From: Willy Tarreau Date: Wed, 4 Nov 2026 22:22:17 +0000 (+0100) Subject: [RELEASE] Released version 3.5-dev11 X-Git-Tag: v3.5-dev11^0 X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=ce79f339cc56e4e7c3885a39b2fdbac9fb77dabe;p=haproxy.git [RELEASE] Released version 3.5-dev11 Released version 3.5-dev11 with the following main changes : - BUILD: sym: Fix build on recent glibc - BUG/MINOR: checks/log: force implicit UDP checks as TCP for log backend - CLEANUP: sym: factor out the short object name extraction - MINOR: sym: use the symbol table to resolve a DSO name - BUG/MINOR: errors: reset diagnostic buffers after thread cleanup - BUG/MINOR: sample: fix NULL dereference in the ltime/utime converters - BUILD: Makefile: extend the capabilities of EXTRA_MAKE - MINOR: thread: add EXTRAS_LOCK so addons can name their locks - BUG/MINOR: debug: fix "debug dev fd" crash on unknown address families - BUILD: Makefile: allow external makefiles to provide build targets - BUG/MEDIUM: ssl: skip TLS 1.3 suites in the FIPS TLS 1.2 cipher check - REGTESTS: ssl: skip AWS-LC FIPS rejected crypto in ciphersuites/curves tests - CI: github: add AWS-LC FIPS testing workflow - BUILD: github: run FreeBSD CI on every branch - CI: github: cache VTest binary in FreeBSD workflow - BUG/MEDIUM: proxy: fix stick table expired entries cleanup on stopping - BUG/MINOR: http-ana: fix response compression for applets - DOC: configuration: Clarify wait-for-body doc for the response side - MINOR: http-act: Add 'no-fail' option on 'wait-for-body' action - BUG/MEDIUM: leastconn: reset the smallest key when backups take over - CLEANUP: quic: remove duplicated key phase pointer assignments - MINOR: quic: use the right trace event in quic_tls_key_update() - CLEANUP: quic: remove duplicated rx offset initialization in quic_cstream_new() - CLEANUP: quic: remove the unused tx part of struct quic_cstream - CLEANUP: quic: remove unused tx crypto size and offset counters - BUG/MINOR: quic: fix the header protection key length dump with AWS-LC - CLEANUP: quic: remove the unused key parameter from quic_tls_decrypt() - CLEANUP: quic: remove the unused count and flags from struct quic_tls_kp - CLEANUP: quic: remove the stale initial_salt declaration - CLEANUP: quic: remove duplicated quic_cstream_new() declaration - CLEANUP: quic: remove the unneeded quic_rx.h include from quic_tls.c - CLEANUP: quic: update the outdated comment of quic_tls_derive_keys() - BUG/MINOR: sample: realign the ungrpc converter on message boundaries - BUG/MEDIUM: compression: fix incompatibility between compression and large-buffers - CLEANUP: tools: make inetaddr_host_lim*() usable on untrusted inputs - BUG/MINOR: flt-http-comp: check the block returned by htx_replace_blk_value() - BUG/MINOR: compression: pass the configured level to slz - OPTIM: flt-http-comp: only flush the compressor after the last DATA block - IMPORT: slz: update slz to version 1.4-dev4 - MINOR: compression: pass the content type to the algorithms' init function - MINOR: flt-http-comp: size the compression reserve using SLZ_MAX_OVERHEAD() - REGTESTS: compression: check hard to compress contents and nearly full buffers - BUG/MEDIUM: mux-h1: don't drop pending output on a short content-length - BUG/MINOR: filters: Reject id-less implicit instances of multi-instance classes - BUG/MINOR: ssl/ckch: free the new instance when ckch_inst_rebuild() fails - BUG/MEDIUM: ssl/cli: reset the ongoing transaction when "commit ssl cert" is interrupted - BUG/MEDIUM: ssl/cli: don't unlock the certificate lock after a failed trylock - BUG/MINOR: httpclient/lua: fix stack overread when copying the headers - BUG/MINOR: httpclient/lua: raise an error on too many request