Search filters

Type

Section

Actions

You are using the new documentation layout. Switch to the old layout or learn more.

Choose a topic...
Product Documentation
API Documentation
Configuration Documentation
- Tutorials and examples
- Configuration Manual

Configuration Manual Management Introduction Changelog

Changelog - HAProxy Enterprise 3.2r1

#2025/10/12 : 3.2r1 (1.0.0-353.347)

MINORquicrestore QUIC_HP_SAMPLE_LEN constant
BUG/MINORquictoo short PADDING frame for too short packets
BUILDsslcan't build when using -DLISTEN_DEFAULT_CIPHERS
MINORregexuse a thread-local match pointer for pcre2
BUG/MAJORlb-chashfix key calculation when using default hash-key id
BUG/MINORpoolsdon't report limited to the first X entries by default
BUG/MEDIUMpoolsfix crash on filtered show pools output
TESTSquicuseless param for b_quic_dec_int()
BUG/MINORsslPotential NULL deref in trace macro
BUG/MINORsslFree key_base from global_ssl structure during deinit
BUG/MINORsslFree global_ssl structure contents during deinit

#2025/10/14 : 3.2r1 (1.0.0-353.336)

MINORdebugadd distro name and version in postmortem
BUG/MINORsinkretry attempt for sft server may never occur

#2025/10/12 : 3.2r1 (1.0.0-353.334)

