mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2025-08-09 00:27:08 +02:00
91ff709542
1847 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Willy Tarreau
|
437fd289f2 |
[RELEASE] Released version 2.7.0
Released version 2.7.0 with the following main changes :
- MINOR: ssl: forgotten newline in error messages on ca-file
- BUG/MINOR: ssl: shut the ca-file errors emitted during httpclient init
- DOC: config: provide some configuration hints for "http-reuse"
- DOC: config: refer to section about quoting in the "add_item" converter
- DOC: halog: explain how to use -ac and -ad in the help message
- DOC: config: clarify the fact that SNI should not be used in HTTP scenarios
- DOC: config: mention that a single monitor-uri rule is supported
- DOC: config: explain how default matching method for ACL works
- DOC: config: clarify the fact that "retries" is not just for connections
- BUILD: halog: fix missing double-quote at end of help line
- DOC: config: clarify the -m dir and -m dom pattern matching methods
- MINOR: activity: report uptime in "show activity"
- REORG: activity/cli: move the "show activity" handler to activity.c
- DEV: poll: add support for epoll
- DEV: tcploop: centralize the polling code into wait_for_fd()
- DEV: tcploop: add support for POLLRDHUP when supported
- DEV: tcploop: do not report an error on POLLERR
- DEV: tcploop: add optional support for epoll
- SCRIPTS: announce-release: add a link to the data plane API
- CLEANUP: stick-table: fill alignment holes in the stktable struct
- MINOR: stick-table: store a per-table hash seed and use it
- MINOR: stick-table: show the shard number in each entry's "show table" output
- CLEANUP: ncbuf: remove ncb_blk args by value
- CLEANUP: ncbuf: inline small functions
- CLEANUP: ncbuf: use standard BUG_ON with DEBUG_STRICT
- BUG/MINOR: quic: Endless loop during retransmissions
- MINOR: mux-h2: add the expire task and its expiration date in "show fd"
- BUG/MINOR: peers: always initialize the stksess shard value
- REGTESTS: fix peers-related regtests regarding "show table"
- BUG/MEDIUM: mux-h1: Close client H1C on EOS when there is no output data
- MINOR: stick-table: change the API of the function used to calculate the shard
- CLEANUP: peers: factor out the key len calculation in received updates
- BUG/MINOR: peers: always update the stksess shard number on incoming updates
- CLEANUP: assorted typo fixes in the code and comments
- MINOR: mux-h1: add the expire task and its expiration date in "show fd"
- MINOR: debug: improve error handling on the memstats command parser
- BUILD: quic: allow build with USE_QUIC and USE_OPENSSL_WOLFSSL
- CLEANUP: anon: clarify the help message on "debug dev hash"
- MINOR: debug: relax access restrictions on "debug dev hash" and "memstats"
- SCRIPTS: run-regtests: add a version check
- MINOR: version: mention that it's stable now
|
||
Ilya Shipitsin
|
6f86eaae4f |
CLEANUP: assorted typo fixes in the code and comments
This is 33rd iteration of typo fixes |
||
|
Willy Tarreau
|
f386a2de92 |
DOC: config: clarify the -m dir and -m dom pattern matching methods
There's regularly some confusion about them (do they match at the beginning, end ? do they support multiple components etc). Tim suggested to improve the doc in issue #61, it's never too late, so let's do it now wih a few examples. |
||
|
Willy Tarreau
|
0b4a622b49 |
DOC: config: clarify the fact that "retries" is not just for connections
In issue #412 it was rightfully reported that the wording in "retries" still exclusively speaks about connection attempts, while since L7 retries with "retry-on" it's no longer a limitation. Let's update the text. |
||
|
Willy Tarreau
|
4f4fea417b |
DOC: config: explain how default matching method for ACL works
In issue #698, it's made apparent that the default matching method for ACL keywords can be confusing when a converter is applied, because depending on the converters used, users may think that the default matching method from the sample fetch name might apply to the whole expression. It's easier to understand that this doesn't make sense when thinking about converters turning to completely different types (e.g. hdr_beg(host),do_resolve() returns an IP, thus it's obvious that _beg makes no sense at all). This patch states this in the doc to avoid future confusion. |
||
|
Willy Tarreau
|
7fe0c62516 |
DOC: config: mention that a single monitor-uri rule is supported
It was reported in issue #1059 that when multiple monitor-uri rules are specified, only the last one is used. While this was done on purpose since a single URI is used, it was not clearly mentioned in the doc, possibly leading to confusion or wasted time trying to establish a working setup. Let's clarify this point. |
||
|
Willy Tarreau
|
d26fb57e81 |
DOC: config: clarify the fact that SNI should not be used in HTTP scenarios
As reported by Tim in issue #1373 some warnings are deserved to explain why using the frontend SNI for routing or connecting to a server is usually not correct, especially since it can be tempting and used to make sense in pure TCP scenarios. |
||
|
Willy Tarreau
|
b143d110bf |
DOC: config: refer to section about quoting in the "add_item" converter
As requested by Nick in issue #1719, let's add a reference to the section about quoting there, since add_item() will often be used with commas and it's easy to mess up. |
||
|
Willy Tarreau
|
44fce8bd73 |
DOC: config: provide some configuration hints for "http-reuse"
This adds some configuration hints regarding various workloads that do not manage to achieve high reuse rates due to too low a global maxconn or thread groups. This fixes github issue #1472. |
||
|
Willy Tarreau
|
0279df9e82 |
[RELEASE] Released version 2.7-dev10
Released version 2.7-dev10 with the following main changes :
- MEDIUM: tcp-act: add parameter rst-ttl to silent-drop
- BUG/MAJOR: quic: Crash upon retransmission of dgrams with several packets
- MINOR: cli: print parsed command when not found
- BUG/MAJOR: quic: Crash after discarding packet number spaces
- CLEANUP: quic: replace "choosen" with "chosen" all over the code
- MINOR: cli/pools: store "show pools" results into a temporary array
- MINOR: cli/pools: add sorting capabilities to "show pools"
- MINOR: cli/pools: add pool name filtering capability to "show pools"
- DOC: configuration: fix quic prefix typo
- MINOR: quic: report error if force-retry without cluster-secret
- MINOR: global: generate random cluster.secret if not defined
- BUG/MINOR: resolvers: do not run the timeout task when there's no resolution
- BUG/MINOR: server/idle: at least use atomic stores when updating max_used_conns
- MINOR: server/idle: make the next_takeover index per-tgroup
- BUILD: listener: fix build warning on global_listener_rwlock without threads
- BUG/MAJOR: sched: protect task during removal from wait queue
- BUILD: sched: fix build with DEBUG_THREAD with the previous commit
- DOC: quic: add note on performance issue with listener contention
- BUG/MINOR: cfgparse-listen: fix ebpt_next_dup pointer dereference on proxy "from" inheritance
- BUG/MINOR: log: fix parse_log_message rfc5424 size check
- CLEANUP: arg: remove extra check in make_arg_list arg escaping
- CLEANUP: tools: extra check in utoa_pad
- MINOR: h1: Consider empty port as invalid in authority for CONNECT
- MINOR: http: Considere empty ports as valid default ports
- BUG/MINOR: http-htx: Normalized absolute URIs with an empty port
- BUG/MINOR: h1: Replace authority validation to conform RFC3986
- REG-TESTS: http: Add more tests about authority/host matching
- BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action
- BUG/MEDIUM: mux-h1: Don't release H1C on timeout if there is a SC attached
- BUG/MEDIUM: mux-h1: Subscribe for reads on error on sending path
- BUILD: http-htx: Silent build error about a possible NULL start-line
- DOC: configuration.txt: add default_value for table_idle signature
- BUILD: ssl-sock: Silent error about NULL deref in ssl_sock_bind_verifycbk()
- BUG/MEDIUM: mux-h1: Remove H1C_F_WAIT_NEXT_REQ flag on a next request
- BUG/MINOR: mux-h1: Fix handling of 408-Request-Time-Out
- MINOR: mux-h1: Remove H1C_F_WAIT_NEXT_REQ in functions handling errors
- MINOR: mux-h1: Avoid useless call to h1_send() if no error is sent
- DOC: configuration.txt: fix typo in table_idle signature
- BUILD: stick-tables: fix build breakage in xxhash on older compilers
- BUILD: compiler: include compiler's definitions before ours
- BUILD: quic: global.h is needed in cfgparse-quic
- CLEANUP: tools: do not needlessly include xxhash nor cli from tools.h
- BUILD: flags: really restrict the cases where flags are exposed
- BUILD: makefile: minor reordering of objects by build time
- BUILD: quic: silence two invalid build warnings at -O1 with gcc-6.5
- BUILD: quic: use openssl-compat.h instead of openssl/ssl.h
- MEDIUM: ssl: add minimal WolfSSL support with OpenSSL compatibility mode
- MINOR: sample: make the rand() sample fetch function use the statistical_prng
- MINOR: auth: silence null dereference warning in check_user()
- CLEANUP: peers: fix format string for status messages (int signedness)
- CLEANUP: qpack: fix format string in debugging code (int signedness)
- CLEANUP: qpack: properly use the QPACK macros not HPACK ones in debug code
- BUG/MEDIUM: quic: fix datagram dropping on queueing failed
|
||
Aurelien DARRAGON
|
fd766ddfaf |
DOC: configuration.txt: fix typo in table_idle signature
An extra ',' was mistakenly added in table_idle converter signature
with commit
|
||
|
Aurelien DARRAGON
|
ed36968f16 |
DOC: configuration.txt: add default_value for table_idle signature
table_idle converter takes optional default_value argument.
The documentation correctly describes this usage but <default_value> was
missing in the converter signature.
It should be backported with
|
||
Christopher Faulet
|
84cdbe478a |
BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action
An abosulte URI is marked as normalized if it comes from an H2 client. This way, we know we can send a relative URI to an H1 server. But, after a set-uri action, the URI must no longer be considered as normalized. Otherwise there is no way to send an absolute URI on the server side. If it is important to update a normalized absolute URI without altering this property, the host, path and/or query-string must be set separatly. This patch should fix the issue #1938. It should be backported as far as 2.4. |
||
Amaury Denoyelle
|
7078fb1f3a |
DOC: quic: add note on performance issue with listener contention
Complete quic4/quic6 bind lines by a note on performance issues due to receiver socket contention. Suggest to use sharding to improve the situation. This should be backported up to 2.6. |
||
|
Amaury Denoyelle
|
28ea31c7cb |
MINOR: global: generate random cluster.secret if not defined
If no cluster-secret is defined by the user, a random one is silently generated. This ensures that at least QUIC Retry tokens are generated if abnormal conditions are detected. However, it is advisable to specify it in the configuration for tokens to be valid even after a reload or across LBs instances in the same cluster. This should be backported up to 2.6. |
||
|
Amaury Denoyelle
|
996ca7d0fa |
MINOR: quic: report error if force-retry without cluster-secret
QUIC Retry generation relies on global cluster-secret to produce token valid even after a process restart and across several LBs instances. Before this patch, Retry is automatically deactivated if no cluster-secret is provided. This is the case even if a user has configured a QUIC listener with quic-force-retry. Change this behavior by now returning an error during configuration parsing. The user must provide a cluster-secret if quic-force-retry is used. This shoud be backported up to 2.6. |
||
|
Amaury Denoyelle
|
936c135e05 |
DOC: configuration: fix quic prefix typo
Replace quicv4/quicv6 -> quic4/quic6 as prefix for bind lines of QUIC listeners. This should be backported up to 2.6. |
||
Mathias Weiersmueller
|
d9b7174d99 |
MEDIUM: tcp-act: add parameter rst-ttl to silent-drop
The silent-drop action was extended with an additional optional parameter, [rst-ttl <ttl> ], causing HAProxy to send a TCP RST with the specified TTL towards the client. With this behaviour, the connection state on your own client- facing middle-boxes (load balancers, firewalls) will be purged, but the client will still assume the TCP connection is up because the TCP RST packet expires before reaching the client. |
||
|
Willy Tarreau
|
a0abec8bc0 |
[RELEASE] Released version 2.7-dev9
Released version 2.7-dev9 with the following main changes :
- BUILD: quic: QUIC mux build fix for 32-bit build
- BUILD: scripts: disable tests build on QuicTLS build
- BUG/MEDIUM: httpclient: segfault when the httpclient parser fails
- BUILD: ssl_sock: fix null dereference for QUIC build
- BUILD: quic: Fix build for m68k cross-compilation
- BUG/MINOR: quic: fix buffer overflow on retry token generation
- MINOR: quic: add version field on quic_rx_packet
- MINOR: quic: extend pn_offset field from quic_rx_packet
- MINOR: quic: define first packet flag
- MINOR: quic: extract connection retrieval
- MINOR: quic: split and rename qc_lstnr_pkt_rcv()
- MINOR: quic: refactor packet drop on reception
- MINOR: quic: extend Retry token check function
- BUG/MINOR: log: Preserve message facility when the log target is a ring buffer
- BUG/MINOR: ring: Properly parse connect timeout
- BUG/MEDIUM: httpclient/lua: crash when the lua task timeout before the httpclient
- BUG/MEDIUM: httpclient: check if the httpclient was released in the IO handler
- REGTESTS: httpclient/lua: test the lua task timeout with the httpclient
- CI: github: dump the backtrace of coredumps in the alpine container
- BUILD: Makefile: add "USE_SHM_OPEN" on the linux-musl target
- DOC: lua: add a note about compression w/ httpclient
- CLEANUP: mworker/cli: rename the status function to loadstatus
- MINOR: mworker/cli: does no try to dump the startup-logs w/o USE_SHM_OPEN
- MINOR: list: fixing typo in MT_LIST_LOCK_ELT
- DOC/MINOR: list: fixing MT_LIST_LOCK_ELT macro documentation
- MINOR: list: adding MT_LIST_APPEND_LOCKED macro
- BUG/MINOR: mux-quic: complete flow-control for uni streams
- BUG/MEDIUM: compression: handle rewrite errors when updating response headers
- MINOR: quic: do not crash on unhandled sendto error
- MINOR: quic: display unknown error sendto counter on stat page
- MINOR: peers: Support for peer shards
- MINOR: peers: handle multiple resync requests using shards
- BUG/MINOR: sink: Only use backend capability for the sink proxies
- BUG/MINOR: sink: Set default connect/server timeout for implicit ring buffers
- MINOR: ssl: add the SSL error string when failing to load a certificate
- MINOR: ssl: add the SSL error string before the chain
- MEDIUM: ssl: be stricter about chain error
- BUG/MAJOR: stick-table: don't process store-response rules for applets
- MINOR: quic: remove unnecessary quic_session_accept()
- BUG/MINOR: quic: fix subscribe operation
- BUG/MINOR: log: fixing bug in tcp syslog_io_handler Octet-Counting
- MINOR: ssl: dump the SSL string error when SSL_CTX_use_PrivateKey() failed.
- MINOR: quic: add counter for interrupted reception
- BUG/MINOR: quic: fix race condition on datagram purging
- CI: add monthly gcc cross compile jobs
- CLEANUP: assorted typo fixes in the code and comments
- CLEANUP: ssl: remove dead code in ssl_sock_load_pem_into_ckch()
- BUG/MINOR: httpclient: fixed memory allocation for the SSL ca_file
- BUG/MINOR: ssl: Memory leak of DH BIGNUM fields
- BUG/MINOR: ssl: Memory leak of AUTHORITY_KEYID struct when loading issuer
- BUG/MINOR: ssl: ocsp structure not freed properly in case of error
- CI: switch to the "latest" LibreSSL
- CI: enable QUIC for LibreSSL builds
- BUG/MEDIUM: ssl: Verify error codes can exceed 63
- MEDIUM: ssl: {ca,crt}-ignore-err can now use error constant name
- MINOR: ssl: x509_v_err_str converter transforms an integer to a X509_V_ERR name
- CLEANUP: cli: rename dynamic error printing state
- MINOR: cli: define usermsgs print context
- MINOR: server: clear prefix on stderr logs after add server
- BUG/MINOR: ssl: bind_conf is uncorrectly accessed when using QUIC
- BUILD: ssl_utils: fix build on gcc versions before 8
- BUILD: debug: remove unnecessary quotes in HA_WEAK() calls
- CI: emit the compiler's version in the build reports
- IMPORT: xxhash: update xxHash to version 0.8.1
- IMPORT: slz: declare len to fix debug build when optimal match is enabled
- IMPORT: slz: mention the potential header in slz_finish()
- IMPORT: slz: define and use a __fallthrough statement for switch/case
- BUILD: compiler: add a macro to detect if another one is set and equals 1
- BUILD: compiler: add a default definition for __has_attribute()
- BUILD: compiler: define a __fallthrough statement for switch/case
- BUILD: sample: use __fallthrough in smp_is_rw() and smp_dup()
- BUILD: quic: use __fallthrough in quic_connect_server()
- BUILD: ssl/crt-list: use __fallthrough in cli_io_handler_add_crtlist()
- BUILD: ssl: use __fallthrough in cli_io_handler_commit_{cert,cafile_crlfile}()
- BUILD: ssl: use __fallthrough in cli_io_handler_tlskeys_files()
- BUILD: hlua: use __fallthrough in hlua_post_init_state()
- BUILD: stream: use __fallthrough in stats_dump_full_strm_to_buffer()
- BUILD: tcpcheck: use __fallthrough in check_proxy_tcpcheck()
- BUILD: stats: use __fallthrough in stats_dump_proxy_to_buffer()
- BUILD: peers: use __fallthrough in peer_io_handler()
- BUILD: hash: use __fallthrough in hash_djb2()
- BUILD: tools: use __fallthrough in url_decode()
- BUILD: args: use __fallthrough in make_arg_list()
- BUILD: acl: use __fallthrough in parse_acl_expr()
- BUILD: spoe: use __fallthrough in spoe_handle_appctx()
- BUILD: logs: use __fallthrough in build_log_header()
- BUILD: check: use __fallthrough in __health_adjust()
- BUILD: http_act: use __fallthrough in parse_http_del_header()
- BUILD: h1_htx: use __fallthrough in h1_parse_chunk()
- BUILD: vars: use __fallthrough in var_accounting_{diff,add}()
- BUILD: map: use __fallthrough in cli_io_handler_*()
- BUILD: compression: use __fallthrough in comp_http_payload()
- BUILD: stconn: use __fallthrough in various shutw() functions
- BUILD: prometheus: use __fallthrough in promex_dump_metrics() and IO handler()
- CLEANUP: ssl: remove printf in bind_parse_ignore_err
- BUG/MINOR: ssl: crt-ignore-err memory leak with 'all' parameter
- BUG/MINOR: ssl: Fix potential overflow
- CLEANUP: stick-table: remove the unused table->exp_next
- OPTIM: stick-table: avoid atomic ops in stktable_requeue_exp() when possible
- BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task
- MEDIUM: http-ana: remove set-cookie2 support
- BUG/MEDIUM: wdt/clock: properly handle early task hangs
- MINOR: deinit: add a "quick-exit" option to bypass the deinit step
- OPTIM: ebtree: make ebmb_insert_prefix() keep a copy the new node's pfx
- OPTIM: ebtree: make ebmb_insert_prefix() keep a copy the new node's key
- MINOR: ssl: ssl_sock_load_cert_chain() display error strings
- MINOR: ssl: reintroduce ERR_GET_LIB(ret) == ERR_LIB_PEM in ssl_sock_load_pem_into_ckch()
- BUG/MINOR: http-htx: Fix error handling during parsing http replies
- BUG/MINOR: resolvers: Don't wait periodic resolution on healthcheck failure
- BUG/MINOR: resolvers: Set port before IP address when processing SRV records
- BUG/MINOR: mux-fcgi: Be sure to send empty STDING record in case of zero-copy
- BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once
- BUG/MINOR: ssl: SSL_load_error_strings might not be defined
- MINOR: pool/debug: create a new pool_alloc_flag() macro
- MINOR: dynbuf: switch allocation and release to macros to better track users
- BUG/MINOR: mux-h1: Do not send a last null chunk on body-less answers
- REG-TESTS: cache: Remove T-E header for 304-Not-Modified responses
- DOC: config: fix alphabetical ordering of global section
- MINOR: trace: split the CLI "trace" parser in CLI vs statement
- MEDIUM: trace: create a new "trace" statement in the "global" section
- BUG/MEDIUM: ring: fix creation of server in uninitialized ring
- BUILD: quic: fix dubious 0-byte overflow on qc_release_lost_pkts
- BUILD: makefile: mark poll and tcploop targets as phony
- BUILD: makefile: properly pass CC to sub-projects
- BUILD: makefile: move default verbosity settings to include/make/verbose.mk
- BUILD: makefile: use $(cmd_MAKE) in quiet mode
- BUILD: makefile: move the compiler option detection stuff to compiler.mk
- DEV: poll: make the connect() step an action as well
- DEV: poll: strip the "do_" prefix from reported function names
- DEV: poll: indicate the FD's side in front of its value
- BUG/MINOR: pool/cli: use ullong to report total pool usage in bytes
- MINOR: mux-h1: Remove usless code inside shutr callback
- CLEANUP: mux-h1; Rename H1S_F_ERROR flag into H1S_F_ERROR_MASK
- REORG: mux-h1: Reorg the H1C structure
- CLEANUP: mux-h1: Rename H1C_F_ST_ERROR and H1C_F_ST_SILENT_SHUT flags
- MINOR: mux-h1: Add a dedicated enum to deal with H1 connection state
- MEDIUM: mux-h1: Handle H1C states via its state field instead of H1C_F_ST_*
- MINOR: mux-h1: Don't handle subscribe for reads in h1_process_demux()
- CLEANUP: mux-h1: Rename H1C_F_ERR_PENDING into H1C_F_ABRT_PENDING
- MINOR: mux-h1: Add flag on H1 stream to deal with internal errors
- MEDIUM: mux-h1: Rely on the H1C to deal with shutdown for reads
- CLEANUP: mux-h1: Reorder H1 connection flags to avoid holes
- MEDIUM: mux-h1: Don't report a final error whe a message is aborted
- MEDIUM: mux-pt: Don't always set a final error on SE on the sending path
- MEDIUM: mux-h2: Introduce flags to deal with connection read/write errors
- CLEANUP: mux-h2: Remove unused fields in h2c structures
- MEDIUM: mux-fcgi: Introduce flags to deal with connection read/write errors
- MINOR: sconn: Set SE_FL_ERROR only when there is no more data to read
- MINOR: mux-h1: Rely on a H1S flag to know a WS key was found or not
- DOC: lua-api: Remove warning about the lua filters
- BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task
- CLEANUP: listener: Remove useless task_queue from manage_global_listener_queue
- BUG/MINOR: mux-h1: Fix error handling when H1S allocation failed on client side
- DOC: internal: commit notes about polling states and flags
- DOC: internal: commit notes about polling states and flags on connect()
- CLEANUP: mux-h1: Don't test h1c in h1_shutw_conn()
- BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists
- BUG/MEDIUM: raw-sock: Don't report connection error if something was received
- BUG/MINOR: ssl: don't initialize the keylog callback when not required
- BUILD: Makefile: enable USE_SHM_OPEN by default on freebsd
- BUG/MEDIUM: peers: messages about unkown tables not correctly ignored
- MINOR: cfgparse: Always check the section position
- MEDIUM: thread: Restric nbthread/thread-group(s) to very first global sections
- BUILD: peers: Remove unused variables
- MINOR: ncbuf: complete doc for ncb_advance()
- BUG/MEDIUM: quic: fix unsuccessful handshakes on ncb_advance error
- BUG/MEDIUM: quic: fix memleak for out-of-order crypto data
- MINOR: quic: complete traces/debug for handshake
|
||
|
Willy Tarreau
|
9fd0542148 |
MEDIUM: trace: create a new "trace" statement in the "global" section
The exact same commands as those from the CLI may be pre-loaded at boot time by passing them one per line after the "trace" keyword in the global section; i.e. just copy-pasting all commands directly there will do the job. Note that if a ring is mentioned, it needs to be declared before the global section. Another option is to append another global section after "ring". For now the keyword is marked as experimental to discourage its broad adoption by default. "expose-experimental-directives" needs to be placed in the global section to expose it. |
||
|
Willy Tarreau
|
8e6ad2548c |
DOC: config: fix alphabetical ordering of global section
the global section keywords were seriously misordered, and it's visible that some mistakes have induced other ones over time, so it was about time to fix this. Roughly 20% of the keywords were misplaced. This commit only reordered the keywords index and their description, nothing else was changed. It might be backported because it's a real pain to find certain options there. |
||
|
Willy Tarreau
|
e98d385819 |
MINOR: deinit: add a "quick-exit" option to bypass the deinit step
Once in a while we spot a bug in the deinit code that is complex, especially when it has to deal with incomplete initializations, and the ability to bypass this step has regularly been raised. In addition for fast-reloading setups it could theoretically save some time. Tests have shown that very large configs can barely save ~100-150ms by skipping the deinit step. However the ability not to crash if a bug is encountered can occasionally help. This patch adds an option to do exactly this. It's obviously not enabled by default and the documentation discourages from using it, but this might be useful in the future. |
||
William Lallemand
|
9fbc84e571 |
MINOR: ssl: x509_v_err_str converter transforms an integer to a X509_V_ERR name
The x509_v_err_str converter transforms a numerical X509 verify error to its constant name. |
||
|
William Lallemand
|
960fb74cae |
MEDIUM: ssl: {ca,crt}-ignore-err can now use error constant name
The ca-ignore-err and crt-ignore-err directives are now able to use the openssl X509_V_ERR constant names instead of the numerical values. This allow a configuration to survive an OpenSSL upgrade, because the numerical ID can change between versions. For example X509_V_ERR_INVALID_CA was 24 in OpenSSL 1 and is 79 in OpenSSL 3. The list of errors must be updated when a new major OpenSSL version is released. |
||
Frdric Lcaille
|
36d1565640 |
MINOR: peers: Support for peer shards
Add "shards" new keyword for "peers" section to configure the number of peer shards attached to such secions. This impact all the stick-tables attached to the section. Add "shard" new "server" parameter to configure the peers which participate to all the stick-tables contents distribution. Each peer receive the stick-tables updates only for keys with this shard value as distribution hash. The "shard" value is stored in ->shard new server struct member. cfg_parse_peers() which is the function which is called to parse all the lines of a "peers" section is modified to parse the "shards" parameter stored in ->nb_shards new peers struct member. Add srv_parse_shard() new callback into server.c to pare the "shard" parameter. Implement stksess_getkey_hash() to compute the distribution hash for a stick-table key as the 64-bits xxhash of the key concatenated to the stick-table name. This function is called by stksess_setkey_shard(), itself called by the already implemented function which create a new stick-table key (stksess_new()). Add ->idlen new stktable struct member to store the stick-table name length to not have to compute it each time a stick-table key hash is computed. |
||
|
Willy Tarreau
|
ea8aebe8c5 |
[RELEASE] Released version 2.7-dev8
Released version 2.7-dev8 with the following main changes :
- BUG/MINOR: checks: update pgsql regex on auth packet
- DOC: config: Fix pgsql-check documentation to make user param mandatory
- CLEANUP: mux-quic: remove usage of non-standard ull type
- CLEANUP: quic: remove global var definition in quic_tls header
- BUG/MINOR: quic: adjust quic_tls prototypes
- CLEANUP: quic: fix headers
- CLEANUP: quic: remove unused function prototype
- CLEANUP: quic: remove duplicated varint code from xprt_quic.h
- CLEANUP: quic: create a dedicated quic_conn module
- BUG/MINOR: mux-quic: ignore STOP_SENDING for locally closed stream
- BUG/MEDIUM: lua: Don't crash in hlua_lua2arg_check on failure
- BUG/MEDIUM: lua: handle stick table implicit arguments right.
- BUILD: h1: silence an initiialized warning with gcc-4.7 and -Os
- MINOR: fd: add a new function to only raise RLIMIT_NOFILE
- MINOR: init: do not try to shrink existing RLIMIT_NOFIlE
- BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth()
- BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os
- BUG/MINOR: hlua: hlua_channel_insert_data() behavior conflicts with documentation
- MINOR: quic: limit usage of ssl_sock_ctx in favor of quic_conn
- MINOR: mux-quic: check quic-conn return code on Tx
- CLEANUP: quic: fix indentation
- MEDIUM: quic: retrieve frontend destination address
- CLEANUP: Reapply ist.cocci (2)
- CLEANUP: Reapply strcmp.cocci
- CLEANUP: quic/receiver: remove the now unused tx_qring list
- BUG/MINOR: quic: set IP_PKTINFO socket option for QUIC receivers only
- MINOR: hlua: some luaL_checktype() calls were not guarded with MAY_LJMP
- DOC: configuration: missing 'if' in tcp-request content example
- MINOR: hlua: removing ambiguous lua_pushvalue with 0 index
- BUG/MAJOR: stick-tables: do not try to index a server name for applets
- MINOR: plock: support disabling exponential back-off
- MINOR: freq_ctr: use the thread's local time whenever possible
- MEDIUM: stick-table: switch the table lock to rwlock
- MINOR: stick-table: do not take an exclusive lock when downing ref_cnt
- MINOR: stick-table: move the write lock inside stktable_touch_with_exp()
- MEDIUM: stick-table: only take the lock when needed in stktable_touch_with_exp()
- MEDIUM: stick-table: make stksess_kill_if_expired() avoid the exclusive lock
- MEDIUM: stick-table: return inserted entry in __stktable_store()
- MEDIUM: stick-table: free newly allocated stkess if it couldn't be inserted
- MEDIUM: stick-table: switch to rdlock in stktable_lookup() and lookup_key()
- MEDIUM: stick-table: make stktable_get_entry() look up under a read lock
- MEDIUM: stick-table: do not take a lock to update t->current anymore.
- MEDIUM: stick-table: make stktable_set_entry() look up under a read lock
- MEDIUM: stick-table: requeue the expiration task out of the exclusive lock
- MINOR: stick-table: split stktable_store() between key and requeue
- MEDIUM: stick-table: always use atomic ops to requeue the table's task
- MEDIUM: stick-table: requeue the wakeup task out of the write lock
- BUG/MINOR: stick-table: fix build with DEBUG_THREAD
- REORG: mux-fcgi: Extract flags and enums into mux_fcgi-t.h
- MINOR: flags/mux-fcgi: Decode FCGI connection and stream flags
- BUG/MEDIUM: mux-h1: Add connection error handling when reading/sending on a pipe
- BUG/MEDIUM: mux-h1: Handle abort with an incomplete message during parsing
- BUG/MINOR: server: make sure "show servers state" hides private bits
- MINOR: checks: use the lighter PRNG for spread checks
- MEDIUM: checks: spread the checks load over random threads
- CI: SSL: use proper version generating when "latest" semantic is used
- CI: SSL: temporarily stick to LibreSSL=3.5.3
- MINOR: quic: New quic_cstream object implementation
- MINOR: quic: Extract CRYPTO frame parsing from qc_parse_pkt_frms()
- MINOR: quic: Use a non-contiguous buffer for RX CRYPTO data
- BUG/MINOR: quic: Stalled 0RTT connections with big ClientHello TLS message
- MINOR: quic: Split the secrets key allocation in two parts
- CLEANUP: quic: remove unused rxbufs member in receiver
- CLEANUP: quic: improve naming for rxbuf/datagrams handling
- MINOR: quic: implement datagram cleanup for quic_receiver_buf
- MINOR: ring: ring_cast_from_area() cast from an allocated area
- MINOR: buffers: split b_force_xfer() into b_cpy() and b_force_xfer()
- MINOR: logs: startup-logs can use a shm for logging the reload
- MINOR: mworker/cli: reload command displays the startup-logs
- MEDIUM: quic: respect the threads assigned to a bind line
- DOC: management: update the "reload" command of the master CLI
- BUILD: ssl_sock: bind_conf uninitialized in ssl_sock_bind_verifycbk()
- BUG/MEDIUM: httpclient: Don't set EOM flag on an empty HTX message
- MINOR: httpclient/lua: Don't set req_payload callback if body is empty
- DOC/CLEANUP: lua-api: some minor corrections
- DOC: lua-api: updating toolbox link
- DOC/CLEANUP: lua-api: removing duplicate core.proxies attribute
- DOC: management: add forgotten "show startup-logs"
- DOC: management: "show startup-logs" for master CLI
- CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in matrix.py
- CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in workflow definition
|
||
|
Aurelien DARRAGON
|
d49b559a15 |
DOC: configuration: missing 'if' in tcp-request content example
An example given for tcp-request content rule with lua
was missing 'if' keyword. Using it "as is" makes haproxy unhappy.
The example was introduced with
|
||
|
Christopher Faulet
|
59307b3e4e |
DOC: config: Fix pgsql-check documentation to make user param mandatory
The username is required in the Start-up message. Thus, since the 2.2, when this health-check was refactored, the user parameter is mandatory. On prior versions, when no username is provided, no pgsql check is performed but only a basic tcpcheck. This patch should be backported as far as 2.2. |
||
|
Willy Tarreau
|
dd4a2a69dc |
[RELEASE] Released version 2.7-dev7
Released version 2.7-dev7 with the following main changes :
- BUG/MEDIUM: mux-quic: fix nb_hreq decrement
- CLEANUP: httpclient: deleted unused variables
- MINOR: httpclient: enabled the use of SNI presets
- OPTIM: hpack-huff: reduce the cache footprint of the huffman decoder
- BUG/MINOR: mux-quic: do not keep detached qcs with empty Tx buffers
- REORG: mux-quic: extract traces in a dedicated source file
- REORG: mux-quic: export HTTP related function in a dedicated file
- MINOR: mux-quic: refactor snd_buf
- BUG/MEDIUM: mux-quic: properly trim HTX buffer on snd_buf reset
- BUG/MINOR: mux-h1: Account consumed output data on synchronous connection error
- BUG/MINOR: log: improper behavior when escaping log data
- CLEANUP: tools: removing escape_chunk() function
- MINOR: clock: split local and global date updates
- MINOR: pollers: only update the local date during busy polling
- MINOR: clock: do not update the global date too often
- REGTESTS: 4be_1srv_smtpchk_httpchk_layer47errors: Return valid SMTP replies
- MINOR: smtpchk: Update expect rule to fully match replies to EHLO commands
- BUG/MINOR: smtpchk: SMTP Service check should gracefully close SMTP transaction
- MINOR: list: documenting mt_list_for_each_entry_safe() macro
- CLEANUP: list: Fix mt_list_for_each_entry_safe indentation
- BUG/MINOR: hlua: Remove \n in Lua error message built with memprintf
- MINOR: hlua: Allow argument on lua-lod(-per-thread) directives
- BUG/MINOR: anon: memory illegal accesses in tools.c with hash_anon and hash_ipanon
- MEDIUM: mworker/cli: keep the connection of the FD that ask for a reload
- BUG/MINOR: hlua: fixing ambiguous sizeof in hlua_load_per_thread
- MINOR: mworker/cli: replace close() by fd_delete()
- MINOR: mworker: store and shows loading status
- MINOR: mworker: mworker_cli_proxy_new_listener() returns a bind_conf
- MINOR: mworker: stores the mcli_reload bind_conf
- MINOR: mworker/cli: the mcli_reload bind_conf only send the reload status
- DOC: management: describe the new reload command behavior
- CLEANUP: list: fix again some style issues in the recent comments
- BUG/MINOR: stream: Perform errors handling in right order in stream_new()
- BUG/MEDIUM: stconn: Reset SE descriptor when we fail to create a stream
- BUG/MEDIUM: resolvers: Remove aborted resolutions from query_ids tree
- DOC: management: add timeout on the "reload" command
- BUG/MINOR: ring: fix the size check in ring_make_from_area()
- BUG/MINOR: config: don't count trailing spaces as empty arg
- Revert "BUG/MINOR: config: don't count trailing spaces as empty arg"
- BUG/MINOR: hlua: fixing hlua_http_msg_del_data behavior
- BUG/MINOR: hlua: fixing hlua_http_msg_insert_data behavior
- MINOR: cli: Add anonymization on a missed element for 'show sess all'
- MINOR: cli: remove error message with 'set anon on|off'
- MINOR: tools: modify hash_ipanon in order to use it in cli
- MINOR: cli: use hash_ipanon to anonymized address
- MINOR: cli: Add an anonymization on a missed element in 'show server state'
- MINOR: config: correct errors about argument number in condition in cfgparse.c
- MINOR: config: Add other keywords when dump the anonymized configuration file
- MINOR: config: Add option line when the configuration file is dumped
- MINOR: cli: correct commentary and replace 'set global-key' name
- MINOR: tools: Impprove hash_ipanon to support dgram sockets and port offsets
- MINOR: tools: Impprove hash_ipanon to not hash FD-based addresses
- BUG/MINOR: hlua: _hlua_http_msg_delete incorrect behavior when offset is used
- DOC: management: httpclient can resolve server names in URLs
- BUG/MINOR: hlua: prevent crash when loading numerous arguments using lua-load(per-thread)
- DOC/CLEANUP: lua-api: removing duplicate date functions doc
- MINOR: hlua: ambiguous lua_pushvalue with 0 index
- BUG/MINOR: config: don't count trailing spaces as empty arg (v2)
- BUG/MEDIUM: config: count line arguments without dereferencing the output
- BUG/MAJOR: conn-idle: fix hash indexing issues on idle conns
- BUG/MINOR: config: insufficient syntax check of the global "maxconn" value
- BUG/MINOR: backend: only enforce turn-around state when not redispatching
|
||
Thierry Fournier
|
ae6b56800f |
MINOR: hlua: Allow argument on lua-lod(-per-thread) directives
Allow per-lua file argument which makes multiples configuration easier to handle This patch fixes issue #1609. |
||
|
Willy Tarreau
|
4b10a5c439 |
[RELEASE] Released version 2.7-dev6
Released version 2.7-dev6 with the following main changes :
- MINOR: Revert part of clarifying samples support per os commit
- BUILD: makefile: enable crypt(3) for NetBSD
- BUG/MINOR: quic: Retransmitted frames marked as acknowledged
- BUG/MINOR: quic: Possible crash with "tls-ticket-keys" on QUIC bind lines
- MINOR: http-check: Remove support for headers/body in "option httpchk" version
- BUG/MINOR: h1: Support headers case adjustment for TCP proxies
- BUG/MINOR: quic: Possible crash when verifying certificates
- BUILD: quic: add some ifdef around the SSL_ERROR_* for libressl
- BUILD: ssl: fix ssl_sock_switchtx_cbk when no client_hello_cb
- BUILD: quic: temporarly ignore chacha20_poly1305 for libressl
- BUILD: quic: enable early data only with >= openssl 1.1.1
- BUILD: ssl: fix the ifdef mess in ssl_sock_initial_ctx
- BUILD: quic: fix the #ifdef in ssl_quic_initial_ctx()
- MINOR: quic: add QUIC support when no client_hello_cb
- MINOR: quic: Add traces about sent or resent TX frames
- MINOR: quic: No TRACE_LEAVE() in retrieve_qc_conn_from_cid()
- BUG/MINOR: quic: Wrong connection ID to thread ID association
- BUG/MINOR: task: always reset a new tasklet's call date
- BUG/MINOR: task: make task_instant_wakeup() work on a task not a tasklet
- MINOR: task: permanently enable latency measurement on tasklets
- CLEANUP: task: rename ->call_date to ->wake_date
- BUG/MINOR: sched: properly account for the CPU time of dying tasks
- MINOR: sched: store the current profile entry in the thread context
- BUG/MINOR: stream/sched: take into account CPU profiling for the last call
- MINOR: tasks: do not keep cpu and latency times in struct task
- MINOR: tools: add generic pointer hashing functions
- CLEANUP: activity: make memprof use the generic ptr_hash() function
- CLEANUP: activity: make taskprof use ptr_hash()
- MINOR: debug: add struct ha_caller to describe a calling location
- CLEANUP: debug: use struct ha_caller for memstat
- DEBUG: task: define a series of wakeup types for tasks and tasklets
- DEBUG: task: use struct ha_caller instead of arrays of file:line
- DEBUG: applet: instrument appctx_wakeup() to log the caller's location
- DEBUG: task: simplify the caller recording in DEBUG_TASK
- CLEANUP: task: move tid and wake_date into the common part
- CLEANUP: sched: remove duplicate code in run_tasks_from_list()
- CLEANUP: activity: make the number of sched activity entries more configurable
- DEBUG: resolvers: unstatify process_resolvers() to make it appear in profiling
- DEBUG: quic: export the few task handlers that often appear in task dumps
- MEDIUM: tasks/activity: combine the called function with the caller
- MINOR: tasks/activity: improve the caller-callee activity hash
- MINOR: activity/cli: support aggregating task profiling outputs
- MINOR: activity/cli: support sorting task profiling by total CPU time
- BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals
- BUG/MINOR: quic: Speed up the handshake completion only one time
- BUG/MINOR: quic: Trace fix about packet number space information.
- BUG/MINOR: h3: Crash when h3 trace verbosity is "minimal"
- MINOR: h3: Add the quic_conn object to h3 traces
- MINOR: h3: Missing connection argument for a TRACE_LEAVE() argument
- MINOR: h3: Send the h3 settings with others streams (requests)
- MINOR: dev/udp: Apply the corruption to both directions
- BUILD: udp-perturb: Add a make target for udp-perturb tool
- BUG/MINOR: signals/poller: ensure wakeup from signals
- CI: cirrus-ci: bump FreeBSD image to 13-1
- DEV: flags: fix usage message to reflect available options
- DEV: flags: add missing CO_FL_FDLESS connection flag
- MINOR: flags: add a new file to host flag dumping macros
- MINOR: flags: implement a macro used to dump enums inside masks
- MINOR: flags/channel: use flag dumping for channel flags and analysers
- MINOR: flags/connection: use flag dumping for connection flags
- MINOR: flags/stconn: use flag dumping for stconn and sedesc flags
- MINOR: flags/stream: use flag dumping for stream error type
- MINOR: flags/stream: use flag dumping for stream flags
- MINOR: flags/task: use flag dumping for task state
- MINOR: flags/http_ana: use flag dumping for txn flags
- DEV: flags: remove the now unused SHOW_FLAG() definition
- DEV: flags: remove the now useless intermediary functions
- MINOR: flags/htx: use flag dumping to show htx and start-line flags
- MINOR: flags/http_ana: use flag dumping to show http msg states
- BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK
- MINOR: listener: small API change
- MINOR: proxy/listener: support for additional PAUSED state
- BUG/MINOR: stats: fixing stat shows disabled frontend status as 'OPEN'
- BUILD: flags: fix build warning in some macros used by show_flags
- BUILD: flags: fix the fallback macros for missing stdio
- CLEANUP: pollers: remove dead code in the polling loop
- BUG/MINOR: mux-h1: Increment open_streams counter when H1 stream is created
- REGTESTS: healthcheckmail: Relax matching on the healthcheck log message
- CLEANUP: listener: function comment typo in stop_listener()
- BUG/MINOR: listener: null pointer dereference suspected by coverity
- MINOR: flags/fd: decode FD flags states
- REORG: mux-h2: extract flags and enums into mux_h2-t.h
- MINOR: flags/mux-h2: decode H2C and H2S flags
- REGTESTS: log: test the log-forward feature
- BUG/MEDIUM: sink: bad init sequence on tcp sink from a ring.
