net-proxy/haproxy: Bumps re CVE-2025-11230 / CVE-2023-30421

Signed-off-by: Christian Ruppert <idl0r@gentoo.org>

5 files changed, 871 insertions, 0 deletions

diff --git a/net-proxy/haproxy/Manifest b/net-proxy/haproxy/Manifest
index eacd5719a4ef..b35aa7120b8e 100644
--- a/net-proxy/haproxy/Manifest
+++ b/net-proxy/haproxy/Manifest
@@ -1,9 +1,13 @@
 DIST VTest-af198470d7ce482d3d26eb9ca3f246a438739366.tar.gz 196700 BLAKE2B d740e19104a91b4cf978596ccda861974e96c9ed85a49c91e996c5bc6dde40f1cdcf49e6a75243aba7bf59abfd8d2c051a7ee574bab22f9e512d74376c9e1738 SHA512 cdc62271bb75ef7032745a457e1a54a84bcaadce73324272462b647383177338c5c2c8a17993d6344840e8ce0308a7e6f0df9bb766ebe0e8d4ee6dd4914e188c
 DIST haproxy-2.8.11.tar.gz 4400628 BLAKE2B 0daccc4dbae5cecae3ad0bc1d164ea78a9584a0f4cb71e15664aff4b76fc05a828030dee355722c99a77270427bd3e9e43939ae59a3f3b1cabcc0179faff34b9 SHA512 59517187a5c0e0dbcb8629d2a922f7a865e1ebdbb9fe0f4fbe273913e0f15a1a26767808bd1607f10e79d3abcdd8c35c1ae648df149a1d5c0df32604df553655
 DIST haproxy-2.8.15.tar.gz 4418838 BLAKE2B f2f0ac46400ddcccbf01319d62be7df34ec16be047f33c795b1d944eacf82fa919c93201d79a468746c4580d89a1f45fe81ff3a5fb5510c438de4b37efe0c2e7 SHA512 ac116667a6bce4f77789b9e5cdfb703864c96b18f20025cf6a00f81d0caf0829e1a7fc3f325c181b3509c64feed8711b67db2e88ac24f85611d68ee592282ad3
+DIST haproxy-2.8.16.tar.gz 4429238 BLAKE2B eb1599260a71114a412e95220bc98c85d495c5c74c13d181bae9ef84abfe188107acd10cfeb8ccb9973ab77fa32162bfa8c5c220bdb9d5ad6435302e6852bd82 SHA512 d05fee92c077828c9ab8954e47492e38307f2bad6dab53b74e10f4510ef2f4c83745242e6f5a9ddc871aaa016e1069a207caf3cb24e53f524fc13d27116af00d
 DIST haproxy-3.0.11.tar.gz 4738655 BLAKE2B df5f6ee9f29df007ad2be38b91fb6b99d7d0cfb6de4fc4144caaba1ce9b94b8234132df507ea022d124409f1887536ddb428161972bd724988323d324c0bfe68 SHA512 3dc9f2367a3601480b302fad47e8cb8172d7a50443970284f4253f0b605dcd7b0e8d4ce825e9c6f4c66f24a65b6e28cf5891cfb659eeab21f8446dbb3c3bf25b
+DIST haproxy-3.0.12.tar.gz 4745984 BLAKE2B 6d7ac9fe32440efbd56eb33b784884995f1a4e70814f97ebfdab4c5bb2116146f68aca40f6e925d309f31f6b05b5decf787a3526158e2e5677d4d29e8c2e5057 SHA512 ed9b0d0635f14c4825ae0bc342f2a3217a2fb71e8624577cc69af3c06536a716f0701247db505d49bcf5dc58f483b55e617341bbea181b78b1f1034ae7c0c0f9
 DIST haproxy-3.0.5.tar.gz 4698022 BLAKE2B c64d8799755fddaf5b45a9e2b67c5f03b25af98fbddde68ab1206c288d9a65f91938810b150c4398ee138d9154c90f1af9fb05c3d0bbc80394e71430e1cc4396 SHA512 8c16b026d5e26fc030178ecd354c68e8ea32c2b971f143cb2aa2f1b2d16fbfc0a27e3975f78873a0cefe3f904b5f1999f8d75622a04234b9cf88f90161d9ea91
 DIST haproxy-3.1.7.tar.gz 4917146 BLAKE2B 07c99ab5dfbafecb46fd6cfb62e6e82e6feab9be2a12b28ddaf72bcd62a47ab8cd4faf8f148ad44f80d4d95c098ceedb8c4eb8c4c4d010e85d734f22ec75a1ab SHA512 4cf13b96fcc0c7748ebf2a9bd512474d8aa5f760dd9e40961ba6c0ce72324450b556657b129114c3ca150826fff2b161d062366419fac7bd9c4d44a68e8b6a73
 DIST haproxy-3.1.8.tar.gz 4923696 BLAKE2B a863bf3944a871329b22c65e13a7e4759d1baa8d5d3b5b7ad54f7eb9d286a3fa49022d7f93f044b210fb60a7649927625f1408c190627b65e69e09c7fc6c2136 SHA512 4708d6f1611ad8e87c1ff51350d2c339be1d268b9961e9d55d026aee8e45b4feeb1aa0528e7877770b45471794a0f05c48c5371d420bde8f5c78a6f7290742e2
+DIST haproxy-3.1.9.tar.gz 4930057 BLAKE2B 5658db1cba1b29b9ac92cb964d56d14e66eb0faf4e7d69b338fe30bc446d74c8dd7d47205569e615b8ad9791db41ab381177b49c8363a34bdcbf82ad44b45bdc SHA512 8e4ebdef6c84c7e3e1b839783369a5d90fe97102a4cb871c38581ccb1971d242aeba46785515cc9b22df10483ae3b3061d1e5768ff0626e0852e71a0c722908e
