●Change8

v3.4.0

📦 haproxyView on GitHub →
✨ 14 features🐛 51 fixes🔧 39 symbols

Summary

Version 3.4.0 introduces numerous bug fixes across various components including TCP, SSL, QUIC, and QPACK. It also includes several minor improvements and cleanup tasks, enhancing stability and performance.

Migration Steps

  1. Convert 51d, deviceatlas, and WURFL addons to EXTRA_MAKE.
  2. Include EXTRA_MAKE in the .build_opts construction.
  3. Put EXTRA_MAKE help at the right place in the Makefile.
  4. Use the system's default Lua library before all other variants.
  5. Search for Lua 5.5 as well in the Makefile.
  6. Replace cirrus CI with a vmactions/freebsd-vm job.
  7. Run illumos job weekly on Mondays at 03:00 instead of monthly.

✨ New Features

  • Add -dA option to dump an archive of all dependencies.
  • Add simple task dump, thread dump, and fdtab dump for debugging with GDB.
  • Mention that version 3.4 is now LTS.
  • Enable kTLS on the SSL bind line when supported.
  • Add a threat model definition to the documentation.
  • Add security.txt describing how to report security issues.
  • Add a note to exclude dev/ and admin/ from security issue reporting.
  • Add basic QMux tests.
  • Add missing flags for mux_quic/flags.
  • Notify when cpu-policy is ignored due to other settings.
  • Report when thread-groups or nbthread results in fewer threads.
  • Indicate when max-threads-per-group is ignored.
  • Clarify ambiguous wording in core-principles documentation.
  • Add more explanation in http-reusee regarding sni-auto in config documentation.

🐛 Bug Fixes

  • tcpcheck: Check LDAP response to not read more data than available.
  • ssl-gencert: Validate SNI characters to prevent SAN certificate injection.
  • mux-h1: H2 preface rejection doesn't update stick-table glitches.
  • cpu-topo: Enforce thread-hard-limit on policy.
  • qmux: Do not crash on too large record.
  • qmux: Do not crash on receiving an invalid first frame.
  • qmux: Reject too large initial record.
  • Revert 'BUG/MEDIUM: dns: fix long loops in additional records parse on name failure'.
  • qpack: Fix index calculation in debug functions.
  • qpack: Fix potential null-pointer dereference in qpack_dht_insert().
  • qpack: Fix sign bit mask in qpack_decode_fs_pfx().
  • qpack: Fix huff_dec() error handling in qpack_decode_fs().
  • quic: Handle ECONNREFUSED on RX side.
  • quic: Fix memory leak in quic_deallocate_dghdlrs().
  • lua: Defer Lua VM initialisation to the first Lua config keyword.
  • lua: Fix tune.lua.openlibs in Lua reg-tests.
  • mux-h2: Count padding for connection flow control on error path.
  • mux_quic: Open an idle QCS on reset on BE side.
  • mux_quic: Fix BE conn removal on app shutdown.
  • mux_quic: Prevent BE reuse with an errored conn.
  • quic: Fix ack range node pool_free call passing wrong pointer type.
  • quic: Reset cwnd in slow_start on persistent congestion (cubic).
  • quic: Reset consecutive_losses on exit from recovery period (cubic).
  • quic: Update drs->lost before calling on_ack_recv.
  • Revert 'MEDIUM: quic: optimize HKDF operations by reusing per-thread contexts'.
  • lua: Register hlua_init() as a pre-check to fix crash without Lua config.
  • quic: Disable quic/ocsp_auto_update for now.
  • threads: Set at least grp_max when mtpg is too small.
  • threads: Ignore max-threads-per-group when thread-groups is set.
  • quic: Fix another buffer overflow with sockaddr_in46.
  • cache: Fix cache tree iteration.
  • resolvers: Wait a bit before calling the xprt prepare_srv.
  • qmux: Close connection on invalid frame.
  • h3: Fix MAX_PUSH_ID handling.
  • cache: Fix copy of value when parsing maxage.
  • mux-h1: Dup connection/upgrade value to parse it when making headers.
  • htx: Fix headers rollback on partial copy in htx_xfer().
  • ssl: Make sure the alpn length is small enough.
  • applet: Commit changes into input buffer after sending HTX data.
  • mux-spop: Fix possible off-by-one OOB read in spop_get_varint().
  • leastconn: Unlock the write lock on allocation failure.
  • tasks: Increase the right niced_task counter.
  • http-act: Properly handle final evaluation in pause action.
  • startup: Unbreak chroot with CAP_SYS_CHROOT.
  • haterm: Do not try to bind QUIC when not supported.
  • haterm: Also apply the tcp-bind-opts to clear TCP 'bind' lines.
  • channel: Fix condition to know if a channel may send.
  • vars: Properly eval set-var-fmt action for empty log-format string.
  • stream: Don't use small buffer on queuing with a request data filter.
  • jwe: Don't write randoms past MAX_DECRYPTED_CEK_LEN in RSA_PKCS1_PADDING.
  • chunk: Do not rely on small trash by default for expressions.

Affected Symbols

tcpcheckssl-gencertmux-h1cpu-topoqmuxqpackquicluamux-h2addonsmux_quicthreadsh3htxsslappletmux-spopleastconntaskshttp-actstartuphatermchannelvarsstreamjwechunkqpack_dht_insertqpack_decode_fs_pfxqpack_decode_fshuff_decquic_deallocate_dghdlrshlua_initsockaddr_in46xprt prepare_srvhtx_xferspop_get_varintset-var-fmtMAX_DECRYPTED_CEK_LEN