- REGTESTS: ssl/log: test the log-forward with SSL
- MEDIUM: httpclient: httpclient_create_proxy() creates a proxy for httpclient
- MEDIUM: httpclient: allow to use another proxy
- DOC: fix TOC in starter guide for subsection 3.3.8. Statistics
- MINOR: httpclient: export httpclient_create_proxy()
- MEDIUM: quic: separate path for rx and tx with set_encryption_secrets
- BUG/MEDIUM: mux-quic: fix crash on early app-ops release
- REORG: mux-h1: extract flags and enums into mux_h1-t.h
- MINOR: flags/mux-h1: decode H1C and H1S flags
- CLEANUP: mux-quic: remove stconn usage in h3/hq
- BUG/MINOR: mux-quic: do not remotely close stream too early
- CLEANUP: exclude udp-perturb with .gitignore
- BUG/MEDIUM: server: segv when adding server with hostname from CLI
- CLEANUP: quic,ssl: fix tiny typos in C comments
- BUG/MEDIUM: captures: free() an error capture out of the proxy lock
- BUILD: fd: fix a build warning on the DWCAS
- MINOR: anon: add new macros and functions to anonymize contents
- MINOR: anon: store the anonymizing key in the global structure
- MINOR: anon: store the anonymizing key in the CLI's appctx
- MINOR: cli: anonymize commands 'show sess' and 'show sess all'
- MINOR: cli: anonymize 'show servers state' and 'show servers conn'
- MINOR: config: add command-line -dC to dump the configuration file
- SCRIPTS: announce-release: update some URLs to https
|
||
Erwan Le Goas
|
b0c0501516 |
MINOR: config: add command-line -dC to dump the configuration file
This commit adds a new command line option -dC to dump the configuration file. An optional key may be appended to -dC in order to produce an anonymized dump using this key. The anonymizing process uses the same algorithm as the CLI so that the same key will produce the same hashes for the same identifiers. This way an admin may share an anonymized extract of a configuration to match against live dumps. Note that key 0 will not anonymize the output. However, in any case, the configuration is dumped after tokenizing, thus comments are lost. |
||
|
Erwan Le Goas
|
fad9da83da |
MINOR: anon: store the anonymizing key in the global structure
Add a uint32_t key in global to hash words with it. A new CLI command 'set global-key <key>' was added to change the global anonymizing key. The global may also be set in the configuration using the global "anonkey" directive. For now this key is not used. |
||
|
Christopher Faulet
|
4b5f3029bc |
MINOR: http-check: Remove support for headers/body in "option httpchk" version
This trick is deprecated since the health-check refactoring, It is now invalid. It means the following line will trigger an error during the configuration parsing: option httpchk OPTIONS * HTTP/1.1\r\nHost:\ www It must be replaced by: option httpchk OPTIONS * HTTP/1.1 http-check send hdr Host www |
||
|
Willy Tarreau
|
3bb2b5db50 |
[RELEASE] Released version 2.7-dev5
Released version 2.7-dev5 with the following main changes :
- BUG/MINOR: mux-quic: Fix memleak on QUIC stream buffer for unacknowledged data
- BUG/MEDIUM: cpu-map: fix thread 1's affinity affecting all threads
- MINOR: cpu-map: remove obsolete diag warning about combined ranges
- BUG/MAJOR: mworker: fix infinite loop on master with no proxies.
- REGTESTS: launch http_reuse_always in mworker mode
- BUG/MINOR: quix: Memleak for non in flight TX packets
- BUG/MINOR: quic: Wrong list_for_each_entry() use when building packets from qc_do_build_pkt()
- BUG/MINOR: quic: Safer QUIC frame builders
- MINOR: quic: Replace MT_LISTs by LISTs for RX packets.
- BUG/MEDIUM: applet: fix incorrect check for abnormal return condition from handler
- BUG/MINOR: applet: make the call_rate only count the no-progress calls
- MEDIUM: peers: limit the number of updates sent at once
- BUILD: tcp_sample: fix build of get_tcp_info() on OpenBSD
- BUG/MINOR: resolvers: return the correct value in resolvers_finalize_config()
- BUG/MINOR: mworker: does not create the "default" resolvers in wait mode
- BUG/MINOR: tcpcheck: Disable QUICKACK only if data should be sent after connect
- REGTESTS: Fix prometheus script to perform HTTP health-checks
- MINOR: resolvers: shut the warning when "default" resolvers is implicit
- Revert "BUG/MINOR: quix: Memleak for non in flight TX packets"
- BUG/MINOR: quic: Leak in qc_release_lost_pkts() for non in flight TX packets
- BUG/MINOR: quic: Stalled connections (missing I/O handler wakeup)
- CLEANUP: quic: No more use ->rx_list MT_LIST entry point (quic_rx_packet)
- CLEANUP: quic: Remove a useless check in qc_lstnr_pkt_rcv()
- MINOR: quic: Remove useless traces about references to TX packets
- Revert "MINOR: quic: Remove useless traces about references to TX packets"
- DOC: configuration: do-resolve doesn't work with a port in the string
- MINOR: sample: add the host_only and port_only converters
- BUG/MINOR: httpclient: fix resolution with port
- DOC: configuration.txt: do-resolve must use host_only to remove its port.
- BUG/MINOR: quic: Null packet dereferencing from qc_dup_pkt_frms() trace
- BUG/MINOR: quic: Frames added to packets even if not built.
- BUG/MEDIUM: spoe: Properly update streams waiting for a ACK in async mode
- BUG/MEDIUM: peers: Add connect and server timeut to peers proxy
- BUG/MEDIUM: peers: Don't use resync timer when local resync is in progress
- BUG/MEDIUM: peers: Don't start resync on reload if local peer is not up-to-date
- BUG/MINOR: hlua: Rely on CF_EOI to detect end of message in HTTP applets
- BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input
- BUG/MINOR: epoll: do not actively poll for Rx after an error
- MINOR: raw-sock: don't try to send if an error was already reported
- BUG/MINOR: quic: Missing header protection AES cipher context initialisations (draft-v2)
- MINOR: quic: Add a trace to distinguish the datagram from the packets inside
- BUG/MINOR: ssl: fix deinit of the ca-file tree
- BUG/MINOR: ssl: leak of ckch_inst_link in ckch_inst_free()
- BUG/MINOR: tcpcheck: Disable QUICKACK for default tcp-check (with no rule)
- BUG/MEDIUM: ssl: Fix a UAF when old ckch instances are released
- BUG/MINOR: ssl: revert two wrong fixes with ckhi_link
- BUG/MINOR: dev/udp: properly preset the rx address size
- BUILD: debug: make sure debug macros are never empty
- MINOR: quic: Move traces about RX/TX bytes from QUIC_EV_CONN_PRSAFRM event
- BUG/MINOR: quic: TX frames memleak
- BUG/MINOR: ssl: leak of ckch_inst_link in ckch_inst_free() v2
- MINOR: sink/ring: rotate non-empty file-backed contents only
- BUG/MINOR: regex: Properly handle PCRE2 lib compiled without JIT support
- REGTESTS: http_request_buffer: Add a barrier to not mix up log messages
- BUG/MEDIUM: mux-h1: always use RST to kill idle connections in pools
- MINOR: backend: always satisfy the first req reuse rule with l7 retries
- BUG/MINOR: quic: Do not ack when probing
- MINOR: quic: Add TX frames addresses to traces to several trace events
- MINOR: quic: Trace typo fix in qc_release_frm()
- BUG/MINOR: quic: Frames leak during retransmissions
- BUG/MINOR: h2: properly set the direction flag on HTX response
- BUG/MEDIUM: httpclient: always detach the caller before self-killing
- BUG/MINOR: httpclient: only ask for more room on failed writes
- BUG/MINOR: httpclient: keep-alive was accidentely disabled
- MEDIUM: httpclient: enable ALPN support on outgoing https connections
- BUG/MINOR: mux-h2: fix the "show fd" dest buffer for the subscriber
- BUG/MINOR: mux-h1: fix the "show fd" dest buffer for the subscriber
- BUG/MINOR: mux-fcgi: fix the "show fd" dest buffer for the subscriber
- DEBUG: stream: minor rearrangement of a few fields in struct stream.
- MINOR: debug: report applet pointer and handler in crashes when known
- MINOR: mux-h2: extract the stream dump function out of h2_show_fd()
- MINOR: mux-h2: extract the connection dump function out of h2_show_fd()
- MINOR: muxes: add a "show_sd" helper to complete "show sess" dumps
- MINOR: mux-h2: provide a "show_sd" helper to output stream debugging info
- MINOR: mux-h2: insert line breaks in "show sess all" output for legibility
- MINOR: mux-quic: provide a "show_sd" helper to output stream debugging info
- MINOR: mux-h1: split "show_fd" into connection and stream
- MINOR: mux-h1: provide a "show_sd" helper to output stream debugging info
- BUG/MINOR: http-act: initialize http fmt head earlier
|
||
|
Willy Tarreau
|
32872db605 |
MINOR: sink/ring: rotate non-empty file-backed contents only
If the service is rechecked before a reload, that may cause the config to be parsed twice and file-backed rings to be lost. Here we make sure that such a ring does contain information before deciding to rotate it. This way the first process starting after some writes will cause a rotate but not subsequent ones until new writes are applied. An attempt was also made to disable rotations on checks but this was a bad idea, as the ring is still initialized and this causes the contents to be lost. The choice of initializing the ring during parsing is questionable but the config check ought to be as close as possible to a real start, and we could imagine that the ring is used by some code during startup (e.g. lua). So this approach was abandonned and config checks also cause a rotation, as the purpose of this rotation is to preserve latest information against accidental removal. |
||
|
William Lallemand
|
b5c2cd461d |
DOC: configuration.txt: do-resolve must use host_only to remove its port.
The do-resolve action does not support a port in its parameter string, the host_only converter must be used. Must be backported to 2.6. |
||
|
William Lallemand
|
dd754cba16 |
MINOR: sample: add the host_only and port_only converters
Add 2 converters that can manipulate the value of an Host header. host_only will return the host without any port, and port_only will return the port. |
||
|
William Lallemand
|
1ef2460934 |
DOC: configuration: do-resolve doesn't work with a port in the string
Fix the documentation about do-resolve to handle the case where a port is associated to the hostname in the Host header. Must be backported as far as 2.0. |
||
|
Willy Tarreau
|
8bd146d8af |
MEDIUM: peers: limit the number of updates sent at once
As seen in GH issue #1770, peers synchronization do not cope well with very large buffers because by default the only two reasons for stopping the processing of updates is either that the end was reached or that the buffer is full. This can cause high latencies, and even rightfully trigger the watchdog when the operations are numerous and slowed down by competition on the stick-table lock. This patch introduces a limit to the number of messages one may send at once, which now defaults to 200, regardless of the buffer size. This means taking and releasing the lock up to 400 times in a row, which is costly enough to let some other parts work. After some observation this could be backported to 2.6. If so, however, previous commits "BUG/MEDIUM: applet: fix incorrect check for abnormal return condition from handler" and "BUG/MINOR: applet: make the call_rate only count the no-progress calls" must be backported otherwise the call rate might trigger the looping protection. |
||
|
Willy Tarreau
|
f53201940b |
[RELEASE] Released version 2.7-dev4
Released version 2.7-dev4 with the following main changes :
- BUG/MEDIUM: quic: Wrong packet length check in qc_do_rm_hp()
- MINOR: quic: Too much useless traces in qc_build_frms()
- BUG/MEDIUM: quic: Missing AEAD TAG check after removing header protection
- MINOR: quic: Replace pool_zalloc() by pool_malloc() for fake datagrams
- MINOR: debug: make the mem_stats section aligned to void*
- MINOR: debug: store and report the pool's name in struct mem_stats
- MINOR: debug: also store the function name in struct mem_stats
- MINOR: debug/memstats: automatically determine first column size
- MINOR: debug/memstats: permit to pass the size to free()
- CLEANUP: mux-quic: remove loop on sending frames
- MINOR: quic: replace custom buf on Tx by default struct buffer
- MINOR: quic: release Tx buffer on each send
- MINOR: quic: refactor datagram commit in Tx buffer
- MINOR: quic: skip sending if no frame to send in io-cb
- BUG/MINOR: mux-quic: open stream on STOP_SENDING
- BUG/MINOR: quic: fix crash on handshake io-cb for null next enc level
- BUG/MEDIUM: quic: always remove the connection from the accept list on close
- BUG/MEDIUM: poller: use fd_delete() to release the poller pipes
- BUG/MEDIUM: task: relax one thread consistency check in task_unlink_wq()
- MEDIUM: quic: xprt traces rework
- BUILD: stconn: fix build warning at -O3 about possible null sc
- MINOR: quic: Remove useless lock for RX packets
- BUG/MINOR: quic: Possible infinite loop in quic_build_post_handshake_frames()
- CLEANUP: quic: Remove trailing spaces
- MINOR: mux-quic: adjust enter/leave traces
- MINOR: mux-quic: define protocol error traces
- CLEANUP: mux-quic: adjust traces level
- MINOR: mux-quic: define new traces
- BUG/MEDIUM: mux-quic: fix crash due to invalid trace arg
- BUG/MEDIUM: quic: Possible use of uninitialized <odcid> variable in qc_lstnr_params_init()
- BUG/MEDIUM: ring: fix too lax 'size' parser
- BUG/MEDIUM: quic: Wrong use of <token_odcid> in qc_lsntr_pkt_rcv()
- BUILD: ring: forward-declare struct appctx to avoid a build warning
- MINOR: ring: support creating a ring from a linear area
- MINOR: ring: add support for a backing-file
- DEV: haring: add a simple utility to read file-backed rings
- DEV: haring: support remapping LF in contents with CR VT
- BUG/MINOR: quic: memleak on wrong datagram receipt
- BUILD: sink: replace S_IRUSR, S_IWUSR with their octal value
- MINOR: ring: archive a previous file-backed ring on startup
- BUG/MINOR: mux-quic: fix crash with traces in qc_detach()
- BUG/MINOR: quic: MIssing check when building TX packets
- BUG/MINOR: quic: Wrong status returned by qc_pkt_decrypt()
- MINOR: memprof: export the minimum definitions for memory profiling
- MINOR: pool/memprof: report pool alloc/free in memory profiling
- MINOR: pools/memprof: store and report the pool's name in each bin
- MINOR: chunk: inline alloc_trash_chunk()
- MINOR: stick-table: Add table_expire() and table_idle() new converters
- CLEANUP: exclude haring with .gitignore
- MINOR: quic: adjust quic_frame flag manipulation
- MINOR: h3: report error on control stream close
- MINOR: qpack: report error on enc/dec stream close
- BUG/MEDIUM: mux-quic: reject uni stream ID exceeding flow control
- MINOR: mux-quic: adjust traces on stream init
- MINOR: mux-quic: add missing args on some traces
- MINOR: quic: refactor application send
- BUG/MINOR: quic: do not notify MUX on frame retransmit
- BUG/MEDIUM: http-ana: fix crash or wrong header deletion by http-restrict-req-hdr-names
- BUG/MINOR: quic: Missing initializations for ducplicated frames.
