mholt/caddy-l4 v0.1.3 on GitHub

This release changes how UDP and other packet connections are served: they are now split into a flow per client. It also adds timeouts that limit how long stalled TLS handshakes and half-closed proxied connections can last. Beyond that, it fixes a number of crashes, leaks and hangs in matching, proxy, proxy_protocol and remote_ip_list, and bumps dependencies.

Highlights

UDP flows now go through vnxme/hybrid. Packet connections such as UDP sockets are served as a wrapper. Each client (downstream address:port) gets its own flow, and a flow ends when its connection is closed or goes idle (#485, #494).
New timeouts to stop stalled connections from hanging around:
- tls handler: handshake_timeout limits how long the TLS handshake may take (#470)
- proxy handler: half_close_timeout closes a half-closed connection after it has been idle that long. Every read resets the timer, so data still flowing in the open direction is never cut (#468)
Both default to 0, which keeps the old behavior.
Requires Go 1.26 and Caddy v2.11.7 (#474, #476)

Fixes

Core / matching

A route that conclusively failed to match no longer stops matching early. Previously, e.g. an http route placed after a tls route could make matching give up within microseconds, long before matching_timeout (#455)
Packet conns: fixed reads of empty and large packets, and of packets only partly prefetched. Sub-second deadlines also work now (#484)
UDP session goroutines and their buffers are released when the server shuts down or reloads. Before, they leaked on every reload (#482)
Listener wrapper: the prefetch buffer of a hijacked connection is no longer returned to the pool while it is still in use. Under concurrency this could hand one client's ClientHello to another connection ("server did not echo the legacy session ID") (#483)

Handlers & matchers

proxy: fixed a nil dereference that crashed the process when sending a PROXY header to upstreams whose addresses contain placeholders (#486)
proxy: half-closing a TLS connection now sends a TCP FIN after close_notify, so TCP-only peers (e.g. L4 load balancers) see the connection end (#466)
proxy: active health checks keep the upstream address (#458)
proxy_protocol: the computed policy is now passed to go-proxyproto. With go-proxyproto ≥ v0.15.0, headerless connections allowed by USE/IGNORE fallbacks were being rejected, and IGNORE did not actually ignore the header (#475)
remote_ip_list: Cleanup no longer blocks after the context is cancelled. Previously this hung config reloads and the admin API (#492)
clock: a panic guard was added, and after > before is now treated as an overnight window that wraps past midnight (#449)

Docs & tests

Documented HTTP/2 connection coalescing with listener wrappers (#480)
Added close handler tests and documented that the handler is terminal (#454)

Maintenance

Dependency and CI updates (#456, #463, #487, #488, #489)

New contributors

Thanks to everyone who made their first contribution in this release:

Full Changelog: v0.1.2...v0.1.3