Willy Tarreau [Thu, 6 Aug 2026 16:33:19 +0000 (18:33 +0200)]
DEV: haring: bound the ring geometry to the size of the file
Truncated ring files are not exceptional and the tool wasn't very robust
against them and could easily crash when trying to read past the end of
the mapping. Let's bound the sizes and offsets announced in the header
to the real file size. This also allows to relax some checks that would
reject some malformed files that are now handled as best effort ring v1.
It can be helpful to backport this to stable releases, though no issue
was really reported outside of the dev team.
Willy Tarreau [Thu, 6 Aug 2026 07:38:41 +0000 (09:38 +0200)]
BUG/MINOR: hlua: use a local buffer to format the socket addresses
hlua_socket_info() formats the peer or local address of a Lua socket into
a function-static buffer shared by all threads. But there's no reason for
this buffer to be static, and it can cause inter-thread corruption. Let's
just drop the static modifier so that the address lies in the stack.
It can be backported to all versions since it's been there since 1.6
when sockets were introduced to Lua.
Willy Tarreau [Thu, 6 Aug 2026 07:25:13 +0000 (09:25 +0200)]
BUG/MINOR: stats-file: reject tgid 0 when preloading shm objects
When preloading the shared memory stats file at startup,
shm_stats_file_preload() only checked that the tgid read from each
object was not greater than the number of configured thread groups,
but it forgot to also check for zero, which can correspond to an
entry in the process of being reused, and that would cause the
process to crash on startup.
Let's just also test 0. This should be backported to 3.3.
Willy Tarreau [Thu, 6 Aug 2026 07:19:58 +0000 (09:19 +0200)]
BUG/MEDIUM: hpack: encode long methods and schemes using the long form
hpack_encode_scheme() and hpack_encode_method() document that they're
limited to 127 chars since they only rely on hpack_encode_short_idx()
for literals, but the H2 mux doesn't check this. This results in only
the bytes modulo 256 being advertised on a backend connection. As such
the remaining bytes will be confused with other HPACK opcodes. Note
that in practice, the ability to exploit this to inject headers from a
front H1 connection is very limited due to the strict alphabet enabled
in schemes and methods which limits usable codes to literal headers with
indexing for absent pseudo-headers (i.e. no :scheme, :method, :path,
possibly one :authority when none is provided, but it must then match
the host), and whose value will be of 43 chars minimum.
The real impact in practice is to provoke protocol errors and cause
shared H2 backend connections to be abruptly closed in environments
using http-reuse always.
Let's simply make both encoders fall back to hpack_encode_long_idx()
for value larger than 127 bytes, like hpack_encode_path() does. The
bug has been present since 1.9 with commit 39c80ebff ("MINOR: hpack:
provide a function to encode an HTTP method").
Reported-by: Claude (ANT-2026-9SVV6W3Q)
This fix must be backported to all stable versions.
A recent fix was introduced for "del backend" on 3.4 when deleting the
first proxy declared in the configuration. This issue does not affect
the current development tree.
To ensure this case is safe, complete backend deletion reg-test with a
deletion on the first declared proxy. This could prevent any future
regression for this particular case.
BUG/MINOR: proxy: release watcher in various commands on CLI abort
Watcher has been added to protect several commands in src/proxy.c which
iterate over either the proxies or servers list against a runtime
deletion.
However, no io_release has been defined for such commands. This may
cause issue in case the command has yielded and is aborted before its
full completion, for example on client early disconnect. Related applet
context is freed while still subscribed into a proxy or server instance.
When this instance is deleted, a crash occurs on freed applet context
access.
To prevent this, define a dedicated io_release for the following
commands : "show servers state|conn", "show backend" and "show errors".
Any watcher is detached there.
Reported-by: Claude (ANT-2026-6Q55R82E)
This must be backported up to 3.4.
MINOR: config: support "all" and "none" on "tune.defaults.purge"
Extends "tune.defaults.purge" to support new arguments value. The values
"all" is equivalent to "proxies,servers".
The value "none" instructs to preserve all instances, which is similar
to the default behavior when the keyword is absent. It is added mainly
to simplify configuration by external APIs.
Both these values are exclusive : they cannot be mixed into the
comma-delimited list of tokens.
Willy Tarreau [Thu, 6 Aug 2026 07:00:35 +0000 (09:00 +0200)]
[RELEASE] Released version 3.5-dev4
Released version 3.5-dev4 with the following main changes :
- CLEANUP: mux_quic: remove unused prototype
- BUG/MEDIUM: proxy: protect "show errors" against backend deletion
- MINOR: proxy: stress "show errors" handler
- BUG/MINOR: haload: fix use-after-free upon updating task expiration
- BUG/MINOR: haload: set default thread count to 1
- BUG/MINOR: haload: fix display glitches by flushing stdout in summary
- MINOR: haload: add rate limiting support using -R option
- MINOR: log: use curproxy during config parsing
- MINOR: config: define wrapper for proxies loop during check config
- MINOR: log: convert list to standard doubly linked one
- MINOR: sink: convert list to standard doubly linked one
- MINOR: proxy: centralize proxies_list insert during config parsing
- MINOR: proxy: define proxies_list iteration functions
- MAJOR: proxy: convert proxies_list to a doubly linked struct list
- OPTIM/MEDIUM: proxy: avoid main proxies list reordering on startup
- CLEANUP: proxy/config: clean up after proxies list conversion
- MINOR: proxy: rename proxies list to all_proxies
- BUG/MEDIUM: ssl: Spell HAVE_VANILLA_OPENSSL correctly
- BUG/MEDIUM: ssl: Handle non-application data record while splicing
- MEDIUM: ssl: Add a way to rate-limit TLSv1.3 KeyUpdate
- DOC: ssl: Document tune.ssl.keyupdate-rate-limit
- BUG/MEDIUM: ssl: Put CO_ER_SSL_KEYUPDATE at the right place
- BUILD: ssl: Do not use SSL3_MT_KEY_UPDATE, hardcode 24 instead
- MINOR: server: rename global servers_list to all_servers
- MINOR: server: do not return next server on srv_drop()
- MINOR: proxy: define server list iteration functions
- MAJOR: proxy: convert server list to a doubly linked struct list
- OPTIM/MEDIUM: proxy/server: avoid server list reordering on startup
- OPTIM: tools: keep a cache of recent localtime() and gmtime()
- DEBUG: fd: catch access attempts to closed FDs
- MINOR: halog: Add reusable function to extract the value of header captures
- CLEANUP: halog: Clean up naming for variables related to `-hdr` processing
- MINOR: halog: Add support filtering on header capture values using -hdr-match
- REORG: h1-htx: Move h1 headers map in h1-htx
- BUG/MEDIUM: mux-h1: Always adjust case for all outgoing headers as expected
- MINOR: mux-h1: Lower the case for Sec-Websocket-* headers when manually added
- MINOR: mux-h1: Use htx version to send default low-level errors
- BUG/MINOR: haload: fix CPU topology detection by omitting forced "nbthread"
- CLEANUP: haload: use <arg_thrd> instead of <global.nbthread> where applicable
- BUG/MINOR: http-htx: fix the length moved when removing a header value
- BUG/MEDIUM: http-fetch: don't parse a non-HTTP check buffer as an HTX message
- BUG/MEDIUM: http-fetch: reject a negative capture id in capture.{req,res}.hdr
- BUG/MINOR: http-fetch: fix a NULL channel dereference in smp_fetch_body()
- BUG/MINOR: http: fix an out-of-bounds read in http_get_host_port() on empty host
- BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()
- BUG/MINOR: h1: report the right error position on authority/host mismatch
- BUG/MINOR: h2: don't use a block pointer to roll back a partial HTX conversion
- BUG/MINOR: h3: don't use a block pointer to roll back a partial HTX conversion
- BUG/MINOR: http-ana: fix a one-byte over-read in the client-side cookie parser
- CLEANUP: htx: remove the unreachable "append_data" label in htx_reserve_max_data()
- CLEANUP: flt-comp: remove a no-op http_remove_header() call
- BUG/MINOR: http-act: fix a double free of the regex on a rule parsing error
- BUG/MINOR: http-act: fix a double free of the map reference on a parsing error
- BUG/MINOR: http-act: restore the response buffer state in the early-hint action
- BUG/MINOR: http-act: work on a copy of the sample in del-headers-bin
- BUG/MINOR: http-act: reject a negative capture id in the capture actions
- CLEANUP: http-conv: index the captures array with hdr->index in the converters
- BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument
- BUG/MEDIUM: tools: make string encoding possible to fail instead of truncating
