vey-proxy v1.14.3

LTS patch release on lts/vey-proxy/1.14/default. v1.14.3 includes the v1.14.1 and v1.14.2 fixes. Those versions were not published as their own GitHub releases.

Full history: vey-proxy/CHANGELOG on the 1.14 LTS branch.

v1.14.3

Bug fixes

• Fluentd retry_queue_len is read from YAML.
• QUIC Initial packets with a Source Connection ID longer than 20 bytes are rejected.
• server.forbidden.invalid_param increments its own counter instead of user_blocked.
• A route escaper remembers the upstream it chose, so the next request can reuse that connection.
• HTTP/1 response headers that arrive while the request body is still being sent use the response-header timeout.
• ICAP RESPMOD preview 206 is reported as ICAP-RESPMOD-206, and a non-preview error is not described as after 100-continue.
• ICAP RESPMOD accepts an Encapsulated header that starts with req-hdr and skips that request header.
• ICAP OPTIONS consumes an opt-body so the next message on that connection can be parsed.
• Connection-specific headers are removed from ICAP-adapted HTTP/2 messages.

v1.14.2

Bug fixes

• Update h2 to fix errors.

v1.14.1

Bug fixes

• SMTP interception answers out-of-sequence commands locally without forwarding them upstream.
• IMAP interception matches CAPABILITY names and greeting response codes case-insensitively.
• IMAP interception logs use ImapConnection instead of SmtpConnection.
• IMAP interception enters the authenticated state after a successful LOGIN, so SELECT/FETCH are forwarded instead of rejected as BAD.
• Password hash verify always clears the thread-local buffer, so an OpenSSL error cannot poison later checks.
• SOCKS5 UDP ASSOCIATE batch receive applies destination ACL to every datagram, so a later forbidden target is rejected.
• LDAP and Python password auth apply local expire_datetime and block_and_delay like Basic.