Changes since version 3.3.13 : Alexander Stephan (1): BUG/MEDIUM: counters: preserve shared.tg pointer on 'clear counters all' Amaury Denoyelle (4): BUG/MINOR: server: check strdup return value on server ID BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup BUG/MEDIUM: quic: prevent out-of-bound read on wrapping CRYPTO content BUG/MINOR: quic: drop multiple Retry on same connection Aurelien DARRAGON (5): MINOR: log/tools: fix ambiguous comments for some log encoding helpers BUG/MEDIUM: log: always reserve room for trailing 0 when using CBOR encoding helpers BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string BUG/MEDIUM: hlua_fcn: ensure systematic bref cleanup for patref list iterator BUG/MEDIUM: stats-file: fix shm-stats-file recover when all process slots are full Austin Kauffman (1): BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters Christopher Faulet (6): BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering BUG/MINOR: config: Check buffer pool creation for failures BUG/MINOR: hlua: Properly enable/disable receives for TCP applets BUG/MINOR: tcpcheck: Don't release ruleset when parsing 'spop-check' ruleset BUG/MEDIUM: tools: make string encoding possible to fail instead of truncating BUG/MINOR: flt-http-comp: Don't read next block to detect end of data Frederic Lecaille (2): BUG/MINOR: server: fix off-by-one error when parsing and copying source port range BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB) Kirill Furman (1): BUG/MINOR: log: fix double-free error when error in parse_loger occurs Mani Goyal (1): BUG/MEDIUM: http: fix authority parsing for absolute-form URI with empty path Manu Nicolas (1): BUG/MINOR: resolvers: accept fields at the response boundary Miroslav Zagorac (1): BUG/MINOR: ot: removed dead code in flt_ot_parse_cfg_str() Olivier Houchard (12): BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd" BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start BUG/MINOR: mux-fcgi: don't call fcgi_strm_destroy() on a NULL stream BUG/MEDIUM: http-ana: don't crash on "keep-query" in a response redirect BUG/MEDIUM: stick-tables: use the same bucket for string keys with a NUL BUG/MEDIUM: sock: bound the recvmsg() length when receiving old sockets BUG/MEDIUM: http-ana: check the cookie rewrite result before moving the offsets BUG/MINOR: mux-fcgi: sanitize the STDERR records before logging them BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode BUG/MEDIUM: mux-fcgi: check the room left before appending the index BUG/MEDIUM: mux-h1: close the connection on a short content-length MEDIUM: mux-h2: don't report EOM on a short content-length message Remi Tricot-Le Breton (8): BUG/MINOR: jwt: don't take an extra reference on the certificate public key BUG/MEDIUM: ssl: require a full-length AEAD tag when decrypting with AES-GCM BUG/MINOR: conn: Do not check 'sess_el' list on frontend connections in __trace_enabled BUG/MINOR: ssl: Fix leak of X509_NAME in traces BUG/MINOR: ssl: release the previous client cert reference at depth > 0 BUG/MEDIUM: ssl: Fix unprotected 'ssl_sock_choose_sni_ctx' calls BUG/MINOR: jwt: Missing 'jwt_tokenize' return value check MINOR: jwt: Improve 'jwt_tokenize' function Rémi Tricot-Le Breton (2): BUG/MEDIUM: cache: retain the primary or secondary entry only when detaching its row BUG/MEDIUM: cache: do not release an entry under the cache read lock William Lallemand (22): BUG/MINOR: ech: propagate error from load_echkeys() BUG/MINOR: ech: reject an ECH store with no usable private key BUG/MEDIUM: acme: don't delete a NULL token from the map BUG/MINOR: ssl: reject server certificate names containing a NUL byte BUG/MINOR: acme: restrict the permissions of the generated account key DOC: config: clarify req.ssl_sni BUG/MINOR: ssl: reject an embedded NUL in the ssl_*_dn(entry) fetches BUG/MINOR: ssl: reject an embedded NUL in the full-DN ssl_*_dn() fetches BUG/MINOR: payload: fix handshake length off-by-4 in ssl_hello_sni/alpn BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session renewals BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC BUILD: ssl: disable the TLS1.3 session timeout clamp on wolfSSL BUG/MEDIUM: ssl: isolate TLS session resumption per X509 server certificate BUG/MINOR: ssl: isolate TLS session resumption per crt-list filter BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2 BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f' BUG/MINOR: ech: fix label at end of compound statement Revert "BUG/MINOR: jwt: Missing 'jwt_tokenize' return value check" BUG/MINOR: admin: haproxy-reload use explicit socat address type BUG/MINOR: acme: NULL check on my_strndup() Willy Tarreau (28): BUG/MEDIUM: hpack: encode long methods and schemes using the long form BUG/MINOR: stats-file: reject tgid 0 when preloading shm objects BUG/MINOR: hlua: use a local buffer to format the socket addresses BUG/MINOR: connection: reserve the whole CRC32C TLV before saving its pointer BUG/MEDIUM: session: don't release a reversed connection twice on error BUG/MINOR: lb-chash: bound the walk when the saved cursor changed tree BUG/MINOR: debug: only dump the trace once in __BUG_ON_ONCE() BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval BUG/MEDIUM: sink: pre-initialize the implicit log forwarding server BUG/MINOR: http-fetch: fix smp_fetch_hdr_ip()'s handling of brackets for IPv6 BUG/MINOR: http-fetch: make http_first_req() check for HTTP first BUG/MINOR: http-act: set-status() must check the response message, not the request BUG/MINOR: tools: fix memory leak in env_expand() error path BUG/MINOR: auth: free user groups on error paths in userlist_postinit() BUG/MINOR: cfgcond: make KQUEUE check for GTUNE_USE_KQUEUE not GTUNE_USE_EPOLL BUG/MINOR: mqtt: connack parser returns MQTT_NEED_MORE_DATA on unknown property BUG/MINOR: mqtt: connect parser uses wrong bit field for TOPIC_ALIAS_MAXIMUM BUG/MINOR: mqtt: connack parser uses wrong bit for SUBSCRIPTION_IDENTIFIERS_AVAILABLE BUG/MINOR: mqtt: fix PUBLISH flags validation that want all bits to be set BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages() MINOR: sample: add new converter has_ctl() to detect control characters REGTESTS: converters: use connection: close in the has_ctl() test BUG/MEDIUM: cache: ignore cache on redundant origin/referer BUG/MEDIUM: sink: initialize the settings of the implicit log server BUG/MEDIUM: sink: do not create one implicit ring per logger copy scientiamobile (1): BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit