These are the highlights of new features or additions to existing features in v4.2.x.
New configuration option for attaching server sessions to client sessions
Even though Traffic Server always supported sharing origin server sessions between client sessions, a server session would by default be associated with a Keep-Alive client session for the duration of that client session. This was configurable by limiting the number of server connections (proxy.config.http.server_max_connections). To decouple this overloaded semantics, a new configuration option has been created:
CONFIG proxy.config.http.attach_server_session_to_client INT 0
The default is "0", which means we no longer attach the server sessions to the client by default. This is a change from previous versions of Apache Traffic Server, but it's a reasonable change since it changes what should be considered a broken behavior. Changing this configuration to "1" will not restore the old behavior, but will instead always attach the server sessions regardless of what proxy.config.http.server_max_connections is set to.
Jira: TS-2422
SSL new features and improvements
TLS 1.1 and 1.2 Configurations
There are two new options to turn off or on TLS 1.1 and TLS 1.2. By default TLS 1.2 is off (value of 0), for now, because of a problem with TLS 1.2 crashing in openssl 1.0.1, 1.0.1a, 1.0.1b, 1.0.1c, 1.0.1d, and 1.0.1e. There is an open issue with openssl http://rt.openssl.org/Ticket/Display.html?id=3200.
Update: January 10, 2014 - The openssl issue with TLS 1.2 has been resolved in openssl 1.0.1f (you can enable TLS 1.2 if you update openssl to 1.0.1f). More information is available at http://www.openssl.org/news/vulnerabilities.html#2013-6449 regarding this vulnerability (CVE-2013-6449).
CONFIG proxy.config.ssl.TLSv1_1 INT 1
CONFIG proxy.config.ssl.TLSv1_2 INT 0
Jira: TS-2335
RFC 5077 TLS Session tickets
For supporting RFC 5077 TLS Session tickets across a ATS cluster, all the machines need to have the same server ticket. This adds two new configurations to ssl_multicert.config:
ssl_ticket_enabled=1|0 ticket_key_name=<filename>
Jira: TS-1146
Support for HSTS (HTTP Strict Transport Security)
From WikiPedia: The HSTS Policy is communicated by the server to the user agent via a HTTP response header field named "Strict-Transport-Security". HSTS Policy specifies a period of time during which the user agent shall access the server in only secure fashion. Two new configuration option, which is overridable per remap rule, has been added to Traffic Server:
CONFIG proxy.config.ssl.hsts_max_age INT -1 CONFIG proxy.config.ssl.hsts_include_subdomains INT 0
Jira: TS-1668
Change in ordering for SSL certificates with same CN
Previous to 4.2.x, for two SSL certificates with the same CN, the last one would be used. This has been changed to properly using the first one as well as issuing a warning about the situation. This will only affect those with multiple SSL Certificates with the same CN, for example a self-signed one and one from a CA.
Configure max TLS record size
The client can decipher the data only once it has received a full record over SSL. The record size can have significant impact on the page load time performance of the application. No limitation on record size means that clients might have to download up to 16KB of data before starting to process them, whereas very small records incur a larger overhead due to record framing. A new configuration has been added to control this:
CONFIG proxy.config.ssl.max_record_size INT 0
Jira: TS-2365
Gentoo Layout changes
Runtimedir on Gentoo changed from /var/run to /run
More details
- Slide deck with more feature / improvement details