- CLEANUP: http-conv: Remove useless enc_type init to ENC_QUERY
- CLEANUP: http-conf: rename local trash variable
- BUG/MINOR: htx: Perform raw copy for messages of same size in htx_copy_msg()
- BUG/MINOR: htx: Transfer HTX_FL_EOM flag on success in htx_append_msg()
- BUG/MINOR: http-rules: fix release of a failed "set-cookie-fmt" redirect rule
- BUG/MINOR: slz: do not read past the end of the input around the match loop
- CLEANUP: slz: fix the documented worst case size of flush() and finish()
- BUG/MINOR: slz: use the exact switch cost for the last literals of a block
- BUG/MEDIUM: slz: bound the bits wasted by the 9-bit literals
- BUG/MINOR: slz: do not append a block to an already finished stream
- BUG/MINOR: slz: fix the adler32 accumulators signedness on 32-bit
- BUG/MINOR: slz: avoid undefined shifts when building the word byte by byte
- CLEANUP: slz: clarify that the size promise applies to the stream, not to a call
- BUG/MEDIUM: peers: check the available room before encoding dict values
- BUG/MEDIUM: sample: reject the deprecated protobuf group wire types
- BUG/MAJOR: ssl/ocsp: lock the OCSP response around reads in the stapling callback
- MINOR: server: improve parsing error for server-template
- BUG/MINOR: server: fix QUIC on server-template
- BUG/MINOR: server: duplicate server alt_proto in srv_settings_cpy()
- MINOR: server: ensure check-reuse-pool is init in srv_settings_init()
- BUG/MINOR: server: fix check reuse-pool in srv_settings_cpy()
- IMPORT: cebtree: private: fix the duplicate detection in the lookup shortcut
- BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd"
- BUG/MINOR: cli: do not reject the "/<fd>" form of "show fd"
- CLEANUP: haload: embed rate_task into hld_thr_info structure
- CLEANUP: haload: factor out user scheduling into hld_usr_schedule()
- BUG/MINOR: haload: fix rate limit bypass during stream errors
- MEDIUM: fd: Remove fdinfo
- MEDIUM: fd: Make it possible to have one fdtab per thread-group
- MEDIUM: pollers: Allow one polled_mask per thread group
- MEDIUM: pollers: Create the poller pipes before we create the thread
- MEDIUM: listeners: Don't always balance connections across thread groups
- MEDIUM: backend: Do not always allow takeover across thread groups
- MEDIUM: listener: Properly handle unshared fd tables between tgroups
- MEDIUM: cli: Transfer sockets with unshared file descriptor tables
- MEDIUM: pollers: Only allow epoll when each tgroup has its fd table
- MEDIUM: pipes: Have one pool of free pipes per thread group
- MINOR: cli: Make "show fd" aware of per-thread-group FD tables
- MINOR: debug: Report the current tgid in "debug dev fd"
- MINOR: cli: Report the tgid along the FD in "show sess"
- MEDIUM: dns: Stick the TCP nameserver tasks to the resolvers' thread
- MEDIUM: server: Do not close other thread groups' connections at deinit
- MEDIUM: resolvers: Do not close another thread group's socket at deinit
- MEDIUM: quic: Do not use another thread group's listener FD
- MINOR: connection: Do not retrieve src/dst on another thread group's FD
- MEDIUM: fd: Add the tune.fd.tables option
- BUILD: listener: Fix the build on platforms without MSG_CMSG_CLOEXEC
- DOC: config: Document the tune.fd.tables option
- BUG/MINOR: ech: propagate error from load_echkeys()
- BUG/MINOR: ech: reject an ECH store with no usable private key
- BUG/MEDIUM: counters: preserve shared.tg pointer on 'clear counters all'
- MINOR: counters: add max-only reset helpers and use them for clear counters
- MINOR: server: add 'clear counters server <backend>/<server>' CLI command
- REGTESTS: stats: add test for 'clear counters server'
- DOC: management: document 'clear counters server'
- BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering
- CLEANUP: haload: drop unused flags field from struct hld_url
- BUG/MINOR: haload: fix stale global variables affecting URL allocations
- MINOR: haload: support HTTP status code by version
- DEV: patchbot: add an "O" filter to hide original lines without new notes
- DEV: patchbot: retrieve the shared state on page load, with a timeout
- DEV: patchbot: support passing the page settings in the URL fragment
- OPTIM: pattern: try literal IPv6 parsing before DNS resolution in pat_parse_ip
- OPTIM: tools/str2net: only duplicate the string when a slash is present
- BUILD: tools: fix C23 incompatible strrchr usage
- CLEANUP: server: remove wrong comments about server-template ID
- MINOR: errors: further improve parsing error for server-template
- BUG/MINOR: server: check strdup return value on server ID
- MINOR: server: do not ignore errors during server-template init
- BUG/MINOR: server: check strdup return on server-template ID generation
- MINOR: server: detect name conflict earlier during parsing
- MINOR: server: treat proxy server tree as without duplicate
- BUG/MINOR: ech: fix label at end of compound statement
- MINOR: ech: introduce an ech_store type and helpers in load_echkeys()
- MEDIUM: ech: implement a lighter ECH feature for AWS-LC
- CI: github: add USE_ECH=1 in OpenSSL and AWS-LC jobs
- DOC: stop supporting OpenSSL version < 1.1.1
- CI: github: remove OpenSSL 1.0.2 job
- BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup
- MINOR: proxy: implement unpublished backend keyword
- MINOR: server: define _srv_parse_from() for server "from" keyword
- MINOR: server: implement "from none"
- MINOR: proxy: keep default-server unless empty setting
- MINOR: proxy: extend global tune.defaults.purge for default-server
- MEDIUM: server: implement from be:
- MINOR: server: set default-server id to NULL
- MEDIUM: proxy: implement named default-server
- MINOR: server: prevent name collision with a default-server
- MEDIUM: server: implement "from srv:"
- CLEANUP: xprt_quic: remove dead callbacks prepare_srv/destroy_srv
- MINOR: sample: make the param converter support control characters
- DOC: explain better that named defaults are preserved
- DOC: better explain that default-server are now preserved
- BUG/MINOR: proxy: fix "show backend"
- MINOR: list: define watcher_is_attached()
- MINOR: proxy: implement "show default-server"
- MINOR: proxy: complete "add backend" reg-test
- MINOR: proxy: implement "show defaults"
Implement a new command "show defaults" whose purpose is to list the
existing named defaults section. This may be needed when adding a new
backend via the CLI.
For now, only the names of the defaults instances are listed. In the
future, it could be useful to have at least some details about their
configuration.
Command does not take any argument and is implemented via a single
io_handler. No need for a watcher as iteration is performed over
defaults instances which cannot be removed at runtime.
Define a new CLI command "show default-server". This lists all the
default-server instances, both unnamed and named. By default, all
backends are displayed. A single instance only can be requested.
Command is protected against runtime backend deletion via a watcher. It
is only attached for a full iteration. If only a single instance is
requested, watcher_is_attached() will detects this and interrupt the for
loop.
Define an utility function to report if a watcher is currently attached
on a target. This will notably be used to implement a new CLI command
"show default-server".
During the conversion for the main proxies list, "show backend" was
broken as no entry would be displayed. This patch restores the iteration
over the backends list.
The exact patch which introduces the regression is the following one.
DOC: better explain that default-server are now preserved
Complete default-server documentation by mentionning that default-server
unnamed and named are now preserved after configuration parsing.
This is already mentionned in the related keyword "tune.defaults.purge".
However, as this is a major change, it is necessary to remind it
directly in default-server section.
DOC: explain better that named defaults are preserved
Named defaults section are now kept after configuration by default. This
behavior change has already been explained in "tune.defaults.purge".
Mention again this change directly in "defaults" documentation. This is
the main entry point documentation for "defaults" sections, so the
change is now more visible to users.
Willy Tarreau [Tue, 4 Aug 2026 09:04:06 +0000 (11:04 +0200)]
MINOR: sample: make the param converter support control characters
Sometimes it can be convenient to support delimiting of the param()
converter using control characters that can be found in some request
bodies. Since the converter only supports a single character, we can
easily make an exception for "0xHH". That's what this patch does. The
reg-test was updated to include one 0x26.
CLEANUP: xprt_quic: remove dead callbacks prepare_srv/destroy_srv
QUIC xprt defines prepare_srv callback. The main objective of this
callback is to setup server XPRT to QUIC.
