Change8

v3.4-dev14

📦 haproxyView on GitHub →
13 features🐛 58 fixes🔧 39 symbols

Summary

Version 3.4-dev14 introduces several bug fixes and minor improvements across various modules, including networking, SSL, and HTTP handling. It also enhances the random number generation for security-sensitive operations and improves QUIC and H3 protocol support.

Migration Steps

  1. BUILD: proxy: unstatify the proxies_del_lock to avoid a warning without threads
  2. CLEANUP: resolvers: use read_n32() instead of open-coded big-endian read
  3. CLEANUP: resolvers: remove pool_free(NULL) in SRV additional record matching
  4. CLEANUP: resolvers: fix comment typos and wrong filenames in file headers
  5. init: fall back to ha_random64_pair_hashed() for the cluster secret
  6. tools: use the hashed random pair for UUID generation
  7. h1: use ha_random64_pair_hashed() for the WebSocket key
  8. quic: use ha_random64_pair_hashed() to generate the QUIC retry tokens
  9. tools: switch the main PRNG to a thread-local xoshiro256**
  10. CLEANUP: mux-fcgi/mux-spop: Remove copy/pasted comment about slow realign

✨ New Features

  • config: shm-stats-file is no longer experimental
  • connection: define xprt_add_l6hs()
  • xprt_qmux: define default value for get_alpn
  • connection: define mask CO_FL_WAIT_XPRT_L6
  • session: support QMux in clear on FE side
  • backend: support QMux in clear for BE side
  • mux_quic: handle STOP_SENDING in QMux
  • mux_quic: handle MAX_STREAMS for uni stream in QMux
  • haterm: enable h3 for TCP bindings
  • haterm: do not emit a warning when not using SSL
  • http: Add function to remove all occurrences of a value in a header
  • h1: Add a H1M flag to specify a non-empty 'Upgrade:' header was parsed
  • tools: provide a function to generate a hashed random pair

🐛 Bug Fixes

  • net_helper: fix a remaining possibly infinite loop in converters
  • ssl_sock: remove unneeded check on QMux flags
  • ocsp: Manage date too far away in the future
  • mux_quic: do not crash on unhandled QMux frame reception
  • applet: Properly handle receives of size 0
  • resolvers: Fix test on dn label size in resolv_dn_label_to_str()
  • ssl-gencert: Unlock LRU cache if failing to generate certificate
  • quic: fix ODCID lookup from derived value
  • dict: hold lock while decrementing refcount in dict_entry_unref
  • tcpchecks: Limit parsing of agent-check reply to the buffer
  • hlua: Fix integer underflow when receiving line from lua cosocket
  • cli: Fix parsing of pattern finishing a command payload
  • acme: NUL terminate response buffer before PEM parsing
  • intops: mask the fail value in array_size_or_fail()
  • log-forward: make sure the month is unsigned
  • regex: allocate a large enough pcre2 match for all matches
  • tcpcheck/spoe: bound the SPOP error code to valid values
  • cache: fix a refcount leak for missed secondary entries
  • log: free logformat expr on compile failure in cfg_parse_log_profile
  • resolvers: fix room for trailing zero in resolv_dn_label_to_str()
  • resolvers: fix risk of appending garbage past the domain name
  • mux-h2: validate HEADERS frame length before reading stream dep
  • log: look for the end of priority before the end of the buffer
  • dict: fix refcount race on insert collision
  • init: use more than ha_random64() for the cluster secret
  • sample: limit the be2hex converter's chunk size
  • haterm: fix the random suffix multiplication
  • h1: drop headers whose names contain invalid chars
  • h1: limit status codes to 3 digits by default
  • cache: always verify the primary hash in get_secondary_entry()
  • cache: also recognize directives in the form "token="
  • resolvers: relax size checks in authority record parsing
  • sample: request an extra output byte for the url_dec converter
  • http-fetch: check against the whole token in get_http_auth()
  • acme: protect against risk of null-deref on connection failure
  • http-ext: always check remaining data when reading rfc7239 nodeport
  • base64: return empty string for empty input in base64dec()
  • payload: fix the handshake length bounds check smp_client_hello_parse()
  • ssl-hello: make use of the null-terminated servername
  • resolvers: switch to a better PRNG for query IDs
  • addons/51d: NUL-terminate headers before passing them to Trie API
  • tools: insert an XXH64 layer on the PRNG output
  • h3: reject client push stream
  • h3: reject server push stream
  • h3: reject client CANCEL_PUSH frame
  • h3: adjust error on PUSH_PROMISE frame reception
  • h3: reject server MAX_PUSH_ID frame
  • auth: fix unconfigured password NULL deref
  • h3: add missing break on rcv_buf()
  • hlua: prevent Lua from passing CR/LF/NUL in HTTP headers
  • qmux: do not crash on frame parsing issue
  • quic: reject packet too short for HP decryption
  • jwe: enforce GCM tag length to 128 bits
  • jwe: substitute random CEK on RSA1_5 decryption failure per RFC 7516 #11.5
  • mux-fcgi: reject stream ID 0 for application records
  • h1-htx: Sanitize parsing to properly handle upgrade requests
  • mux-fcgi: Use relative offset to compute contig data in demux buf
  • mux-spop: Use relative offset to compute contig data in demux buf

Affected Symbols