v3.4-dev14
📦 haproxyView on GitHub →
✨ 13 features🐛 58 fixes🔧 39 symbols
Summary
Version 3.4-dev14 introduces several bug fixes and minor improvements across various modules, including networking, SSL, and HTTP handling. It also enhances the random number generation for security-sensitive operations and improves QUIC and H3 protocol support.
Migration Steps
- BUILD: proxy: unstatify the proxies_del_lock to avoid a warning without threads
- CLEANUP: resolvers: use read_n32() instead of open-coded big-endian read
- CLEANUP: resolvers: remove pool_free(NULL) in SRV additional record matching
- CLEANUP: resolvers: fix comment typos and wrong filenames in file headers
- init: fall back to ha_random64_pair_hashed() for the cluster secret
- tools: use the hashed random pair for UUID generation
- h1: use ha_random64_pair_hashed() for the WebSocket key
- quic: use ha_random64_pair_hashed() to generate the QUIC retry tokens
- tools: switch the main PRNG to a thread-local xoshiro256**
- CLEANUP: mux-fcgi/mux-spop: Remove copy/pasted comment about slow realign
✨ New Features
- config: shm-stats-file is no longer experimental
- connection: define xprt_add_l6hs()
- xprt_qmux: define default value for get_alpn
- connection: define mask CO_FL_WAIT_XPRT_L6
- session: support QMux in clear on FE side
- backend: support QMux in clear for BE side
- mux_quic: handle STOP_SENDING in QMux
- mux_quic: handle MAX_STREAMS for uni stream in QMux
- haterm: enable h3 for TCP bindings
- haterm: do not emit a warning when not using SSL
- http: Add function to remove all occurrences of a value in a header
- h1: Add a H1M flag to specify a non-empty 'Upgrade:' header was parsed
- tools: provide a function to generate a hashed random pair
🐛 Bug Fixes
- net_helper: fix a remaining possibly infinite loop in converters
- ssl_sock: remove unneeded check on QMux flags
- ocsp: Manage date too far away in the future
- mux_quic: do not crash on unhandled QMux frame reception
- applet: Properly handle receives of size 0
- resolvers: Fix test on dn label size in resolv_dn_label_to_str()
- ssl-gencert: Unlock LRU cache if failing to generate certificate
- quic: fix ODCID lookup from derived value
- dict: hold lock while decrementing refcount in dict_entry_unref
- tcpchecks: Limit parsing of agent-check reply to the buffer
- hlua: Fix integer underflow when receiving line from lua cosocket
- cli: Fix parsing of pattern finishing a command payload
- acme: NUL terminate response buffer before PEM parsing
- intops: mask the fail value in array_size_or_fail()
- log-forward: make sure the month is unsigned
- regex: allocate a large enough pcre2 match for all matches
- tcpcheck/spoe: bound the SPOP error code to valid values
- cache: fix a refcount leak for missed secondary entries
- log: free logformat expr on compile failure in cfg_parse_log_profile
- resolvers: fix room for trailing zero in resolv_dn_label_to_str()
- resolvers: fix risk of appending garbage past the domain name
- mux-h2: validate HEADERS frame length before reading stream dep
- log: look for the end of priority before the end of the buffer
- dict: fix refcount race on insert collision
- init: use more than ha_random64() for the cluster secret
- sample: limit the be2hex converter's chunk size
- haterm: fix the random suffix multiplication
- h1: drop headers whose names contain invalid chars
- h1: limit status codes to 3 digits by default
- cache: always verify the primary hash in get_secondary_entry()
- cache: also recognize directives in the form "token="
- resolvers: relax size checks in authority record parsing
- sample: request an extra output byte for the url_dec converter
- http-fetch: check against the whole token in get_http_auth()
- acme: protect against risk of null-deref on connection failure
- http-ext: always check remaining data when reading rfc7239 nodeport
- base64: return empty string for empty input in base64dec()
- payload: fix the handshake length bounds check smp_client_hello_parse()
- ssl-hello: make use of the null-terminated servername
- resolvers: switch to a better PRNG for query IDs
- addons/51d: NUL-terminate headers before passing them to Trie API
- tools: insert an XXH64 layer on the PRNG output
- h3: reject client push stream
- h3: reject server push stream
- h3: reject client CANCEL_PUSH frame
- h3: adjust error on PUSH_PROMISE frame reception
- h3: reject server MAX_PUSH_ID frame
- auth: fix unconfigured password NULL deref
- h3: add missing break on rcv_buf()
- hlua: prevent Lua from passing CR/LF/NUL in HTTP headers
- qmux: do not crash on frame parsing issue
- quic: reject packet too short for HP decryption
- jwe: enforce GCM tag length to 128 bits
- jwe: substitute random CEK on RSA1_5 decryption failure per RFC 7516 #11.5
- mux-fcgi: reject stream ID 0 for application records
- h1-htx: Sanitize parsing to properly handle upgrade requests
- mux-fcgi: Use relative offset to compute contig data in demux buf
- mux-spop: Use relative offset to compute contig data in demux buf