This should be called once the server is fully configured, with related
code blocks in proxy_finalize() and cli_parse_add_server(). However,
this is in fact dead code as prepare_srv is in fact called through
XPRT_SSL. This is still functional though because SSL and QUIC share the
same prepare_srv, so this issue is not visible. This is the same
situation for destroy_srv callback.
This patch removes the dead code to ensure there is no ambiguity here.
There is still a design issue which should be fixed later as it's not
expected for QUIC code to rely on XPRT_SSL layer.
Implement "srv:" notation for the "from" server keyword. This allows to
specify a server or default-server by its name. It may be optionnaly
prefixed by a backend name using a slash separator. If this is not the
case, lookup is performed under the backend where the current newly
created server instance is attached.
This is implemented by extending _srv_parse_from() to support "from
srv:" argument value. An internal function lookup_srv_be_arg() is
defined to parse the argument of the form "[<be>/]<srv>". This is
similar to already existing lookup functions such as cli_find_server(),
however there is some differences which forces to have duplicated code
for the moment.
MINOR: server: prevent name collision with a default-server
The previous patch has introduced the support for named default-server.
It is not possible though to declare a default-server with a name if it
collides with an already existing server instance.
This patch implements a similar check but on the other side : it ensures
that a newly created server instance does not collide with an already
existing default-server.
To implement this, a new function server_find_by_name2() is defined. It
is similar to server_find_by_name() except it also lookup in the named
default-server tree. Checks are performed on several places :
* _srv_parse_init() for a server parsing
* _srv_parse_tmpl_init() for a server-template parsing
* srv_update_server_name() for the CLI command "set server name"
* cli_parse_add_server() for the CLI command "add server"
Implement the support for named default-server. In a single backend, it
is now possible to define different default-server instances identified
by a name. Along to them, it's still possible to use the anonymous
default-server.
To define a named default-server, a new "name" argument can be used just
after the "default-server" token. It is positional to ensure extra
server settings are always set after it. This is necessary to continue
to allow to define a default-server on multiple lines, concatenating the
settings with the previous line.
Named default-server are stored in a new dedicated compact tree
<defsrv_by_name> in proxy struct.
Name must not conflict with server instances already defined in the same
backend. This is necessary for the future implementation of name
addressing on both servers and default-servers without having to specify
the lookup list.
Previously, default-server <id> was set to "default-server" static
string. With this patch, it is now set to NULL.
This has no noticeable impact, including on the configuration error
messages, as default-server ID is not used there. This is because
register_parsing_obj() is only used for standard server and
server-template instances, but not for default-server.
A nice side-effect of this change is that it's possible to free server
<id> member in srv_free_params(), which is less error prone (even more
with named default server future implementation).
This is a prealable for the future named default-server feature, as it
could conflict with a default-server explicitely named "default-server".
Also, for named default-server, it will be necessary to free <id>
member. Thus it's better to remove a static string reference to prevent
any issue with free() usage.
Implement "from be:" syntax. This instructs that the server should reuse
parameters from the default-server already defined in the same proxy
instance.
This behavior is already the current one in the configuration parser,
thus there is no visible change here. The main usage is on "add server"
command, which previously always ignored a default-server instance.
This is implemented by extending _srv_parse_from() to parse "be:"
argument value. If found, the designated server is returned via <from>
output parameter.
MINOR: proxy: extend global tune.defaults.purge for default-server
Previous patch changes behavior for default-server. They are now
preserved after configuration during the whole process lifetime as
dynamic servers may need them. A default-server is still purge though if
it does not contain any particular setting.
This relation between dynamic and default-server is similar to the one
between dynamic backends and named default proxies sections, which are
also kept by default at runtime.
This patch extends tune.defaults.purge keyword which was previously used
to force cleanup of named defaults section on post parsing. This now
support an extra argument to instruct the type of elements to remove :
supported values are "proxies" for named defaults sections and "servers"
for default-server.
Without any argument, the option only forces clean up of named defaults
sections. This is the simplest method to preserve backward compatibility
with previous releases.
This new setting requires a dedicated code block for default-server
purgeing in check_config_validity(). This cannot be performed during
post-section parsing as this is a global setting which can be defined
later.
Previously, default-server were removed as soon as a proxy section
parsing was over. This patch changes this behavior to now keep
default-server during haproxy runtime. This will allow to reuse them for
dynamic servers, which will be later implemented via "from" keyword as a
distinct feature.
Default-server may consume a noticeable amount of memory, so it can
still be desirable to clean up these elements on post-parsing. Thus, if
a default-server is reset, it will still be purged on section post
parsing. This can be achived by using a "default-server from none" final
line.
To detect if a default-server should be preserved, a new flag
SRV_F_UMODIFIED has been defined. Such flag is set as soon as a server
keyword has been parsed. It is reset when srv_settings_init() is used.
Thus, if this flag is present, default-server purge on post parsing is
skipped.
Implement "from none" on a server line. This instructs to not preset
server settings via another instance, instead relying on documented
default values.
This is useful to change the default behavior for static servers to
prevent them from reusing a default-server instance. A secondary usage
of this value is on a default-server. This reset the default-server to
the documented default settings.
This is implemented by extending _srv_parse_from() to parse "none"
value. In this case, <from> output return is set to NULL, which will
cause the server to be initialized via srv_settings_init().
MINOR: server: define _srv_parse_from() for server "from" keyword
Prepare the support for a new server keyword "from".
This keyword has special constraints : it is a positional one as it can
only be specified once, after the server address and before the other
parameters.
The purpose of this keyword will be to define server settings
inheritance outside of the default-server of the current backend. It
will also be useful for dynamic servers which currently do not inherit
from a default-server.
Add a new "unpublished" proxy keyword. This allows to start a backend
instance in unpublished state. This can be reverted via "publish
backend" on the CLI.
This keyword is restricted to backend and listen sections.
This patch is a simple feature implementation, however it can be
considered as a must-have when using dynamic backends. As such, it
should be backported up to 3.4.
BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup
A proxy with BE capabilities may define a default-server instance. This
instance is freed when config parser switch to another section. Beside
the server object, <conf.file> is also freed.
This causes a memleak if the default-server configuration is expanded
with keywords triggering dynamic allocations. For example, this is the
case if a cookie name is defined.
To fix this, use srv_free_params() on default-server deletion. This
function is designed to work both for server and default-server. It
ensures that every dynamic elements in it are freed. Only <id> member is
not freed by srv_free_params() : this is expected as it is a static
value for default-server instances.
Note that srv_free_params() is already used when default-server is freed
in deinit_proxy() since the following patch. However, post-parsing
cleanup has been added after it without reusing srv_free_params().
MEDIUM: ech: implement a lighter ECH feature for AWS-LC
This patch implements ECH with AWS-LC. AWS-LC supports a different ECH
API than OpenSSL 4.0.
AWS-LC does not implement an API to load a PEM ECH file, the ECHCONFIG
section is parsed manually using PEM_read_bio() to feed the SSL_ECH_KEYS
object.
Runtime ECH store management ('show/add/set/del ssl ech') and ECH
status/outer-SNI reporting are disabled under AWS-LC for now.
MINOR: ech: introduce an ech_store type and helpers in load_echkeys()
Alias OSSL_ECHSTORE as ech_store, and wrap OSSL_ECHSTORE_new(),
OSSL_ECHSTORE_free(), SSL_CTX_set1_echstore() and the per-file PEM
loading loop behind ech_store_new(), ech_store_free(),
ech_store_set_ctx() and ech_store_load_file(). Use them in
load_echkeys() instead of the OpenSSL calls directly.
ech_store_load_file() no longer reads strerror(errno) to explain a
BIO_new_file() failure: that function records the fopen() failure
reason in the crypto library's error queue, not in errno.
load_echkeys() already drains that queue into *err on any failure, so
just keeping the message filename-only here is enough to get the real
reason appended.
This is pure preparation with no functional change otherwise: a
following commit will give ech_store and these four helpers an
AWS-LC-specific body, so that load_echkeys() can be shared between the
two SSL libraries.
BUG/MINOR: ech: fix label at end of compound statement
The "ignore_entry" label used to skip non ".ech" directory entries in
load_echkeys() was placed right before the closing brace of the "for"
loop, with no statement attached to it. A label with no following
statement is only valid since C23, so strict compilers reject it:
src/ech.c:96:2: error: label at end of compound statement is a C23
extension [-Werror,-Wc23-extensions]
MINOR: server: treat proxy server tree as without duplicate
Previous commit changes the unicity checks on server name inside a
proxy. This is now done directly during the parsing, prior to the tree
insertion.
