From first-hand experience I realized that using encrypted passwords in
userlists can quickly become overwhelming for busy sites. In my case
just about 100 rq/s were enough to drive (user) CPU usage from 2-3% up
to >90%. While it is perfectly explicable why this is the case, having
it mentioned in the relevant documentation section might spare someone
some confusion in the future.
Released version 1.8-rc2 with the following main changes :
- BUG/MINOR: send-proxy-v2: fix dest_len in make_tlv call
- BUG/MINOR: send-proxy-v2: string size must include ('\0')
- MINOR: mux: Only define pipe functions on linux.
- MINOR: cache: Remove useless test for nonzero.
- MINOR: cache: Don't confuse act_return and act_parse_ret.
- BUG/MEDIUM: h2: don't try to parse incomplete H1 responses
- BUG/MEDIUM: checks/mux: always enable send-polling after connecting
- BUG/MAJOR: fix deadlock on healthchecks.
- BUG/MINOR: thread: fix a typo in the debug code
- BUILD: shctx: allow to be built without openssl
- BUG/MEDIUM: cache: don't try to resolve wrong filters
- BUG/MAJOR: buffers: fix get_buffer_nc() for data at end of buffer
- BUG/MINOR: freq: fix infinite loop on freq_ctr_period.
- BUG/MINOR: stdarg.h inclusion
- BUG/MINOR: dns: fix missing lock protection on server.
- BUG/MINOR: lua: fix missing lock protection on server.
- BUILD: enable USE_THREAD for OpenBSD build.
- BUG/MAJOR: mux_pt: don't dereference a connstream after ->wake()
- MINOR: thread: report multi-thread support in haproxy -vv
Released version 1.8-rc1 with the following main changes :
- BUG/MEDIUM: server: Allocate tmptrash before using it.
- CONTRIB: trace: add the possibility to place trace calls in the code
- CONTRIB: trace: try to display the function's return value on exit
- CONTRIB: trace: report the base name only for file names
- BUILD: ssl: support OPENSSL_NO_ASYNC #define
- MINOR: ssl: build with recent BoringSSL library
- BUG/MINOR: ssl: OCSP_single_get0_status can return -1
- BUG/MINOR: cli: restore "set ssl tls-key" command
- CLEANUP: cli: remove undocumented "set ssl tls-keys" command
- IMPORT: sha1: import SHA1 functions
- MINOR: sample: add the sha1 converter
- MINOR: sample: add the hex2i converter
- MINOR: stream-int: stop checking for useless connection flags in chk_snd_conn
- MINOR: ssl: don't abort after sending 16kB
- MINOR: connection: move the cleanup of flag CO_FL_WAIT_ROOM
- MINOR: connection: add flag CO_FL_WILL_UPDATE to indicate when updates are granted
- MEDIUM: connection: make use of CO_FL_WILL_UPDATE in conn_sock_shutw()
- MINOR: raw_sock: make use of CO_FL_WILL_UPDATE
- MINOR: ssl_sock: make use of CO_FL_WILL_UPDATE
- BUG/MINOR: checks: Don't forget to release the connection on error case.
- MINOR: buffer: add the buffer input manipulation functions
- BUG/MEDIUM: prevent buffers being overwritten during build_logline() execution
- MEDIUM: cfgparse: post section callback
- MEDIUM: cfgparse: post parsing registration
- MINOR: lua: add uuid to the Class Proxy
- MINOR: hlua: Add regex class
- MINOR: http: Mark the 425 code as "Too Early".
- MEDIUM: ssl: convert CBS (BoringSSL api) usage to neutral code
- MINOR: ssl: support Openssl 1.1.1 early callback for switchctx
- MINOR: ssl: generated certificate is missing in switchctx early callback
- MEDIUM: ssl: Handle early data with OpenSSL 1.1.1
- BUILD: Makefile: disable -Wunused-label
- MINOR: ssl/proto_http: Add keywords to take care of early data.
- BUG/MINOR: lua: const attribute of a string is overridden
- MINOR: ssl: Don't abuse ssl_options.
- MINOR: update proxy-protocol-v2 #define
- MINOR: merge ssl_sock_get calls for log and ppv2
- MINOR: add ALPN information to send-proxy-v2
- MEDIUM: h1: ensure that 1xx, 204 and 304 don't have a payload body
- CLEANUP: shctx: get ride of the shsess_packet{_hdr} structures
- MEDIUM: lists: list_for_each_entry{_safe}_from functions
- REORG: shctx: move lock functions and struct
- MEDIUM: shctx: allow the use of multiple shctx
- REORG: shctx: move ssl functions to ssl_sock.c
- MEDIUM: shctx: separate ssl and shctx
- MINOR: shctx: rename lock functions
- MINOR: h1: store the status code in the H1 message
- BUG/MINOR: spoe: Don't compare engine name and SPOE scope when both are NULL
- BUG/MINOR: spoa: Update pointer on the end of the frame when a reply is encoded
- MINOR: action: Add trk_idx inline function
- MINOR: action: Use trk_idx instead of tcp/http_trk_idx
- MINOR: action: Add a function pointer in act_rule struct to check its validity
- MINOR: action: Add function to check rules using an action ACT_ACTION_TRK_*
- MINOR: action: Add a functions to check http capture rules
- MINOR: action: Factorize checks on rules calling check_ptr if defined
- MINOR: acl: Pass the ACLs as an explicit parameter of build_acl_cond
- MEDIUM: spoe: Add support of ACLS to enable or disable sending of SPOE messages
- MINOR: spoe: Check uniqness of SPOE engine names during config parsing
- MEDIUM: spoe: Parse new "spoe-group" section in SPOE config file
- MEDIUM: spoe/rules: Add "send-spoe-group" action for tcp/http rules
- MINOR: spoe: Move message encoding in its own function
- MINOR: spoe: Add a type to qualify the message list during encoding
- MINOR: spoe: Add a generic function to encode a list of SPOE message
- MEDIUM: spoe/rules: Process "send-spoe-group" action
- BUG/MINOR: dns: Fix CLI keyword declaration
- MAJOR: dns: Refactor the DNS code
- BUG/MINOR: mailers: Fix a memory leak when email alerts are released
- MEDIUM: mailers: Init alerts during conf parsing and refactor their processing
- MINOR: mailers: Use pools to allocate email alerts and its tcpcheck_rules