headers - BUG/MINOR: resolvers: validate TXT RDATA before reading - MINOR: stream: add per-stream memory slots - BUG/MINOR: haterm: fix the response body phase on short writes - BUG/MEDIUM: haload: restore request accounting after user timeouts - BUG/MEDIUM: ssl: disable kTLS on OpenSSL versions affected by a known bug - DOC: config: add missing empty line before tune.ssl.ktls-unsafe - BUG/MINOR: ist: make ist_find_range() accept non-zero min boundaries - MINOR: ist: add ist_find_http_ctl() to match http CTL chars - MINOR: ist: add ist_find_outside() to find offending characters - MINOR: http: use ist_find_http_ctl() instead of ist_find_ctl() - MINOR: h1: indicate the trailers state to h1_parse_msg_tlrs() - MINOR: http: introduce the notion of http-hardening flags and sections - MINOR: cfgparse/http: add a simple parser for new section "http-fingerprint" - MINOR: http: support default hardening names "untrusted" and "trusted" - MINOR: cfgparse: dump the "http-hardening" keywords with -dKcfg - MINOR: cli/http: add the "show http-hardening" CLI command - MINOR: listener: add the "http-hardening" bind keyword - MINOR: server: add the "http-hardening" server keyword - MINOR: tools: add is_ip_untrusted() to check for non-local addresses - DOC: config: document the "http-hardening" section and server/bind options - MINOR: http: define http_hdng_chk for ambient hardening checks to be run - MINOR: mux-h1: pass the profile's HTTP hardening checks into the h1c and h1s - MINOR: mux-h2: pass the profile's HTTP hardening checks into the h2c and h2s - MINOR: h3: pass the HTTP hardening checks to the h3s and h3c - MINOR: http: add the "set http-hardening" CLI command - MINOR: http/hardening: implement hardening "reject-duplicate-host-header" - MINOR: http/hardening: implement hardening "reject-lowercase-method" - MINOR: http/hardening: implement hardening "reject-underscore-in-header-name" - MINOR: http/hardening: implement hardening "reject-underscore-in-trailer-name" - MINOR: http/harderning: implement "delete-underscore-in-header-name" - MINOR: http/harderning: implement "delete-underscore-in-trailer-name" - MINOR: http/hardening: add "delete-unregistered-header-fields" - MINOR: http/hardening: add "delete-unregistered-trailer-fields" - MINOR: http/hardening: add "delete-all-trailer-fields" - MINOR: http/hardening: implement hardening "reject-header-trailer-folding" - MINOR: h1: rearrange the header value parser to better deal with CTL chars - MINOR: http: speed up http_header_has_forbidden_char() to make it work alone - MINOR: http: don't call ist_find_http_ctl() before up http_header_has_forbidden_char() - MEDIUM: http/hardening: implement hardening "reject-ctl-in-header-trailer" - MINOR: http/hardening: implement hardening "reject-content-length-with-te" - MINOR: http/hardening: implement hardening "reject-content-length-leading-zero" - MINOR: http/hardening: add aliases "all-reject" and "all-delete" - MEDIUM: http: enable a few important hardening rules on untrusted connections - REGTESTS: http-messaging: test the http-hardening checks on HTTP/1 headers - REGTESTS: http-messaging: test the http-hardening checks on HTTP/2 headers - REGTESTS: http-messaging: test the http-hardening checks on trailers - REGTESTS: http-messaging: test http-hardening profiles and their CLI --- diff --git a/CHANGELOG b/CHANGELOG index 38af158fe..65c33296b 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,104 @@ ChangeLog : =========== +2026/11/04 : 3.5-dev11 + - BUILD: sym: Fix build on recent glibc + - BUG/MINOR: checks/log: force implicit UDP checks as TCP for log backend + - CLEANUP: sym: factor out the short object name extraction + - MINOR: sym: use the symbol table