mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 07:07:04 +02:00
Code Issues Projects Releases Wiki Activity
24,846 Commits 15 Branches 393 Tags 179 MiB
C 98.1%
Shell 0.8%
Makefile 0.5%
Lua 0.2%
Python 0.2%
4a298c6c5c
Go to file
William Lallemand 4a298c6c5c BUG/MEDIUM: ssl/clienthello: ECDSA with ssl-max-ver TLSv1.2 and no ECDSA ciphers 
Patch 23093c72 ("BUG/MINOR: ssl: suboptimal certificate selection with TLSv1.3
and dual ECDSA/RSA") introduced a problem when prioritizing the ECDSA
with TLSv1.3.

Indeed, when a client with TLSv1.3 capabilities announce a list of
ECDSA sigalgs, a list of TLSv1.3 ciphersuites compatible with ECDSA,
but only RSA ciphers for TLSv1.2, and haproxy is configured to a
ssl-max-ver TLSv1.2, then haproxy would use the ECDSA keypair, but the
client wouldn't be able to process it because TLSv1.2 was negociated.

HAProxy would be configured like that:

  ssl-default-bind-options ssl-max-ver TLSv1.2

And a client could be used this way:

  openssl s_client -connect localhost:8443 -cipher ECDHE-ECDSA-AES128-GCM-SHA256 \
          -ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

This patch fixes the issue by checking if TLSv1.3 was configured before
allowing ECDSA is an TLSv1.3 ciphersuite is in the list.

This could be backported where 23093c72 ("BUG/MINOR: ssl: suboptimal
certificate selection with TLSv1.3 and dual ECDSA/RSA") was backported.
However this is quite sensible and we should wait a bit before the
backport.

This should fix issue #2988
2025-06-25 14:25:14 +02:00
.github CI: combine AWS-LC and AWS-LC-FIPS by template 2025-05-27 15:06:58 +02:00
addons MINOR: promex: Add agent check status/code/duration metrics 2025-05-22 09:50:10 +02:00
admin CLEANUP: assorted typo fixes in the code and comments 2024-09-03 17:49:21 +02:00
dev DEV: patchbot: prepare for new version 3.3-dev 2025-05-28 16:23:12 +02:00
doc MAJOR: mailers: remove native mailers support 2025-06-24 10:55:58 +02:00
examples MAJOR: mailers: remove native mailers support 2025-06-24 10:55:58 +02:00
include MAJOR: mailers: remove native mailers support 2025-06-24 10:55:58 +02:00
reg-tests REGTESTS: Remove tests with REQUIRE_VERSION_BELOW=2.4 2025-06-02 17:37:07 +02:00
scripts REGTESTS: Remove support for REQUIRE_VERSION and REQUIRE_VERSION_BELOW 2025-06-02 17:37:11 +02:00
src BUG/MEDIUM: ssl/clienthello: ECDSA with ssl-max-ver TLSv1.2 and no ECDSA ciphers 2025-06-25 14:25:14 +02:00
tests TESTS: Fix build for filltab25.c 2025-04-03 15:59:41 +02:00
.cirrus.yml CI: cirrus-ci: bump FreeBSD image to 14-2 2025-02-12 13:18:55 +01:00
.gitattributes
.gitignore MINOR: tevt/dev: Add term_events tool 2025-01-31 10:41:50 +01:00
.mailmap
.travis.yml MEDIUM: mworker: remove USE_SYSTEMD requirement for -Ws 2024-11-20 12:07:38 +01:00
BRANCHES
BSDmakefile
CHANGELOG [RELEASE] Released version 3.3-dev1 2025-06-11 14:31:33 +02:00
CONTRIBUTING CLEANUP: assorted typo fixes in the code and comments 2025-04-02 11:12:20 +02:00
INSTALL MINOR: version: mention that it's development again 2025-05-28 16:46:15 +02:00
LICENSE
MAINTAINERS MAJOR: spoe: Let the SPOE back into the game 2024-05-22 09:04:38 +02:00
Makefile MINOR: counters: add shared counters helpers to get and drop shared pointers 2025-06-05 09:59:04 +02:00
README.md DOC: change the link to the FreeBSD CI in README.md 2024-06-03 15:21:29 +02:00
SUBVERS
VERDATE [RELEASE] Released version 3.3-dev1 2025-06-11 14:31:33 +02:00
VERSION [RELEASE] Released version 3.3-dev1 2025-06-11 14:31:33 +02:00

README.md

HAProxy

alpine/musl AWS-LC openssl no-deprecated Illumos NetBSD FreeBSD VTest

HAProxy logo

HAProxy is a free, very fast and reliable reverse-proxy offering high availability, load balancing, and proxying for TCP and HTTP-based applications.

Installation

The INSTALL file describes how to build HAProxy. A list of packages is also available on the wiki.

Getting help

The discourse and the mailing-list are available for questions or configuration assistance. You can also use the slack or IRC channel. Please don't use the issue tracker for these.

The issue tracker is only for bug reports or feature requests.

Documentation

The HAProxy documentation has been split into a number of different files for ease of use. It is available in text format as well as HTML. The wiki is also meant to replace the old architecture guide.

Please refer to the following files depending on what you're looking for:

  • INSTALL for instructions on how to build and install HAProxy
  • BRANCHES to understand the project's life cycle and what version to use
  • LICENSE for the project's license
  • CONTRIBUTING for the process to follow to submit contributions

The more detailed documentation is located into the doc/ directory:

License

HAProxy is licensed under GPL 2 or any later version, the headers under LGPL 2.1. See the LICENSE file for a more detailed explanation.