|
2 | 2 | <html lang="en"> |
3 | 3 | <head> |
4 | 4 | <meta charset="utf-8" /> |
5 | | - <title>HAProxy version 3.4-dev8-35 - Configuration Manual</title> |
| 5 | + <title>HAProxy version 3.4-dev8-42 - Configuration Manual</title> |
6 | 6 | <link href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" /> |
7 | 7 | <link href="https://raw.githubusercontent.com/thomaspark/bootswatch/v3.3.7/cerulean/bootstrap.min.css" rel="stylesheet" /> |
8 | 8 | <link href="../css/page.css?0.4.2-15" rel="stylesheet" /> |
|
4521 | 4521 |
|
4522 | 4522 | <a class="list-group-item" href="#tune.lua.maxmem">tune.lua.maxmem</a> |
4523 | 4523 |
|
| 4524 | + <a class="list-group-item" href="#tune.lua.openlibs">tune.lua.openlibs</a> |
| 4525 | + |
4524 | 4526 | <a class="list-group-item" href="#tune.lua.service-timeout">tune.lua.service-timeout</a> |
4525 | 4527 |
|
4526 | 4528 | <a class="list-group-item" href="#tune.lua.session-timeout">tune.lua.session-timeout</a> |
|
4886 | 4888 | You can use <strong>left</strong> and <strong>right</strong> arrow keys to navigate between chapters.<br> |
4887 | 4889 | </p> |
4888 | 4890 | <p class="text-right"> |
4889 | | - <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2026/04/03</b></small> |
| 4891 | + <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2026/04/09</b></small> |
4890 | 4892 | </p> |
4891 | 4893 | </div> |
4892 | 4894 | <!-- /.sidebar --> |
|
4897 | 4899 | <div class="text-center"> |
4898 | 4900 | <h1><a href="http://www.haproxy.org/" title="HAProxy"><img src="../img/HAProxyCommunityEdition_60px.png?0.4.2-15" /></a></h1> |
4899 | 4901 | <h2>Configuration Manual</h2> |
4900 | | - <p><strong>version 3.4-dev8-35</strong></p> |
| 4902 | + <p><strong>version 3.4-dev8-42</strong></p> |
4901 | 4903 | <p> |
4902 | 4904 | 2026/04/03<br> |
4903 | 4905 |
|
@@ -7947,6 +7949,7 @@ <h2 id="chapter-2.10" data-target="2.10"><small><a class="small" href="#2.10">2. |
7947 | 7949 | - <a href="#tune.lua.log.loggers">tune.lua.log.loggers</a> |
7948 | 7950 | - <a href="#tune.lua.log.stderr">tune.lua.log.stderr</a> |
7949 | 7951 | - <a href="#tune.lua.maxmem">tune.lua.maxmem</a> |
| 7952 | + - <a href="#tune.lua.openlibs">tune.lua.openlibs</a> |
7950 | 7953 | - <a href="#tune.lua.service-timeout">tune.lua.service-timeout</a> |
7951 | 7954 | - <a href="#tune.lua.session-timeout">tune.lua.session-timeout</a> |
7952 | 7955 | - <a href="#tune.lua.task-timeout">tune.lua.task-timeout</a> |
@@ -10448,6 +10451,36 @@ <h2 id="chapter-3.2" data-target="3.2"><small><a class="small" href="#3.2">3.2.< |
10448 | 10451 | default it is zero which means unlimited. It is important to set a limit to |
10449 | 10452 | ensure that a bug in a script will not result in the system running out of |
10450 | 10453 | memory. |
| 10454 | +</pre><a class="anchor" name="tune.lua.openlibs"></a><a class="anchor" name="3-tune.lua.openlibs"></a><a class="anchor" name="3.2-tune.lua.openlibs"></a><a class="anchor" name="tune.lua.openlibs (Global section)"></a><a class="anchor" name="tune.lua.openlibs (Performance tuning)"></a><div class="keyword"><b><a class="anchor" name="tune.lua.openlibs"></a><a href="#3.2-tune.lua.openlibs">tune.lua.openlibs</a></b> <span style="color: #008">[all | none | <span style="color: #080"><lib></span><span style="color: #008">[,<span style="color: #080"><lib></span>...]</span>]</span></div><pre class="text">Selects which Lua standard libraries are loaded when initialising the Lua |