- MINOR: standard: Add memvprintf function
- MINOR: log: Save alerts and warnings emitted during HAProxy startup
- MINOR: cli: Add "show startup-logs" command
- MINOR: startup: Extend the scope the MODE_STARTING flag
- MINOR: threads: Prepare makefile to link with pthread
- MINOR: threads: Add THREAD_LOCAL macro
- MINOR: threads: Add atomic-ops and plock includes in import dir
- MEDIUM: threads: Add hathreads header file
- MINOR: threads: Add mechanism to register per-thread init/deinit functions
- MINOR: threads: Add nbthread parameter
- MEDIUM: threads: Adds a set of functions to handle sync-point
- MAJOR: threads: Start threads to experiment multithreading
- MINOR: threads: Define the sync-point inside run_poll_loop
- MEDIUM: threads/buffers: Define and register per-thread init/deinit functions
- MEDIUM: threads/chunks: Transform trash chunks in thread-local variables
- MEDIUM: threads/time: Many global variables from time.h are now thread-local
- MEDIUM: threads/logs: Make logs thread-safe
- MEDIUM: threads/pool: Make pool thread-safe by locking all access to a pool
- MAJOR: threads/fd: Make fd stuffs thread-safe
- MINOR: threads/fd: Add a mask of threads allowed to process on each fd in fdtab array
- MEDIUM: threads/fd: Initialize the process mask during the call to fd_insert
- MINOR: threads/fd: Process cached events of FDs depending on the process mask
- MINOR: threads/polling: pollers now handle FDs depending on the process mask
- WIP: SQUASH WITH SYNC POINT
- MAJOR: threads/task: handle multithread on task scheduler
- MEDIUM: threads/signal: Add a lock to make signals thread-safe
- MEDIUM: threads/listeners: Make listeners thread-safe
- MEDIUM: threads/proxy: Add a lock per proxy and atomically update proxy vars
- MEDIUM: threads/server: Make connection list (priv/idle/safe) thread-safe
- MEDIUM: threads/server: Add a lock per server and atomically update server vars
- MINOR: threads/server: Add a lock to deal with insert in updates_servers list
- MEDIUM: threads/lb: Make LB algorithms (lb_*.c) thread-safe
- MEDIUM: threads/stick-tables: handle multithreads on stick tables
- MINOR: threads/sample: Change temp_smp into a thread local variable
- MEDIUM: threads/http: Make http_capture_bad_message thread-safe
- MINOR: threads/regex: Change Regex trash buffer into a thread local variable
- MAJOR: threads/applet: Handle multithreading for applets
- MAJOR: threads/peers: Make peers thread safe
- MAJOR: threads/buffer: Make buffer wait queue thread safe
- MEDIUM: threads/stream: Make streams list thread safe
- MAJOR: threads/ssl: Make SSL part thread-safe
- MEDIUM: threads/queue: Make queues thread-safe
- MAJOR: threads/map: Make acls/maps thread safe
- MEDIUM: threads/freq_ctr: Make the frequency counters thread-safe
- MEDIUM: thread/vars: Make vars thread-safe
- MEDIUM: threads/filters: Add init/deinit callback per thread
- MINOR: threads/filters: Update trace filter to add _per_thread callbacks
- MEDIUM: threads/compression: Make HTTP compression thread-safe
- MEDIUM: threads/lua: Makes the jmpbuf and some other buffers local to the current thread.
- MEDIUM: threads/lua: Add locks around the Lua execution parts.
- MEDIUM: threads/lua: Ensure that the launched tasks runs on the same threads than me
- MEDIUM: threads/lua: Cannot acces to the socket if we try to access from another thread.
- MEDIUM: threads/xref: Convert xref function to a thread safe model
- MEDIUM: threads/tasks: Add lock around notifications
- MEDIUM: thread/spoe: Make the SPOE thread-safe
- MEDIUM: thread/dns: Make DNS thread-safe
- MINOR: threads: Add thread-map config parameter in the global section
- MINOR: threads/checks: Add a lock to protect the pid list used by external checks
- MINOR: threads/checks: Set the task process_mask when a check is executed
- MINOR: threads/mailers: Add a lock to protect queues of email alerts
- MEDIUM: threads/server: Use the server lock to protect health check and cli concurrency
- MINOR: threads: Don't start when device a detection module is used
- BUG/MEDIUM: threads: Run the poll loop on the main thread too
- BUG/MINOR: threads: Add missing THREAD_LOCAL on static here and there
- MAJOR: threads: Offically enable the threads support in HAProxy
- BUG/MAJOR: threads/freq_ctr: fix lock on freq counters.
- BUG/MAJOR: threads/time: Store the time deviation in an 64-bits integer
- BUILD: stick-tables: silence an uninitialized variable warning
- BUG/MINOR: dns: Fix SRV records with the new thread code.
- MINOR: ssl: Remove the global allow-0rtt option.
- CLEANUP: threads: replace the last few 1UL<<tid with tid_bit
- CLEANUP: threads: rename process_mask to thread_mask
- MINOR: h1: add a function to measure the trailers length
- MINOR: threads: add a portable barrier for threads and non-threads
- BUG/MAJOR: threads/freq_ctr: use a memory barrier to detect changes
- BUG/MEDIUM: threads: Initialize the sync-point
- MEDIUM: connection: start to introduce a mux layer between xprt and data
- MINOR: connection: implement alpn registration of muxes
- MINOR: mux: register the pass-through mux for any ALPN string
- MEDIUM: session: use the ALPN token and proxy mode to select the mux
- MINOR: connection: report the major HTTP version from the MUX for logging (fc_http_major)
- MINOR: connection: introduce conn_stream
- MINOR: mux: add more methods to mux_ops
- MINOR: connection: introduce the conn_stream manipulation functions
- MINOR: mux_pt: implement remaining mux_ops methods
- MAJOR: connection : Split struct connection into struct connection and struct conn_stream.
- MINOR: connection: make conn_stream users also check for per-stream error flag
- MINOR: conn_stream: new shutr/w status flags
- MINOR: conn_stream: modify cs_shut{r,w} API to pass the desired mode
- MEDIUM: connection: make conn_sock_shutw() aware of lingering
- MINOR: connection: add cs_close() to close a conn_stream
- MEDIUM: mux_pt: make cs_shutr() / cs_shutw() properly close the connection
- MEDIUM: connection: replace conn_full_close() with cs_close()
- MEDIUM: connection: make mux->detach() release the connection
- MEDIUM: stream: do not forcefully close the client connection anymore
- MEDIUM: checks: exclusively use cs_destroy() to release a connection
- MEDIUM: connection: add a destroy callback
- MINOR: session: release the listener with the session, not the stream
- MEDIUM: session: make use of the connection's destroy callback
- CONTRIB: hpack: implement a reverse huffman table generator for hpack
- MINOR: hpack: implement the HPACK Huffman table decoder
- MINOR: hpack: implement the header tables management
- MINOR: hpack: implement the decoder
- MEDIUM: hpack: implement basic hpack encoding
- MINOR: h2: centralize all HTTP/2 protocol elements and constants
- MINOR: h2: create a very minimalistic h2 mux
- MINOR: h2: expose tune.h2.header-table-size to configure the table size
- MINOR: h2: expose tune.h2.initial-window-size to configure the window size
- MINOR: h2: expose tune.h2.max-concurrent-streams to limit the number of streams
- MINOR: h2: create the h2c struct and allocate its pool
- MINOR: h2: create the h2s struct and the associated pool
- MINOR: h2: handle two extra stream states for errors
- MINOR: h2: add a frame header descriptor for incoming frames
- MEDIUM: h2: allocate and release the h2c context on connection init/end
- MEDIUM: h2: implement basic recv/send/wake functions
- MEDIUM: h2: dynamically allocate the demux buffer on Rx
- MEDIUM: h2: implement the mux buffer allocator
- MINOR: h2: add the connection and stream flags listing the causes for blocking
- MINOR: h2: add function h2s_id() to report a stream's ID
- MINOR: h2: small function to know when the mux is busy
- MINOR: h2: new function h2c_error to mark an error on the connection
- MINOR: h2: new function h2s_error() to mark an error on a stream
- MINOR: h2: add h2_set_frame_size() to update the size in a binary frame
- MINOR: h2: new function h2_peek_frame_hdr() to retrieve a new frame header
- MINOR: h2: add a few functions to retrieve contents from a wrapping buffer
- MINOR: h2: add stream lookup function based on the stream ID
- MINOR: h2: create dummy idle and closed streams
- MINOR: h2: add the function to create a new stream
- MINOR: h2: update the {MUX,DEM}_{M,D}ALLOC flags on buffer availability
- MEDIUM: h2: start to consider the H2_CF_{MUX,DEM}_* flags for polling
- MINOR: h2: also terminate the connection on shutr
- MEDIUM: h2: properly consider all conditions for end of connection
- MEDIUM: h2: wake the connection up for send on pending streams
- MEDIUM: h2: start to implement the frames processing loop
- MINOR: h2: add a function to send a GOAWAY error frame
- MINOR: h2: match the H2 connection preface on init
- MEDIUM: h2: enable connection polling for send when a cs wants to emit
- MEDIUM: h2: enable reading again on the connection if it was blocked on stream buffer full
- MEDIUM: h2: process streams pending for sending
- MINOR: h2: send a real SETTINGS frame based on the configuration
- MEDIUM: h2: detect the presence of the first settings frame
- MINOR: h2: create a stream parser for the demuxer
- MINOR: h2: implement PING frames
- MEDIUM: h2: decode SETTINGS frames and extract relevant settings
- MINOR: h2: lookup the stream during demuxing
- MEDIUM: h2: honor WINDOW_UPDATE frames
- MINOR: h2: implement h2_send_rst_stream() to send RST_STREAM frames
- MINOR: h2: handle CONTINUATION frames
- MEDIUM: h2: partial implementation of h2_detach()
- MEDIUM: h2: unblock a connection when its current stream detaches
- MEDIUM: h2: basic processing of HEADERS frame
- MEDIUM: h2: don't use trash to decode headers!
- MEDIUM: h2: implement the response HEADERS frame to encode the H1 response
- MEDIUM: h2: send the H1 response body as DATA frames
- MEDIUM: h2: skip the response trailers if any
- MEDIUM: h2: properly continue to parse header block when facing a 1xx response
- MEDIUM: h2: send WINDOW_UPDATE frames for connection
- MEDIUM: h2: handle request body in DATA frames
- MINOR: h2: handle RST_STREAM frames
- MEDIUM: h2: send DATA+ES or RST_STREAM on shutw/shutr
- MINOR: h2: use a common function to signal some and all streams.
- MEDIUM: h2: handle GOAWAY frames
- MINOR: h2: centralize the check for the idle streams
- MINOR: h2: centralize the check for the half-closed(remote) streams
- MEDIUM: h2: silently ignore frames higher than last_id after GOAWAY
- MINOR: h2: properly reject PUSH_PROMISE frames coming from the client
- MEDIUM: h2: perform a graceful shutdown on "Connection: close"
- MEDIUM: h2: send a GOAWAY frame when dealing with an empty response
- MEDIUM: h2: apply a timeout to h2 connections
- BUG/MEDIUM: h2: fix incorrect timeout handling on the connection
- MEDIUM: shctx: forbid shctx to read more than expected
- MEDIUM: cache: configuration parsing and initialization
- MEDIUM: cache: store objects in cache
- MEDIUM: cache: deliver objects from cache
A new sample fetch function reports either 1 or 2 for the on-wire encoding,
to indicate if the request was received using the HTTP/1.x format or HTTP/2
format. Note that it reports the on-wire encoding, not the version presented
in the request header.
This will possibly have to evolve if it becomes necessary to report the
encoding on the server side as well.
By default, no affinity is set for threads. To bind threads on CPU, you must
define a "thread-map" in the global section. The format is the same than the
"cpu-map" parameter, with a small difference. The process number must be
defined, with the same format than cpu-map ("all", "even", "odd" or a number
between 1 and 31/63).
A thread will be bound on the intersection of its mapping and the one of the
process on which it is attached. If the intersection is null, no specific bind
will be set for the thread.
Now, it is possible to define init_per_thread and deinit_per_thread callbacks to
deal with ressources allocation for each thread.
This is the filter responsibility to deal with concurrency. This is also the
filter responsibility to know if HAProxy is started with some threads. A good
way to do so is to check "global.nbthread" value. If it is greater than 1, then
_per_thread callbacks will be called.
