GitHub PushEvent at 2014-10-30 00:11:33
Repository: haproxy
Actor: hilbix
Payload: {"shas":[["955f4613cb457a93bb278e47a9af19bf5479d27d","f0989643efd6600a9167c036cd32ddcc6802ecbc@babiel.com","BUG/MEDIUM: regex: fix pcre_study error handling\n\npcre_study() may return NULL even though it succeeded. In this case error is\nNULL otherwise error is not NULL. Also see man 3 pcre_study.\n\nPreviously a ACL pattern of e.g. \".*\" would cause error because pcre_study did\nnot found anything to speed up matching and returned regex->extra = NULL and\nerror = NULL which in this case was a false-positive. That happend only when\nPCRE_JIT was enabled for HAProxy but libpcre has been built without JIT.\n\nSigned-off-by: Christian Ruppert <c.ruppert@babiel.com>\n\n[wt: this needs to be backported to 1.5 as well]","Christian Ruppert",true],["43e7958def282deebde934950b133a1dd9edaabf","ac0b4a525641bbb210eabb816ec33e32bed6dd53@haproxy.com","MINOR: add fetchs 'ssl_c_der' and 'ssl_f_der' to return DER formatted certs\n\nssl_c_der : binary\n  Returns the DER formatted certificate presented by the client when the\n  incoming connection was made over an SSL/TLS transport layer. When used for\n  an ACL, the value(s) to match against can be passed in hexadecimal form.\n\nssl_f_der : binary\n  Returns the DER formatted certificate presented by the frontend when the\n  incoming connection was made over an SSL/TLS transport layer. When used for\n  an ACL, the value(s) to match against can be passed in hexadecimal form.","Emeric Brun",true],["5e0d0e046a7a54c6f4349e58f0e850105038a71a","aff024fe4ab0fece4091de044c58c9ae4233383a@1wt.eu","BUG/MEDIUM: tcp: don't use SO_ORIGINAL_DST on non-AF_INET sockets\n\nThere's an issue when using SO_ORIGINAL_DST to retrieve the original\ndestination of a connection's address before being translated by\nNetfilter's DNAT/REDIRECT or the old TPROXY. SO_ORIGINAL_DST is\nable to retrieve an IPv4 address when the original destination was\nIPv4 mapped into IPv6. At first glance it's not a big deal, but it\nis for logging and for the proxy protocol, because we then have\ntwo different address families for the source and destination. In\nthis case, the proxy protocol correctly detects the issue and emits\n\"UNKNOWN\".\n\nIn order to fix this, we perform getsockname() first, and only if\nthe address family is AF_INET, then we perform the getsockopt() call.\n\nThis fix must be backported to 1.5, and probably even to 1.4 and 1.3.","Willy Tarreau",true]],"size":3,"ref":"refs/heads/dev","head":"5e0d0e046a7a54c6f4349e58f0e850105038a71a"}