 DIST haproxy-3.2.3.tar.gz 5089103 BLAKE2B b967ce88cb47105e6db43e06d27471d81cdc27b6b71ff868b139b1d22702070eb83308d3c4e20be3b05bd6d27f06a3b76d701f13b11e61a61a622fa11609be89 SHA512 90529ca48897d30249680de55e7d86c1b77f9bd62762b43803b7db51087df1e527f8d7a44d173e305b932a759fff6158763d10121c020dbe75adf4b28cd9f750
 DIST haproxy-3.2.5.tar.gz 5104627 BLAKE2B 0d078293893f9cbb6faa7c4ecae64f1f11241fe2bee77a38a798297d8c20c3368a70108c794631d80470977fe53629ad6393736551d87b4180a39a094cc3e525 SHA512 4b1f01d1760e1d099967fd50d74bd65d907446f1fa37b90a216eae13fa4d94347909b380883071d777a4d5cf096bf7724141103ba655b9fe7879347716468684
+DIST haproxy-3.2.6.tar.gz 5108005 BLAKE2B 7f8d6d2bc5962498da93c0adf70c4c3c41da2dbd0d3cdffd3eeab56f3e4960d96be7878a686682ec88a30ff236e4dbdb4f476b68b7fd0e343796218356d706a5 SHA512 15da214f93b4448ad73c6498fe308d92aad073a45233b3015e1bc71a1efc6ce6e219993e8ea577cf9014feb26154668fccc24f1bf4f7b0005fdeeb55c86de78f
diff --git a/net-proxy/haproxy/haproxy-2.8.16.ebuild b/net-proxy/haproxy/haproxy-2.8.16.ebuild
new file mode 100644
index 000000000000..b8adca997201
--- /dev/null
+++ b/net-proxy/haproxy/haproxy-2.8.16.ebuild
@@ -0,0 +1,218 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LUA_COMPAT=( lua5-4 lua5-3 )
+
+[[ ${PV} == *9999 ]] && SCM="git-r3"
+inherit toolchain-funcs lua-single systemd linux-info ${SCM} multiprocessing
+
+MY_P="${PN}-${PV/_beta/-dev}"
+
+DESCRIPTION="A TCP/HTTP reverse proxy for high availability environments"
+HOMEPAGE="http://www.haproxy.org"
+if [[ ${PV} != *9999 ]]; then
+	# This is arbitrary; upstream uses master.  Try to update when possible
+	VTEST_COMMIT="af198470d7ce482d3d26eb9ca3f246a438739366"
+	VTEST_DIR="${WORKDIR}/VTest-${VTEST_COMMIT}"
+	SRC_URI="http://haproxy.1wt.eu/download/$(ver_cut 1-2)/src/${MY_P}.tar.gz
+			test? ( https://github.com/vtest/VTest/archive/${VTEST_COMMIT}.tar.gz -> VTest-${VTEST_COMMIT}.tar.gz )"
+	KEYWORDS="~amd64 ~arm64 ~ppc ~x86"
+elif [[ ${PV} == 9999 ]]; then
+	VTEST_DIR="${WORKDIR}/VTest"
+	EGIT_REPO_URI="https://git.haproxy.org/git/haproxy.git/"
+	EGIT_BRANCH=master
+else
+	VTEST_DIR="${WORKDIR}/VTest"
+	EGIT_REPO_URI="https://git.haproxy.org/git/haproxy-$(ver_cut 1-2).git/"
+	EGIT_BRANCH=master
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0/$(ver_cut 1-2)"
+IUSE="+crypt doc examples +slz +net_ns +pcre pcre-jit prometheus-exporter
+ssl systemd test +threads tools zlib lua 51degrees wurfl"
+REQUIRED_USE="pcre-jit? ( pcre )
+	lua? ( ${LUA_REQUIRED_USE} )
+	?? ( slz zlib )"
+RESTRICT="!test? ( test )"
+
+BDEPEND="virtual/pkgconfig"
+DEPEND="
+	crypt? ( virtual/libcrypt:= )
+	pcre? (
+		dev-libs/libpcre2:=
+		pcre-jit? ( dev-libs/libpcre2:=[jit] )
+	)
+	ssl? (
+		dev-libs/openssl:0=
+	)
+	systemd? ( sys-apps/systemd )
+	zlib? ( sys-libs/zlib )
+	lua? ( ${LUA_DEPS} )
+	test? (
+		dev-libs/libpcre2
+		sys-libs/zlib
+	)"
+RDEPEND="${DEPEND}
+	acct-group/haproxy
+	acct-user/haproxy"
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( CHANGELOG CONTRIBUTING MAINTAINERS README )
+EXTRAS=( admin/halog admin/iprange dev/tcploop dev/hpack )
+
+haproxy_use() {
+	(( $# != 2 )) && die "${FUNCNAME} <USE flag> <make option>"
+
+	usex "${1}" "USE_${2}=1" "USE_${2}="
+}
+
+pkg_setup() {
+	use lua && lua-single_pkg_setup
+	if use net_ns; then
+		CONFIG_CHECK="~NET_NS"
+		linux-info_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} != *9999 ]]; then
+		default
+	else
+		git-r3_src_unpack
+		EGIT_REPO_URI="https://github.com/vtest/VTest" EGIT_CHECKOUT_DIR="${VTEST_DIR}" git-r3_src_unpack
+	fi
+}
+
+src_compile() {
+	local -a args=(
+		V=1
+		# Switching to PCRE2 by default, bug 838013
+		PCRE=
+		PCRE_JIT=
+	)
+
+	if use elibc_musl; then
+		args+=( TARGET=linux-musl )
+	else
+		args+=( TARGET=linux-glibc )
+	fi
+
+	# TODO: PCRE2_WIDTH?