BUG/MEDIUMapppetImprove spinning loop detection with the new API
BUILDmakefiledisable tail calls optimizations with memory profiling
BUG/MINORsslleak crtlist_name in ssl-f-use
BUG/MINORsslleak in ssl-f-use
BUG/MINORsslalways clear the remains of the first hello for the second one
BUG/MEDIUMssltake care of second client hello
BUG/MINOrhluaFix receive from HTTP applet by properly accounting data
BUG/MINORacmeavoid overflow when diff > notAfter
BUG/MEDIUMresolversbreak an infinite loop in resolv_get_ip_from_response()
BUG/MINORh3forbid 'Z' as well in header field names checks
BUG/MINORh2forbid 'Z' as well in header field names checks
BUG/CRITICALmjsonfix possible DoS when parsing numbers
DOCconfigclarify some known limitations of the json_query() converter
BUG/MEDIUMfwlcHandle memory allocation failures.
MEDIUMfwlcMake it so fwlc_srv_reposition works with unqueued srv
MEDIUMserversSchedule the server requeue target on creation
BUG/MEDIUMstick-tablesMake sure not to free a pending entry
MINORmt_listImplement MT_LIST_POP_LOCKED()
BUG/MEDIUMsslca-file directory mode must read every certificates of a file
BUG/MINORpatternFix pattern lookup for map with opt@ prefix
BUG/MINORacmepossible overflow in acme_will_expire()
BUG/MINORacmepossible overflow on scheduling computation
BUG/MINORpatternProperly flag virtual maps as using samples
BUG/MINORcompressionTest payload size only if content-length is specified
MINORssladd the ssl_bc_sni sample fetch function to retrieve backend SNI
BUG/MEDIUMwdtimprove stuck task detection accuracy
MINORschedpass the thread number to is_sched_alive()
MINORschedlet's permit to share the local ctx between threads
BUG/MEDIUMacmefree() of i2d_X509_REQ() with AWS-LC
BUG/MEDIUMacmecfg_postsection_acme() don't init correctly acme sections
BUG/MINORacmedon't unlink from acme_ctx_destroy()
CIgithubbuild halog on the vtest job
BUILDhalogmisleading indentation in halog.c
BUG/MINORpoolsFix the dump of pools info to deal with buffers limitations
BUG/MEDIUMstick-tablesDon't let table_process_entry() handle refcnt
BUG/MINORacme/cliwrong description for acme challenge_ready
MEDIUMresolversmake the process_resolvers() task single-threaded
MEDIUMdnsbind the nameserver sockets to the initiating thread
OPTIMsinkreduce contention on sink_announce_dropped()
BUG/MEDIUMresolversWake resolver task up whne unlinking a stream requester
BUG/MEDIUMresolversAccept to create resolution without hostname
BUG/MEDIUMresolversMake resolution owns its hostname_dn value
BUG/MEDIUMresolversTest for empty tree when getting a record from DNS answer
BUG/MINORresolversRestore round-robin selection on records in DNS answers
BUG/MEDIUMresolversProperly cache do-resolv resolution
MINORtoolsdon't emit +0 for symbol names which exactly match known ones
MINORactivityindicate the number of calls on show tasks
MEDIUMpeersmove process_peer_sync() to a single thread
MEDIUMstick-tablemove process_table_expire() to a single thread
MEDIUMpeersdon't even try to process updates under contention
MEDIUMstick-tablesdon't wait indefinitely in stktable_add_pend_updates()
MEDIUMstick-tablesgive up on lock contention in process_table_expire()
MEDIUMstick-tablesrelax stktable_trash_oldest() to only purge what is needed
MINORstick-tablepermit stksess_new() to temporarily allocate more entries
DEBUGpeersexport functions that use locks
MINORdebugreport the time since last wakeup and call
MINORdebugreport the number of loops and ctxsw for each thread
DEBUGstreamcount the number of passes in the connect loop
MINORdebugreport the process id in warnings and panics
BUG/MINORtcpcheckDon't use sni as pool-conn-name for non-SSL connections
BUG/MINORserverUpdate healthcheck when server settings are changed via CLI
BUG/MEDIUMserverUse sni as pool connection name for SSL server only
MINORserverParse sni and pool-conn-name expressions in a dedicated function
OPTIMstick-tablesexit expiry faster when the update lock is held
MINORstick-tableslimit the number of visited nodes during expiration