- BUG/MEDIUM: quic: fix crash on MUX send notification
- REORG: h2: extract cookies concat function in http_htx
- REGTESTS: add test for HTTP/2 cookies concatenation
- MEDIUM: h3: concatenate multiple cookie headers
- MINOR: applet: add a function to reset the svcctx of an applet
- BUG/MEDIUM: cli: always reset the service context between commands
- BUG/MEDIUM: mux-h2: do not fiddle with ->dsi to indicate demux is idle
- MINOR: mux-h2/traces: report transition to SETTINGS1 before not after
- MINOR: mux-h2: make streams know if they need to send more data
- BUG/MINOR: mux-h2: send a CANCEL instead of ES on truncated writes
- BUG/MINOR: quic: Possible crashes when dereferencing ->pkt quic_frame struct member
- MINOR: quic: Add frame addresses to QUIC_EV_CONN_PRSAFRM event traces
- BUG/MINOR: quic: Wrong splitted duplicated frames handling
- MINOR: quic: Add the QUIC connection to mux traces
- MINOR: quic: Trace fix in qc_release_frm()
- BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized
- BUG/MAJOR: log-forward: Fix ssl layer not initialized on bind even if configured
- MINOR: quic: Add reusable cipher contexts for header protection
- BUG/MINOR: ssl/cli: error when the ca-file is empty
- MINOR: ssl: handle ca-file appending in cafile_entry
- MINOR: ssl/cli: implement "add ssl ca-file"
|
||
|
Frdric Lcaille
|
bbeec37b31 |
MINOR: stick-table: Add table_expire() and table_idle() new converters
table_expire() returns the expiration delay for a stick-table entry associated to an input sample. Its counterpart table_idle() returns the time the entry remained idle since the last time it was updated. Both converters may take a default value as second argument which is returned when the entry is not present. |
||
|
Willy Tarreau
|
ded77cc71f |
MINOR: ring: archive a previous file-backed ring on startup
In order to ensure that an instant restart of the process will not wipe precious debugging information, and to leave time for an admin to archive a copy of a ring, now upon startup, any previously existing file will be renamed with the extra suffix ".bak", and any previously existing file with suffix ".bak" will be removed. |
||
|
Willy Tarreau
|
0b8e9ceb12 |
MINOR: ring: add support for a backing-file
This mmaps a file which will serve as the backing-store for the ring's contents. The idea is to provide a way to retrieve sensitive information (last logs, debugging traces) even after the process stops and even after a possible crash. Right now this was possible by connecting to the CLI and dumping the contents of the ring live, but this is not handy and consumes quite a bit of resources before it is needed. With a backing file, the ring is effectively RAM-mapped file, so that contents stored there are the same as those found in the file (the OS doesn't guarantee immediate sync but if the process dies it will be OK). Note that doing that on a filesystem backed by a physical device is a bad idea, as it will induce slowdowns at high loads. It's really important that the device is RAM-based. Also, this may have security implications: if the file is corrupted by another process, the storage area could be corrupted, causing haproxy to crash or to overwrite its own memory. As such this should only be used for debugging. |
||
|
Willy Tarreau
|
87e95d38a9 |
[RELEASE] Released version 2.7-dev3
Released version 2.7-dev3 with the following main changes :
- BUILD: makefile: Fix install(1) handling for OpenBSD/NetBSD/Solaris/AIX
- BUG/MEDIUM: tools: avoid calling dlsym() in static builds (try 2)
- MINOR: resolvers: resolvers_destroy() deinit and free a resolver
- BUG/MINOR: resolvers: shut off the warning for the default resolvers
- BUG/MINOR: ssl: allow duplicate certificates in ca-file directories
- BUG/MINOR: tools: fix statistical_prng_range()'s output range
- BUG/MINOR: quic: do not send CONNECTION_CLOSE_APP in initial/handshake
- BUILD: debug: Add braces to if statement calling only CHECK_IF()
- BUG/MINOR: fd: Properly init the fd state in fd_insert()
- BUG/MEDIUM: fd/threads: fix incorrect thread selection in wakeup broadcast
- MINOR: init: load OpenSSL error strings
- MINOR: ssl: enhance ca-file error emitting
- BUG/MINOR: mworker/cli: relative pid prefix not validated anymore
- BUG/MAJOR: mux_quic: fix invalid PROTOCOL_VIOLATION on POST data overlap
- BUG/MEDIUM: mworker: proc_self incorrectly set crashes upon reload
- BUILD: add detection for unsupported compiler models
- BUG/MEDIUM: stconn: Only reset connect expiration when processing backend side
- BUG/MINOR: backend: Fallback on RR algo if balance on source is impossible
- BUG/MEDIUM: master: force the thread count earlier
- BUG/MAJOR: poller: drop FD's tgid when masks don't match
- DEBUG: fd: detect possibly invalid tgid in fd_insert()
- BUG/MINOR: sockpair: wrong return value for fd_send_uxst()
- MINOR: sockpair: move send_fd_uxst() error message in caller
- Revert "BUG/MINOR: peers: set the proxy's name to the peers section name"
- DEBUG: fd: split the fd check
- MEDIUM: resolvers: continue startup if network is unavailable
- BUG/MINOR: fd: always remove late updates when freeing fd_updt[]
- MINOR: cli: emit a warning when _getsocks was used more than once
- BUG/MINOR: mworker: PROC_O_LEAVING used but not updated
- Revert "MINOR: cli: emit a warning when _getsocks was used more than once"
- MINOR: cli: warning on _getsocks when socket were closed
- BUG/MEDIUM: mux-quic: fix missing EOI flag to prevent streams leaks
- MINOR: quic: Congestion control architecture refactoring
- MEDIUM: quic: Cubic congestion control algorithm implementation
- MINOR: quic: New "quic-cc-algo" bind keyword
- BUG/MINOR: quic: loss time limit variable computed but not used
- MINOR: quic: Stop looking for packet loss asap
- BUG/MAJOR: quic: Useless resource intensive loop qc_ackrng_pkts()
- MINOR: quic: Send packets as much as possible from qc_send_app_pkts()
- BUG/MEDIUM: queue/threads: limit the number of entries dequeued at once
- MAJOR: threads/plock: update the embedded library
- MINOR: thread: provide an alternative to pthread's rwlock
- DEBUG: tools: provide a tree dump function for ebmbtrees as well
- MINOR: ebtree: add ebmb_lookup_shorter() to pursue lookups
- BUG/MEDIUM: pattern: only visit equivalent nodes when skipping versions
- BUG/MINOR: mux-quic: prevent crash if conn released during IO callback
- CLEANUP: mux-quic: remove useless app_ops is_active callback
- BUG/MINOR: mux-quic: do not free conn if attached streams
- MINOR: mux-quic: save proxy instance into qcc
- MINOR: mux-quic: use timeout server for backend conns
- MEDIUM: mux-quic: adjust timeout refresh
- MINOR: mux-quic: count in-progress requests
- MEDIUM: mux-quic: implement http-keep-alive timeout
- MINOR: peers: Add a warning about incompatible SSL config for the local peer
- MINOR: peers: Use a dedicated reconnect timeout when stopping the local peer
- BUG/MEDIUM: peers: limit reconnect attempts of the old process on reload
- BUG/MINOR: peers: Use right channel flag to consider the peer as connected
- BUG/MEDIUM: dns: Properly initialize new DNS session
- BUG/MINOR: backend: Don't increment conn_retries counter too early
- MINOR: server: Constify source server to copy its settings
- REORG: server: Export srv_settings_cpy() function
- BUG/MEDIUM: proxy: Perform a custom copy for default server settings
- BUG/MINOR: quic: Missing in flight ack eliciting packet counter decrement
- BUG/MEDIUM: quic: Floating point exception in cubic_root()
- MINOR: h3: support HTTP request framing state
- MINOR: mux-quic: refresh timeout on frame decoding
- MINOR: mux-quic: refactor refresh timeout function
- MEDIUM: mux-quic: implement http-request timeout
- BUG/MINOR: quic: Avoid sending truncated datagrams
- BUG/MINOR: ring/cli: fix a race condition between the writer and the reader
- BUG/MEDIUM: sink: Set the sink ref for forwarders created during ring parsing
- BUG/MINOR: sink: fix a race condition between the writer and the reader
- BUG/MINOR: quic: do not reject datagrams matching minimum permitted size
- MINOR: quic: Add two new stats counters for sendto() errors
- BUG/MINOR: quic: Missing Initial packet dropping case
- MINOR: quic: explicitely ignore sendto error
- BUG/MINOR: quic: adjust errno handling on sendto
- BUG/MEDIUM: quic: break out of the loop in quic_lstnr_dghdlr
- MINOR: threads: report the number of thread groups in build options
- MINOR: config: automatically preset MAX_THREADS based on MAX_TGROUPS
- BUILD: SSL: allow to pass additional configure args to QUICTLS
- CI: enable weekly "m32" builds on x86_64
- CLEANUP: assorted typo fixes in the code and comments
- BUG/MEDIUM: fix DH length when EC key is used
- REGTESTS: ssl: adopt tests to OpenSSL-3.0.N
- REGTESTS: ssl: adopt tests to OpenSSL-3.0.N
- REGTESTS: ssl: fix grep invocation to use extended regex in ssl_generate_certificate.vtc
- BUILD: cfgparse: always defined _GNU_SOURCE for sched.h and crypt.h
|
||
|
Ilya Shipitsin
|
3b64a28e15 |
CLEANUP: assorted typo fixes in the code and comments
This is 31st iteration of typo fixes |
||
|
Frédéric Lécaille
|
43910a9450 |
MINOR: quic: New "quic-cc-algo" bind keyword
As it could be interesting to be able to choose the QUIC control congestion algorithm to be used by listener, add "quic-cc-algo" new keyword to do so. Update the documentation consequently. Must be backported to 2.6. |
||
|
Willy Tarreau
|
2200a9caef |
[RELEASE] Released version 2.7-dev2
Released version 2.7-dev2 with the following main changes :
- BUG/MINOR: qpack: fix build with QPACK_DEBUG
- MINOR: h3: handle errors on HEADERS parsing/QPACK decoding
- BUG/MINOR: qpack: abort on dynamic index field line decoding
- MINOR: qpack: properly handle invalid dynamic table references
- MINOR: task: Add tasklet_wakeup_after()
- BUG/MINOR: quic: Dropped packets not counted (with RX buffers full)
- MINOR: quic: Add new stats counter to diagnose RX buffer overrun
- MINOR: quic: Duplicated QUIC_RX_BUFSZ definition
- MINOR: quic: Improvements for the datagrams receipt
- CLEANUP: h2: Typo fix in h2_unsubcribe() traces
- MINOR: quic: Increase the QUIC connections RX buffer size (upto 64Kb)
- CLEANUP: mux-quic: adjust comment on qcs_consume()
- MINOR: ncbuf: implement ncb_is_fragmented()
- BUG/MINOR: mux-quic: do not signal FIN if gap in buffer
- MINOR: fd: add a new FD_DISOWN flag to prevent from closing a deleted FD
- BUG/MEDIUM: ssl/fd: unexpected fd close using async engine
- MINOR: tinfo: make tid temporarily still reflect global ID
- CLEANUP: config: remove unused proc_mask()
- MINOR: debug: remove mask support from "debug dev sched"
- MEDIUM: task: add and preset a thread ID in the task struct
- MEDIUM: task/debug: move the ->thread_mask integrity checks to ->tid
- MAJOR: task: use t->tid instead of ffsl(t->thread_mask) to take the thread ID
- MAJOR: task: replace t->thread_mask with 1<<t->tid when thread mask is needed
- CLEANUP: task: remove thread_mask from the struct task
- MEDIUM: applet: only keep appctx_new_*() and drop appctx_new()
- MEDIUM: task: only keep task_new_*() and drop task_new()
- MINOR: applet: always use task_new_on() on applet creation
- MEDIUM: task: remove TASK_SHARED_WQ and only use t->tid
- MINOR: task: replace task_set_affinity() with task_set_thread()
- CLEANUP: task: remove the unused task_unlink_rq()
- CLEANUP: task: remove the now unused TASK_GLOBAL flag
- MINOR: task: make rqueue_ticks atomic
- MEDIUM: task: move the shared runqueue to one per thread
- MEDIUM: task: replace the global rq_lock with a per-rq one
- MINOR: task: remove grq_total and use rq_total instead
- MINOR: task: replace global_tasks_mask with a check for tree's emptiness
- MEDIUM: task: use regular eb32 trees for the run queues
- MEDIUM: queue: revert to regular inter-task wakeups
- MINOR: thread: make wake_thread() take care of the sleeping threads mask
- MINOR: thread: move the flags to the shared cache line
- MINOR: thread: only use atomic ops to touch the flags
- MINOR: poller: centralize poll return handling
- MEDIUM: polling: make update_fd_polling() not care about sleeping threads
- MINOR: poller: update_fd_polling: wake a random other thread
- MEDIUM: thread: add a new per-thread flag TH_FL_NOTIFIED to remember wakeups
- MEDIUM: tasks/fd: replace sleeping_thread_mask with a TH_FL_SLEEPING flag
- MINOR: tinfo: add the tgid to the thread_info struct
- MINOR: tinfo: replace the tgid with tgid_bit in tgroup_info
- MINOR: tinfo: add the mask of enabled threads in each group
- MINOR: debug: use ltid_bit in ha_thread_dump()
- MINOR: wdt: use ltid_bit in wdt_handler()
- MINOR: clock: use ltid_bit in clock_report_idle()
- MINOR: thread: use ltid_bit in ha_tkillall()
- MINOR: thread: add a new all_tgroups_mask variable to know about active tgroups
- CLEANUP: thread: remove thread_sync_release() and thread_sync_mask
- MEDIUM: tinfo: add a dynamic thread-group context
- MEDIUM: thread: make stopping_threads per-group and add stopping_tgroups
- MAJOR: threads: change thread_isolate to support inter-group synchronization
- MINOR: thread: add is_thread_harmless() to know if a thread already is harmless
- MINOR: debug: mark oneself harmless while waiting for threads to finish
- MINOR: wdt: do not rely on threads_to_dump anymore
- MEDIUM: debug: make the thread dumper not rely on a thread mask anymore
- BUILD: debug: fix build issue on clang with previous commit
- BUILD: debug: re-export thread_dump_state
- BUG/MEDIUM: threads: fix incorrect thread group being used on soft-stop
- BUG/MEDIUM: thread: check stopping thread against local bit and not global one
- MINOR: proxy: use tg->threads_enabled in hard_stop() to detect stopped threads
- BUILD: Makefile: Add Lua 5.4 autodetect
- CI: re-enable gcc asan builds
- MEDIUM: mworker: set the iocb of the socketpair without using fd_insert()
- MINOR: fd: Add BUG_ON checks on fd_insert()
- CLEANUP: mworker: rename mworker_pipe to mworker_sockpair
- CLEANUP: mux-quic: do not export qc_get_ncbuf
- REORG: mux-quic: reorganize flow-control fields
- MINOR: mux-quic: implement accessor for sedesc
- MEDIUM: mux-quic: refactor streams opening
- MINOR: mux-quic: rename qcs flag FIN_RECV to SIZE_KNOWN
- MINOR: mux-quic: emit FINAL_SIZE_ERROR on invalid STREAM size
- BUG/MINOR: peers/config: always fill the bind_conf's argument
- BUG/MEDIUM: peers/config: properly set the thread mask
- CLEANUP: bwlim: Set pointers to NULL when memory is released
- BUG/MINOR: http-check: Preserve headers if not redefined by an implicit rule
- BUG/MINOR: http-act: Properly generate 103 responses when several rules are used
- BUG/MEDIUM: thread: mask stopping_threads with threads_enabled when checking it
- CLEANUP: thread: also remove a thread's bit from stopping_threads on stop
- BUG/MINOR: peers: fix possible NULL dereferences at config parsing
- BUG/MINOR: http-htx: Fix scheme based normalization for URIs wih userinfo
- MINOR: http: Add function to get port part of a host
- MINOR: http: Add function to detect default port
- BUG/MEDIUM: h1: Improve authority validation for CONNCET request
- MINOR: http-htx: Use new HTTP functions for the scheme based normalization
- BUG/MEDIUM: http-fetch: Don't fetch the method if there is no stream
- REGTEESTS: filters: Fix CONNECT request in random-forwarding script
- MEDIUM: mworker/systemd: send STATUS over sd_notify
- BUG/MINOR: mux-h1: Be sure to commit htx changes in the demux buffer
- BUG/MEDIUM: http-ana: Don't wait to have an empty buf to switch in TUNNEL state
- BUG/MEDIUM: mux-h1: Handle connection error after a synchronous send
- MEDIUM: epoll: don't synchronously delete migrated FDs
- BUILD: debug: silence warning on gcc-5
- BUILD: http: silence an uninitialized warning affecting gcc-5
- BUG/MEDIUM: mux-quic: fix server chunked encoding response
- REORG: mux-quic: rename stream initialization function
- MINOR: mux-quic: rename stream purge function
- MINOR: mux-quic: add traces on frame parsing functions
- MINOR: mux-quic: implement qcs_alert()
- MINOR: mux-quic: filter send/receive-only streams on frame parsing
- MINOR: mux-quic: do not ack STREAM frames on unrecoverable error
- MINOR: mux-quic: support stream opening via MAX_STREAM_DATA
- MINOR: mux-quic: define basic stream states
- MINOR: mux-quic: use stream states to mark as detached
- MEDIUM: mux-quic: implement RESET_STREAM emission
- MEDIUM: mux-quic: implement STOP_SENDING handling
- BUG/MEDIUM: debug: fix possible hang when multiple threads dump at once
- BUG/MINOR: quic: fix closing state on NO_ERROR code sent
- CLEANUP: quic: clean up include on quic_frame-t.h
- MINOR: quic: define a generic QUIC error type
- MINOR: mux-quic: support app graceful shutdown
- MINOR: mux-quic/h3: prepare CONNECTION_CLOSE on release
- MEDIUM: quic: send CONNECTION_CLOSE on released MUX
- CLEANUP: mux-quic: move qc_release()
- MINOR: mux-quic: send one last time before release
- MINOR: h3: store control stream in h3c
- MINOR: h3: implement graceful shutdown with GOAWAY
- BUG/MINOR: threads: produce correct global mask for tgroup > 1
- BUG/MEDIUM: cli/threads: make "show threads" more robust on applets
- BUG/MINOR: thread: use the correct thread's group in ha_tkillall()
- BUG/MINOR: debug: enter ha_panic() only once
- BUG/MEDIUM: debug: fix parallel thread dumps again
- MINOR: cli/streams: show a stream's tgid next to its thread ID
- DEBUG: cli: add a new "debug dev deadlock" expert command
- MINOR: cli/activity: add a thread number argument to "show activity"
- CLEANUP: applet: remove the obsolete command context from the appctx
- MEDIUM: config: remove deprecated "bind-process" directives from frontends
- MEDIUM: config: remove the "process" keyword on "bind" lines
- MINOR: listener/config: make "thread" always support up to LONGBITS
- CLEANUP: fd: get rid of the __GET_{NEXT,PREV} macros
- MEDIUM: debug/threads: make the lock debugging take tgroups into account
- MEDIUM: proto: stop protocols under thread isolation during soft stop
- MEDIUM: poller: program the update in fd_update_events() for a migrated FD
- MEDIUM: poller: disable thread-groups for poll() and select()
- MINOR: thread: remove MAX_THREADS limitation
- MEDIUM: cpu-map: replace the process number with the thread group number
- MINOR: mworker/threads: limit the mworker sockets to group 1
- MINOR: cli/threads: always bind CLI to thread group 1
- MINOR: fd/thread: get rid of thread_mask()
- MEDIUM: task/thread: move the task shared wait queues per thread group
- MINOR: task: move the niced_tasks counter to the thread group context
- DOC: design: add some thoughts about how to handle the update_list
- MEDIUM: conn: make conn_backend_get always scan the same group
- MAJOR: fd: remove pending updates upon real close
- MEDIUM: fd/poller: make the update-list per-group
- MINOR: fd: delete unused updates on close()
- MINOR: fd: make fd_insert() apply the thread mask itself
- MEDIUM: fd: add the tgid to the fd and pass it to fd_insert()
- MINOR: cli/fd: show fd's tgid and refcount in "show fd"
- MINOR: fd: add functions to manipulate the FD's tgid
- MINOR: fd: add fd_get_running() to atomically return the running mask
- MAJOR: fd: grab the tgid before manipulating running
- MEDIUM: fd/poller: turn polled_mask to group-local IDs
- MEDIUM: fd/poller: turn update_mask to group-local IDs
- MEDIUM: fd/poller: turn running_mask to group-local IDs
- MINOR: fd: make fd_clr_running() return the previous value instead
- MEDIUM: fd: make thread_mask now represent group-local IDs
- MEDIUM: fd: make fd_insert() take local thread masks
- MEDIUM: fd: make fd_insert/fd_delete atomically update fd.tgid
- MEDIUM: fd: quit fd_update_events() when FD is closed
- MEDIUM: thread: change thread_resolve_group_mask() to return group-local values
- MEDIUM: listener: switch bind_thread from global to group-local
- MINOR: fd: add fd_reregister_all() to deal with boot-time FDs
- MEDIUM: fd: support stopping FDs during starting
- MAJOR: pollers: rely on fd_reregister_all() at boot time
- MAJOR: poller: only touch/inspect the update_mask under tgid protection
- MEDIUM: fd: support broadcasting updates for foreign groups in updt_fd_polling
- CLEANUP: threads: remove the now unused all_threads_mask and tid_bit
- MINOR: config: change default MAX_TGROUPS to 16
- BUG/MEDIUM: tools: avoid calling dlsym() in static builds
|
||
|
Willy Tarreau
|
856d56d2d2 |
MINOR: config: change default MAX_TGROUPS to 16
This will allows nbtgroups > 1 to be declared in the config without recompiling. The theoretical limit is 64, though we'd rather not push it too far for now as some structures might be enlarged to be indexed per group. Let's start with 16 groups max, allowing to experiment with dual-socket machines suffering from up to 8 loosely coupled L3 caches. It's a good start and doesn't engage us too far. |
||
|
Willy Tarreau
|
5b09341c02 |
MEDIUM: cpu-map: replace the process number with the thread group number
The principle remains the same, but instead of having a single process and ignoring extra ones, now we set the affinity masks for the respective threads of all groups. The doc was updated with a few extra examples. |
||
|
Willy Tarreau
|
acd644197f |
MEDIUM: config: remove the "process" keyword on "bind" lines
It was deprecated, marked for removal in 2.7 and was already emitting a warning, let's get rid of it. Note that we've kept the keyword detection to suggest to use "thread" instead. |
||
|
Willy Tarreau
|
94f763b5e4 |
MEDIUM: config: remove deprecated "bind-process" directives from frontends
This was already causing a deprecation warning and was marked for removal in 2.7, now it happens. An error message indicates this doesn't exist anymore. |
||
|
Willy Tarreau
|
f9de4e9fae |
[RELEASE] Released version 2.7-dev1
Released version 2.7-dev1 with the following main changes :
- BUG/MINOR: ssl_ckch: Free error msg if commit changes on a cert entry fails
- BUG/MINOR: ssl_ckch: Free error msg if commit changes on a CA/CRL entry fails
- BUG/MEDIUM: ssl_ckch: Don't delete a cert entry if it is being modified
- BUG/MEDIUM: ssl_ckch: Don't delete CA/CRL entry if it is being modified
- BUG/MINOR: ssl_ckch: Don't duplicate path when replacing a cert entry
- BUG/MINOR: ssl_ckch: Don't duplicate path when replacing a CA/CRL entry
- BUG/MEDIUM: ssl_ckch: Rework 'commit ssl cert' to handle full buffer cases
- BUG/MEDIUM: ssl_ckch: Rework 'commit ssl ca-file' to handle full buffer cases
- BUG/MEDIUM: ssl/crt-list: Rework 'add ssl crt-list' to handle full buffer cases
- BUG/MEDIUM: httpclient: Don't remove HTX header blocks before duplicating them
- BUG/MEDIUM: httpclient: Rework CLI I/O handler to handle full buffer cases
- MEDIUM: httpclient: Don't close CLI applet at the end of a response
- MEDIUM: http-ana: Always report rewrite failures as PRXCOND in logs
- CLEANUP: Re-apply xalloc_size.cocci (2)
- REGTESTS: abortonclose: Add a barrier to not mix up log messages
- REGTESTS: http_request_buffer: Increase client timeout to wait "slow" clients
- CLEANUP: ssl_ckch: Use corresponding enum for commit_cacrlfile_ctx.cafile_type
- MINOR: ssl_ckch: Simplify I/O handler to commit changes on CA/CRL entry
- BUG/MINOR: ssl_ckch: Use right type for old entry in show_crlfile_ctx
- BUG/MINOR: ssl_ckch: Dump CRL transaction only once if show command yield
- BUG/MINOR: ssl_ckch: Dump CA transaction only once if show command yield
- BUG/MINOR: ssl_ckch: Dump cert transaction only once if show command yield
- BUG/MINOR: ssl_ckch: Init right field when parsing "commit ssl crl-file" cmd
- CLEANUP: ssl_ckch: Remove unused field in commit_cacrlfile_ctx structure
- MINOR: ssl_ckch: Simplify structure used to commit changes on CA/CRL entries
- MINOR: ssl_ckch: Remove service context for "set ssl cert" command
- MINOR: ssl_ckch: Remove service context for "set ssl ca-file" command
- MINOR: ssl_ckch: Remove service context for "set ssl crl-file" command
- BUG/MINOR: ssl_ckch: Fix possible uninitialized value in show_cert I/O handler
- BUG/MINOR: ssl_ckch: Fix possible uninitialized value in show_cafile I/O handler
- BUG/MINOR: ssl_ckch: Fix possible uninitialized value in show_crlfile I/O handler
- BUILD: ssl_ckch: Fix build error about a possible uninitialized value
- BUG/MINOR: ssl_ckch: Fix another possible uninitialized value
- REGTESTS: http_abortonclose: Extend supported versions
- REGTESTS: restrict_req_hdr_names: Extend supported versions
- MINOR: connection: support HTTP/3.0 for smp_*_http_major fetch
- MINOR: h3: add h3c pointer into h3s instance
- MINOR: mux-quic: simplify decode_qcs API
- MINOR: mux-quic/h3: adjust demuxing function return values
- BUG/MINOR: h3: fix return value on decode_qcs on error
- BUILD: quic: fix anonymous union for gcc-4.4
- BUILD: compiler: implement unreachable for older compilers too
- DEV: tcploop: reorder options in the usage message
- DEV: tcploop: make the current address the default address
- DEV: tcploop: make it possible to change the target address of a connect()
- DEV: tcploop: factor out the socket creation
- DEV: tcploop: permit port 0 to ease handling of default options
- DEV: tcploop: add a new "bind" command to bind to ip/port.
