From a854729155c248d7fd2d629adf1b5af65946fff9 Mon Sep 17 00:00:00 2001 From: Christian Lachner Date: Thu, 13 Dec 2018 10:59:51 +0100 Subject: [PATCH] haproxy: Update HAProxy to v1.8.15 - Update haproxy download URL and hash - Removed all obsolete patches Signed-off-by: Christian Lachner --- net/haproxy/Makefile | 6 +- net/haproxy/get-latest-patches.sh | 2 +- ..._pipe-is-initialized-before-using-it.patch | 38 -- ...ify-force-private-cache-is-an-option.patch | 39 -- ...pointer-dereference-in-send-proxy-v2.patch | 47 -- ...heck-that-the-mux-installed-properly.patch | 43 -- ...wrap-in-buffer_insert_line2-replace2.patch | 40 -- ...-for-ciphersuites-option-for-TLSv1-3.patch | 473 ------------------ ...-CumSslConns-counters-not-threadsafe.patch | 62 --- ...7-BUG-MINOR-checks-queues-null-deref.patch | 33 -- ...eceiving-SIGUSR1-followed-by-SIGTERM.patch | 52 -- ...M-stream-dont-crash-on-out-of-memory.patch | 29 -- ...ssl.patch => 001-deprecated-openssl.patch} | 12 +- ...n-ssl_fc_cipherlist_str-sample-fetch.patch | 29 -- ...ef-warning-in-ssl_sock_switchctx_cbk.patch | 28 -- ...il-on-task_new-during-initialization.patch | 26 - ...ocation-error-during-peers_init_sync.patch | 77 --- .../patches/0014-DOC-Fix-a-few-typos.patch | 56 --- ...-at-the-end-of-the-rendez-vous-point.patch | 36 -- ...threads_want_sync-is-marked-volatile.patch | 29 -- ...er-add-a-new-statement-__unreachable.patch | 38 -- ...ctions-calling-lua_yieldk-may-return.patch | 304 ----------- ...rnings-about-potential-null-derefs-2.patch | 48 -- ...me-compiler-warnings-after-WILL_LJMP.patch | 39 -- ...ded-double-around-conditional-clause.patch | 27 - ...get-to-simply-show-the-build-options.patch | 41 -- ...-speed-up-compiler-options-detection.patch | 38 -- ...n-option-conflict-warning-with-clang.patch | 38 -- ...server-Use-memcpy-instead-of-strncpy.patch | 34 -- ...se-Write-130-as-128-as-0x82-and-0x80.patch | 34 -- ...es-instead-of-enums-to-appease-clang.patch | 39 -- ...eference-to-map-files-in-MAINTAINERS.patch | 24 - ...name-__unreachable-to-my_unreachable.patch | 41 -- ...Fix-the-usage-of-mmap-with-DEBUG_UAF.patch | 33 -- ...no-stream-is-left-an-GOAWAY-was-sent.patch | 28 -- ...he-new-ERR-variable-to-force--Werror.patch | 46 -- ...e-Crashes-with-total-max-size-2047MB.patch | 55 -- ...INOR-cache-Wrong-usage-of-shctx_init.patch | 28 -- ...-MINOR-ssl-Wrong-usage-of-shctx_init.patch | 26 - ...ing-information-about-total-max-size.patch | 24 - ...nections-private-if-NTLM-is-detected.patch | 94 ---- ...erver-if-lb-alg-is-non-deterministic.patch | 76 --- ...h-may-deference-an-inexisting-buffer.patch | 39 -- ...eads-use-of-crypt-is-not-thread-safe.patch | 77 --- ...esence-of-the-h2-pattern-in-npn-alpn.patch | 43 -- ...ake-sure-stksess-is-properly-aligned.patch | 61 --- ...ges-when-parsing-of-a-backend-starts.patch | 38 -- ...-fix-encoding-of-accept-ranges-field.patch | 32 -- 48 files changed, 10 insertions(+), 2592 deletions(-) delete mode 100644 net/haproxy/patches/0000-MINOR-threads-Make-sure-threads_sync_pipe-is-initialized-before-using-it.patch delete mode 100644 net/haproxy/patches/0001-DOC-clarify-force-private-cache-is-an-option.patch delete mode 100644 net/haproxy/patches/0002-BUG-MINOR-connection-avoid-null-pointer-dereference-in-send-proxy-v2.patch delete mode 100644 net/haproxy/patches/0003-BUG-MINOR-backend-check-that-the-mux-installed-properly.patch delete mode 100644 net/haproxy/patches/0004-BUG-MEDIUM-buffers-Make-sure-we-dont-wrap-in-buffer_insert_line2-replace2.patch delete mode 100644 net/haproxy/patches/0005-MEDIUM-ssl-add-support-for-ciphersuites-option-for-TLSv1-3.patch delete mode 100644 net/haproxy/patches/0006-BUG-MEDIUM-Cur-CumSslConns-counters-not-threadsafe.patch