BUG/MEDIUMpatternfix possible infinite loops on deletion (try 2)
DEBUGstick-tablesexport stktable_add_pend_updates() for better reporting
BUG/MEDIUMringinvert the length check to avoid an int overflow
BUG/MINORresolversalways normalize FQDN from response
BUG/MINORocspCrash when updating CA during ocsp updates
BUG/MEDIUMhttp_anafix potential NULL deref in http_process_req_common()
BUG/MINORocspprototype inconsistency
BUG/MINORsslFix potential NULL deref in trace callback
BUG/MINORsslPotential NULL deref in trace macro
BUG/MEDIUMjwsreturn size_t in JWS functions
BUG/MINORacmenull pointer dereference upon allocation failure
BUG/MAJORstreamForce channel analysis on successful synchronous send
BUG/MAJORstreamRemove READ/WRITE events on channels after analysers eval
BUG/MINORstick-tablemake sure never to miss a process_table_expire update
BUG/MEDIUMstick-tablesdon't loop on non-expirable entries
BUG/MINORactivityfix reporting of task latency
BUG/MEDIUMsslcreate the mux immediately on early data
BUG/MEDIUMh1Allow reception if we have early data
BUG/MEDIUMchecksfix ALPN inheritance from server
OPTIMcheckdo not delay MUX for ALPN if SSL not active
BUG/MEDIUMmux-h2Reinforce conditions to report an error to app-layer stream
BUG/MEDIUMmux-h2Report RST/error to app-layer stream during 0-copy fwding
BUG/MINORmux-h2Remove H2_CF_DEM_DFULL flags when the demux buffer is reset
BUG/MEDIUMmux-h2Restart reading when mbuf ring is no longer full
BUG/MEDIUMmux-h2; Don't block reveives in H2_CS_ERROR and H2_CS_ERROR2 states
BUG/MEDIUMmux-h2Reset MUX blocking flags when a send error is caught
CLEANUPquicfix typo in quic_tx trace
BUG/MINORcpu_topowork around a small bug in musl's CPU_ISSET()
BUILDtracesilence a bogus build warning at -Og
BUG/MINORlogfix potential memory leak upon error in add_to_logformat_list()
BUG/MINORconnectionstreamline conn detach from lists
BUG/MEDIUMconnfix UAF on connection after reversal on edge
REGTESTSexplicitly use balance roundrobin where RR is needed
BUG/MINORcheckfix dst address when reusing a connection
BUG/MINORcheckensure check-reuse is compatible with SSL
BUG/MEDIUMpeersdon't fail twice to grab the update lock
BUG/MINORstick-tablesnever leave used entries without expiration
BUG/MEDIUMstick-tablesdon't leave the expire loop with elements deleted
MINORquicAdd more information about RX packets
BUILDaclsilence a possible null deref warning in parse_acl_expr()
BUG/MINORhaproxybe sure not to quit too early on soft stop
BUG/MINORquicfix padding issue on INITIAL retransmit
BUG/MINORquicfix room check if padding requested
BUG/MINORquicignore AGAIN ncbuf err when parsing CRYPTO frames
BUG/MINORtoolsAdd OOM check for malloc() in indent_msg()
BUG/MINORcompressionAdd OOM check for calloc() in parse_compression_options()
BUG/MINORcfgparseAdd OOM check for calloc() in cfg_parse_listen()
BUG/MINORaclAdd OOM check for calloc() in smp_fetch_acl_parse()
BUG/MINORlogAdd OOM checks for calloc() and malloc() in logformat parser and dup_logger()
BUG/MINORhalogAdd OOM checks for calloc() in filter_count_srv_status() and filter_count_url()
BUG/MEDIUMserverDuplicate healthcheck's alpn inherited from default server
REG-TESTSmap_redirectDon't use hdr_dom in ACLs with -m end matching method
BUG/MAJORmux-quicfix crash on reload during emission
BUG/MEDIUMquicCRYPTO frame freeing without eb_delete()
CLEANUPquicremove a useless CRYPTO frame variable assignment
MINORdocadd missing statistics column
MINORdocadd missing statistics column
DOCconfigurationconfuse strict-mode with zero-warning
DOCunreliable sockpair@ on macOS
BUILDmworkerfix ignoring return value of read
BUG/MINORserverdecrement session idle_conns on del server
BUG/MINORconnectionremove extra session_unown_conn() on reverse
BUG/MINORconnectionrearrange union list members
BUG/MEDIUMmworkerfix startup and reload on macOS
BUG/MINORaclset arg_list->kw to aclkw->kw string literal if aclkw is found
BUG/MINORmux-quictrace with non initialized qcc
MINORquicremove ->offset qf_crypto struct field