| 10455 | +state. The argument is a comma-separated list of library names taken from |
| 10456 | +the following set: table, io, os, string, math, utf8, package, debug. The |
| 10457 | +special values "all" and "none" may be used instead of a list. "none" |
| 10458 | +cannot be combined with library names. The default value is "all". |
| 10459 | + |
| 10460 | +The base and coroutine libraries are always loaded regardless of this |
| 10461 | +setting: base provides core Lua functions that HAProxy relies on, and |
| 10462 | +coroutine is required because HAProxy overrides coroutine.create() with |
| 10463 | +its own safe implementation. |
| 10464 | + |
| 10465 | +Note that fork() and new thread creation are already blocked by default in |
| 10466 | +HAProxy regardless of this setting, and can only be re-enabled via the |
| 10467 | +"<a href="#insecure-fork-wanted">insecure-fork-wanted</a>" global directive. Restricting the set of loaded |
| 10468 | +libraries further reduces the attack surface exposed to Lua scripts. In |
| 10469 | +particular: |
| 10470 | + - omitting "os" prevents os.execute() and os.exit() |
| 10471 | + - omitting "io" prevents io.open() and io.popen() |
| 10472 | + - omitting "package" prevents loading native C modules via require() |
| 10473 | + - omitting "<a href="#debug">debug</a>" prevents introspection of HAProxy internals via |
| 10474 | + debug.getupvalue(), debug.getmetatable(), or debug.sethook() |
| 10475 | +</pre><div class="separator"> |
| 10476 | +<span class="label label-success">Examples:</span> |
| 10477 | +<pre class="prettyprint"> |
| 10478 | +<code>tune.lua.openlibs none <span class="comment"># only base + coroutine</span> |
| 10479 | +tune.lua.openlibs string,math,table,utf8 <span class="comment"># safe subset, no I/O or OS</span> |
| 10480 | +tune.lua.openlibs all <span class="comment"># default, load everything</span> |
| 10481 | +</code></pre> |
| 10482 | +</div><pre class="text">This setting must be set before any "<a href="#lua-load">lua-load</a>" or "<a href="#lua-load-per-thread">lua-load-per-thread</a>" |
| 10483 | +directive, otherwise a parse error is returned. |
10451 | 10484 | </pre><a class="anchor" name="tune.lua.service-timeout"></a><a class="anchor" name="3-tune.lua.service-timeout"></a><a class="anchor" name="3.2-tune.lua.service-timeout"></a><a class="anchor" name="tune.lua.service-timeout (Global section)"></a><a class="anchor" name="tune.lua.service-timeout (Performance tuning)"></a><div class="keyword"><b><a class="anchor" name="tune.lua.service-timeout"></a><a href="#3.2-tune.lua.service-timeout">tune.lua.service-timeout</a></b> <span style="color: #080"><timeout></span></div><pre class="text">This is the execution timeout for the Lua services. This is useful for |
10452 | 10485 | preventing infinite loops or spending too much time in Lua. This timeout |
10453 | 10486 | counts only the pure Lua runtime. If the Lua does a sleep, the sleep is |
@@ -35235,7 +35268,7 @@ <h2 id="chapter-12.9" data-target="12.9"><small><a class="small" href="#12.9">12 |
35235 | 35268 | <br> |
35236 | 35269 | <hr> |
35237 | 35270 | <div class="text-right"> |
35238 | | - HAProxy 3.4-dev8-35 – Configuration Manual<br> |
| 35271 | + HAProxy 3.4-dev8-42 – Configuration Manual<br> |
35239 | 35272 | <small>, 2026/04/03</small> |
35240 | 35273 | </div> |
35241 | 35274 | </div> |
|
0 commit comments