Hi,
HAProxy 2.4.1 was released on 2021/06/17. It added 73 new commits
after version 2.4.0.
Overall, we've had a few very minor regressions in 2.4 for now. One of
them is the closure without error response when http-ignore-probes is
set and a bad request is received, and the few other ones were about a
few extra fields having disappeared from the H2 traces. The rest is just
regular bug fixes, though some of these are quite annoying and have been
present for a while:
- the "set maxconn server" command on the CLI could deadlock with
requests in the queue (the same locks can be taken a second time).
This has been the case since 1.8 and will have to be backported there.
- the old bug that got reported 2-3 times since 2.2 about loops in
process_stream() was finally caught. Under some circumstances a
connection could get receive hte error flag after it was being queued
and this theoretically impossible situation wasn't handled.
- there was a thin but possible race between free() and pool_alloc() in
the lockless variant since its introduction in 1.9. It was so thin and
so hard to trigger that I'm not sure anyone ever reported it. The fix
wasn't trivial but it allowed to remove a specificity of this code and
to make the lockless one not architecture-specific anymore. 2.5 has
already merged the implementations, and the conditions to use it could
be relaxed in a future 2.4.
- an HTX defragmentation bug recently appeared with HTTP compression,
in the rare case where compression inflates the buffer. This bug has
been there since 2.0 and we've got 2 or 3 similar reports in a week,
which is a bit surprising.
- an old bug affecting the dequeuing code was fixed. It has always been
there but got recently amplified in 2.3. The bug was that a flag was
not set on a request being picked out of the queue, so the request
had to pass again through load balancing after a server had picked it.
That used to only be a waste of CPU cycles, until a small optimization
in 2.3 resulted in avoiding to LB when there were already requests in
queue. This resulted in such requests remaining in the queue until
their timeout (or a restart).
- the SHCTX code that is used for the cache and the SSL sessions was
improperly locked when USE_PRIVATE_CACHE was enabled. It's extremely
rarely used, but if used it could crash.
In addition to these important fixes, a number of users have witnessed
watchdog panics when dealing with large DNS responses. The problem was
related to algorithmic complexity in the response processing and when
matching against certain server settings. A few more cross-references
were added here and there to address this issue and reduce the complexity
from O(n^3) to O(n) if I understood right.
The HTTP compression was having issues at the end of a response that could
occasionally be truncated or corrupted.
The Opentracing initialization would previously fail in a chroot, the
initialization sequence was slightly changed to address this. Note that
users will need to also update their Opentracing C wrapper to version
1.1.0, as the thread initialization was split between the two.
There were some fixes and cleanups for the dynamic servers (those added
and deleted at runtime from the CLI). A few settings were not properly
set, initialized, or tested.
And the rest is less visible but there are quite a few minor issues fixed,
I encourage you to have a look at the full change log at the end.
Please find the usual URLs below :
Site index : http://www.haproxy.org/
Discourse : http://discourse.haproxy.org/
Slack channel : https://slack.haproxy.org/
Issue tracker : https://github.com/haproxy/haproxy/issues
Wiki : https://github.com/haproxy/wiki/wiki
Sources : http://www.haproxy.org/download/2.4/src/
Git repository : http://git.haproxy.org/git/haproxy-2.4.git/
Git Web browsing : http://git.haproxy.org/?p=haproxy-2.4.git
Changelog : http://www.haproxy.org/download/2.4/src/CHANGELOG
Cyril's HTML doc : http://cbonte.github.io/haproxy-dconv/
Willy
---
Complete changelog :
Alex (1):
DOC: use the req.ssl_sni in examples
Alexandar Lazic (1):
DOC/MINOR: move uuid in the configuration to the right alphabetical order
Amaury Denoyelle (9):
BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
MINOR: errors: allow empty va_args for diag variadic macro
BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server'
BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees
BUG/MEDIUM: server: do not forget to generate the dynamic servers ids
BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree
BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node
BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers
Christopher Faulet (16):
BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers"
BUG/MINOR: http-ana: Send the right error if max retries is reached on L7
retry
BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A
aborts
MINOR: http-ana: Perform L7 retries because of status codes in response
analyser
CLEANUP: http-ana: Remove useless if statement about L7 retries
BUG/MINOR: vars: Be sure to have a session to get checks variables
BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next
block
BUG/MEDIUM: compression: Properly get the next block to iterate on payload
BUG/MEDIUM: compression: Add a flag to know the filter is still
processing data
BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
CLEANUP: l7-retries: do not test the buffer before calling b_alloc()
DOC: lua: Add a warning about buffers modification in HTTP
Emeric Brun (4):
BUG/MINOR: resolvers: answser item list was randomly purged or errors
MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
MEDIUM: resolvers: add a ref between servers and srv request or used SRV
record
BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
Mark Mullan (1):
DOC: intro: Fix typo in starter guide
Miroslav Zagorac (3):
BUILD/MINOR: opentracing: fixed build when using clang
Revert "BUG/MINOR: opentracing: initialization after establishing daemon
mode"
BUG/MEDIUM: opentracing: initialization before establishing daemon and/or
chroot mode
Remi Tricot-Le Breton (15):
BUG/MEDIUM: ebtree: Invalid read when looking for dup entry
BUG/MINOR: server: Missing calloc return value check in srv_parse_source
BUG/MINOR: peers: Missing calloc return value check in
peers_register_table
BUG/MINOR: ssl: Missing calloc return value check in
ssl_init_single_engine
BUG/MINOR: http: Missing calloc return value check in
parse_http_req_capture
BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
BUG/MINOR: http: Missing calloc return value check while parsing
tcp-request/tcp-response
BUG/MINOR: http: Missing calloc return value check while parsing
tcp-request rule
BUG/MINOR: compression: Missing calloc return value check in
comp_append_type/algo
BUG/MINOR: worker: Missing calloc return value check in
mworker_env_to_proc_list
BUG/MINOR: http: Missing calloc return value check while parsing redirect
rule
BUG/MINOR: http: Missing calloc return value check in make_arg_list
BUG/MINOR: proxy: Missing calloc return value check in
chash_init_server_tree
BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the
future
Tim Duesterhus (1):
MINOR: cfgparse: Fail when encountering extra arguments in macro
William Lallemand (1):
BUILD: make tune.ssl.keylog available again
Willy Tarreau (21):
BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location
MINOR: pools: do not maintain the lock during pool_flush()
MINOR: pools: call malloc_trim() under thread isolation
MEDIUM: pools: use a single pool_gc() function for locked and lockless
BUG/MAJOR: pools: fix possible race with free() in the lockless variant
CLEANUP: pools: remove now unused seq and pool_free_list
BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
BUG/MINOR: ssl: use atomic ops to update global shctx stats
BUG/MINOR: mworker: fix typo in chroot error message
CLEANUP: global: remove unused definition of stopping_task[]
BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue
MINOR: backend: only skip LB when there are actual connections
BUG/MINOR: mux-h1: do not skip the error response on bad requests
MINOR: connection: add helper conn_append_debug_info()
MINOR: mux-h2/trace: report a few connection-level info during h2_init()
CLEANUP: mux-h2/traces: better align user messages
BUG/MINOR: stats: make "show stat typed desc" work again
MINOR: mux-h2: obey http-ignore-probes during the preface
BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace
BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces
---