delete mode 100644 net/haproxy/patches/0007-BUG-MINOR-checks-queues-null-deref.patch delete mode 100644 net/haproxy/patches/0008-BUG-MEDIUM-mworker-segfault-receiving-SIGUSR1-followed-by-SIGTERM.patch delete mode 100644 net/haproxy/patches/0009-BUG-MEDIUM-stream-dont-crash-on-out-of-memory.patch rename net/haproxy/patches/{0045-deprecated-openssl.patch => 001-deprecated-openssl.patch} (90%) delete mode 100644 net/haproxy/patches/0010-BUILD-ssl-fix-null-deref-warning-in-ssl_fc_cipherlist_str-sample-fetch.patch delete mode 100644 net/haproxy/patches/0011-BUILD-ssl-fix-another-null-deref-warning-in-ssl_sock_switchctx_cbk.patch delete mode 100644 net/haproxy/patches/0012-BUILD-stick-table-make-sure-not-to-fail-on-task_new-during-initialization.patch delete mode 100644 net/haproxy/patches/0013-BUILD-peers-check-allocation-error-during-peers_init_sync.patch delete mode 100644 net/haproxy/patches/0014-DOC-Fix-a-few-typos.patch delete mode 100644 net/haproxy/patches/0015-BUG-MEDIUM-threads-fix-thread_release-at-the-end-of-the-rendez-vous-point.patch delete mode 100644 net/haproxy/patches/0016-BUG-MEDIUM-threads-make-sure-threads_want_sync-is-marked-volatile.patch delete mode 100644 net/haproxy/patches/0017-BUILD-compiler-add-a-new-statement-__unreachable.patch delete mode 100644 net/haproxy/patches/0018-MINOR-lua-all-functions-calling-lua_yieldk-may-return.patch delete mode 100644 net/haproxy/patches/0019-BUILD-lua-silence-some-compiler-warnings-about-potential-null-derefs-2.patch delete mode 100644 net/haproxy/patches/0020-BUILD-lua-silence-some-compiler-warnings-after-WILL_LJMP.patch delete mode 100644 net/haproxy/patches/0021-CLEANUP-stick-tables-Remove-unneeded-double-around-conditional-clause.patch delete mode 100644 net/haproxy/patches/0022-BUILD-Makefile-add-a-make-opts-target-to-simply-show-the-build-options.patch delete mode 100644 net/haproxy/patches/0023-BUILD-Makefile-speed-up-compiler-options-detection.patch delete mode 100644 net/haproxy/patches/0024-BUILD-Makefile-silence-an-option-conflict-warning-with-clang.patch delete mode 100644 net/haproxy/patches/0025-MINOR-server-Use-memcpy-instead-of-strncpy.patch delete mode 100644 net/haproxy/patches/0026-MINOR-cfgparse-Write-130-as-128-as-0x82-and-0x80.patch delete mode 100644 net/haproxy/patches/0027-MINOR-peers-use-defines-instead-of-enums-to-appease-clang.patch delete mode 100644 net/haproxy/patches/0028-DOC-fix-reference-to-map-files-in-MAINTAINERS.patch delete mode 100644 net/haproxy/patches/0029-BUILD-compiler-rename-__unreachable-to-my_unreachable.patch delete mode 100644 net/haproxy/patches/0030-BUG-MEDIUM-pools-Fix-the-usage-of-mmap-with-DEBUG_UAF.patch delete mode 100644 net/haproxy/patches/0031-BUG-MEDIUM-h2-Close-connection-if-no-stream-is-left-an-GOAWAY-was-sent.patch delete mode 100644 net/haproxy/patches/0032-BUILD-Makefile-add-the-new-ERR-variable-to-force--Werror.patch delete mode 100644 net/haproxy/patches/0033-BUG-MINOR-cache-Crashes-with-total-max-size-2047MB.patch delete mode 100644 net/haproxy/patches/0034-BUG-MINOR-cache-Wrong-usage-of-shctx_init.patch delete mode 100644 net/haproxy/patches/0035-BUG-MINOR-ssl-Wrong-usage-of-shctx_init.patch delete mode 100644 net/haproxy/patches/0036-DOC-cache-Missing-information-about-total-max-size.patch delete mode 100644 net/haproxy/patches/0037-BUG-MINOR-only-mark-connections-private-if-NTLM-is-detected.patch delete mode 100644 net/haproxy/patches/0038-BUG-MINOR-only-auto-prefer-last-server-if-lb-alg-is-non-deterministic.patch delete mode 100644 net/haproxy/patches/0039-BUG-MAJOR-http-http_txn_get_path-may-deference-an-inexisting-buffer.patch delete mode 100644 net/haproxy/patches/0040-BUG-MEDIUM-auth-threads-use-of-crypt-is-not-thread-safe.patch