa-mirror v1.2.20

Hardened SPOP frame decoding

on GitHub

spoa-mirror 1.2.20

The frames received from HAProxy are now decoded defensively: the announced frame length, the decoded item lengths and the 32-bit items are all checked against the frame boundaries, and an item that cannot be decoded rejects the whole frame. The program also learned the connection and transfer timeout arguments, and the README describes how it works with the recent HAProxy versions.

What's new

• New --connection-timeout and --timeout command-line arguments set the maximum time to connect to the mirror server and the maximum duration of a single transfer; both were hard-coded before and keep their previous values as defaults.
• The README got a HAProxy compatibility section: the program implements SPOP 2.0, HAProxy 3.1 handles the protocol in a dedicated multiplexer that negotiates pipelining alone, the SPOE backend may stay in mode tcp, and several spoe-agent keywords are parsed but have no effect.
• The build system supports a separate build directory, so a release and a debug build can live side by side, and a debug build of the program is installed under its own name.
• New --enable-compile-warnings and --enable-compile-errors configure options control the compilation warnings and whether they are treated as errors.
• Debug builds can dump the contents of a curl list through the new mir_curl_slist_dump() function.

Breaking changes

• The --max-frame-size values below 512 bytes are rejected, because a frame buffer smaller than the HAPROXY-HELLO frame crashed the program. A command line that used a smaller value has to be corrected.

Bug fixes

• The frame length announced in the header is checked against the maximum frame size as soon as it is read, and the connection is closed when the frame does not fit; a peer could otherwise write past the end of the receive buffer.
• The lengths decoded from a frame are compared with the space left in it instead of being added to the current position, where a large enough value made the addition wrap around and parsing continued from an arbitrary address.
• The 32-bit items are checked against the space left in the frame before they are read.
• A K/V item that cannot be decoded aborts the decoding and sets the status code, instead of losing the error and continuing in the middle of the item.
• The frame flags are decoded and encoded with memcpy(), so they are no longer read and written through an unaligned pointer to uint32_t.
• The same buffer overflow and pointer arithmetic corrections were made in the example agent in contrib/spoa_example.
• The connection and transfer timeouts are given to libcurl in milliseconds again; they were set in microseconds by mistake.
• The help output copied into the README shows the same timeout defaults as the program prints.

Other changes

• The return value of chdir() is checked in daemonize().
• The spoa_msg_arg_hdrs() declaration no longer warns about an unused parameter in non-debug builds.
• The UINT64_C() macro is used when defining unsigned long long values.
• The deprecated AC_TRY_COMPILE() macro was replaced in the remaining m4 files.
• The ChangeLog was populated.

Full Changelog: v1.2.19...v1.2.20