to resolve a DSO name + - BUG/MINOR: errors: reset diagnostic buffers after thread cleanup + - BUG/MINOR: sample: fix NULL dereference in the ltime/utime converters + - BUILD: Makefile: extend the capabilities of EXTRA_MAKE + - MINOR: thread: add EXTRAS_LOCK so addons can name their locks + - BUG/MINOR: debug: fix "debug dev fd" crash on unknown address families + - BUILD: Makefile: allow external makefiles to provide build targets + - BUG/MEDIUM: ssl: skip TLS 1.3 suites in the FIPS TLS 1.2 cipher check + - REGTESTS: ssl: skip AWS-LC FIPS rejected crypto in ciphersuites/curves tests + - CI: github: add AWS-LC FIPS testing workflow + - BUILD: github: run FreeBSD CI on every branch + - CI: github: cache VTest binary in FreeBSD workflow + - BUG/MEDIUM: proxy: fix stick table expired entries cleanup on stopping + - BUG/MINOR: http-ana: fix response compression for applets + - DOC: configuration: Clarify wait-for-body doc for the response side + - MINOR: http-act: Add 'no-fail' option on 'wait-for-body' action + - BUG/MEDIUM: leastconn: reset the smallest key when backups take over + - CLEANUP: quic: remove duplicated key phase pointer assignments + - MINOR: quic: use the right trace event in quic_tls_key_update() + - CLEANUP: quic: remove duplicated rx offset initialization in quic_cstream_new() + - CLEANUP: quic: remove the unused tx part of struct quic_cstream + - CLEANUP: quic: remove unused tx crypto size and offset counters + - BUG/MINOR: quic: fix the header protection key length dump with AWS-LC + - CLEANUP: quic: remove the unused key parameter from quic_tls_decrypt() + - CLEANUP: quic: remove the unused count and flags from struct quic_tls_kp + - CLEANUP: quic: remove the stale initial_salt declaration + - CLEANUP: quic: remove duplicated quic_cstream_new() declaration + - CLEANUP: quic: remove the unneeded quic_rx.h include from quic_tls.c + - CLEANUP: quic: update the outdated comment of quic_tls_derive_keys() + - BUG/MINOR: sample: realign the ungrpc converter on message boundaries + - BUG/MEDIUM: compression: fix incompatibility between compression and large-buffers + - CLEANUP: tools: make inetaddr_host_lim*() usable on untrusted inputs + - BUG/MINOR: flt-http-comp: check the block returned by htx_replace_blk_value() + - BUG/MINOR: compression: pass the configured level to slz + - OPTIM: flt-http-comp: only flush the compressor after the last DATA block + - IMPORT: slz: update slz to version 1.4-dev4 + - MINOR: compression: pass the content type to the algorithms' init function + - MINOR: flt-http-comp: size the compression reserve using SLZ_MAX_OVERHEAD() + - REGTESTS: compression: check hard to compress contents and nearly full buffers + - BUG/MEDIUM: mux-h1: don't drop pending output on a short content-length + - BUG/MINOR: filters: Reject id-less implicit instances of multi-instance classes + - BUG/MINOR: ssl/ckch: free the new instance when ckch_inst_rebuild() fails + - BUG/MEDIUM: ssl/cli: reset the ongoing transaction when "commit ssl cert" is interrupted + - BUG/MEDIUM: ssl/cli: don't unlock the certificate lock after a failed trylock + - BUG/MINOR: httpclient/lua: fix stack overread when copying the headers + - BUG/MINOR: httpclient/lua: raise an error on too many request headers + - BUG/MINOR: resolvers: validate TXT RDATA before reading + - MINOR: stream: add per-stream memory slots + - BUG/MINOR: haterm: fix the response body phase on short writes + - BUG/MEDIUM: haload: restore request accounting after user timeouts + - BUG/MEDIUM: ssl: disable kTLS on OpenSSL versions affected by a known bug + - DOC: config: add missing empty line before tune.ssl.ktls-unsafe + - BUG/MINOR: ist: make ist_find_range() accept non-zero min