delete mode 100644 net/haproxy/patches/0041-BUG-MINOR-config-better-detect-the-presence-of-the-h2-pattern-in-npn-alpn.patch delete mode 100644 net/haproxy/patches/0042-BUG-MEDIUM-Make-sure-stksess-is-properly-aligned.patch delete mode 100644 net/haproxy/patches/0043-BUG-MINOR-config-Copy-default-error-messages-when-parsing-of-a-backend-starts.patch delete mode 100644 net/haproxy/patches/0044-BUG-MEDIUM-hpack-fix-encoding-of-accept-ranges-field.patch diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index a4a4483b4c..1328136a11 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -10,12 +10,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=haproxy -PKG_VERSION:=1.8.14 -PKG_RELEASE:=5 +PKG_VERSION:=1.8.15 +PKG_RELEASE:=1 PKG_SOURCE:=haproxy-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://www.haproxy.org/download/1.8/src/ -PKG_HASH:=b17e402578be85e58af7a3eac99b1f675953bea9f67af2e964cf8bdbd1bd3fdf +PKG_HASH:=7113862f1146d7de8b8e64f45826ab3533c7f7f7b7767e24c08f7c762202a032 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION) PKG_LICENSE:=GPL-2.0 diff --git a/net/haproxy/get-latest-patches.sh b/net/haproxy/get-latest-patches.sh index 4612ccdaec..39e46a4f3f 100755 --- a/net/haproxy/get-latest-patches.sh +++ b/net/haproxy/get-latest-patches.sh @@ -1,7 +1,7 @@ #!/bin/bash CLONEURL=http://git.haproxy.org/git/haproxy-1.8.git -BASE_TAG=v1.8.14 +BASE_TAG=v1.8.15 TMP_REPODIR=tmprepo PATCHESDIR=patches diff --git a/net/haproxy/patches/0000-MINOR-threads-Make-sure-threads_sync_pipe-is-initialized-before-using-it.patch b/net/haproxy/patches/0000-MINOR-threads-Make-sure-threads_sync_pipe-is-initialized-before-using-it.patch deleted file mode 100644 index 00bc944901..0000000000 --- a/net/haproxy/patches/0000-MINOR-threads-Make-sure-threads_sync_pipe-is-initialized-before-using-it.patch +++ /dev/null @@ -1,38 +0,0 @@ -commit 14844e448b637fea2770bcb03a43a010c4c8176d -Author: Olivier Houchard -Date: Thu Sep 27 14:55:34 2018 +0200 - - MINOR: threads: Make sure threads_sync_pipe is initialized before using it. - - thread_want_sync() might be called before thread_sync_init() was called, - at least when reading the server state file, as apply_server_state() is called - before thread_sync_init(). So make sure the threads_sync_pipe was initialized - before writing to it, if it was not, there's no thread, so no need to sync - anything anyway, and if we don't check it we'll end up writing a 'S' on - stdin. - - this only applies to 1.8. - -diff --git a/src/hathreads.c b/src/hathreads.c -index 97ed31c5..9dba4356 100644 ---- a/src/hathreads.c -+++ b/src/hathreads.c -@@ -28,7 +28,7 @@ void thread_sync_io_handler(int fd) - #ifdef USE_THREAD - - static HA_SPINLOCK_T sync_lock; --static int threads_sync_pipe[2]; -+static int threads_sync_pipe[2] = {-1, -1}; - static unsigned long threads_want_sync = 0; - volatile unsigned long threads_want_rdv_mask = 0; - volatile unsigned long threads_harmless_mask = 0; -@@ -76,7 +76,8 @@ void thread_want_sync() - if (all_threads_mask & (all_threads_mask - 1)) { - if (threads_want_sync & tid_bit) - return; -- if (HA_ATOMIC_OR(&threads_want_sync, tid_bit) == tid_bit) -+ if (HA_ATOMIC_OR(&threads_want_sync, tid_bit) == tid_bit && -+ threads_sync_pipe[1] != -1) - shut_your_big_mouth_gcc(write(threads_sync_pipe[1], "S", 1)); - } - else { diff --git a/net/haproxy/patches/0001-DOC-clarify-force-private-cache-is-an-option.patch b/net/haproxy/patches/0001-DOC-clarify-force-private-cache-is-an-option.patch deleted file mode 100644 index 3358f63378..0000000000 --- a/net/haproxy/patches/0001-DOC-clarify-force-private-cache-is-an-option.patch +++ /dev/null @@ -1,39 +0,0 @@ -commit 