Thus, the tree can now be considered without duplicate. Replace cebis_*
function by their equivalent cebuis_*. Also, insertion is now performed
via utility function _srv_register_name() which contains a new BUG_ON()
to ensure server name unicity principle is not violated.
This was implemented as a post parsing check via
check_config_validity(). Now, this is performed directly during the
parsing of each new server instances. The main benefit is that it is a
much clearer operation.
Multiple checks are required : in _srv_parse_init() for standard server
and in _srv_parse_tmpl_init() for server-template. Note that the latter
check requires the following patch to ensure errors are properly
reported when duplicating a server-template instance.
BUG/MINOR: server: check strdup return on server-template ID generation
Check strdup() return value when a server-template prefix is expanded
into the final server name. Now, an alert is reported in case of error
and server parsing is interrupted.
Along with this change, the server prefix expansion function has been
renamed and its documentation adjusted.
This could be backported to all stable releases. However, this depends
on a previous patch which prevents ignoring of errors during
server-template generation. As this is a minor fix which is only useful
after memory allocation failure, it is probably better to not pick them.
If backporting is considered necessary, the following patch is required
first.
MINOR: server: do not ignore errors during server-template init
_srv_parse_tmpl_init() is used to duplicate a server several times
according to its template declaration. If an error was encountered
during the duplication of one of these instance, the function was
interrupted. However, no error/warning message is displayed and the
error is silently ignored by caller parse_server().
The objective of this patch is to ensure an error occuring during a
server template allocation is now properly reported. First, an alert is
reported for every failure cases. Also, _srv_parse_tmpl_init() return
type is changed to use an error code. This is used to interrupt server
parsing.
The real benefit of this patch is still pretty limited. The only real
case of error which can happen is an allocation memory issue, likely
detected by a later operation. Also, server_parse_exprs() is also
faillible. However, this was already invoked for the first server
instance via _srv_parse_finalize(). Thus it is unlikely that an error is
reported for the duplicated instances during duplication. Despite this,
the current patch is an improvment as it will allow to extend
_srv_parse_tmpl_init(), for example to check for server name duplication
during parsing on every template instances.
MINOR: errors: further improve parsing error for server-template
The following patch improved error messages for server-template lines.
This properly used <tmpl_info.prefix> instead of the <id> field for
them, which prevents to display an empty string.
This patch relied on server-template instance detection by checking if
<id> field is NULL. However, this is not appropriate once a
server-template has its ID assigned during _srv_parse_tmpl_init(). The
expanded name is displayed, which can be a misleading information as
this is not present directly in the configuration.
This patch fixes this by now detecting a server-template by checking if
its <tmpl_info.prefix> is non NULL. Thus, a server-template remains
detected as such even after its ID has been generating. Its template
name is used on error messages instead of the expanded prefix.
CLEANUP: server: remove wrong comments about server-template ID
This misleading comment suggests that server <id> field is set to the
prefix for a server-template. In fact, this field remains NULL and
prefix is set to <tmpl_info.prefix>.
This change is required since C23, as strrchr(), along other functions
which accept a const-qualified pointer without returning a const type
are now declared as macro with generics to preserve the const qualifier.
See https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3020.pdf for
details.
Willy Tarreau [Mon, 3 Aug 2026 07:52:58 +0000 (09:52 +0200)]
OPTIM: tools/str2net: only duplicate the string when a slash is present
The str2net() and str62net() functions systematically strdup() the
input pattern before parsing it, while this is only needed when a '/'
is present. Given that this '/' is already looked up, better move the
allocation inside that block so that no allocation is performed when
none is present.
Doing so saves ~5% load time on plain IPv4 addresses and ~8% on plain
IPv6 addresses, while not changing anything for addresses with masks.
Andre Brait [Wed, 22 Jul 2026 20:53:17 +0000 (22:53 +0200)]
OPTIM: pattern: try literal IPv6 parsing before DNS resolution in pat_parse_ip
pat_parse_ip() calls str2net() with DNS resolution enabled before trying
str62net(), so every IPv6 entry of a pattern file pays a blocking DNS
resolution attempt (which necessarily fails) before being parsed as an
IPv6 literal. On a configuration loading a 20k-entry IPv6 acl file on a
host with a resolv.conf search domain, this added two DNS round trips
per entry and made "haproxy -c" take 14 seconds instead of about 1.
Try both literal parsers first, then fall back to the resolving call of
str2net(). An IPv6 literal can never be a valid host name (colons are
not permitted in DNS labels) and host names keep resolving exactly as
before, so no working configuration changes behaviour.
Diagnosed on pfSense, where large pfBlockerNG IP block lists are loaded
through "acl ... -f" files:
https://github.com/pfsense/FreeBSD-ports/pull/1450
This patch was authored with Claude Fable 5 and reviewed by GPT-5.6 Sol.
DEV: patchbot: support passing the page settings in the URL fragment
It's difficult to point a coworker to a set of patches resulting from a
selection. Some browser-based tools such as slides pass information in
the URL as a fragment that the code in the browser is able to retrieve.
Conversely it's possible to update it without causing a page reload
using history.replaceState(). This means that we can instantly update
the URL bar with extra params passed as fragments as we click on the
page, so it's possible to copy-paste a current state so that someone
else gets the same view (without local edits).
DEV: patchbot: retrieve the shared state on page load, with a timeout
I got trapped a few times reviewing patches without clicking the
"Get Updates" button (not yet being used to it). After checking with
AI, it's not complicate to implement a fetch timeout, so let's do that
directly on page load. It also means that a reload will automatically
retrieve updates. In case of failure (offline, server dead), after 2s
the fetch is abandonned and the page can be used normally. For browsers
that wouldn't implement the timeout, it would just act as if the button
had been clicked, so likely that pressing Esc would stop it. Tested in
firefox 140.
DEV: patchbot: add an "O" filter to hide original lines without new notes
Now that we can save notes, it appears that it becomes convenient to
leave new backport notes there, e.g. flag the already backported patch
as "wait" and add a note "left in 3.2 for now, sensitive backport". But
rediscovering these notes later happens to be difficult.
This patch adds a new checkbox with "O" for "original notes", which
is checked by default, and which when unchecked allows to only list
lines with edited notes.
An initial test was made to also consider a changed state in this reduced
listing but too many are changed (~10%) and they add pollution for no
reason (many Y<->N). Let's just keep lines with extra notes.
MINOR: haload: support HTTP status code by version
Add support for tracking and displaying HTTP status code distribution
broken down by HTTP version (h0, h1, h2, h3) via the new -hsv option.
Building upon -hs, -hsv retains the global status code distribution and
appends additional columns detailed by HTTP version.
Each URL configuration (struct hld_url_cfg) stores its targeted HTTP version in
->http_ver. Thread statistics track status code counts per HTTP
version in thrs_info.vtot_sc[][], which are then aggregated and displayed
alongside global status codes in hld_summary().
Also remove deprecated --show-status-codes, which is a too long long option,
in favor of -hs / -hsv.
BUG/MINOR: haload: fix stale global variables affecting URL allocations
hld_alloc_url() relied on global variables (alpn, h2c) set during
command-line parsing. When processing multiple URLs, values retained in
these globals by previous URLs persisted and affected subsequent
allocations. This corrupted the configuration of newly allocated
URLs—especially QUIC URLs, which require "h3" ALPN and no h2c—causing
connection failures.
Fix this by passing is_quic, ALPN, and h2c explicitly as parameters
from haproxy_init_args() to hld_alloc_url(), ensuring each URL is
constructed with its appropriate parameters instead of inheriting
stale global state.
BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering
While a filter is registered on the payload filter in TCP, it is important
to disable the auto-cloes on the corresponding channel. It is already
performed in HTTP. It is only an issue when the ->tcp_payload callback
function is defined.
Without this patch, the data blocked in a filter may be lost when the
producer shut its connection. In that case, we must take care to wait the
filter flushes pending data.
This patch should fix the issue #3457. It must be backported to all
supported versions.
Add a section for the new 'clear counters server <backend>/<server>
[force]' CLI command in doc/management.txt, alongside 'clear counters'
and 'clear counters all'.
The entry documents the admin-only permission level (it clears
accumulated counters, like 'clear counters all') and the fact that both
accumulated counters and max values are reset, along with the clearable
module-registered extra counters, while the server's runtime state
(address, weight, admin state) and health checks are left untouched. It
describes the optional 'force' argument required to clear counters
stored in a shared-memory stats file, and calls out the Kubernetes
slot-recycle use case that motivated the command (per-entity
attribution after 'set server <b>/<s> name').
