# changelog

author: Anton Novojilov <andy@essentialkaos.com> - 1.2.3-0
changelog:
  - Arguments parser updated to v3 with fixed stderr output redirection for
    showArgWarn and showArgValWarn functions


author: Anton Novojilov <andy@essentialkaos.com> - 1.3.0-0
changelog:
  - Using 1 CPU by default for unpacking data
  - Added option '-F/--fast' for using all CPUs for unpacking data


author: Anton Novojilov <andy@essentialkaos.com> - 1.3.4-0
changelog:
  - Added handling of SCRIPT_DEBUG environment variable for enabling debug mode
  - Added handler for script errors


author: Anton Novojilov <andy@essentialkaos.com> - 1.6.10-0
changelog:
  - GeoIP_database_info now returns the full version string rather than
    incorrectly truncating it
  - This API is now distributed with a small test copy of GeoIP.dat rather than
    a full copy
  - Fix issue where Visual Studio 2015 was optimizing out initialization code
  - Fix test/benchmark on Windows


author: Anton Novojilov <andy@essentialkaos.com> - 1.6.12-0
changelog:
  - Populate metro and area code when performing lookups in IPv6 City databases.
    Previously this was only done when using IPv4 City databases.


author: Anton Novojilov <andy@essentialkaos.com> - 2.1.1-0
changelog:
  - Fixed bug with killing old Unicorn master by the watchdog before sending
    QUIT signal
  - Removed useless log message from watchdog


author: Anton Novojilov <andy@essentialkaos.com> - 0.0.2-0
changelog:
  - Added cloud/serverless function for Yandex.Cloud
  - Fixed bug with handling STORAGE_S3_REGION value from options and environment
    variables
  - Code refactoring
  - Dependencies update


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.0-0
changelog:
  - Support for Docker containers
  - Improved gathering of process data
  - Improved memory figures for processes
  - Variable width for PID column
  - Minor improvements


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.0-0
changelog:
  - Support for Nvidia GPU statistics
  - Support for Infiniband statistics
  - Support for Pressure Stall Information (PSI)
  - Faster startup of atop
  - Configurable options for atop running in the background
  - CPU Instructions Per Cycle (IPC)
  - Various NFS counters corrected
  - Recognition of nvme and nbd disks
  - Recognition of DEADLINE scheduling policy
  - Proper handling of memory locking (improper handling caused malloc failures
    in previous versions)
  - Added atopconvert


author: Anton Novojilov <andy@essentialkaos.com> - 2.5.0-0
changelog:
  - Avoid using perf counters in VM
  - Improve daily rotation of logfile for systemd-based systems
  - Bug fixes


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.1-0
changelog:
  - Bug solution: wrong conversion of NUMA statistics (for systems with multiple
    NUMA nodes)
  - Bug solution: string formatting might result in buffer overflow


author: Anton Novojilov <andy@essentialkaos.com> - 2.9.0-0
changelog:
  - Introduction of bar graph mode
  - Additional counters per thread showing the number of voluntary and
    involuntary context switches (key 's')
  - Improved handling of process accounting
  - Various bugfixes and minor improvements
  - Various bugfixes (to avoid loss of synchronization and race conditions)


author: Anton Novojilov <andy@essentialkaos.com> - 2.10.0-0
changelog:
  - Additional memory statistics on system level: amount of available memory,
    amount of memory used for Transparant Huge Pages, amount of memory used by two
    categories of static huge pages (usually 2MiB and 1GiB), and the number
    of pages transferred to/from zswap.
  - Additional counters for the number of idle threads on system level and process
    level.
  - Refined view of memory bar graph, including free static huge pages.
  - Generic way to determine the container id or pod name for containerized
    processes.
  - Support for a BPF-based alternative for the netatop kernel module to gather
    network statistics per process/thread.
  - Use the -z flag followed by a regex to prepend matching environment variables
    to the full command line that is shown per process (with key 'c').
  - Various bugfixes (like memory leak when switching to bar graph mode) and minor
    improvements.
  - Bugfix: failing malloc while starting atopsar (unprivileged) for a live
    measurement.
  - The program atophide can be used to make an extraction from an input raw log
    to an output raw log, optionally specifying a begin time and/or an end time.
  - The format of the raw file is incompatible with previous versions. Raw files
    from previous versions can be converted to the new layout with the atopconvert
    command.


author: Anton Novojilov <andy@essentialkaos.com> - 1.16.5-0
changelog:
  - PYTHON_PREFIX and PYTHON_EXEC_PREFIX are now set according to
    Python's sys.* values only if the new configure option
    --with-python-sys-prefix is specified. Otherwise, GNU default values
    are used, as in the past. (The change in 1.16.3 was too incompatible.)
  - consistently depend on install-libLTLIBRARIES.
  - use const for yyerror declaration in bison/yacc tests.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.0-0
changelog:
  - crond: Job environment variables are set also when executing sendmail.
  - crond: Adding duplicate orphans on reload is now prevented.
  - crond: The regular crond shutdown is now logged.
  - crontab: PAM is not called in crontab command if the caller's uid is 0.
  - crond: PAM is not called from crond for system cron jobs
    (/etc/crontab, /etc/cron.d) which are run for uid 0.
  - crond: The existence of an user is checked at time when job is run
    and not when the crontab is parsed on database reload.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.1-0
changelog:
  - crontab: Use temporary file name that is ignored by crond.
  - crond: Inherit PATH from the crond environment if -P option is used.
  - crond: Remove hardcoded "system_u" SELinux user, use the SELinux user of
    the running crond.
  - anacron: Small cleanups and fixes.
  - crond: Fix longstanding race condition on repeated crontab modification.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.1-2
changelog:
  - Fixed bug from original Fedora package with removing crond from chkconfig
    after package update
  - Improved spec


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.2-0
changelog:
  - crontab: do not try to replace the crontab with a directory
  - Support the MAILFROM also in anacron.
  - Document that in range the first number must be less than second.
  - round time on the minute
  - print all jobs executed in interval
  - new options -l and -q
  - output in yaml format
  - print the job(s) that is going to be executed next
  - allow checking a time interval
  - print format for flags
  - cronnext can read additional crontabs from files
  - Use proper variable types.
  - Add myself as author.
  - Log startup even when started in non-forking mode.
  - Fix SELinux denial when running under Docker
  - build-sys: use silent build rule
  - cronnext: improve manual page
  - all: add version printing option -V
  - cronnext: use same style in usage() with other commands
  - various files: fix indentation
  - crond: never define unused cron_start_pam()
  - Add Arch Linux to list of distributions
  - Fix misleading indentation.
  - Make cronnext build and work with additional features enabled.
  - Add MIME-Version header also to mails generated by anacron.
  - Add MIME-Version header to generated mails.
  - The output might not be mailed, make the message more precise.
  - Allow empty environment values in crontab.
  - Point releases to the GitHub cronie releases page
  - crontab.5: Add a mention about disabling logging
  - Avoid creating pid files when crond doesn't fork
  - readme.md: remove CRs
  - Add readme.md for github
  - Make it clear that one of the reasons for getpwnam() failure is unknown user.
  - On some machines the power supply is named ADP0.
  - Query power supply status directly from kernel.
  - cronnext: Fix warnings
  - cronnext: Print usage and error on stderr.
  - Added useful utility cronnext to find out time of the next job run.
  - anacron: Check return value of fchdir.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.3-0
changelog:
  - Fix CVE-2019-9704 and CVE-2019-9705 to avoid local DoS of the crond
  - crontab: Make crontab without arguments fail
  - crond: In PAM configuration include system-auth instead of password-auth
  - crond: In the systemd service file restart crond if it fails
  - crond: Use the role from the crond context for system job contexts
  - Multiple small cleanups and fixes


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.5-0
changelog:
  - avoid warning for strncat
  - crontab.1: Various fixes and improvements
  - crontab: fsync to check for full disk
  - crontab: Add Y/N to retry prompt
  - entries: Explicitly validate upper ranges and steps
  - crond: report missing newline before EOF
  - do not log carriage return
  - skip directories when given as crontabs
  - crontab -l colors comment lines in a different color
  - fix compile instruction: configure is generated by autogen.sh
  - getdtablesize() can return very high values in containers
  - power supply name not detected correctly
  - Revert "Avoid creating pid files when crond doesn't fork"
  - anacron: fix types in comparisons
  - mics: stop using plain integer as NULL pointer
  - cron: fix type in comparison
  - cron: fix variable shadowing
  - cron: mark signal number arguments in signal handlers unused
  - update readme.md with recent releases
  - move allowed() and related function to security.c
  - build-sys: enable anacron by default
  - build-sys: use none-recursive build
  - cronnext: optionally select jobs by substring
  - crond: Do not abort loading crontab prematurely in case of error


author: Anton Novojilov <andy@essentialkaos.com> - 2.10.0-0
changelog:
  - updated Visual Studio projects to VS 2019
  - mp4read.c: fix stack-buffer-overflow in stringin()/ftypin()
  - fix heap-buffer-overflow in mp4read.c
  - Remove non-ASCII characters
  - Remove trailing whitespace
  - Check return value of ltp_data.
  - Restrict SBR frame length to 960 and 1024 samples.
  - Support object type 29.
  - Support implicit SBR signaling in frontend.
  - Fix PNS decoding when only right channel is noise.
  - Initialize element_id array with an invalid id.
  - Fix NULL pointer dereferences.
  - Fix infinite loop in adts_parse.
  - Fix infinite loop in huffman_getescape.
  - Check for error after each channel decode.
  - Check for inconsistent number of channels.


author: Anton Novojilov <andy@essentialkaos.com> - 1.7.0-0
changelog:
  - This release includes three new filters, code cleanups and several
    bugfixes improving stability of existing plugins.
  - New filters (3): normaliz0r, elastic_scale, premultiply.
  - Updated (47): alpha0ps, baltan, bgsubtractor, bluescreen0r, blur,
    c0rners, cairogradient, cairoimagegrid, cartoon, cluster,
    coloradj, colorhalftone, curves, d90stairsteppingfix, defish0r,
    delay0r, edgeglow, emboss, facebl0r, facedetect, levels,
    lightgraffiti, measure, ndvi, nervous, nosync0r, primaries,
    rgbnoice, rgbsplit0r, scanline0r, select0r, sopsat, spillsupress,
    three_point_balance, timeout, tutorial, vertigo, vignette, water,
    alphaatop, alphain, alphaout, alphaover, alphaxor,
    cairoaffineblend, cairoblend, xfade0r.


author: Anton Novojilov <andy@essentialkaos.com> - 1.11.5-2
changelog:
  - Rebuilt with latest version of netcdf
  - Removed libspatialite support
  - Minimal required version of PostgreSQL set to 9.3