DOCconfigurationclarify 'default-crt' and implicit default certificates
MINORssldiagnostic warning when both 'default-crt' and 'strict-sni' are used
BUG/MINORquicreorder fragmented RX CRYPTO frames by their offsets
MINORsampleAdd base2 converter
MINORsampleAdd le2dec (little endian to decimal) sample fetch
MINORhapee/daremove STG_LOCK INITCALL
MINORhapee/51dremove STG_LOCK INITCALL
BUG/MINORhapeefix module bind_parse callback prototype
MEDIUMhapee/51duse '_' instead of '-' in 51d-set-property-vars() names
MEDIUMhapee/51dset version and date metadata variables
REORGhapee/51dCreate a function for setting property variables
MEDIUMhapee/51dadd a new action http-request 51d-set-property-vars
MINORhapee/WURFLtransfer error status from the _wurfl_reload() function
MINORhapee/WURFLadded live update database function
MINORhapee/WURFLadded custom API log function
MINORhapee/WURFLadded function to check correct module initialization
BUG/MINORhapee/WURFLcorrected version check of used wurfl library
MINORhapee/daalert in case of incorrect data version
BUG/MINORhapee/daenabling use of precompiled json database in 'deviceatlas-json-file'
BUG/MINORhapee/dafixed bug when using binary version of database
BUG/BUILDhapee/daadded preprocessed source code generation for *.cpp files
BUILDhapee/darepaired build in case of using old DeviceAtlas library
MINORhapee/daadd function that allow data reload
MINORhapee/daadd spin locking
MINORhapee/daadd support for loading a precompiled json data
MEDIUMhapee/daRevert MEDIUM: da: update module to handle schedule mode.
MEDIUMhapee/51dsupport data reload for 51Degrees V4 engine
MINORhapee/51dadd function that returns path to 51Degrees data file
MINORhapee/51dadd function that allow data reload
BUG/MINORhapee/51dadd spin locking
BUILDhapee/51dfix error when building with 51Degrees enabled
BUG/MEDIUMhapee/51dfix a segfault on exit when 51d configuration is not loaded
MEDIUMhapee/51duse fiftyoneDegreesProvider to access the pool and dataset
BUG/MEDIUMspoeImprove error detection in SPOE applet on client abort
BUG/MEDIUMhttp_anahandle yield for stats http-request evaluation
BUG/MEDIUMmux-spopReject connection attempts from a non-spop frontend
MINORhttp_anafix typo in http_res_get_intercept_rule
MINORquiccentralize padding for HP sampling on packet building
BUG/MINORquicdon't coalesce probing and ACK packet of same type
BUG/MAJORquicfix INITIAL padding with probing packet only
BUG/MINORquicdo not emit probe data if CONNECTION_CLOSE requested
BUG/MEDIUMquicreset padding when building GSO datagrams
MINORdnsdns_connect_nameserver: fix fd leak at error path
BUG/MEDIUMsslapply ssl-f-use on every ssl bind
BUG/MEDIUMmux-h2fix crash on idle-ping due to unwanted ABORT_NOW
BUG/MEDIUMmworkermore verbose error upon loading failure
BUG/MEDIUMcliReport inbuf is no longer full when a line is consumed
BUG/MINORspoeProperly detect and skip empty NOTIFY frames
MEDIUMdnsdon't call connect to dest socket for AF_INET*
BUG/MINORmux-h1fix wrong lock label
BUG/MEDIUMquiclistener connection stuck during handshakes (OpenSSL 3.5)
MINORquicimplement qc_ssl_do_hanshake()
BUG/MEDIUMRemove sync sends from streams to applets
BUG/MEDIUMstconnFix conditions to know an applet can get data from stream
BUG/MEDIUMhttp-clientTest HTX_FL_EOM flag before commiting the HTX buffer
BUG/MEDIUMmux-quicadjust wakeup behavior
DOCconfigrecommend single quoting passwords
DOCmanagementfix typo in commit f4f93c56
BUG/MINORinitInitialize random seed earlier in the init process
BUG/MEDIUMsslfix build with AWS-LC
BUG/MEDIUMsslFix 0rtt to the server
MINORsockupdate broken accept4 detection for older hardwares.
BUG/MINORstick-tablecap sticky counter idx with tune.nb_stk_ctr instead of MAX_SESS_STKCTR
BUILDcompatalways set _POSIX_VERSION to ease comparisons
BUILDcompatprovide relaxed versions of the MIN/MAX macros
DOClist missing global QUIC settings
CLEANUPhttp-clientRemove useless indentation when sending request body
BUG/MINORmux-quicensure close-spread-time is properly applied
