From: Willy Tarreau <w@1wt.eu>
Date: Tue, 15 Sep 2026 14:37:58 +0000 (+0200)
Subject: BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section
X-Git-Tag: v3.5-dev9~159
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=34dbb37e8479e3c2a86a50301704f10bc8011cfd;p=haproxy.git

BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section

A proxy section only accepts "<keyword> <name> [from <defaults>]", and
anything else was reported as an alert suggesting to use the "bind"
keyword, but only for sections with the frontend capability. For the
others the block was left silently, without any message and without
creating the proxy nor opening a bacend section! As such any keyword
so that either the next line was a section keyword and it would restart
from there, or any other proxy keyword was rejected with "'listen' or
'defaults' expected". The only really silent case was when the section
is the last one, as it's silently dropped:

  $ printf 'defaults\nmode http\nbackend b junk\n' | ./haproxy -c -f /dev/stdin
  $ echo 0
  0

This patch fixes the error report (both message and err_code) for
backends. It moves the too many args check after the fe/be distinction
so that we don't mix the two messages and we can always emit a relevant
message for both fronts and backs.

Since the only case where such a config would have been accepted was
when an empty and invalid backend definition was placed at the end
immediately after a defaults section, there's no risk to break any
working config so this can safely be backported.
---

diff --git a/src/cfgparse-listen.c b/src/cfgparse-listen.c
index be1eb29de..cd2b43369 100644
--- a/src/cfgparse-listen.c
+++ b/src/cfgparse-listen.c
@@ -371,14 +371,19 @@ int cfg_parse_listen(const char *file, int linenum, char **args, int kwm)
 				err_code |= ERR_ALERT | ERR_FATAL;
 		}
 
-		if ((*args[2] && (!*args[3] || strcmp(args[2], "from") != 0)) ||
-		    alertif_too_many_args(3, file, linenum, args, &err_code)) {
-			if (rc & PR_CAP_FE) {
-				err_code |= ERR_ALERT | ERR_FATAL;
+		if (*args[2] && (!*args[3] || strcmp(args[2], "from") != 0)) {
+			/* the only form taking arguments is "<kw> <name> from <defaults>" */
+			if (rc & PR_CAP_FE)
 				ha_alert("parsing [%s:%d] : please use the 'bind' keyword for listening addresses.\n", file, linenum);
-			}
+			else
+				ha_alert("parsing [%s:%d] : '%s' cannot handle unexpected argument '%s'.\n",
+					 file, linenum, args[0], args[2]);
+			err_code |= ERR_ALERT | ERR_FATAL;
 			goto out;
 		}
+
+		if (alertif_too_many_args(3, file, linenum, args, &err_code))
+			goto out;
 	}
 
 	if (rc & PR_CAP_LISTEN) {  /* new proxy or defaults section */