vey-proxy 1.15.2

This is a new version in v1.15 feature development branch.

Baseline is 1.15.1. The full list is in vey-proxy/CHANGELOG.

Before you upgrade

The control socket directory has moved. Root on Linux uses /run/vey-proxy. Root on other Unix systems uses /var/run/vey-proxy. Another Linux user uses an absolute XDG_RUNTIME_DIR, or /run/user/<uid>/vey-proxy. Point vey-proxy-ctl and any monitoring at the new directory.

Python 3.8 is no longer supported. Builds with the python feature need Python 3.9 or newer.

These existing configs and peers change behavior:

• A Connection header that contains close stays closed when a later keep-alive token is seen.
• A Hickory lookup keeps an address only when its owner is the name being resolved, stops a CNAME chase after 8 hops or a repeated name, and keeps waiting for another server after an early error.
• A relative pid file is created in the working directory from before daemonizing. The lock is held until the process exits.
• A successful HTTP CONNECT or 101 Upgrade response is rejected when it carries a message body.
• A Tongsuo TLCP or NTLS handshake does not insert an empty TLS fragment.
• A transparent IPv6 listener is IPv6-only, even when ipv6_only is false.
• A weighted rendezvous set follows the highest score, so a lighter node can be chosen.
• An ALPN match without a backend name fails config load.
• An ICAP message is rejected when the status line omits the space before the reason phrase, a section follows the body token, an encapsulated header ends before its offset, or an OPTIONS null-body offset is not zero.
• An incomplete legacy rustls certificate pair fails config load instead of being ignored.
• An issued certificate cannot start before its issuer, and its pathlen cannot exceed what the issuer allows. Certificate times outside 1950–2049 use GeneralizedTime. A timestamp offset that includes seconds is written in UTC.
• An SMTP tag match ignores case.
• An unknown Fluentd HELO option fails the handshake.
• An unknown key in a weighted metric node fails config load.
• A reuseport listener does not join eBPF maps pinned by a previous release. IPv4 and IPv6 listeners use separate maps, so 0.0.0.0 and :: no longer share one.
• DragonFly worker sched_affinity applies to the calling thread.
• drop_default_port_in_host rebuilds Host from the parsed host, so the domain is in ASCII form and an IPv4-mapped address is written as IPv4.
• YAML config is parsed with saphyr instead of yaml-rust2.
• Packages build on openSUSE Leap 16.1. Published container images set OCI labels so GHCR can describe them.

Features

• An IP location service can be reached over a Unix datagram socket.
• UDP stream and transparent UDP listeners emit listen.datagram.recv.* and listen.datagram.send.*.

Bug fixes

HTTP, ICAP, and protocol inspection

• A buffered stream copy, a vectored write, and an HTTP or HTTP/2 chunked transfer stop when the writer returns no bytes.
• An HTTP chunk size line longer than the limit is rejected even when the newline arrives in the same read.
• An HTTP or ICAP status code that does not fit in a 16-bit integer is rejected.
• An ICAP preview continues only after the chunk CRLF has arrived.
• An HTTP log URI redacts the password when the userinfo contains another @.
• Protocol inspection accepts a DNS query that carries an EDNS additional record, recognizes the WebDAV method UPDATEREDIRECTREF, and recognizes an RTSP request that starts with DESCRIBE or OPTIONS. HTTP stays in play until the method cannot be an RTSP request.
• A ClientHello whose handshake header arrives in pieces no longer consumes the next handshake message.
• An MQTT CONNECT whose remaining length is 128 or larger is recognized.
• An NNTP greeting that arrives before its newline is still recognized, and an NNSP greeting is reported as NNSP.

Mail, FTP, and IMAP

• An SMTP IPv6 address literal [IPv6:...] is accepted. A blocked-message reason that contains a line break stays on one reply. SMTP DATA dot-stuffing leaves a . that continues the same line unchanged.
• An FTP LIST waits until the control connection is readable before reading the closing reply. FTP control replies drop only the CR/LF ending, so trailing spaces in the text stay. FTP stops the next passive mode after the control connection fails, rejects a command parameter that contains a line break, and accepts a blank FEAT end line.
• forward-ftp enables FTP GET, PUT, and DELETE forwarding.
• IMAP interception reads a trailing literal on responses that carry strings, accepts an empty AUTHENTICATE challenge, and treats a tag that starts with * or + as that command's result. An IMAP BAD reply stays on one line when the tag contains a control character.

DNS, certificates, and TLS

• DNS-over-HTTPS releases the HTTP/2 receive window. A DNS-over-HTTPS or DNS-over-HTTP/3 response body stops at 65535 bytes.
• A TLS session ticket that is too short to hold an HMAC tag is ignored. The TLS ticket key still in use can decrypt tickets after a refresh.
• An OpenSSL async client engine stays registered after the handshake and no longer busy-waits. OpenSSL async engine file descriptors are registered with the I/O-safe AsyncFd API.
• Reloading a UDP or QUIC listener keeps the new socket buffer size.
• A link-local IPv6 peer or local address keeps its scope id.

Runtime, logging, and platform

• A cache lookup returns an error if the query runtime has quit.
• A country code that is not two letters, a non-ASCII size string, and a TCP or UDP listen scale whose denominator is 0 are rejected at config load.
• A crypt password hash is rejected when a character is outside the alphabet or the last character has unused high bits set.
• A log format failure is reported, and syslog is sent before the reconnect wait. Failure to spawn the async log thread is reported. A large Linux journald record can be sealed and sent.
• A rotating histogram still publishes while samples keep arriving, and 0.0 and -0.0 count as one quantile.
• A statsd export continues after sendmmsg writes only part of the batch, and logs the first error in each 64 second slice.
• A Redis handshake times out, and a later resolved address is tried when an earlier TCP connection fails.
• A Fluentd handshake reports a closed connection instead of parsing a short HELO or PONG. A TLS Fluentd client finishes the forward handshake after TLS.
• An IP location client keeps querying after a UDP receive error, and a cached prefix is replaced when the answer is a longer match.
• A quit during graceful shutdown closes the unique control listener. After graceful shutdown is cancelled, a later SIGTERM still requests shutdown.
• An empty daemon group uses _.sock as the control socket. On Windows, another control client can connect while one connection is still open. The Windows hostname sent to syslog and Fluentd no longer includes a trailing NUL.
• A UDP datagram that fills the byte window exactly is allowed through. A UDP dump larger than one datagram is split, and a failed send does not stop later dumps. UDP receive ancillary data is aligned so control messages can be parsed.