18aff2297ce844362f28ea5317c289ba154bd33d -Author: Lukas Tribus -Date: Mon Oct 1 02:00:16 2018 +0200 - - DOC: clarify force-private-cache is an option - - "boolean" may confuse users into thinking they need to provide - additional arguments, like false or true. This is a simple option - like many others, so lets not confuse the users with internals. - - Also fixes an additional typo. - - Should be backported to 1.8 and 1.7. - - (cherry picked from commit 2793578eaf934bbf28f742a35f3a1ae656280324) - Signed-off-by: Christopher Faulet - -diff --git a/doc/configuration.txt b/doc/configuration.txt -index c69033b1..580194ec 100644 ---- a/doc/configuration.txt -+++ b/doc/configuration.txt -@@ -1651,7 +1651,7 @@ tune.ssl.cachesize - this value to 0 disables the SSL session cache. - - tune.ssl.force-private-cache -- This boolean disables SSL session cache sharing between all processes. It -+ This option disables SSL session cache sharing between all processes. It - should normally not be used since it will force many renegotiations due to - clients hitting a random process. But it may be required on some operating - systems where none of the SSL cache synchronization method may be used. In -@@ -6535,7 +6535,7 @@ option smtpchk - yes | no | yes | yes - Arguments : - is an optional argument. It is the "hello" command to use. It can -- be either "HELO" (for SMTP) or "EHLO" (for ESTMP). All other -+ be either "HELO" (for SMTP) or "EHLO" (for ESMTP). All other - values will be turned into the default command ("HELO"). - - is the domain name to present to the server. It may only be diff --git a/net/haproxy/patches/0002-BUG-MINOR-connection-avoid-null-pointer-dereference-in-send-proxy-v2.patch b/net/haproxy/patches/0002-BUG-MINOR-connection-avoid-null-pointer-dereference-in-send-proxy-v2.patch deleted file mode 100644 index 9ab8e34f1d..0000000000 --- a/net/haproxy/patches/0002-BUG-MINOR-connection-avoid-null-pointer-dereference-in-send-proxy-v2.patch +++ /dev/null @@ -1,47 +0,0 @@ -commit f6d20e718131aa2b468ff0a6c42e20c0b900e58b -Author: Ilya Shipitsin -Date: Sat Sep 15 00:50:05 2018 +0500 - - BUG/MINOR: connection: avoid null pointer dereference in send-proxy-v2 - - found by coverity. - - [wt: this bug was introduced by commit 404d978 ("MINOR: add ALPN - information to send-proxy-v2"). It might be triggered by a health - check on a server using ppv2 or by an applet making use of such a - server, if at all configurable]. - - This needs to be backported to 1.8. - - (cherry picked from commit ca56fce8bd271928b18d38b439bd35bd273fe8d4) - Signed-off-by: Christopher Faulet - -diff --git a/src/connection.c b/src/connection.c -index 8c5af156..7403e8ae 100644 ---- a/src/connection.c -+++ b/src/connection.c -@@ -874,6 +874,7 @@ int conn_recv_netscaler_cip(struct connection *conn, int flag) - return 0; - } - -+/* Note: is explicitly allowed to be NULL */ - int make_proxy_line(char *buf, int buf_len, struct server *srv, struct connection *remote) - { - int ret = 0; -@@ -985,6 +986,7 @@ static int make_tlv(char *dest, int dest_len, char type, uint16_t length, const - return length + sizeof(*tlv); - } - -+/* Note: is explicitly allowed to be NULL */ - int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connection *remote) - { - const char pp2_signature[] = PP2_SIGNATURE; -@@ -1060,7 +1062,7 @@ int make_proxy_line_v2(char *buf, int buf_len, struct server *srv, struct connec - } - } - -- if (conn_get_alpn(remote, &value, &value_len)) { -+ if (remote && conn_get_alpn(remote, &value, &value_len)) { - if ((buf_len - ret) < sizeof(struct tlv)) - return 0; - ret += make_tlv(&buf[ret], (buf_len - ret), PP2_TYPE_ALPN, value_len, value); diff --git