Hi Willy, I had to rollback to 2.6.2 after having upgrade to 2.6.3 because systemd was restarting the haproxy process every 1m30s (on an up-to-date Debian 11) apt upgrade itself hung while doing the upgrade.
Regards, Ionel ----- Mail original ----- De: "Willy Tarreau" <[email protected]> À: "haproxy" <[email protected]> Envoyé: Vendredi 19 Août 2022 18:51:25 Objet: [*EXT*] [ANNOUNCE] haproxy-2.6.3 Hi, HAProxy 2.6.3 was released on 2022/08/19. It added 60 new commits after version 2.6.2. This release contains assorted fixes for issues discovered after the previous 2.6.2 release, and there are quite a few annoying ones so I preferred not to let them rot too long: - there was an issue with the log-forward section, where a missing initialization due to code duplication caused some settings from "bind" lines to be ignored (ssl, thread, a few such things). - the late cleanup of the CLI keyword processing in 2.6 caused some breakage when certain commands are chained using a semi-colon, due to a command context that was not reset between commands and could then be misused. For example "show version; show sess" could crash the process. - some ugly crashes saying "offset > buf->data" were reported when using the DNS (e.g. issue #1781) , and it was found that it was using uninitialized fields in a structure. A pool_zalloc() was used to paper over it, since it's not even impossible that others fields are affected and that this part requires a deep breath before being dived into. - there was a logic but in processing of option http-restrict-req-hdr-names that could cause deletion of a wrong header or a crash when facing multiple forbidden chars. This was reported in issue #1822, analysed and fixed by Mateusz Malek. - an old bug in the H2 mux may cause spurious stream resets when uploading and downloading at the same time from the same stream, due to the window update frames having to be delayed when the output is full, and sent later after the stream ID was reset. Those using POST to servers might have experienced such occasional issues and might want to check for any improvement there. This was reported in issue #1830 and diagnosed by David le Blanc. - during atomic map updates of entries based on prefix length ("_ip" and "_beg"), if a new finer entry was added and matched an input before being committed, it was naturally ignored, but the lookup would continue with next keys without rechecking the key, possibly returning an incorrect match. This was reported by Miroslav in issue #1802. - Tim reported in issue #1799 that upon reload, and old process that failed to synchronize its tables with the new one could loop for a while without any pause and waste a lot of CPU doing this. - the recently added assertion in fd_delete() already spotted a long existing bug on reload, where the FD that was used by the pipe of an exiting thread could be instantly reused as a socket by another thread and be incorrectly inserted in the table. Most of the time it remained unnoticed as these were mostly health checks on a reloading process, but since the assertion a few users started to see logs of a crash of the exiting process. This was reported both by Christian Ruppert in issue #1807 and by Cedric Paillet. - there was an undesired sharing of data between default-servers that could lead to double-frees concretized by crashes when checking the config. This was reported in issue #1804 by Fabiano Nunes. - when a server had numerous requests waiting in queue, it was possible for a thread to spend its time picking requests from this queue while all other threads were working at refilling it, and the time spent doing this was unbounded, which could 1) add high processing latencies, and 2) even trigger the watchdog if the thread worked too long. I could trigger the watchdog a few times on a 48-thread machine. I think it's the same issue that was reported 2 years ago by Jaroslaw Rzeszotko in issue #880. - the ring section's "size" parser was too lax and would take "1M" for "1" without even issuing a warning... Also error messages regarding incorrect values would copy the input string instead of the parsed value, providing no way to diagnose. - there was a problem with the ring forwarding that's not very clear to me (I have no idea about the impact, commit 96417f3 in master). - I managed to trigger an error on reload where the old process died saying "t->tid >= 0 && t->tid != tid". This is caused by the deinit code that needs to stop stuff initialized on other threads, and as such it violates some consistency checks. The check was relaxed to ignore the stopping condition. - reading from the rings could also occasionally freeze at high rate if the reader had to stop due to a buffer full while the writer had already stopped due to a ring full. - Tim reported in issue #1803 that sometimes a new process would fail to get the sockets from the old one on reload, due to a flag that was not correctly updated before switching to wait mode. - the function used to send FDs to the new process was using a wrong error code on failure, leading to the failure not being detected. - and a usual lot of QUIC fixes and updates, but more on that below. A few build issues were addressed (essentially warnings with older compilers). Two new converters were backported, table_expire() and table_idle() which look up a key in a table and respectively report how long is left before the entry expires and how long the entry was left untouched. They're trivial, harmless and we've faced they were missing quite a few times already in environments that want to emit a retry-after for example (issue #1535 opened 6 months ago already). Regarding QUIC, there are roughly 25 fixes in this version, and we have prepared the 80 missing ones to match the state of 2.7-dev that's getting good according to our kind testers (mainly Tristan). I didn't want to add them into this release, but they will be merged into 2.6.4 so that those who want to use it have something more reliable that doesn't risk to take their process down too fast. Thus if you're impatient about QUIC, better jump to 2.7-dev or wait for 2.6.4. Thanks to all participants, these were two quite busy weeks but it was worth it! Please find the usual URLs below : Site index : http://www.haproxy.org/ Documentation : http://docs.haproxy.org/ Wiki : https://github.com/haproxy/wiki/wiki Discourse : http://discourse.haproxy.org/ Slack channel : https://slack.haproxy.org/ Issue tracker : https://github.com/haproxy/haproxy/issues Sources : http://www.haproxy.org/download/2.6/src/ Git repository : http://git.haproxy.org/git/haproxy-2.6.git/ Git Web browsing : http://git.haproxy.org/?p=haproxy-2.6.git Changelog : http://www.haproxy.org/download/2.6/src/CHANGELOG Pending bugs : http://www.haproxy.org/l/pending-bugs Reviewed bugs : http://www.haproxy.org/l/reviewed-bugs Code reports : http://www.haproxy.org/l/code-reports Latest builds : http://www.haproxy.org/l/dev-packages Willy --- Complete changelog : Amaury Denoyelle (6): BUG/MEDIUM: mux-quic: fix missing EOI flag to prevent streams leaks BUG/MINOR: mux-quic: prevent crash if conn released during IO callback CLEANUP: mux-quic: remove useless app_ops is_active callback BUG/MINOR: mux-quic: do not free conn if attached streams MINOR: quic: explicitely ignore sendto error CLEANUP: mux-quic: remove loop on sending frames Christopher Faulet (11): Revert "BUG/MINOR: peers: set the proxy's name to the peers section name" MINOR: peers: Use a dedicated reconnect timeout when stopping the local peer BUG/MEDIUM: peers: limit reconnect attempts of the old process on reload BUG/MINOR: peers: Use right channel flag to consider the peer as connected BUG/MEDIUM: dns: Properly initialize new DNS session BUG/MINOR: backend: Don't increment conn_retries counter too early MINOR: server: Constify source server to copy its settings REORG: server: Export srv_settings_cpy() function BUG/MEDIUM: proxy: Perform a custom copy for default server settings MINOR: peers: Add a warning about incompatible SSL config for the local peer BUG/MEDIUM: sink: Set the sink ref for forwarders created during ring parsing Emeric Brun (2): BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized BUG/MAJOR: log-forward: Fix ssl layer not initialized on bind even if configured Frédéric Lécaille (17): MINOR: quic: Congestion control architecture refactoring MEDIUM: quic: Cubic congestion control algorithm implementation MINOR: quic: New "quic-cc-algo" bind keyword BUG/MINOR: quic: loss time limit variable computed but not used MINOR: quic: Stop looking for packet loss asap BUG/MAJOR: quic: Useless resource intensive loop qc_ackrng_pkts() MINOR: quic: Send packets as much as possible from qc_send_app_pkts() BUG/MINOR: quic: Missing in flight ack eliciting packet counter decrement BUG/MEDIUM: quic: Floating point exception in cubic_root() BUG/MINOR: quic: Avoid sending truncated datagrams BUG/MINOR: quic: Missing Initial packet dropping case BUG/MEDIUM: quic: Wrong packet length check in qc_do_rm_hp() MINOR: quic: Too much useless traces in qc_build_frms() BUG/MEDIUM: quic: Missing AEAD TAG check after removing header protection BUG/MINOR: quic: Possible infinite loop in quic_build_post_handshake_frames() BUG/MINOR: quic: memleak on wrong datagram receipt MINOR: stick-table: Add table_expire() and table_idle() new converters Ilya Shipitsin (1): CLEANUP: assorted typo fixes in the code and comments Mateusz Malek (1): BUG/MEDIUM: http-ana: fix crash or wrong header deletion by http-restrict-req-hdr-names William Lallemand (4): BUG/MINOR: sockpair: wrong return value for fd_send_uxst() DEBUG: fd: split the fd check MEDIUM: resolvers: continue startup if network is unavailable BUG/MINOR: mworker: PROC_O_LEAVING used but not updated Willy Tarreau (18): BUG/MEDIUM: queue/threads: limit the number of entries dequeued at once MINOR: ebtree: add ebmb_lookup_shorter() to pursue lookups BUG/MEDIUM: pattern: only visit equivalent nodes when skipping versions BUILD: http: silence an uninitialized warning affecting gcc-5 BUG/MINOR: ring/cli: fix a race condition between the writer and the reader BUG/MINOR: sink: fix a race condition between the writer and the reader BUG/MINOR: quic: do not reject datagrams matching minimum permitted size BUG/MEDIUM: quic: break out of the loop in quic_lstnr_dghdlr BUILD: cfgparse: always defined _GNU_SOURCE for sched.h and crypt.h BUG/MEDIUM: quic: always remove the connection from the accept list on close BUG/MEDIUM: poller: use fd_delete() to release the poller pipes BUG/MEDIUM: task: relax one thread consistency check in task_unlink_wq() BUILD: stconn: fix build warning at -O3 about possible null sc BUILD: debug: silence warning on gcc-5 BUG/MEDIUM: ring: fix too lax 'size' parser MINOR: applet: add a function to reset the svcctx of an applet BUG/MEDIUM: cli: always reset the service context between commands BUG/MEDIUM: mux-h2: do not fiddle with ->dsi to indicate demux is idle --- -- 232 avenue Napoleon BONAPARTE 92500 RUEIL MALMAISON Capital EUR 219 300,00 - RCS Nanterre B 408 832 301 - TVA FR 09 408 832 301
