When a proxy inherits from its defaults section, the return value of
proxy_ref_defaults() was assigned to err_code instead of being ORed
into it, wiping all the errors collected earlier for that line. As a
result an invalid character in a proxy's name was reported but the
process started anyway:
$ cat inv.cfg
defaults
mode http
frontend inv@lid
bind :8080
$ ./haproxy -c -f inv.cfg
[ALERT] : parsing [inv.cfg:3] : character '@' is not permitted in
'frontend' name 'inv@lid'.
$ echo 0
0
The same applies to the duplicate name and ambiguous defaults reference
diagnostics emitted before the proxy is created.
Configurations which were mistakenly accepted until will now be rejected,
though they were already emitting an alert. The issue was only introduced
in 3.4 with commit
87ea407cce ("MINOR: proxy: refactor proxy inheritance
of a defaults section"), so it's fairly unlikely that a bogus configuration
was introduced only there, thus a backport would be preferable, or maybe
only the err_code should be turned to ERR_WARN to remain tolerant for
existing versions.
curproxy->conf.line_prev = line_prev;
if (curr_defproxy) {
- err_code = proxy_ref_defaults(curproxy, curr_defproxy, &errmsg);
- if (err_code)
+ int ret = proxy_ref_defaults(curproxy, curr_defproxy, &errmsg);
+
+ if (ret)
ha_alert("parsing [%s:%d]: %s.\n", file, linenum, errmsg);
+ err_code |= ret;
}
if (rc & PR_CAP_DEF) {