Released version 3.5-dev12 with the following main changes :
- CLEANUP: quic: compute the STREAM frame end offset once in qc_stream_frm_is_acked()
- CLEANUP: quic: fix and complete the comments in quic_retransmit.c
- CLEANUP: quic: remove a redundant test in the fast retransmission lookups
- CLEANUP: quic: use QUIC_PACKET_PN_MAXLEN instead of the magic 4
- CLEANUP: quic: remove the dead encryption level variable in qc_prep_hdshk_fast_retrans()
- CLEANUP: quic: drop the intermediate packet tree pointer in the fast retransmissions
- CLEANUP: quic: remove the duplicate qc_prep_hdshk_fast_retrans() prototype
- REGTESTS: protobuf: cover the ungrpc message realignment
- BUG/MINOR: fd: allow fd_write_frag_line() to run before fdtab allocation
- BUG/MINOR: http/hardening: don't count unregistered hdr/tlr too early
- MINOR: http/hardening: turn it to a macro and count matches with COUNT_IF()
- BUG/MEDIUM: stream: reset analyse_exp when analysers are stripped on error
- BUG/MINOR: http-ana: also set FINAL on http-response actions on server error
- BUG/MEDIUM: spoe: stop waiting on a dead producer channel
- BUG/MINOR: tcpcheck: check the number of "hdr" in http-check send
- MINOR: tcpcheck: add post-80-sha2 mode to mysql-check for caching_sha2_password
- BUG/MINOR: stick-table: reject invalid gpc/gpt array indexes
- MEDIUM: h1/violations: restrict valid version strings to "1.0" and "1.1"
- BUG/MEDIUM: filters: avoid NULL block access in decompression
- BUG/MEDIUM: mux-fcgi: do not enforce the timeout on connections with streams
- BUG/MEDIUM: quic: fix loss time selection in quic_loss_pktns()
- BUILD: http: fix build of macro http_harden() with clang
- MINOR: debug: add a COUNT() macro which doesn't take a condition
- CLEANUP: debug/tree-wide: replace COUNT_IF(1, ...) with COUNT()
- BUG/MINOR: applet: accept a temporarily owned tid in appctx_init()
- BUG/MINOR: server: fix a leak when completing a named default-server
- DOC: minor: update VTest2 URL everywhere
- BUG/MEDIUM: compression: use a trash chunk as large as the buffer for the output
- BUILD: debug: fix _COUNT undefinied with USE_OBSOLETE_LINKER
- BUG/MEDIUM: mux-h2: consider the send list as pending data for the timeout
- BUG/MEDIUM: mux-h2: refresh the connection timeout before parking it idle
- BUG/MEDIUM: mux-fcgi: arm the connection timeout only when data remains
- BUG/MEDIUM: mux-fcgi: detect an early connection error during the handshake
- BUG/MEDIUM: mux-fcgi: ignore conn->owner when deciding if a connection is dead
- MINOR: mux-fcgi: check for a dead connection before refreshing the timeout
- MINOR: mux-fcgi: don't add a closed connection to an idle list on detach
- BUG/MEDIUM: mux-h2: also consider the fctl_list as pending data for the timeout
- BUG/MEDIUM: ssl: don't use MSG_MORE for kTLS control records
- MINOR: cli: factorize CLI session reset
- MINOR: cli: store active CLI sessions in a global list
- MINOR: cli: implement basic mechanism for uninterruptible jobs
- MINOR: cli: implement uninterruptible mode for wait
- MINOR: ring: support inactivity timeout in show ring CLI handler
- MINOR: sink: add timeout argument for "show events"
- MINOR: cli: add "kill" CLI command
- REGTESTS: cli: check uninterruptible mode
- CLEANUP: mux-h2: clarify that bptr is not NULL when calling to h2_get_buf()
- BUG/MEDIUM: mux-h2: always return already allocated buffers in h2_get_buf()
- BUG/MEDIUM: mux-h2: permit the buffer callback to allocate despite the queue
- BUG/MEDIUM: mux-h2: wake the connection up after a delayed mbuf allocation
- BUG/MEDIUM: mux-h2: serve all pending buffer allocations in the buffer callback
- BUG/MINOR: mux-h2: unblock the demux when destroying the stream it was blocked on
- BUG/MEDIUM: mux-h2: don't send RST_STREAM for backend streams whose HEADERS were not sent
- BUG/MEDIUM: mux-h2: also emit the HPACK dynamic table size update on requests
- BUG/MINOR: mux-h2: also emit the HPACK Dynamic Table Size Update before trailers
- BUG/MINOR: mux-h2: only convert GET upgrade requests to Extended CONNECT
- BUG/MINOR: mjson: fix out-of-bounds reads on malformed JSON paths
- BUG/MEDIUM: flt-decomp: preserve pending output before decoding again
- REGTEST: ocsp: make the ocsp_client_check test fast
- CI: github: switch development builds back to ubuntu-latest
- CI: github: remove MIPS targets from cross-zoo.yml
- CI: temporarily disable AWS-LC 3.x (fips-2024-09-27)
- CI: github: install libcrypt-dev:i386 for the i686 build
- BUG/MEDIUM: resolvers: detach servers without resolvers from the SRV request