- DEV: tcploop: add minimal UDP support
- BUG/MINOR: trace: Test server existence for health-checks to get proxy
- BUG/MINOR: checks: Properly handle email alerts in trace messages
- BUG/MEDIUM: mailers: Set the object type for check attached to an email alert
- REGTESTS: healthcheckmail: Update the test to be functionnal again
- REGTESTS: healthcheckmail: Relax health-check failure condition
- BUG/MINOR: h3: fix incorrect BUG_ON assert on SETTINGS parsing
- MEDIUM: mux-h2: try to coalesce outgoing WINDOW_UPDATE frames
- OPTIM: mux-h2: increase h2_settings_initial_window_size default to 64k
- BUG/MINOR: h3: fix frame type definition
- BUG/MEDIUM: h3: fix SETTINGS parsing
- BUG/MINOR: cli/stats: add missing trailing LF after JSON outputs
- BUG/MINOR: server: do not enable DNS resolution on disabled proxies
- BUG/MINOR: cli/stats: add missing trailing LF after "show info json"
- DOC: design: update the notes on thread groups
- BUG/MEDIUM: mux-quic: fix flow control connection Tx level
- MINOR: mux-quic: complete BUG_ON on TX flow-control enforcing
- BUG/MINOR: mux-quic: fix memleak on frames rejected by transport
- BUG/MINOR: tcp-rules: Make action call final on read error and delay expiration
- CLEANUP: check: Remove useless tests on check's stream-connector
- BUG/MEDIUM: stconn: Don't wakeup applet for send if it won't consume data
- BUG/MEDIUM: cli: Notify cli applet won't consume data during request processing
- BUG/MEDIUM: mux-quic: fix segfault on flow-control frame cleanup
- MINOR: task: move profiling bit to per-thread
- CLEANUP: quic: use task_new_on() for single-threaded tasks
- MINOR: tinfo: remove the global thread ID bit (tid_bit)
- CLEANUP: hlua: check for at least 2 threads on a task
- MINOR: thread: get rid of MAX_THREADS_MASK
- OPTIM: task: do not consult shared WQ when we're already full
- DOC: design: update the task vs thread affinity requirements
- MINOR: qpack: add comments and remove a useless trace
- MINOR: qpack: reduce dependencies on other modules
- BUG/MINOR: qpack: support header litteral name decoding
- MINOR: qpack: add ABORT_NOW on unimplemented decoding
- BUG/MINOR: h3/qpack: deal with too many headers
- MINOR: qpack: improve decoding function
- MINOR: qpack: implement standalone decoder tool
- BUG/BUILD: h3: fix wrong label name
- BUG/MINOR: quic: Stop hardcoding Retry packet Version field
- MINOR: quic: Add several nonce and key definitions for Retry tag
- BUG/MINOR: quic: Wrong PTO calculation
- MINOR: quic: Parse long packet version from qc_parse_hd_form()
- CLEANUP: quid: QUIC draft-28 no more supported
- MEDIUM: quic: Add QUIC v2 draft support
- MINOR: quic: Released QUIC TLS extension for QUIC v2 draft
- MEDIUM: quic: Compatible version negotiation implementation (draft-08)
- CLEANUP: quic: Remove any reference to boringssl
- BUG/MINOR: task: fix thread assignment in tasklet_kill()
- BUG/MEDIUM: stream: Properly handle destructive client connection upgrades
- MINOR: stream: Rely on stconn flags to abort stream destructive upgrade
- CLEANUP: stconn: Don't expect to have no sedesc on detach
- BUG/MINOR: log: Properly test connection retries to fix dontlog-normal option
- MINOR: hlua: don't dump empty entries in hlua_traceback()
- MINOR: hlua: add a new hlua_show_current_location() function
- MEDIUM: debug: add a tainted flag when a shared library is loaded
- MEDIUM: debug: detect redefinition of symbols upon dlopen()
- BUILD: quic: Wrong HKDF label constant variable initializations
- BUG/MINOR: quic: Unexpected half open connection counter wrapping
- BUG/MINOR: quic_stats: Duplicate "quic_streams_data_blocked_bidi" field name
- BUG/MINOR: quic: purge conn Rx packet list on release
- BUG/MINOR: quic: free rejected Rx packets
- BUG/MINOR: qpack: abort on dynamic index field line decoding
- BUG/MEDIUM: ssl/cli: crash when crt inserted into a crt-list
- REGTESTS: ssl: add the same cert for client/server
- BUG/MINOR: quic: Acknowledgement must be forced during handshake
- MINOR: quic: Dump version_information transport parameter
- BUG/MEDIUM: mworker: use default maxconn in wait mode
- MINOR: intops: add a function to return a valid bit position from a mask
- TESTS: add a unit test for one_among_mask()
- BUILD: ssl_ckch: fix "maybe-uninitialized" build error on gcc-9.4 + ARM
- BUG/MINOR: ssl: Do not look for key in extra files if already in pem
- BUG/MINOR: quic: Missing acknowledgments for trailing packets
- BUG/MINOR: http-ana: Set method to HTTP_METH_OTHER when an HTTP txn is created
- BUG/MINOR: http-fetch: Use integer value when possible in "method" sample fetch
- MINOR: freq_ctr: Add a function to get events excess over the current period
- BUG/MINOR: stream: only free the req/res captures when set
- CLEANUP: pool/tree-wide: remove suffix "_pool" from certain pool names
- MEDIUM: debug: improve DEBUG_MEM_STATS to also report pool alloc/free
- BUG/MINOR: quic: Wrong reuse of fulfilled dgram RX buffer
- BUG/MAJOR: quic: Big RX dgrams leak when fulfilling a buffer
- BUG/MAJOR: quic: Big RX dgrams leak with POST requests
- BUILD: quic+h3: 32-bit compilation errors fixes
- MEDIUM: bwlim: Add support of bandwith limitation at the stream level
|
||
|
Christopher Faulet
|
2b6777021d |
MEDIUM: bwlim: Add support of bandwith limitation at the stream level
This patch adds a filter to limit bandwith at the stream level. Several filters can be defined. A filter may limit incoming data (upload) or outgoing data (download). The limit can be defined per-stream or shared via a stick-table. For a given stream, the bandwith limitation filters can be enabled using the "set-bandwidth-limit" action. A bandwith limitation filter can be used indifferently for HTTP or TCP stream. For HTTP stream, only the payload transfer is limited. The filter is pretty simple for now. But it was designed to be extensible. The current design tries, as far as possible, to never exceed the limit. There is no burst. |
||
Glenn Strauss
|
0012f899dd |
OPTIM: mux-h2: increase h2_settings_initial_window_size default to 64k
This changes the default from RFC 7540's default 65535 (64k-1) to avoid avoid some degenerative WINDOW_UPDATE behaviors in the wild observed with clients using 65536 as their buffer size, and have to complete each block with a 1-byte frame, which with some servers tend to degenerate in 1-byte WU causing more 1-byte frames to be sent until the transfer almost only uses 1-byte frames. More details here: https://github.com/nghttp2/nghttp2/issues/1722 As mentioned in previous commit (MEDIUM: mux-h2: try to coalesce outgoing WINDOW_UPDATE frames) the issue could not be reproduced with haproxy but individual WU frames are sent so theoretically nothing prevents this from happening. As such it should be backported as a workaround for already deployed clients after watching for any possible side effect with rare clients. As an added benefit, uploads from curl now use less DATA frames (all are 16384 now). Note that the previous patch alone is sufficient to stop the issue with curl in case this one would need to be reverted. [wt: edited commit messaged, updated doc] |
||
|
Willy Tarreau
|
29698e39ed |
[RELEASE] Released version 2.7-dev0
Released version 2.7-dev0 with the following main changes :
- MINOR: version: it's development again
|
||
|
Willy Tarreau
|
a1efc048bf |
[RELEASE] Released version 2.6.0
Released version 2.6.0 with the following main changes :
- DOC: Fix formatting in configuration.txt to fix dconv
- CLEANUP: tcpcheck: Remove useless test on the stream-connector in tcpcheck_main
- CLEANUP: muxes: Consider stream's sd as defined in .show_fd callback functions
- MINOR: quic: Ignore out of packet padding.
- CLEANUP: quic: Useless QUIC_CONN_TX_BUF_SZ definition
- CLEANUP: quic: No more used handshake output buffer
- MINOR: quic: QUIC transport parameters split.
- MINOR: quic: Transport parameters dump
- DOC: quic: Update documentation for QUIC Retry
- MINOR: quic: Tunable "max_idle_timeout" transport parameter
- MINOR: quic: Tunable "initial_max_streams_bidi" transport parameter
- MINOR: quic: Clarifications about transport parameters value
- MINOIR: quic_stats: add QUIC connection errors counters
- BUG/MINOR: quic: Largest RX packet numbers mixing
- MINOR: quic_stats: Add transport new counters (lost, stateless reset, drop)
- DOC: quic: Documentation update for QUIC
- MINOR: quic: Connection TX buffer setting renaming.
- MINOR: h3: Add a statistics module for h3
- MINOR: quic: Send STOP_SENDING frames if mux is released
- MINOR: quic: Do not drop packets with RESET_STREAM frames
- BUG/MINOR: qpack: fix buffer API usage on prefix integer encoding
- BUG/MINOR: qpack: support bigger prefix-integer encoding
- BUG/MINOR: h3: do not report bug on unknown method
- SCRIPTS: add make-releases-json to recreate a releases.json file in download dirs
- SCRIPTS: make publish-release try to launch make-releases-json
- MINOR: htx: add an unchecked version of htx_get_head_blk()
- BUILD: htx: use the unchecked version of htx_get_head_blk() where needed
- BUILD: quic: use inttypes.h instead of stdint.h
- DOC: internal: remove totally outdated diagrams
- DOC: remove the outdated ROADMAP file
- DOC: add maintainers for QUIC and HTTP/3
- MINOR: h3: define h3 trace module
- MINOR: h3: add traces on frame recv
- MINOR: h3: add traces on frame send
- MINOR: h3: add traces on h3s init/end
- EXAMPLES: remove completely outdated acl-content-sw.cfg
- BUILD: makefile: reorder objects by build time
- DOC: fix a few spelling mistakes in the docs
- BUG/MEDIUM: peers/cli: fix "show peers" crash
- CLEANUP: peers/cli: stop misusing the appctx local variable
- CLEANUP: peers/cli: make peers_dump_peer() take an appctx instead of an stconn
- BUG/MINOR: peers: set the proxy's name to the peers section name
- MINOR: server: indicate when no address was expected for a server
- BUG/MINOR: peers: detect and warn on init_addr/resolvers/check/agent-check
- DOC: peers: indicate that some server settings are not usable
- DOC: peers: clarify when entry expiration date is renewed.
- DOC: peers: fix port number and addresses on new peers section format
- DOC: gpc/gpt: add commments of gpc/gpt array definitions on stick tables.
- DOC: install: update supported OpenSSL versions in the INSTALL doc
- MINOR: ncbuf: adjust ncb_data with NCBUF_NULL
- BUG/MINOR: h3: fix frame demuxing
- BUG/MEDIUM: h3: fix H3_EXCESSIVE_LOAD when receiving H3 frame header only
- BUG/MINOR: quic: Fix QUIC_EV_CONN_PRSAFRM event traces
- CLEANUP: quic: remove useless check on local UNI stream reception
- BUG/MINOR: qpack: do not consider empty enc/dec stream as error
- DOC: intro: adjust the numbering of paragrams to keep the output ordered
- MINOR: version: mention that it's LTS now.
|
||
Emeric Brun
|
5e349e7b7e |
DOC: gpc/gpt: add commments of gpc/gpt array definitions on stick tables.
Some users misunderstood that the parameter of gpc() gpt() store types on the table line presents the number of elements of the array to store and not an index of gpt/gpc tag/counter. This patch adds some explanations. This patch addresses github issue #1630 It should be backorted in until branch 2.5. |
||
|
Emeric Brun
|
e77984f700 |
DOC: peers: fix port number and addresses on new peers section format
This patch fix the port number and addresses on the example to match those of the old format. This patch address the github issue #1492 This patch should be backported until version 2.0 |
||
|
Emeric Brun
|
423ed389ac |
DOC: peers: clarify when entry expiration date is renewed.
This patch add some details to know which rules are updating the expiration timer of an entry. It also adds a comment to know how to fetch a value without renewing this timer. This patch addresses github issue #615 This patch should be backported on all still supported branches |
||
|
Willy Tarreau
|
0f4a02b81a |
DOC: peers: indicate that some server settings are not usable
Let's make it clear in the peers documentation that not all server parameters may be used, as there is some confusion around this, and the doc was even misleading by saying that all parameters were supported. This should address github issue #919. |
||
|
Willy Tarreau
|
55b9689bbe |
DOC: fix a few spelling mistakes in the docs
These were reported by the CI's spell checker: https://github.com/haproxy/haproxy/actions/runs/2411893527 A few need to be ignored ("ressources" and "trafic" being part of a URL). |
||
|
Frédéric Lécaille
|
38dea05ca9 |
MINOR: quic: Connection TX buffer setting renaming.
Rename "tune.quic.conn-buf-limit" to "tune.quic.frontend.conn-tx-buffers.limit" to reflect the stream direction (TX) and the objects (frontends) which are concerned. |
||
|
Frédéric Lécaille
|
f717a4bc7c |
DOC: quic: Documentation update for QUIC
Add minimalistic information about QUIC new protocol supported by QUIC. |
||
|
Frédéric Lécaille
|
2674098569 |
MINOR: quic: Tunable "initial_max_streams_bidi" transport parameter
Add tunable "tune.quic.frontend.max_streams_bidi" setting for QUIC frontends to set the "initial_max_streams_bidi" transport parameter. Add some documentation for this new setting. |
||
|
Frédéric Lécaille
|
1d96d6e024 |
MINOR: quic: Tunable "max_idle_timeout" transport parameter
Add two tunable settings both for backends and frontends "max_idle_timeout" QUIC transport parameter, "tune.quic.frontend.max-idle-timeout" and "tune.quic.backend.max-idle-timeout" respectively. cfg_parse_quic_time() has been implemented to parse a time value thanks to parse_time_err(). It should be reused for any tunable time value to be parsed. Add the documentation for this tunable setting only for frontend. |
||
|
Frédéric Lécaille
|
aa8daed335 |
DOC: quic: Update documentation for QUIC Retry
Add some information for "quic-force-retry" and "tune.quic.retry-force" settings. |
||
Tim Duesterhus
|
464193793e |
DOC: Fix formatting in configuration.txt to fix dconv
The missing space before the colon causes haproxy-dconv to misparse the configuration.txt. |
||
|
Willy Tarreau
|
0edb9977b3 |
[RELEASE] Released version 2.6-dev12
Released version 2.6-dev12 with the following main changes :
- CLEANUP: tools: Clean up non-QUIC error message handling in str2sa_range()
- BUG/MEDIUM: tools: Fix `inet_ntop` usage in sa2str
- CLEANUP: tools: Crash if inet_ntop fails due to ENOSPC in sa2str
- BUG/MEDIUM: mux-quic: adjust buggy proxy closing support
- Revert "MINOR: quic: activate QUIC traces at compilation"
- Revert "MINOR: mux-quic: activate qmux traces on stdout via macro"
- CLEANUP: init: address a coverity warning about possible multiply overflow
- BUG/MEDIUM: http: Properly reject non-HTTP/1.x protocols
- MEDIUM: h1: enlarge the scope of accepted version chars with accept-invalid-http-request
- BUG/MEDIUM: resolvers: Don't defer resolutions release in deinit function
- BUG/MEDIUM: peers: fix segfault using multiple bind on peers sections
- BUG/MEDIUM: peers: prevent unitialized multiple listeners on peers section
- BUG/MINOR: task: Don't defer tasks release when HAProxy is stopping
- MINOR: h3: mark ncbuf as const on h3_b_dup
- MINOR: mux-quic: do not alloc quic_stream_desc for uni remote stream
- MINOR: mux-quic: delay cs_endpoint allocation
- MINOR: mux-quic: add traces in qc_recv()
- MINOR: mux-quic: adjust return value of decode_qcs
- CLEANUP: h3: rename struct h3 -> h3c
- CLEANUP: h3: rename uni stream type constants
- BUG/MINOR: h3: prevent overflow when parsing SETTINGS
- MINOR: h3: refactor h3_control_send()
- MINOR: quic: support CONNECTION_CLOSE_APP emission
- MINOR: mux-quic: disable read on CONNECTION_CLOSE emission
- MINOR: h3: reject too big frames
- MINOR: mux-quic: emit STREAM_STATE_ERROR in qcc_recv
- BUG/MINOR: mux-quic: refactor uni streams TX/send H3 SETTINGS
- MINOR: h3/qpack: use qcs as type in decode callbacks
- MINOR: h3: define stream type
- MINOR: h3: refactor uni streams initialization
- MINOR: h3: check if frame is valid for stream type
- MINOR: h3: define non-h3 generic parsing function
- MEDIUM: quic: refactor uni streams RX
- CLEANUP: h3: remove h3 uni tasklet
- MINOR: h3: abort read on unknown uni stream
- MINOR: h3: refactor SETTINGS parsing/error reporting
- Revert "BUG/MINOR: task: Don't defer tasks release when HAProxy is stopping"
- DOC: configuration: add a warning for @system-ca on bind
- CLEANUP: init: address another coverity warning about a possible multiply overflow
- BUG/MINOR: ssl/lua: use correctly cert_ext in CertCache.set()
- BUG/MEDIUM: sample: Fix adjusting size in word converter
- REGTESTS: Do not use REQUIRE_VERSION for HAProxy 2.5+ (2)
- CLEANUP: conn_stream: remove unneeded exclusion of RX_WAIT_EP from RXBLK_ANY
- CLEANUP: conn_stream: rename the cs_endpoint's context to "conn"
- MINOR: conn_stream: add new sets of functions to set/get endpoint flags
- DEV: coccinelle: add cs_endp_flags.cocci
- CLEANUP: conn_stream: apply cs_endp_flags.cocci tree-wide
- DEV: coccinelle: add endp_flags.cocci
- CLEANUP: conn_stream: apply endp_flags.cocci tree-wide
- CLEANUP: conn_stream: rename the stream endpoint flags CS_EP_* to SE_FL_*
- CLEANUP: conn_stream: rename the cs_endpoint's target to "se"
- CLEANUP: conn_stream: rename cs_endpoint to sedesc (stream endpoint descriptor)
- CLEANUP: applet: rename the sedesc pointer from "endp" to "sedesc"
- CLEANUP: conn_stream: rename the conn_stream's endp to sedesc
- CLEANUP: conn_stream: rename cs_app_* to sc_app_*
- CLEANUP: conn_stream: tree-wide rename to stconn (stream connector)
- CLEANUP: mux-h1: add and use h1s_sc() to retrieve the stream connector
- CLEANUP: mux-h2: add and use h2s_sc() to retrieve the stream connector
- CLEANUP: mux-fcgi: add and use fcgi_strm_sc() to retrieve the stream connector
- CLEANUP: mux-pt: add and use pt_sc() to retrieve the stream connector
- CLEANUP: stdesc: rename the stream connector ->cs field to ->sc
- CLEANUP: stream: rename "csf" and "csb" to "scf" and "scb"
- CLEANUP: stconn: tree-wide rename stream connector flags CS_FL_* to SC_FL_*
- CLEANUP: stconn: tree-wide rename stconn states CS_ST/SB_* to SC_ST/SB_*
- MINOR: check: export wake_srv_chk()
- MINOR: conn_stream: test the various ops functions before calling them
- MEDIUM: stconn: merge the app_ops and the data_cb fields
- MINOR: applet: add new wrappers to put chk/blk/str/chr to channel from appctx
- CLEANUP: applet: use applet_put*() everywhere possible
- CLEANUP: stconn: rename cs_{i,o}{b,c} to sc_{i,o}{b,c}
- CLEANUP: stconn: rename cs_{check,strm,strm_task} to sc_strm_*
- CLEANUP: stconn: rename cs_conn() to sc_conn()
- CLEANUP: stconn: rename cs_mux() to sc_mux_strm()
- CLEANUP: stconn: rename cs_conn_mux() to sc_mux_ops()
- CLEANUP: stconn: rename cs_appctx() to sc_appctx()
- CLEANUP: stconn: rename __cs_endp_target() to __sc_endp()
- CLEANUP: stconn: rename cs_get_data_name() to sc_get_data_name()
- CLEANUP: stconn: rename cs_conn_*() to sc_conn_*()
- CLEANUP: stconn: rename cs_conn_get_first() to conn_get_first_sc()
- CLEANUP: stconn: rename cs_ep_set_error() to se_fl_set_error()
- CLEANUP: stconn: make a few functions take a const argument
- CLEANUP: stconn: use a single function to know if SC may send to SE
- MINOR: stconn: consider CF_SHUTW for sc_is_send_allowed()
- MINOR: stconn: remove calls to cs_done_get()
- MEDIUM: stconn: always rely on CF_SHUTR in addition to cs_rx_blocked()
- MEDIUM: stconn: remove SE_FL_RXBLK_SHUT
- MINOR: stconn: rename SE_FL_RXBLK_CONN to SE_FL_APPLET_NEED_CONN
- MEDIUM: stconn: take SE_FL_APPLET_NEED_CONN out of the RXBLK_ANY flags
- CLEANUP: stconn: rename cs_rx_room_{blk,rdy} to sc_{need,have}_room()
- CLEANUP: stconn: rename cs_rx_chan_{blk,rdy} to sc_{wont,will}_read()
- CLEANUP: stconn: rename cs_rx_buff_{blk,rdy} to sc_{need,have}_buff()
- MINOR: stconn: start to rename cs_rx_endp_{more,done}() to se_have_{no_,}more_data()
- MINOR: stconn: add sc_is_recv_allowed() to check for ability to receive
- CLEANUP: stconn: rename SE_FL_RX_WAIT_EP to SE_FL_HAVE_NO_DATA
- MEDIUM: stconn: move the RXBLK flags to the stream connector
- CLEANUP: stconn: rename SE_FL_WANT_GET to SE_FL_WILL_CONSUME
- CLEANUP: stconn: remove cs_tx_blocked() and cs_tx_endp_ready()
- CLEANUP: stconn: rename cs_{want,stop}_get() to se_{will,wont}_consume()
- CLEANUP: stconn: rename cs_cant_get() to se_need_more_data()
- CLEANUP: stconn: rename cs_{new,create,free,destroy}_* to sc_*
- CLEANUP: stconn: rename remaining management functions from cs_* to sc_*
- CLEANUP: stconn: rename cs{,_get}_{src,dst} to sc_*
- CLEANUP: stconn: rename cs_{shut,chk}* to sc_*
- CLEANUP: stconn: rename final state manipulation functions from cs_* to sc_*
- CLEANUP: quic: drop the name "conn_stream" from the pool variable names
- REORG: rename cs_utils.h to sc_strm.h
- REORG: stconn: rename conn_stream.{c,h} to stconn.{c,h}
- CLEANUP: muxes: rename "get_first_cs" to "get_first_sc"
- DEV: flags: use "sc" for stream conns instead of "cs"
- CLEANUP: check: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: connection: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: stconn: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: quic/h3: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: stream: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: promex: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: stats: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: cli: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: applet: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: cache: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: dns: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: spoe: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: hlua: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: log-forward: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: http-client: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: mux-fcgi: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: mux-h1: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: mux-h2: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: mux-pt: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: peers: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: sink: rename all occurrences of stconn "cs" to "sc"
- CLEANUP: sslsock: remove only occurrence of local variable "cs"
- CLEANUP: applet: rename appctx_cs() to appctx_sc()
- CLEANUP: stream: rename stream_upgrade_from_cs() to stream_upgrade_from_sc()
- CLEANUP: obj_type: rename OBJ_TYPE_CS to OBJ_TYPE_SC
- CLEANUP: stconn: replace a few remaining occurrences of CS in comments or traces
- DOC: internal: update the muxes doc to mention the stconn
- CLEANUP: mux-quic: rename the "endp" field to "sd"
- CLEANUP: mux-h1: rename the "endp" field to "sd"
- CLEANUP: mux-h2: rename the "endp" field to "sd"
- CLEANUP: mux-fcgi: rename the "endp" field to "sd"
- CLEANUP: mux-pt: rename the "endp" field to "sd"
- CLEANUP: stconn: rename a few "endp" arguments and variables to "sd"
- MINOR: stconn: turn SE_FL_WILL_CONSUME to SE_FL_WONT_CONSUME
- CLEANUP: stream: remove unneeded test on appctx during initialization
- CLEANUP: stconn: remove the new unneeded SE_FL_APP_MASK
- DEV: flags: fix "siet" shortcut name
- DEV: flags: rename the "endp" shortcut to "sd" for "stream descriptor"
- DEV: flags: reorder a few SC/SE flags
- DOC: internal: add a description of the stream connectors and descriptors
|
||
|
William Lallemand
|
1639d6c02b |
DOC: configuration: add a warning for @system-ca on bind
Add a warning on @system-ca on the bind line so people don't use it this way. |
||
|
Willy Tarreau
|
1ba30167a0 |
MEDIUM: h1: enlarge the scope of accepted version chars with accept-invalid-http-request
We used to support both RTSP and HTTP protocol version names with and
without accept-invalid-http-request, but since this is based on the
characters themselves, any protocol made of chars {0-9/.HPRST} was
possible and not others. Now that such non-standard protocols are
restricted to accept-invalid-http-request, there's no reason for not
allowing other letters. With this patch, characters {0-9./A-Z} are
permitted when the option is set.