This is a huge patch with many changes, all about the DNS. Initially, the idea
was to update the DNS part to ease the threads support integration. But quickly,
I started to refactor some parts. And after several iterations, it was
impossible for me to commit the different parts atomically. So, instead of
adding tens of patches, often reworking the same parts, it was easier to merge
all my changes in a uniq patch. Here are all changes made on the DNS.
First, the DNS initialization has been refactored. The DNS configuration parsing
remains untouched, in cfgparse.c. But all checks have been moved in a post-check
callback. In the function dns_finalize_config, for each resolvers, the
nameservers configuration is tested and the task used to manage DNS resolutions
is created. The links between the backend's servers and the resolvers are also
created at this step. Here no connection are kept alive. So there is no needs
anymore to reopen them after HAProxy fork. Connections used to send DNS queries
will be opened on demand.
Then, the way DNS requesters are linked to a DNS resolution has been
reworked. The resolution used by a requester is now referenced into the
dns_requester structure and the resolution pointers in server and dns_srvrq
structures have been removed. wait and curr list of requesters, for a DNS
resolution, have been replaced by a uniq list. And Finally, the way a requester
is removed from a DNS resolution has been simplified. Now everything is done in
dns_unlink_resolution.
srv_set_fqdn function has been simplified. Now, there is only 1 way to set the
server's FQDN, independently it is done by the CLI or when a SRV record is
resolved.
The static DNS resolutions pool has been replaced by a dynamoc pool. The part
has been modified by Baptiste Assmann.
The way the DNS resolutions are triggered by the task or by a health-check has
been totally refactored. Now, all timeouts are respected. Especially
hold.valid. The default frequency to wake up a resolvers is now configurable
using "timeout resolve" parameter.
Now, as documented, as long as invalid repsonses are received, we really wait
all name servers responses before retrying.
As far as possible, resources allocated during DNS configuration parsing are
releases when HAProxy is shutdown.
Beside all these changes, the code has been cleaned to ease code review and the
doc has been updated.
The messages processing is done using existing functions. So here, the main task
is to find the SPOE engine to use. To do so, we loop on all filter instances
attached to the stream. For each, we check if it is a SPOE filter and, if yes,
if its name is the one used to declare the "send-spoe-group" action.
We also take care to return an error if the action processing is interrupted by
HAProxy (because of a timeout or an error at the HAProxy level). This is done by
checking if the flag ACT_FLAG_FINAL is set.
The function spoe_send_group is the action_ptr callback ot
This action is used to trigger sending of a group of SPOE messages. To do so,
the SPOE engine used to send messages must be defined, as well as the SPOE group
to send. Of course, the SPOE engine must refer to an existing SPOE filter. If
not engine name is provided on the SPOE filter line, the SPOE agent name must be
used. For example:
http-request send-spoe-group my-engine some-group
This action is available for "tcp-request content", "tcp-response content",
"http-request" and "http-response" rulesets. It cannot be used for tcp
connection/session rulesets because actions for these rulesets cannot yield.
For now, the action keyword is parsed and checked. But it does nothing. Its
processing will be added in another patch.
For now, this section is only parsed. It should have the following format:
spoe-group <grp-name>
messages <msg-name> ...
And then SPOE groups must be referenced in spoe-agent section:
spoe-agnt <name>
...
groups <grp-name> ...
The purpose of these groups is to trigger messages sending from TCP or HTTP
rules, directly from HAProxy configuration, and not on specific event. This part
will be added in another patch.
It is important to note that a message belongs at most to a group.
The engine name is now kept in "spoe_config" struture. Because a SPOE filter can
be declared without engine name, we use the SPOE agent name by default. Then,
its uniqness is checked against all others SPOE engines configured for the same
proxy.
* TODO: Add documentation
Now, it is possible to conditionnaly send a SPOE message by adding an ACL-based
condition on the "event" line, in a "spoe-message" section. Here is the example
coming for the SPOE documentation:
spoe-message get-ip-reputation
args ip=src
event on-client-session if ! { src -f /etc/haproxy/whitelist.lst }
To avoid mixin with proxy's ACLs, each SPOE message has its private ACL list. It
possible to declare named ACLs in "spoe-message" section, using the same syntax
than for proxies. So we can rewrite the previous example to use a named ACL:
spoe-message get-ip-reputation
args ip=src
acl ip-whitelisted src -f /etc/haproxy/whitelist.lst
event on-client-session if ! ip-whitelisted
ACL-based conditions are executed in the context of the stream that handle the
client and the server connections.
A bind_conf does contain a ssl_bind_conf, which already has a flag to know
if early data are activated, so use that, instead of adding a new flag in
the ssl_options field.
Add a new sample fetch, "ssl_fc_has_early", a boolean that will be true
if early data were sent, and a new action, "wait-for-handshake", if used,
the request won't be forwarded until the SSL handshake is done.
When compiled with Openssl >= 1.1.1, before attempting to do the handshake,
try to read any early data. If any early data is present, then we'll create
the session, read the data, and handle the request before we're doing the
handshake.
For this, we add a new connection flag, CO_FL_EARLY_SSL_HS, which is not
part of the CO_FL_HANDSHAKE set, allowing to proceed with a session even
before an SSL handshake is completed.
As early data do have security implication, we let the origin server know
the request comes from early data by adding the "Early-Data" header, as
specified in this draft from the HTTP working group :
https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-replay
Use Openssl-1.1.1 SSL_CTX_set_client_hello_cb to mimic BoringSSL early callback.
Native multi certificate and SSL/TLS method per certificate is now supported by
Openssl >= 1.1.1.
This patch simply brings HAProxy internal regex system to the Lua API.
Lua doesn't embed regexes, now it inherits from the regexes compiled
with haproxy.
Released version 1.8-dev3 with the following main changes :
- REORG: ssl: move defines and methodVersions table upper
- MEDIUM: ssl: ctx_set_version/ssl_set_version func for methodVersions table
- MINOR: ssl: support ssl-min-ver and ssl-max-ver with crt-list
- MEDIUM: ssl: disable SSLv3 per default for bind
- BUG/MAJOR: ssl: fix segfault on connection close using async engines.
