Changes since version 3.5-dev9 : Aleksandar Lazic (1): BUG/MINOR: filters: free the error message of the filter-config parsers Amaury Denoyelle (21): BUG/MINOR: quic: rearm packet on packet received even non ack-eliciting REGTESTS: use HAPROXY_TEST_TIMEOUT for wait in purge srv/be MINOR: quic: rename confusing qc_purge_txbuf() to qc_flush_txbuf() BUG/MEDIUM: mux_quic: prevent uaf on fctl frame after send error BUG/MINOR: mux_quic: prevent RS/SS on unistream with hq-interop BUG/MINOR: check: do not inspect errno if conn FDLESS BUG/MINOR: mux_quic: do not crash on SE_SHR_DRAIN shut BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on SETTINGS parsing BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on GOAWAY parsing BUG/MEDIUM: h3: fix BUG_ON() crash with glitch after QPACK dec err MINOR: h3: remove dead code on h3_rcv_buf() error path BUG/MINOR: h3: fix risk of BUG_ON() crash with glitch on unknown frame BUG/MINOR: h3: fix BUG_ON() crash with glitch on htx_set_eom() failure Revert "BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold" BUG/MEDIUM: h3: fix memory corruption on trailers parsing realign BUG/MINOR: mux_quic: wake streams on soft-stop using listener socket BUG/MINOR: h3: enforce maxrewrite on request headers BUG/MINOR: h3: fix crash with maxrewrite on response headers BUG/MEDIUM: mux_quic: fix crash on QCS double remote close BUG/MEDIUM: mux_quic: ensure FIN is reported after Rx data transfer BUG/MINOR: mux-quic: prevent send corruption on buf realign Aurelien DARRAGON (2): BUG/MEDIUM: stats-file: shm-stats-file be counters not working anymore BUG/MINOR: cfgparse/peers: warn and prevent undefined behavior when peers is missing bind info Björn Jacke (1): DOC: config: explain per ACL line limitations Christopher Faulet (44): BUG/MEDIUM: cli: Fix parsing of big payloads with dynamically allocated buffer BUG/MINOR: filters: fix silent compression disable with legacy "filter compression" first MINOR: filters: Support the global side in filter_place_class() OPTIMIZE: stream: Stop holding a reference on the frontend during stream_free() BUG/MEDIUM: mux-h1: Don't close the connection on a payload parsing error BUG/MEDIUM: h1: make the Connection/Upgrade headers cleanup idempotent BUG/MINOR: h1: keep accepting unsafe violations after a parser reset BUG/MEDIUM: h1: don't rewrite the Upgrade header when not cleaning headers BUG/MEDIUM: h1-htx: don't stall on messages ending exactly at the buffer's end BUG/MEDIUM: mux-h1: don't truncate the response when closing after draining BUG/MEDIUM: mux-h1: don't truncate responses on soft-stop BUG/MINOR: h1: don't use uninitialized start line pointers when restarting BUG/MINOR: mux-h1: only reset the session's timing info on the frontend side BUG/MINOR: mux-h1: fix the open streams counter on stream creation failure BUG/MINOR: mux-h1: wake the connection up when a pending error can be sent BUG/MINOR: mux-h1: don't dereference a NULL opposite sedesc in h1_fastfwd() BUG/MEDIUM: h1: reject CONNECT request targets other than "host:port" BUG/MEDIUM: mux-h1: don't lose the end of the previous chunk in h1_make_chunk() BUG/MEDIUM: mux-h1: don't stall when draining more than a buffer of data BUG/MINOR: mux-h1: reset the content-length/chunking state after a 1xx response BUG/MINOR: mux-h1: don't keep fast-forwarding disabled for the next streams BUG/MINOR: mux-h1: don't report a 408 error on timeout of a closed connection BUG/MEDIUM: mux-h1: don't swap buffers when transferring data with a reserved offset BUG/MINOR: mux-h1: report payload parsing glitches to the session BUG/MEDIUM: mux-h1: don't lose error responses once a content-length was parsed BUG/MEDIUM: h1: build a missing Host header from the authority of the URI BUG/MINOR: h1: reject CONNECT authorities with an empty host BUG/MINOR: h1: forget a previous pass' results when parsing headers only BUG/MEDIUM: mux-h1: don't send chunked responses to HTTP/1.0 clients BUG/MINOR: mux-h1: convert the argument of h1-case-adjust to lower case BUG/MEDIUM: h1: reject absolute http(s) URIs with an empty host BUG/MINOR: mux-h1: only rely on the client's method for bodyless responses BUG/MINOR: mux-h1: search the websocket key in the right message BUG/MINOR: mux-h1: don't forward request trailers named like server name header BUG/MEDIUM: mux-h1: don't spread-close idle conns with idle-close-on-response BUG/MINOR: mux-h1: Don't subscribe for receives once read0 or error received BUG/MEDIUM: bwlim: never burst more than the pending data in input MINOR: filters: Move cache-store after decompression in global classes list REGTESTS: filters: Fix the global filters order as reported on the CLI MEDIUM: filters: automatically order the implicit core filters in legacy mode DOC: filters: document the automatic ordering of the legacy core filters MEDIUM: filters: eval the backend instances first on the response path MEDIUM: filters: eval the legacy backend filters first on the response path BUG/MINOR: flt-decomp: Report error about filter order in lagacy mode only Frederic Lecaille (6): MEDIUM: quic: implement the AEAD confidentiality limit OPTIM: quic: use native HKDF APIs where available TESTS: quic: add HKDF unit tests using RFC 5869 vectors BUG/MEDIUM: peers: keep the earliest sync task deadline MINOR: quic: use the same HP encryption helpers for RX and TX BUG/MINOR: quic: valid NEW_TOKEN connections are counted as half-open Miroslav Zagorac (1): MINOR: filters: initialize the filter classes before the register stage Olivier Houchard (16): BUILD: sym: Make sure minidebug works correctly with most environments BUILD: sym: Use dl_iterate_phdr() for more OSes. BUILD: sym: Get it to build and work on various OSes BUILD: sym: Make sure __always_inline always is inline. BUILD: sym: Build properly with gold as a linker BUILD: sym: Keep a temporary binary without .gnu_debugdata BUILD: sym: Don't add a minidebug section to haterm and haload BUG/MINOR: sym: don't crash on images linked at a fixed base BUG/MEDIUM: resolvers: reject too long labels when encoding a name BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold BUG/MAJOR: mux-h2: split absolute URIs like the HTTP analysers do on output BUG/MEDIUM: h3: split absolute URIs like the HTTP analysers do on output MINOR: thread: split out thread_bind_to_cpu_map() OPTIM: fd: Make each thread group's FD table NUMA-local OPTIM: fd: make each thread group's polled_mask NUMA-local BUILD: thread: fix builds without thread support Remi Tricot-Le Breton (8): BUG/MINOR: sample: Fix wrong 'base64urldec' return value check in 'jwt_member_query' MINOR: ssl: Add new 'pha' server option BUG/MINOR: jwt: don't truncate binary HMAC secrets at the first NULL byte BUG/MINOR: jws: fix ECDSA_SIG leak in jws_b64_signature() BUG/MINOR: jwe: only accept exact "alg" and "enc" names in JWE tokens BUG/MINOR: jwe: reject non-empty encrypted keys with "dir" and "ECDH-ES" BUG/MINOR: jwe: only match the exact "ALL" word in jwt.decrypt_{alg,enc}_list BUG/MINOR: jwt: enforce the ECDSA signature length in jwt_verify William Lallemand (4): CI: github: run several weekly/monthly jobs daily DOC: remove the AWS-LC CI image CI: github: fix VTest cache paths in container jobs BUG/MEDIUM: task: do not destroy twice the tasks already killed in mworker_cleantasks() Willy Tarreau (6): BUILD: makefile: better support git worktrees DOC: config: add missing acme.scheduler in the global index MINOR: tools: add find_word_index_in_array() to find a keyword MINOR: http/config: add acceptable-http-re{quest,sponse}-violations MINOR: http: add one control per existing HTTP violation MEDIUM: http: add the "short-status-code" violation exception Yeonggi Kim (7): MINOR: quic: use the listener for Retry and Version Negotiation emission MINOR: quic: define a function to emit a datagram on a listener socket BUG/MEDIUM: quic: use datagram destination as source for Retry BUG/MINOR: quic: use datagram destination as source for stateless reset BUG/MINOR: quic: use datagram destination as source for version negotiation REGTESTS: quic: check Retry source address on a wildcard listener BUG/MINOR: quic: handle EINTR on emission of packets without connection