|
||
|
Willy Tarreau
|
137c8fde78 |
[RELEASE] Released version 2.6-dev11
Released version 2.6-dev11 with the following main changes :
- CI: determine actual LibreSSL version dynamically
- BUG/MEDIUM: ncbuf: fix null buffer usage
- MINOR: ncbuf: fix warnings for testing build
- MEDIUM: http-ana: Add a proxy option to restrict chars in request header names
- MEDIUM: ssl: Delay random generator initialization after config parsing
- MINOR: ssl: Add 'ssl-propquery' global option
- MINOR: ssl: Add 'ssl-provider' global option
- CLEANUP: Add missing header to ssl_utils.c
- CLEANUP: Add missing header to hlua_fcn.c
- CLEANUP: Remove unused function hlua_get_top_error_string
- BUILD: fix build warning on solaris based systems with __maybe_unused.
- MINOR: tools: add get_exec_path implementation for solaris based systems.
- BUG/MINOR: ssl: Fix crash when no private key is found in pem
- CLEANUP: conn-stream: Remove cs_applet_shut declaration from header file
- MINOR: applet: Prepare appctx to own the session on frontend side
- MINOR: applet: Let the frontend appctx release the session
- MINOR: applet: Change return value for .init callback function
- MINOR: stream: Export stream_free()
- MINOR: applet: Add appctx_init() helper fnuction
- MINOR: applet: Add a function to finalize frontend appctx startup
- MINOR: applet: Add function to release appctx on error during init stage
- MEDIUM: dns: Refactor dns appctx creation
- MEDIUM: spoe: Refactor SPOE appctx creation
- MEDIUM: lua: Refactor cosocket appctx creation
- MEDIUM: httpclient: Refactor http-client appctx creation
- MINOR: sink: Add a ref to sink in the sink_forward_target structure
- MEDIUM: sink: Refactor sink forwarder appctx creation
- MINOR: peers: Add a ref to peers section in the peer structure
- MEDIUM: peers: Refactor peer appctx creation
- MINOR: applet: Add API to start applet on a thread subset
- MEDIUM: applet: Add support for async appctx startup on a thread subset
- MINOR: peers: Track number of applets run by thread
- MEDIUM: peers: Balance applets across threads
- MINOR: conn-stream/applet: Stop setting appctx as the endpoint context
- CLEANUP: proxy: Remove dead code when parsing "http-restrict-req-hdr-names" option
- REGTESTS: abortonclose: Fix some race conditions
- MINOR: ssl: Add 'ssl-provider-path' global option
- CLEANUP: http_ana: Make use of the return value of stream_generate_unique_id()
- BUG/MINOR: spoe: Fix error handling in spoe_init_appctx()
- CLEANUP: peers: Remove unreachable code in peer_session_create()
- CLEANUP: httpclient: Remove useless test on ss_dst in httpclient_applet_init()
- BUG/MEDIUM: quic: fix Rx buffering
- OPTIM: quic: realign empty Rx buffer
- BUG/MINOR: ncbuf: fix ncb_is_empty()
- MINOR: ncbuf: refactor ncb_advance()
- BUG/MINOR: mux-quic: update session's idle delay before stream creation
- MINOR: h3: do not wait a complete frame for demuxing
- MINOR: h3: flag demux as full on HTX full
- MEDIUM: mux-quic: implement recv on io-cb
- MINOR: mux-quic: remove qcc_decode_qcs() call in XPRT
- MINOR: mux-quic: reorganize flow-control frames emission
- MINOR: mux-quic: implement MAX_STREAM_DATA emission
- MINOR: mux-quic: implement MAX_DATA emission
- BUG/MINOR: mux-quic: support nul buffer with qc_free_ncbuf()
- MINOR: mux-quic: free RX buf if empty
- BUG/MEDIUM: config: Reset outline buffer size on realloc error in readcfgfile()
- BUG/MINOR: check: Reinit the buffer wait list at the end of a check
- MEDIUM: check: No longer shutdown the connection in .wake callback function
- REORG: check: Rename and export I/O callback function
- MEDIUM: check: Use the CS to handle subscriptions for read/write events
- BUG/MINOR: quic: break for error on sendto
- MINOR: quic: abort on unlisted errno on sendto()
- MINOR: quic: detect EBADF on sendto()
- BUG/MEDIUM: quic: fix initialization for local/remote TPs
- CLEANUP: quic: adjust comment/coding style for TPs init
- BUG/MINOR: cfgparse: abort earlier in case of allocation error
- MINOR: quic: Dump initial derived secrets
- MINOR: quic_tls: Add quic_tls_derive_retry_token_secret()
- MINOR: quic_tls: Add quic_tls_decrypt2() implementation
- MINOR: quic: Retry implementation
- MINOR: cfgparse: Update for "cluster-secret" keyword for QUIC Retry
- MINOR: quic: Move quic_lstnr_dgram_dispatch() out of xprt_quic.c
- BUILD: stats: Missing headers inclusions from stats.h
- MINOR: quic_stats: Add a new stats module for QUIC
- MINOR: quic: Attach proxy QUIC stats counters to the QUIC connection
- BUG/MINOR: quic: Fix potential memory leak during QUIC connection allocations
- MINOR: quic: QUIC stats counters handling
- MINOR: quic: Add tune.quic.retry-threshold keyword
- MINOR: quic: Dynamic Retry implementation
- MINOR: quic/mux-quic: define CONNECTION_CLOSE send API
- MINOR: mux-quic: emit FLOW_CONTROL_ERROR
- MINOR: mux-quic: emit STREAM_LIMIT_ERROR
- MINOR: mux-quic: close connection on error if different data at offset
- BUG/MINOR: peers: fix error reporting of "bind" lines
- CLEANUP: config: improve address parser error report for unmatched protocols
- CLEANUP: config: provide cleare hints about unsupported QUIC addresses
- MINOR: protocol: replace ctrl_type with xprt_type and clarify it
- MINOR: listener: provide a function to process all of a bind_conf's arguments
- MINOR: config: use the new bind_parse_args_list() to parse a "bind" line
- CLEANUP: listener: add a comment about what the BC_SSL_O_* flags are for
- MINOR: listener: add a new "options" entry in bind_conf
- CLEANUP: listener: replace all uses of bind_conf->is_ssl with BC_O_USE_SSL
- CLEANUP: listener: replace bind_conf->generate_cers with BC_O_GENERATE_CERTS
- CLEANUP: listener: replace bind_conf->quic_force_retry with BC_O_QUIC_FORCE_RETRY
- CLEANUP: listener: store stream vs dgram at the bind_conf level
- MINOR: listener: detect stream vs dgram conflict during parsing
- MINOR: listener: set the QUIC xprt layer immediately after parsing the args
- MINOR: listener/ssl: set the SSL xprt layer only once the whole config is known
- MINOR: connection: add flag MX_FL_FRAMED to mark muxes relying on framed xprt
- MINOR: config: detect and report mux and transport incompatibilities
- MINOR: listener: automatically select a QUIC mux with a QUIC transport
- MINOR: listener: automatically enable SSL if a QUIC transport is found
- BUG/MINOR: quic: Fixe a typo in qc_idle_timer_task()
- BUG/MINOR: quic: Missing <conn_opening> stats counter decrementation
- BUILD/MINOR: cpuset fix build for FreeBSD 13.1
- CI: determine actual OpenSSL version dynamically
|
||
|
Frédéric Lécaille
|
ad20a56971 |
MINOR: cfgparse: Update for "cluster-secret" keyword for QUIC Retry
The QUIC Retry feature is disabled if no "cluster-secret" setting was set. |
||
Remi Tricot-Le Breton
|
ccc0355c41 |
MINOR: ssl: Add 'ssl-provider-path' global option
When loading providers with 'ssl-provider' global options, this ssl-provider-path option can be used to set the search path that is to be used by openssl. It behaves the same way as the OPENSSL_MODULES environment variable. |
||
|
Remi Tricot-Le Breton
|
1746a388c5 |
MINOR: ssl: Add 'ssl-provider' global option
When HAProxy is linked to an OpenSSLv3 library, this option can be used to load a provider during init. You can specify multiple ssl-provider options, which will be loaded in the order they appear. This does not prevent OpenSSL from parsing its own configuration file in which some other providers might be specified. A linked list of the providers loaded from the configuration file is kept so that all those providers can be unloaded during cleanup. The providers loaded directly by OpenSSL will be freed by OpenSSL. |
||
|
Remi Tricot-Le Breton
|
e80976526c |
MINOR: ssl: Add 'ssl-propquery' global option
This option can be used to define a default property query used when fetching algorithms in OpenSSL providers. It follows the format described in https://www.openssl.org/docs/man3.0/man7/property.html. It is only available when haproxy is built with SSL support and linked to OpenSSLv3 libraries. |
||
|
Christopher Faulet
|
18c13d3bd8 |
MEDIUM: http-ana: Add a proxy option to restrict chars in request header names
The "http-restrict-req-hdr-names" option can now be set to restrict allowed
characters in the request header names to the "[a-zA-Z0-9-]" charset.
Idea of this option is to not send header names with non-alphanumeric or
hyphen character. It is especially important for FastCGI application because
all those characters are converted to underscore. For instance,
"X-Forwarded-For" and "X_Forwarded_For" are both converted to
"HTTP_X_FORWARDED_FOR". So, header names can be mixed up by FastCGI
applications. And some HAProxy rules may be bypassed by mangling header
names. In addition, some non-HTTP compliant servers may incorrectly handle
requests when header names contain characters ouside the "[a-zA-Z0-9-]"
charset.
When this option is set, the policy must be specify:
* preserve: It disables the filtering. It is the default mode for HTTP
proxies with no FastCGI application configured.
* delete: It removes request headers with a name containing a character
outside the "[a-zA-Z0-9-]" charset. It is the default mode for
HTTP backends with a configured FastCGI application.
* reject: It rejects the request with a 403-Forbidden response if it
contains a header name with a character outside the
"[a-zA-Z0-9-]" charset.
The option is evaluated per-proxy and after http-request rules evaluation.
This patch may be backported to avoid any secuirty issue with FastCGI
application (so as far as 2.2).
|
||
|
Willy Tarreau
|
370332572b |
[RELEASE] Released version 2.6-dev10
Released version 2.6-dev10 with the following main changes :
- MINOR: ssl: ignore dotfiles when loading a dir w/ ca-file
- MEDIUM: ssl: ignore dotfiles when loading a dir w/ crt
- BUG/MINOR: ssl: Fix typos in crl-file related CLI commands
- MINOR: compiler: add a new macro to set an attribute on an enum when possible
- BUILD: stats: conditionally mark obsolete stats states as deprecated
- BUILD: ssl: work around bogus warning in gcc 12's -Wformat-truncation
- BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings
- BUILD: listener: shut report of possible null-deref in listener_accept()
- BUG/MEDIUM: ssl: fix the gcc-12 broken fix :-(
- DOC: install: update gcc version requirements
- BUILD: makefile: add -Wfatal-errors to the default flags
- BUG/MINOR: server: Make SRV_STATE_LINE_MAXLEN value from 512 to 2kB (2000 bytes).
- BUG/MAJOR: dns: multi-thread concurrency issue on UDP socket
- BUG/MINOR: mux-h2: mark the stream as open before processing it not after
- MINOR: mux-h2: report a trace event when failing to create a new stream
- DOC: configuration: add the httpclient keywords to the global keywords index
- MINOR: quic: Add a debug counter for sendto() errors
- BUG/MINOR: quic: Dropped peer transport parameters
- BUG/MINOR: quic: Wrong unit for ack delay for incoming ACK frames
- MINOR: quic: Congestion controller event trace fix (loss)
- MINOR: quic: Add correct ack delay values to ACK frames
- MINOR: config: Add "cluster-secret" new global keyword
- MINOR: quic-tls: Add quic_hkdf_extract_and_expand() for HKDF
- MINOR: quic: new_quic_cid() code moving
- MINOR: quic: Initialize stateless reset tokens with HKDF secrets
- MINOR: qc_new_conn() rework for stateless reset
- MINOR: quic: Stateless reset token copy to transport parameters
- MINOR: quic: Send stateless reset tokens
- MINOR: quic: Short packets always embed a trailing AEAD TAG
- CLEANUP: quic: wrong use of eb*entry() macro
- CLEANUP: quic: Useless use of pointer for quic_hkdf_extract()
- CLEANUP: quic_tls: QUIC_TLS_IV_LEN defined two times
- MINOR: ncbuf: define non-contiguous buffer
- MINOR: ncbuf: complete API and define block interal abstraction
- MINOR: ncbuf: optimize storage for the last gap
- MINOR: ncbuf: implement insertion
- MINOR: ncbuf: define various insertion modes
- MINOR: ncbuf: implement advance
- MINOR: ncbuf: write unit tests
- BUG/MEDIUM: lua: fix argument handling in data removal functions
- DOC/MINOR: fix typos in the lua-api document
- BUG/MEDIUM: wdt: don't trigger the watchdog when p is unitialized
- MINOR: mux-h1: Add global option accpet payload for any HTTP/1.0 requests
- CLEANUP: mux-h1: Fix comments and error messages for global options
- MINOR: conn_stream: make cs_set_error() work on the endpoint instead
- CLEANUP: mux-h1: always take the endp from the h1s not the cs
- CLEANUP: mux-h2: always take the endp from the h2s not the cs
- CLEANUP: mux-pt: always take the endp from the context not the cs
- CLEANUP: mux-fcgi: always take the endp from the fstrm not the cs
- CLEANUP: mux-quic: always take the endp from the qcs not the cs
- CLEANUP: applet: use the appctx's endp instead of cs->endp
- MINOR: conn_stream: add a pointer back to the cs from the endpoint
- MINOR: mux-h1: remove the now unneeded h1s->cs
- MINOR: mux-h2: make sure any h2s always has an endpoint
- MINOR: mux-h2: remove the now unneeded conn_stream from the h2s
- MINOR: mux-fcgi: make sure any stream always has an endpoint
- MINOR: mux-fcgi: remove the now unneeded conn_stream from the fcgi_strm
- MINOR: mux-quic: remove the now unneeded conn_stream from the qcs
- MINOR: mux-pt: remove the now unneeded conn_stream from the context
- CLEANUP: muxes: make mux->attach/detach take a conn_stream endpoint
- MINOR: applet: replace cs_applet_shut() with appctx_shut()
- MINOR: applet: add appctx_strm() and appctx_cs() to access common fields
- CLEANUP: applet: remove the unneeded appctx->owner
- CLEANUP: conn_stream: merge cs_new_from_{mux,applet} into cs_new_from_endp()
- MINOR: ext-check: indicate the transport and protocol of a server
- BUG/MEDIUM: mux-quic: fix a thinko in the latest cs/endpoint cleanup
- MINOR: tools: improve error message accuracy in str2sa_range
- MINOR: config: make sure never to mix dgram and stream protocols on a bind line
- BUG/MINOR: ncbuf: fix coverity warning on uninit sz_data
- MINOR: xprt_quic: adjust flow-control according to bufsize
- MEDIUM: mux-quic/h3/hq-interop: use ncbuf for bidir streams
- MEDIUM: mux-quic/h3/qpack: use ncbuf for uni streams
- CLEANUP: mux-quic: remove unused fields for Rx
- CLEANUP: quic: remove unused quic_rx_strm_frm
|
||
|
Willy Tarreau
|
973cf90714 |
MINOR: ext-check: indicate the transport and protocol of a server
Valerio Pachera explained [1] that external checks would benefit from
having a variable indicating if SSL is being used or not on the server
being checked, and the discussion derived to also indicating the protocol
in use.
This patch adds two environment variables for external checks:
- HAPROXY_SERVER_SSL: equals "0" when SSL is not used, "1" when it is
- HAPROXY_SERVER_PROTO: contains one of the following words to describe
the protocol used with this server:
- "cli": the haproxy CLI. Normally not seen
- "syslog": this is a syslog TCP server
- "peers": this is a peers TCP server
- "h1": this is an HTTP/1.x server
- "h2": this is an HTTP/2 server
- "tcp": this is any other TCP server
The patch is very simple, and may be backported to recent versions if
needed. This closes github issue #1692.