REGTESTS: stats: add test for 'clear counters server'
Cover the new 'clear counters server <backend>/<server>' CLI command:
- error cases:
* unknown backend
* unknown server
- success case: drive two requests pinned to a single server (the
second server is a backup, so it stays idle), verify via 'show stat'
that the served server accumulated sessions while the backup stayed
at zero, clear only the served server's counters, then verify its
cumulative sessions dropped back to zero while the backup is still
untouched.
- the optional 'force' argument is accepted (a no-op override here,
since these process-local counters are not backed by a shared-memory
stats file) and the command is discoverable via 'help'.
The success path also implicitly exercises the counters_be_reset()
helper: if the reset were unsafe against the shared.tg pointer, the
vtest run would segfault on the next scheduled scrape or health check.
MINOR: server: add 'clear counters server <backend>/<server>' CLI command
Add a CLI command to reset the statistics counters of a single server:
clear counters server <backend>/<server> [force]
Motivation: 'clear counters all' resets counters across every proxy and
server in the process, which is too blunt for common operational needs.
In particular, when a server slot is being reused to represent a
different logical entity (e.g. a different Kubernetes pod occupying the
same slot after 'set server <b>/<s> name'), the operator needs per-slot
counter attribution and cannot afford to wipe the entire process' stats.
The command requires ACCESS_LVL_ADMIN, like 'clear counters all'. It
resets cumulative counters (not just the max gauges cleared by the base
'clear counters'), so restricting it to admin prevents an operator-level
socket from hiding accumulated activity. Like 'clear counters' / 'clear
counters all', it is not gated by the server's administrative state: the
reset only zeroes counter values and does not touch the server object or
its runtime state, so it is safe to issue on a live server (a concurrent
counter increment races on a value exactly as it already does for 'clear
counters all').
When the server's counters are registered in a shared-memory stats file
object (COUNTERS_SHARED_F_LOCAL not set), clearing them breaks the
monotonicity that monitoring tools consuming the shared stats rely on
and affects every process attached to the object. Such a clear is
therefore refused unless the optional 'force' argument is given.
The reset covers both the native server counters, via counters_be_reset()
introduced earlier in this series (which safely zeroes the per-tgroup
accumulated counter contents while preserving the shared.tg pointer
array), and the module-registered extra counters, via the new
srv_stats_clear_extra_counters() helper.
Note on the dispatch: 'clear counters' is a two-word CLI keyword, and
cli_find_kw() matches the first keyword whose tokens are all consumed,
so a separate three-word 'clear counters server' keyword would be
shadowed (or would shadow) depending on registration order. To avoid
that ambiguity the new sub-command is dispatched from within
cli_parse_clear_counters() when args[2] == "server", mirroring how the
existing "all" argument is handled. The per-server worker lives in
server.c (cli_clear_counters_server()) where the server lookup and
lock helpers are available.
MINOR: counters: add max-only reset helpers and use them for clear counters
The plain "clear counters" command (OPER level) resets only the max/peak
gauges of each object's counters, leaving cumulative counters intact,
while "clear counters all" (ADMIN) performs a full reset via the
counters_{fe,be}_reset() helpers introduced earlier in this series.
The max-only reset was open-coded inline in proxy_stats_clear_counters()
with a hand-maintained list of fields, duplicated across the backend,
server and listener branches. This is fragile: a new max gauge added to
struct {fe,be}_counters can silently be forgotten here.
Factor the max-only reset into counters_fe_reset_max() and
counters_be_reset_max(), living next to the existing reset helpers, and
call them from proxy_stats_clear_counters(). Unlike the full-reset
helpers these cannot use a blanket memset because the max fields are
interleaved with live cumulative fields, so the gauges are zeroed
individually.
While consolidating, the two open-coded lists turned out to disagree:
the backend branch cleared conn_max / cps_max / rps_max but not
cur_sess_max, while the server branch cleared cur_sess_max but none of
the former. Both used the same struct be_counters, so these were latent
gaps rather than intentional differences. counters_be_reset_max() now
clears the union of all peak gauges, so plain "clear counters"
consistently resets every max gauge for both backends and servers.
No functional change for the full-reset ("all") path.
BUG/MEDIUM: counters: preserve shared.tg pointer on 'clear counters all'
proxy_stats_clear_counters() did a blanket memset() on the be_counters /
fe_counters / listener counter structs when clearing all counters. This
zeroed the embedded shared.tg pointer array, which every hot path
dereferences with no NULL check (for example
_HA_ATOMIC_INC(&srv->counters.shared.tg[tgid-1]->cum_lbconn) in
process_srv_queue()). After 'clear counters all' the next request on
that server would segfault.
The memset pattern predates the switch to per-thread-group shared
counters (commit 5495c8844 "MEDIUM: counters: Dynamically allocate
per-thread group counters") and wasn't updated when shared.tg gained
pointer-array semantics. Additionally, memset'ing only the outer struct
never actually reset the accumulated counters in the pointed-at
per-tgroup structs, so 'clear counters all' silently failed to match
its documented "same effect as restarting" behaviour for cumulative
counters (bytes, sessions, requests, ...).
Both iterate shared.tg[0 .. nbtgroups-1] and zero the *contents* of each
per-tgroup struct via memset, then zero the local (non-shared) fields of
the outer struct. The shared.tg pointer array, each shared.tg[it]
pointer, and shared.flags (COUNTERS_SHARED_F_LOCAL is set at boot and
reflects allocation ownership, not counter state) are preserved.
Refactor proxy_stats_clear_counters() to call these helpers instead of
the inline memset. This fixes both the segfault after 'clear counters
all' and the silent no-op on cumulative counters, and provides a shared
primitive for a subsequent 'clear counters server <b>/<s>' command.
In SHM stats-file mode, zeroing the per-tgroup structs affects every
process attached to the same object; this matches the intended
"reset everywhere" semantic of clear counters and is unchanged from
the outer-memset intent.
This bug should be backported wherever the per-thread-group shared
counter refactor is present.
BUG/MINOR: ech: reject an ECH store with no usable private key
OSSL_ECHSTORE_read_pem() accepts a PEM file containing only an
ECHConfig with no private key. OSSL_ECHSTORE_num_keys() returns 1
on success regardless of the count it writes back, so the existing
"!= 1" check only ever caught the call itself failing, never a
resulting count of zero: a directory containing only such
config-only ".ech" files loaded "successfully" and got installed via
SSL_CTX_set1_echstore(), while unable to decrypt a single
ECH-protected ClientHello, with nothing pointing at the cause.
BUG/MINOR: ech: propagate error from load_echkeys()
load_echkeys() was not emitting any error messagw, so a failed load only
ever produced "failed to load ECH keys". Add a char **err parameter to
the function so it can emit TLS library errors or system errors.
BUILD: listener: Fix the build on platforms without MSG_CMSG_CLOEXEC
Some OSes, such as macos, do not provide MSG_CMSG_CLOEXEC, so provide a
fallback mechanism using fdcntl(FD_CLOEXEC) instead.
It doesn't matter right now, that code will never be used on such OS,
because you can't use per-thread-group fd tables in there, but maybe it
will change one day.
Add a new experimental option, tune.fd.tables, that can be set to
either "shared" (the default) or "per-thread-group", to enable
per-thread group file descriptor tables.
This can give a nice performance boost when running with a lot of
threads, as we observe a lot of contention on the file descriptor table
lock in the kernel.
MINOR: connection: Do not retrieve src/dst on another thread group's FD
conn_get_src() and conn_get_dst() lazily fetch the connection's
addresses with getsockname()/getpeername() when they were not known
yet. They may be called on a foreign connection by observability code
running on any thread, for example "show peers", which dumps the peers
sessions' connections from whatever thread serves the CLI. With
per-thread-group FD tables, the FD of a connection owned by another
group is not usable from the calling thread.
So just fail if we attempt to access a connection that is owned by
another thread group.
MEDIUM: quic: Do not use another thread group's listener FD
A datagram may be read by a thread of another group than the one owning
the connection it is for, and with per-thread-group file descriptor
tables, we can't assume that we can use that file descriptor, so find a
more fitting one if needed.
MEDIUM: resolvers: Do not close another thread group's socket at deinit
resolvers_destroy() runs at deinit, on the last remaining thread, and
closes the UDP nameserver sockets, which were created by the thread
their resolvers section's task was pinned to. With per-thread-group FD
tables, when that thread belongs to another group, its group's FD
table died with its last thread and already closed the socket, and the
stored number is only meaningful in that table, closing it from here
would actually close whatever FD carries the same number in this
thread's own table. So in that case, leave the FD alone.