author: Anton Novojilov <andy@essentialkaos.com> - 1.4.6-0
changelog:
  - Added additional feed reader clients.
  - Added additional browsers and bots to the main list.
  - Added command line option '--unknowns-log' to log unknown browsers and OSs.
  - Added 'Referer' to the pre-defined 'Caddy JSON' log format.
  - Added support for real-time piping as non-root user.
  - Added the ability to Handle case when IPv4 is encoded as IPv6 in
    GeoIP1/legacy.
  - Ensure we capture linux (lowercase) when extracting an OS.
  - Fixed a regression in parsing Google Cloud Storage or possibly other non-JSON
    formats.
  - Fixed inability to parse escaped formats.
  - Fixed issue when using '%s' with 'strptime(3)' under musl libc. This
    addresses mostly the Docker image.
  - Fixed possible buffer over-read for certain log-format patterns.
  - Fixed segfault when attempting to process a malformed JSON string.
  - Fixed segfault when setting an empty log-format from the TUI dialog.
  - Fixed sorting on hits and visitors when larger than INT_MAX.
  - Updated CloudFront pre-defined log-format to reflect the latest fields.
  - Updated 'Dockerfile' image to use 'alpine:3.13' instead of edge due to
    compatibility issue with the GNU coreutils.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5-0
changelog:
  - Added a Docker container based isolated build environment (Debian).
  - Added Dark Mode detection to the HTML report.
  - Added the ability for the WebSocket server to bind to a Unix-domain socket.
  - Added the ability to parse IPs enclosed within brackets (e.g., IPv6).
  - Changed categorization of requests containing 'CFNetwork' to 'iOS' when
    applicable.
  - Changed command line option from '--hide-referer' to '--hide-referrer'.
  - Changed command line option from '--ignore-referer' to '--ignore-referrer'.
  - Fixed a potential division by zero.
  - Fixed inablity to parse IPv6 when using a 'CADDY' log format.
  - Fixed issue where a 'BSD' OS could be displayed as Linux with certain
    user-agents.
  - Fixed memory leak when a JSON value contained an empty string(e.g., JSON/CADDY
    format).
  - Fixed possible buffer overflow on a WS packet coming from the browser.
  - Refactored a substancial part of the storage codebase for upcoming
    filtering/search capabilities (issue #117).
  - Refactored DB storage to minimize memory consumption up to '35%'.
  - Updated default 'AWS Elastic Load Balancing' log format.
  - Updated German translation.
  - Updated page size to 24 on the HTML report.
  - Updated UNIX OS catergories.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.1-0
changelog:
  - Changed official deb repo so it now builds '--with-getline' in order to
    support request lines longer than 4096.
  - Ensure there's no tail delay if the log file hasn't changed.
  - Fixed data race when writing to a self-pipe and attempting to stop the WS
    server.
  - Fixed inability to close expanded panel when pressing 'q' on TUI.
  - Fixed possible data race during parsing spinner label assignment.
  - Increased the maximum number of files to monitor from '512' to '3072'.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.2-0
changelog:
  - Added .avi to the list of static requests/extensions.
  - Changed label from 'Init. Proc. Time' to 'Log Parsing Time'.
  - Fixed issue where lengthy static-file extension wouldn't account certain valid
    requests.
  - Fixed possible buffer underflow when checking static-file extension.
  - Fixed segfault when attempting to parse an invalid JSON log while using a JSON
    log format.
  - Fixed segfault when ignoring a status code and processing a line > '4096'
    chars.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.3-0
changelog:
  - Added additional crawlers to the default list.
  - Added Italian translation (i18n).
  - Added 'macOS 12' to the list of OS.
  - Fixed buffer overflow caused by an excessive number of invalid requests with
    multiple logs.
  - Fixed visualization issue on the HTML report for panels with disabled chart.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.4-0
changelog:
  - Added AWS ALB to the predefined logs format list --log-format=AWSALB.
  - Ensure we lock our pipe/websocket writer before broadcasting message.
  - Ensure we require a valid host token even when we're not validating the IP.
  - Ensure we simply update the TUI once after tailing multiple files.
  - Ensure we simply update the UI once after tailing multiple files.
  - Fixed buffer overflow when checking if an HTTP code was a 404 on an empty
    status code.
  - Optimized terminal and HTML UI output when tailing multiple files.
  - Updated DB PATH error message to be more descriptive.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.5-0
changelog:
  - Added mechanism to automatically parse additional bots.
  - Changed area chart interpolation to 'monotone'. This should avoid the issue
    where the interpolated curve has a bend into the negative space.
  - Changed build to use debugging symbols even for release builds.
  - Changed order on which we verify bots to be the first thing we check. This
    adds a slight improvement on parsing time.
  - Ensure we initialize DNS resolver conditions and mutexes before they're used.
  - Fixed possible buffer over-read for cases where a '\0' could be reached early
    when parsing a log line.
  - Fixed possible data race on UI spinner thread.
  - Fixed regression where a lot of robots were not detected by GoAccess.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.6-0
changelog:
  - Added `--anonymize-level=<1|2|3>` option to specify IP anonymization level.
  - Added minute specificity to the Visitors panel via `--date-spec=min`.
  - Added the ability to toggle on/off panels on the HTML report.
  - Changed stderr to stdout on non-error output when exiting goaccess.


author: Anton Novojilov <andy@essentialkaos.com> - 1.5.7-0
changelog:
  - Updated Caddy's JSON format. This should address CADDY's v2.5.0 change.
  - Updated Chinese translation (i18n).
  - Updated GeoIP module so it defaults to native language name (i18n) or
    fall-back to English.
  - Updated Russian translation (i18n).
  - Updated Ukrainian translation (i18n).


author: Anton Novojilov <andy@essentialkaos.com> - 1.6-0
changelog:
  - Changed slightly how the XFF field is specified. See man page for details.
  - Ensure city is displayed with the DBIP City Lite database.
  - Ensure no 'cleaning up resources' message is displayed if `--no-progress`
    is passed.
  - Ensure the maximum number of items per panel defaults to 1440 (24hrs) when
    passing `--date-spec=min`.
  - Fixed issue when parsing a delimited XFF field followed by a host IP.
  - Fixed issue where some data was buffered on the WebSocket server before it
    was sent to each client.
  - Fixed issue where the WebSocket server would fail with POLLNVAL consuming
    100% CPU.
  - Fixed segfault when attempting to open an unresolved IP on mac/BSDs.


author: Anton Novojilov <andy@essentialkaos.com> - 1.6.1-0
changelog:
  - Added a `--ping-interval=<secs>` in an attempt to keep the WebSocket
    connection opened.
  - Added support for timezone conversion via `--datetime-format=<format>`
    and `--tz=<timezone>`.
  - Added the ability to reconnect to the WebSocket server after 1 sec with
    exponential backoff (x20).
  - Fixed issue where an invalid client connection would stall data out to
    clients via the WebSocket server.
  - Fixed an issue where real-time data would be parsed multiple times under
    `Cygwin`.


author: Anton Novojilov <andy@essentialkaos.com> - 1.6.2-0
changelog:
  - Added `Android 12` to the list of OSs.
  - Added `macOS 12 Ventura` to the list of OSs.
  - Fixed implicit declaration build issue due to `timegm(3)` on `BSDs`
    and `macOS`.
  - Fixed issue where timezone conversion would be performed twice on
    a given date.


author: Anton Novojilov <andy@essentialkaos.com> - 1.10.0-0
changelog:
  - [gopack] Added a new way to remove useless source code after installing
    package managers
  - [gopack] Added go mod support
  - [gopack] Improved source downloading mechanics
  - [gopack-build] Added XZ support


author: Anton Novojilov <andy@essentialkaos.com> - 1.13.2-0
changelog:
  - [gopack|gopack-build] Fixed --no-color option handling
  - [gopack-build] Improved remote file availability check
  - [gopack|gopack-build] Code refactoring


author: Anton Novojilov <andy@essentialkaos.com> - 1.14.0-0
changelog:
  - [gopack] Added option --ignore-vendor option for ignoring vendored
    dependencies
  - [gopack] Improved working with vendored dependencies
  - [gopack] Code refactoring


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.1-0
changelog:
  - BUG/MINOR: ssl: don't report 1024 bits DH param load error when it's higher
  - MINOR: http-htx: Add understandable errors for the errorfiles parsing
  - DOC: config: Fix a typo on ssl_c_chain_der
  - BUG/MEDIUM: ssl/crt-list: correctly insert crt-list line if crt already loaded
  - BUG/MINOR: pattern: a sample marked as const could be written
  - BUG/MINOR: lua: set buffer size during map lookups
  - BUG/MINOR: stats: free dynamically stats fields/lines on shutdown
  - BUG/MINOR: peers: Do not ignore a protocol error for dictionary entries.
  - BUG/MINOR: peers: Missing TX cache entries reset.
  - BUG/MEDIUM: peers: fix decoding of multi-byte length in stick-table messages
  - BUG/MINOR: http-fetch: Extract cookie value even when no cookie name
  - BUG/MINOR: http-fetch: Fix calls w/o parentheses of the cookie sample fetches
  - BUG/MEDIUM: check: reuse srv proto only if using same mode
  - MINOR: check: report error on incompatible proto
  - MINOR: check: report error on incompatible connect proto
  - BUG/MINOR: http-htx: Handle warnings when parsing http-error and http-errors
  - BUG/MAJOR: spoe: Be sure to remove all references on a released spoe applet
  - MINOR: spoe: Don't close connection in sync mode on processing timeout
  - BUG/MINOR: tcpcheck: Don't warn on unused rules if check option is after
  - MINOR: init: Fix the prototype for per-thread free callbacks
  - MINOR: config/mux-h2: Return ERR_ flags from init_h2() instead of a status
  - MINOR: cfgparse: tighten the scope of newnameserver variable, free it on
    error.
  - REGTEST: ssl: test wildcard and multi-type + exclusions
  - REGTEST: ssl: mark reg-tests/ssl/ssl_crt-list_filters.vtc as broken
  - MINOR: peers: Add traces to peer_treat_updatemsg().
  - REGTEST: make ssl_client_samples and ssl_server_samples require to 2.2


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.2-0
changelog:
  - BUILD: http-htx: fix build warning regarding long type in printf
  - CLEANUP: cfgparse: remove duplicate registration for transparent build options
  - BUG/MEDIUM: filters: Forward all filtered data at the end of http filtering
  - BUG/MINOR: http-ana: Don't wait for the body of CONNECT requests
  - DOC: add missing 3.10 in the summary
  - BUG/MINOR: ssl: segv on startup when AKID but no keyid
  - BUG/MEDIUM: http-ana: Don't eval http-after-response ruleset on empty messages
  - BUG/MEDIUM: ssl/crt-list: bundle support broken in crt-list
  - BUG/MEDIUM: ssl: error when no certificate are found
  - BUG/MINOR: ssl/crt-list: load bundle in crt-list only if activated
  - BUG/MEDIUM: ssl/crt-list: fix error when no file found
  - BUILD: makefile: enable crypt(3) for OpenBSD
  - DOC: clarify how to create a fallback crt
  - CLEANUP: connection: do not use conn->owner when the session is known
  - BUG/MAJOR: connection: reset conn->owner when detaching from session list
  - BUG/MINOR: http_htx: Fix searching headers by substring
  - DOC: better describes how to configure a fallback crt
  - BUG/MAJOR: filters: Always keep all offsets up to date during data filtering
  - MEDIUM: cache: Change caching conditions
  - DOC: cache: Add new caching limitation information
  - REGTESTS: Add sample_fetches/cook.vtc
  - REGTESTS: converter: add url_dec test
  - MINOR: http_act: Add -m flag for del-header name matching method
  - BUILD: Make DEBUG part of .build_opts
  - BUILD: Show the value of DEBUG= in haproxy -vv
  - BUG/MEDIUM: http_act: Restore init of log-format list
  - BUG/MAJOR: peers: fix partial message decoding
  - DOC: better document the config file format and escaping/quoting rules
  - DOC: Clarify %HP description in log-format
  - BUG/MINOR: tcpcheck: Don't forget to reset tcp-check flags on new kind of
    check
  - MINOR: tcpcheck: Don't handle anymore in-progress send rules in tcpcheck_main
  - BUG/MAJOR: tcpcheck: Allocate input and output buffers from the buffer pool
  - DOC: config: Move req.hdrs and req.hdrs_bin in L7 samples fetches section
  - BUG/MINOR: http-fetch: Fix smp_fetch_body() when called from a health-check


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.3-0
changelog:
  - MINOR: plock: use an ARMv8 instruction barrier for the pause instruction
  - BUG/MEDIUM: lists: Lock the element while we check if it is in a list.
  - MINOR: task: remove __tasklet_remove_from_tasklet_list()
  - BUG/MEDIUM: task: close a possible data race condition on a tasklet's
    list link
  - BUG/MEDIUM: local log format regression.
  - BUG/MINOR: mux-h2/stats: make stream/connection proto errors more accurate
  - BUG/MINOR: mux-h2/stats: not all GOAWAY frames are errors
  - BUG/MINOR: lua: missing "\n" in error message
  - BUG/MINOR: lua: lua-load doesn't check its parameters
  - BUG/MINOR: lua: Post init register function are not executed beyond
    the first one
  - BUG/MINOR: lua: Some lua init operation are processed unsafe
  - MINOR: actions: Export actions lookup functions
  - MINOR: actions: add a function returning a service pointer from its name
  - MINOR: cli: add a function to look up a CLI service description
  - BUG/MINOR: lua: warn when registering action, conv, sf, cli or applet
    multiple times
  - BUG/MAJOR: ring: tcp forward on ring can break the reader counter.
  - BUILD/MINOR: haproxy DragonFlyBSD affinity build update.
  - DOC/MINOR: Fix formatting in Management Guide
  - BUG/MINOR: listener: use sockaddr_in6 for IPv6
  - BUG/MINOR: mux-h1: Handle keep-alive timeout for idle frontend connections
  - MINOR: protocol: add a ->set_port() helper to address families
  - MINOR: listener: automatically set the port when creating listeners
  - MINOR: listener: now use a generic add_listener() function
  - MEDIUM: ssl: fatal error with bundle + openssl < 1.1.1
  - BUG/MAJOR: spoa/python: Fixing return None
  - DOC: spoa/python: Fixing typo in IP related error messages
  - DOC: spoa/python: Rephrasing memory related error messages
  - DOC: spoa/python: Fixing typos in comments
  - BUG/MINOR: spoa/python: Cleanup references for failed Module Addobject
    operations
  - BUG/MINOR: spoa/python: Cleanup ipaddress objects if initialization fails
  - BUG/MEDIUM: spoa/python: Fixing PyObject_Call positional arguments
  - BUG/MEDIUM: spoa/python: Fixing references to None
  - DOC: email change of the DeviceAtlas maintainer
  - BUG/MINOR: http-check: Use right condition to consider HTX message as full
  - BUG/MINOR: tcpcheck: Don't rearm the check timeout on each read
  - MINOR: tcpcheck: Only wait for more payload data on HTTP expect rules
  - BUG/MINOR: tools: make parse_time_err() more strict on the timer validity
  - BUG/MINOR: tools: Reject size format not starting by a digit
  - BUG/MEDIUM: lb-leastconn: Reposition a server using the right eweight
  - BUG/MEDIUM: ssl/crt-list: bad behavior with "commit ssl cert"
  - REGTESTS: make use of HAPROXY_ARGS and pass -dM by default
  - BUILD: SSL: fine guard for SSL_CTX_add_server_custom_ext call
  - BUILD: Makefile: have "make clean" destroy .o/.a/.s in contrib subdirs as well
  - BUG/MINOR: mux-h1: Don't set CS_FL_EOI too early for protocol upgrade requests
  - BUG/MEDIUM: http-ana: Never for sending data in TUNNEL mode
  - BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request
  - CONTRIB: halog: fix build issue caused by %L printf format
  - CONTRIB: halog: mark the has_zero* functions unused
  - CONTRIB: halog: fix signed/unsigned build warnings on counts and timestamps
  - CONTRIB: debug: address "poll" utility build on non-linux platforms
  - BUILD: plock: remove dead code that causes a warning in gcc 11
  - BUILD: ssl: fine guard for SSL_CTX_get0_privatekey call
  - BUG/MINOR: dns: SRV records ignores duplicated AR records
  - DOC: fix "smp_size" vs "sample_size" in "log" directive arguments
  - BUG/MEDIUM: mux_h2: Add missing braces in h2_snd_buf()around trace+wakeup
  - BUILD: hpack: hpack-tbl-t.h uses VAR_ARRAY but does not include compiler.h
  - MINOR: atomic: don't use ; to separate instruction on aarch64.
  - BUG/MINOR: sink: Return an allocation failure in __sink_new if strdup() fails
  - BUG/MINOR: cfgparse: Fail if the strdup() for `rule->be.name` for
    `use_backend` fails
  - BUG/MINOR: tcpcheck: Report a L7OK if the last evaluated rule is a send rule
  - DOC: Improve the message printed when running `make` w/o `TARGET`
  - BUG/MINOR: stats: Make stat_l variable used to dump a stat line thread local
  - SCRIPTS: improve announce-release to support different tag and versions
  - SCRIPTS: make announce release support preparing announces before tag exists
  - BUG/MINOR: srv: do not init address if backend is disabled
  - BUG/MINOR: srv: do not cleanup idle conns if pool max is null
  - MINOR: converter: adding support for url_enc
  - BUILD: Makefile: exclude broken tests by default
  - CLEANUP: cfgparse: replace "realloc" with "my_realloc2" to fix to memory
    leak on error
  - MINOR: contrib/prometheus-exporter: export build_info
  - DOC: fix some spelling issues over multiple files
  - SCRIPTS: announce-release: fix typo in help message
  - DOC: Add maintainers for the Prometheus exporter
  - BUG/MINOR: sample: fix concat() converter's corruption with non-string
    variables