[1] https://www.mail-archive.com/haproxy@formilux.org/msg42233.html
|
||
|
Christopher Faulet
|
0f9c0f5801 |
MINOR: mux-h1: Add global option accpet payload for any HTTP/1.0 requests
Since the 2.5, for security reason, HTTP/1.0 GET/HEAD/DELETE requests with a
payload are rejected (See
|
||
|
Frédéric Lécaille
|
372508cc42 |
MINOR: config: Add "cluster-secret" new global keyword
It could be usefull to set a ASCII secret which could be used for different usages. For instance, it will be used to derive QUIC stateless reset tokens. |
||
|
William Lallemand
|
cfabb3526b |
DOC: configuration: add the httpclient keywords to the global keywords index
- httpclient.ssl.verify
- httpclient.ssl.ca-file
- httpclient.resolvers.id
- httpclient.resolvers.prefer
|
||
|
William Lallemand
|
589570df1f |
MEDIUM: ssl: ignore dotfiles when loading a dir w/ crt
Ignore the files starting with a dot when trying to load a directory with the "crt" directive. Should fix issue #1689. |
||
|
William Lallemand
|
e4b93eb947 |
MINOR: ssl: ignore dotfiles when loading a dir w/ ca-file
Ignore the files starting with a dot when trying to load a directory with the "ca-file directive". |
||
|
Willy Tarreau
|
e979796584 |
[RELEASE] Released version 2.6-dev9
Released version 2.6-dev9 with the following main changes :
- MINOR: mux-quic: support full request channel buffer
- BUG/MINOR: h3: fix parsing of unknown frame type with null length
- CLEANUP: backend: make alloc_{bind,dst}_address() idempotent
- MEDIUM: stream: remove the confusing SF_ADDR_SET flag
- MINOR: conn_stream: remove the now unused CS_FL_ADDR_*_SET flags
- CLEANUP: protocol: make sure the connect_* functions always receive a dst
- MINOR: connection: get rid of the CO_FL_ADDR_*_SET flags
- MINOR: session: get rid of the now unused SESS_FL_ADDR_*_SET flags
- CLEANUP: mux: Useless xprt_quic-t.h inclusion
- MINOR: quic: Make the quic_conn be aware of the number of streams
- BUG/MINOR: quic: Dropped retransmitted STREAM frames
- BUG/MINOR: mux_quic: Dropped packet upon retransmission for closed streams
- MEDIUM: httpclient: remove url2sa to use a more flexible parser
- MEDIUM: httpclient: http-request rules for resolving
- MEDIUM: httpclient: allow address and port change for resolving
- CLEANUP: httpclient: remove the comment about resolving
- MINOR: httpclient: handle unix and other socket types in dst
- MINOR: httpclient: rename dash by dot in global option
- MINOR: init: exit() after pre-check upon error
- MINOR: httpclient: cleanup the error handling in init
- MEDIUM: httpclient: hard-error when SSL is configured
- MINOR: httpclient: allow to configure the ca-file
- MINOR: httpclient: configure the resolvers section to use
- MINOR: httpclient: allow ipv4 or ipv6 preference for resolving
- DOC: configuration: httpclient global option
- MINOR: conn-stream: Add mask from flags set by endpoint or app layer
- BUG/MEDIUM: conn-stream: Only keep app layer flags of the endpoint on reset
- BUG/MEDIUM: mux-fcgi: Be sure to never set EOM flag on an empty HTX message
- BUG/MEDIUM: mux-h1: Be able to handle trailers when C-L header was specified
- DOC: config: Update doc for PR/PH session states to warn about rewrite failures
- MINOR: resolvers: cleanup alert/warning in parse-resolve-conf
- MINOR: resolvers: move the resolv.conf parser in parse_resolv_conf()
- MINOR: resolvers: resolvers_new() create a resolvers with default values
- BUILD: debug: unify the definition of ha_backtrace_to_stderr()
- BUG/MINOR: tcp/http: release the expr of set-{src,dst}[-port]
- MEDIUM: resolvers: create a "default" resolvers section at startup
- DOC: resolvers: default resolvers section
- BUG/MINOR: startup: usage() when no -cc arguments
- BUG/MEDIUM: resolvers: make "show resolvers" properly yield
- BUG/MEDIUM: cli: make "show cli sockets" really yield
- BUG/MINOR: proxy/cli: don't enumerate internal proxies on "show backend"
- BUG/MINOR: map/cli: protect the backref list during "show map" errors
- BUG/MINOR: map/cli: make sure patterns don't vanish under "show map"'s init
- BUG/MINOR: ssl/cli: fix "show ssl ca-file/crl-file" not to mix cli+ssl contexts
- BUG/MINOR: ssl/cli: fix "show ssl ca-file <name>" not to mix cli+ssl contexts
- BUG/MINOR: ssl/cli: fix "show ssl crl-file" not to mix cli+ssl contexts
- BUG/MINOR: ssl/cli: fix "show ssl cert" not to mix cli+ssl contexts
- CLEANUP: ssl/cli: do not loop on unknown states in "add ssl crt-list" handler
- MINOR: applet: reserve some generic storage in the applet's context
- CLEANUP: applet: make appctx_new() initialize the whole appctx
- CLEANUP: stream/cli: take the "show sess" context definition out of the appctx
- CLEANUP: stream/cli: stop using appctx->st2 for the dump state
- CLEANUP: stream/cli: remove the unneeded init state from "show sess"
- CLEANUP: stream/cli: remove the unneeded STATE_FIN state from "show sess"
- CLEANUP: stream/cli: remove the now unneeded dump state from "show sess"
- CLEANUP: proxy/cli: take the "show errors" context definition out of the appctx
- CLEANUP: stick-table/cli: take the "show table" context definition out of the appctx
- CLEANUP: stick-table/cli: stop using appctx->st2 for the dump state
- CLEANUP: stick-table/cli: remove the unneeded STATE_INIT for "show table"
- CLEANUP: map/cli: take the "show map" context definition out of the appctx
- CLEANUP: map/cli: stop using cli.i0/i1 to store the generation numbers
- CLEANUP: map/cli: stop using appctx->st2 for the dump state
- CLEANUP: map/cli: always detach the backref from the list after "show map"
- CLEANUP: peers/cli: take the "show peers" context definition out of the appctx
- CLEANUP: peers/cli: stop using appctx->st2 for the dump state
- CLEANUP: peers/cli: remove unneeded state STATE_INIT
- CLEANUP: cli: initialize the whole appctx->ctx, not just the stats part
- CLEANUP: promex: make the applet use its own context
- CLEANUP: promex: stop using appctx->st2
- CLEANUP: stats/cli: take the "show stat" context definition out of the appctx
- CLEANUP: stats/cli: stop using appctx->st2
- CLEANUP: hlua/cli: take the hlua_cli context definition out of the appctx
- CLEANUP: ssl/cli: use a local context for "show cafile"
- CLEANUP: ssl/cli: use a local context for "show crlfile"
- CLEANUP: ssl/cli: use a local context for "show ssl cert"
- CLEANUP: ssl/cli: use a local context for "commit ssl cert"
- CLEANUP: ssl/cli: stop using appctx->st2 for "commit ssl cert"
- CLEANUP: ssl/cli: use a local context for "set ssl cert"
- CLEANUP: ssl/cli: use a local context for "set ssl cafile"
- CLEANUP: ssl/cli: use a local context for "set ssl crlfile"
- CLEANUP: ssl/cli: use a local context for "commit ssl {ca|crl}file"
- CLEANUP: ssl/cli: stop using appctx->st2 for "commit ssl ca/crl"
- CLEANUP: ssl/cli: stop using ctx.cli.i0/i1/p0 for "show tls-keys"
- CLEANUP: ssl/cli: add a new "dump_entries" field to "show_keys_ref"
- CLEANUP: ssl/cli: make "show tlskeys" not use appctx->st2 anymore
- CLEANUP: ssl/cli: make "show ssl ocsp-response" not use cli.p0 anymore
- CLEANUP: ssl/cli: make "{show|dump} ssl crtlist" use its own context
- CLEANUP: ssl/cli: make "add ssl crtlist" use its own context
- CLEANUP: ssl/cli: make "add ssl crtlist" not use st2 anymore
- CLEANUP: dns: stop abusing the sink forwarder's context
- CLEANUP: sink: use the generic context to store the forwarder's context
- CLEANUP: activity/cli: make "show profiling" not use ctx.cli anymore
- CLEANUP: debug/cli: make "debug dev fd" not use ctx.cli anymore
- CLEANUP: debug/cli: make "debug dev memstats" not use ctx.cli anymore
- CLEANUP: ring: pass the ring watch flags to ring_attach_cli(), not in ctx.cli
- CLEANUP: ring/cli: use a locally-defined context instead of using ctx.cli
- CLEANUP: resolvers/cli: make "show resolvers" use a locally-defined context
- CLEANUP: resolvers/cli: remove the unneeded appctx->st2 from "show resolvers"
- CLEANUP: cache/cli: make use of a locally defined context for "show cache"
- CLEANUP: proxy/cli: make use of a locally defined context for "show servers"
- CLEANUP: proxy/cli: get rid of appctx->st2 in "show servers"
- CLEANUP: proxy/cli: make "show backend" only use the generic context
- CLEANUP: cli: make "show fd" use its own context
- CLEANUP: cli: make "show env" use its own context
- CLEANUP: cli: simplify the "show cli sockets" I/O handler
- CLEANUP: cli: make "show cli sockets" use its own context
- CLEANUP: httpclient/cli: use a locally-defined context instead of ctx.cli
- CLEANUP: httpclient: do not use the appctx.ctx anymore
- CLEANUP: peers: do not use appctx.ctx anymore
- CLEANUP: spoe: do not use appctx.ctx anymore
- BUILD: applet: mark the CLI's generic variables as deprecated
- BUILD: applet: mark the appctx's st2 variable as deprecated
- CLEANUP: cache: take the context out of appctx.ctx
- MEDIUM: lua: move the cosocket storage outside of appctx.ctx
- MINOR: lua: move the tcp service storage outside of appctx.ctx
- MINOR: lua: move the http service context out of appctx.ctx
- CLEANUP: cli: move the status print context into its own context
- CLEANUP: stats: rename the stats state values an mark the old ones deprecated
- DOC: internal: document the new cleaner approach to the appctx
- MINOR: tcp: socket translate TCP_KEEPIDLE for macOs equivalent
- DOC: fix typo "ant" for "and" in INSTALL
- CI: dynamically determine actual version of h2spec
|
||
|
William Lallemand
|
c33df2e524 |
DOC: resolvers: default resolvers section
Add a paragraph about the default resolvers section generated by HAProxy. |
||
|
Christopher Faulet
|
24dda9403a |
DOC: config: Update doc for PR/PH session states to warn about rewrite failures
When an HTTP header rewrite failure is triggered, and 500-internal-error response is returned. A "PR" termination state is logged if the error occurred on the request and "PH" if the error is reported for the response. The documentation was updated accordingly. This patch is related to issue #1597. |
||
|
William Lallemand
|
de1803f8a9 |
DOC: configuration: httpclient global option
Documentation about the 4 options in the global section for the httpclient: - httpclient.ssl.verify - httpclient.ssl.ca-file - httpclient.resolvers.id - httpclient.resolvers.prefer |
||
|
Willy Tarreau
|
026fef98a0 |
[RELEASE] Released version 2.6-dev8
Released version 2.6-dev8 with the following main changes :
- BUG/MINOR: quic: fix use-after-free with trace on ACK consume
- BUG/MINOR: rules: Forbid captures in defaults section if used by a backend
- BUG/MEDIUM: rules: Be able to use captures defined in defaults section
- BUG/MINOR: rules: Fix check_capture() function to use the right rule arguments
- BUG/MINOR: http-act: make release_http_redir() more robust
- BUG/MINOR: sample: add missing use_backend/use-server contexts in smp_resolve_args
- MINOR: sample: don't needlessly call c_none() in sample_fetch_as_type()
- MINOR: sample: make the bool type cast to bin
- MEDIUM: backend: add new "balance hash <expr>" algorithm
- MINOR: init: add global setting "fd-hard-limit" to bound system limits
- BUILD: pollers: use an initcall to register the pollers
- BUILD: xprt: use an initcall to register the transport layers
- BUILD: thread: use initcall instead of a constructor
- BUILD: http: remove the two unused constructors in rules and ana
- CLEANUP: compression: move the default setting of maxzlibmem to defaults
- MINOR: tree-wide: always consider EWOULDBLOCK in addition to EAGAIN
- BUG/MINOR: connection: "connection:close" header added despite 'close-spread-time'
- MINOR: fd: add functions to set O_NONBLOCK and FD_CLOEXEC
- CLEANUP: tree-wide: use fd_set_nonblock() and fd_set_cloexec()
- CLEANUP: tree-wide: remove 25 occurrences of unneeded fcntl.h
- REGTESTS: fix the race conditions in be2dec.vtc ad field.vtc
- REGTESTS: webstats: remove unused stats socket in /tmp
- MEDIUM: httpclient: disable SSL when the ca-file couldn't be loaded
- BUG/MINOR: httpclient/lua: error when the httpclient_start() fails
- BUG/MINOR: ssl: free the cafile entries on deinit
- BUG/MINOR: ssl: memory leak when trying to load a directory with ca-file
- MEDIUM: httpclient: re-enable the verify by default
- BUG/MEDIUM: ssl/cli: fix yielding in show_cafile_detail
- BUILD: compiler: properly distinguish weak and global symbols
- MINOR: connection: Add way to disable active connection closing during soft-stop
- BUG/MEDIUM: http-ana: Fix memleak in redirect rules with ignore-empty option
- CLEANUP: Destroy `http_err_chunks` members during deinit
- BUG/MINOR: resolvers: Fix memory leak in resolvers_deinit()
- MINOR: Call deinit_and_exit(0) for `haproxy -vv`
- BUILD: fd: disguise the fd_set_nonblock/cloexec result
- BUG/MINOR: pools: make sure to also destroy shared pools in pool_destroy_all()
- MINOR: ssl: add a new global option "tune.ssl.hard-maxrecord"
- CLEANUP: errors: also call deinit_errors_buffers() on deinit()
- CLEANUP: chunks: release trash also in deinit
- CLEANUP: deinit: release the pre-check callbacks
- CLEANUP: deinit: release the config postparsers
- CLEANUP: listeners/deinit: release accept queue tasklets on deinit
- CLEANUP: connections/deinit: destroy the idle_conns tasks
- BUG/MINOR: mux-quic: fix build in release mode
- MINOR: mux-quic: adjust comment on emission function
- MINOR: mux-quic: remove unused bogus qcc_get_stream()
- BUG/MINOR: mux-quic: fix leak if cs alloc failure
- MINOR: mux-quic: count local flow-control stream limit on reception
- BUG/MINOR: h3: fix incomplete POST requests
- BUG/MEDIUM: h3: fix use-after-free on mux Rx buffer wrapping
- MINOR: mux-quic: partially copy Rx frame if almost full buf
- MINOR: h3: change frame demuxing API
- MINOR: mux-quic: add a app-layer context in qcs
- MINOR: h3: implement h3 stream context
- MINOR: h3: support DATA demux if buffer full
- MINOR: quic: decode as much STREAM as possible
- MINOR: quic: Improve qc_prep_pkts() flexibility
- MINOR: quic: Prepare quic_frame struct duplication
- MINOR: quic: Do not retransmit frames from coalesced packets
- MINOR: quic: Add traces about TX frame memory releasing
- MINOR: quic: process_timer() rework
- MEDIUM: quic: New functions for probing rework
- MEDIUM: quic: Retransmission functions rework
- MEDIUM: quic: qc_requeue_nacked_pkt_tx_frms() rework
- MINOR: quic: old data distinction for qc_send_app_pkt()
- MINOR: quic: Mark packets as probing with old data
- MEDIUM: quic: Mark copies of acknowledged frames as acknowledged
- MEDIUM: quic: Enable the new datagram probing process
- MINOR: quic: Do not send ACK frames when probing
- BUG/MINOR: quic: Wrong returned status by qc_build_frms()
- BUG/MINOR: quic: Avoid sending useless PADDING frame
- BUG/MINOR: quic: Traces fix about remaining frames upon packet build failure
- MINOR: quic: Wake up the mux to probe with new data
- BUG/MEDIUM: quic: Possible crash on STREAM frame loss
- BUG/MINOR: quic: Missing Initial packet length check
- CLEANUP: quic: Rely on the packet length set by qc_lstnr_pkt_rcv()
- MINOR: quic: Drop 0-RTT packets if not allowed
- BUG/MINOR: httpclient/ssl: use the correct verify constant
- BUG/MEDIUM: conn-stream: Don't erase endpoint flags on reset
- BUG/MEDIUM: httpclient: Fix loop consuming HTX blocks from the response channel
- BUG/MINOR: httpclient: Count metadata in size to transfer via htx_xfer_blks()
- MINOR: httpclient: Don't use co_set_data() to decrement output
- BUG/MINOR: conn_stream: do not confirm a connection from the frontend path
- MEDIUM: quic: do not ACK packet with STREAM if MUX not present
- MEDIUM: quic: do not ack packet with invalid STREAM
- MINOR: quic: Drop 0-RTT packets without secrets
- CLEANUP: quic: Remaining fprintf() debug trace
- MINOR: quic: moving code for QUIC loss detection
- BUG/MINOR: quic: Missing time threshold multiplifier for loss delay computation
- CI: github actions: update LibreSSL to 3.5.2
- SCRIPTS: announce-release: add URL of dev packages
|
||
Thomas Prckl
|
10243938db |
MINOR: ssl: add a new global option "tune.ssl.hard-maxrecord"
Low footprint client machines may not have enough memory to download a complete 16KB TLS record at once. With the new option the maximum record size can be defined on the server side. Note: Before limiting the the record size on the server side, a client should consider using the TLS Maximum Fragment Length Negotiation Extension defined in RFC6066. This patch fixes GitHub issue #1679. |
||
|
Remi Tricot-Le Breton
|
4d7fdc65d4 |
MINOR: connection: Add way to disable active connection closing during soft-stop
If the "close-spread-time" option is set to "infinite", active connection closing during a soft-stop can be disabled. The 'connection: close' header or the GOAWAY frame will not be added anymore to the server's response and active connections will only be closed once the clients disconnect. Idle connections will not be closed all at once when the soft-stop starts anymore, and each idle connection will follow its own timeout based on the multiple timeouts set in the configuration (as is the case during regular execution). This feature request was described in GitHub issue #1614. This patch should be backported to 2.5. It depends on 'MEDIUM: global: Add a "close-spread-time" option to spread soft-stop on time window'. |
||
|
Willy Tarreau
|
2df1fbf816 |
MINOR: init: add global setting "fd-hard-limit" to bound system limits
On some systems, the hard limit for ulimit -n may be huge, in the order of 1 billion, and using this to automatically compute maxconn doesn't work as it requires way too much memory. Users tend to hard-code maxconn but that's not convenient to manage deployments on heterogenous systems, nor when porting configs to developers' machines. The ulimit-n parameter doesn't work either because it forces the limit. What most users seem to want (and it makes sense) is to respect the system imposed limits up to a certain value and cap this value. This is exactly what fd-hard-limit does. This addresses github issue #1622. |
||
|
Willy Tarreau
|
7c9a0fe2a6 |
MEDIUM: backend: add new "balance hash <expr>" algorithm
Almost all of our hash-based LB algorithms are implemented as special cases of something that can now be achieved using sample expressions, and some of them have adopted some options to adapt their behavior in ways that could also be achieved using converters. There are users who want to hash other parameters that are combined into variables, and who set headers from these values and use "balance hdr(name)" for this. Instead of constantly implementing specific options and having users hack around when they want a real hash, let's implement a native hash mode that applies to a standard sample expression. This way, any fetchable element (including variables) may be used to construct the hash, even modified by any converter if desired. |
||
|
Willy Tarreau
|
3e69fcc240 |
[RELEASE] Released version 2.6-dev7
Released version 2.6-dev7 with the following main changes :
- BUILD: calltrace: fix wrong include when building with TRACE=1
- MINOR: ssl: Use DH parameters defined in RFC7919 instead of hard coded ones
- MEDIUM: ssl: Disable DHE ciphers by default
- BUILD: ssl: Fix compilation with OpenSSL 1.0.2
- MINOR: mux-quic: split xfer and STREAM frames build
- REORG: quic: use a dedicated module for qc_stream_desc
- MINOR: quic-stream: use distinct tree nodes for quic stream and qcs
- MINOR: quic-stream: add qc field
- MEDIUM: quic: implement multi-buffered Tx streams
- MINOR: quic-stream: refactor ack management
- MINOR: quic: limit total stream buffers per connection
- MINOR: mux-quic: implement immediate send retry
- MINOR: cfg-quic: define tune.quic.conn-buf-limit
- MINOR: ssl: Add 'show ssl providers' cli command and providers list in -vv option
- REGTESTS: ssl: Update error messages that changed with OpenSSLv3.1.0-dev
- BUG/MEDIUM: quic: Possible crash with released mux
- BUG/MINOR: mux-quic: unsubscribe on release
- BUG/MINOR: mux-quic: handle null timeout
- BUG/MEDIUM: logs: fix http-client's log srv initialization
- BUG/MINOR: mux-quic: remove dead code in qcs_xfer_data()
- DEV: stream: Fix conn-streams dump in full stream message
- CLEANUP: conn-stream: Rename cs_conn_close() and cs_conn_drain_and_close()
- CLEANUP: conn-stream: Rename cs_applet_release()
