* [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling
@ 2026-08-27 16:55 Peter Korsgaard
2026-08-27 16:55 ` [Buildroot] [PATCH 2/2] support/testing: add haproxy test Peter Korsgaard
2026-08-27 21:10 ` [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling Julien Olivain via buildroot
0 siblings, 2 replies; 3+ messages in thread
From: Peter Korsgaard @ 2026-08-27 16:55 UTC (permalink / raw)
To: buildroot; +Cc: Fabrice Fontaine
haproxy has a runtime test to verify that it is built with -fwrapv:
haproxy
FATAL ERROR: invalid code detected -- cannot go further, please recompile!
The source code was miscompiled by the compiler, which usually indicates that
some of the CFLAGS needed to work around overzealous compiler optimizations
were overwritten at build time. Please do not force CFLAGS, and read Makefile
and INSTALL files to decide on the best way to pass your local build options.
Build options :
TARGET = custom
CPU = generic
CC = /home/peko/source/buildroot/output-haproxy/host/bin/arm-linux-gcc
CFLAGS = -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1
OPTIONS = USE_THREAD=1 USE_DL=1
DEBUG = -DDEBUG_STRICT -DDEBUG_MEMORY_POOLS
Which comes from:
https://github.com/haproxy/haproxy/blob/v2.6.0/src/haproxy.c#L3008-L3037
So build it with -fwrapv to fix that.
Notice that this message also embeds the build path (through CC), breaking
reproducible builds.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
package/haproxy/haproxy.mk | 2 ++
1 file changed, 2 insertions(+)
diff --git a/package/haproxy/haproxy.mk b/package/haproxy/haproxy.mk
index 970347d3ed..f75f18e031 100644
--- a/package/haproxy/haproxy.mk
+++ b/package/haproxy/haproxy.mk
@@ -15,8 +15,10 @@ HAPROXY_CPE_ID_VENDOR = haproxy
# https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=832b672eee54866c7a42a1d46078cc9ae0d544d9
HAPROXY_IGNORE_CVES += CVE-2023-45539
+# haproxy relies on signed overflow, so MUST be built with -fwrapv
HAPROXY_MAKE_OPTS = \
LD=$(TARGET_CC) \
+ CFLAGS="$(TARGET_CFLAGS) -fwrapv" \
PREFIX=/usr \
TARGET=custom
--
2.47.3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH 2/2] support/testing: add haproxy test
2026-08-27 16:55 [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling Peter Korsgaard
@ 2026-08-27 16:55 ` Peter Korsgaard
2026-08-27 21:10 ` [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling Julien Olivain via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2026-08-27 16:55 UTC (permalink / raw)
To: buildroot
Based on the lighttpd test case. Verify that we can download index.html
from haproxy in front of lighttpd.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
DEVELOPERS | 1 +
support/testing/conf/haproxy.cfg | 13 +++++++
support/testing/tests/package/test_haproxy.py | 38 +++++++++++++++++++
3 files changed, 52 insertions(+)
create mode 100644 support/testing/conf/haproxy.cfg
create mode 100644 support/testing/tests/package/test_haproxy.py
diff --git a/DEVELOPERS b/DEVELOPERS
index 5eb438906f..b39e01fe46 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -2715,6 +2715,7 @@ F: package/wireguard-linux-compat/
F: package/wireguard-tools/
F: support/testing/tests/package/test_agec.py
F: support/testing/tests/package/test_docker_compose.py
+F: support/testing/tests/package/test_haproxy.py
F: support/testing/tests/package/test_python_hid.py
N: Peter Seiderer <ps.report@gmx.net>
diff --git a/support/testing/conf/haproxy.cfg b/support/testing/conf/haproxy.cfg
new file mode 100644
index 0000000000..41e983ea97
--- /dev/null
+++ b/support/testing/conf/haproxy.cfg
@@ -0,0 +1,13 @@
+defaults