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.4-0
changelog:
  - MINOR: reg-tests: add a way to add service dependency
  - BUG/MINOR: sample: check alloc_trash_chunk return value in concat()
  - BUG/MINOR: reg-tests: fix service dependency script
  - MINOR: reg-tests: add base prometheus test
  - Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"
  - BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  - BUG/MINOR: check: Don't perform any check on servers defined in a frontend
  - BUG/MINOR: init: enforce strict-limits when using master-worker
  - MINOR: contrib/prometheus-exporter: avoid connection close header
  - MINOR: contrib/prometheus-exporter: use fill_info for process dump


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.5-0
changelog:
  - BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable
  - MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities
  - MINOR: server: Forbid server definitions in frontend sections
  - BUG/MINOR: threads: Fixes the number of possible cpus report for Mac.
  - MINOR: peers: Add traces for peer control messages.
  - BUG/MINOR: dns: SRV records ignores duplicated AR records (v2)
  - BUILD: peers: fix build warning about unused variable
  - BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  - BUG/MINOR: peers: Possible appctx pointer dereference.
  - MINOR: build: discard echoing in help target
  - BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  - BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd"
    helper
  - BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  - BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context
  - BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  - BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  - DOC: Improve documentation of the various hdr() fetches
  - BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  - BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  - BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file()
  - BUG/MEDIUM: session: only retrieve ready idle conn from session
  - REORG: backend: simplify conn_backend_get
  - BUG/MEDIUM: backend: never reuse a connection for tcp mode
  - BUG/MINOR: backend: check available list allocation for reuse
  - MINOR: contrib: Make the wireshark peers dissector compile for more distribs.
  - CLEANUP: tools: make resolve_sym_name() take a const pointer
  - CLEANUP: cli: make "show fd" use a const connection to access other fields
  - MINOR: cli: make "show fd" also report the xprt and xprt_ctx
  - MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps.
  - MINOR: ssl: provide a "show fd" helper to report important SSL information
  - MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them
  - MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber
    when known
  - MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber
    when known
  - MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber
    when known
  - MINOR: cli: give the show_fd helpers the ability to report a suspicious entry
  - MINOR: cli/show_fd: report some easily detectable suspicious states
  - MINOR: ssl/show_fd: report some FDs as suspicious when possible
  - MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls
  - MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls
  - MINOR: h1: Raise the chunk size limit up to (2^52 - 1)
  - DOC: management: fix "show resolvers" alphabetical ordering
  - BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  - BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store
  - BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  - BUG/MINOR: mux_h2: fix incorrect stat titles
  - BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  - BUG/MINOR: ssl: do not try to use early data if not configured
  - BUILD: ssl: fix build breakage with last commit
  - MINOR: cli/show_fd: report local and report ports when known
  - BUILD: Makefile: move REGTESTST_TYPE default setting
  - BUG/MEDIUM: mux-h2: handle remaining read0 cases
  - BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  - BUG/MINOR: sock: Unclosed fd in case of connection allocation failure
  - MINOR: config: Deprecate and ignore tune.chksize global option


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.6-0
changelog:
  - MINOR: check: do not ignore a connection header for http-check send
  - BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro
  - BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro
  - BUILD: ssl: guard SSL_CTX_set_msg_callback with
    SSL_CTRL_SET_MSG_CALLBACK macro
  - BUG/MINOR: intops: fix mul32hi()'s off-by-one
  - BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors
  - BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  - BUG/MINOR: server: re-align state file fields number
  - BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  - BUG/MINOR: backend: hold correctly lock when killing idle conn
  - BUG/MINOR: server: Fix server-state-file-name directive
  - CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  - BUG/MEDIUM: config: don't pick unset values from last defaults section
  - BUG/MINOR: stats: revert the change on ST_CONVDONE
  - BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  - BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  - DOC: tune: explain the origin of block size for ssl.cachesize
  - CLEANUP: channel: fix comment in ci_putblk.
  - BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  - BUG/MINOR: session: atomically increment the tracked sessions counter
  - BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  - BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust()
  - BUG/MINOR: sample: Always consider zero size string samples as unsafe
  - BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions
  - DOC: explain the relation between pool-low-conn and tune.idle-pool.shared
  - BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ().
  - BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer
  - BUG/MINOR: http-rules: Always replace the response status on a return action
  - BUG/MINOR: server: Init params before parsing a new server-state line
  - BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  - BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  - BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert"
  - MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes
  - BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  - BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  - BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  - BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  - BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  - BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl()
  - BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned
  - BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record
  - BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  - BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  - BUG/MEDIUM: resolvers: Reset address for unresolved servers
  - BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
  - CLEANUP: muxes: Remove useless if condition in show_fd function
  - BUG/MINOR: stats: fix compare of no-maint url suffix
  - BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  - BUG/MINOR: http-ana: Only consider dst address to process originalto option
  - BUG/MINOR: tcp-act: Don't forget to set the original port for
    IPv4 set-dst rule
  - BUG/MINOR: connection: Use the client's dst family for adressless servers
  - BUG/MEDIUM: spoe: Kill applets if there are pending connections
    and nbthread > 1
  - DOC: spoe: Add a note about fragmentation support in HAProxy
  - BUG/MINOR: mux-h2: Fix typo in scheme adjustment
  - BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.7-0
changelog:
  - BUG/MINOR: backend: fix condition for reuse on mode HTTP
  - BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  - BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  - REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h
  - BUG/MINOR: mt-list: always perform a cpu_relax call on failure
  - MINOR: atomic: add armv8.1-a atomics variant for cas-dw
  - MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs
  - BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  - MINOR: tasks: refine the default run queue depth
  - MINOR: listener: refine the default MAX_ACCEPT from 64 to 4
  - OPTIM: server: switch the actconn list to an mt-list
  - MINOR: server: move actconns to the per-thread structure
  - MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock
  - OPTIM: lb-first: do not take the server lock on take_conn/drop_conn
  - OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn
  - OPTIM: lb-leastconn: do not unlink the server if it did not change
  - MINOR: dynbuf: make the buffer wait queue per thread
  - MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait
  - MINOR: dynbuf: pass offer_buffers() the number of buffers instead of
    a threshold
  - MINOR: stream: add an "epoch" to figure which streams appeared when
  - MINOR: cli/streams: make "show sess" dump all streams till the new epoch
  - MINOR: streams: use one list per stream instead of a global one
  - MEDIUM: streams: do not use the streams lock anymore
  - MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS
  - MINOR: pools: double the local pool cache size to 1 MB
  - MEDIUM: backend: use a trylock when trying to grab an idle connection
  - MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY
  - MINOR: ssl: mark the SSL handshake tasklet as heavy
  - BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake
  - MINOR: task: add an application specific flag to the state: TASK_F_USR1
  - MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1
  - MINOR: xprt: add new xprt_set_idle and xprt_set_used methods
  - MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks
  - MEDIUM: task: remove the tasks_run_queue counter and have one per thread
  - MINOR: task: give the scheduler a bit more flexibility in the runqueue size
  - OPTIM: task: automatically adjust the default runqueue-depth to the threads
  - BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple
    http tracksc.
  - BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw()
  - BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  - BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check
  - BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  - BUG/MINOR: session: Add some forgotten tests on session's listener
  - BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check
  - CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  - Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with
    an additional record"
  - BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  - BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  - BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  - BUG/MEDIUM: resolvers: Don't set an address-less server as UP
  - BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item
  - MINOR: resolvers: new function find_srvrq_answer_record()
  - BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item
  - BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete
  - MINOR: resolvers: Use a function to remove answers attached to a resolution
  - MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  - MINOR: resolvers: Add function to change the srv status based on
    SRV resolution
  - MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  - BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks
  - BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set
  - MINOR: resolvers: Use milliseconds for cached items in resolver responses
  - MINOR: resolvers: Don't try to match immediatly renewed ADD items
  - BUG/MINOR: resolvers: Add missing case-insensitive comparisons
    of DNS hostnames


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.8-0
changelog:
  - MINOR: time: export the global_now variable
  - BUG/MINOR: freq_ctr/threads: make use of the last updated global time
  - BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback
  - MINOR: time: also provide a global, monotonic global_now_ms timer
  - BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  - BUG/MINOR: protocol: add missing support of dgram unix socket.
  - MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master
    CLI socket
  - MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua
  - BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable
  - BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
  - BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro
  - MINOR: lua: Slightly improve function dumping the lua traceback
  - BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  - BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  - MINOR: fd: make fd_clr_running() return the remaining running mask
  - MINOR: fd: remove the unneeded running bit from fd_insert()
  - BUG/MEDIUM: fd: do not wait on FD removal in fd_delete()
  - CLEANUP: fd: remove unused fd_set_running_excl()
  - BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available.
  - BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  - MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  - BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.9-0
changelog:
  - BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent
  - MEDIUM: backend: use a trylock to grab a connection on high FD counts as well
  - BUG/MINOR: payload: Wait for more data if buffer is empty
    in payload/payload_lv
  - BUG/MINOR: stats: Apply proper styles in HTML status page.
  - BUG/MEDIUM: time: make sure to always initialize the global tick


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.10-0
changelog:
  - BUILD: backend: fix build breakage in idle conn locking fix
  - BUG/MINOR: tcp: fix silent-drop workaround for IPv6
  - BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  - BUG/MINOR: ssl: Fix update of default certificate
  - BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is
    a default one
  - BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  - BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free
  - REGTESTS: ssl: "set ssl cert" and multi-certificates bundle
  - DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  - REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken
  - CONTRIB: halog: fix issue with array of type char
  - BUG/MINOR: tools: fix parsing "us" unit for timers
  - DOC: clarify that compression works for HTTP/2
  - MINOR: No longer rely on deprecated sample fetches for predefined ACLs
  - BUG/MEDIUM: sample: Fix adjusting size in field converter
  - DOC: ssl: Certificate hot update only works on fronted certificates
  - BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  - BUG/MINOR: checks: Set missing id to the dummy checks frontend
  - MINOR: logs: Add support of checks as session origin to format lf strings
  - BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections
  - MINOR: connection: Make bc_http_major compatible with tcp-checks
  - BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check
  - BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  - BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  - BUG/MINOR: logs: Report the true number of retries if there was no connection
  - BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  - BUG/MINOR: server: free srv.lb_nodes in free_server
  - BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  - BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  - BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  - BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  - BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  - BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  - BUG/MINOR: peers: remove useless table check if initial resync is finished
  - BUG/MEDIUM: peers: re-work connection to new process during reload.
  - BUG/MEDIUM: peers: re-work refcnt on table to protect against flush