a/net/haproxy/patches/0003-BUG-MINOR-backend-check-that-the-mux-installed-properly.patch b/net/haproxy/patches/0003-BUG-MINOR-backend-check-that-the-mux-installed-properly.patch deleted file mode 100644 index d63a9216c4..0000000000 --- a/net/haproxy/patches/0003-BUG-MINOR-backend-check-that-the-mux-installed-properly.patch +++ /dev/null @@ -1,43 +0,0 @@ -commit e725a7f9bfd8b7fe2e74c62c7c6bf2b9ebf83772 -Author: Willy Tarreau -Date: Wed Oct 3 10:20:19 2018 +0200 - - BUG/MINOR: backend: check that the mux installed properly - - The return value from conn_install_mux() was not checked, so if an - inconsistency happens in the code, or a memory allocation fails while - initializing the mux, we can crash while using an uninitialized mux. - In practice the code inconsistency does not really happen since we - cannot configure such a situation, except during development, but - the out of memory condition could definitely happen. - - This should be backported to 1.8 (the code is a bit different there, - there are two calls to conn_install_mux()). - - (cherry picked from commit 33dd4ef81245bb868b22f99b9be45d0791131eec) - Signed-off-by: Christopher Faulet - -diff --git a/src/backend.c b/src/backend.c -index 2b6167dc..fc1eac0d 100644 ---- a/src/backend.c -+++ b/src/backend.c -@@ -1163,7 +1163,8 @@ int connect_server(struct stream *s) - if (srv) { - conn_prepare(srv_conn, protocol_by_family(srv_conn->addr.to.ss_family), srv->xprt); - /* XXX: Pick the right mux, when we finally have one */ -- conn_install_mux(srv_conn, &mux_pt_ops, srv_cs); -+ if (conn_install_mux(srv_conn, &mux_pt_ops, srv_cs) < 0) -+ return SF_ERR_INTERNAL; - } - else if (obj_type(s->target) == OBJ_TYPE_PROXY) { - /* proxies exclusively run on raw_sock right now */ -@@ -1171,7 +1172,8 @@ int connect_server(struct stream *s) - if (!objt_cs(s->si[1].end) || !objt_cs(s->si[1].end)->conn->ctrl) - return SF_ERR_INTERNAL; - /* XXX: Pick the right mux, when we finally have one */ -- conn_install_mux(srv_conn, &mux_pt_ops, srv_cs); -+ if (conn_install_mux(srv_conn, &mux_pt_ops, srv_cs) < 0) -+ return SF_ERR_INTERNAL; - } - else - return SF_ERR_INTERNAL; /* how did we get there ? */ diff --git a/net/haproxy/patches/0004-BUG-MEDIUM-buffers-Make-sure-we-dont-wrap-in-buffer_insert_line2-replace2.patch b/net/haproxy/patches/0004-BUG-MEDIUM-buffers-Make-sure-we-dont-wrap-in-buffer_insert_line2-replace2.patch deleted file mode 100644 index e365cd5c83..0000000000 --- a/net/haproxy/patches/0004-BUG-MEDIUM-buffers-Make-sure-we-dont-wrap-in-buffer_insert_line2-replace2.patch +++ /dev/null @@ -1,40 +0,0 @@ -commit 45e9f3c660c872e93588cf1c0b74c192f2c8c3d5 -Author: Olivier Houchard -Date: Wed Sep 26 15:09:58 2018 +0200 - - BUG/MEDIUM: buffers: Make sure we don't wrap in buffer_insert_line2/replace2. - - In buffer_insert_line2() and buffer_replace2(), we can't afford to wrap, - so don't use b_tail to check if we do, directly use b->p + b->i instead. - - This should be backported to previous versions. - - (cherry picked from commit 363c745569b6ffd8f095d2b7758131d08aa27219) - Signed-off-by: Christopher Faulet - - [cf: This patch was adapted and its commit message too. Because of the - refactoring of the buffer's API in 1.9, the original patch fixes same bug in - ci_insert_line2/b_rep_blk.] - -diff --git a/src/buffer.c b/src/buffer.c -index 167b75ae..6ad38a02 100644 ---- a/src/buffer.c -+++ b/src/buffer.c -@@ -107,7 +107,7 @@ int buffer_replace2(struct buffer *b, char *pos, char *end, const char *str, int - - delta = len - (end - pos); - -- if (bi_end(b) + delta > b->data + b->size) -+ if (b->p + b->i + delta > b->data + b->size) - return 0; /* no space left */ - - if (buffer_not_empty(b) && -@@ -146,7 +146,7 @@ int