BUG/MINORhq-interopfix FIN transmission
BUG/MINORlogsfix log-steps extra log origins selection
BUG/MEDIUMthreadsDisable the workaround to load libgcc_s on macOS
BUG/MINORhalogexit with error when some output filters are set simultaneosly
BUG/MINORappletDon't trigger BUG_ON if the tid is not on appctx init
MINORh3remove unused outbuf in h3_resp_headers_send()
BUG/MINORquicWrong source address use on FreeBSD
BUG/MEDIUMh3handle interim response properly on FE side
MINORqmuxchange API for snd_buf FIN transmission
BUG/MINORh3ensure that invalid status code are not encoded (FE side)
BUG/MINORh3properly realloc buffer after interim response encoding
BUG/MEDIUMh3do not overwrite interim with final response
BUG/MINORh1-htxDon't forget to init flags in h1_format_htx_msg function
BUG/MINORmux-h1Use configured error files if possible for early H1 errors
MINORh1-htxAdd function to format an HTX message in its H1 representation
BUG/MEDIUMhttp-clientNotify applet has more data to deliver until the EOM
BUG/MEDIUMhttp-clientDrain the request if an early response is received
BUG/MINORhttp-clientReject any 101-switching-protocols response
BUG/MINORhttp-clientIgnore 1XX interim responses in non-HTX mode
BUG/MEDIUMhttp-clientAsk for more room when request data cannot be xferred
BUG/MEDIUMhttp-clientProperly inc input data when HTX blocks are xferred
BUG/MEDIUMhttp-clientDon't wake http-client applet if nothing was xferred
BUG/MEDIUMquicCrash after QUIC server callbacks restoration (OpenSSL 3.5)
MINORquicPrevent QUIC build with OpenSSL 3.5 new QUIC API version < 3.5.1
BUG/MINORlistenerreally assign distinct IDs to shards
MEDIUMssl/clirelax crt insertion in crt-list of type directory
DOCmanagementclarify usage of -V with -c
MEDIUMacmeuse lowercase for challenge names in configuration
BUG/MINORacmepossible integer underflow in acme_txt_record()
MINORacmeupdate the log for DNS-01
MEDIUMacmeallow to wait and restart the task for DNS-01
MINORacmeemit the DNS-01 challenge details on the dpapi sink
MINORacmeemit a log for DNS-01 challenge response
BUG/MEDIUMhlua_fcnensure systematic watcher cleanup for server list iterator
BUILDacmeavoid declaring TRACE_SOURCE in acme-t.h
CLEANUPsslRename ssl_trace-t.h to ssl_trace.h
BUG/MEDIUMmux-quicensure Early-data header is set
BUG/MINORhluatake default-path into account with lua-load-per-thread
BUG/MEDIUMlogsfix sess_build_logline_orig() recursion with options
BUG/MEDIUMdnsReset reconnect tempo when connection is finally established
BUG/MEDIUMhluaReport to SC when output data are blocked on a lua socket
BUG/MEDIUMhluaReport to SC when data were consumed on a lua socket
BUG/MINORhluaSkip headers when a receive is performed on an HTTP applet
MINORacmeimplement traces
MINORacmeadd ACME to the haproxy -vv feature list
CLEANUPacmefix wrong spelling of resources
BUG/MINORacmeallow processing in challenge requests
MINORacmeremove acme_req_auth() and use acme_post_as_get() instead
BUG/MEDIUMacmeuse POST-as-GET instead of GET for resources
BUG/MEDIUMssl/clienthelloECDSA with ssl-max-ver TLSv1.2 and no ECDSA ciphers
DOCdeviceatlas build clarifications
BUILD/MEDIUMdeviceatlasfix when installed in custom locations.
BUG/MINORhttp-actFix parsing of the expression argument for pause action
BUG/MINORsslcrash in ssl_sock_io_cb() with SSL traces and idle connections
BUG/MINORssl/ocspfix definition discrepancies with ocsp_update_init()
BUG/MINORquicMissing TLS 1.3 QUIC cipher suites and groups inits (OpenSSL 3.5 QUIC API)
CIgithubupdate to OpenSSL 3.5.1
BUG/MEDIUMquicSSL/TCP handshake failures with OpenSSL 3.5
BUILDquicQUIC build against OpenSSL 3.5 broken
CIgithubupdate the stable CI to ubuntu-24.04
CIgithubadd an OpenSSL 3.5.0 job
CIenable USE_QUIC=1 for OpenSSL versions >= 3.5.0
BUG/MINORproto-tcpTake care to initialized tcp_md5sig structure
BUILDcfgparse-tcpAdd _GNU_SOURCE for TCP_MD5SIG_MAXKEYLEN
MINORproto-tcpAdd support for TCP MD5 signature for listeners and servers
BUILDdev/phashremove the accidentally committed a.out file