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.0-0
changelog:
  - BUG/MINOR: http_fetch: fix possible uninit sockaddr in fetch_url_ip/port
  - CLEANUP: cli/activity: Remove double spacing in set profiling command
  - CI: Build VTest with clang
  - CI: extend spellchecker whitelist, add "ists" as well
  - CLEANUP: assorted typo fixes in the code and comments
  - BUG/MINOR: memprof: properly account for differences for realloc()
  - MINOR: memprof: also report the method used by each call
  - MINOR: memprof: also report the totals and delta alloc-free
  - CLEANUP: pattern: remove the unused and dangerous pat_ref_reload()
  - BUG/MINOR: http_act: Fix normalizer names in error messages
  - MINOR: uri_normalizer: Add `fragment-strip` normalizer
  - MINOR: uri_normalizer: Add `fragment-encode` normalizer
  - IMPORT: slz: use the generic function for the last bytes of the crc32
  - IMPORT: slz: do not produce the crc32_fast table when CRC is natively
    supported
  - BUILD/MINOR: opentracing: fixed compilation with filter enabled
  - BUILD: makefile: add a few popular ARMv8 CPU targets
  - BUG/MEDIUM: stick_table: fix crash when using tcp smp_fetch_src
  - REGTESTS: stick-table: add src_conn_rate test
  - CLEANUP: stick-table: remove a leftover of an old keyword declaration
  - BUG/MINOR: stats: fix lastchk metric that got accidently lost
  - EXAMPLES: add a "basic-config-edge" example config
  - EXAMPLES: add a trivial config for quick testing
  - DOC: management: Correct example reload command in the document
  - Revert "CI: Build VTest with clang"
  - MINOR: activity/cli: optionally support sorting by address on "show profiling"
  - DEBUG: ssl: export ssl_sock_close() to see its symbol resolved in profiling
  - BUG/MINOR: lua/vars: prevent get_var() from allocating a new name
  - DOC: config: Fix configuration example for mqtt
  - BUG/MAJOR: config: properly initialize cpu_map.thread[] up to MAX_THREADS
  - BUILD: config: avoid a build warning on numa_detect_topology() without threads
  - DOC: update min requirements in INSTALL
  - IMPORT: slz: use inttypes.h instead of stdint.h
  - BUILD: sample: use strtoll() instead of atoll()
  - MINOR: version: mention that it's LTS now.


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.1-0
changelog:
  - BUG/MEDIUM: ebtree: Invalid read when looking for dup entry
  - BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  - BUILD/MINOR: opentracing: fixed build when using clang
  - BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  - BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  - Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers"
  - BUG/MINOR: http-ana: Send the right error if max retries is reached
    on L7 retry
  - BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  - MINOR: http-ana: Perform L7 retries because of status codes
    in response analyser
  - MINOR: cfgparse: Fail when encountering extra arguments in macro
  - DOC: intro: Fix typo in starter guide
  - BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  - BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  - BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  - BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  - BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  - BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  - BUG/MINOR: http: Missing calloc return value check while parsing
    tcp-request/tcp-response
  - BUG/MINOR: http: Missing calloc return value check while parsing
    tcp-request rule
  - BUG/MINOR: compression: Missing calloc return value check
    in comp_append_type/algo
  - BUG/MINOR: worker: Missing calloc return value check in
    mworker_env_to_proc_list
  - BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  - BUG/MINOR: http: Missing calloc return value check in make_arg_list
  - BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  - CLEANUP: http-ana: Remove useless if statement about L7 retries
  - BUG/MINOR: vars: Be sure to have a session to get checks variables
  - DOC/MINOR: move uuid in the configuration to the right alphabetical order
  - BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  - MINOR: errors: allow empty va_args for diag variadic macro
  - DOC: use the req.ssl_sni in examples
  - BUILD: make tune.ssl.keylog available again
  - BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  - Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode"
  - BUG/MEDIUM: opentracing: initialization before establishing daemon
    and/or chroot mode
  - BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block
  - BUG/MEDIUM: compression: Properly get the next block to iterate on payload
  - BUG/MEDIUM: compression: Add a flag to know the filter is still
    processing data
  - BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  - BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location
  - MINOR: pools: do not maintain the lock during pool_flush()
  - MINOR: pools: call malloc_trim() under thread isolation
  - MEDIUM: pools: use a single pool_gc() function for locked and lockless
  - BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  - CLEANUP: pools: remove now unused seq and pool_free_list
  - BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  - BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  - CLEANUP: l7-retries: do not test the buffer before calling b_alloc()
  - BUG/MINOR: resolvers: answser item list was randomly purged or errors
  - MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  - MEDIUM: resolvers: add a ref between servers and srv request or used
    SRV record
  - BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  - DOC: lua: Add a warning about buffers modification in HTTP
  - BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  - BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server'
  - BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees
  - BUG/MEDIUM: server: do not forget to generate the dynamic servers ids
  - BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree
  - BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node
  - BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  - BUG/MINOR: ssl: use atomic ops to update global shctx stats
  - BUG/MINOR: mworker: fix typo in chroot error message
  - CLEANUP: global: remove unused definition of stopping_task[]
  - BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue
  - MINOR: backend: only skip LB when there are actual connections
  - BUG/MINOR: mux-h1: do not skip the error response on bad requests
  - BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers
  - MINOR: connection: add helper conn_append_debug_info()
  - MINOR: mux-h2/trace: report a few connection-level info during h2_init()
  - CLEANUP: mux-h2/traces: better align user messages
  - BUG/MINOR: stats: make "show stat typed desc" work again
  - MINOR: mux-h2: obey http-ignore-probes during the preface
  - BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace
  - BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.2-0
changelog:
  - BUG/MINOR: server-state: load SRV resolution only if params match the config
  - BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  - BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  - MINOR: resolvers: Clean server in a dedicated function when removing
    a SRV item
  - MINOR: resolvers: Remove server from named_servers tree when removing
    a SRV item
  - BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  - BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()
  - BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  - BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header
  - BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  - REGTESTS: fix maxconn update with agent-check
  - MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  - DOC: config: Add missing actions in "tcp-request session" documentation
  - CLEANUP: dns: Remove a forgotten debug message
  - BUG/MINOR: resolvers: Always attach server on matching record on resolution
  - BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  - MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  - BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  - BUILD: Makefile: fix linkage for Haiku.
  - BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  - BUG/MINOR: mqtt: Fix parser for string with more than 127 characters
  - BUG/MINOR: mqtt: Support empty client ID in CONNECT message
  - BUG/MEDIUM: resolvers: Make 1st server of a template take part to
    SRV resolution
  - DOC: config: use CREATE USER for mysql-check
  - BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  - BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  - DOC: stick-table: add missing documentation about gpt0 stored type
  - BUG/MEDIUM: sock: make sure to never miss early connection failures
  - BUG/MINOR: cli: fix server name output in "show fd"
  - Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request
    content" rules"
  - MINOR: http: implement http_get_scheme
  - MEDIUM: http: implement scheme-based normalization
  - MEDIUM: h1-htx: apply scheme-based normalization on h1 requests
  - MEDIUM: h2: apply scheme-based normalization on h2 requests
  - REGTESTS: add http scheme-based normalization test


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.3-0
changelog:
  - BUILD: http_htx: fix ci compilation error with isdigit for Windows
  - MINOR: mux_h2: define config to disable h2 websocket support
  - BUG/MINOR: ssl: Default-server configuration ignored by server
  - BUILD: add detection of missing important CFLAGS
  - BUILD: lua: silence a build warning with TCC
  - BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  - BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  - BUILD/MINOR: memprof fix macOs build.
  - BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  - BUG/MINOR: stats: Add missing agent stats on servers
  - BUG/MINOR: check: fix the condition to validate a port-less server
  - BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  - BUG/MINOR: systemd: must check the configuration using -Ws
  - BUG/MINOR: mux-h1: Obey dontlognull option for empty requests
  - BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  - BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe()
    is called
  - BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  - BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  - BUG/MEDIUM: connection: close a rare race between idle conn close and takeover
  - BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  - BUG/MINOR: select: fix excess number of dead/skip reported
  - BUG/MINOR: poll: fix abnormally high skip_fd counter
  - BUG/MINOR: pollers: always program an update for migrated FDs
  - BUG/MINOR: fd: protect fd state harder against a concurrent takeover
  - DOC: internals: document the FD takeover process
  - BUILD: opentracing: fixed build when using pkg-config utility
  - BUG/MINOR: server: remove srv from px list on CLI 'add server' error
  - BUG/MINOR: server: update last_change on maint->ready transitions too
  - MINOR: server: unmark deprecated on enable health/agent cli
  - ADMIN: dyncookie: implement a simple dynamic cookie calculator
  - MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  - BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one
    is released
  - BUG/MINOR: buffer: fix buffer_dump() formatting
  - BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  - DOC: Improve the lua documentation
  - DOC: config: Fix 'http-response send-spoe-group' documentation
  - BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  - BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during
    config check
  - CLEANUP: assorted typo fixes in the code and comments
  - DOC/MINOR: fix typo in management document
  - MINOR: http: add a new function http_validate_scheme() to validate a scheme
  - BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  - BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  - BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  - BUG/MEDIUM: h2: give :authority precedence over Host
  - REGTESTS: add a test to prevent h2 desync attacks


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.4-0
changelog:
  - BUG/MEDIUM: h2: match absolute-path not path-absolute for :path
  - REGTESTS: http_upgrade: fix incorrect expectation on TCP->H1->H2
  - REGTESTS: abortonclose: after retries, 503 is expected, not close
  - MINOR: hlua: take the global Lua lock inside a global function
  - BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  - BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  - BUG/MINOR: base64: base64urldec() ignores padding in output size check
  - MINOR: compiler: implement an ONLY_ONCE() macro
  - BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  - BUG/MINOR: time: fix idle time computation for long sleeps
  - MINOR: time: add report_idle() to report process-wide idle time
  - BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  - BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  - BUG/MINOR: tools: Fix loop condition in dump_text()
  - CLEANUP: Add missing include guard to signal.h
  - BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser
  - DOC: configuration: remove wrong tcp-request examples in tcp-response
  - BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB
  - CLEANUP: htx: remove comments about "must be < 256 MB"
  - BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  - Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn
    may receive"


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.0-0
changelog:
  - MINOR: compression: Improve the way Vary header is added
  - BUILD: makefile: search for SSL_INC/wolfssl before SSL_INC
  - MINOR: init: pre-allocate kernel data structures on init
  - DOC: install: add details about WolfSSL
  - BUG/MINOR: ssl_sock: add check for ha_meth
  - BUG/MINOR: thread: add a check for pthread_create
  - BUILD: init: print rlim_cur as regular integer
  - DOC: install: specify the minimum openssl version recommended
  - CLEANUP: mux-quic: remove unneeded fields in qcc
  - MINOR: mux-quic: remove nb_streams from qcc
  - MINOR: quic: fix stats naming for flow control BLOCKED frames
  - BUG/MEDIUM: mux-quic: only set EOI on FIN
  - BUG/MEDIUM: threads: fix a tiny race in thread_isolate()
  - DOC: config: fix rfc7239 converter examples
  - DOC: quic: remove experimental status for QUIC
  - CLEANUP: mux-quic: rename functions for mux_ops
  - CLEANUP: mux-quic: rename internal functions
  - BUG/MINOR: mux-h2: refresh the idle_timer when the mux is empty
  - DOC: config: Fix bind/server/peer documentation in the peers section
  - BUILD: Makefile: use -pthread not -lpthread when threads are enabled
  - CLEANUP: doc: remove 21 totally obsolete docs
  - DOC: install: mention the common strict-aliasing warning on older compilers
  - DOC: install: clarify a few points on the wolfSSL build method
  - MINOR: quic: Add QUIC connection statistical counters values to "show quic"
  - EXAMPLES: update the basic-config-edge file for 2.8
  - MINOR: quic/cli: clarify the "show quic" help message
  - MINOR: version: mention that it's LTS now.


