●Change8

v3.3-dev11

📦 haproxyView on GitHub →
✨ 35 features🐛 35 fixes🔧 28 symbols

Summary

This release introduces new features for QUIC, SSL/ECH, and stick-tables, alongside numerous bug fixes across various modules. Key changes include improved QUIC option handling, enhanced SSL certificate management, and more robust stick-table operations.

Migration Steps

  1. Rename "no-quic" to "tune.quic.listen"

✨ New Features

  • Add a new initcall stage, STG_INIT_2
  • Use a per-shard expiration task for stick-tables
  • Extract common types for ncbuf
  • Define new ncbmbuf type
  • Implement add for ncbmbuf
  • Implement iterator bitmap utilities functions for ncbmbuf
  • Implement ncbmbuf_data()
  • Implement advance operation for ncbmbuf
  • Add tests for ncbmbuf in standalone mode
  • Remove received CRYPTO temporary tree storage for QUIC
  • Add FIXED_SIZE(size, type, name) macro for compiler
  • Use explicit-size types for freq-ctr struct
  • Add the dns-01-record field to the ACME sink
  • Display the complete challenge_ready command in ACME logs
  • Remove unused conn-tx-buffers limit keyword for QUIC
  • Prepare support for options on FE/BE side for QUIC
  • Rename "no-quic" to "tune.quic.listen"
  • Duplicate glitches FE option on BE side for QUIC
  • Split congestion controler options for FE/BE usage for QUIC
  • Split Tx options for FE/BE usage for QUIC
  • Rename max Tx mem setting for QUIC
  • Rename retry-threshold setting for QUIC
  • Rename frontend sock-per-conn setting for QUIC
  • Add certificate password callback that calls external command for SSL
  • Add local passphrase cache for SSL
  • Do not dump decrypted privkeys in 'dump ssl cert'
  • Add ssl_fc_early_rcvd() to detect use of early data in ssl-sample
  • Make devnullfd global and create it earlier in init
  • Use devnullfd in stdio_quiet calls instead of recreating a fd everytime
  • Add ECH configuration and key loading for SSL/ECH
  • Add logging and sample fetches for ECH status and outer SNI for SSL/ECH
  • Implement bind_conf_find_by_name() for listener
  • Key management via stats socket for SSL/ECH
  • Do not needlessly refrain from sending data early for mux-h2
  • Extract the code to send preface+settings into its own function for mux-h2

🐛 Bug Fixes

  • Make sure not to unlock the element twice in mt_list
  • Handle unchecked connections during handshakes in quic-be
  • Free the trash chunk on the error path in cli
  • Don't set HTX_FL_EOM flag on 1xx informational messages in h1-htx
  • Properly encode response after interim one in same buf in h3
  • Fix default pool alignment in pools
  • Use ncbmbuf for CRYPTO handling in QUIC
  • Fix typo in shm-stats-file object struct size detection
  • Ensure shm_stats_file_object struct mapping consistency in stats-file (2nd attempt)
  • Limit excessive and counter-productive gcc-15 vectorization in build
  • Don't loop if there's nothing left in stick-tables
  • Avoid el->prev = el->next = el in mt_lists
  • Improve again spinning loops detection with the new API in applet
  • Properly index string-type keys in stick-tables
  • Use atomic operations to prevent compiler optims in mt_list
  • Fix build with openssl-compat for QUIC
  • Do not put SE_FL_WANT_ROOM on rcv_buf() if the channel is empty in applet
  • Create cli_raw_rcv_buf() from the generic applet_raw_rcv_buf() in cli
  • Do not return ACKs one char at a time in cli
  • Crash because of dangling ckch_store reference in a ckch instance in ssl
  • Remove unreachable code in CLI function in ssl
  • Warn if "_sub" derivative used with an explicit match in acl
  • Fix 405, 431, 501 default errorfile in http
  • Do not close previously created fd in stdio_quiet in init
  • Apply dns-accept-family setting on additional records in resolvers
  • Returns when SSL_CTX_new failed during init in ssl
  • Non destructive parsing in cli_find_ech_specific_ctx() in ech
  • Split max-idle-timeout option for FE/BE usage in quic
  • Split option for congestion max window size in quic
  • Rename and duplicate stream settings in quic
  • Fix build failure with OPENSSL=0 and KTLS=1 in openssl-compat
  • Ensure shm_stats_file_object struct mapping consistency in stats-file (reverted and re-applied)
  • Use explicit-size types for freq-ctr struct (reverted and re-applied)
  • Add FIXED_SIZE(size, type, name) macro (reverted and re-applied)
  • Send the preface along with the first request if needed in mux-h2

Affected Symbols

mt_listquic-becliinitcallsstick-tablesh1-htxh3poolsncbufncbmbufquicstats-filecompilerfreq-ctrbuildacmemt_listsappletopenssl-compatsslaclresolvershttpinitssl-samplelistenerssl/echmux-h2