When configuring an HA environment with a new VRRP (Virtual Router Redundancy Protocol) interface, VRRP may incorrectly continue advertising IP addresses from the previously configured interfaces, causing stale information to appear in 'show redundancy detail'.

While adding replication/DR to a broker that is part of a DMR network messages destined to that broker from other brokers in the DMR network may be lost.

Running config-sync assert-leader on a standby HA broker for a DMR message VPN triggers the DMR state for the VPN to bounce on the active broker which could result in message loss.

Broker instances supporting the PSK-AES256-GCM-SHA384 cipher will use it instead of PSK-AES256-CBC-SHA for broker to broker connections supporting PSK ciphers.

In rare cases a broker that is part of a DMR network may allow a DMR VPN to come up before the broker has finished learning subscriptions for the VPN from the rest of the network. This may result in message loss.

A broker configured with 3 billion queue messages that is spooling messages in partitioned queues or messages with a User Data message header may enter a continuous reboot loop if those messages are consumed following a reboot.

A transacted session may be leaked if the client disconnects before a broker reboot or failover, and while the associated objects for the session are not yet released.

Shutting down and re-enabling service msg-backbone would cause the Solace broker to ignore {{request-client-certificate "never"}} on VPNs. This affects both software and hardware brokers.

* On HA brokers, failover and fallback will clear this condition.

Solace appliances in direct messaging only HA can failover unexpectedly after an appliance reboots.

This can happen if the redundancy interface on the appliance takes a while to come up after the reboot.

The broker may not resume delivery of messages to all AMQP consumers following a period of very high NAB buffer utilization.

In rare cases, when messages are spooled to disk, a race condition can cause message corruption and a broker reboot.

DMR brokers with large numbers of ACL exceptions and/or trace filters configured may not be able to accept subscriptions advertised by their DMR neighbors resulting in message loss.

The active broker of a High Availability (HA) redundant group of software brokers may briefly give up activity if the standby broker is restarted.

In previous releases, SEMPv2 permissively allowed invalid Content-Encoding header. Beginning in release 10.10.0, the broker will enforce valid Content-Encoding headers. If the header is specified it must include only a single value. either 'gzip' or 'x-gzip'.

In previous releases, SEMPv2 compressed multi-part requests were not supported, but would succeed for some SEMPv2 requests. Beginning in release 10.10.0 requests that previously succeeded will now fail. Solace recommends using either compressed singular requests, or uncompressed multi-part requests.

This change affects the AWS Machine Image (AMI) packaging of PubSub+. When an SSH connection attempt is made to a PubSub+ instance created from the AMI, the allowed cryptographic algorithms have been restricted to more secure options. The AMI cipher list now exclusively includes AES-GCM ciphers (aes256-gcm@openssh.com and aes128-gcm@openssh.com), replacing the previous broader range that included potentially less secure options. Furthermore, the Key Exchange Algorithms for the AMI have been updated to utilize only the following algorithms in this specific order: curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group18-sha512, diffie-hellman-group16-sha512, diffie-hellman-group-exchange-sha256. The minimum modulus size for Diffie-Hellman key exchange has also been increased from 1024 bits to 3072 bits.

If you reference the "EventThreshold", "EventThresholdByPercent" or "EventThresholdByValue" definitions inside the SEMPv2 API SPEC file (by name) then you will have to change your references to one of the new definition names in your application.

This does NOT impact the wireline protocol. This does NOT break existing applications. This only impacts:

* programs that parse the SEMPv2 API SPEC and look for those definitions, and are given a newer version of the API SPEC;

* programs that use auto-generated libraries based upon our SEMPv2 API SPEC +and;+

** are recompiled with a newer auto-generated library created from a newer version of the SEMPv2 API SPEC +and;+

** reference the "EventThreshold", "EventThresholdByPercent" or "EventThresholdByValue" classes inside the auto-generated library code.

----

Some definitions in the SEMPv2 API SPEC have been split. Specifically, the "EventThreshold", "EventThresholdByPercent" and "EventThresholdByValue" will all be split into dozens of classes.

For example, in our current generated SEMPv2 API SPEC, the "EventThreshold" referenced by the "Broker" property named "guaranteedMsgingEventCacheUsageThreshold" will now be called "BrokerGuaranteedMsgingEventCacheUsageThreshold".

----

Changing your application source code from the old class name to the new class name will enable your application to compile with a newer generated API library.

This issue applies to Solace PubSub+ software event broker machine images only.

The software event broker is vulnerable to CVE-2018-5407.

Disable SMT/Hyper-Threading on the event broker host.

Messages queued at the replication standby site will not be moved to the dead message queue (DMQ) when they expire at the replication active site.

Bridges configured with an active/standby role of 'auto' may fail to connect following a redundancy failover if the broker's active-standby-role configuration is modified after creating the 'auto' bridge.

Rebooting the broker two times will correct the issue.

The broker may disconnect slow subscribers when its NAB Buffer Load Factor exceeds 85%, before the expected 100% level at which slow subscribers are typically disconnected.

The rate at which a broker can accept connections may be lower than expected when using LDAP authorization.

When the message spool disk is full for HA software brokers, message spool defragmentation will fail, as expected, but with the incorrect error message.

Endpoints with many messages require more time to trim than expected (replay-log trimming included).

SolOS will fail to boot if the search list for host-name lookup in /etc/resolv.conf is larger than 245 characters.

If you are upgrading brokers that are part of a DMR network to version 10.1.1 or newer from version 9.5 or older, cluster links will not be operational after the upgrade. Solace recommends upgrading to 10.0.1 first, and then upgrading to 10.1.1 and newer.

Alternatively, after a direct upgrade between the affected versions, dynamic-message-routing can be disabled and re-enabled on each message-vpn to recover the cluster links. Note that this operation will cause a brief DMR service outage.

When performing an HA broker upscale, redundancy will not recover if the primary and backup are upscaled back to back immediately with no delay.

Add a delay of 60 seconds between upscaling the primary and backup broker after step 7 of the upscale procedure (https://docs.solace.com/Software-Broker/Set-Scaling-Params-HA.htm#Step_2__Increase_the_Value_of_the_Scaling_Parameter(s)).

SolOS will fail to start up if an invalid SSL certificate is configured via config-keys.

The PubSub+ Software Event Broker needs larger TCP rmem/wmem settings to support multi-node routing neighbors across high RTT WAN links.

Original bug: Bug 63008

The PubSub+ Software Event Broker erroneously allows more user-created message-VPNs than are officially supported within the broker. This applies to all editions (Enterprise, Standard, and Evaluation). In a future release, this limit will be strictly enforced.

If the backup appliance in an active-active HA configuration is restarted while the message spool is disabled, re-enabling the message-spool will fail if one or more replay logs exist in the setup. This issue applies to Solace PubSub+ appliances only.

Set the active-standby redundancy role of the backup appliance to 'backup' prior to the restart. After the restart, set the active-standby role back to 'none'.

WebUI login passwords can only accept the printable ASCII character set. Extended characters like auoAUOss do not work.