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.1-0
changelog:
  - BUG/MINOR: stats: Fix Lua's `get_stats` function
  - BUG/MINOR: stream: do not use client-fin/server-fin with HTX
  - BUG/MINOR: quic: Possible crash when SSL session init fails
  - CONTRIB: Add vi file extensions to .gitignore
  - BUG/MINOR: spoe: Only skip sending new frame after a receive attempt
  - DOC: quic: fix misspelled tune.quic.socket-owner
  - DOC: config: fix jwt_verify() example using var()
  - DOC: config: fix rfc7239 converter examples (again)
  - BUG/MINOR: cfgparse-tcp: leak when re-declaring interface from bind line
  - BUG/MINOR: proxy: add missing interface bind free in free_proxy
  - BUG/MINOR: proxy/server: free default-server on deinit
  - BUG/MEDIUM: hlua: Use front SC to detect EOI in HTTP applets' receive
    functions
  - BUG/MINOR: peers: Improve detection of config errors in peers sections
  - REG-TESTS: stickiness: Delay haproxys start to properly resolv variables
  - BUG/MINOR: ssl: log message non thread safe in SSL Hanshake failure
  - BUG/MINOR: quic: Wrong encryption level flags checking
  - BUG/MINOR: quic: Address inversion in "show quic full"
  - BUG/MINOR: server: inherit from netns in srv_settings_cpy()
  - BUG/MINOR: namespace: missing free in netns_sig_stop()
  - BUG/MINOR: quic: Missing initialization (packet number space probing)
  - BUG/MINOR: quic: Possible crash in quic_conn_prx_cntrs_update()
  - BUG/MINOR: quic: Possible endless loop in quic_lstnr_dghdlr()
  - BUG/MEDIUM: mworker: increase maxsock with each new worker
  - BUG/MINOR: quic: ticks comparison without ticks API use
  - DOC: Add tune.h2.be.* and tune.h2.fe.* options to table of contents
  - DOC: Add tune.h2.max-frame-size option to table of contents
  - REGTESTS: h1_host_normalization : Add a barrier to not mix up log messages
  - DOC: Attempt to fix dconv parsing error for tune.h2.fe.initial-window-size
  - BUG/MINOR: http_ext: fix if-none regression in forwardfor option
  - BUG/MINOR: mworker: leak of a socketpair during startup failure
  - BUG/MINOR: quic: Prevent deadlock with CID tree lock
  - BUG/MEDIUM: quic: error checking buffer large enought to receive the retry tag
  - BUG/MINOR: config: fix stick table duplicate name check
  - BUG/MINOR: quic: Missing random bits in Retry packet header
  - BUG/MINOR: quic: Wrong Retry paquet version field endianess
  - BUG/MINOR: quic: Wrong endianess for version field in Retry token
  - IMPORT: slz: implement a synchronous flush() operation
  - MINOR: compression/slz: add support for a pure flush of pending bytes
  - BUILD: debug: avoid a build warning related to epoll_wait() in debug code
  - MINOR: quic: Move QUIC encryption level structure definition
  - MINOR: quic: Move packet number space related functions
  - MINOR: quic: Reduce the maximum length of TLS secrets
  - CLEANUP: quic: Remove server specific about Initial packet number space


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.2-0
changelog:
  - DOC: ssl: Fix typo in 'ocsp-update' option
  - DOC: ssl: Add ocsp-update troubleshooting clues and emphasize on crt-list
    only aspect
  - BUG/MINOR: tcp_sample: bc_{dst,src} return IP not INT
  - BUG/MINOR: cache: A 'max-age=0' cache-control directive can be overriden
    by a s-maxage
  - BUG/MEDIUM: sink: invalid server list in sink_new_from_logsrv()
  - BUG/MINOR: http_ext: unhandled ERR_ABORT in proxy_http_parse_7239()
  - BUG/MINOR: sink: missing sft free in sink_deinit()
  - BUG/MINOR: ring: size warning incorrectly reported as fatal error
  - BUG/MINOR: ring: maxlen warning reported as alert
  - BUG/MINOR: log: LF upsets maxlen for UDP targets
  - MINOR: sink/api: pass explicit maxlen parameter to sink_write()
  - BUG/MEDIUM: log: improper use of logsrv->maxlen for buffer targets
  - BUG/MINOR: log: fix missing name error message in cfg_parse_log_forward()
  - BUG/MINOR: log: fix multiple error paths in cfg_parse_log_forward()
  - BUG/MINOR: log: free errmsg on error in cfg_parse_log_forward()
  - BUG/MINOR: sink: invalid sft free in sink_deinit()
  - BUG/MINOR: sink: fix errors handling in cfg_post_parse_ring()
  - BUG/MINOR: server: set rid default value in new_server()
  - MINOR: hlua_fcn/mailers: handle timeout mail from mailers section
  - BUG/MINOR: sink/log: properly deinit srv in sink_new_from_logsrv()
  - EXAMPLES: maintain haproxy 2.8 retrocompatibility for lua mailers script
  - BUG/MINOR: hlua_fcn/queue: use atomic load to fetch queue size
  - BUG/MINOR: config: Remove final '\n' in error messages
  - BUG/MEDIUM: quic: token IV was not computed using a strong secret
  - BUG/MINOR: quic: retry token remove one useless intermediate expand
  - BUG/MEDIUM: quic: missing check of dcid for init pkt including a token
  - BUG/MEDIUM: quic: timestamp shared in token was using internal time clock
  - CLEANUP: quic: remove useless parameter 'key' from quic_packet_encrypt
  - BUG/MINOR: hlua: hlua_yieldk ctx argument should support pointers
  - BUG/MEDIUM: hlua_fcn/queue: bad pop_wait sequencing
  - DOC: config: Fix fc_src description to state the source address is returned
  - BUG/MINOR: sample: Fix wrong overflow detection in add/sub conveters
  - BUG/MINOR: http: Return the right reason for 302
  - CI: add naming convention documentation
  - CI: explicitely highlight VTest result section if there's something
  - BUILD: quic: fix warning during compilation using gcc-6.5
  - BUG/MINOR: hlua: add check for lua_newstate
  - BUG/MINOR: h1-htx: Return the right reason for 302 FCGI responses
  - MINOR: cpuset: add cpu_map_configured() to know if a cpu-map was found
  - BUG/MINOR: config: do not detect NUMA topology when cpu-map is configured
  - BUG/MINOR: cpuset: remove the bogus "proc" from the cpu_map struct
  - BUG/MINOR: init: set process' affinity even in foreground
  - BUG/MINOR: server: Don't warn on server resolution failure with init-addr none
  - BUG/MINOR: quic: Missing parentheses around PTO probe variable.
  - BUG/MINOR: server-state: Ignore empty files
  - BUG/MINOR: server-state: Avoid warning on 'file not found'
  - BUG/MEDIUM: listener: Acquire proxy's lock in relax_listener() if necessary
  - MINOR: quic: Make ->set_encryption_secrets() be callable two times
  - MINOR: quic: Useless call to SSL_CTX_set_quic_method()
  - BUG/MINOR: ssl: OCSP callback only registered for first SSL_CTX
  - BUG/MEDIUM: h3: Properly report a C-L header was found to the HTX start-line
  - DOC: configuration: describe Td in Timing events
  - BUG/MINOR: chunk: fix chunk_appendf() to not write a zero if buffer is full
  - BUG/MEDIUM: h3: Be sure to handle fin bit on the last DATA frame
  - BUG/MEDIUM: bwlim: Reset analyse expiration date when then channel analyse
    ends
  - BUG/MEDIUM: quic: consume contig space on requeue datagram
  - BUG/MINOR: http-client: Don't forget to commit changes on HTX message
  - BUG/MINOR: quic: reappend rxbuf buffer on fake dgram alloc error
  - BUILD: quic: fix wrong potential NULL dereference
  - BUG/MAJOR: http-ana: Get a fresh trash buffer for each header value
    replacement
  - REORG: http: move has_forbidden_char() from h2.c to http.h
  - BUG/MAJOR: h3: reject header values containing invalid chars
  - BUG/MAJOR: http: reject any empty content-length header value
  - MINOR: ist: add new function ist_find_range() to find a character range
  - MINOR: http: add new function http_path_has_forbidden_char()
  - MINOR: h2: pass accept-invalid-http-request down the request parser
  - REGTESTS: http-rules: add accept-invalid-http-request for normalize-uri tests
  - BUG/MINOR: h1: do not accept '#' as part of the URI component
  - BUG/MINOR: h2: reject more chars from the :path pseudo header
  - BUG/MINOR: h3: reject more chars from the :path pseudo header
  - REGTESTS: http-rules: verify that we block '#' by default for normalize-uri
  - DOC: clarify the handling of URL fragments in requests
  - BUG/MINOR: http: skip leading zeroes in content-length values


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.3-0
changelog:
  - CI: do not use "groupinstall" for Fedora Rawhide builds
  - CI: get rid of travis-ci wrapper for Coverity scan
  - BUG/MEDIUM: quic: fix tasklet_wakeup loop on connection closing
  - BUG/MINOR: hlua: fix invalid use of lua_pop on error paths
  - DEV: flags/show-sess-to-flags: properly decode fd.state
  - BUG/MINOR: stktable: allow sc-set-gpt(0) from tcp-request connection
  - BUG/MINOR: stktable: allow sc-add-gpc from tcp-request connection
  - DOC: typo: fix sc-set-gpt references
  - SCRIPTS: git-show-backports: automatic ref and base detection with -m
  - REGTESTS: Do not use REQUIRE_VERSION for HAProxy 2.5+ (3)
  - DOC: jwt: Add explicit list of supported algorithms
  - BUILD: Makefile: add the USE_QUIC option to make help
  - IMPORT: plock: also support inlining the int code
  - MINOR: threads: inline the wait function for pthread_rwlock emulation
  - MINOR: atomic: make sure to always relax after a failed CAS
  - IMPORT: xxhash: update xxHash to version 0.8.2
  - CI: fedora: fix "dnf" invocation syntax
  - BUG/MINOR: hlua_fcn: potentially unsafe stktable_data_ptr usage
  - DOC: lua: fix core.register_action typo
  - BUG/MINOR: ssl_sock: fix possible memory leak on OOM
  - BUILD: import: guard plock.h against multiple inclusion
  - BUG/MINOR: ssl/cli: can't find ".crt" files when replacing a certificate
  - BUG/MINOR: stream: protect stream_dump() against incomplete streams
  - DOC: config: mention uid dependency on the tune.quic.socket-owner option
  - BUG/MINOR: checks: do not queue/wake a bounced check
  - DEBUG: applet: Properly report opposite SC expiration dates in traces
  - BUG/MEDIUM: stconn: Update stream expiration date on blocked sends
  - BUG/MINOR: stconn: Don't report blocked sends during connection establishment
  - BUG/MEDIUM: stconn: Wake applets on sending path if there is a pending
    shutdown
  - BUG/MEDIUM: stconn: Don't block sends if there is a pending shutdown
  - BUG/MINOR: quic: Possible skipped RTT sampling
  - BUG/MAJOR: quic: Really ignore malformed ACK frames.
  - BUG/MEDIUM: h1-htx: Ensure chunked parsing with full output buffer
  - BUG/MINOR: stream: further protect stream_dump() against incomplete sessions
  - DOC: configuration: update examples for req.ver
  - MINOR: httpclient: allow to configure the retries
  - MINOR: httpclient: allow to configure the timeout.connect
  - BUG/MINOR: quic: Wrong RTT adjusments
  - BUG/MINOR: quic: Wrong RTT computation (srtt and rrt_var)
  - BUG/MEDIUM: applet: Fix API for function to push new data in channels buffer
  - BUG/MEDIUM: stconn: Report read activity when a stream is attached to front SC
  - BUG/MEDIUM: applet: Report an error if applet request more room on aborted SC
  - BUG/MEDIUM: stconn/stream: Forward shutdown on write timeout
  - NUG/MEDIUM: stconn: Always update stream's expiration date after I/O
  - BUG/MINOR: applet: Always expect data when CLI is waiting for a new command
  - BUG/MINOR: ring/cli: Don't expect input data when showing events
  - BUG/MINOR: hlua/action: incorrect message on E_YIELD error
  - MEDIUM: capabilities: enable support for Linux capabilities
  - CI: Update to actions/checkout@v4


