Synchronise 2025.1 with upstream - #87
Merged
Merged
Conversation
The tls_ciphers field on listeners and pools was not validated for control characters, allowing injection of arbitrary HAProxy configuration directives by embedding spaces or newlines in the cipher string. Add input validation at the API layer to reject cipher strings containing characters outside the set allowed by OpenSSL cipher strings. Also add a safety check at config generation time to detect and replace invalid values that may already exist in the database, falling back to the configured default ciphers. Closes-Bug: #2162101 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Change-Id: Ia6affaafcaa8b22ec2e0c94b3c4007cccaae41ba Signed-off-by: Gregory Thiemonge <gthiemon@redhat.com> (cherry picked from commit cad6290) (cherry picked from commit 8f9e00a) (cherry picked from commit 7d94ab7)
The redirect_url and redirect_prefix fields on L7 policies were vulnerable to HAProxy configuration injection. The rfc3986 URL validator encodes control characters (e.g. newlines to %0A) before validating, so they passed structural checks. However, Octavia stores the raw unencoded input and writes it directly into the HAProxy configuration file, allowing injection of arbitrary directives. Add a check in the URL validator to reject URLs containing control characters and spaces before they reach rfc3986. Also add a safety check at config generation time to clear invalid redirect URLs that may already exist in the database. Closes-Bug: #2162103 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Change-Id: I23c3ca392233c7e8223a9a00b9ee07c6f4b63615 Signed-off-by: Gregory Thiemonge <gthiemon@redhat.com> (cherry picked from commit bad7074) (cherry picked from commit e642536) (cherry picked from commit 38bed8e)
The Jinja2 template for the global section used whitespace-stripping
tags ({%- ... %}) around the cpu-map block. When both cpu-map (multi
vCPU amphora) and external-check (PING health monitor) were enabled,
the stripped newline caused external-check to be appended to the
cpu-map line, producing a fatal HAProxy configuration error:
"cpu-map : 'external-check' is not a CPU range."
Remove the dash from the Jinja2 conditional tags to preserve the
newline between cpu-map and external-check directives.
Closes-Bug: #2162906
Change-Id: I306a653374c1f0fec1422334a40dd149e58c4e65
Co-Authored-By: biggrundik
Signed-off-by: Gregory Thiemonge <gthiemon@redhat.com>
(cherry picked from commit 8c0248a)
(cherry picked from commit 0e02bad)
(cherry picked from commit 7be66d5)
github-actions
Bot
added
automated
priteau
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains a snapshot of 2025.1 from upstream stable/2025.1.