MEDIUM: server: Do not close other thread groups' connections at deinit
srv_close_idle_conns() runs at deinit, on the last remaining thread,
and closes the FDs of every thread's idle connections. With
per-thread-group FD tables, the connections of the other thread groups
were already closed by the kernel when the last thread of their group
exited, and their numbers are only meaningful in those groups' tables,
closing them from here would in fact close whatever FD carries the
same number in this thread's own table, and let sock_conn_ctrl_close()
rewrite an unrelated entry of this group's FD table. So in that case,
only release the memory and leave the FDs alone.
MEDIUM: dns: Stick the TCP nameserver tasks to the resolvers' thread
The tasks handling the TCP nameservers (task_req, task_rsp, task_idle)
are created with no thread affinity, but with thread groups having their
own file descriptors table, it has to run on the same thread as the
one who created the socket, or maybe the other thread will not be able
to use the socket.
In practice, it was not a problem, because the scheduler will wake the
task on the running thread. But that may change in the future, so make
sure we always run on the current thread from start to finish.
MINOR: cli: Report the tgid along the FD in "show sess"
With per-thread-group FD tables, an FD number alone is ambiguous: it is
only meaningful within the thread group of the stream that uses it. So
display the FDs of the "show sess" output in the "tgid/fd" form already
used by "show fd", both in the one-line format and in the detailed one.
In the detailed output, the FD state, update and thread masks are also
read from the owner group's table rather than from the calling
thread's one, which would report an unrelated entry when the tables
are not shared.
MINOR: debug: Report the current tgid in "debug dev fd"
"debug dev fd" scans the FDs of the process as the calling thread sees
them, and reports the ones unknown to fdtab. With per-thread-group FD
tables, both that scan and the fdtab lookups only reflect the view of
the calling thread's group: the same command may report different FDs
depending on the thread that serves it. Let's print the current tgid in
a header line so the output states which view it shows.
MINOR: cli: Make "show fd" aware of per-thread-group FD tables
The <tgid>/<fd> argument forms of "show fd" were parsed but the tgid was
ignored so far, the dump always reading the local thread's FD table.
Now that each thread group can have its own table, give the tgid its
intended meaning: a specific tgid dumps that group's table only, while
the wildcard and unspecified forms visit every group in turn, so that
"show fd /<fd>" shows what each group knows about a given FD number.
Each entry's group remains visible in the gid= field. The polled_mask
words are read from the dumped group's slice as well, and the dump can
resume from the right group when the output buffer fills up.
When the tables are shared, all the groups alias the same table, so a
single pass is performed as before and the tgid makes no difference.
The tgid is now also validated against the number of configured thread
groups rather than the maximum supported.
MEDIUM: pipes: Have one pool of free pipes per thread group
The pipes used for splicing are kept in a shared pool of free pipes, so
that they can be reused by any thread. However, with per-thread-group
FD tables, a pipe created by one group only exists in that group's
kernel table, so its FDs must never be handed over to a thread of
another group.
To fix that, replace the global list of free pipes with one list per
thread group if the fd tables are not shared across thread groups.
MEDIUM: pollers: Only allow epoll when each tgroup has its fd table
Getting pollers such as select and poll to work when thread groups
unshared their file descriptors would require to have per-thread groups
arrays of file descriptors. Given making each thread group its own file
descriptor table is done for performance reasons, and those pollers will
never perform very well, this does not seem to be worth it.
kqueue and evports would work, except that they are only implemented on
OSes that do not provide the equivalent of the unshare() system call.
So effectively, only epoll can be used as a poller when fds are not
shared across thread groups.
MEDIUM: cli: Transfer sockets with unshared file descriptor tables
Teach the _getsocks command how to use the new rx agent facilities to
obtain the file descriptors from other thread groups when each one has
its own file descriptor table.
MEDIUM: listener: Properly handle unshared fd tables between tgroups
With different FD tables for each thread group, a new mechanism is
needed to get each thread group to close/open their fds, and to transfer
fds from one thread group to another.
So we add the concept of rx agents. Each thread group has a tasklet
dedicated to that, bound to the first thread of each thread group, and
are used to get those operations done.
Each receiver contains context bits so that the tasklet will know which
action to do when woken up.
A new socketpair is also created per group, to be able to send fds to other
thread groups.
MEDIUM: backend: Do not always allow takeover across thread groups
When we're running with separate file descriptor tables across thread
groups, do not allow connection takeover across thread groups, as the
connection would not be usable for that thread, anyway.
MEDIUM: listeners: Don't always balance connections across thread groups
Do not try to dispatch new connections to threads from other thread
groups if there is no file descriptor sharing across thread groups, as
they could not access that new fd.
MEDIUM: pollers: Create the poller pipes before we create the thread
As we may now unshare the file descriptor tables, make sure we create
the pipes used to wake the pollers up before we create the threads, so
that they will be shared by all threads.
MEDIUM: pollers: Allow one polled_mask per thread group
Similarly to what's been done for fdtab, create one polled_mask per
thread group if GTUNE_NO_TG_FD_SHARING is set.
As the flag can't be set yet, this commit should have no impact.
Olivier Houchard [Mon, 29 Jun 2026 12:32:19 +0000 (14:32 +0200)]
MEDIUM: fd: Make it possible to have one fdtab per thread-group
Add a new global flag, GTUNE_NO_TG_FD_SHARING. When set, the goal is to
have to a different file descriptor table for each thread group, if
the platform supports separate file descriptor tables for each thread
(so right now, only linux with the unshare() syscall), as with many
threads, the kernel lock for the file descriptor table is a huge source
of contention.
This commit just makes it so if the flag is set, we will have one fdtab
per thread group, and we will call unshare() for each thread group, so
that each has its own file descriptor table.
Note that for now there is no way to set the flag, as a lot more work is
needed before the feature is usable. As such, this commit should have no
noticeable impact.
fdinfo is a global table, indexed by the file descriptor, whose purpose
is just to remember if a port was allocated in a port range, so that
that port may be released when the file descriptor is closed. But that
would no longer work if we split file descriptors per thread-group, and
while we may just have one fdinfo table per thread group, this sounds
like wasted memory with little benefits.
So instead, abuse fdtab to store the relevant information. "state" now
has two more flags, FD_HAS_PORT and FD_OWNER_PR. FD_HAS_PORT means a
port has been explicitly allocated for that file descriptor.
FD_OWNER_PR means the owner field now points to the struct port_range
from which the port was allocated, and where it should be released.
The local port is now obtained from getsockname(), instead of storing it
anywhere.
For TCP, as fd_delete() is called from sock_conn_ctrl_close(), which
itself is called when the connection is about to be destroyed, we can
get the port range used as it is the one provided by the server, which
is available as conn->target.
For QUIC, unfortunately, the connection may be gone already, so instead,
we just store it in the quic_conn.
We have to wait until _fd_delete_orphan() is called in order to release
the port, as in some rare cases, fd_delete() will not call
_fd_delete_orphan(), and we want to make sure we only release the port
just as we're closing the file descriptor.
BUG/MINOR: haload: fix rate limit bypass during stream errors
In hld_strm_task(), stream errors triggered an unconditional task_wakeup()
on the user task. This bypassed arg_rate and caused haload to send connection
retries as fast as possible instead of respecting the configured request rate.
Call hld_usr_schedule() when arg_rate is set to guarantee that
rate pacing is preserved even when streams fail.
CLEANUP: haload: embed rate_task into hld_thr_info structure
Store the rate task directly inside the per-thread <hld_thr_info>
struct instead of keeping a separate global <hld_rate_tasks> array.
This simplifies memory management by grouping thread-specific tasks and
data together:
- move rate task creation into <hld_alloc_thrs_info>
- clean up rate tasks directly inside <hld_dealloc_thrs_info>
- remove the separate <hld_dealloc_rate_task> helper and global array
BUG/MINOR: cli: do not reject the "/<fd>" form of "show fd"
Commit da554b7ef added the tgid/fd argument form, where tgid is
optional, and a missing tgid would mean "in each thread group".
However the code considered everything that was not a digit a filter
type, and as / was not a valid filter type, we'd just get an output of
"Invalid FD type".
Fix that by not considering / a filter character.
BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd"
Commit 1cb041a6e added filtering to show fd, which means the number of
arguments can now change, however args[2] was still used from time to
time. Fix this by using args|arg] instead when relevant.
Note that before 3.4, there is only one instance of that, atoi(args[2])
should be atoi(args[arg]). That could lead to the wrong fd being used.