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.4-0
changelog:
  - BUILD: bug: make BUG_ON() void to avoid a rare warning
  - BUG/MINOR: quic: Leak of frames to send.
  - BUG/MINOR: quic: Wrong cluster secret initialization
  - MINOR: quic: QUIC openssl wrapper implementation
  - MINOR: quic: Include QUIC opensssl wrapper header from TLS stacks
    compatibility header
  - MINOR: quic: Do not enable O-RTT with USE_QUIC_OPENSSL_COMPAT
  - MINOR: quic: Set the QUIC connection as extra data before calling
    SSL_set_quic_method()
  - MINOR: quic: Do not enable 0RTT with SSL_set_quic_early_data_enabled()
  - MINOR: quic: Add a compilation option for the QUIC OpenSSL wrapper
  - MINOR: quic: Export some KDF functions (QUIC-TLS)
  - MINOR: quic: Initialize TLS contexts for QUIC openssl wrapper
  - MINOR: quic: Call the keylog callback for QUIC openssl wrapper from
    SSL_CTX_keylog()
  - MINOR: quic: Add a quic_openssl_compat struct to quic_conn struct
  - MINOR: quic: SSL context initialization with QUIC OpenSSL wrapper.
  - MINOR: quic: Add "limited-quic" new tuning setting
  - DOC: quic: Add "limited-quic" new tuning setting
  - BUG/MINOR: quic+openssl_compat: Non initialized TLS encryption levels
  - MINOR: quic: Warning for OpenSSL wrapper QUIC bindings without "limited-quic"
  - MINOR: quic+openssl_compat: Do not start without "limited-quic"
  - MINOR: quic+openssl_compat: Emit an alert for "allow-0rtt" option
  - BUILD: Makefile: add USE_QUIC_OPENSSL_COMPAT to make help
  - BUG/MINOR: quic: allow-0rtt warning must only be emitted with quic bind
  - BUG/MINOR: quic: ssl_quic_initial_ctx() uses error count not error code
  - BUILD: quic: fix build on centos 8 and USE_QUIC_OPENSSL_COMPAT
  - MINOR: hlua: add hlua_stream_ctx_prepare helper function
  - BUG/MEDIUM: hlua: streams don't support mixing lua-load with
    lua-load-per-thread
  - Revert "BUG/MEDIUM: quic: missing check of dcid for init pkt including
    a token"
  - CI: musl: highlight section if there are coredumps
  - CI: musl: drop shopt in workflow invocation
  - BUG/MEDIUM: hlua: don't pass stale nargs argument to lua_resume()
  - BUG/MINOR: hlua/init: coroutine may not resume itself
  - BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records
  - BUG/MINOR: promex: fix backend_agg_check_status
  - BUG/MEDIUM: master/cli: Pin the master CLI on the first thread of the group 1
  - BUG/MINOR: freq_ctr: fix possible negative rate with the scaled API
  - BUG/MAJOR: mux-h2: Report a protocol error for any DATA frame before headers
  - BUG/MINOR: server: add missing free for server->rdr_pfx
  - MINOR: pattern: fix pat_{parse,match}_ip() function comments
  - BUG/MEDIUM: server/cli: don't delete a dynamic server that has streams
  - BUG/MINOR: mux-quic: remove full demux flag on ncbuf release
  - BUG/MEDIUM: actions: always apply a longest match on prefix lookup
  - BUG/MEDIUM: quic_conn: let the scheduler kill the task when needed
  - BUG/MEDIUM: http-ana: Try to handle response before handling server abort
  - MINOR: hlua: Set context's appctx when the lua socket is created
  - MINOR: hlua: Don't preform operations on a not connected socket
  - MINOR: hlua: Save the lua socket's timeout in its context
  - MINOR: hlua: Save the lua socket's server in its context
  - MINOR: hlua: Test the hlua struct first when the lua socket is connecting
  - BUG/MEDIUM: hlua: Initialize appctx used by a lua socket on connect only
  - BUG/MINOR: mux-h1: Handle read0 in rcv_pipe() only when data receipt was tried
  - BUG/MINOR: mux-h1: Ignore C-L when sending H1 messages if T-E is also set
  - BUG/MEDIUM: h1: Ignore C-L value in the H1 parser if T-E is also set
  - BUG/MINOR: hq-interop: simplify parser requirement
  - BUG/MEDIUM: stconn: Fix comparison sign in sc_need_room()
  - BUG/MINOR: quic: Avoid crashing with unsupported cryptographic algos
  - BUG/MINOR: quic: reject packet with no frame
  - BUG/MEDIUM: mux-quic: fix RESET_STREAM on send-only stream
  - BUG/MINOR: mux-quic: support initial 0 max-stream-data
  - BUG/MINOR: h3: strengthen host/authority header parsing
  - BUG/MINOR: mux-quic: fix free on qcs-new fail alloc
  - BUG/MEDIUM: quic-conn: free unsent frames on retransmit to prevent crash
  - BUG/MINOR: mux-h1: Send a 400-bad-request on shutdown before the first request
  - BUG/MINOR: mux-h2: make up other blocked streams upon removal from list
  - BUG/MEDIUM: mux-h2: Don't report an error on shutr if a shutw is pending
  - BUG/MINOR: mux-h2: fix http-request and http-keep-alive timeouts again
  - BUG/MINOR: trace: fix trace parser error reporting
  - BUG/MEDIUM: peers: Be sure to always refresh recconnect timer in sync task
  - BUG/MEDIUM: peers: Fix synchro for huge number of tables
  - BUG/MINOR: mux-h2: commit the current stream ID even on reject
  - BUG/MINOR: mux-h2: update tracked counters with req cnt/req err
  - DOC: internal: filters: fix reference to entities.pdf
  - BUG/MINOR: ssl: load correctly @system-ca when ca-base is define
  - MINOR: lua: Add flags to configure logging behaviour
  - DEBUG: mux-h2/flags: fix list of h2c flags used by the flags decoder
  - MINOR: connection: add conn_pr_mode_to_proto_mode() helper func
  - BUG/MEDIUM: server: "proto" not working for dynamic servers
  - BUG/MINOR: quic: do not consider idle timeout on CLOSING state
  - BUG/MINOR: ssl: use a thread-safe sslconns increment
  - MINOR: frontend: implement a dedicated actconn increment function
  - MEDIUM: quic: count quic_conn instance for maxconn
  - MEDIUM: quic: count quic_conn for global sslconns
  - BUG/MINOR: ssl: suboptimal certificate selection with TLSv1.3 and dual
    ECDSA/RSA
  - BUG/MINOR: mux-quic: fix early close if unset client timeout
  - BUG/MEDIUM: ssl: segfault when cipher is NULL
  - BUG/MINOR: tcpcheck: Report hexstring instead of binary one on check failure
  - BUG/MINOR: stktable: missing free in parse_stick_table()
  - BUG/MINOR: cfgparse/stktable: fix error message on stktable_init() failure
  - BUG/MEDIUM: pattern: don't trim pools under lock in pat_ref_purge_range()
  - BUG/MEDIUM: stconn: Don't report rcv/snd expiration date if SC cannot epxire
  - BUG/MEDIUM: Don't apply a max value on room_needed in sc_need_room()
  - BUG/MINOR: stconn: Sanitize report for read activity
  - CLEANUP: htx: Properly indent htx_reserve_max_data() function
  - BUG/MEDIUM: quic: fix actconn on quic_conn alloc failure
  - BUG/MEDIUM: quic: fix sslconns on quic_conn alloc failure
  - BUG/MINOR: stick-table/cli: Check for invalid ipv4 key
  - BUG/MINOR: mux-h1: Properly handle http-request and http-keep-alive timeouts
  - BUG/MEDIUM: freq-ctr: Don't report overshoot for long inactivity period
  - BUG/MEDIUM: pool: fix releasable pool calculation when overloaded
  - BUG/MINOR: quic: idle timer task requeued in the past
  - BUG/MEDIUM: quic: Avoid trying to send ACK frames from an empty ack ranges
    tree
  - BUG/MEDIUM: quic: Possible crashes when sending too short Initial packets
  - BUG/MEDIUM: quic: Avoid some crashes upon TX packet allocation failures
  - BUG/MEDIUM: stconn: Don't update stream expiration date if already expired
  - DOC: management: -q is quiet all the time
  - BUG/MINOR: quic: fix retry token check inconsistency
  - DOC: config: use the word 'backend' instead of 'proxy' in 'track' description
  - BUG/MEDIUM: applet: Remove appctx from buffer wait list on release
  - BUG/MINOR: sink: don't learn srv port from srv addr
  - DOC: quic: Wrong syntax for "quic-cc-algo" keyword.
  - BUG/MEDIUM: connection: report connection errors even when no mux is installed
  - BUG/MINOR: stconn: Handle abortonclose if backend connection was already
    set up
  - MINOR: connection: Add a CTL flag to notify mux it should wait for reads again
  - MEDIUM: mux-h1: Handle MUX_SUBS_RECV flag in h1_ctl() and susbscribe for reads
  - BUG/MEDIUM: stream: Properly handle abortonclose when set on backend only
  - REGTESTS: http: Improve script testing abortonclose option
  - BUG/MEDIUM: stconn: Report a send activity everytime data were sent
  - BUG/MEDIUM: applet: Report a send activity everytime data were sent
  - BUG/MEDIUM: mworker: set the master variable earlier
  - BUG/MEDIUM: stream: Don't call mux .ctl() callback if not implemented
  - BUG/MEDIUM: stconn: Update fsb date on partial sends
  - MINOR: htx: Use a macro for overhead induced by HTX
  - MINOR: channel: Add functions to get info on buffers and deal with HTX streams
  - BUG/MINOR: stconn: Fix streamer detection for HTX streams
  - BUG/MINOR: stconn: Use HTX-aware channel's functions to get info on buffer
  - BUG/MINOR: stconn/applet: Report send activity only if there was output data
  - BUG/MINOR: stconn: Report read activity on non-indep streams for partial sends


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.5-0
changelog:
  - BUG/MAJOR: quic: complete thread migration before tcp-rules
  - BUG/MEDIUM: mux-h2: fail earlier on malloc in takeover()
  - BUG/MEDIUM: mux-h1: fail earlier on malloc in takeover()
  - BUG/MEDIUM: mux-fcgi: fail earlier on malloc in takeover()
  - BUG/MINOR: stream/cli: report correct stream age in "show sess"
  - MINOR: stktable: add stktable_deinit function
  - BUG/MINOR: proxy/stktable: missing frees on proxy cleanup
  - REGTESTS: http: add a test to validate chunked responses delivery
  - BUG/MINOR: startup: set GTUNE_SOCKET_TRANSFER correctly
  - BUG/MINOR: sock: mark abns sockets as non-suspendable and always unbind them
  - BUG/MEDIUM: quic: Possible crash for connections to be killed
  - BUG/MINOR: quic: Possible RX packet memory leak under heavy load
  - BUG/MINOR: server: do not leak default-server in defaults sections
  - DOC: 51d: updated 51Degrees repo URL for v3.2.10
  - DOC: config: fix timeout check inheritance restrictions
  - REGTESTS: connection: disable http_reuse_be_transparent.vtc if !TPROXY
  - DOC: lua: add sticktable class reference from Proxy.stktable
  - DOC: lua: fix Proxy.get_mode() output
  - BUG/MINOR: quic: fix CONNECTION_CLOSE_APP encoding
  - BUG/MINOR: compression: possible NULL dereferences in
    comp_prepare_compress_request()
  - BUG/MEDIUM: master/cli: Properly pin the master CLI on thread 1 / group 1
  - BUG/MINOR: h3: fix TRAILERS encoding
  - BUG/MINOR: h3: always reject PUSH_PROMISE
  - DOC: config: fix missing characters in set-spoe-group action
  - BUG/MINOR: quic_tp: fix preferred_address decoding
  - BUG/MINOR: config: Stopped parsing upon unmatched environment variables
  - BUG/MINOR: cfgparse-listen: fix warning being reported as an alert
  - DOC: config: specify supported sections for "max-session-srv-conns"
  - DOC: config: add matrix entry for "max-session-srv-conns"
  - DOC: config: fix monitor-fail typo
  - REGTESTS: sample: Test the behavior of consecutive delimiters for the field
    converter
  - BUG/MINOR: sample: Make the `word` converter compatible with `-m found`
  - DOC: Clarify the differences between field() and word()
  - BUG/MEDIUM: peers: fix partial message decoding
  - BUG/MINOR: cache: Remove incomplete entries from the cache when stream
    is closed
  - BUG/MEDIUM: quic: Possible crash during retransmissions and heavy load
  - BUG/MINOR: quic: Possible leak of TX packets under heavy load
  - BUG/MINOR: quic: Missing QUIC connection path member initialization
  - BUG/MINOR: quic: Packet number spaces too lately initialized
  - BUG/MINOR: ssl: Double free of OCSP Certificate ID
  - MINOR: ssl/cli: Add ha_(warning|alert) msgs to CLI ckch callback
  - BUG/MINOR: ssl: Wrong OCSP CID after modifying an SSL certficate
  - BUG/MINOR: lua: Wrong OCSP CID after modifying an SSL certficate (LUA)
  - BUG/MEDIUM: proxy: always initialize the default settings after init