+	args+=( $(haproxy_use threads THREAD) )
+	args+=( $(haproxy_use crypt LIBCRYPT) )
+	args+=( $(haproxy_use net_ns NS) )
+	args+=( $(haproxy_use pcre PCRE2) )
+	args+=( $(haproxy_use pcre-jit PCRE2_JIT) )
+	args+=( $(haproxy_use ssl OPENSSL) )
+	args+=( $(haproxy_use slz SLZ) )
+	args+=( $(haproxy_use zlib ZLIB) )
+	args+=( $(haproxy_use lua LUA) )
+	args+=( $(haproxy_use 51degrees 51DEGREES) )
+	args+=( $(haproxy_use wurfl WURFL) )
+	args+=( $(haproxy_use systemd SYSTEMD) )
+	args+=( $(haproxy_use prometheus-exporter PROMEX) )
+
+	# Bug #668002
+	if use ppc || use arm || use hppa; then
+		TARGET_LDFLAGS=-latomic
+	fi
+
+	# HAProxy really needs some of those "SPEC_CFLAGS", like -fno-strict-aliasing
+	emake CFLAGS="${CFLAGS} \$(SPEC_CFLAGS)" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" EXTRA_OBJS="${EXTRA_OBJS}" \
+		TARGET_LDFLAGS="${TARGET_LDFLAGS}" PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]}
+	emake -C admin/systemd CFLAGS="${CFLAGS} \$(SPEC_CFLAGS)" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+		EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) \
+		SBINDIR=/usr/sbin
+
+	if use tools ; then
+		for extra in ${EXTRAS[@]} ; do
+			if [ "${extra}" = "admin/halog" ]; then
+				emake CFLAGS="${CFLAGS} \$(SPEC_CFLAGS)" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+					EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" \
+					PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]} admin/halog/halog
+			elif [ "${extra}" = "dev/hpack" ]; then
+				emake CFLAGS="${CFLAGS} \$(SPEC_CFLAGS)" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+					EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" \
+					PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]} dev/hpack/{decode,gen-enc,gen-rht}
+			else
+				# Those two includes are a workaround for hpack Makefile missing those
+				emake -C ${extra} \
+					CFLAGS="${CFLAGS} -I../../include/ -I../../ebtree/" OPTIMIZE="${CFLAGS}" LDFLAGS="${LDFLAGS}" \
+						CC="$(tc-getCC)" ${args[@]}
+			fi
+		done
+	fi
+}
+
+src_test() {
+	# https://github.com/vtest/VTest/issues/12
+	emake -C "${VTEST_DIR}" CC="$(tc-getCC)" FLAGS="${CFLAGS} -Wno-error=unused-result"
+	ulimit -n 65536 || die "${PN} requires ulimit -n set to at least 65536 for tests"
+	env -u A -u D TMPDIR="/tmp" emake reg-tests -- --v --j "$(makeopts_jobs)" \
+		HAPROXY_PROGRAM="${S}/haproxy" VTEST_PROGRAM="${VTEST_DIR}/vtest" REGTESTS_TYPE="default,bug,devel"
+}
+
+src_install() {
+	dosbin haproxy
+
+	newconfd "${FILESDIR}/${PN}.confd-r1" ${PN}
+	newinitd "${FILESDIR}/${PN}.initd-r9" ${PN}
+
+	doman doc/haproxy.1
+
+	systemd_dounit admin/systemd/haproxy.service
+
+	einstalldocs
+
+	# The errorfiles are used by upstream defaults.
+	insinto /etc/haproxy/errors/
+	doins examples/errorfiles/*
+
+	if use doc; then
+		dodoc doc/*.txt
+		#if use lua; then
+		# TODO: doc/lua-api/
+		#fi
+	fi
+
+	if use tools ; then
+		has admin/halog "${EXTRAS[@]}" && dobin admin/halog/halog
+		has admin/iprange "${EXTRAS[@]}" && {
+			newbin admin/iprange/iprange haproxy_iprange
+			newbin admin/iprange/ip6range haproxy_ip6range
+		}
+		has dev/tcploop "${EXTRAS[@]}" && newbin dev/tcploop/tcploop haproxy_tcploop
+		has dev/hpack "${EXTRAS[@]}" && {
+			newbin dev/hpack/gen-rht haproxy_gen-rht
+			newbin dev/hpack/gen-enc haproxy_gen-enc
+			newbin dev/hpack/decode haproxy_decode
+		}
+	fi
+
+	if use examples ; then
+		docinto examples
+		dodoc examples/*.cfg
+		dodoc doc/seamless_reload.txt
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins admin/syntax-highlight/haproxy.vim
+}
+
+pkg_postinst() {
+	if [[ ! -f "${EROOT}/etc/haproxy/haproxy.cfg" ]] ; then
+		ewarn "You need to create /etc/haproxy/haproxy.cfg before you start the haproxy service."
+		ewarn "It's best practice to not run haproxy as root, user and group haproxy was therefore created."
+		ewarn "Make use of them with the \"user\" and \"group\" directives."
+
+		if [[ -d "${EROOT}/usr/share/doc/${PF}" ]]; then
+			einfo "Please consult the installed documentation for learning the configuration file's syntax."
