Changes since version 3.3.10 : Amaury Denoyelle (10): BUG/MINOR: httpclient-cli: fix uninit variable in error label BUG/MINOR: mux_quic: do not exceed stream.max-concurrent on backend side BUG/MINOR: quic: fix ODCID lookup from derived value BUG/MEDIUM: h3: reject client push stream BUG/MINOR: h3: reject server push stream BUG/MINOR: h3: reject client CANCEL_PUSH frame BUG/MINOR: h3: adjust error on PUSH_PROMISE frame reception BUG/MINOR: h3: reject server MAX_PUSH_ID frame BUG/MINOR: h3: add missing break on rcv_buf() BUG/MINOR: quic: reject packet too short for HP decryption Christian Ruppert (1): REGTESTS: Don't try to use real nameservers for testcases Christopher Faulet (21): BUG/MEDIUM: http-client: Only consume input buffer when hc one is empty MINOR: htx: Add htx_move_blks() to move blocks from a message to another BUG/MEDIUM: applet: Fix transfer of HTX data to the applet BUG/MINOR: httpclient-cli: Destroy http-client context if failing to start it BUG/MEDIUM: h1: Skip all h2c values from Upgrade headers during parsing BUG/MINOR: h1: Don't mask websocket protocol if multiple protocols used BUG/MINOR: server: Properly handle init-state value during haproxy startup BUG/MEDIUM: applet: Properly handle receives of size 0 BUG/MEDIUM: resolvers: Fix test on dn label size in resolv_dn_label_to_str() BUG/MEDIUM: ssl-gencert: Unlock LRU cache if failing to generate certificate BUG/MEDIUM: dict: hold lock while decrementing refcount in dict_entry_unref BUG/MINOR: tcpchecks: Limit parsing of agent-check reply to the buffer BUG/MEDIUM: hlua: Fix integer underflow when receiving line from lua cosocket BUG/MEDIUM: mux-fcgi: reject stream ID 0 for application records MINOR: http: Add function to remove all occurrences of a value in a header MINOR: h1: Add a H1M flag to specify a non-empty 'Upgrade:' header was parsed BUG/MEDIUM: h1-htx: Sanitize parsing to properly handle upgrade requests BUG/MINOR: mux-fcgi: Use relative offset to compute contig data in demux buf BUG/MINOR: mux-spop: Use relative offset to compute contig data in demux buf BUG/MINOR: tcpcheck: Check LDAP response to not read more data than available Revert "BUG/MEDIUM: dns: fix long loops in additional records parse on name failure" Ilia Shipitsin (1): BUILD: 51d.c: cleanup, fix preprocessor ifdefs Olivier Houchard (4): MEDIUM: stick-tables: Avoid freeing elements while holding a lock BUG/MEDIUM: servers: Store the connection hash with the parameter cache BUG/MEDIUM: servers: Don't forget to set srv_hash when needed BUG/MEDIUM: cpu-topo: Enforce thread-hard-limit on policy Remi Tricot-Le Breton (2): BUG/MINOR: jws: Add missing return value check (EVP_PKEY_get_bn_param) BUG/MINOR: ocsp: Manage date too far away in the future William Lallemand (2): BUG/MEDIUM: auth: fix unconfigured password NULL deref BUG/MINOR: ssl-gencert: validate SNI characters to prevent SAN certificate injection Willy Tarreau (46): BUG/MEDIUM: dict: hold read lock while incrementing refcount in dict_insert BUG/MINOR: backend: correct parameter value validation in get_server_ph_post() BUG/MINOR: config/dns: properly fail on duplicate nameserver name detection BUG/MEDIUM: dns: fix long loops in additional records parse on name failure BUG/MEDIUM: resolvers: fix name compression pointer validation in resolv_read_name() BUG/MEDIUM: dns: fix memory leak of sockaddr in dns_session_init() error path CLEANUP: proxy: fix tiny mistakes in parse error messages BUG/MINOR: servers: use proper source of pool_conn_name in srv_settings_cpy() BUG/MEDIUM: server/cli: unlock server lock on failure in cli_parse_set_server BUG/MINOR: resolvers: fix dangling list pointer in resolvers_new() error paths BUG/MINOR: dns: fix dangling dgram pointer on dns_dgram_init() failure path BUG/MINOR: resolvers: report the expression error in the do-resolve() action parser BUG/MINOR: resolvers: fix leaked dgram and dns_ring struct in parse_resolve_conf() BUG/MINOR: session/trace: use distinct flags for SESS_EV_END and _ERR BUG/MINOR: check: properly report errno in chk_report_conn_err() BUG/MINOR: jwt: fix possible memory leak in convert_ecdsa_sig() error path DOC: config: further clarify that resolvers "default" exists BUG/MEDIUM: limits: properly account for global.maxpipes in compute_ideal_maxconn() BUG/MINOR: jws: fix OpenSSL 3.0 version check from > to >= BUG/MINOR: server: accept server IDs above 2^31 and clarify error message BUG/MINOR: backend: fix balance hash calculation when using hash-type none BUG/MEDIUM: log-forward: make sure the month is unsigned BUG/MEDIUM: regex: allocate a large enough pcre2 match for all matches BUG/MEDIUM: tcpcheck/spoe: bound the SPOP error code to valid values BUG/MEDIUM: cache: fix a refcount leak for missed secondary entries BUG/MINOR: resolvers: fix room for trailing zero in resolv_dn_label_to_str() BUG/MINOR: resolvers: fix risk of appending garbage past the domain name BUG/MINOR: mux-h2: validate HEADERS frame length before reading stream dep BUG/MINOR: log: look for the end of priority before the end of the buffer BUG/MINOR: dict: fix refcount race on insert collision BUG/MINOR: init: use more than ha_random64() for the cluster secret BUG/MINOR: sample: limit the be2hex converter's chunk size BUG/MEDIUM: h1: drop headers whose names contain invalid chars BUG/MEDIUM: h1: limit status codes to 3 digits by default BUG/MEDIUM: cache: always verify the primary hash in get_secondary_entry() BUG/MINOR: cache: also recognize directives in the form "token=" BUG/MINOR: resolvers: relax size checks in authority record parsing BUG/MINOR: http-fetch: check against the whole token in get_http_auth() BUG/MEDIUM: acme: protect against risk of null-deref on connection failure BUG/MINOR: http-ext: always check remaining data when reading rfc7239 nodeport BUG/MINOR: base64: return empty string for empty input in base64dec() BUG/MINOR: payload: fix the handshake length bounds check smp_client_hello_parse() BUG/MINOR: ssl-hello: make use of the null-terminated servername BUG/MINOR: resolvers: switch to a better PRNG for query IDs BUG/MINOR: addons/51d: NUL-terminate headers before passing them to Trie API BUG/MINOR: hlua: prevent Lua from passing CR/LF/NUL in HTTP headers