vey-proxy v1.14.4

LTS patch for the 1.14 line. Bug fixes and compatibility changes backported through vey-proxy 1.15.2. No new 1.15 features.

Branch: lts/vey-proxy/1.14/default

Upgrade notes

• YAML config is parsed with saphyr instead of yaml-rust2.
• Connection: close stays closed when a later keep-alive token is seen.
• A Hickory lookup keeps an address only when its owner is the name being resolved, stops a CNAME chase after 8 hops or a repeated name, and keeps waiting for another server after an early error.
• drop_default_port_in_host rebuilds Host from the parsed host. The domain is written in ASCII form, and an IPv4-mapped address is written as IPv4.
• A transparent IPv6 listener is IPv6-only, even when ipv6_only is false.
• A weighted rendezvous set follows the highest score, so a lighter node can be chosen.
• A reuseport listener does not join eBPF maps pinned by a previous release. IPv4 and IPv6 listeners use separate maps.
• A relative pid file is created in the working directory from before daemonizing. The lock is held until the process exits.
• Stricter rejects: an empty ALPN backend, an incomplete legacy rustls certificate pair, an unknown Fluentd HELO option, an unknown weighted-metric key, and several malformed ICAP messages.

Bug fixes

• --panic-quit in monitored mode still shuts the process down after notifying the parent.
• A blended runtime applies its default thread count only when none is set.
• A buffered stream copy or vectored write stops when the writer returns no bytes.
• A cache lookup returns an error if the query runtime has quit, instead of panicking.
• A ClientHello whose handshake header arrives in pieces no longer consumes the next handshake message.
• A configured OpenSSL async job limit is stored as the maximum size.
• A country code that is not two letters is rejected instead of panicking.
• A crypt password hash is rejected when a character is outside the alphabet or the last character has unused high bits set.
• A Fluentd handshake reports a closed connection instead of parsing a short HELO or PONG.
• A large Linux journald record can be sealed and sent.
• A link-local IPv6 peer or local address keeps its scope id.
• A log format failure is reported instead of panicking, and syslog is sent before the reconnect wait.
• A mapped IPv6 QUIC header is sized as an IPv4 SOCKS UDP header.
• A non-ASCII size string in YAML or JSON config is rejected instead of panicking.
• A port range that starts at 0 is rejected so the count fits in a 16-bit integer.
• A quit during graceful shutdown closes the unique control listener.
• A Redis handshake times out, and a later resolved address is tried when an earlier TCP connection fails.
• A rotating histogram still publishes while samples keep arriving, and 0.0 and -0.0 count as one quantile.
• A statsd export continues after sendmmsg writes only part of the batch, and logs the first error in each 64 second slice.
• A TCP or UDP listen scale whose denominator is 0 is rejected instead of panicking.
• A TLS Fluentd client finishes the forward handshake after TLS.
• A TLS session ticket that is too short to hold an HMAC tag is ignored instead of panicking.
• A UDP datagram that fills the byte window exactly is allowed through.
• A UDP dump larger than one datagram is split, and a failed send does not stop later dumps.
• After graceful shutdown is cancelled, a later SIGTERM still requests shutdown.
• An empty daemon group uses _.sock as the control socket.
• An FTP LIST waits until the control connection is readable before reading the closing reply.
• An HTTP chunk size line longer than the limit is rejected even when the newline arrives in the same read.
• An HTTP log URI redacts the password when the userinfo contains another @.
• An HTTP or HTTP/2 chunked transfer stops when a write returns no bytes.
• An HTTP or ICAP status code that does not fit in a 16-bit integer is rejected.
• An ICAP preview continues only after the chunk CRLF has arrived.
• An IMAP BAD reply stays on one line when the tag contains a control character.
• An IP location client keeps querying after a UDP receive error, and a cached prefix is replaced when the answer is a longer match.
• An MQTT CONNECT whose remaining length is 128 or larger is recognized.
• An NNTP greeting that arrives before its newline is still recognized, and an NNSP greeting is reported as NNSP.
• An OpenSSL async client engine stays registered after the handshake and no longer busy-waits.
• An SMTP blocked-message reason that contains a line break stays on one reply.
• An SMTP IPv6 address literal [IPv6:...] is accepted.
• DNS-over-HTTPS releases the HTTP/2 receive window, and a DNS-over-HTTPS or DNS-over-HTTP/3 response body stops at 65535 bytes.
• Failure to spawn the async log thread is reported.
• forward-ftp enables FTP GET, PUT, and DELETE forwarding.
• FTP control replies drop only the CR/LF ending, so trailing spaces in the text stay.
• FTP stops the next passive mode after the control connection fails, rejects a command parameter that contains a line break, and accepts a blank FEAT end line.
• IMAP interception reads a trailing literal on responses that carry strings, accepts an empty AUTHENTICATE challenge, and treats a tag that starts with * or + as that command's result.
• IPv4 and IPv6 reuseport listeners use separate eBPF maps, so 0.0.0.0 and :: no longer share one.
• On Windows, another control client can connect while one connection is still open.
• OpenSSL async engine file descriptors are registered with the I/O-safe AsyncFd API.
• OpenSSL async jobs are initialized on the current-thread worker.
• Protocol inspection accepts a DNS query that carries an EDNS additional record.
• Protocol inspection recognizes an RTSP request that starts with DESCRIBE or OPTIONS, and leaves HTTP in play until the method cannot be an RTSP request.
• Protocol inspection recognizes the WebDAV method UPDATEREDIRECTREF.
• Reloading a UDP or QUIC listener keeps the new socket buffer size.
• Round-robin selection of zero nodes returns no nodes.
• SMTP DATA dot-stuffing leaves a . that continues the same line unchanged.
• The pid file lock is held until the process exits.
• The TLS ticket key still in use can decrypt tickets after a refresh.
• The Windows hostname sent to syslog and Fluentd no longer includes a trailing NUL.
• UDP receive ancillary data is aligned so control messages can be parsed.

Compatibility

• A Connection header that contains close stays closed when a later keep-alive token is seen.
• A Hickory lookup keeps an address only when its owner is the name being resolved, stops a CNAME chase after 8 hops or a repeated name, and keeps waiting for another server after an early error.
• A relative pid file is created in the working directory from before daemonizing.
• A reuseport listener does not join eBPF maps pinned by a previous release.
• A successful HTTP CONNECT or 101 Upgrade response is rejected when it carries a message body.
• A Tongsuo TLCP or NTLS handshake does not insert an empty TLS fragment.
• A transparent IPv6 listener is IPv6-only, even when ipv6_only is false.
• A weighted rendezvous set follows the highest score, so a lighter node can be chosen.
• An ALPN match without a backend name is rejected.
• An ICAP message is rejected when the status line omits the space before the reason phrase, a section follows the body token, an encapsulated header ends before its offset, or an OPTIONS null-body offset is not zero.
• An incomplete legacy rustls certificate pair fails config load instead of being ignored.
• An issued certificate cannot start before its issuer, and its pathlen cannot exceed what the issuer allows.
• An SMTP tag match ignores case.
• An unknown Fluentd HELO option is rejected.
• An unknown key in a weighted metric node is rejected.
• Certificate times outside 1950–2049 use GeneralizedTime, and a timestamp offset that includes seconds is written in UTC.
• DragonFly worker sched_affinity applies to the calling thread.
• drop_default_port_in_host rebuilds Host from the parsed host, so the domain is in ASCII form and an IPv4-mapped address is written as IPv4.
• Packages build on openSUSE Leap 16.1.
• Published container images set OCI labels so GHCR can describe them.
• YAML config is parsed with saphyr instead of yaml-rust2.