From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 2 Nov 2020 15:08:09 +0000 (+0100)
Subject: BUG/MEDIUM: filters: Don't try to init filters for disabled proxies
X-Git-Tag: v2.3.0~31
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=400829cd2;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: filters: Don't try to init filters for disabled proxies

Configuration is parsed for such proxies but not validated. Concretely, it means
check_config_validity() function does almost nothing for such proxies. Thus, we
must be careful to not initialize filters for disabled proxies because the check
callback function is not called. In fact, to be sure to avoid any trouble,
filters for disabled proxies are released.

This patch fixes a segfault at startup if the SPOE is configured for a disabled
proxy. It must be backported as far as 1.7 (maybe with some adaptations).
---

diff --git a/src/filters.c b/src/filters.c
index 1d4119b6ce..9e5557d132 100644
--- a/src/filters.c
+++ b/src/filters.c
@@ -291,6 +291,10 @@ flt_init_all()
 	int err_code = 0;
 
 	for (px = proxies_list; px; px = px->next) {
+		if (px->disabled) {
+			flt_deinit(px);
+			continue;
+		}
 		err_code |= flt_init(px);
 		if (err_code & (ERR_ABORT|ERR_FATAL)) {
 			ha_alert("Failed to initialize filters for proxy '%s'.\n",
@@ -310,6 +314,9 @@ flt_init_all_per_thread()
 	int err_code = 0;
 
 	for (px = proxies_list; px; px = px->next) {
+		if (px->disabled)
+			continue;
+
 		err_code = flt_init_per_thread(px);
 		if (err_code & (ERR_ABORT|ERR_FATAL)) {
 			ha_alert("Failed to initialize filters for proxy '%s' for thread %u.\n",
@@ -349,7 +356,7 @@ flt_deinit(struct proxy *proxy)
 	struct flt_conf *fconf, *back;
 
 	list_for_each_entry_safe(fconf, back, &proxy->filter_configs, list) {
-		if (fconf->ops->deinit)
+		if (!proxy->disabled && fconf->ops->deinit)
 			fconf->ops->deinit(proxy, fconf);
 		LIST_DEL(&fconf->list);
 		free(fconf);
@@ -378,8 +385,10 @@ flt_deinit_all_per_thread()
 {
 	struct proxy *px;
 
-	for (px = proxies_list; px; px = px->next)
-		flt_deinit_per_thread(px);
+	for (px = proxies_list; px; px = px->next) {
+		if (!px->disabled)
+			flt_deinit_per_thread(px);
+	}
 }
 
 /* Attaches a filter to a stream. Returns -1 if an error occurs, 0 otherwise. */