IMPORT: cebtree: private: fix the duplicate detection in the lookup shortcut
Commit 6b5cd28 ("OPTIM: descent: stop at the node when the path to the
leaf is not used") made _ceb_descend() stop as soon as a match is found
on the key when the caller requests none of the ret_* pointers needed by
insert and delete. This overlooked a special case needed for duplicates,
which require to descend to the leaf. The detection performed at the end
of the function is:
It needs <is_leaf>, i.e. the knowledge that the node was reached through
a leaf pointer which is not its own, because a node's role (node/leaf)
is only figured by the path used to reach it, and the state of the leaf
itself is not sufficient. For example, inserting "s1", "s2", or "s2",
"s2" both produce a second node whose b[0] is a tagged pointer to the
first node and whose b[1] is a tagged pointer to itself. Only the tag
of the pointer leading to it differs.
Two independent problems follow:
- the shortcut to the leaf from the commit above does not update
<is_leaf>. For arrays and strings it assigns "node = ln"/"node = rn"
then breaks, so is_leaf still describes the node we came from, and
a duplicate is reported as a regular leaf ;
- the shortcut may stop on an inner node instead of the leaf, and an
inner node carrying the searched key says nothing about the possible
presence of a list of duplicates hanging below it. For example, in
(0,2a,3,2b), the descent will visit 0,3,2b and this is the last 2
that was inserted and not the one we want to return.
As a result *_prev_dup() returned NULL instead of the previous duplicate
as soon as the tree contained another key, i.e. exactly when the tree is
deep enough for the descent to enter the loop. *_next_dup() is immune to
the first problem since it never looks at is_dup, but not to the second
one. Less visibly, *_lookup() also uses is_dup, to walk back to the
first element of a list, and with is_dup wrongly zero it returned the
last one.
The fix keeps the shortcut everywhere it is harmless, as the whole point
of that commit was to avoid useless operations. Only three call sites
both reach this block and request is_dup: _ceb_lookup() with CEB_WM_KEQ,
and _ceb_next_dup() and _ceb_prev_dup() with CEB_WM_KNX/CEB_WM_KPR. All
the others either pass a blocking ret_* pointer (insert, delete,
next/prev, lookup_le/lt/ge/gt) or use a method below CEB_WM_KEQ which
never enters the block. Thus we have this:
- for arrays and strings, the shortcut jumps to the matching branch,
which for a list of duplicates is its last element, so it is taken
whenever that branch is already a leaf, and <is_leaf> is updated
accordingly. Only the inner node case is given up ;
- for ints, the shortcut stops on the matching node itself, which is
the dual-role node, i.e. the *first* element of the list. That is
exactly what _ceb_lookup() must return, so it is kept there, and
excluded only for _next_dup()/_prev_dup() which need the last
element in order to walk the list.
More importantly, performance-wise, no operation that was already correct
descends further than before. Int lookups in multi-key trees are now
slightly slower since they need to reach a leaf or a dup tree, but that
is the price to pay to find the real first element. On the other hand,
string lookups are now slightly faster (~10%).
Now tests/testdups does not return any failure out of 6298 sequences.
[wt: this could sometimes miss duplicate server names since 3.3 and
commit 413e903a22 ("MEDIUM: server: switch conf.name to cebis_tree"),
as Amaury found. This must be backported to 3.3]
BUG/MINOR: server: fix check reuse-pool in srv_settings_cpy()
<reuse_pool> may be set on check to instruct that connection reuse may
be performed for server health checks.
As expected, this field is duplicated in srv_settings_cpy(). However,
there is an exception for rHTTP servers as in this case check-reuse-pool
must be forcefully activated, as performed in srv_settings_init(). Thus,
the value was not copied to avoid changing it to 0.
This causes a configuration issue with rHTTP on server-template though.
In this case, check-reuse-pool is not set for duplicated server
instances as srv_settings_init() is not called for them. This causes
checks to always fail for such entries.
Fix this by forcing check-reuse-pool for rHTTP in srv_settings_cpy(),
and duplicate the values for other servers.
MINOR: server: ensure check-reuse-pool is init in srv_settings_init()
For rHTTP servers, check-reuse-pool is forcefully set on them, else
checks would always fail. This initialization was performed in
_srv_parse_init().
Move this force init in srv_settings_init(). This is a better place as
_srv_parse_init() should only perform minimal configuration, mostly
related to server address. Then srv_settings_init() is called with the
task to set every fields to suitable default values before keywords
parsing.
Also, this ensures that check-reuse-pool is set to 0 for non rHTTP
servers. This is not strictly required though as server structure is
calloc'ed.
BUG/MINOR: server: duplicate server alt_proto in srv_settings_cpy()
Server <alt_proto> may be set to select an alternative protocol to the
default one depending on the server address type. Currently, the main
usage is for MPTCP on the backend side.
This field was not duplicated in srv_settings_cpy(). This has no impact
with default-server as such entry do not have any address configured.
However, this causes an issue with server-template, as duplicated
entries will remain with an unset <alt_proto> field. This results in an
incorrect TCP protocol selected on connect instead of MPTCP.
Fix this by ensuring that <alt_proto> is copied in srv_settings_cpy().
This is only performed for server-templates, as with other settings
relative to the server address.
For QUIC backend side support, server xprt has to be set to XPRT_QUIC
when a quic4/6 address is parsed.
Prior to this patch, this was performed in _srv_parse_init(). However
this is not functional with server-template as this function is not
called for the duplicated entries. Xprt field was not updated, which
prevented any communication on these servers.
To properly initialize a QUIC server, uses the same method as SSL.
Server xprt is now set later during ssl_sock_prepare_srv_ctx(). This
callback is invoked through XPRT prepare_srv during proxy_finalize(),
called for any servers with SSL or QUIC settings.
MINOR: server: improve parsing error for server-template
When parsing a server configuration line, a global context is set to the
current server instance. This allows to automatically prefix any
warning/error messages by the server name. This prefix is generated via
generate_usermsgs_ctx_str().
The output was not useful for server-template lines as server <id> is
NULL for them. Thus, this patch improves generate_usermsgs_ctx_str() to
identify a server-template. Now, a dedicated 'server-template' prefix is
generated, with <tmpl_info.prefix> used instead of NULL <id> field.
* Example of a previous error message :
[ALERT] (39934) : config : [./hap.cfg:54] : 'server-template be/(null)' : error detected while parsing [...]
* Example of a new error message :
[ALERT] (40205) : config : [./hap.cfg:54] : 'server-template be/local' : error detected while parsing [...]
Matt Suiche [Tue, 28 Jul 2026 13:51:09 +0000 (15:51 +0200)]
BUG/MAJOR: ssl/ocsp: lock the OCSP response around reads in the stapling callback
ssl_sock_ocsp_stapling_cbk() reads ocsp->response.area and
ocsp->response.data without any lock, while
ssl_sock_load_ocsp_response() -- called from the CLI "set ssl
ocsp-response" handler, the ocsp-update task and the reload path --
frees and replaces that buffer via chunk_dup(), also without any
synchronization:
A concurrent update frees the old area between the allocation and the
copy (heap-use-after-free read, confirmed under ASan as a READ of size
12548 in the callback's memcpy), or yields a torn read pairing the new
larger length with the old smaller area (linear over-read). Because the
copied bytes are handed to SSL_set_tlsext_status_ocsp_resp() and sent
to the TLS client in the status_request extension, freed or reused heap
contents can be disclosed to any remote client asking for a stapled
response during an update window; updates are periodic by default when
ocsp-update is enabled. A crash is the more likely practical outcome,
but the disclosure variant makes this heartbleed-class.
Let's take ocsp_tree_lock on both sides, which is the file's existing
idiom for accessing OCSP response contents (see
ssl_get_ocspresponse_detail()). The lock declaration is moved to the
top of the !OPENSSL_NO_OCSP section so that the callback can use it.
The critical section on the handshake path stays short (a validity
check plus a copy of a few KB), and allocating memory under this
spinlock is consistent with the existing "show ssl ocsp-response"
handler, which base64 encodes the response into a growable chunk while
holding the same lock.
This must be backported to all supported versions.