BUG/MINORhttpclientwrongly named httpproxy flag
DOCFix 'jwt_verify' converter doc
BUG/MINORjwtCopy input and parameters in dedicated buffers in jwt_verify converter
BUG/MEDIUMmux-h2Properly handle connection error during preface sending
BUG/MEDIUMhluaForbid any L6/L7 sample fetche functions from lua services
MINORsslcheck TLS1.3 ciphersuites again in clienthello with recent AWS-LC
BUG/MINORtoolsuse my_unsetenv instead of unsetenv
SCRIPTSdrop the HTML generation from announce-release
DOCconfigcrt-list clarify default cert + cert-bundle
MINORquicUseless TX buffer size reduction in closing state
BUG/MINORquicwrong QUIC_FT_CONNECTION_CLOSE(0x1c) frame encoding
DOCconfigurationadd details on prefer-client-ciphers
BUG/MINORlogBe able to use %ID alias at anytime of the stream's evaluation
BUG/MINORstreamAvoid recursive evaluation for unique-id based on itself
BUG/MINORtoolsonly reset argument start upon new argument
MINORfwlcFactorize code.
BUG/MAJORfwlcCount an avoided server as unusable.
BUG/MINORmux-quic/h3properly handle too low peer fctl initial stream
DOCconfigprefer-last-server: add notes for non-deterministic algorithms
BUG/MEDIUMcheckSet SOCKERR by default when a connection error is reported
MINORclihandle EOS/ERROR first
BUG/MEDIUMcliDon't consume data if outbuf is full or not available
BUG/MINORquicFix OSSL_FUNC_SSL_QUIC_TLS_got_transport_params_fn callback (OpenSSL3.5)
BUG/MINORhttp-anaProperly handle keep-query redirect option if no QS
BUG/MINORconfig/serverreject QUIC addresses
BUG/MINIRh1Fix doc of 'accept-unsafe-...-request' about URI parsing
BUG/MEDIUMfdUse the provided tgid in fd_insert() to get tgroup_info
BUG/MINORquicMissing SSL session object freeing
BUG/MINORconfigfix arg number reported on empty arg warning
BUG/MINORconfigemit warning for empty args only in discovery mode
BUG/MEDIUMcliProperly parse empty lines and avoid crashed
BUG/MINORmux-spopFix null-pointer deref on SPOP stream allocation failure
BUG/MEDIUMcheckRequeue healthchecks on I/O events to handle check timeout
BUG/MAJORleastconnProtect tree_elt with the lbprm lock
DOCconfigFix a typo in 2.7 (Name format for maps and ACLs)
BUILDtoolsproperly define ha_dump_backtrace() to avoid a build warning
MINORhapee/modulesreport the per-stream allocated size for each module
BUG/MEDIUMhapeeprevent the module file name being overwritten
MEDIUMhapeeHAPEE_MODULE_DECLARE() allows to declare an HAPEE module
BUG/MINORhapeeMakefile: bad substitution for MODVERSION variable
BUG/MINORhapeerelax __vers symbol check
BUG/MINORhapee/modulescan't load modules with USE_OBSOLETE_LINKER
BUG/MINORhapeeremove leading \n on __vers error
MEDIUMhapeewarn on unsupported initcalls
BUG/MINORhapeeforbid to load a module twice
HAPEEudpupdate structs and functions required for the UDP module
HAPEEmakefileautomatically build objects in addons/hapee_*
HAPEEmakefileupdate the cleanup rule to also remove *.i from addons
HAPEEaddonsquic CID in -vv
HAPEEaddonsadds quic CID generator to interop with packetshield
MEDIUMhapeedoes not pass OPTION_LDFLAGS to modules
MINORhapee/modulescheck if we generate the API hash correctly
BUG/MINORhapee/modulesadjust include match() in gen-modules-config-h.awk
BUG/MINORhapee/modulesinitialize the module head list
BUILDhapee/modulesselect either md5 or md5sum
MEDIUMhapee/modulesload the STG_REGISTER initcalls
BUG/MINORhapee/modulesdisplay detailed error message on mod_init() failure
MINORhapee/modulesadd a new label MODULES_LOCK to the lock_label enum
MINORhapee/modulesadd the ability to register variable and functions.
MEDIUMhapee/modules'modules list' on the cli shows currently loaded modules
MINORhapee/modulesterminate properly loaded modules if possible
MEDIUMhapee/modulesadd memory reservation support for the modules
MINORhapeechange URLs for 3.2r1
BUILDhapee/modulesupdate HAPEE version macro to 3.2r1
BUILDhapee/modulesadd macros to compute numerical value of a HAPEE version
BUILDhapee/modulesadd version of the module in the defines
MEDIUMhapee/modulesadd modules support