- MINOR: conn-stream: Rely on endpoint shutdown flags to shutdown an applet
- BUG/MINOR: cache: Disable cache if applet creation fails
- BUG/MINOR: backend: Don't allow to change backend applet
- BUG/MEDIUM: conn-stream: Set back CS to RDY state when the appctx is created
- MINOR: stream: Don't needlessly detach server endpoint on early client abort
- MINOR: conn-stream: Make cs_detach_* private and use cs_destroy() from outside
- MINOR: init: add the pre-check callback
- MEDIUM: httpclient: change the init sequence
- MEDIUM: httpclient/ssl: verify required
- MINOR: httpclient/mworker: disable in the master process
- MEDIUM: httpclient/ssl: verify is configurable and disabled by default
- BUG/MAJOR: connection: Never remove connection from idle lists outside the lock
- BUG/MEDIUM: mux-quic: fix stalled POST requets
- BUG/MINOR: mux-quic: fix POST with abortonclose
- MINOR: task: add a new task_instant_wakeup() function
- MEDIUM: queue: use tasklet_instant_wakeup() to wake tasks
- DOC: remove my name from the config doc
|
||
|
Willy Tarreau
|
1401b9cd3a |
DOC: remove my name from the config doc
I was surprised to notice that my name was still present as the author
at the top of the config manual. It turns out that this line and a few
other ones in this file remained unchanged since commit
|
||
|
Amaury Denoyelle
|
97e84c6c69 |
MINOR: cfg-quic: define tune.quic.conn-buf-limit
Add a new global configuration option to set the limit of buffers per QUIC connection. By default, this value is set to 30. |
||
|
Remi Tricot-Le Breton
|
1d6338ea96 |
MEDIUM: ssl: Disable DHE ciphers by default
DHE ciphers do not present a security risk if the key is big enough but they are slow and mostly obsoleted by ECDHE. This patch removes any default DH parameters. This will effectively disable all DHE ciphers unless a global ssl-dh-param-file is defined, or tune.ssl.default-dh-param is set, or a frontend has DH parameters included in its PEM certificate. In this latter case, only the frontends that have DH parameters will have DHE ciphers enabled. Adding explicitely a DHE ciphers in a "bind" line will not be enough to actually enable DHE. We would still need to know which DH parameters to use so one of the three conditions described above must be met. This request was described in GitHub issue #1604. |
||
|
Willy Tarreau
|
a8b1065b6b |
[RELEASE] Released version 2.6-dev6
Released version 2.6-dev6 with the following main changes :
- CLEANUP: connection: reduce the with of the mux dump output
- CI: Update to actions/checkout@v3
- CI: Update to actions/cache@v3
- DOC: adjust QUIC instruction in INSTALL
- BUG/MINOR: stats: define the description' background color in dark color scheme
- BUILD: ssl: add USE_ENGINE and disable the openssl engine by default
- BUILD: makefile: pass USE_ENGINE to cflags
- BUILD: xprt-quic: replace ERR_func_error_string() with ERR_peek_error_func()
- DOC: install: document the fact that SSL engines are not enabled by default
- CI: github actions: disable -Wno-deprecated
- BUILD: makefile: silence unbearable OpenSSL deprecation warnings
- MINOR: sock: check configured limits at the sock layer, not the listener's
- MINOR: connection: add a new flag CO_FL_FDLESS on fd-less connections
- MINOR: connection: add conn_fd() to retrieve the FD only when it exists
- MINOR: stream: only dump connections' FDs when they are valid
- MINOR: connection: use conn_fd() when displaying connection errors
- MINOR: connection: skip FD-based syscalls for FD-less connections
- MEDIUM: connection: panic when calling FD-specific functions on FD-less conns
- MINOR: mux-quic: properly set the flags and name fields
- MINOR: connection: rearrange conn_get_src/dst to be a bit more extensible
- MINOR: protocol: add get_src() and get_dst() at the protocol level
- MINOR: quic-sock: provide a pair of get_src/get_dst functions
- MEDIUM: ssl: improve retrieval of ssl_sock_ctx and SSL detection
- MEDIUM: ssl: stop using conn->xprt_ctx to access the ssl_sock_ctx
- MEDIUM: xprt-quic: implement get_ssl_sock_ctx()
- MEDIUM: quic: move conn->qc into conn->handle
- BUILD: ssl: fix build warning with previous changes to ssl_sock_ctx
- BUILD: ssl: add an unchecked version of __conn_get_ssl_sock_ctx()
- MINOR: ssl: refine the error testing for fc_err and fc_err_str
- BUG/MINOR: sock: do not double-close the accepted socket on the error path
- CI: cirrus: switch to FreeBSD-13.0
- MINOR: log: add '~' to frontend when the transport layer provides SSL
- BUILD/DEBUG: lru: fix printf format in debug code
- BUILD: peers: adjust some printf format to silence cppcheck
- BUILD/DEBUG: hpack-tbl: fix format string in standalone debug code
- BUILD/DEBUG: hpack: use unsigned int in printf format in debug code
- BUILD: halog: fix some incorrect signs in printf formats for integers
- BUG/MINOR: h3: fix build with DEBUG_H3
- BUG/MINOR: mux-h2: do not send GOAWAY if SETTINGS were not sent
- BUG/MINOR: cache: do not display expired entries in "show cache"
- BUG/MINOR: mux-h1: Don't release unallocated CS on error path
- MINOR: applet: Make .init callback more generic
- MINOR: conn-stream: Add flags to set the type of the endpoint
- MEDIUM: applet: Set the appctx owner during allocation
- MAJOR: conn-stream: Invert conn-stream endpoint and its context
- REORG: Initialize the conn-stream by hand in cs_init()
- MEDIUM: conn-stream: Add an endpoint structure in the conn-stream
- MINOR: conn-stream: Move some CS flags to the endpoint
- MEDIUM: conn-stream: Be able to pass endpoint to create a conn-stream
- MEDIUM: conn-stream: Pre-allocate endpoint to create CS from muxes and applets
- REORG: applet: Uninline appctx_new function
- MAJOR: conn-stream: Share endpoint struct between the CS and the mux/applet
- MEDIUM: conn-stream: Move remaning flags from CS to endpoint
- MINOR: mux-pt: Rely on the endpoint instead of the conn-stream when possible
- MINOR: conn-stream: Add ISBACK conn-stream flag
- MINOR: conn-stream: Add header file with util functions related to conn-streams
- MEDIUM: tree-wide: Use CS util functions instead of SI ones
- MINOR: stream-int/txn: Move buffer for L7 retries in the HTTP transaction
- CLEANUP: http-ana: Remove http_alloc_txn() function
- MINOR: stream-int/stream: Move conn_retries counter in the stream
- MINOR: stream: Simplify retries counter calculation
- MEDIUM: stream-int/conn-stream: Move src/dst addresses in the conn-stream
- MINOR: stream-int/conn-stream: Move half-close timeout in the conn-stream
- MEDIUM: stream-int/stream: Use connect expiration instead of SI expiration
- MINOR: stream-int/conn-stream: Report error to the CS instead of the SI
- MEDIUM: conn-stream: Use endpoint error instead of conn-stream error
- MINOR: channel: Use conn-streams as channel producer and consumer
- MINOR: stream-int: Remove SI_FL_KILL_CON to rely on conn-stream endpoint only
- MINOR: mux-h2/mux-fcgi: Fully rely on CS_EP_KILL_CONN
- MINOR: stream-int: Remove SI_FL_NOLINGER/NOHALF to rely on CS flags instead
- MINOR: stream-int: Remove SI_FL_DONT_WAKE to rely on CS flags instead
- MINOR: stream-int: Remove SI_FL_INDEP_STR to rely on CS flags instead
- MINOR: stream-int: Remove SI_FL_SRC_ADDR to rely on stream flags instead
- CLEANUP: stream-int: Remove unused SI_FL_CLEAN_ABRT flag
- MINOR: stream: Only save previous connection state for the server side
- MEDIUM: stream-int: Move SI err_type in the stream
- MEDIUM: stream-int/conn-stream: Move stream-interface state in the conn-stream
- MINOR: stream-int/stream: Move si_retnclose() in the stream scope
- MINOR: stream-int/backend: Move si_connect() in the backend scope
- MINOR: stream-int/conn-stream: Move si_conn_ready() in the conn-stream scope
- MINOR: conn-stream/connection: Move SHR/SHW modes in the connection scope
- MEDIUM: conn-stream: Be prepared to fail to attach a cs to a mux
- MEDIUM: stream-int/conn-stream: Handle I/O subscriptions in the conn-stream
- MINOR: conn-stream: Rename CS functions dedicated to connections
- MINOR: stream-int/conn-stream: Move si_shut* and si_chk* in conn-stream scope
- MEDIUM: stream-int/conn-stream: Move si_ops in the conn-stream scope
- MINOR: applet: Use the CS to register and release applets instead of SI
- MINOR: connection: unconst mux's get_fist_cs() callback function
- MINOR: stream-int/connection: Move conn_si_send_proxy() in the connection scope
- REORG: stream-int: Export si_cs_recv(), si_cs_send() and si_cs_process()
- REORG: stream-int: Move si_is_conn_error() in the header file
- REORG: conn-stream: Move cs_shut* and cs_chk* in cs_utils
- REORG: conn-stream: Move cs_app_ops in conn_stream.c
- MINOR: stream-int-conn-stream: Move si_update_* in conn-stream scope
- MINOR: stream-int/stream: Move si_update_both in stream scope
- MEDIUM: conn-stream/applet: Add a data callback for applets
- MINOR: stream-int/conn-stream: Move stream_int_read0() in the conn-stream scope
- MINOR: stream-int/conn-stream: Move stream_int_notify() in the conn-stream scope
- MINOR: stream-int/conn-stream: Move si_cs_io_cb() in the conn-stream scope
- MINOR: stream-int/conn-stream: Move si_sync_recv/send() in conn-stream scope
- MINOR: conn-stream: Move si_conn_cb in the conn-stream scope
- MINOR: stream-int/conn-stream Move si_is_conn_error() in the conn-stream scope
- MINOR: stream-int/conn-stream: Move si_alloc_ibuf() in the conn-stream scope
- CLEANUP: stream-int: Remove unused SI functions
- MEDIUM: stream-int/conn-stream: Move blocking flags from SI to CS
- MEDIUM: stream-int/conn-stream: Move I/O functions to conn-stream
- REORG: stream-int/conn-stream: Move remaining functions to conn-stream
- MINOR: stream: Use conn-stream to report server error
- MINOR: http-ana: Use CS to perform L7 retries
- MEDIUM: stream: Don't use the stream-int anymore in process_stream()
- MINOR: conn-stream: Remove the stream-interface from the conn-stream
- DEV: flags: No longer dump SI flags
- CLEANUP: tree-wide: Remove any ref to stream-interfaces
- CLEANUP: conn-stream: Don't export internal functions
- DOC: conn-stream: Add comments on functions of the new CS api
- MEDIUM: check: Use a new conn-stream for each health-check run
- CLEANUP: muxes: Remove MX_FL_CLEAN_ABRT flag
- MINOR: conn-stream: Use a dedicated function to conditionally remove a CS
- CLEANUP: conn-stream: rename cs_register_applet() to cs_applet_create()
- MINOR: muxes: Improve show_fd callbacks to dump endpoint flags
- MINOR: mux-h1: Rely on the endpoint instead of the conn-stream when possible
- BUG/MINOR: quic: Avoid starting the mux if no ALPN sent by the client
- BUILD: debug: mark the __start_mem_stats/__stop_mem_stats symbols as weak
- BUILD: initcall: mark the __start_i_* symbols as weak, not global
- BUG/MINOR: mux-h2: do not use timeout http-keep-alive on backend side
- BUG/MINOR: mux-h2: use timeout http-request as a fallback for http-keep-alive
- MINOR: muxes: Don't expect to have a mux without connection in destroy callback
- MINOR: muxes: Don't handle proto upgrade for muxes not supporting it
- MINOR: muxes: Don't expect to call release function with no mux defined
- MINOR: conn-stream: Use unsafe functions to get conn/appctx in cs_detach_endp
- BUG/MEDIUM: mux-h1: Don't request more room on partial trailers
- BUILD: http-client: Avoid dead code when compiled without SSL support
- BUG/MINOR: mux-quic: prevent a crash in session_free on mux.destroy
- BUG/MINOR: quic-sock: do not double free session on conn init failure
- BUG/MINOR: quic: fix return value for error in start
- MINOR: quic: emit CONNECTION_CLOSE on app init error
- BUILD: sched: workaround crazy and dangerous warning in Clang 14
- BUILD: compiler: use a more portable set of asm(".weak") statements
- BUG/MEDIUM: stream: do not abort connection setup too early
- CLEANUP: extcheck: do not needlessly preset the server's address/port
- MINOR: extcheck: fill in the server's UNIX socket address when known
- BUG/MEDIUM: connection: Don't crush context pointer location if it is a CS
- BUG/MEDIUM: quic: properly clean frames on stream free
- BUG/MEDIUM: fcgi-app: Use http_msg flags to know if C-L header can be added
- BUG/MEDIUM: compression: Don't forget to update htx_sl and http_msg flags
- MINOR: tcp_sample: clarifying samples support per os, for further expansion.
- MINOR: tcp_sample: extend support for get_tcp_info to macOs.
- SCRIPTS: announce-release: update the doc's URL
- DOC: lua: update a few doc URLs
- SCRIPTS: announce-release: add shortened links to pending issues
|
||
|
Christopher Faulet
|
a97ccedf6f |
CLEANUP: muxes: Remove MX_FL_CLEAN_ABRT flag
This flag is unused. Thus, it may be removed. No reason to still set it. It also cleans up "haproxy -vv" output. |
||
|
Willy Tarreau
|
d3b4cd11f7 |
[RELEASE] Released version 2.6-dev5
Released version 2.6-dev5 with the following main changes :
- DOC: reflect H2 timeout changes
- BUG/MEDIUM: mux-fcgi: Properly handle return value of headers/trailers parsing
- BUG/MEDIUM: mux-h1: Properly detect full buffer cases during message parsing
- BUG/MINOR: log: Initialize the list element when allocating a new log server
- BUG/MINOR: samples: add missing context names for sample fetch functions
- MINOR: management: add some basic keyword dump infrastructure
- MINOR: config: add a function to dump all known config keywords
- MINOR: filters: extend flt_dump_kws() to dump to stdout
- MINOR: services: extend list_services() to dump to stdout
- MINOR: cli: add a new keyword dump function
- MINOR: acl: add a function to dump the list of known ACL keywords
- MINOR: samples: add a function to list register sample fetch keywords
- MINOR: sample: list registered sample converter functions
- MINOR: tools: add strordered() to check whether strings are ordered
- MINOR: action: add a function to dump the list of actions for a ruleset
- MINOR: config: alphanumerically sort config keywords output
- MINOR: sample: alphanumerically sort sample & conv keyword dumps
- MINOR: acl: alphanumerically sort the ACL dump
- MINOR: cli: alphanumerically sort the dump of supported commands
- MINOR: filters: alphabetically sort the list of filter names
- MINOR: services: alphabetically sort service names
- MEDIUM: httpclient/lua: be stricter with httpclient parameters
- MINOR: ssl: split the cert commit io handler
- MINOR: ssl: move the cert_exts and the CERT_TYPE enum
- MINOR: ssl: simplify the certificate extensions array
- MINOR: ssl: export ckch_inst_rebuild()
- MINOR: ssl: add "crt" in the cert_exts array
- MINOR: ssl/lua: CertCache.set() allows to update an SSL certificate file
- BUILD: ssl/lua: CacheCert needs OpenSSL
- DOC: lua: CertCache class documentation
- BUG/MEDIUM: quic: do not use qcs from quic_stream on ACK parsing
- MINOR: mux-quic: return qcs instance from qcc_get_qcs
- MINOR: mux-quic: reorganize qcs free
- MINOR: mux-quic: define release app-ops
- BUG/MINOR: h3: release resources on close
- BUG/MINOR: mux-quic: ensure to free all qcs on MUX release
- CLEANUP: quic: complete comment on qcs_try_to_consume
- MINOR: quic: implement stream descriptor for transport layer
- MEDIUM: quic: move transport fields from qcs to qc_conn_stream
- MEDIUM: mux-quic: remove qcs tree node
- BUG/MINOR: cli/stream: fix "shutdown session" to iterate over all threads
- DOC: management: add missing dot in 9.4.1
- BUG/MAJOR: mux_pt: always report the connection error to the conn_stream
- DOC: remove double blanks in configuration.txt
- CI: github actions: update OpenSSL to 3.0.2
- BUG/MEDIUM: quic: Possible crash in ha_quic_set_encryption_secrets()
- CLEANUP: quic: Remove all atomic operations on quic_conn struct
- CLEANUP: quic: Remove all atomic operations on packet number spaces
- MEDIUM: quic: Send ACK frames asap
- BUG/MINOR: quic: Missing probing packets when coalescing
- BUG/MINOR: quic: Discard Initial packet number space only one time
- MINOR: quic: Do not display any timer value from process_timer()
- BUG/MINOR: quic: Do not probe from an already probing packet number space
- BUG/MINOR: quic: Non duplicated frames upon fast retransmission
- BUG/MINOR: quic: Too much prepared retransmissions due to anti-amplification
- MINOR: quic: Useless call to SSL_CTX_set_default_verify_paths()
- MINOR: quic: Add traces about list of frames
- BUG/MINOR: h3: Missing wait event struct field initialization
- BUG/MINOR: quic: QUIC TLS secrets memory leak
- BUG/MINOR: quic: Missing ACK range deallocations
- BUG/MINOR: quic: Missing TX packet deallocations
- CLEANUP: hpack: be careful about integer promotion from uint8_t
- OPTIM: hpack: read 32 bits at once when possible.
- MEDIUM: ssl: allow loading of a directory with the ca-file directive
- BUG/MINOR: ssl: continue upon error when opening a directory w/ ca-file
- MINOR: ssl: ca-file @system-ca loads the system trusted CA
- DOC: configuration: add the ca-file changes
- MINOR: sample: converter: Add add_item convertor
- BUG/MINOR: ssl: handle X509_get_default_cert_dir() returning NULL
- BUG/MINOR: ssl/cli: Remove empty lines from CLI output
- MINOR: httpclient: enable request buffering
- MEDIUM: httpclient: enable l7-retry
- BUG/MINOR: httpclient: end callback in applet release
- MINOR: quic: Add draining connection state.
- MINOR: quic: Add closing connection state
- BUG/MEDIUM: quic: ensure quic-conn survives to the MUX
- CLEANUP: quic: use static qualifer on quic_close
- CLEANUP: mux-quic: remove unused QC_CF_CC_RECV
- BUG/MINOR: fix memleak on quic-conn streams cleaning
- MINOR: mux-quic: factorize conn-stream attach
- MINOR: mux-quic: adjust timeout to accelerate closing
- MINOR: mux-quic: define is_active app-ops
- MINOR: mux-quic: centralize send operations in qc_send
- MEDIUM: mux-quic: report CO_FL_ERROR on send
- MEDIUM: mux-quic: report errors on conn-streams
- MEDIUM: quic: report closing state for the MUX
- BUG/MINOR: fcgi-app: Don't add C-L header on response to HEAD requests
- BUG/MEDIUM: stats: Be sure to never set EOM flag on an empty HTX message
- BUG/MEDIUM: hlua: Don't set EOM flag on an empty HTX message in HTTP applet
- BUG/MEDIUM: promex: Be sure to never set EOM flag on an empty HTX message
- BUG/MEDIUM: mux-h1: Set outgoing message to DONE when payload length is reached
- BUG/MINOR: http_client: Don't add input data on an empty request buffer
- BUG/MEDIUM: http-conv: Fix url_enc() to not crush const samples
- BUG/MEDIUM: http-act: Don't replace URI if path is not found or invalid
- CLEANUP: mux-quic: remove uneeded TODO in qc_detach
- BUG/MEDIUM: mux-quic: properly release conn-stream on detach
- BUG/MINOR: quic: set the source not the destination address on accept()
- BUG/MEDIUM: quic: Possible crash from quic_free_arngs()
- MINOR: quic_tls: Add reusable cipher contexts to QUIC TLS contexts
- MINOR: quic_tls: Stop hardcoding cipher IV lengths
- CLEANUP: quic: Do not set any cipher/group from ssl_quic_initial_ctx()
- MINOR: quic: Add short packet key phase bit values to traces
- MINOR: quic_tls: Make key update use of reusable cipher contexts
- BUG/MINOR: opentracing: setting the return value in function flt_ot_var_set()
- BUG/BUILD: opentracing: fixed OT_DEFINE variable setting
- EXAMPLES: opentracing: refined shell scripts for testing filter performance
- DOC: opentracing: corrected comments in function descriptions
- CLEANUP: opentracing: removed unused function flt_ot_var_unset()
- CLEANUP: opentracing: removed unused function flt_ot_var_get()
- Revert "MINOR: opentracing: change the scope of the variable 'ot.uuid' from 'sess' to 'txn'"
- MINOR: opentracing: only takes the variables lock on shared entries
- CLEANUP: opentracing: added flt_ot_smp_init() function
- CLEANUP: opentracing: added variable to store variable length
- MINOR: opentracing: improved normalization of context variable names
- DEBUG: opentracing: show return values of all functions in the debug output
- CLEANUP: opentracing: added FLT_OT_PARSE_INVALID_enum enum
- DEBUG: opentracing: display the contents of the err variable after setting
- MAJOR: opentracing: reenable usage of vars to transmit opentracing context
- Revert "BUILD: opentracing: display warning in case of using OT_USE_VARS at compile time"
- MEDIUM: global: Add a "close-spread-time" option to spread soft-stop on time window
|