Hi,
HAProxy 3.4-dev10 was released on 2026/04/29. It added 162 new commits
after version 3.4-dev9.
Small fixes and cleanups have really started, it's pleasant. We have 72
bug fixes (most minor), 21 cleanups, 5 doc updates. There were also some
important bugs that were fixed:
- the task expiration got corrupted in 3.4-dev8 on 32-bit machines, and
was the main cause for some regtests failing there. It was fixed.
- an old super-rare race where task_schedule() being called on a task
could cause a crash was fixed and the fix backported, but it turned out
that it can cause a deadlock with the lock held by idle connections
tasks, that it's difficult to reproduce but sadly it happens much
more often than the one it was fixing. A new fix was emitted which
better addresses the issue, and which will have to be backported since
the one above was backported as well. It's what caused a few watchdog
reports a few days ago.
- end of stream on H2 HEADERS frames wouldn't trigger the length check
against content-length (only DATA did), which could, when combined
with "http-reuse never" and a server responding early, be used to
form a smuggled request that would escape filtering rules. This was
already backported.
- the H1 mux on 32-bit machines would only advertise the 32 lower bits
of the chunk size, which could be used to form request or response
smuggling. It's not as if 32-bit machines were still omnipresent but
they do still exist, so this will have to be backported.
- the presence of commas in Host header and authority was permitted
and would be used to compare the values, which then would differ
when read via hdr(host) which splits them on commas, and under
certain circumstances, trigger crashes (at least it did in the
OSS-Fuzz environment when injecting the values directly at the HTX
layer). Even though the spec permits commas in authorities (not in
domain names), there is currently no use case for this and it causes
an ambiguity with the historical use of hdr(host), so we preferred
to just deny them. This will be backported as far as 2.8 soon.
- the ip.fp() converter that establishes a SYN fingerprint from a sample
had a nasty case of possible infinite loop, which normally doesn't
exist with a real TCP SYN packet, but we never know how fingerprints
are fed to it.
Aside these, there were some build fixes, a good bunch of CI updates, and
some small general updates, among which:
- cli: dynamic large payloads are now supported, up to 128kB by default,
can be changed using tune.cli.max-payload-size. This can be useful for
those dealing with large maps or certificates. The payload delimiter
can also be enlarged up to 64 chars (e.g. sha256sum of a random).
- lb algos: internal cleanups: this is one of the oldest parts of the
code, and with algos being added once every 3-4 years on average, it's
never the good opportunity for implementing a clean registration instead
of copy-pasting function pointer assignment. The planned cleanup has
started with LB algo descriptors, which may even open the way for more
modular things in 3.5 if opportunities arise (e.g. experiments with
Peak EWMA etc).
- connections: owners are now better defined, and this will avoid the
recently introduced issue of idle h2 backend connections that would
be closed after the last stream finished.
- the default max-threads-per-group was finally set to 16 after lots of
experimentation, confirming good guesses from months ago, showing that
compared to the previous 64, it can significantly lower contention in
the system at the file descriptor layer (performance are doubled on a
64-core machine), and it happens to match what's already applied by
default on multi-CCX systems like EPYC processors.
- the opentracing filter now emits a deprecation warning, as indicated in
the wiki. We'll backport it to 3.3 as a notice message, since it was
forgotten at release time despite being documented as such (wiki and
internal doc).
- ACME now supports IP SAN in certificate requests, which should allow
to use certificates when connecting with a pure IP address. ACME
profiles were also implemented, allowing the CA to select the best
issuance policy (classic, shortlived etc).
- QUIC now implements termination events ("term_events") which are way
more detailed than the usual 2-character termination codes. Various
other minor cleanups were done in the area.
- various opentelemetry fixes and cleanups
- a new converter "fe_exists()" tests for the existence of a frontend
whose name is in the input sample.
That's about all for now. We still have plenty of small fixes and cleanups
to apply (typically a number of identified places where the classical leak
can happen on out-of-memory), which are totally harmless but ought to be
fixed so that we don't rediscover them later.
We're now about 4 weeks from the release, and time flies very fast in
May, so let's stay focused on testing, bug reporting and cleanups. As
usual in order to help with testing, we'll finish the period with one
release every week.
Due to the regression in stable releases, just do not update right now
to the recently released stable versions for branches 2.8 and above,
we're finishing the needed backports and we should have a new set of
releases by tomorrow. Many thanks to those who reported the regression
as soon as they noticed it!