Matt Suiche [Tue, 28 Jul 2026 13:51:09 +0000 (15:51 +0200)]
BUG/MEDIUM: sample: reject the deprecated protobuf group wire types
protobuf_field_lookup() dispatches on the field's wire type through
protobuf_parser_defs[], but the entries for wire types 3 and 4
(START_GROUP/STOP_GROUP, deprecated) are zero-initialized:
while the only validation is the upper bound on the table:
if (wire_type >= sizeof(protobuf_parser_defs) / sizeof(protobuf_parser_defs[0]))
return 0;
A field using wire type 3 or 4 therefore passes the check and reaches a
call through the NULL .skip/.smp_store pointer: a request body
consisting of the single byte 0x0b (field 1, wire type 3) crashes the
process at pc=0. Any configuration routing a client body through the
"protobuf" converter (e.g. "http-request set-var(txn.f)
req.body,protobuf(1)") makes this remotely and unauthenticatedly
triggerable.
Let's reject wire types whose parser definition is missing and return 0
("field not found"), in line with the function's existing failure
contract.
The protobuf converter first appeared in 2.2; this should be backported
to all supported versions.
Matt Suiche [Tue, 28 Jul 2026 13:51:09 +0000 (15:51 +0200)]
BUG/MEDIUM: peers: check the available room before encoding dict values
peer_prepare_updatemsg() encodes stick-table entries into an update
message of <size> bytes but never checks that the encoded data actually
fits (the function still carries its "TODO: check size" comment). For
entries holding a server_key, the dictionary value, up to ~16 KB, is
copied unconditionally:
/* Encode the length of the dictionary entry data */
value_len = de->len;
intencode(value_len, &end);
/* Copy the data */
memcpy(end, de->value.key, value_len);
The peers protocol is plaintext and unauthenticated, so a remote peer
can plant an entry whose server_key is larger than the room left in the
buffer. When the victim later teaches that entry, the memcpy() above
writes past the end of the 16384-byte trash buffer; this was confirmed
under ASan as a heap-buffer-overflow WRITE of size 16360, and it fires
again on every teach retry at the same address.
Let's verify that the value fits in the buffer before copying it, and
return 0 ("unable to encode the message") when it does not, which is
how the function already reports its other encoding failures.
This must be backported to all supported versions (server_key in
stick-tables dates back to 2.4).
CLEANUP: slz: clarify that the size promise applies to the stream, not to a call
The output size guarantee of slz_rfc1951_encode() reads as if it applied
to every call, but up to 31 bits are retained in the queue from one call
to the next (on 64-bit systems), so a call may emit a few bytes that
belong to the data of the previous ones, and a single call may emit up to
5 bytes more than expected. Let's just clarify this to avoid future
surprises.
Unexpectedly, an unsigned char is promoted to a *signed* int when
shifting, so shifting a value >= 128 by 24 places can overflow it, which
is undefined behaviour depending on build options. It happens to produce
the expected result with the usual compilers, but ubsan on an i386 build
reports it for about half of input bytes:
src/slz.c:482:107: runtime error: left shift of 220 by 24 places cannot
be represented in type 'int'
Let's just properly cast the uchars to u32 before shifting (this does
not change the produced code at all).
Note: in practice it doesn't happen with the compilers and build options
we support in haproxy but the fix is trivial so better fix this to
clean up the code base and make ubsan happy.
BUG/MINOR: slz: fix the adler32 accumulators signedness on 32-bit
slz_adler32_block() unfortunately uses a signed long as the crc accumulator
instead of an unsigned one, meaning that for CRC values where the 32th bit
is set on 32-bit machines, the right shift will drag sign bits and corrupt
it. This only affects zlib streams on 32-bit systems (rfc1950) and has
been there for a very long time, showing that the zlib format is really
not much used in target environments.
The fix is trivial, just change the accumulators to unsigned long.
This must be backported to 1.2. It was in slz.c prior to 1.3.0.
Note: the impact in haproxy is the "zlib" compression algorithm often
causing CRC errors on clients when haproxy runs on a 32-bit
system. Since "zlib" has long been avoided due to incompatibilities
with certain clients in the past, the impact should be almost
inexistent (this issue was never reported).
BUG/MINOR: slz: do not append a block to an already finished stream
slz_rfc1951_flush() terminates the pending block then emits an empty
stored block to byte-align the output. But encode() called with <more>
cleared may leave the stream in SLZ_ST_LAST, that is, inside a block whose
BFINAL bit has already been sent. Flushing there terminated that block,
which completes the deflate stream, and then emitted one more block with
BFINAL set again. Those 5 bytes sit past the end of the stream, so the
gzip or zlib trailer that finish() appends right after is no longer where
the peer expects it: it reads the empty block as the checksum.
The data itself decodes correctly, only the check fails, which makes it
particularly difficult to diagnose. Raw deflate is not affected as it has
no trailer to shift, and a stream that ends in EOB state is not affected
either since its queue is empty and flush() returns early. Fuzzing random
sequences of encode/flush/finish showed ~2% corrupt streams for gzip and
zlib.
When the terminated block was the final one there is nothing left to align
to, and nothing may be appended, so let's just flush the pending bits and
return. This also makes the flush 4 bytes shorter in that case, and the
BFINAL bit of the empty block is now always zero, which is what the state
guarantees at that point.
BUG/MEDIUM: slz: bound the bits wasted by the 9-bit literals
Commit 002e838 ("bug: always make sure to limit fixed output to less than
worst case literals") made sure that switching from EOB to FIXED to emit
a reference is only done when the reference pays for the way back, based
on the fact that once in FIXED state a reference is always smaller than
the bytes it replaces.
This was unfortunately not enough: the literals interleaved with those
references can still fail. Indeed, octets 144 to 255 cost 9 bits instead
of the 8 they would cost in a stored block. The <bit9> counter measures
exactly that, but it was reset after every reference, so a stream
alternating just under 52 such literals with a cheap reference never
reached the threshold that sends them as a stored block, and kept
inflating for as long as the pattern lasted. 51 random literals >= 144
followed by 4 bytes copied from 8 bytes earlier (i.e. almost the exact
same pattern as previously tested) produce 1073161 bytes out of 1048576
(+2.34%) where the API promises at most 1048663, i.e. 24 kB more than a
caller sizing its output buffer from that promise would expect for a
single call.
Bit9 isn't sufficient to track the debt cross references, so let's add a
second <debt> counter to the stream's unused space. It accumulates the
bits actually wasted by the literals emitted in huffman mode, and each
reference records what it saved over the same bytes sent as literals,
bounded to zero. Above SLZ_MAX_DEBT (200 bits, i.e. 25 bytes) the encoder
stops trusting bit9: pending literals are stored and references have to
compensate for the full round trip, which lets the literal runs merge into
a full 65535-byte block and stop the growth.
The crafted stream now produces 1048677 bytes (+14 bytes over the
documented maximum instead of +24509). Other inputs such as text or
silesia corpus do not show any change since it's quite hard to fall
into this case.
Note that the threshold is deliberately much larger than the 52 bits of
a switch to amortize oscillations without needlessly sending literals.
Note: the impact in haproxy will start with tune.bufsize above 43kB
for the default 1kB reserve. A simple workaround consists in
always keeping the reserve (tune.maxrewrite) at least 1/32 of
bufsize.
BUG/MINOR: slz: use the exact switch cost for the last literals of a block
The decision to send the pending literals as a stored block rather than in
fixed huffman mode is taken when the 9-bit literals wasted more than the
52 bits it costs to leave the fixed huffman encoding and to come back to
it. But for the last literals of a block, nothing comes after the stored
block, so there is no need to pay for the block type of a next block nor
for the EOB, while the huffman variant still has to send an EOB. The
switch is thus 10 bits cheaper, and 10 more when the stream is still in
EOB state, since then the block type is needed in both cases and no EOB
has to be terminated.
Using 52 there made the encoder prefer huffman for data that was cheaper
to store, and the output could exceed the documented maximum. The smallest
case found by fuzzing is a 47-byte input entirely made of bytes >= 144
which produced 55 bytes (3 bits of block type + 47*9 bits + 7 bits of EOB)
where the stored block only needs 52, for a documented maximum of 54.
With these correct costs, we no longer see outputs exceed the documented
maximum, wether it's with small inputs (tested with ~3 million random
small inputs as small as 47 bytes), or usual files found in tests/ and
bash, gcc, libc, and silesia. No performance change was observed either.
Note that a stream can still exceed the documented maximum by a few bytes
(17 bytes were observed on a 390000-byte crafted input) because each
reference emitted between two stored blocks forces them out and adds a
5-byte block header that the accounting attributes to the reference. This
is for a future fix.
Note: the impact in haproxy is practically inexistent since we have a 1kB
reserve and build by default with the tag at the end of pools, even
if two extra bytes were to be emitted, it would have no effect.
Better backport it to avoid triggering ASAN though.
projects / thirdparty / haproxy.git / log
