●Change8

v3.5-dev3

📦 haproxyView on GitHub →
✨ 10 features🐛 21 fixes🔧 19 symbols

Summary

This release introduces early hints support for the cache module, enhances SSL/TLS security with FIPS compliance for AWS-LC, and includes various bug fixes and minor improvements across different modules.

Migration Steps

  1. Increase a buffer size in haload to resolve gcc complaints.
  2. Clamp shctx_row_data_get() reads against the offset.
  3. Factor the proxy vs scope check into its own function in stats.
  4. Factor 103 emission into start/end helpers in http.
  5. Factor cache_extract_link_hints out of cache_extract_hints.
  6. Use BUG_ON_STATIC() in event_hdl.
  7. Error when trying to build with aws-lc with the wrong flags in Makefile.

✨ New Features

  • Add two header parsing functions to http module.
  • Introduce src/fips.c with TLS version check for SSL module.
  • Add FIPS TLS 1.2 cipher check for AWS-LC.
  • Set FIPS-approved cipher defaults for AWS-LC FIPS builds.
  • Add FIPS TLS 1.3 ciphersuite check for AWS-LC.
  • Set FIPS-approved curve defaults for AWS-LC FIPS builds.
  • Add FIPS elliptic curve check for AWS-LC.
  • Set FIPS-approved sigalgs defaults for AWS-LC FIPS builds.
  • Add FIPS signature algorithm check for AWS-LC.
  • Add BUG_ON_STATIC(): a compile-time BUG_ON().

🐛 Bug Fixes

  • Fix build when no 8B CAS is available at all.
  • Apply socket timeout on server side only for hlua.
  • Reenable reads in applet context if requesting a connection.
  • Subject "stats admin" accesses to "stats scope" filtering.
  • Fix shctx_row_data_get() when offset exceeds a block.
  • Reattach the row when a secondary cache entry is incomplete.
  • Ensure that Origin is valid on POSTs for stats.
  • Don't forget to free memory when done in ssl-gencert.
  • Adjust sample size capacity after pointer shift in protobuf.
  • Fix nested path bypass in field lookup in protobuf.
  • Fix proxy lookup for show ssl sni.
  • Don't delay send if message with c-l was fully sent in mux-h1.
  • Adjust sample size capacity after pointer shift in net-helper.
  • Adjust sample size capacity after pointer shift for bytes() in sample.
  • Adjust sample size capacity after pointer shift for ltrim() in sample.
  • Fix bytes() when length it greater than remaining data in sample.
  • Protect "show servers ..." against server deletion.
  • Protect "show servers ..." against backend deletion.
  • Protect show backend against be deletion.
  • Properly check for streams before deletion in server.
  • Do not index resolvers names in the proxies.

Affected Symbols

haloadtaskhluaappletstatsshctxcachehttpsslssl-gencertprotobufmux-h1net-helpersampleMakefileproxyserverresolversevent_hdl