Hi, HAProxy 2.2.33 was released on 2024/04/05. It added 20 new commits after version 2.2.32.
This maintenance version addresses a few issues discovered after previous release: - an API issue with OpenSSL. The SSL_do_handshake() function returns SSL_ERROR_WANT_READ when it needs more data, but in certain obscure circumstances related to internal error handling, it was found that it may stop trying to read available data and continue to return that status! This results in wakeup loops that prevent the process from sleeping, hence it consumes 100% of the CPU (but it's still working fine). The code does what the doc suggests (but the doc is basically a one-liner), and neither aws-lc nor wolfSSL exhibit this problem. - "option redispatch 0" is documented as disabling redispatch on server connection failure except that it caused it to redispatch at every retry. This was fixed. Note that "no option redispatch" would properly work though. - h1: Ben Kallus kindly reminded us that we would still accept the NUL byte in header values, while we were (wrongly) quite certain that these had long been rejected. Ben is currently not aware of situations where this could help convey an attack to any existing component, but given the surprises he certainly faces in his reviews, it's probably only a matter of time before one implementation shows to be too weak and we fail to properly protect it. So it was better to address both at once. In the extremely unlikely case that anyone would discover such an invalid byte on their network with an application that heavily relies on it, *option accept-invalid-http* will work as usual to bypass the check. We'll backport that to older versions as well, and I think it would be prudent for distros to take that as well. - spoe: in some cases, the expiration date could be reset, leading to a non-expirable stream. There could also be a wakeup loop when receiving too small a frame because it was ignored but not consumed instead of raising an error. Also, upon reload, applets that were waiting for a response would stick to idle mode and postpone the release of the old process. Now it's tested again, as well as on any subsequent attempt to use the idle connection. - idle conns: a private backend connections could crash in H2 if a new list head cannot be allocated during session_add_conn() because that would leave a NULL owner that is used later on. In practice it should only be reproducible under extremely low memory condition. - a rare deadlock was found on the pools code, it can be triggered at stopping time and crash the old process. It's been there since 2.5, and is difficult to trigger, but a user faced it and that's how we learned about it (GH issue #2427, thanks to user @JB0925). - the status of agent checks is returned as-is in the stats CSV output, resulting in mangling the CLI's output if it contains line feeds. It has been there since 2.0. - the previously backported aes_gcm_enc() converter could be subject to a small memory leak. - and other lower importance fixes at various places. - doc updates and the CI updates (support for cache API v4, thanks to Tim). And that's about all. ############################################################################################# Please find the usual URLs below : Site index : https://www.haproxy.org/ Documentation : https://docs.haproxy.org/ Wiki : https://github.com/haproxy/wiki/wiki Discourse : https://discourse.haproxy.org/ Slack channel : https://slack.haproxy.org/ Issue tracker : https://github.com/haproxy/haproxy/issues Sources : https://www.haproxy.org/download/2.2/src/ Git repository : https://git.haproxy.org/git/haproxy-2.2.git/ Git Web browsing : https://git.haproxy.org/?p=haproxy-2.2.git Changelog : https://www.haproxy.org/download/2.2/src/CHANGELOG Dataplane API : https://github.com/haproxytech/dataplaneapi/releases/latest Pending bugs : https://www.haproxy.org/l/pending-bugs Reviewed bugs : https://www.haproxy.org/l/reviewed-bugs Code reports : https://www.haproxy.org/l/code-reports Latest builds : https://www.haproxy.org/l/dev-packages --- Complete changelog : Amaury Denoyelle (1): BUG/MINOR: session: ensure conn owner is set after insert into session Aurelien DARRAGON (2): BUG/MINOR: cfgparse: report proper location for log-format-sd errors BUG/MINOR: server: 'source' interface ignored from 'default-server' directive Christopher Faulet (6): BUG/MEDIUM: mux-h2: Report too large HEADERS frame only when rxbuf is empty BUG/MEDIUM: stconn: Forward shutdown on write timeout only if it is forwardable BUG/MEDIUM: spoe: Never create new spoe applet if there is no server up BUG/MINOR: hlua: Fix log level to the right value when set via TXN:set_loglevel BUG/MEDIUM: spoe: Return an invalid frame on recv if size is too small BUG/MEDIUM: spoe: Don't rely on stream's expiration to detect processing timeout Dragan Dosen (1): BUG/MINOR: ssl: fix possible ctx memory leak in sample_conv_aes_gcm() Emeric Brun (1): BUG/MEDIUM: cli: some err/warn msg dumps add LR into CSV output on stat's CLI Olivier Houchard (1): BUG/MAJOR: ssl_sock: Always clear retry flags in read/write functions Tim Duesterhus (1): CI: Update to actions/cache@v4 William Lallemand (1): DOC: configuration: typo req.ssl_hello_type Willy Tarreau (6): BUG/MEDIUM: pool: fix rare risk of deadlock in pool_flush() BUG/MINOR: h1-htx: properly initialize the err_pos field BUG/MEDIUM: h1: always reject the NUL character in header values DOC: internal: update missing data types in peers-v2.0.txt BUG/MINOR: backend: properly handle redispatch 0 CLEANUP: pools: remove unused arguments to pool_evict_from_cache() -- Christopher Faulet
