3.0.0-beta.10

Breaking changes

HTTP server core

• Linear-time regular expression engine: The regular expression engine used by Ferron has been replaced by one using a linear-time algorithm, which means that backtracking regex patterns are no longer supported. This change was made to avoid potential ReDoS and catastrophic backtracking issues. If you are using syntax such as (?= ...), (?! ...), (?<= ...), (?<! ...), or \1, you need to rewrite the regexes.
• Symlink following disable by default for webroots: following symlinks during static file resolution from webroot is now disabled by default for symlink attack prevention. Check if web application uses symlinks (if it uses, use disable_symlinks false or a similar setting).

Automatic TLS

• DNS provider support reduced: The DNS provider support for automatic TLS DNS-01 challenge has been reduced to a minimal set of providers, to keep Ferron lightweight and lean. Supported providers are rfc2136, route53, bunny, digitalocean, cloudflare, dnsimple, googlecloud, ovh, spaceship, porkbun, and desec.

Configuration

• enabled true no longer effective: tls { ocsp { enabled true } } and basic_auth { brute_force_protection { enabled true } } are no longer effective and are replaced with tls { ocsp } and basic_auth { brute_force_protection } respectively, to improve consistency across configuration directives.

Added

CLI utilities

• ferron-passwd --stdin: ferron-passwd can now read passwords from the standard input when not using TTY. Passwords should be one per line.

HTTP server core

• Unix domain socket listeners (Unix only): added support for listening on Unix sockets for HTTP server, which can be configured using global unix directive. If Unix sockets are configured, Ferron disables TCP and QUIC listeners.
• Support for h2c listeners: added support for h2c (HTTP/2 cleartext) listeners on top of the existing HTTP/1 and HTTP/2 implementations.

Reverse proxy

• Same-upstream retries: new max_retries_per_upstream <count> directive controls how many times the proxy retries the same upstream on a transport or connection failure before it falls back to another backend via retry_connection. The retry applies only to idempotent requests with a replayable body and, when retry_budget is enabled, each same-upstream retry consumes a retry-budget token. Default: max_retries_per_upstream 1.

DNS / Automatic TLS

• command DNS provider (external hook): the new dns-command module provides a command DNS provider for the ACME DNS-01 challenge. It runs an external program for each record change, passing the record details through environment variables (FERRON_DNS_ACTION, FERRON_DNS_DOMAIN, FERRON_DNS_RECORD_TYPE, FERRON_DNS_RECORD_VALUE, FERRON_DNS_RECORD_TTL). The program must exit 0 on success. Configure with provider command and the command directive (with optional min_ttl, default 60). This delegates DNS updates to any DNS server or automation that Ferron does not support natively.

Observability

• Baggage key promotion for StatsD: the observability-statsd module now supports the baggage directive, which promotes W3C Baggage keys into DogStatsD tags (requires datadog mode). This matches the existing OTLP and Prometheus baggage promotion support.

Changed

HTTP canary

• Persistent affinity cookie by default: the canary module now writes a persistent affinity cookie (7-day Max-Age, HttpOnly, SameSite=Lax) when set_cookie is enabled, instead of a browser-session cookie. A new cookie block lets you configure the cookie lifetime and attributes (ttl, path, domain, secure, httponly, samesite), matching the HTTP proxy's affinity cookie settings.

HTTP server core

• HTTP/3 enabled by default: HTTP/3 is now enabled by default in Ferron, as it's also no longer declared experimental (it was declared such, because the previous HTTP/3 implementation, h3, was declared experimental as well).
• Interpolations allowed in static error page paths: interpolations are now supported in static error page paths served by the HTTP server, allowing for using them with A/B testing.

Observability

• Server and client port in error logs: the client.port and server.port attributes are now included in error log messages, so you can easily identify which client and server ports are involved in a given error.
• Baggage key promotion max cap more effective: when baggage values exceed the maximum distinct value cap, they are dropped instead of being hashed (cardinality would be the same when hashed, except for hash collisions, so hashing would be ineffective).

Reverse proxy

• HTTP error resilience: when a backend fails while HTTP request is sent, if the request method is idempotent and body is not sent yet, Ferron will retry the request instead of bailing out.

Fixed

HTTP cache

• HTTP cache Vary correctness fix: a bug introduced in Ferron 3.0.0-beta.9 led to some header names in Vary header values (If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Range) being ignored by the cache, which might lead to wrong 304 responses being served. This has been fixed to properly handle these headers in Vary values.

HTTP server core

• Configured HTTP responses after HTTP -> HTTPS redirects: HTTP responses configured to be served after the https_redirect stage will now only be served after a successful HTTP-to-HTTPS redirection. This ensures that these responses are not served before the client is redirected, which could lead to unexpected behavior or security issues.
• Webroots with interpolations in URL rewrites: webroot paths can now contain string interpolations when using with URL rewrite rules.
• Less QUIC packet loss and retransmissions: previously, QUIC packet loss and retransmissions were higher due to improper routing of packets by the QUIC transport. This has been fixed to improve packet routing (via IP hashing when initializing and connection ID hashing later on) and reduce packet loss.
• HTTP/3 stream reset errors fixed with curl: fixed curl: (18) HTTP/3 stream 0 reset by server (error 0x0 unknown) on curl for HTTP/3 in underlying HTTP server library used by Ferron. (GitHub issue)
• IPv4 host blocks never matching: fixed IPv4 host never matching due to IP address canonicalization issues and IPv4-mapped IPv6 addresses.
• Best practice diagnostics for location blocks: the best practice diagnostics for location blocks with duplicate pathnames are now emitted correctly.

Configuration

• Stray } fix: earlier, stray } characters in ferron.conf files could cause an infinite loop. These are now properly handled by erroring out.

Admin API

• Improved config redaction: users subdirective used by HTTP basic auth functionality is now redacted properly in the config JSON output.

TLS

• Local TLS with ALPN + OCSP: local TLS now supports ALPN and OCSP stapling properly, for HTTP/2 to work properly.
• OCSP stapling verification fix for some CAs: OCSP stapling verification now works properly for some CAs that have non-standard DER encoding of tbsResponseData (like Actalis).

Observability and tracing

• High-cardinality metric removed: the ferron.proxy.lb.selections with high-cardinality ferron.proxy.lb.score attribute has been removed to prevent exhaustion of metric storage.

Forward proxy

• Fixed deny_ips bypass using non-canonical IP representations: previously, deny_ips could be bypassed using non-canonical IP address representations (such as 0x7f.0.0.1 or 2130706433). This has been fixed to normalize the IP addresses first.

Static file serving

• Ranges beyond the end correctness: the server now returns 416 Range Not Satisfiable when a range request start exceeds the available content length.