- BUG/MAJOR: ssl: buffer overflow using offloaded ciphering on async engine
- BUG/MINOR: ssl: do not call directly the conn_fd_handler from async_fd_handler
- BUG/MINOR: haproxy/cli : fix for solaris/illumos distros for CMSG* macros
- BUG/MEDIUM: build without openssl broken
- BUG/MINOR: warning: need_resend may be used uninitialized
- BUG/MEDIUM: misplaced exit and wrong exit code
- BUG/MINOR: Makefile: fix compile error with USE_LUA=1 in ubuntu16.04
- BUILD: scripts: make publish-release support bare repositories
- BUILD: scripts: add an automatic mode for publish-release
- BUILD: scripts: add a "quiet" mode to publish-release
- BUG/MAJOR: http: call manage_client_side_cookies() before erasing the buffer
- BUG/MINOR: buffers: Fix bi/bo_contig_space to handle full buffers
- CONTRIB: plug qdiscs: Plug queuing disciplines mini HOWTO.
- BUG/MINOR: acls: Set the right refflag when patterns are loaded from a map
- BUG/MINOR: ssl: Be sure that SSLv3 connection methods exist for openssl < 1.1.0
- BUG/MINOR: http/filters: Be sure to wait if a filter loops in HTTP_MSG_ENDING
- BUG/MEDIUM: peers: Peers CLOSE_WAIT issue.
- BUG/MAJOR: server: Segfault after parsing server state file.
- BUG/MEDIUM: unix: never unlink a unix socket from the file system
- scripts: create-release pass -n to tail
- SCRIPTS: create-release: enforce GIT_COMMITTER_{NAME|EMAIL} validity
- BUG/MEDIUM: fix segfault when no argument to -x option
- MINOR: warning on multiple -x
- MINOR: mworker: don't copy -x argument anymore in copy_argv()
- BUG/MEDIUM: mworker: don't reuse PIDs passed to the master
- BUG/MINOR: Wrong peer task expiration handling during synchronization processing.
- BUG/MINOR: cfgparse: Check if tune.http.maxhdr is in the range 1..32767
- BUG/MINOR: log: pin the front connection when front ip/ports are logged
- DOC: fix references to the section about the unix socket
- BUG/MINOR: stream: flag TASK_WOKEN_RES not set if task in runqueue
- MAJOR: task: task scheduler rework.
- MINOR: task/stream: tasks related to a stream must be init by the caller.
- MINOR: queue: Change pendconn_get_next_strm into private function
- MINOR: backends: Change get_server_sh/get_server_uh into private function
- MINOR: queue: Change pendconn_from_srv/pendconn_from_px into private functions
- MEDIUM: stream: make stream_new() always set the target and analysers
- MINOR: frontend: initialize HTTP layer after the debugging code
- MINOR: connection: add a .get_alpn() method to xprt_ops
- MINOR: ssl: add a get_alpn() method to ssl_sock
- MINOR: frontend: retrieve the ALPN name when available
- MINOR: frontend: report the connection's ALPN in the debug output
- MINOR: stream: don't set backend's nor response analysers on SF_TUNNEL
- MINOR: connection: send data before receiving
- MAJOR: applet: applet scheduler rework.
- BUG/MAJOR: frontend: don't dereference a null conn on outgoing connections
- BUG/MAJOR: cli: fix custom io_release was crushed by NULL.
- BUG/MAJOR: map: fix segfault during 'show map/acl' on cli.
- BUG/MAJOR: compression: Be sure to release the compression state in all cases
- MINOR: compression: Use a memory pool to allocate compression states
- BUG/MAJOR: applet: fix a freeze if data is immedately forwarded.
- DOC: fix references to the section about time format.
- BUG/MEDIUM: map/acl: fix unwanted flags inheritance.
- BUG/MAJOR: http: fix buffer overflow on loguri buffer.
- MINOR: ssl: compare server certificate names to the SNI on outgoing connections
- BUG/MINOR: stream: Don't forget to remove CF_WAKE_ONCE flag on response channel
- BUG/MINOR: http: Don't reset the transaction if there are still data to send
- BUG/MEDIUM: filters: Be sure to call flt_end_analyze for both channels
- MINOR: peers: Add additional information to stick-table definition messages.
- BUG/MINOR: http: properly handle all 1xx informational responses
- OPTIM: ssl: don't consider a small ssl_read() as an indication of end of buffer
- BUG/MINOR: peers: peer synchronization issue (with several peers sections).
- CLEANUP: hdr_idx: make some function arguments const where possible
- BUG/MINOR: Prevent a use-after-free on error scenario on option "-x".
- BUG/MINOR: lua: In error case, the safe mode is not removed
- BUG/MINOR: lua: executes the function destroying the Lua session in safe mode
- BUG/MAJOR: lua/socket: resources not detroyed when the socket is aborted
- BUG/MEDIUM: lua: bad memory access
- BUG/MINOR: Lua: variable already initialized
- DOC: update CONTRIBUTING regarding optional parts and message format
- DOC: update the list of OpenSSL versions in the README
- BUG/MINOR: http: Set the response error state in http_sync_res_state
- MINOR: http: Reorder/rewrite checks in http_resync_states
- MINOR: http: Switch requests/responses in TUNNEL mode only by checking txn flags
- BUG/MEDIUM: http: Switch HTTP responses in TUNNEL mode when body length is undefined
- MINOR: http: Rely on analyzers mask to end processing in forward_body functions
- BUG/MINOR: http: Fix bug introduced in previous patch in http_resync_states
- BUG/MINOR: contrib/modsecurity: BSD build fix
- BUG/MINOR: contrib/mod_defender: build fix
- BUG/MINOR: ssl: remove haproxy SSLv3 support when ssl lib have no SSLv3
- MINOR: ssl: remove an unecessary SSL_OP_NO_* dependancy
- BUILD: ssl: fix compatibility with openssl without TLSEXT_signature_*
- MINOR: tools: add a portable timegm() alternative
- BUILD: lua: replace timegm() with my_timegm() to fix build on Solaris 10
- DOC: Updated 51Degrees git URL to point to a stable version.
- BUG/MAJOR: http: Fix possible infinity loop in http_sync_(req|res)_state
- MINOR: memory: remove macros
- BUG/MINOR: lua: Fix Server.get_addr() port values
- BUG/MINOR: lua: Correctly use INET6_ADDRSTRLEN in Server.get_addr()
- MINOR: samples: Handle the type SMP_T_METH when we duplicate a sample in smp_dup
- MINOR: samples: Handle the type SMP_T_METH in smp_is_safe and smp_is_rw
- MINOR: samples: Don't allocate memory for SMP_T_METH sample when method is known
- BUG/MINOR: lua: always detach the tcp/http tasks before freeing them
- MINOR: task: always preinitialize the task's timeout in task_init()
- CLEANUP: task: remove all initializations to TICK_ETERNITY after task_new()
- BUG/MAJOR: lua: properly dequeue hlua_applet_wakeup() for new scheduler
- MINOR: lua: Add proxy as member of proxy object.