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.6-0
changelog:
  - DOC: configuration: typo req.ssl_hello_type
  - BUG/MINOR: mworker/cli: fix set severity-output support
  - BUG/MEDIUM: quic: Possible buffer overflow when building TLS records
  - BUG/MEDIUM: quic: QUIC CID removed from tree without locking
  - BUG/MEDIUM: mux-h2: Report too large HEADERS frame only when rxbuf is empty
  - BUG/MINOR: resolvers: default resolvers fails when network not configured
  - DOC: config: Update documentation about local haproxy response
  - MINOR: stats: store the parent proxy in stats ctx (http)
  - BUG/MEDIUM: stats: unhandled switching rules with TCP frontend
  - BUG/MINOR: mux-quic: always report error to SC on RESET_STREAM emission
  - BUG/MINOR: quic: Wrong keylog callback setting.
  - BUG/MINOR: quic: Missing call to TLS message callbacks
  - MINOR: h3: check connection error during sending
  - BUG/MINOR: h3: close connection on header list too big
  - BUG/MINOR: h3: properly handle alloc failure on finalize
  - BUG/MINOR: h3: close connection on sending alloc errors
  - CLEANUP: quic: Remaining useless code into server part
  - BUG/MEDIUM: h3: fix incorrect snd_buf return value
  - BUG/MEDIUM: stconn: Forward shutdown on write timeout only if it is
    forwardable
  - BUG/MEDIUM: spoe: Never create new spoe applet if there is no server up
  - MINOR: mux-h2: support limiting the total number of H2 streams per connection
  - DOC: configuration: corrected description of keyword
    tune.ssl.ocsp-update.mindelay
  - BUG/MINOR: mux-quic: do not prevent non-STREAM sending on flow control
  - BUG/MINOR: mux-h2: also count streams for refused ones
  - BUG/MEDIUM: quic: keylog callback not called (USE_OPENSSL_COMPAT)
  - MINOR: compiler: add a new DO_NOT_FOLD() macro to prevent code folding
  - MINOR: debug: make sure calls to ha_crash_now() are never merged
  - MINOR: debug: make ABORT_NOW() store the caller's line number when using abort
  - MINOR: debug: make BUG_ON() catch build errors even without DEBUG_STRICT
  - MINOR: mux-h2/traces: also suggest invalid header upon parsing error
  - MINOR: mux-h2/traces: explicitly show the error/refused stream states
  - MINOR: mux-h2/traces: clarify the "rejected H2 request" event
  - BUG/MEDIUM: mux-h2: refine connection vs stream error on headers
  - MINOR: mux-h2/traces: add a missing trace on connection WU with negative inc
  - REGTESTS: add a test to ensure map-ordering is preserved
  - BUG/MEDIUM: cli: some err/warn msg dumps add LR into CSV output on stat's CLI
  - BUG/MINOR: vars/cli: fix missing LF after "get var" output
  - BUG/MEDIUM: cli: fix once for all the problem of missing trailing LFs
  - BUG/MINOR: jwt: fix jwt_verify crash on 32-bit archs
  - BUG/MEDIUM: pool: fix rare risk of deadlock in pool_flush()
  - BUG/MEDIUM: stconn: Allow expiration update when READ/WRITE event is pending
  - BUG/MEDIUM: stconn: Don't check pending shutdown to wake an applet up
  - BUG/MINOR: h1: Don't support LF only at the end of chunks
  - BUG/MEDIUM: h1: Don't support LF only to mark the end of a chunk size
  - BUG/MINOR: h1-htx: properly initialize the err_pos field
  - BUG/MEDIUM: h1: always reject the NUL character in header values
  - BUG/MAJOR: ssl_sock: Always clear retry flags in read/write functions
  - BUG/MINOR: ssl: Fix error message after ssl_sock_load_ocsp call
  - BUG/MINOR: ssl: Duplicate ocsp update mode when dup'ing ckch
  - BUG/MINOR: ssl: Clear the ckch instance when deleting a crt-list line
  - MINOR: ssl: Use OCSP_CERTID instead of ckch_store in ckch_store_build_certid
  - BUG/MEDIUM: ocsp: Separate refcount per instance and per store
  - BUG/MINOR: ssl: Destroy ckch instances before the store during deinit
  - BUG/MINOR: ssl: Reenable ocsp auto-update after an "add ssl crt-list"
  - REGTESTS: ssl: Fix empty line in cli command input
  - REGTESTS: ssl: Add OCSP related tests
  - BUG/MEDIUM: ssl: Fix crash when calling "update ssl ocsp-response" when an
    update is ongoing
  - BUG/MINOR: h3: fix checking on NULL Tx buffer
  - BUG/MEDIUM: mux-quic: report early error on stream
  - CLEANUP: quic: Remove unused CUBIC_BETA_SCALE_FACTOR_SHIFT macro.
  - MINOR: quic: Stop hardcoding a scale shifting value
    (CUBIC_BETA_SCALE_FACTOR_SHIFT)
  - MINOR: quic: extract qc_stream_buf free in a dedicated function
  - BUG/MEDIUM: quic: remove unsent data from qc_stream_desc buf
  - MINOR: h3: add traces for stream sending function
  - BUG/MEDIUM: h3: do not crash on invalid response status code
  - BUG/MEDIUM: qpack: allow 6xx..9xx status codes
  - BUG/MEDIUM: quic: fix crash on invalid qc_stream_buf_free() BUG_ON
  - BUG/MINOR: quic: Wrong ack ranges handling when reaching the limit.
  - CLEANUP: quic: Code clarifications for QUIC CUBIC (RFC 9438)
  - BUG/MINOR: quic: fix possible integer wrap around in cubic window calculation
  - MINOR: quic: Stop using 1024th of a second.
  - BUG/MEDIUM: quic: Wrong K CUBIC calculation.
  - MINOR: quic: Update K CUBIC calculation (RFC 9438)
  - MINOR: quic: Dynamic packet reordering threshold
  - MINOR: quic: Add a counter for reordered packets
  - MINOR: errors: ha_alert() and ha_warning() uses warn_exec_path()
  - BUG/MINOR: diag: always show the version before dumping a diag warning
  - BUG/MINOR: diag: run the final diags before quitting when using -c
  - MINOR: ext-check: add an option to preserve environment variables
  - BUG/MINOR: ext-check: cannot use without preserve-env
  - BUILD: address a few remaining calloc(size, n) cases
  - DOC: configuration: clarify http-request wait-for-body
  - DOC: httpclient: add dedicated httpclient section
  - DOC: install: recommend pcre2
  - DOC: internal: update missing data types in peers-v2.0.txt
  - CI: Update to actions/cache@v4
  - DEV: makefile: add a new "range" target to iteratively build all commits
  - DEV: makefile: fix POSIX compatibility for "range" target


author: Anton Novojilov <andy@essentialkaos.com> - 2.8.8-0
changelog:
  - MINOR: mux-h2: add a counter of "glitches" on a connection
  - BUG/MINOR: mux-h2: count rejected DATA frames against the connection's flow
    control
  - MINOR: mux-h2: count excess of CONTINUATION frames as a glitch
  - MINOR: mux-h2: count late reduction of INITIAL_WINDOW_SIZE as a glitch
  - MINOR: mux-h2: always use h2c_report_glitch()
  - MEDIUM: mux-h2: allow to set the glitches threshold to kill a connection
  - MINOR: connection: add a new mux_ctl to report number of connection glitches
  - MINOR: mux-h2: implement MUX_CTL_GET_GLITCHES
  - MINOR: connection: add sample fetches to report per-connection glitches
  - BUG/MAJOR: promex: fix crash on deleted server
  - BUG/MINOR: quic: reject unknown frame type
  - BUG/MINOR: quic: reject HANDSHAKE_DONE as server
  - BUG/MINOR: qpack: reject invalid increment count decoding
  - BUG/MINOR: qpack: reject invalid dynamic table capacity
  - DOC: quic: Missing tuning setting in "Global parameters"
  - BUG/MEDIUM: applet: Immediately free appctx on early error
  - BUG/MEDIUM: hlua: Be able to garbage collect uninitialized lua sockets
  - BUG/MEDIUM: hlua: Don't loop if a lua socket does not consume received data
  - BUG/MEDIUM: quic: fix transient send error with listener socket
  - DOC: quic: fix recommandation for bind on multiple address
  - MINOR: quic: warn on bind on multiple addresses if no IP_PKTINFO support
  - BUG/MINOR: ist: allocate nul byte on istdup
  - BUG/MINOR: stats: drop srv refcount on early release
  - BUG/MAJOR: server: fix stream crash due to deleted server
  - BUG/MINOR: quic: fix output of show quic
  - BUG/MINOR: ist: only store NUL byte on succeeded alloc
  - BUG/MINOR: ssl/cli: duplicate cleaning code in cli_parse_del_crtlist
  - LICENSE: event_hdl: fix GPL license version
  - LICENSE: http_ext: fix GPL license version
  - DOC: configuration: clarify ciphersuites usage
  - BUG/MINOR: config/quic: Alert about PROXY protocol use on a QUIC listener
  - BUG/MINOR: hlua: Fix log level to the right value when set via
    TXN:set_loglevel
  - MINOR: hlua: Be able to disable logging from lua
  - BUG/MINOR: tools: seed the statistical PRNG slightly better
  - BUG/MINOR: hlua: fix unsafe lua_tostring() usage with empty stack
  - BUG/MINOR: hlua: don't use lua_tostring() from unprotected contexts
  - BUG/MINOR: hlua: fix possible crash in hlua_filter_new() under load
  - BUG/MINOR: hlua: improper lock usage in hlua_filter_callback()
  - BUG/MINOR: hlua: improper lock usage in hlua_filter_new()
  - BUG/MEDIUM: hlua: improper lock usage with SET_SAFE_LJMP()
  - BUG/MAJOR: hlua: improper lock usage with hlua_ctx_resume()
  - BUG/MINOR: hlua: don't call ha_alert() in hlua_event_subscribe()
  - BUG/MINOR: sink: fix a race condition in the TCP log forwarding code
  - CI: skip scheduled builds on forks
  - BUG/MINOR: ssl/cli: typo in new ssl crl-file CLI description
  - BUG/MINOR: cfgparse: report proper location for log-format-sd errors
  - BUILD: solaris: fix compilation errors
  - DOC: configuration: clarify ciphersuites usage (V2)
  - BUG/MINOR: ssl: fix possible ctx memory leak in sample_conv_aes_gcm()
  - BUG/MINOR: hlua: segfault when loading the same filter from different contexts
  - BUG/MINOR: hlua: missing lock in hlua_filter_new()
  - BUG/MINOR: hlua: fix missing lock in hlua_filter_delete()
  - DEBUG: lua: precisely identify if stream is stuck inside lua or not
  - MINOR: hlua: use accessors for stream hlua ctx
  - BUG/MEDIUM: hlua: streams don't support mixing lua-load with
    lua-load-per-thread (2nd try)
  - BUG/MINOR: listener: Wake proxy's mngmt task up if necessary on session
    release
  - BUG/MINOR: listener: Don't schedule frontend without task in
    listener_release()
  - BUG/MEDIUM: spoe: Don't rely on stream's expiration to detect processing
    timeout
  - BUG/MINOR: spoe: Be sure to be able to quickly close IDLE applets on soft-stop
  - CI: temporarily adjust kernel entropy to work with ASAN/clang
  - BUG/MEDIUM: spoe: Return an invalid frame on recv if size is too small
  - BUG/MINOR: session: ensure conn owner is set after insert into session
  - BUG/MEDIUM: ssl: Fix crash in ocsp-update log function
  - BUG/MINOR: mux-quic: close all QCS before freeing QCC tasklet
  - BUG/MEDIUM: mux-fcgi: Properly handle EOM flag on end-of-trailers HTX block
  - OPTIM: http_ext: avoid useless copy in http_7239_extract_{ipv4,ipv6}
  - BUG/MINOR: server: 'source' interface ignored from 'default-server' directive
  - BUG/MINOR: ssl: Wrong ocsp-update "incompatibility" error message
  - BUG/MINOR: ssl: Detect more 'ocsp-update' incompatibilities
  - BUG/MINOR: server: fix persistence cookie for dynamic servers
  - MINOR: server: allow cookie for dynamic servers
  - MINOR: cli: Remove useless loop on commands to find unescaped semi-colon
  - BUG/MEDIUM: cli: Warn if pipelined commands are delimited by a \n
  - BUG/MINOR: server: ignore 'enabled' for dynamic servers
  - BUG/MINOR: backend: properly handle redispatch 0
  - BUG/MINOR: proxy: fix logformat expression leak in use_backend rules


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.20-0
changelog:
  - BUG/MAJOR: listener: Make sure the listener exist before using it.
  - BUG/MINOR: listener: keep accept rate counters accurate under saturation
  - BUG/MEDIUM: logs: Only attempt to free startup_logs once.
  - BUG/MEDIUM: 51d: fix possible segfault on deinit_51degrees()
  - BUG/MINOR: ssl: fix warning about ssl-min/max-ver support
  - MEDIUM: threads: Use __ATOMIC_SEQ_CST when using the newer atomic API.
  - BUG/MEDIUM: threads/fd: do not forget to take into account epoll_fd/pipes
  - BUG/MAJOR: spoe: Fix initialization of thread-dependent fields
  - BUG/MAJOR: stats: Fix how huge POST data are read from the channel
  - BUG/MINOR: http/counters: fix missing increment of fe->srv_aborts
  - BUG/MEDIUM: ssl: ability to set TLS 1.3 ciphers using
    ssl-default-server-ciphersuites
  - DOC: The option httplog is no longer valid in a backend.
  - BUG/MAJOR: checks: segfault during tcpcheck_main
  - BUILD: makefile: work around an old bug in GNU make-3.80
  - MINOR: tools: make memvprintf() never pass a NULL target to vsnprintf()
  - BUILD: makefile: fix build of IPv6 header on aix51
  - BUILD: makefile: add _LINUX_SOURCE_COMPAT to build on AIX-51
  - BUILD: Makefile: disable shared cache on AIX 5.1
  - BUG/MINOR: cli: correctly handle abns in 'show cli sockets'
  - MINOR: cli: start addresses by a prefix in 'show cli sockets'
  - BUG/MEDIUM: peers: fix a case where peer session is not cleanly reset on
    release.
  - BUILD: use inttypes.h instead of stdint.h
  - BUILD: connection: fix naming of ip_v field
  - BUG/MEDIUM: pattern: assign pattern IDs after checking the config validity
  - BUG/MEDIUM: spoe: Queue message only if no SPOE applet is attached to the
    stream
  - BUG/MEDIUM: spoe: Return an error if nothing is encoded for fragmented
    messages
  - BUG/MINOR: threads: fix the process range of thread masks
  - MINOR: lists: Implement locked variations.
  - BUG/MEDIUM: lists: Properly handle the case we're removing the first elt.
  - BUG/MEDIUM: list: fix the rollback on addq in the locked liss
  - BUG/MEDIUM: list: fix LIST_POP_LOCKED's removal of the last pointer
  - BUG/MEDIUM: list: add missing store barriers when updating elements and head
  - MINOR: list: make the delete and pop operations idempotent
  - BUG/MEDIUM: list: correct fix for LIST_POP_LOCKED's removal of last element
  - BUG/MEDIUM: list: fix again LIST_ADDQ_LOCKED
  - BUG/MEDIUM: list: fix incorrect pointer unlocking in LIST_DEL_LOCKED()
  - MAJOR: listener: do not hold the listener lock in listener_accept()
  - BUG/MEDIUM: listener: use a self-locked list for the dequeue lists
  - BUG/MEDIUM: listener: make sure the listener never accepts too many conns
  - BUILD/MINOR: listener: Silent a few signedness warnings.
  - MINOR: skip get_gmtime where tm is unused
  - BUG/MAJOR: http_fetch: Get the channel depending on the keyword used
  - BUG/MEDIUM: maps: only try to parse the default value when it's present
  - BUG/MINOR: acl: properly detect pattern type SMP_T_ADDR
  - BUG/MEDIUM: thread/http: Add missing locks in set-map and add-acl HTTP rules
  - BUG/MINOR: 51d: Get the request channel to call CHECK_HTTP_MESSAGE_FIRST()
  - BUG/MINOR: da: Get the request channel to call CHECK_HTTP_MESSAGE_FIRST()
  - BUG/MINOR: spoe: Don't systematically wakeup SPOE stream in the applet handler