- BUG/MEDIUM: resolvers: don't ignore records not matching a resolve-net family
- BUG/MEDIUM: resolvers: skip the data of ignored additional records
- BUG/MINOR: resolvers: reject a null or negative resolve_retries value
- BUG/MINOR: resolvers: reject null "timeout resolve" and "timeout retry" values
- BUG/MINOR: resolvers: preserve nameserver identity on "clear counters all"
- BUG/MINOR: resolvers: don't dump a nameserver twice in "show resolvers"
- BUG/MINOR: resolvers: Always init a new resolution's list element
- BUG/MINOR: resolvers: count nameserver timeouts
- BUG/MEDIUM: resolvers: reject servers sharing an SRV record with different resolvers
- BUG/MINOR: resolvers: check the SRV expiration date again under the lock
- OPTIM: resolvers: only walk duplicates when looking up an existing record
- BUG/MINOR: resolvers: warn about ignored arguments on datagram nameservers
- BUG/MINOR: resolvers: fix leaks on do-resolve's fetch availability error
- BUG/MINOR: resolvers: report a timeout when a TCP fallback gets no response
- BUG/MINOR: resolvers: use truncated SRV responses when no TCP fallback is possible
- BUG/MEDIUM: resolvers: properly skip root-named authority and additional records
- BUG/MINOR: resolvers: compute a name's wire length by walking its labels
- BUG/MINOR: quic/ssl: record TLS version bounds for certificate selection
- CI: github: pin ARM development builds to Ubuntu 26.04
- BUG/MINOR: cfgparse: detect unsupported crypt() hashes on Debian/Ubuntu
- DOC: configuration: clarify normalize-uri version availability
- BUG/MINOR: ssl/ckch: fix an invalid free() in the domains/ips error paths
- BUG/MINOR: tools: ha_freearray() must also free the array
- CI: github: re-enable AWS-LC 3.x (fips-2024-09-27)
- BUG/MAJOR: quic: don't reference a retired CID from a NEW_CONNECTION_ID frame
- BUG/MINOR: quic: reject RETIRE_CONNECTION_ID for a CID not sent to the peer
- BUG/MINOR: ssl: skip the cipher workaround with AWS-LC API 38 and newer
- BUILD: Makefile: force $(shell command -v ...) to run through the shell
- BUG/MINOR: quic: reject invalid stream ID after MUX closure
- BUG/MEDIUM: quic: limit reject after MUX closure to once per stream
- BUG/MINOR: quic-be: fix Initial token length check on backend connections
- BUG/MINOR: mux_quic: remove dangling qc->qcc ref on MUX init failure
- MINOR: http: add <need_eot> to trailers parsing function
- MINOR: mux_quic: refactor qcs_http_handle_standalone_fin()
- BUG/MINOR: h3: fix missing EOM after trailers without FIN
- BUG/MINOR: h3: close connection on response start-line alloc failure
- BUG/MINOR: h3: fix error code on incomplete request
- BUG/MEDIUM: h3: reject standalone FIN on invalid request/response
- BUG/MEDIUM: threads: don't read lock history entries that don't fit in ulong
- BUG/MINOR: quic-be: drop long header packets with unsupported version
- BUG/MINOR: stick-table: release server_key on any stksess destruction
- BUG/MINOR: acl: check the presence of an argument to "-u"
- BUG/MINOR: server: don't report dyncookie collision on same IP servers
- SCRIPTS: create-release: do not match the word "version" isolated
- MEDIUM: sched: fix the default runqueue-depth
- DOC: security: clarify how to send proper reports
- DOC: threat-model: add a few more entries for stuff that should be public
- DOC: configuration: add a section on secure filtering of HTTP requests
- MINOR: sample: add SMP_USE__MAY_ALIAS to mark fetches returning aliasable contents
- MINOR: http-fetch: mark URI-based sample fetches with SMP_USE__MAY_ALIAS
- MINOR: acl: add acl_cond_find_positive_use() to find positive terms by usage
- MINOR: http-act: mark http-request access control actions with KWF_ACCESS_CTRL
- MINOR: http-rules: accept "no-warn" before the condition of access control rules
- REGTESTS: add a no-warn directive on deny rules using a path
- MEDIUM: http-rules: report access control rules relying on aliasable contents
- MINOR: http: add a global setting to decide on warnings for http rules
- DEBUG: stream: do not emit debug messages for internal proxies
- MINOR: mux-quic: add an sctl() callback to the application ops
- MINOR: mux: add sctl MUX_SCTL_GET_HDNG_FOUND/FIXED to report hardening results
- MINOR: http-fetch: add {fs,bs}.hdng.{found,fixed} to report hardening results
- MINOR: http-conv: add hdng_rej_name to name the HTTP hardening reject rule
- REGTESTS: http-messaging: test the reporting of HTTP hardening results
projects / haproxy.git / commit