buffer_insert_line2(struct buffer *b, char *pos, const char *str, int len) - - delta = len + 2; - -- if (bi_end(b) + delta >= b->data + b->size) -+ if (b->p + b->i + delta >= b->data + b->size) - return 0; /* no space left */ - - if (buffer_not_empty(b) && diff --git a/net/haproxy/patches/0005-MEDIUM-ssl-add-support-for-ciphersuites-option-for-TLSv1-3.patch b/net/haproxy/patches/0005-MEDIUM-ssl-add-support-for-ciphersuites-option-for-TLSv1-3.patch deleted file mode 100644 index ac2cd136fe..0000000000 --- a/net/haproxy/patches/0005-MEDIUM-ssl-add-support-for-ciphersuites-option-for-TLSv1-3.patch +++ /dev/null @@ -1,473 +0,0 @@ -commit 4be76416751aa22992a44f2f5cfdba506809fd89 -Author: Dirkjan Bussink -Date: Fri Sep 14 11:14:21 2018 +0200 - - MEDIUM: ssl: add support for ciphersuites option for TLSv1.3 - - OpenSSL released support for TLSv1.3. It also added a separate function - SSL_CTX_set_ciphersuites that is used to set the ciphers used in the - TLS 1.3 handshake. This change adds support for that new configuration - option by adding a ciphersuites configuration variable that works - essentially the same as the existing ciphers setting. - - Note that it should likely be backported to 1.8 in order to ease usage - of the now released openssl-1.1.1. - - (cherry picked from commit 415150f7640b06740fa832363d186c5c6565338e) - Signed-off-by: Willy Tarreau - -diff --git a/doc/configuration.txt b/doc/configuration.txt -index 580194ec..7a268386 100644 ---- a/doc/configuration.txt -+++ b/doc/configuration.txt -@@ -580,8 +580,10 @@ The following keywords are supported in the "global" section : - - setenv - - stats - - ssl-default-bind-ciphers -+ - ssl-default-bind-ciphersuites - - ssl-default-bind-options - - ssl-default-server-ciphers -+ - ssl-default-server-ciphersuites - - ssl-default-server-options - - ssl-dh-param-file - - ssl-server-verify -@@ -984,11 +986,25 @@ setenv - ssl-default-bind-ciphers - This setting is only available when support for OpenSSL was built in. It sets - the default string describing the list of cipher algorithms ("cipher suite") -- that are negotiated during the SSL/TLS handshake for all "bind" lines which -- do not explicitly define theirs. The format of the string is defined in -- "man 1 ciphers" from OpenSSL man pages, and can be for instance a string such -- as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes). Please check the -- "bind" keyword for more information. -+ that are negotiated during the SSL/TLS handshake except for TLSv1.3 for all -+ "bind" lines which do not explicitly define theirs. The format of the string -+ is defined in "man 1 ciphers" from OpenSSL man pages, and can be for instance -+ a string such as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes). For -+ TLSv1.3 cipher configuration, please check the "ssl-default-bind-ciphersuites" -+ keyword. Please check the "bind" keyword for more information. -+ -+ssl-default-bind-ciphersuites -+ This setting is only available when support for OpenSSL was built in and -+ OpenSSL 1.1.1 or later was used to build HAProxy. It sets the default string -+ describing the list of cipher algorithms ("cipher suite") that are negotiated -+ during the TLSv1.3 handshake for all "bind" lines which do not explicitly define -+ theirs. The format of the string is defined in -+ "man 1 ciphers" from OpenSSL man pages under the section "ciphersuites", and can -+ be for instance a string such as -+ "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" -+ (without quotes). For cipher configuration for TLSv1.2 and earlier, please check -+ the "ssl-default-bind-ciphers" keyword. Please check the "bind" keyword for more -+ information. - - ssl-default-bind-options [