- DOC: lua: Proxy class doc update
- MINOR: lua: Add lists of frontends and backends
- BUG/MINOR: ssl: Fix check against SNI during server certificate verification
- BUG/MINOR: ssl: make use of the name in SNI before verifyhost
- MINOR: ssl: add a new error codes for wrong server certificates
- BUG/MEDIUM: stream: don't retry SSL connections which fail the SNI name check
- MINOR: ssl: add "no-ca-names" parameter for bind
- BUG/MINOR: lua: Fix bitwise logic for hlua_server_check_* functions.
- DOC: fix alphabetical order of "show commands" in management.txt
- MINOR: listener: add a function to return a listener's state as a string
- MINOR: cli: add a new "show fd" command
- BUG/MEDIUM: ssl: Fix regression about certificates generation
- MINOR: Add server port field to server state file.
- MINOR: ssl: allow to start without certificate if strict-sni is set
- MINOR: dns: Cache previous DNS answers.
- MINOR: obj: Add a new type of object, OBJ_TYPE_SRVRQ.
- Add a few functions to do unaligned access.
- MINOR: dns: Handle SRV records.
- MINOR: check: Fix checks when using SRV records.
- MINOR: doc: Document SRV label usage.
- BUILD/MINOR: cli: shut a minor gcc warning in "show fd"
- BUILD: ssl: replace SSL_CTX_get0_privatekey for openssl < 1.0.2
- BUILD/MINOR: build without openssl still broken
- BUG/MAJOR: stream: in stream_free(), close the front endpoint and not the origin
- CLEANUP: raw_sock: Use a better name for the constructor than __ssl_sock_deinit()
- MINOR: init: Fix CPU affinity setting on FreeBSD.
- MINOR: dns: Update analysis of TRUNCATED response for SRV records
- MINOR: dns: update record dname matching for SRV query types
- MINOR: dns: update dns response buffer reading pointer due to SRV record
- MINOR: dns: duplicate entries in resolution wait queue for SRV records
- MINOR: dns: make debugging function dump_dns_config() compatible with SRV records
- MINOR: dns: ability to use a SRV resolution for multiple backends
- MINOR: dns: enable caching of responses for server set by a SRV record
- MINOR: dns: new dns record type (RTYPE) for OPT
- MINOR: dns: enabled edns0 extension and make accpeted payload size tunable
- MINOR: dns: default "hold obsolete" timeout set to 0
- MINOR: chunks: add chunk_memcpy() and chunk_memcat()
- MINOR: session: add a streams field to the session struct
- MINOR: stream: link the stream to its session
- MEDIUM: session: do not free a session until no stream references it
- MINOR: ist: implement very simple indirect strings
- TESTS: ist: add a test file for the functions
- MINOR: http: export some of the HTTP parser macros
- BUG/MINOR: Wrong type used as argument for spoe_decode_buffer().
- BUG/MINOR: dns: server set by SRV records stay in "no resolution" status
- MINOR: dns: Maximum DNS udp payload set to 8192
- MINOR: dns: automatic reduction of DNS accpeted payload size
- MINOR: dns: make SRV record processing more verbose
- CLEANUP: dns: remove duplicated code in dns_resolve_recv()
- CLEANUP: dns: remove duplicated code in dns_validate_dns_response()
- BUG/MINOR: dns: wrong resolution interval lead to 100% CPU
- BUG/MEDIUM: dns: fix accepted_payload_size parser to avoid integer overflow
- BUG/MAJOR: lua: fix the impact of the scheduler changes again
- BUG/MEDIUM: lua: HTTP services must take care of body-less status codes
- MINOR: lua: properly process the contents of the content-length field
- BUG/MEDIUM: stream: properly set the required HTTP analysers on use-service
- OPTIM: lua: don't use expensive functions to parse headers in the HTTP applet
- OPTIM: lua: don't add "Connection: close" on the response
- REORG/MEDIUM: connection: introduce the notion of connection handle
- BUG/MINOR: stream-int: don't check the CO_FL_CURR_WR_ENA flag
- MEDIUM: connection: get rid of data->init() which was not for data
- MEDIUM: stream: make stream_new() allocate its own task
- CLEANUP: listener: remove the unused handler field
- MEDIUM: session: add a pointer to a struct task in the session
- MINOR: stream: provide a new stream creation function for connections
- MEDIUM: connection: remove useless flag CO_FL_DATA_RD_SH
- CLEANUP: connection: remove the unused conn_sock_shutw_pending()
- MEDIUM: connection: remove useless flag CO_FL_DATA_WR_SH
- DOC: add CLI info on privilege levels
- DOC: Refer to Mozilla TLS info / config generator
- MINOR: ssl: remove duplicate ssl_methods in struct bind_conf
- BUG/MEDIUM: http: Fix a regression bug when a HTTP response is in TUNNEL mode
- DOC: Add note about "* " prefix in CSV stats
- CLEANUP: memory: Remove unused function pool_destroy
- MINOR: listeners: Change listener_full and limit_listener into private functions
- MINOR: listeners: Change enable_listener and disable_listener into private functions
- MINOR: fd: Don't forget to reset fdtab[fd].update when a fd is added/removed
- MINOR: fd: Set owner and iocb field before inserting a new fd in the fdtab
- MINOR: backends: Make get_server_* functions explicitly static
- MINOR: applet: Check applets_active_queue before processing applets queue
- MINOR: chunks: Use dedicated function to init/deinit trash buffers
- MEDIUM: chunks: Realloc trash buffers only after the config is parsed and checked
- MINOR: logs: Use dedicated function to init/deinit log buffers
- MINOR: logs: Realloc log buffers only after the config is parsed and checked
- MINOR: buffers: Move swap_buffer into buffer.c and add deinit_buffer function
- MINOR: stick-tables: Make static_table_key a struct variable instead of a pointer
- MINOR: http: Use a trash chunk to store decoded string of the HTTP auth header
- MINOR: fd: Add fd_active function
- MINOR: fd: Use inlined functions to check fd state in fd_*_send/recv functions
- MINOR: fd: Move (de)allocation of fdtab and fdinfo in (de)init_pollers
- MINOR: freq_ctr: Return the new value after an update
- MEDIUM: check: server states and weight propagation re-work
- BUG/MEDIUM: epoll: ensure we always consider HUP and ERR
- MINOR: fd: Add fd_update_events function
- MINOR: polling: Use fd_update_events to update events seen for a fd
- BUG/MINOR: server: Remove FQDN requirement for using init-addr and state file
- Revert "BUG/MINOR: server: Remove FQDN requirement for using init-addr and state file"
- MINOR: ssl: rework smp_fetch_ssl_fc_cl_str without internal ssl use
- BUG/MEDIUM: http: Close streams for connections closed before a redirect
- BUG/MINOR: Lua: The socket may be destroyed when we try to access.
- MINOR: xref: Add a new xref system
- MEDIUM: xref/lua: Use xref for referencing cosocket relation between stream and lua
- MINOR: tasks: Move Lua notification from Lua to tasks
- MINOR: net_helper: Inline functions meant to be inlined.
- MINOR: cli: add socket commands and config to prepend informational messages with severity
- MINOR: add severity information to cli feedback messages
- BUILD: Makefile: add a function to detect support by the compiler of certain options
- BUILD: Makefile: shut certain gcc/clang stupid warnings
- BUILD: Makefile: improve detection of support for compiler warnings
- MINOR: peers: don't reference the incoming listener on outgoing connections
- MINOR: frontend: don't retrieve ALPN on the critical path
- MINOR: protocols: always pass a "port" argument to the listener creation
- MINOR: protocols: register the ->add function and stop calling them directly
- MINOR: unix: remove the now unused proto_uxst.h file
- MINOR: listeners: new function create_listeners
- MINOR: listeners: make listeners count consistent with reality
- MEDIUM: session: take care of incrementing/decrementing jobs
- MINOR: listener: new function listener_release
- MINOR: session: small cleanup of conn_complete_session()
- MEDIUM: session: factor out duplicated code for conn_complete_session
- MEDIUM: session: count the frontend's connections at a single place
- BUG/MEDIUM: compression: Fix check on txn in smp_fetch_res_comp_algo
- BUG/MINOR: compression: Check response headers before http-response rules eval
- BUG/MINOR: spoe: Don't rely on SPOE ctx in debug message when its creation failed
- BUG/MINOR: dns: Fix check on nameserver in snr_resolution_cb
- MINOR: ssl: Remove useless checks on bind_conf or bind_conf->is_ssl
- BUG/MINOR: contrib/mod_defender: close the va_list argp before return
- BUG/MINOR: contrib/modsecurity: close the va_list ap before return
- MINOR: tools: make my_htonll() more efficient on x86_64
- MINOR: buffer: add b_del() to delete a number of characters
- MINOR: buffer: add b_end() and b_to_end()
- MINOR: net_helper: add functions to read from vectors
- MINOR: net_helper: add write functions
- MINOR: net_helper: add 64-bit read/write functions
- MINOR: connection: adjust CO_FL_NOTIFY_DATA after removal of flags
- MINOR: ist: add a macro to ease const array initialization
- BUG/MEDIUM: server: unwanted behavior leaving maintenance mode on tracked stopping server
- BUG/MEDIUM: server: unwanted behavior leaving maintenance mode on tracked stopping server (take2)
- BUG/MINOR: log: fixing small memory leak in error code path.
- BUG/MINOR: contrib/halog: fixing small memory leak
- BUG/MEDIUM: tcp/http: set-dst-port action broken
- CLEANUUP: checks: don't set conn->handle.fd to -1
- BUG/MEDIUM: tcp-check: properly indicate polling state before performing I/O
- BUG/MINOR: tcp-check: don't quit with pending data in the send buffer
- BUG/MEDIUM: tcp-check: don't call tcpcheck_main() from the I/O handlers!
- BUG/MINOR: unix: properly check for octal digits in the "mode" argument
- MINOR: checks: make chk_report_conn_err() take a check, not a connection
- CLEANUP: checks: remove misleading comments and statuses for external process
- CLEANUP: checks: don't report report the fork() error twice
- CLEANUP: checks: do not allocate a connection for process checks
- TESTS: checks: add a simple test config for external checks
- BUG/MINOR: tcp-check: don't initialize then break a connection starting with a comment
- TESTS: checks: add a simple test config for tcp-checks
- MINOR: tcp-check: make tcpcheck_main() take a check, not a connection
- MINOR: checks: don't create then kill a dummy connection before tcp-checks
- MEDIUM: checks: make tcpcheck_main() indicate if it recycled a connection
- MEDIUM: checks: do not allocate a permanent connection anymore
- BUG/MEDIUM: cli: fix "show fd" crash when dumping closed FDs
- BUG/MEDIUM: http: Return an error when url_dec sample converter failed
- BUG/MAJOR: stream-int: don't re-arm recv if send fails
- BUILD/MINOR: 51d: fix warning when building with 51Degrees release version 3.2.12.12
- DOC: 51d: add 51Degrees git URL that points to release version 3.2.12.12
- DOC: 51d: Updated git URL and instructions for getting Hash Trie data files.
- MINOR: compiler: restore the likely() wrapper for gcc 5.x
- MINOR: session: remove the list of streams from struct session
- DOC: fix some typos
- MINOR: server: add the srv_queue() sample fetch method
- MINOR: payload: add new sample fetch functions to process distcc protocol
- MAJOR: servers: propagate server status changes asynchronously.
- BUG/MEDIUM: ssl: fix OCSP expiry calculation
- BUG/MINOR: stream-int: don't set MSG_MORE on SHUTW_NOW without AUTO_CLOSE
- MINOR: server: Handle weight increase in consistent hash.
- MINOR: checks: Add a new keyword to specify a SNI when doing SSL checks.
- BUG/MINOR: tools: fix my_htonll() on x86_64
- BUG/MINOR: stats: Clear a bit more counters with in cli_parse_clear_counters().
- BUG/MAJOR: lua: scheduled task is freezing.
