●Change8

v3.4-dev6

Breaking Changes
📦 haproxyView on GitHub →
⚠ 12 breaking✨ 49 features🐛 32 fixes🔧 27 symbols

Summary

This release includes numerous bug fixes and minor improvements across various components like QUIC, ACME, and proxy handling. It also introduces new features for haterm and improved error reporting in SSL.

⚠️ Breaking Changes

  • MEDIUM: counters: change the fill_stats() API to pass the module and extra_counters. This requires updating callers to pass the module and extra_counters to fill_stats().
  • MEDIUM: counters: add a dedicated storage for extra_counters in various structs. This is a structural change that might affect code directly manipulating counter storage.
  • MEDIUM: counters: return aggregate extra counters in ->fill_stats(). Callers of fill_stats() might need to adjust how they process the returned data.
  • MEDIUM: proxy: add lock for global accesses during proxy free. Code that frees proxies concurrently might need to be reviewed for thread safety.
  • MEDIUM: proxy: add lock for global accesses during default free. Code that frees default proxies concurrently might need to be reviewed for thread safety.
  • MEDIUM: proxy: implement backend deletion. This introduces new logic for backend deletion which might have subtle behavioral changes.
  • MEDIUM: quic/mux-quic: adjust app-ops install. This change in app-ops installation for QUIC/mux-QUIC might require adjustments in how app-ops are managed.
  • MEDIUM: http-fetch: Rework how HTTP message version is retrieved. Code relying on the previous method of retrieving HTTP message version might need updates.
  • MEDIUM: http-ana: Use the version of the opposite side for internal messages. This change in how internal messages use version information might affect internal processing.
  • BUG/MAJOR: qpack: unchecked length passed to huffman decoder. This is a critical bug fix that could lead to crashes or incorrect decoding if not addressed. Ensure all lengths passed to the huffman decoder are validated.
  • BUG/MAJOR: fcgi: Fix param decoding by properly checking its size. This is a critical bug fix that could lead to crashes or incorrect decoding if not addressed. Ensure all param sizes are properly checked during FCGI decoding.
  • BUG/MAJOR: resolvers: Properly lowered the names found in DNS response. This change in how DNS response names are processed might affect lookups if case sensitivity was implicitly relied upon.

Migration Steps

  1. Update callers of fill_stats() to pass the module and extra_counters.
  2. Review code that frees proxies concurrently for thread safety.
  3. Review code that frees default proxies concurrently for thread safety.
  4. Ensure all lengths passed to the huffman decoder are validated.
  5. Ensure all param sizes are properly checked during FCGI decoding.

✨ New Features

  • MINOR: haterm: provide -b and -c options (RSA key size, ECDSA curves)
  • MINOR: haterm: add long options for QUIC and TCP "bind" settings
  • MINOR: quic: add BUG_ON() on half_open_conn counter access from BE
  • MINOR: quic/h3: display QUIC/H3 backend module on HTML stats
  • MINOR: ssl: clarify error reporting for unsupported keywords
  • MINOR: traces: always mark trace_source as thread-aligned
  • MINOR: ncbmbuf: improve itbmap_next() code
  • MINOR: proxy: improve code when checking server name conflicts
  • MINOR: quic: add a new metric for ncbuf failures
  • MINOR: mux-h2: add a new setting, "tune.h2.log-errors" to tweak error logging
  • MINOR: counters: store a tgroup step for extra_counters to access multiple tgroups
  • MINOR: counters: add EXTRA_COUNTERS_BASE() to retrieve extra_counters base storage
  • MINOR: promex: test applet resume in stress mode
  • MINOR: proxy: convert proxy flags to uint
  • MINOR: proxy: refactor srv_detach()
  • MINOR: proxy: define a basic "del backend" CLI
  • MINOR: proxy: define proxy watcher member
  • MINOR: stats: protect proxy iteration via watcher
  • MINOR: promex: use watcher to iterate over backend instances
  • MINOR: lua: use watcher for proxies iterator
  • MINOR: proxy: add refcount to proxies
  • MINOR: proxy: rename default refcount to avoid confusion
  • MINOR: server: take proxy refcount when deleting a server
  • MINOR: lua: handle proxy refcount
  • MINOR: proxy: prevent backend removal when unsupported
  • MINOR: proxy: prevent deletion of backend referenced by config elements
  • MINOR: proxy: prevent backend deletion if server still exists in it
  • MINOR: server: mark backend removal as forbidden if QUIC was used
  • MINOR: cli: implement wait on be-removable
  • MINOR: proxy: add comment for defaults_px_ref/unref_all()
  • MINOR: proxy: use atomic ops for default proxy refcount
  • MINOR: quic: use signed char type for ALPN manipulation
  • MINOR: quic/h3: reorganize stream reject after MUX closure
  • MINOR: mux-quic: add function for ALPN to app-ops conversion
  • MINOR: quic: use server cache for ALPN on BE side
  • MINOR: hlua: Properly enable/disable line receives from HTTP applet
  • MINOR: hlua: Properly enable/disable receives for TCP applets
  • MINOR: htx: Add a function to retrieve the HTTP version from a start-line
  • MINOR: h1-htx: Reports non-HTTP version via dedicated flags
  • MINOR: http-ana: Save the message version in the http_msg structure
  • DEBUG: stream: Display the currently running rule in stream dump
  • MINOR: filters: Use filter API as far as poissible to break loops on filters
  • MINOR: filters: Set last_entity when a filter fails on stream_start callback
  • MINOR: stream: Display the currently running filter per channel in stream dump
  • DOC: config: Use the right alias for %B
  • MINOR: counters: Introduce COUNTERS_UPDATE_MAX()
  • MINOR: listeners: Update the frequency counters separately when needed
  • MINOR: proxies: Update beconn separately
  • MINOR: stats: Add an option to disable the calculation of max counters