boundaries + - MINOR: ist: add ist_find_http_ctl() to match http CTL chars + - MINOR: ist: add ist_find_outside() to find offending characters + - MINOR: http: use ist_find_http_ctl() instead of ist_find_ctl() + - MINOR: h1: indicate the trailers state to h1_parse_msg_tlrs() + - MINOR: http: introduce the notion of http-hardening flags and sections + - MINOR: cfgparse/http: add a simple parser for new section "http-fingerprint" + - MINOR: http: support default hardening names "untrusted" and "trusted" + - MINOR: cfgparse: dump the "http-hardening" keywords with -dKcfg + - MINOR: cli/http: add the "show http-hardening" CLI command + - MINOR: listener: add the "http-hardening" bind keyword + - MINOR: server: add the "http-hardening" server keyword + - MINOR: tools: add is_ip_untrusted() to check for non-local addresses + - DOC: config: document the "http-hardening" section and server/bind options + - MINOR: http: define http_hdng_chk for ambient hardening checks to be run + - MINOR: mux-h1: pass the profile's HTTP hardening checks into the h1c and h1s + - MINOR: mux-h2: pass the profile's HTTP hardening checks into the h2c and h2s + - MINOR: h3: pass the HTTP hardening checks to the h3s and h3c + - MINOR: http: add the "set http-hardening" CLI command + - MINOR: http/hardening: implement hardening "reject-duplicate-host-header" + - MINOR: http/hardening: implement hardening "reject-lowercase-method" + - MINOR: http/hardening: implement hardening "reject-underscore-in-header-name" + - MINOR: http/hardening: implement hardening "reject-underscore-in-trailer-name" + - MINOR: http/harderning: implement "delete-underscore-in-header-name" + - MINOR: http/harderning: implement "delete-underscore-in-trailer-name" + - MINOR: http/hardening: add "delete-unregistered-header-fields" + - MINOR: http/hardening: add "delete-unregistered-trailer-fields" + - MINOR: http/hardening: add "delete-all-trailer-fields" + - MINOR: http/hardening: implement hardening "reject-header-trailer-folding" + - MINOR: h1: rearrange the header value parser to better deal with CTL chars + - MINOR: http: speed up http_header_has_forbidden_char() to make it work alone + - MINOR: http: don't call ist_find_http_ctl() before up http_header_has_forbidden_char() + - MEDIUM: http/hardening: implement hardening "reject-ctl-in-header-trailer" + - MINOR: http/hardening: implement hardening "reject-content-length-with-te" + - MINOR: http/hardening: implement hardening "reject-content-length-leading-zero" + - MINOR: http/hardening: add aliases "all-reject" and "all-delete" + - MEDIUM: http: enable a few important hardening rules on untrusted connections + - REGTESTS: http-messaging: test the http-hardening checks on HTTP/1 headers + - REGTESTS: http-messaging: test the http-hardening checks on HTTP/2 headers + - REGTESTS: http-messaging: test the http-hardening checks on trailers + - REGTESTS: http-messaging: test http-hardening profiles and their CLI + 2026/10/28 : 3.5-dev10 - BUG/MEDIUM: stats-file: shm-stats-file be counters not working anymore - BUG/MINOR: quic: rearm packet on packet received even non ack-eliciting diff --git a/VERDATE b/VERDATE index 7d2617db1..5fec50680 100644 --- a/VERDATE +++ b/VERDATE @@ -1,2 +1,2 @@ $Format:%ci$ -2026/10/28 +2026/11/04 diff --git a/VERSION b/VERSION index 32adb22e7..019b02cec 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.5-dev10 +3.5-dev11 diff --git a/doc/configuration.txt b/doc/configuration.txt index d44656b1c..25a6194b9 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -3,7 +3,7 @@ Configuration Manual ---------------------- version 3.5 - 2026/10/28 + 2026/11/04 This document covers the configuration language as implemented in the version