Please find the usual URLs below :
Site index : https://www.haproxy.org/
Documentation : https://docs.haproxy.org/
Wiki : https://github.com/haproxy/wiki/wiki
Discourse : https://discourse.haproxy.org/
Slack channel : https://slack.haproxy.org/
Issue tracker : https://github.com/haproxy/haproxy/issues
Q&A from devs : https://github.com/orgs/haproxy/discussions
Sources : https://www.haproxy.org/download/3.4/src/
Git repository : https://git.haproxy.org/git/haproxy.git/
Git Web browsing : https://git.haproxy.org/?p=haproxy.git
Changelog : https://www.haproxy.org/download/3.4/src/CHANGELOG
Dataplane API :
https://github.com/haproxytech/dataplaneapi/releases/latest
Pending bugs : https://www.haproxy.org/l/pending-bugs
Reviewed bugs : https://www.haproxy.org/l/reviewed-bugs
Code reports : https://www.haproxy.org/l/code-reports
Latest builds : https://www.haproxy.org/l/dev-packages
Willy
---
Complete changelog :
Amaury Denoyelle (28):
BUG/MINOR: mux_quic: limit avail_streams() to 2^62
MINOR: h3: simplify GOAWAY local emission
MEDIUM: h3: prevent new streams on GOAWAY reception
MINOR: mux-quic: release BE idle conn after GOAWAY reception
BUG/MINOR: xprt_qstrm: read record length in 64bits
BUG/MINOR: mux_quic: convert QCC rx.rlen to 64bits
BUG/MINOR: xprt_qstrm: reduce max record length check
BUG/MINOR: mux_quic: prevent crash on qc_frm_free() with QMux
BUG/MINOR: xprt_qstrm: ensure all local TPs are allocated
BUG/MINOR: xprt_qstrm: prevent crash if conn release on MUX wake
BUG/MINOR: mux_quic: do not release conn on qcc_recv() for QMux
MINOR: xprt_qstrm: remove unused subs
MINOR: connection: document conn_create_mux()
MINOR: xprt_qstrm: implement close callback
MINOR: mux_quic: refactor QMux send frames function
MINOR: mux_quic: use dynamic Tx streams buffers for QMux
MINOR: mux_quic: use dynamic conn buffers for QMux
MINOR: mux_quic/xprt_qstrm: simplify Rx buffer transfer
MINOR: mux_quic: receive MAX_STREAMS_BIDI frames in QMux
MINOR: mux_quic: handle conn errors on QMux without crash
MINOR: mux_quic: handle incomplete QMux record read
BUG/MEDIUM: stats: fix crash on 'dump stats-file'
MINOR: mux_quic: return conn error code in debug string
MINOR: mux_quic: display QCS sd on traces
MINOR: mux_quic/h3: report termination events at connection level
MINOR: mux_quic/h3: report termination events at stream layer
MINOR: mux_quic: remove superfluous b_size() before b_alloc()
BUG/MINOR: mux_quic: free frames emitted with QMux
Aurelien DARRAGON (2):
BUG/MINOR: task: fix uninitialised read in run_tasks_from_lists()
MINOR: compression: prefix compression oriented functions with "comp_"
BiancaDogareci (1):
BUG/MINOR: ssl: fix memory leak on realloc failure in acme.ips
Christopher Faulet (40):
MINOR: cli: Handle the paylod pattern as a pointer in the cmdline buffer
MEDIUM: cli: Make a buffer for the command payload
MEDIUM: cli: Add support for dynamically allocated payloads
MEDIUM: cli: increase the payload pattern up to 64 bytes
MINOR: stream: Move the HTTP txn in an union
MINOR: stream: Add flags to identify the stream tansaction when allocated
MINOR: stream: Use a pcli transaction to replace pcli_* members
CLEANUP: applet: Remove useless shadow pointer from appctx
BUG/MINOR: mux-h1: Fix condition to send null-chunk for bodyless message
BUG/MINOR: mux-h1: Fix test to skip trailers from chunked messages
BUG/MINOR: http-act: fix a typo in a "del-heeaders-bin" error message
CLEANUP: tcpcheck: Fix some typos in comments
MINOR: tcpcheck: Rely on free_tcpcheck_ruleset() to deinit tcpchecks
BUG/MINOR: tcpcheck: Don't release ruleset when parsing 'spop-check'
ruleset
BUG/MINOR: tcpcheck: Fix a leak on deinit by releasing ruleset's conf.file
CLEANUP: haterm: Fix typos in comments
CLEANUP: config: Fix warning about invalid small buffer size
CLEANUP: htx: Fix typos in comments
CLEANUP: chunk: Fix a typo in a comment
CLEANUP: http-client: Fix typos in comments
BUG/MEDIUM: tcpcheck: Release temporary small chunk when retrying on
http-check
CLEANUP: proxy: Fix typos in comments
DOC: config: Fix a typo for "external-check" directive
CLEANUP: cli: Fix typos in comments
BUG/MINOR: stream: Add SF_TXN_HTTP/SF_TXN_PCLI flags in strm_show_flags()
REGTESTS: Never reuse server connection in jwt/jws_verify.vtc
REGTESTS: Never reuse server connection in
server/cli_delete_dynamic_server.vtc
BUG/MEDIUM: mux-h1: Force close mode for bodyless message announcing a C-L
DOC: config: Fix log-format example with last rule expressions
DOC: config: Fix typo in tune.bufsize.large description
BUG/MAJOR: http-htx: Store new host in a chunk for scheme-based
normalization
BUG/MEDIUM: http-htx: Don't use data from HTX message to update authority
BUG/MEDIUM: http-htx: Loop on full host value during scheme based
normalization
MEDIUM: http-htx: Make authority update optional when replacing a header
value
MEDIUM: http-htx: Make authority update optional when adding a header
BUG/MAJOR: http: forbid comma character in authority value
BUG/MEDIUM: h1: Enforce the authority validation during H1 request parsing
BUG/MAJOR: mux-h1: Deal with true 64-bits integer to emit chunks size
BUG/MEDIUM: mux-fcgi: Properly handle full buffer for FCGI_PARAM record
BUG/MINOR: http-htx: Don't normalize emtpy path for OPTIONS requests
Daniel Lenar (1):
BUG/MINOR: tcpcheck: Allow connection reuse without prior traffic
Emeric Brun (1):
BUG/MAJOR: net_helper: ip.fp infinite loop on malformed tcp options
Ilia Shipitsin (6):
CI: github: do not install pcre-devel on Fedora Rawhide build
reg-tests/ssl/ssl_dh.vtc: fix syntax error
ci: modernize actions/upload-artifact@v4
BUG/MINOR: reg-tests: make shell syntax errors fatal
BUG/MINOR: ssl: fix memory leaks on realloc failure in ssl_ckch.c
BUG/MINOR: ssl: fix memory leaks on realloc failure in ssl_sock.c
Maxime Henrion (3):
MINOR: lb: infrastructure for declarative initialization
MEDIUM: lb: use the LB ops tables
MINOR: lb: cleanups
Miroslav Zagorac (7):
MINOR: otel: added debug thread ID support for the OTel C wrapper library
MINOR: otel: test: added option parsing to the speed test script
MINOR: otel: test: replaced argument variables with positional parameters
in run scripts
CLEANUP: otel: removed insecure-fork-wanted requirement
MINOR: otel: test: unified run scripts into a single symlinked script
MEDIUM: ot: emitted deprecation warning at filter init
BUILD: ot: emitted deprecation warning at build time
Olivier Houchard (6):
BUG/MEDIUM: checks: Don't forget to set the "alt_proto" field
BUG/MEDIUM: tasks: Make sure we don't schedule a task already running
BUG/MINOR: h2: make tune.h2.log-errors actually work
BUG/MINOR: h2: Don't look at the exclusive bit for PRIORITY frame
BUG/MINOR: H2: Don't forget to free shared_rx_bufs on failure
BUG/MEDIUM: tasks: Do not loop in task_schedule() if a task is running
Pierre Cheynier (1):
MINOR: sample: converter for frontend existence check
Tim Duesterhus (4):
CI: Build halog as part of contrib.yml
CLEANUP: Reapply ist.cocci (4)
CLEANUP: Reapply strcmp.cocci (3)
CLEANUP: Reapply ha_free.cocci (2)
William Lallemand (14):
CI: github: merge Test and Test-musl in VTest.yml
CI: github: revert quictls version on cross-zoo.yml
CI: github: use quictls-3.1.7 for cross-zoo.yml
BUILD: ssl/sample: potential null pointer dereference in sample_conv_aes
CI: github: add an i686 job in cross-zoo.yml
CI: github: run cross-zoo.yml weekly
CI: github: add cross-zoo.yml in README.md
CI: github: fix sysctl in fedora-rawhide
CI: github: switch to USE_PCRE2 in Fedora Rawhide build
MINOR: acme: implement draft-ietf-acme-profiles
MINOR: acme: allow IP SAN in certificate request
CI: github: add an i686 job to the push job
REGTESTS: ssl: mark ssl_dh.vtc as broken
BUILD: 51d: fix bool definition on dummy lib v4
Willy Tarreau (48):
DOC: config: fix spelling of "max-threads-per-group" in the index
MEDIUM: threads: change the default max-threads-per-group value to 16
BUG/MEDIUM: mux-h2: ignore conn->owner when deciding if a connection is
dead
BUILD: haterm: don't pass size_t to %lu in error messages
BUG/MINOR: log: consider format expression dependencies to decide when to
log
MINOR: sample: make RQ/RS stats available everywhere
BUG/MINOR: sample: adjust dependencies for channel output bytes counters
MEDIUM: muxes: always set conn->owner to the session that owns the
connection
MEDIUM: session: always reset the conn->owner on backend when installing
mux
CLEANUP: mux-h1: avoid using conn->owner in uncertain areas
CLEANUP: mux-h1: remove the unneeded test on conn->owner in
h1s_finish_detach()
BUG/MAJOR: sched: protect task->expire on 32-bit platforms
BUILD: config: also set DEF_MAX_THREADS_PER_GROUP when not using threads
BUG/MINOR: mux-h2: count a protocol error when failing to parse a trailer
BUG/MINOR: mux-h2: count a proto error when rejecting a stream on parsing
error
BUG/MINOR: log: also wait for the response when logging response headers
BUG/MINOR: compression: properly disable request when setting response
BUG/MINOR: servers: fix last_sess date calculation
DOC: config: fix typo introduce in max-threads-per-group documentation
BUG/MINOR: stream: add the newly added SF_TXN_* flags to strm_show_flags()
BUG/MINOR: debug: properly mark the entire libs archive read-only
Revert "BUG/MINOR: stream: add the newly added SF_TXN_* flags to
strm_show_flags()"
BUG/MINOR: server: fix a possible leak of an error message in dynamic
servers
BUG/MAJOR: mux-h2: detect incomplete transfers on HEADERS frames as well
BUG/MINOR: ssl: fix double-free on failed realloc in ssl_sock.c
BUG/MINOR: tree-wide: fix a few user-visible spelling mistakes from dev7
CLEANUP: tree-wide: address various spelling mistakes in comments from
-dev7
BUG/MINOR: tools: my_memspn/my_memcspn wrong cast causing incorrect byte
reading
BUG/MINOR: tools: fix memory leak in indent_msg() on out of memory
BUG/MINOR: tools: free previously allocated strings on strdup failure in
backup_env()
BUG/MINOR: sample: fix memory leak in check_when_cond() when ACL is not
found
BUG/MINOR: sample: fix memory leak in smp_resolve_args error paths
BUG/MINOR: sample: fix NULL strm dereference in sample_conv_when
BUG/MINOR: peers: fix logical "and" when checking for local in
PEER_APP_ST_STARTING
BUG/MINOR: peers: fix wrong flag reported twice for dump_flags
CLEANUP: peers: fix a few user-visible spelling mistakes
CLEANUP: tools: drop upper case check after tolower()
CLEANUP: mux-h2: remove duplicate forward declaration of
h2s_rxbuf_{head,tail}()
CLEANUP: tree-wide: fix around 20 mistakes in comments in h2,tools,peers
BUG/MEDIUM: mux_h1: fix stack buffer overflow in h1_append_chunk_size()
BUG/MINOR: http_ana: use scf to report term_evts in
http_wait_for_request()
BUG/MINOR: fix various typos and spelling mistakes in user-visible
messages
CLEANUP: tree-wide: fix comment typos all over the tree (~68)
BUG/MINOR: payload: validate minimum keyshare_len in
smp_fetch_ssl_keyshare_groups
BUG/MINOR: payload: prevent integer overflow in distcc token parsing
BUG/MINOR: net_helper: fix out-of-bounds read in tcp_fullhdr_find_opt
BUG/MINOR: net_helper: fix out-of-bounds read in
sample_conv_tcp_options_list
BUG/MINOR: net_helper: fix incomplete decoding in sample_conv_eth_vlan
---