🐛 Bug Fixes

  • BUG/MINOR: proxy: detect strdup error on server auto SNI
  • BUG/MINOR: server: set auto SNI for dynamic servers
  • BUG/MINOR: server: enable no-check-sni-auto for dynamic servers
  • BUG/MINOR: haterm: missing allocation check in copy_argv()
  • BUG/MINOR: quic: fix counters used on BE side
  • BUG/MINOR: acme: acme_ctx_destroy() leaks auth->dns
  • BUG/MINOR: acme: wrong labels logic always memprintf errmsg
  • BUG/MINOR: acme: fix incorrect number of arguments allowed in config
  • BUG/MEDIUM: spoe: Acquire context buffer in applet before consuming a frame
  • BUG/MEDIUM: cpu-topo: Distribute CPUs fairly across groups
  • BUG/MINOR: quic: missing app ops init during backend 0-RTT sessions
  • BUG/MINOR: haterm: cannot reset default "haterm" mode
  • BUG/MEDIUM: mux-h2: make sure to always report pending errors to the stream
  • BUG/MINOR: server: adjust initialization order for dynamic servers
  • BUG/MINOR: call EXTRA_COUNTERS_FREE() before srv_free_params() in srv_drop()
  • BUG/MINOR: promex: fix server iteration when last server is deleted
  • BUG/MINOR: proxy: add dynamic backend into ID tree
  • BUG/MINOR: hlua: fix return with push nil on proxy check
  • BUG/MEDIUM: stream: Handle TASK_WOKEN_RES as a stream event
  • BUG/MEDIUM: hpack: correctly deal with too large decoded numbers
  • BUG/MAJOR: qpack: unchecked length passed to huffman decoder
  • BUG/MINOR: qpack: fix 1-byte OOB read in qpack_decode_fs_pfx()
  • BUG/MINOR: quic: fix OOB read in preferred_address transport parameter
  • BUG/MEDIUM: qpack: correctly deal with too large decoded numbers
  • BUG/MEDIUM: hlua: Fix end of request detection when retrieving payload
  • BUG/MINOR: h1-htx: Be sure that H1 response version starts by "HTTP/"
  • BUG/MINOR: channel: Increase the stconn bytes_in value in channel_add_input()
  • BUG/MINOR: sample: Fix sample to retrieve the number of bytes received and sent
  • BUG/MINOR: http-ana: Increment scf bytes_out value if an haproxy error is sent
  • BUG/MAJOR: fcgi: Fix param decoding by properly checking its size
  • BUG/MAJOR: resolvers: Properly lowered the names found in DNS response
  • BUG/MEDIUM: mux-fcgi: Use a safe loop to resume each stream eligible for sending

Affected Symbols

acmeproxyserverhatermquicsslspoecpu-topomux-h2counterspromexluastreamhluahpackqpackhtxh1-htxhttp-anafcgiresolversmux-fcgifill_stats()srv_free_params()srv_drop()defaults_px_ref/unref_all()channel_add_input()