●Change8

v3.3-dev10

Breaking Changes
📦 haproxyView on GitHub →
⚠ 4 breaking✨ 23 features🐛 29 fixes🔧 31 symbols

Summary

This release introduces significant changes to proxy behavior with abortonclose enabled by default for HTTP and TLS listeners. It also includes numerous bug fixes, performance improvements related to data handling, and enhancements to JWT and SSL functionalities.

⚠️ Breaking Changes

  • MAJOR: proxy: enable abortonclose by default on HTTP proxies. This change enables the abortonclose feature by default for HTTP proxies, which may affect existing configurations if this behavior is not desired. To revert to the previous behavior, explicitly set 'abortonclose' to 'disabled' in your frontend configuration.
  • MAJOR: proxy: enable abortonclose by default on TLS listeners. Similar to HTTP proxies, this change enables abortonclose by default for TLS listeners. To maintain previous behavior, explicitly set 'abortonclose' to 'disabled' in your listener configuration.
  • MEDIUM: jwt: Remove certificate support in jwt_verify converter. The `jwt_verify` converter no longer supports certificate verification. Use the new `jwt_verify_cert` converter for this functionality.
  • MEDIUM: htx: Remove the HTX extra field. The HTX extra field has been removed. Code relying on this field for data transfer, such as body size or message formatting, needs to be updated to use the `<kip>` or `<kop>` values instead.

Migration Steps

  1. If your configuration relies on the HTX extra field for data transfer (e.g., body size, message formatting), update your code to use the `<kip>` or `<kop>` values instead.
  2. If you were explicitly disabling `abortonclose` on HTTP proxies or TLS listeners, you may need to update your configuration to reflect the new default behavior or explicitly re-enable the previous behavior if desired.

✨ New Features

  • MINOR: proxy: explicitly permit abortonclose on frontends and clarify the doc
  • MINOR: proxy: introduce proxy_abrt_close_def() to pass the desired default
  • MINOR: h3/qmux: Set QC_SF_UNKNOWN_PL_LENGTH flag on QCS when headers are sent
  • MINOR: stconn: Add two fields in sedesc to replace the HTX extra value
  • MINOR: h1-htx: Increment body len when parsing a payload with no xfer length
  • MINOR: mux-h1: Set known input payload length during demux
  • MINOR: mux-fcgi: Set known input payload length during demux
  • MINOR: mux-h2: Use <body_len> H2S field for payload without content-length
  • MINOR: mux-h2: Set known input payload length of the sedesc
  • MINOR: h3: Set known input payload length of the sedesc
  • MINOR: stconn: Move data from kip to kop when data are sent to the consumer
  • MINOR: filters: Reset knwon input payload length if a data filter is used
  • MINOR: hlua/http-fetch: Use <kip> instead of HTX extra field to get body size
  • MINOR: cache: Use the <kip> value to check too big objects
  • MINOR: compression: Use the <kip> value to check body size
  • MINOR: jwt: Add new jwt_verify_cert converter
  • MINOR: jwt: Add new "jwt" certificate option
  • MINOR: jwt: Add specific error code for known but unavailable certificate
  • MINOR: ssl: Dump options in "show ssl cert"
  • MINOR: jwt: Add new "add/del/show ssl jwt" CLI commands
  • MINOR: regex: use a thread-local match pointer for pcre2
  • MINOR: config: remove experimental status on tune.disable-fast-forward
  • MINOR: tree-wide: add missing TAINTED flags for some experimental directives

🐛 Bug Fixes

  • BUG/MEDIUM: connections: Only avoid creating a mux if we have one
  • BUG/MINOR: sink: retry attempt for sft server may never occur
  • BUG/MINOR: http-ana: Reset analyse_exp date after 'wait-for-body' action
  • BUG/MINOR: acme: avoid overflow when diff > notAfter
  • REGTESTS: fix h2_desync_attacks to wait for the response
  • REGTESTS: http-messaging: fix the websocket and upgrade tests not to close early
  • BUG/MINOR: acme: memory leak from the config parser
  • BUG/MEDIUM: ssl: take care of second client hello
  • BUG/MINOR: ssl: always clear the remains of the first hello for the second one
  • BUG/MEDIUM: stconn: Properly forward kip to the opposite SE descriptor
  • BUG/MINOR: ssl: leak in ssl-f-use
  • BUG/MINOR: ssl: leak crtlist_name in ssl-f-use
  • BUG/MEDIUM: apppet: Improve spinning loop detection with the new API
  • BUG/MINOR: ssl: Free global_ssl structure contents during deinit
  • BUG/MINOR: ssl: Free key_base from global_ssl structure during deinit
  • BUG/MINOR: ssl: Potential NULL deref in trace macro
  • BUG/MEDIUM: pools: fix bad freeing of aligned pools in UAF mode
  • BUG/MEDIUM: pools: detect() when munmap() fails in UAF mode
  • TESTS: quic: useless param for b_quic_dec_int()
  • BUG/MEDIUM: pools: fix crash on filtered "show pools" output
  • BUG/MINOR: pools: don't report "limited to the first X entries" by default
  • BUG/MAJOR: lb-chash: fix key calculation when using default hash-key id
  • BUG/MEDIUM: stick-tables: Don't forget to dec count on failure.
  • BUG/MINOR: quic: check applet_putchk() for 'show quic' first line
  • TESTS: quic: fix uninit of quic_cc_path const member
  • BUG/MAJOR: quic: uninitialized quic_conn_closed struct members
  • BUG/MAJOR: quic: do not reset QUIC backends fds in closing state
  • BUG/MINOR: quic: SSL counters not handled
  • BUG/MEDIUM: threads/config: drop absent threads from thread groups

Affected Symbols

connectionssinkmjsonhttp-anaacmepatchbotproxyh2_desync_attackshttp-messagingh3/qmuxstconnh1-htxmux-h1mux-fcgimux-h2hlua/http-fetchcachecompressionhtxsslappletjwtregexpcre2poolslb-chashstick-tablesquiccirrus-cimakefiletune.disable-fast-forward