Ferron 3.0.0-rc.6 released

Today, we’re releasing Ferron 3.0.0-rc.6, the sixth release candidate version of what it would be Ferron 3.

This release involves optimizations for lower memory usage (both reverse proxy memory leak fix and overall lower memory usage), as well as several correctness and security fixes.

Lower memory usage

I was figuring out why memory usage in Ferron 3 was higher than Caddy…

Until I did several passes of memory usage optimizations, including fix for a reverse proxy memory leak that occurred when connection is returned to the pool (after proxy received the initial response from an upstream. I also fine-tuned default jemalloc memory allocator settings by the way.

Ferron 3.0.0-rc.6 brings lower memory usage as a result of the optimizations. I tested it and I got this:

Workload / benchmark	Protocol / tool	NGINX	Caddy	Ferron 3
Reverse proxy (peak RAM)	HTTP/3 (`tquic_client`)	N/A	≥ 1,000 MB	~600 MB
Static serving (peak RAM)	HTTP/2 multiplex	N/A	N/A	~90 MB (down from 250MB)
Static serving (peak RAM)	HTTP/1.x (`wrk`)	~300 MB	~125 MB	~100 MB
Reverse proxy throughput	HTTP/2 (`h2load`)	N/A	Lower rps	Higher rps (equal RAM)

I also made the initial memory usage (after starting the server) lower. The console, file, OTLP, Prometheus, and StatsD backends now allocate their event channels only when selected by the configuration, instead of pre-allocating ~4 MB each at startup. Idle servers without observability configured use ~20 MB less memory.

Several correctness fixes

I also did several correctness and security fixes listed below:

Admin API

Access control bugfix: fixed access control bug that allowed unauthorized access to the admin API (/reload was gated by reload_get instead of reload before the bugfix).

HTTP server core

Routing bypass fix: previously, a specially-crafted request (with URL-routing) could bypass routing and access files on unintended paths.

Gateway interfaces

PATH_INFO fix: a bug introduced in 3.0.0-rc.4 caused PATH_INFO to not be sent at all by default due to an incorrect check.

Forward proxy

http_version subdirective fix: the http_version subdirective now correctly sets the HTTP version for forwarded requests.
DNS rebinding protection fix: the forward proxy now rejects with 403 (instead of passing the request through to the normal pipeline) when a destination hostname resolves to a denied IP or DNS resolution fails, on both the CONNECT tunnel and absolute-URI forwarding paths. The stage also fails closed with an error status if any other proxy error leaves no response set.
Hop-by-hop header stripping fix: hop-by-hop headers are now stripped from forwarded requests per RFC 7230 section 6.1, so to not forward them to the upstream server.

Ferron 3 stable coming soon

Ferron 3 is approaching even closer to a stable, production-ready web server. This release candidate focuses on improving the overall stability and user experience of Ferron 3.

As always, I welcome feedback, bug reports, and testing results.

Full changelog

You can see the complete changelog for Ferron 3.0.0-rc.6 in the release notes.

Try it

Documentation: https://ferron.sh/docs/v3
GitHub repo: https://github.com/ferronweb/ferron/tree/develop-3.x

Install Ferron 3 using the installer:

sudo bash -c "$(curl -fsSL https://get.ferron.sh/v3)"