mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-20 13:21:29 +02:00
Code Issues Projects Releases Wiki Activity

DOC: quic: clarifies limited-quic support

Browse Source 
This patch extends the documentation for "limited-quic" global keyword.
It mentions first that it relies on USE_QUIC_OPENSSL_COMPAT=1 build
option.

Compatibility with TLS libraries is now clearly exposed. In particular,
it highlights the fact that it is mostly targetted at OpenSSL version
prior to 3.5.2, and that it should be disabled if a recent OpenSSL
release is available. It also states that limited-quic does nothing if
USE_QUIC_OPENSSL_COMPAT is not set during compilation.
This commit is contained in:
Amaury Denoyelle 2025-09-11 10:06:26 +02:00
parent d293cc62dc
commit c15129f7dc
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
doc/configuration.txt
View File

@ -2772,11 +2772,21 @@ key-base <dir>
ignore "key-base". This option only works with a crt-store load line.
limited-quic
This setting must be used to explicitly enable the QUIC listener bindings when
haproxy is compiled against a TLS/SSL stack without QUIC support, typically
OpenSSL. It has no effect when haproxy is compiled against a TLS/SSL stack
with QUIC support, quictls for instance. Note that QUIC 0-RTT is not supported
when this setting is set.
This setting must be used to explicitly enable the QUIC listener bindings
when haproxy is compiled with a version of OpenSSL without QUIC support. It
activates an haproxy internal compatibility layer which must have been
selected at build time with USE_QUIC_OPENSSL_COMPAT=1. This compatibility
layer supports most of the necessary TLS operations, albeit without QUIC
0-RTT capability.
This feature is primarily targetted for OpenSSL prior to version 3.5.2, where
QUIC API was not implemented or only partially. The compatibility layer can
still be activated for version 3.5.2 and above, but this is probably
unnecessary.
If limited-quic is set but the compatibility layer was not selected at build
time, the option is silently ignored and QUIC TLS operations rely on the TLS
library.
localpeer <name>
Sets the local instance's peer name. It will be ignored if the "-L"