+			einfo "The documentation and sample configuration files are installed here:"
+			einfo "   ${EROOT}/usr/share/doc/${PF}"
+		fi
+	fi
+}
diff --git a/net-proxy/haproxy/haproxy-3.0.12.ebuild b/net-proxy/haproxy/haproxy-3.0.12.ebuild
new file mode 100644
index 000000000000..8205a410b419
--- /dev/null
+++ b/net-proxy/haproxy/haproxy-3.0.12.ebuild
@@ -0,0 +1,217 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LUA_COMPAT=( lua5-4 lua5-3 )
+
+[[ ${PV} == *9999 ]] && SCM="git-r3"
+inherit toolchain-funcs lua-single systemd linux-info ${SCM} multiprocessing
+
+MY_P="${PN}-${PV/_beta/-dev}"
+
+DESCRIPTION="A TCP/HTTP reverse proxy for high availability environments"
+HOMEPAGE="http://www.haproxy.org"
+if [[ ${PV} != *9999 ]]; then
+	# This is arbitrary; upstream uses master.  Try to update when possible
+	VTEST_COMMIT="af198470d7ce482d3d26eb9ca3f246a438739366"
+	VTEST_DIR="${WORKDIR}/VTest-${VTEST_COMMIT}"
+	SRC_URI="http://haproxy.1wt.eu/download/$(ver_cut 1-2)/src/${MY_P}.tar.gz
+			test? ( https://github.com/vtest/VTest/archive/${VTEST_COMMIT}.tar.gz -> VTest-${VTEST_COMMIT}.tar.gz )"
+	KEYWORDS="~amd64 ~arm64 ~ppc ~x86"
+elif [[ ${PV} == 9999 ]]; then
+	VTEST_DIR="${WORKDIR}/VTest"
+	EGIT_REPO_URI="https://git.haproxy.org/git/haproxy.git/"
+	EGIT_BRANCH=master
+else
+	VTEST_DIR="${WORKDIR}/VTest"
+	EGIT_REPO_URI="https://git.haproxy.org/git/haproxy-$(ver_cut 1-2).git/"
+	EGIT_BRANCH=master
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0/$(ver_cut 1-2)"
+IUSE="+crypt doc examples +slz +net_ns +pcre pcre-jit prometheus-exporter
+ssl systemd test +threads tools zlib lua 51degrees wurfl"
+REQUIRED_USE="pcre-jit? ( pcre )
+	lua? ( ${LUA_REQUIRED_USE} )
+	?? ( slz zlib )"
+RESTRICT="!test? ( test )"
+
+BDEPEND="virtual/pkgconfig"
+DEPEND="
+	crypt? ( virtual/libcrypt:= )
+	pcre? (
+		dev-libs/libpcre2:=
+		pcre-jit? ( dev-libs/libpcre2:=[jit] )
+	)
+	ssl? (
+		dev-libs/openssl:0=
+	)
+	systemd? ( sys-apps/systemd )
+	zlib? ( sys-libs/zlib )
+	lua? ( ${LUA_DEPS} )
+	test? (
+		dev-libs/libpcre2
+		sys-libs/zlib
+	)"
+RDEPEND="${DEPEND}
+	acct-group/haproxy
+	acct-user/haproxy"
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( CHANGELOG CONTRIBUTING MAINTAINERS README )
+EXTRAS=( admin/halog admin/iprange dev/tcploop dev/hpack )
+
+haproxy_use() {
+	(( $# != 2 )) && die "${FUNCNAME} <USE flag> <make option>"
+
+	usex "${1}" "USE_${2}=1" "USE_${2}="
+}
+
+pkg_setup() {
+	use lua && lua-single_pkg_setup
+	if use net_ns; then
+		CONFIG_CHECK="~NET_NS"
+		linux-info_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} != *9999 ]]; then
+		default
+	else
+		git-r3_src_unpack
+		EGIT_REPO_URI="https://github.com/vtest/VTest" EGIT_CHECKOUT_DIR="${VTEST_DIR}" git-r3_src_unpack
+	fi
+}
+
+src_compile() {
+	local -a args=(
+		V=1
+		# Switching to PCRE2 by default, bug 838013
+		PCRE=
+		PCRE_JIT=
+	)
+
+	if use elibc_musl; then
+		args+=( TARGET=linux-musl )
+	else
+		args+=( TARGET=linux-glibc )
+	fi
+
+	# TODO: PCRE2_WIDTH?