+ timeout connect 10s
+ timeout client 30s
+ timeout server 30s
+
+frontend myfrontend
+ mode http
+ bind :81
+ default_backend web_servers
+
+backend web_servers
+ mode http
+ server s1 localhost:80 check
diff --git a/support/testing/tests/package/test_haproxy.py b/support/testing/tests/package/test_haproxy.py
new file mode 100644
index 0000000000..6fba0c3809
--- /dev/null
+++ b/support/testing/tests/package/test_haproxy.py
@@ -0,0 +1,38 @@
+import os
+
+import infra.basetest
+
+
+class TestHaproxy(infra.basetest.BRTest):
+ config = infra.basetest.BASIC_TOOLCHAIN_CONFIG + \
+ """
+ BR2_ROOTFS_POST_BUILD_SCRIPT="{}"
+ BR2_ROOTFS_POST_SCRIPT_ARGS="{}"
+ BR2_PACKAGE_HAPROXY=y
+ BR2_PACKAGE_LIGHTTPD=y
+ BR2_TARGET_ROOTFS_CPIO=y
+ # BR2_TARGET_ROOTFS_TAR is not set
+ """.format(
+ infra.filepath("tests/package/copy-sample-script-to-target.sh"),
+ infra.filepath("conf/haproxy.cfg")
+ )
+
+ def test_run(self):
+ cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+ self.emulator.boot(arch="armv5",
+ kernel="builtin",
+ options=["-initrd", cpio_file])
+ self.emulator.login()
+
+ msg = "Hello Buildroot!"
+
+ # sanity check
+ self.assertRunOk("haproxy -v")
+ self.assertRunOk("haproxy -c -f .")
+
+ # proxy to lighttpd
+ self.assertRunOk("haproxy -D -f .")
+
+ self.assertRunOk(f"echo '{msg}' > /var/www/index.html")
+ self.assertRunOk("wget http://localhost:81/index.html")
+ self.assertRunOk(f"grep -F '{msg}' index.html")
--
2.47.3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling
2026-08-27 16:55 [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling Peter Korsgaard
2026-08-27 16:55 ` [Buildroot] [PATCH 2/2] support/testing: add haproxy test Peter Korsgaard
@ 2026-08-27 21:10 ` Julien Olivain via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Julien Olivain via buildroot @ 2026-08-27 21:10 UTC (permalink / raw)
To: Peter Korsgaard; +Cc: buildroot, Fabrice Fontaine
On 27/08/2026 18:55, Peter Korsgaard wrote:
> haproxy has a runtime test to verify that it is built with -fwrapv:
>
> haproxy
> FATAL ERROR: invalid code detected -- cannot go further, please
> recompile!
> The source code was miscompiled by the compiler, which usually
> indicates that
> some of the CFLAGS needed to work around overzealous compiler
> optimizations
> were overwritten at build time. Please do not force CFLAGS, and read
> Makefile
> and INSTALL files to decide on the best way to pass your local build
> options.
>
> Build options :
> TARGET = custom
> CPU = generic
> CC =
> /home/peko/source/buildroot/output-haproxy/host/bin/arm-linux-gcc
> CFLAGS = -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
> -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1 -D_LARGEFILE_SOURCE
> -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0
> -D_FORTIFY_SOURCE=1
> OPTIONS = USE_THREAD=1 USE_DL=1
> DEBUG = -DDEBUG_STRICT -DDEBUG_MEMORY_POOLS
>
> Which comes from:
> https://github.com/haproxy/haproxy/blob/v2.6.0/src/haproxy.c#L3008-L3037
>
> So build it with -fwrapv to fix that.
>
> Notice that this message also embeds the build path (through CC),
> breaking
> reproducible builds.
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-27 21:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-27 16:55 [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling Peter Korsgaard
2026-08-27 16:55 ` [Buildroot] [PATCH 2/2] support/testing: add haproxy test Peter Korsgaard
2026-08-27 21:10 ` [Buildroot] [PATCH 1/2] package/haproxy: needs signed overflow handling Julien Olivain via buildroot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.