[Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling

[Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling

[Peter Korsgaard]

haproxy has a runtime test to verify that it is built with -fwrapv:

haproxy
FATAL ERROR: invalid code detected -- cannot go further, please recompile!
The source code was miscompiled by the compiler, which usually indicates that
some of the CFLAGS needed to work around overzealous compiler optimizations
were overwritten at build time. Please do not force CFLAGS, and read Makefile
and INSTALL files to decide on the best way to pass your local build options.

Build options :
  TARGET  = custom
  CPU     = generic
  CC      = /home/peko/source/buildroot/output-haproxy/host/bin/arm-linux-gcc
  CFLAGS  = -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1
  OPTIONS = USE_THREAD=1 USE_DL=1
  DEBUG   = -DDEBUG_STRICT -DDEBUG_MEMORY_POOLS

Which comes from:
https://github.com/haproxy/haproxy/blob/v2.6.0/src/haproxy.c#L3008-L3037

So build it with -fwrapv to fix that.

Notice that this message also embeds the build path (through CC), breaking
reproducible builds.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/haproxy/haproxy.mk | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/package/haproxy/haproxy.mk b/package/haproxy/haproxy.mk
index 970347d3ed..f75f18e031 100644
--- a/package/haproxy/haproxy.mk
+++ b/package/haproxy/haproxy.mk
@@ -15,8 +15,10 @@ HAPROXY_CPE_ID_VENDOR = haproxy
 # https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=832b672eee54866c7a42a1d46078cc9ae0d544d9
 HAPROXY_IGNORE_CVES += CVE-2023-45539
 
+# haproxy relies on signed overflow, so MUST be built with -fwrapv
 HAPROXY_MAKE_OPTS = \
 	LD=$(TARGET_CC) \
+	CFLAGS="$(TARGET_CFLAGS) -fwrapv" \
 	PREFIX=/usr \
 	TARGET=custom
 
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/2] support/testing: add haproxy test

[Peter Korsgaard]

Based on the lighttpd test case.  Verify that we can download index.html
from haproxy in front of lighttpd.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 DEVELOPERS                                    |  1 +
 support/testing/conf/haproxy.cfg              | 13 +++++++
 support/testing/tests/package/test_haproxy.py | 38 +++++++++++++++++++
 3 files changed, 52 insertions(+)
 create mode 100644 support/testing/conf/haproxy.cfg
 create mode 100644 support/testing/tests/package/test_haproxy.py

diff --git a/DEVELOPERS b/DEVELOPERS
index 5eb438906f..b39e01fe46 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -2715,6 +2715,7 @@ F:	package/wireguard-linux-compat/
 F:	package/wireguard-tools/
 F:	support/testing/tests/package/test_agec.py
 F:	support/testing/tests/package/test_docker_compose.py
+F:	support/testing/tests/package/test_haproxy.py
 F:	support/testing/tests/package/test_python_hid.py
 
 N:	Peter Seiderer <ps.report@gmx.net>
diff --git a/support/testing/conf/haproxy.cfg b/support/testing/conf/haproxy.cfg
new file mode 100644
index 0000000000..41e983ea97
--- /dev/null
+++ b/support/testing/conf/haproxy.cfg
@@ -0,0 +1,13 @@
+defaults
+    timeout connect 10s
+    timeout client 30s
+    timeout server 30s
+
+frontend myfrontend
+  mode http
+  bind :81
+  default_backend web_servers
+
+backend web_servers
+  mode http
+  server s1 localhost:80 check
diff --git a/support/testing/tests/package/test_haproxy.py b/support/testing/tests/package/test_haproxy.py
new file mode 100644
index 0000000000..6fba0c3809
--- /dev/null
+++ b/support/testing/tests/package/test_haproxy.py
@@ -0,0 +1,38 @@
+import os
+
+import infra.basetest
+
+
+class TestHaproxy(infra.basetest.BRTest):
+    config = infra.basetest.BASIC_TOOLCHAIN_CONFIG + \
+        """
+        BR2_ROOTFS_POST_BUILD_SCRIPT="{}"
+        BR2_ROOTFS_POST_SCRIPT_ARGS="{}"
+        BR2_PACKAGE_HAPROXY=y
+        BR2_PACKAGE_LIGHTTPD=y
+        BR2_TARGET_ROOTFS_CPIO=y
+        # BR2_TARGET_ROOTFS_TAR is not set
+        """.format(
+            infra.filepath("tests/package/copy-sample-script-to-target.sh"),
+            infra.filepath("conf/haproxy.cfg")
+        )
+
+    def test_run(self):
+        cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+        self.emulator.boot(arch="armv5",
+                           kernel="builtin",
+                           options=["-initrd", cpio_file])
+        self.emulator.login()
+
+        msg = "Hello Buildroot!"
+
+        # sanity check
+        self.assertRunOk("haproxy -v")
+        self.assertRunOk("haproxy -c -f .")
+
+        # proxy to lighttpd
+        self.assertRunOk("haproxy -D -f .")
+
+        self.assertRunOk(f"echo '{msg}' > /var/www/index.html")
+        self.assertRunOk("wget http://localhost:81/index.html")
+        self.assertRunOk(f"grep -F '{msg}' index.html")
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling

[Julien Olivain via buildroot]

On 27/08/2026 18:55, Peter Korsgaard wrote:
> haproxy has a runtime test to verify that it is built with -fwrapv:
> 
> haproxy
> FATAL ERROR: invalid code detected -- cannot go further, please 
> recompile!
> The source code was miscompiled by the compiler, which usually 
> indicates that
> some of the CFLAGS needed to work around overzealous compiler 
> optimizations
> were overwritten at build time. Please do not force CFLAGS, and read 
> Makefile
> and INSTALL files to decide on the best way to pass your local build 
> options.
> 
> Build options :
>   TARGET  = custom
>   CPU     = generic
>   CC      = 
> /home/peko/source/buildroot/output-haproxy/host/bin/arm-linux-gcc
>   CFLAGS  = -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE 
> -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1 -D_LARGEFILE_SOURCE 
> -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 
> -D_FORTIFY_SOURCE=1
>   OPTIONS = USE_THREAD=1 USE_DL=1
>   DEBUG   = -DDEBUG_STRICT -DDEBUG_MEMORY_POOLS
> 
> Which comes from:
> https://github.com/haproxy/haproxy/blob/v2.6.0/src/haproxy.c#L3008-L3037
> 
> So build it with -fwrapv to fix that.
> 
> Notice that this message also embeds the build path (through CC), 
> breaking
> reproducible builds.
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot