HAProxy 2.0.6 was released on 2019/09/13. It added 36 new commits 
after version 2.0.5.

A major issue was fixed in the SSL part. When a SSL socket was created, its
context was not fully initialized. Because this context is allocated from a
memory pool, it was possible to inherit some information from a previous
session. Thus, some fetches, related to client's certificate presence or its
verify status and errors, was returning erroneous values. So SSL connections
without client certificate were able to be accepted by HAProxy from the time a
previous one was already accepted with a valid client certificate. This issue
was reported on GitHub (#248).

An AB/BA locking issue was fixed about the listeners. The functions
protocol_enable_all() and delete_listener() were using the same locks in a
reverse order. The former being used during startup and the latter during stop,
it was possible to have a deadlock during reload floods. Note though, it is
pretty hard to hit this issue in 2.0 and above.

Nathan Davison (@ndavison) reported that in legacy mode we didn't correctly
rejected messages featuring a transfer-encoding header missing the "chunked"
value. The impact was limited, but if combined with "http-reuse always", it
could be used as an help to construct a content smuggling attack against a
vulnerable component employing a lenient parser which would ignore the
content-length header as soon as it sees a transfer-encoding one, without even
parsing it.

An improvement was made on the idle connections management. Now, we don't keep
more idle connections than we've ever had outstanding requests on a server. This
way the total number of idle connections will never exceed the sum of maximum
connections. Thus highly loaded servers will be able to get many connections and
slightly loaded servers will keep less. This address performance issues with the
option "http-reuse safe" (the default) because of too many idle connections kept
opened and never reused.

An old bug on legacy HTTP analyzers was fixed. When HAProxy was waiting for a 
request or a response, the parsing was delayed if the buffer appeared as not
rewritable (reserve not fully free), without any other criteria. It might 
the message analysis for a while, sometime infinitely depending on
circumstances. For instance, It was happening when the cache applet used the
reserve to added the header "Age" on cached responses. This test was based an 
implicit assumption that stated if a buffer was not rewritable, it meant some
outgoing data were pending to be sent. On recent versions, this is not true
anymore because all outgoing data are sent before starting the analysis of the
next transaction.

Several bugs was fixed into the H1 multiplexer. The trailers of chunked messages
were sometimes truncated on buffer boundary because the parser systematically
reported an error when the buffer was full during trailers parsing. Now, an
error is only reported if the buffer is full because trailers are too huge. In
the same spirit, errors might be reported on transfers ending if the buffer was
full because no more space left to add the EOM block. SD termination state was
erroneously reported in HAProxy logs for successful transfers.

Two bugs was fixed on the cache. Both concerned the way messages with a huge
header part were handled by the cache. First, messages with an header part
impinging upon the buffer's reserved were stored in the cache. Now these
messages are not cached anymore. The reserve must remain available to handle
the response processing when a cached object is served, just like any other
response. Then, in the cache, messages with an header part stored on several
shctx blocks (> 1024 bytes) were not correctly served.

Finally, the usual bunch of bug fixes here and there. Some improvements were
made on checks to adapt them to recent changes on the connections layer. The
sample fetch url32 was fixed to really take the path part into account. A memory
leak during configuration parsing was fixed, when an ACL expression was
parsed. Response flags are now correctly reset when 1xx messages are handled so
it is possible to compress HTTP responses preceded by a 100-Continue. The server
weights are now ignored for empty servers to not always pick the same server on
low load (thanks to @malsumis and @jaroslawr for this fix). And so on.

It is also noticeable that Luca Schimweg added the sample fetch uuid() to get an
UUID following the format of version 4 in the RFC4122 standard. The
DRAIN/MAINT/NOLB status are now reported for servers by the Prometheus 
exporter. And
the number of idle connections for each server is now reported on the stats page
likewise the configuration limit.

All users of the 2.0 are encouraged to upgrade, especially those using
authentication with SSL client certificate.

Please find the usual URLs below :
   Site index       : http://www.haproxy.org/
   Discourse        : http://discourse.haproxy.org/
   Slack channel    : https://slack.haproxy.org/
   Issue tracker    : https://github.com/haproxy/haproxy/issues
   Sources          : http://www.haproxy.org/download/2.0/src/
   Git repository   : http://git.haproxy.org/git/haproxy-2.0.git/
   Git Web browsing : http://git.haproxy.org/?p=haproxy-2.0.git
   Changelog        : http://www.haproxy.org/download/2.0/src/CHANGELOG
   Cyril's HTML doc : http://cbonte.github.io/haproxy-dconv/

Complete changelog :
Adis Nezirovic (1):
      BUG/MINOR: Missing stat_field_names (since f21d17bb)

Christopher Faulet (14):
      BUG/MEDIUM: proto-http: Always start the parsing if there is no outgoing 
      BUG/MINOR: http-ana: Reset response flags when 1xx messages are handled
      BUG/MINOR: h1: Properly reset h1m when parsing is restarted
      BUG/MINOR: mux-h1: Fix size evaluation of HTX messages after headers 
      BUG/MINOR: mux-h1: Don't stop anymore input processing when the max is 
      BUG/MINOR: mux-h1: Be sure to update the count before adding EOM after 
      BUG/MEDIUM: cache: Properly copy headers splitted on several shctx blocks
      BUG/MEDIUM: cache: Don't cache objects if the size of headers is too big
      MINOR: contrib/prometheus-exporter: Report DRAIN/MAINT/NOLB status for 
      BUG/MINOR: listener: Fix a possible null pointer dereference
      BUG/MINOR: ssl: always check for ssl connection before getting its XPRT 
      BUG/MINOR: filters: Properly set the HTTP status code on analysis error
      BUG/MINOR: acl: Fix memory leaks when an ACL expression is parsed
      BUG/MINOR: backend: Fix a possible null pointer dereference

Emeric Brun (1):
      BUG/MAJOR: ssl: ssl_sock was not fully initialized.

Frédéric Lécaille (1):
      BUG/MEDIUM: peers: local peer socket not bound.

Jerome Magnin (1):
      BUG/MEDIUM: url32 does not take the path part into account in the 
returned hash.

Luca Schimweg (1):
      MINOR: sample: Add UUID-fetch

Willy Tarreau (16):
      MINOR: debug: indicate the applet name when the task is task_run_applet()
      MINOR: tools: add append_prefixed_str()
      MINOR: lua: export applet and task handlers
      MEDIUM: debug: make the thread dump code show Lua backtraces
      BUG/MEDIUM: mux-h1: do not truncate trailing 0CRLF on buffer boundary
      BUG/MEDIUM: mux-h1: do not report errors on transfers ending on buffer 
      BUG/MINOR: mworker: disable SIGPROF on re-exec
      BUG/MEDIUM: listener/threads: fix an AB/BA locking issue in 
      BUG/MINOR: checks: stop polling for write when we have nothing left to 
      BUG/MINOR: checks: start sending the request right after connect()
      BUG/MINOR: checks: make __event_chk_srv_r() report success before closing
      BUG/MINOR: checks: do not uselessly poll for reads before the connection 
is up
      BUG/MINOR: lb/leastconn: ignore the server weights for empty servers
      BUG/MEDIUM: connection: don't keep more idle connections than ever needed
      MINOR: stats: report the number of idle connections for each server
      BUG/MEDIUM: http: also reject messages where "chunked" is missing from 

n...@users.noreply.github.com (1):
      DOC: fixed typo in management.txt

Christopher Faulet

Reply via email to