+	args+=( $(haproxy_use threads THREAD) )
+	args+=( $(haproxy_use crypt LIBCRYPT) )
+	args+=( $(haproxy_use net_ns NS) )
+	args+=( $(haproxy_use pcre PCRE2) )
+	args+=( $(haproxy_use pcre-jit PCRE2_JIT) )
+	args+=( $(haproxy_use ssl OPENSSL) )
+	args+=( $(haproxy_use slz SLZ) )
+	args+=( $(haproxy_use zlib ZLIB) )
+	args+=( $(haproxy_use lua LUA) )
+	args+=( $(haproxy_use 51degrees 51DEGREES) )
+	args+=( $(haproxy_use wurfl WURFL) )
+	args+=( $(haproxy_use systemd SYSTEMD) )
+	args+=( $(haproxy_use prometheus-exporter PROMEX) )
+
+	# Bug #668002
+	if use ppc || use arm || use hppa; then
+		TARGET_LDFLAGS=-latomic
+	fi
+
+	emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" EXTRA_OBJS="${EXTRA_OBJS}" \
+		TARGET_LDFLAGS="${TARGET_LDFLAGS}" PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]}
+	emake -C admin/systemd CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+		EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) \
+		SBINDIR=/usr/sbin
+
+	if use tools ; then
+		for extra in ${EXTRAS[@]} ; do
+			if [ "${extra}" = "admin/halog" ]; then
+				emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+					EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" \
+					PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]} admin/halog/halog
+			elif [ "${extra}" = "dev/hpack" ]; then
+				emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+					EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" \
+					PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]} dev/hpack/{decode,gen-enc,gen-rht}
+			else
+				# Those two includes are a workaround for hpack Makefile missing those
+				emake -C ${extra} \
+					CFLAGS="${CFLAGS} -I../../include/ -I../../ebtree/" OPTIMIZE="${CFLAGS}" LDFLAGS="${LDFLAGS}" \
+						CC="$(tc-getCC)" ${args[@]}
+			fi
+		done
+	fi
+}
+
+src_test() {
+	# https://github.com/vtest/VTest/issues/12
+	emake -C "${VTEST_DIR}" CC="$(tc-getCC)" FLAGS="${CFLAGS} -Wno-error=unused-result"
+	ulimit -n 65536 || die "${PN} requires ulimit -n set to at least 65536 for tests"
+	env -u A -u D TMPDIR="/tmp" emake reg-tests -- --v --j "$(makeopts_jobs)" \
+		HAPROXY_PROGRAM="${S}/haproxy" VTEST_PROGRAM="${VTEST_DIR}/vtest" REGTESTS_TYPE="default,bug,devel"
+}
+
+src_install() {
+	dosbin haproxy
+
+	newconfd "${FILESDIR}/${PN}.confd-r1" ${PN}
+	newinitd "${FILESDIR}/${PN}.initd-r9" ${PN}
+
+	doman doc/haproxy.1
+
+	systemd_dounit admin/systemd/haproxy.service
+
+	einstalldocs
+
+	# The errorfiles are used by upstream defaults.
+	insinto /etc/haproxy/errors/
+	doins examples/errorfiles/*
+
+	if use doc; then
+		dodoc doc/*.txt
+		#if use lua; then
+		# TODO: doc/lua-api/
+		#fi
+	fi
+
+	if use tools ; then
+		has admin/halog "${EXTRAS[@]}" && dobin admin/halog/halog
+		has admin/iprange "${EXTRAS[@]}" && {
+			newbin admin/iprange/iprange haproxy_iprange
+			newbin admin/iprange/ip6range haproxy_ip6range
+		}
+		has dev/tcploop "${EXTRAS[@]}" && newbin dev/tcploop/tcploop haproxy_tcploop
+		has dev/hpack "${EXTRAS[@]}" && {
+			newbin dev/hpack/gen-rht haproxy_gen-rht
+			newbin dev/hpack/gen-enc haproxy_gen-enc
+			newbin dev/hpack/decode haproxy_decode
+		}
+	fi
+
+	if use examples ; then
+		docinto examples
+		dodoc examples/*.cfg
+		dodoc doc/seamless_reload.txt
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins admin/syntax-highlight/haproxy.vim
+}
+
+pkg_postinst() {
+	if [[ ! -f "${EROOT}/etc/haproxy/haproxy.cfg" ]] ; then
+		ewarn "You need to create /etc/haproxy/haproxy.cfg before you start the haproxy service."
+		ewarn "It's best practice to not run haproxy as root, user and group haproxy was therefore created."
+		ewarn "Make use of them with the \"user\" and \"group\" directives."
+
+		if [[ -d "${EROOT}/usr/share/doc/${PF}" ]]; then
+			einfo "Please consult the installed documentation for learning the configuration file's syntax."
+			einfo "The documentation and sample configuration files are installed here:"
+			einfo "   ${EROOT}/usr/share/doc/${PF}"
+		fi
+	fi
+}
diff --git a/net-proxy/haproxy/haproxy-3.1.9.ebuild b/net-proxy/haproxy/haproxy-3.1.9.ebuild
new file mode 100644
index 000000000000..ea3c85bbd20c
--- /dev/null
+++ b/net-proxy/haproxy/haproxy-3.1.9.ebuild
@@ -0,0 +1,216 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LUA_COMPAT=( lua5-4 lua5-3 )
+
+[[ ${PV} == *9999 ]] && SCM="git-r3"
+inherit toolchain-funcs lua-single systemd linux-info ${SCM} multiprocessing
+
+MY_P="${PN}-${PV/_beta/-dev}"
+
+DESCRIPTION="A TCP/HTTP reverse proxy for high availability environments"
+HOMEPAGE="http://www.haproxy.org"
+if [[ ${PV} != *9999 ]]; then
+	# This is arbitrary; upstream uses master.  Try to update when possible
