Plugins: net/haproxy: plan upgrade to 2.0 release series

[fraenki]

HAProxy 1.9.0 has just been released a few days ago:
https://www.mail-archive.com/[email protected]/msg32143.html

One of the most interesting features is end-to-end HTTP/2 support. But the HAProxy team more or less recommends to wait for the upcoming 2.0 release:

An important point to note, this technical release is not suitable for inclusion in distros, as it will only be maintained for approximately one year (till 2.1 is out). Version 2.0 coming in May will be long-lived and more suitable for distros.

Considering that the 1.9 release may still not be perfectly suited for production use at this point in time, I suggest to wait for 2.0 instead. (We switched from 1.7 to 1.8 too early, this caused trouble for a number of users. Lessons learned.)

Assuming that HAProxy 2.0 arrives in May, my goal is to make the switch in time for OPNsense 19.7 (or an early 19.7.x release).

That being said, it might be OK to switch the development version of os-haproxy to 1.9 already.

[fraenki]

@fichtner FYI, I think we should skip HAProxy 1.9 and wait for 2.0 (see description).

[fraenki]

HAProxy 2.0 was just released some days ago. \o/ We're slowly getting there...

[fichtner]

19.7.3 will have "haproxy" package as 2.0.x. All yours now to proceed. :D

[WhAtEvErYoUmEaN]

I'm confused.
I have updated to 19.7.3 just now and can't seem to enable either TLSv1.3 or backend http/2 via alpn. The config check says it's not supported as opposed to the HAProxy documentation that says it can be passed as a backend bind parameter now.

Did i misunderstand something? Is the haproxy1.8 freeze still active?

---

haproxy -v shows the following:

HA-Proxy version 1.8.21 2019/08/16
Copyright 2000-2019 Willy Tarreau [e-mail]

---

[mimugmail]

TLS 1.3 needs Openssl 1.1.1 which is not supported by OPNsense 19.7 yet, needs 20.1 (12.0)

[fabianfrz]

@mimugmail I have the same issue in nginx. HTTP/2 is working but features like 0-RTT do not work due to missing support of TLS 1.3 in the current crypto library.

BTW: As far as I can remember it is your plugin which blocked the upgrade (net-snmp).

[fichtner]

BTW: As far as I can remember it is your plugin which blocked the upgrade (net-snmp).

Huh?!

On 31. Aug 2019, at 08:39, Fabian Franz BSc [e-mail] wrote:

@mimugmail I have the same issue in nginx. HTTP/2 is working but features like 0-RTT do not work due to missing support of TLS 1.3 in the current crypto library.

BTW: As far as I can remember it is your plugin which blocked the upgrade (net-snmp).

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

[fabianfrz]

@fichtner net-snmp was on the list of packages (provided by FreeBSD) in OPNsense, which did not compile with OpenSSL 1.1.1. Don't know if it works now.

[WhAtEvErYoUmEaN]

Is there any ETA on OPNsense 20.1?

[AdSchellevis]

2020-01 (January next year, according to schedule)

[fraenki]

Is the haproxy1.8 freeze still active?

Yes, we're still on HAProxy 1.8. I'm actively monitoring HAProxy's bug tracker and waiting for some specific bugfixes to arrive before we'll perform the switch to the 2.0 release series. Currently I'm expecting HAProxy 2.0.6 to contain all required bugfixes.

[fraenki]

FWIW, please note that we track TLS 1.3 support in another issue independently from the HAProxy upgrade: https://github.com/opnsense/plugins/issues/790

[fraenki]

My gut feeling says that HAProxy 2.0.6 is right around the corner, so we'll switch to the 2.0 release series when OPNsense 19.7.5 is released (_NOT_ tomorrow's release).