Five years after the 2.0 branch was formed, the HAProxy 3.0 load balancer has been released, allowing for the distribution of HTTP traffic and arbitrary TCP requests among a group of servers, taking into account multiple factors (for example, checking server availability, assessing load levels, having DDoS mitigation measures) and performing initial data filtering (such as parsing HTTP headers, filtering out incorrect query parameters, blocking SQL injection and XSS, and integrating content processing agents). HAProxy can also be used to coordinate interactions between components in microservices-based architectures. The project code is written in C and is distributed under the GPLv2 license. The project is used on many major sites, including Airbnb, Alibaba, GitHub, Imgur, Instagram, Reddit, StackOverflow, Tumblr, Twitter, and Vimeo.
The HAProxy 3.0 branch is classified as a long-term support (LTS) release and will be maintained until 2029. Key changes:
- A new section "crt-store" has been added to the configuration for managing the storage and use of TLS certificates. Unlike the previous crt-list setting, the crt-store separates the certificate storage from its use in the frontend, allowing individual storage locations for each of the certificate components (files with certificates, keys, and OCSP data).
- The ability to set limits for requests using HTTP/2, allowed by the protocol but potentially problematic, has been added. For example, sending a CONTINUATION frame stream may lead to a DoS attack known as Continuation flood.
- A new configuration directive "guid" has been added, which can be used in the "frontend", "backend", and "listen" sections. This directive ties a unique identifier to these sections, allowing related statistics to be retained after a restart (the Stats page state will not be reset). A new command "dump stats-file" has been added for saving statistics to a file, and a new configuration directive "stats-file" has been added for reading from the file after a restart.
- Enhanced capabilities for balancing Syslog messages. The ability to assign weight coefficients for server-related strings in backend logs has been introduced.
- Support for logging string formatting in JSON and CBOR format has been added.
- The data that can be retrieved using information extraction functions has been expanded, for example, it is now possible to request details about the number of open HTTP sessions for both backend and frontend, the size of the request processing queue, and the allowed number of simultaneous sessions.
- The performance of single-threaded Lua scripts loaded using the 'lua-load' directive has been increased.
- The performance of in-memory storage areas created using the stick-table directive has significantly improved; for instance, in a system with 80 threads, performance increased by 6 times.
- In configurations with multiple sites, where TLS certificate is selected based on the host identifier passed through the TLS SNI extension, the 'default-crt' argument has been added, allowing a default certificate to be specified which will be used if no matches are found with the available certificates.
- The 'set-fc-tos' and 'set-bc-tos' actions have been added for inserting DS (Differentiated Services) fields into IP packets on the backend or frontend, which determine traffic priority.
- The 'set-fc-mark' and 'set-bc-mark' actions have been added, which allow IP packets to be marked on the backend or frontend, for instance, for later binding to a specific routing table.
- Support for creating identifiers in UUIDv7 format has been added.
- The ability to use the '@virt' prefix to create virtual ACL and Map files, which are not saved to disk, has been implemented. The content of virtual ACL and Map files is added and removed using the Runtime API. The '@opt' prefix is also available, under which virtual files are applied only when the actual file does not exist on disk.
- Changes that break backward compatibility have been introduced: sending multiple commands in a single request to the Runtime API separated by new line characters is prohibited; setting the 'enabled' keyword for dynamic servers; the validation of non-standard URIs has been tightened.
Source: opennet.ru