+	VTEST_COMMIT="af198470d7ce482d3d26eb9ca3f246a438739366"
+	VTEST_DIR="${WORKDIR}/VTest-${VTEST_COMMIT}"
+	SRC_URI="http://haproxy.1wt.eu/download/$(ver_cut 1-2)/src/${MY_P}.tar.gz
+			test? ( https://github.com/vtest/VTest/archive/${VTEST_COMMIT}.tar.gz -> VTest-${VTEST_COMMIT}.tar.gz )"
+	KEYWORDS="~amd64 ~arm64 ~ppc ~x86"
+elif [[ ${PV} == 9999 ]]; then
+	VTEST_DIR="${WORKDIR}/VTest"
+	EGIT_REPO_URI="https://git.haproxy.org/git/haproxy.git/"
+	EGIT_BRANCH=master
+else
+	VTEST_DIR="${WORKDIR}/VTest"
+	EGIT_REPO_URI="https://git.haproxy.org/git/haproxy-$(ver_cut 1-2).git/"
+	EGIT_BRANCH=master
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0/$(ver_cut 1-2)"
+IUSE="+crypt doc examples +slz +net_ns +pcre pcre-jit prometheus-exporter
+ssl systemd test +threads tools zlib lua 51degrees wurfl"
+REQUIRED_USE="pcre-jit? ( pcre )
+	lua? ( ${LUA_REQUIRED_USE} )
+	?? ( slz zlib )"
+RESTRICT="!test? ( test )"
+
+BDEPEND="virtual/pkgconfig"
+DEPEND="
+	crypt? ( virtual/libcrypt:= )
+	pcre? (
+		dev-libs/libpcre2:=
+		pcre-jit? ( dev-libs/libpcre2:=[jit] )
+	)
+	ssl? (
+		dev-libs/openssl:0=
+	)
+	systemd? ( sys-apps/systemd )
+	zlib? ( sys-libs/zlib )
+	lua? ( ${LUA_DEPS} )
+	test? (
+		dev-libs/libpcre2
+		sys-libs/zlib
+	)"
+RDEPEND="${DEPEND}
+	acct-group/haproxy
+	acct-user/haproxy"
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( CHANGELOG CONTRIBUTING MAINTAINERS )
+EXTRAS=( admin/halog admin/iprange dev/tcploop dev/hpack )
+
+haproxy_use() {
+	(( $# != 2 )) && die "${FUNCNAME} <USE flag> <make option>"
+
+	usex "${1}" "USE_${2}=1" "USE_${2}="
+}
+
+pkg_setup() {
+	use lua && lua-single_pkg_setup
+	if use net_ns; then
+		CONFIG_CHECK="~NET_NS"
+		linux-info_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} != *9999 ]]; then
+		default
+	else
+		git-r3_src_unpack
+		EGIT_REPO_URI="https://github.com/vtest/VTest" EGIT_CHECKOUT_DIR="${VTEST_DIR}" git-r3_src_unpack
+	fi
+}
+
+src_compile() {
+	local -a args=(
+		V=1
+		# Switching to PCRE2 by default, bug 838013
+		PCRE=
+		PCRE_JIT=
+	)
+
+	if use elibc_musl; then
+		args+=( TARGET=linux-musl )
+	else
+		args+=( TARGET=linux-glibc )
+	fi
+
+	# TODO: PCRE2_WIDTH?
+	args+=( $(haproxy_use threads THREAD) )
+	args+=( $(haproxy_use crypt LIBCRYPT) )
+	args+=( $(haproxy_use net_ns NS) )
+	args+=( $(haproxy_use pcre PCRE2) )
+	args+=( $(haproxy_use pcre-jit PCRE2_JIT) )
+	args+=( $(haproxy_use ssl OPENSSL) )
+	args+=( $(haproxy_use slz SLZ) )
+	args+=( $(haproxy_use zlib ZLIB) )
+	args+=( $(haproxy_use lua LUA) )
+	args+=( $(haproxy_use 51degrees 51DEGREES) )
+	args+=( $(haproxy_use wurfl WURFL) )
+	args+=( $(haproxy_use prometheus-exporter PROMEX) )
+
+	# Bug #668002
+	if use ppc || use arm || use hppa; then
+		TARGET_LDFLAGS=-latomic
+	fi
+
+	emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" EXTRA_OBJS="${EXTRA_OBJS}" \
+		TARGET_LDFLAGS="${TARGET_LDFLAGS}" PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]}
+	emake -C admin/systemd CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+		EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) \
+		SBINDIR=/usr/sbin
+
+	if use tools ; then
+		for extra in ${EXTRAS[@]} ; do
+			if [ "${extra}" = "admin/halog" ]; then
+				emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+					EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" \
+					PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]} admin/halog/halog
+			elif [ "${extra}" = "dev/hpack" ]; then
+				emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+					EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" \
+					PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]} dev/hpack/{decode,gen-enc,gen-rht}
+			else
+				# Those two includes are a workaround for hpack Makefile missing those
+				emake -C ${extra} \
+					CFLAGS="${CFLAGS} -I../../include/ -I../../ebtree/" OPTIMIZE="${CFLAGS}" LDFLAGS="${LDFLAGS}" \
+						CC="$(tc-getCC)" ${args[@]}
+			fi
+		done
+	fi
+}
+
+src_test() {
+	# https://github.com/vtest/VTest/issues/12
+	emake -C "${VTEST_DIR}" CC="$(tc-getCC)" FLAGS="${CFLAGS} -Wno-error=unused-result"
+	ulimit -n 65536 || die "${PN} requires ulimit -n set to at least 65536 for tests"
+	env -u A -u D TMPDIR="/tmp" emake reg-tests -- --v --j "$(makeopts_jobs)" \
+		HAPROXY_PROGRAM="${S}/haproxy" VTEST_PROGRAM="${VTEST_DIR}/vtest" REGTESTS_TYPE="default,bug,devel"
+}
+
+src_install() {
+	dosbin haproxy
+
+	newconfd "${FILESDIR}/${PN}.confd-r1" ${PN}
+	newinitd "${FILESDIR}/${PN}.initd-r9" ${PN}
+
+	doman doc/haproxy.1
+
+	systemd_dounit admin/systemd/haproxy.service
+
+	einstalldocs
+
+	# The errorfiles are used by upstream defaults.
