These are the highlights of new features or additions to existing features in v4.2.x.
| Table of Contents |
|---|
Websockets support
LinkedIn recently donated an implementation that allows for proxying of WebSockets. It supports the basic upgrade path for a web socket, and is configured using normal remap.config rules:
| Code Block |
|---|
map ws://www.example.com ws://ws.example.com:9090
|
This is still slightly in "experimental" mode, so we're definitely looking forward to hear feedback from people using this.
Jira: TS-2541
ICP support
Traffic Server has had an ICP module for the longest time, which unfortunately has been non-functional. Recent efforts have reactivated this feature again! The same configurations as before applies, nothing has changed in behavior or configuration.
Jira: TS-32
New configuration option for attaching server sessions to client sessions
...
SSL new features and improvements
Change in behavior of proxy.config.ssl.server.honor_cipher_order setting
A bug regarding the behavior of the proxy.config.ssl.server.honor_cipher_order setting has been fixed. When enabled this setting allows the server to pick the preferred cipher used during the TLS or SSLv3 handshake based on the value of the proxy.config.ssl.server.cipher_suite setting.
Previously, a value of 0 enabled this setting, and a value of 1 disabled this setting - the reverse of the expected behavior. ATS previously shipped with a value of 1 (disabled). Starting in 4.2.0, the expected behavior was restored - 1 for enable, 0 for disable. The default in 4.2.0+ is 0, so the out of the box behavior remains the same.
Please verify/update records.config if you migrated this value from an older version of ATS to 4.2.0.
Jira: TS-2370
TLS 1.1 and 1.2 Configurations
There are two new options to turn off or on TLS 1.1 and TLS 1.2. By default TLS 1.2 is off enabled still (value of 01), for now, because of a problem but can be disabled if you experience a crash with TLS 1.2 crashing in openssl . These versions of OpenSSL would experience this problem: 1.0.1, 1.0.1a, 1.0.1b, 1.0.1c, 1.0.1d, and 1.0.1e. There is an open issue with openssl http://rt.openssl.org/Ticket/Display.html?id=3200.
...
| Code Block |
|---|
CONFIG proxy.config.ssl.TLSv1_1 INT 1
CONFIG proxy.config.ssl.TLSv1_2 INT 01 |
Jira: TS-23352355
RFC 5077 TLS Session tickets
...
| Code Block |
|---|
CONFIG proxy.config.ssl.hsts_max_age INT -1
CONFIG proxy.config.ssl.hsts_include_subdomains INT 0
|
Gentoo file layout
Runtimedir on Gentoo changed from /var/run to /run
0 |
Jira: TS-1668
Change in ordering for SSL certificates with same CN
Previous to 4.2.x, for two SSL certificates with the same CN, the last one would be used. This has been changed to properly using the first one as well as issuing a warning about the situation. This will only affect those with multiple SSL Certificates with the same CN, for example a self-signed one and one from a CA.
Configure max TLS record size
The client can decipher the data only once it has received a full record over SSL. The record size can have significant impact on the page load time performance of the application. No limitation on record size means that clients might have to download up to 16KB of data before starting to process them, whereas very small records incur a larger overhead due to record framing. A new configuration has been added to control this:
| Code Block |
|---|
CONFIG proxy.config.ssl.max_record_size INT 0
|
Jira: TS-2365
Add forward secrecy support
Added support for elliptic curve ciphers (http://en.wikipedia.org/wiki/Elliptic_curve_cryptography) which generates a new key per session for enhanced security. To use the elliptic curve ciphers you will need to modify the cipher list with the appropriate ciphers. For example:
| Code Block |
|---|
CONFIG proxy.config.ssl.server.cipher_suite STRING ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:RC4-MD5:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!SRP:!DSS:!PSK:!aNULL:!eNULL:!SSLv2 |
Jira: TS-2372
Release memory for idle SSL sessions
OpenSSL tends to allocate about 50KB of memory for each connection. Setting flag: "SSL_MODE_RELEASE_BUFFERS" can save around 34K per idle SSL connection. This flag has no effect on SSL v2 connections, or on DTLS connections. ref: http://www.openssl.org/docs/ssl/SSL_CTX_set_mode.html .
Jira: TS-2413
Configurable TLS session timeout threshold
Default is 300 seconds. It's good to be configurable so that application can specify the threshold for the expiration of internal session and session ticket. Therefore, this is now configurable with the following configuration option:
| Code Block |
|---|
CONFIG proxy.config.ssl.session_cache.timeout INT 0 |
Jira: TS-2416
Gentoo Layout changes
Runtimedir on Gentoo changed from /var/run to /run
New options for traffic_line
A couple of management options were added to traffic_line, which previously required the use of traffic_shell:
| Code Block |
|---|
root@cosmo 421/0 # traffic_line --status
Proxy -- on
root@cosmo 422/0 # traffic_line --clear_alarms all
No Alarms to resolve
root@cosmo 423/0 # traffic_line --alarms
No active alarms. |
Jira: TS-2533
More details
- Slide deck with more feature / improvement details
If you experience issues
Please take a look at TS-2564 to see if this issue is affecting you.