- MINOR: buffer: add bo_del() to delete a number of characters from output
- MINOR: buffer: add a function to match against string patterns
- MINOR: buffer: add two functions to inject data into buffers
- MINOR: buffer: add buffer_space_wraps()
- REORG: channel: finally rename the last bi_* / bo_* functions
- MINOR: buffer: add bo_getblk() and bo_getblk_nc()
- MINOR: channel: make use of bo_getblk{,_nc} for their channel equivalents
- MINOR: channel: make the channel be a const in all {ci,co}_get* functions
- MINOR: ist: add ist0() to add a trailing zero to a string.
- BUG/MEDIUM: log: check result details truncated.
- MINOR: buffer: make bo_getblk_nc() not return 2 for a full buffer
- REORG: http: move some very http1-specific parts to h1.{c,h}
- REORG: http: move the HTTP/1 chunk parser to h1.{c,h}
- REORG: http: move the HTTP/1 header block parser to h1.c
- MEDIUM: http: make the chunk size parser only depend on the buffer
- MEDIUM: http: make the chunk crlf parser only depend on the buffer
- MINOR: h1: add struct h1m for basic HTTP/1 messages
- MINOR: http: add very simple header management based on double strings
- MEDIUM: h1: reimplement the http/1 response parser for the gateway
- REORG: connection: rename CO_FL_DATA_* -> CO_FL_XPRT_*
- MEDIUM: connection: make conn_sock_shutw() aware of lingering
- MINOR: connection: ensure conn_ctrl_close() also resets the fd
- MINOR: connection: add conn_stop_tracking() to disable tracking
- MINOR: tcp: use conn_full_close() instead of conn_force_close()
- MINOR: unix: use conn_full_close() instead of conn_force_close()
- MINOR: checks: use conn_full_close() instead of conn_force_close()
- MINOR: session: use conn_full_close() instead of conn_force_close()
- MINOR: stream: use conn_full_close() instead of conn_force_close()
- MINOR: stream: use conn_full_close() instead of conn_force_close()
- MINOR: backend: use conn_full_close() instead of conn_force_close()
- MINOR: stream-int: use conn_full_close() instead of conn_force_close()
- MINOR: connection: remove conn_force_close()
- BUG/MINOR: ssl: ocsp response with 'revoked' status is correct
When using haproxy in front of distccd, it's possible to provide significant
improvements by only connecting when the preprocessing is completed, and by
selecting different farms depending on the payload size. This patch provides
two new sample fetch functions :
distcc_param(<token>[,<occ>]) : integer
distcc_body(<token>[,<occ>]) : binary
srv_queue([<backend>/]<server>) : integer
Returns an integer value corresponding to the number of connections currently
pending in the designated server's queue. If <backend> is omitted, then the
server is looked up in the current backend. It can sometimes be used together
with the "use-server" directive to force to use a known faster server when it
is not much loaded. See also the "srv_conn", "avg_queue" and "queue" sample
fetch methods.
Adds cli commands to change at runtime whether informational messages
are prepended with severity level or not, with support for numeric and
worded severity in line with syslog severity level.
Adds stats socket config keyword severity-output to set default behavior
per socket on startup.
smp_fetch_ssl_fc_cl_str as very limited usage (only work with openssl == 1.0.2
compiled with the option enable-ssl-trace). It use internal cipher.algorithm_ssl
attribut and SSL_CIPHER_standard_name (available with ssl-trace).
This patch implement this (debug) function in a standard way. It used common
SSL_CIPHER_get_name to display cipher name. It work with openssl >= 1.0.2
and boringssl.
The check_status field in the CSV stats output is conditionally prefixed
with "* " if a check is currently underway. This can trip tools that
parse the CSV output and compare against a well known list of values.
This commit just adds this bit to the documentation.
As per a recent mailing list discussion, suggesting specific cipher
settings is not too helpful, because they depend on a lot of factors,
ranging from client capabilities, available TLS libraries, new
security research, and others.
To avoid the documentation from become stale -- and potentially
wrong/dangerous, this commit adds links to Mozilla's well-reknowned
TLS blog, as well as to their configuration generator.
Following up DNS extension introduction, this patch aims at making the
computation of the maximum number of records in DNS response dynamic.
This computation is based on the announced payload size accepted by
HAProxy.
The "hold obsolete" timer is used to prevent HAProxy from moving a server to
an other IP or from considering the server as DOWN if the IP currently
affected to this server has not been seen for this period of time in DNS
responses.
That said, historically, HAProxy used to update servers as soon as the IP
has disappeared from the response. Current default timeout break this
historical behavior and may change HAProxy's behavior when people will
upgrade to 1.8.
This patch changes the default value to 0 to keep backward compatibility.
Edns extensions may be used to negotiate some settings between a DNS
client and a server.
For now we only use it to announce the maximum response payload size accpeted
by HAProxy.
This size can be set through a configuration parameter in the resolvers
section. If not set, it defaults to 512 bytes.
As DNS servers may not return all IPs in one answer, we want to cache the
previous entries. Those entries are removed when considered obsolete, which
happens when the IP hasn't been returned by the DNS server for a time
defined in the "hold obsolete" parameter of the resolver section. The default
is 30s.
This one dumps the fdtab for all active FDs with some quickly interpretable
characters to read the flags (like upper case=set, lower case=unset). It
can probably be improved to report fdupdt[] and/or fdinfo[] but at least it
provides a good start and allows to see how FDs are seen. When the fd owner
is a connection, its flags are also reported as it can help compare with the
polling status, and the target (fe/px/sv) as well. When it's a listener, the
listener's state is reported as well as the frontend it belongs to.
Commit 2ab8867 ("MINOR: ssl: compare server certificate names to the SNI
on outgoing connections") introduced the ability to check server cert
names against the name provided with in the SNI, but verifyhost was kept
as a way to force the name to check against. This was a mistake, because :
- if an SNI is used, any static hostname in verifyhost will be wrong ;
worse, if it matches and doesn't match the SNI, the server presented
the wrong certificate ;
- there's no way to have a default name to check against for health
checks anymore because the point above mandates the removal of the
verifyhost directive
This patch reverses the ordering of the check : whenever SNI is used, the
name provided always has precedence (ie the server must always present a
certificate that matches the requested name). And if no SNI is provided,
then verifyhost is used, and will be configured to match the server's
default certificate name. This will work both when SNI is not used and
for health checks.
If the commit 2ab8867 is backported in 1.7 and/or 1.6, this one must be
backported too.