+	insinto /etc/haproxy/errors/
+	doins examples/errorfiles/*
+
+	if use doc; then
+		dodoc doc/*.txt
+		#if use lua; then
+		# TODO: doc/lua-api/
+		#fi
+	fi
+
+	if use tools ; then
+		has admin/halog "${EXTRAS[@]}" && dobin admin/halog/halog
+		has admin/iprange "${EXTRAS[@]}" && {
+			newbin admin/iprange/iprange haproxy_iprange
+			newbin admin/iprange/ip6range haproxy_ip6range
+		}
+		has dev/tcploop "${EXTRAS[@]}" && newbin dev/tcploop/tcploop haproxy_tcploop
+		has dev/hpack "${EXTRAS[@]}" && {
+			newbin dev/hpack/gen-rht haproxy_gen-rht
+			newbin dev/hpack/gen-enc haproxy_gen-enc
+			newbin dev/hpack/decode haproxy_decode
+		}
+	fi
+
+	if use examples ; then
+		docinto examples
+		dodoc examples/*.cfg
+		dodoc doc/seamless_reload.txt
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins admin/syntax-highlight/haproxy.vim
+}
+
+pkg_postinst() {
+	if [[ ! -f "${EROOT}/etc/haproxy/haproxy.cfg" ]] ; then
+		ewarn "You need to create /etc/haproxy/haproxy.cfg before you start the haproxy service."
+		ewarn "It's best practice to not run haproxy as root, user and group haproxy was therefore created."
+		ewarn "Make use of them with the \"user\" and \"group\" directives."
+
+		if [[ -d "${EROOT}/usr/share/doc/${PF}" ]]; then
+			einfo "Please consult the installed documentation for learning the configuration file's syntax."
+			einfo "The documentation and sample configuration files are installed here:"
+			einfo "   ${EROOT}/usr/share/doc/${PF}"
+		fi
+	fi
+}
diff --git a/net-proxy/haproxy/haproxy-3.2.6.ebuild b/net-proxy/haproxy/haproxy-3.2.6.ebuild
new file mode 100644
index 000000000000..ea3c85bbd20c
--- /dev/null
+++ b/net-proxy/haproxy/haproxy-3.2.6.ebuild
@@ -0,0 +1,216 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LUA_COMPAT=( lua5-4 lua5-3 )
+
+[[ ${PV} == *9999 ]] && SCM="git-r3"
+inherit toolchain-funcs lua-single systemd linux-info ${SCM} multiprocessing
+
+MY_P="${PN}-${PV/_beta/-dev}"
+
+DESCRIPTION="A TCP/HTTP reverse proxy for high availability environments"
+HOMEPAGE="http://www.haproxy.org"
+if [[ ${PV} != *9999 ]]; then
+	# This is arbitrary; upstream uses master.  Try to update when possible
+	VTEST_COMMIT="af198470d7ce482d3d26eb9ca3f246a438739366"
+	VTEST_DIR="${WORKDIR}/VTest-${VTEST_COMMIT}"
+	SRC_URI="http://haproxy.1wt.eu/download/$(ver_cut 1-2)/src/${MY_P}.tar.gz
+			test? ( https://github.com/vtest/VTest/archive/${VTEST_COMMIT}.tar.gz -> VTest-${VTEST_COMMIT}.tar.gz )"
+	KEYWORDS="~amd64 ~arm64 ~ppc ~x86"
+elif [[ ${PV} == 9999 ]]; then
+	VTEST_DIR="${WORKDIR}/VTest"
+	EGIT_REPO_URI="https://git.haproxy.org/git/haproxy.git/"
+	EGIT_BRANCH=master
+else
+	VTEST_DIR="${WORKDIR}/VTest"
+	EGIT_REPO_URI="https://git.haproxy.org/git/haproxy-$(ver_cut 1-2).git/"
+	EGIT_BRANCH=master
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0/$(ver_cut 1-2)"
+IUSE="+crypt doc examples +slz +net_ns +pcre pcre-jit prometheus-exporter
+ssl systemd test +threads tools zlib lua 51degrees wurfl"
+REQUIRED_USE="pcre-jit? ( pcre )
+	lua? ( ${LUA_REQUIRED_USE} )
+	?? ( slz zlib )"
+RESTRICT="!test? ( test )"
+
+BDEPEND="virtual/pkgconfig"
+DEPEND="
+	crypt? ( virtual/libcrypt:= )
+	pcre? (
+		dev-libs/libpcre2:=
+		pcre-jit? ( dev-libs/libpcre2:=[jit] )
+	)
+	ssl? (
+		dev-libs/openssl:0=
+	)
+	systemd? ( sys-apps/systemd )
+	zlib? ( sys-libs/zlib )
+	lua? ( ${LUA_DEPS} )
+	test? (
+		dev-libs/libpcre2
+		sys-libs/zlib
+	)"
+RDEPEND="${DEPEND}
+	acct-group/haproxy
+	acct-user/haproxy"
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( CHANGELOG CONTRIBUTING MAINTAINERS )
+EXTRAS=( admin/halog admin/iprange dev/tcploop dev/hpack )
+
+haproxy_use() {
+	(( $# != 2 )) && die "${FUNCNAME} <USE flag> <make option>"
+
+	usex "${1}" "USE_${2}=1" "USE_${2}="
+}
+
+pkg_setup() {
+	use lua && lua-single_pkg_setup
+	if use net_ns; then
+		CONFIG_CHECK="~NET_NS"
+		linux-info_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} != *9999 ]]; then
+		default
+	else
+		git-r3_src_unpack
+		EGIT_REPO_URI="https://github.com/vtest/VTest" EGIT_CHECKOUT_DIR="${VTEST_DIR}" git-r3_src_unpack
+	fi
+}
+
+src_compile() {
+	local -a args=(
+		V=1
+		# Switching to PCRE2 by default, bug 838013
+		PCRE=
+		PCRE_JIT=
+	)
+
+	if use elibc_musl; then
+		args+=( TARGET=linux-musl )
+	else
+		args+=( TARGET=linux-glibc )
+	fi
+
+	# TODO: PCRE2_WIDTH?
+	args+=( $(haproxy_use threads THREAD) )
+	args+=( $(haproxy_use crypt LIBCRYPT) )
+	args+=( $(haproxy_use net_ns NS) )
+	args+=( $(haproxy_use pcre PCRE2) )
+	args+=( $(haproxy_use pcre-jit PCRE2_JIT) )
+	args+=( $(haproxy_use ssl OPENSSL) )
+	args+=( $(haproxy_use slz SLZ) )
+	args+=( $(haproxy_use zlib ZLIB) )
+	args+=( $(haproxy_use lua LUA) )
+	args+=( $(haproxy_use 51degrees 51DEGREES) )
+	args+=( $(haproxy_use wurfl WURFL) )
+	args+=( $(haproxy_use prometheus-exporter PROMEX) )
+
+	# Bug #668002
+	if use ppc || use arm || use hppa; then
+		TARGET_LDFLAGS=-latomic
+	fi
+
+	emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" EXTRA_OBJS="${EXTRA_OBJS}" \
+		TARGET_LDFLAGS="${TARGET_LDFLAGS}" PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]}
+	emake -C admin/systemd CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+		EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) \
+		SBINDIR=/usr/sbin
+
+	if use tools ; then
+		for extra in ${EXTRAS[@]} ; do
+			if [ "${extra}" = "admin/halog" ]; then
+				emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+					EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" \
+					PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]} admin/halog/halog
+			elif [ "${extra}" = "dev/hpack" ]; then
+				emake CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" CC="$(tc-getCC)" \
+					EXTRA_OBJS="${EXTRA_OBJS}" TARGET_LDFLAGS="${TARGET_LDFLAGS}" \
+					PCRE_LIB="${ESYSROOT}"/usr/$(get_libdir) ${args[@]} dev/hpack/{decode,gen-enc,gen-rht}
+			else
+				# Those two includes are a workaround for hpack Makefile missing those
+				emake -C ${extra} \
+					CFLAGS="${CFLAGS} -I../../include/ -I../../ebtree/" OPTIMIZE="${CFLAGS}" LDFLAGS="${LDFLAGS}" \
+						CC="$(tc-getCC)" ${args[@]}
+			fi
+		done
+	fi
+}
+
+src_test() {
+	# https://github.com/vtest/VTest/issues/12
+	emake -C "${VTEST_DIR}" CC="$(tc-getCC)" FLAGS="${CFLAGS} -Wno-error=unused-result"
+	ulimit -n 65536 || die "${PN} requires ulimit -n set to at least 65536 for tests"
+	env -u A -u D TMPDIR="/tmp" emake reg-tests -- --v --j "$(makeopts_jobs)" \
+		HAPROXY_PROGRAM="${S}/haproxy" VTEST_PROGRAM="${VTEST_DIR}/vtest" REGTESTS_TYPE="default,bug,devel"
+}
+
+src_install() {
+	dosbin haproxy
+
+	newconfd "${FILESDIR}/${PN}.confd-r1" ${PN}
+	newinitd "${FILESDIR}/${PN}.initd-r9" ${PN}
+
+	doman doc/haproxy.1
+
+	systemd_dounit admin/systemd/haproxy.service
+
+	einstalldocs
+
+	# The errorfiles are used by upstream defaults.
+	insinto /etc/haproxy/errors/
+	doins examples/errorfiles/*
+
+	if use doc; then
+		dodoc doc/*.txt
+		#if use lua; then
+		# TODO: doc/lua-api/
+		#fi
+	fi
+
+	if use tools ; then
+		has admin/halog "${EXTRAS[@]}" && dobin admin/halog/halog
+		has admin/iprange "${EXTRAS[@]}" && {
+			newbin admin/iprange/iprange haproxy_iprange
+			newbin admin/iprange/ip6range haproxy_ip6range
+		}
+		has dev/tcploop "${EXTRAS[@]}" && newbin dev/tcploop/tcploop haproxy_tcploop
+		has dev/hpack "${EXTRAS[@]}" && {
+			newbin dev/hpack/gen-rht haproxy_gen-rht
+			newbin dev/hpack/gen-enc haproxy_gen-enc
+			newbin dev/hpack/decode haproxy_decode
+		}
+	fi
+
+	if use examples ; then
+		docinto examples
+		dodoc examples/*.cfg
+		dodoc doc/seamless_reload.txt
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins admin/syntax-highlight/haproxy.vim
+}
+
+pkg_postinst() {
+	if [[ ! -f "${EROOT}/etc/haproxy/haproxy.cfg" ]] ; then
+		ewarn "You need to create /etc/haproxy/haproxy.cfg before you start the haproxy service."
+		ewarn "It's best practice to not run haproxy as root, user and group haproxy was therefore created."
+		ewarn "Make use of them with the \"user\" and \"group\" directives."
+
+		if [[ -d "${EROOT}/usr/share/doc/${PF}" ]]; then
+			einfo "Please consult the installed documentation for learning the configuration file's syntax."
+			einfo "The documentation and sample configuration files are installed here:"
+			einfo "   ${EROOT}/usr/share/doc/${PF}"
+		fi
+	fi
+}