vey-proxy v1.15.1

This is a new feature development version in 1.15.x.
v1.15.1 includes the v1.15.0 changes. v1.15.0 was not published as its own GitHub release.

Container images: ghcr.io/vey-oss/vey-proxy:1.15.1 (Debian, default), ghcr.io/vey-oss/vey-proxy:1.15.1-debian, and ghcr.io/vey-oss/vey-proxy:1.15.1-alpine. Each tag is a manifest list for linux/amd64 and linux/arm64. The image listens with HTTP on 8080 and SOCKS5 on 1080. Alpine uses mimalloc.

MSRV 1.95.0.

Full history: vey-proxy/CHANGELOG.

v1.15.1

Bug fixes

• A transparent UDP listener forwards to the original destination instead of the listen address.
• UDP replies from a transparent or unspecified listener use the received destination as the source IP.

Features

• H2Forward failure logs include reason.
• UdpConnect creation logs include udp_listen_addr, udp_client_addr, and upstream.
• Site http.h2.force_upstream keeps an http_guard HTTP/2 task on origin HTTP/2 (ALPN h2 only, or h2c for a plaintext origin).
• Published Debian and Alpine images (linux/amd64 and linux/arm64) listen with HTTP on 8080 and SOCKS5 on 1080. Alpine uses mimalloc.
• Deb, rpm, and container image builds accept an optional Rust PGO profile.

Optimization

• eBPF UDP connection tracking uses one shared LRU instead of a per-CPU LRU.

Compatibility

• Classic mode appends X-Forwarded-By for this hop. Previously only standard Forwarded set by.
• An http_guard HTTP/2 stream takes the request host from :authority and is rejected when that host is missing.
• A plaintext http_guard origin uses HTTP/1.1 unless http.h2.force_upstream is set.
• TLCP interception built with Tongsuo 8.5.0 uses the upstream sign certificate and encryption certificate separately.
• macOS stays in the foreground after libc removed daemon().

v1.15.0

Bug fixes

• HTTP/1 response headers that start arriving while the request body is still being sent honor the response-header timeout.
• An idle HTTP connection and an adaptation send honor the escaper expiry.
• A route escaper remembers the upstream it chose, so the next request can reuse that connection.
• ICAP RESPMOD accepts an Encapsulated value that starts with req-hdr. A preview 206 is reported as ICAP-RESPMOD-206. Adapted HTTP/2 messages drop connection-specific headers.
• An ICAP OPTIONS response consumes its opt-body, so the connection can be reused.
• Fluentd retry_queue_len is read from YAML.
• QUIC Initial packets with a Source Connection ID longer than 20 bytes are rejected.
• server.forbidden.invalid_param increments its own counter instead of user_blocked.
• Transfer-Encoding is strictly checked. Request compress transfer codings are rejected (501), and TE is parsed then reduced to trailers.
• SMTP interception answers out-of-sequence commands locally without forwarding them upstream.
• IMAP interception matches CAPABILITY names and greeting response codes case-insensitively.
• IMAP interception logs use ImapConnection instead of SmtpConnection.
• Password hash verify always clears the thread-local buffer, so an OpenSSL error cannot poison later checks.
• SOCKS5 UDP ASSOCIATE batch receive applies destination ACL to every datagram, so a later forbidden target is rejected.
• IMAP interception enters the authenticated state after a successful LOGIN, so SELECT/FETCH are forwarded instead of rejected as BAD.
• LDAP and Python password auth apply local expire_datetime and block_and_delay like Basic.

Features

• Add site_group for reverse-proxy Host/SNI lookup, per-site origin, and tenant limits.
• Add http_guard, a public-edge HTTP reverse proxy.
• Add tls_proxy, a TLS reverse proxy.
• HTTP/H2 forward and intercept logs record decoded body sizes.
• Locally generated HTTP error responses include RFC 9209 Proxy-Status.
• snmalloc builds export allocator memory stats.

Compatibility

• http_expose is renamed from http_rproxy (http_rproxy is still accepted). Origins move to site_group. Ingress TLS uses OpenSSL instead of Rustls.
• http_expose http_forward_upstream_keepalive moved to site http.h1.upstream_keepalive. append_forwarded_for moved to site http.forwarded_header_type.
• HTTP Keep-Alive is parsed as timeout/max. Upstream reuse honors those limits (max=0 is not reused).
• HTTP Connection is parsed as a token list. Keep-alive follows the HTTP version and the merged tokens (HTTP/1.0 defaults to close; TE with Content-Length still forces close).
• task_idle_max_count is the minimum of the user, tenant, and origin site.
• Bump MSRV to 1.95.0.