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.21-0
changelog:
  - BUG/MINOR: http: Call stream_inc_be_http_req_ctr() only one time per request
  - BUG/MEDIUM: spoe: arg len encoded in previous frag frame but len changed
  - MINOR: spoe: Use the sample context to pass frag_ctx info during encoding
  - DOC: contrib/modsecurity: Typos and fix the reject example
  - BUG/MEDIUM: contrib/modsecurity: If host header is NULL, don't try to strdup
    it
  - MINOR: examples: Use right locale for the last changelog date in haproxy.spec
  - BUG/MAJOR: map/acl: real fix segfault during show map/acl on CLI
  - BUG/MEDIUM: listener: Fix how unlimited number of consecutive accepts is
    handled
  - MINOR: config: Test validity of tune.maxaccept during the config parsing
  - CLEANUP: config: Don't alter listener->maxaccept when nbproc is set to 1
  - MINOR: threads: Implement HA_ATOMIC_LOAD().
  - BUG/MEDIUM: port_range: Make the ring buffer lock-free.
  - BUG/MINOR: http_fetch: Rely on the smp direction for "cookie()" and "hdr()"
  - BUG/MEDIUM: dns: make the port numbers unsigned
  - BUG/MEDIUM: spoe: Don't use the SPOE applet after releasing it
  - DOC: fix typos
  - BUG/MINOR: ssl_sock: Fix memory leak when disabling compression
  - BUILD: ssl: fix latest LibreSSL reg-test error
  - BUG/MAJOR: lb/threads: make sure the avoided server is not full on second pass
  - BUG/MEDIUM: http: fix "http-request reject" when not final
  - BUG/MINOR: deinit/threads: make hard-stop-after perform a clean exit
  - BUG/MEDIUM: connection: fix multiple handshake polling issues
  - BUG/MEDIUM: vars: make sure the scope is always valid when accessing vars
  - BUG/MEDIUM: vars: make the tcp/http unset-var() action support conditions
  - BUG/MEDIUM: mux-h2: make sure the connection timeout is always set
  - BUG/MINOR: http-rules: mention "deny_status" for "deny" in the error message
  - MINOR: doc: Remove -Ds option in man page
  - MINOR: doc: add master-worker in the man page
  - BUG/MEDIUM: compression: Set Vary: Accept-Encoding for compressed responses
  - BUG/MEDIUM: lb_fwlc: Don't test the server's lb_tree from outside the lock
  - BUILD: makefile: use :space: instead of digits to count commits
  - BUILD: makefile: do not rely on shell substitutions to determine git version
  - BUG/MEDIUM: lb_fas: Don't test the server's lb_tree from outside the lock
  - BUG/MEDIUM: da: cast the chunk to string.
  - MINOR: task: introduce work lists
  - BUG/MAJOR: listener: fix thread safety in resume_listener()
  - BUG/MEDIUM: tcp-check: unbreak multiple connect rules again
  - BUG/MEDIUM: http/htx: unbreak option http_proxy
  - BUG/MEDIUM: tcp-checks: do not dereference inexisting conn_stream
  - BUG/MEDIUM: protocols: add a global lock for the init/deinit stuff
  - BUG/MINOR: proxy: always lock stop_proxy()
  - BUILD: threads: add the definition of PROTO_LOCK
  - BUG/MEDIUM: lb-chash: Fix the realloc() when the number of nodes is increased
  - DOC: improve the wording in CONTRIBUTING about how to document a bug fix
  - BUG/MEDIUM: hlua: Check the calling direction in lua functions of the HTTP
    class
  - MINOR: hlua: Don't set request analyzers on response channel for lua actions
  - MINOR: hlua: Add a flag on the lua txn to know in which context it can be used
  - BUG/MINOR: hlua: Only execute functions of HTTP class if the txn is HTTP ready
  - BUG/MAJOR: queue/threads: avoid an AB/BA locking issue in process_srv_queue()
  - BUG/MINOR: lua: Set right direction and flags on new HTTP objects
  - BUG/MEDIUM: protocols: properly initialize the proto_lock in 1.8
  - BUG/MEDIUM: lb-chash: Ensure the tree integrity when server weight is
    increased
  - BUG/MINOR: stream-int: also update analysers timeouts on activity
  - BUG/MEDIUM: mux-h2: split the stream's and connection's window sizes
  - BUG/MEDIUM: fd: Always reset the polled_mask bits in fd_dodelete().
  - BUG/MINOR: mux-h2: don't refrain from sending an RST_STREAM after another one
  - BUG/MINOR: mux-h2: use CANCEL, not STREAM_CLOSED in h2c_frt_handle_data()
  - BUG/MEDIUM: mux-h2: do not recheck a frame type after a state transition
  - BUG/MINOR: mux-h2: always send stream window update before connection's
  - BUG/MINOR: mux-h2: always reset rcvd_s when switching to a new frame
  - MINOR: build: Disable -Wstringop-overflow.
  - BUG/MINOR: ssl: fix 0-RTT for BoringSSL
  - MINOR: ssl: ssl_fc_has_early should work for BoringSSL
  - BUG/MEDIUM: lua: Fix test on the direction to set the channel exp timeout


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.22-0
changelog:
  - BUILD/MINOR: stream: avoid a build warning with threads disabled
  - BUG/MINOR: haproxy: fix rule->file memory leak
  - MINOR: connection: add new function conn_is_back()
  - BUG/MEDIUM: ssl: Use the early_data API the right way.
  - BUG/MEDIUM: checks: make sure the warmup task takes the server lock
  - BUG/MINOR: logs/threads: properly split the log area upon startup
  - MINOR: doc: Document allow-0rtt on the server line.
  - BUG/MEDIUM: spoe: Be sure the sample is found before setting its context
  - DOC: fixed typo in management.txt
  - BUG/MINOR: mworker: disable SIGPROF on re-exec
  - BUG/MEDIUM: listener/threads: fix an AB/BA locking issue in delete_listener()
  - BUG/MEDIUM: proto-http: Always start the parsing if there is no outgoing data
  - BUG/MEDIUM: http: also reject messages where "chunked" is missing from
    transfer-enoding
  - BUG/MINOR: filters: Properly set the HTTP status code on analysis error
  - BUG/MINOR: acl: Fix memory leaks when an ACL expression is parsed
  - BUG/MEDIUM: check/threads: make external checks run exclusively on thread 1
  - BUG/MEDIUM: namespace: close open namespaces during soft shutdown
  - BUG/MAJOR: mux_h2: Don't consume more payload than received for skipped frames
  - MINOR: tools: implement my_flsl()
  - BUG/MEDIUM: spoe: Use a different engine-id per process
  - DOC: Fix documentation about the cli command to get resolver stats
  - BUG/MEDIUM: namespace: fix fd leak in master-worker mode
  - BUG/MINOR: lua: Properly initialize the buffer's fields for string samples
    in hlua_lua2(smp|arg)
  - BUG/MEDIUM: cache: make sure not to cache requests with absolute-uri
  - DOC: clarify some points around http-send-name-header's behavior
  - MINOR: stats: mention in the help message support for "json" and "typed"
  - BUG/MINOR: ssl: free the sni_keytype nodes
  - BUG/MINOR: chunk: Fix tests on the chunk size in functions copying data
  - BUG/MINOR: WURFL: fix send_log() function arguments
  - BUG/MINOR: tcp: Don't alter counters returned by tcp info fetchers
  - BUG/MINOR: ssl: abort on sni allocation failure
  - BUG/MINOR: ssl: abort on sni_keytypes allocation failure
  - CLEANUP: ssl: make ssl_sock_load_cert*() return real error codes
  - CLEANUP: ssl: make ssl_sock_put_ckch_into_ctx handle errcode/warn
  - CLEANUP: ssl: make ssl_sock_load_dh_params handle errcode/warn
  - CLEANUP: bind: handle warning label on bind keywords parsing.
  - BUG/MEDIUM: ssl: 'tune.ssl.default-dh-param' value ignored with
    openssl > 1.1.1
  - BUG/MINOR: mworker/ssl: close OpenSSL FDs on reload
  - BUILD: ssl: fix again a libressl build failure after the openssl FD leak fix
  - BUG/MINOR: mworker/ssl: close openssl FDs unconditionally
  - BUG/MINOR: ssl: Fix fd leak on error path when a TLS ticket keys file
    is parsed
  - BUG/MINOR: stick-table: Never exceed (MAX_SESS_STKCTR-1) when fetching
    a stkctr
  - BUG/MINOR: sample: Make the `field` converter compatible with `-m found`
  - BUG/MINOR: ssl: fix memcpy overlap without consequences.
  - BUG/MINOR: stick-table: fix an incorrect 32 to 64 bit key conversion
  - BUG/MEDIUM: pattern: make the pattern LRU cache thread-local and lockless


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.23-0
changelog:
  - MINOR: tcp: avoid confusion in time parsing init
  - BUG/MINOR: cli: don't call the kw->io_release if kw->parse failed
  - BUG/MINOR: config: Update cookie domain warn to RFC6265
  - BUG/MEDIUM: stream: Be sure to support splicing at the mux level to enable it
  - BUG/MEDIUM: stream: Be sure to release allocated captures for TCP streams
  - BUG: dns: timeout resolve not applied for valid resolutions
  - BUG/MEDIUM: listeners: always pause a listener on out-of-resource condition
  - BUG/MINOR: ssl: fix crt-list neg filter for openssl < 1.1.1
  - BUILD/MINOR: ssl: fix compiler warning about useless statement
  - MINOR: ist: add ist_find_ctl()
  - BUG/MAJOR: h2: reject header values containing invalid chars
  - BUG/MAJOR: h2: make header field name filtering stronger
  - SCRIPTS: create-release: show the correct origin name in suggested commands
  - SCRIPTS: git-show-backports: add "-s" to proposed cherry-pick commands


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.24-0
changelog:
  - DOC: clarify matching strings on binary fetches
  - BUG/MEDIUM: listener/thread: fix a race when pausing a listener
  - BUG/MINOR: ssl: certificate choice can be unexpected with openssl >= 1.1.1
  - BUG/MINOR: proxy: make soft_stop() also close FDs in LI_PAUSED state
  - BUG/MINOR: listener/threads: always use atomic ops to clear the FD events
  - BUG/MINOR: listener: also clear the error flag on a paused listener
  - BUG/MEDIUM: listener/threads: fix a remaining race in the listener's accept()
  - DOC: document the listener state transitions
  - BUG/MAJOR: dns: add minimalist error processing on the Rx path
  - BUG/MEDIUM: proto_udp/threads: recv() and send() must not be exclusive.
  - BUG/MEDIUM: kqueue: Make sure we report read events even when no data.
  - DOC: listeners: add a few missing transitions
  - BUILD/MINOR: ssl: shut up a build warning about format truncation
  - BUILD/MINOR: tools: shut up the format truncation warning in get_gmt_offset()
  - BUILD: do not disable -Wformat-truncation anymore
  - DOC: remove references to the outdated architecture.txt
  - BUG/MINOR: log: fix minor resource leaks on logformat error path
  - BUG/MINOR: mworker: properly pass SIGTTOU/SIGTTIN to workers
  - BUG/MINOR: listener: do not immediately resume on transient error
  - BUG/MINOR: server: make "agent-addr" work on default-server line
  - BUG/MINOR: listener: fix off-by-one in state name check
  - BUILD/MINOR: unix sockets: silence an absurd gcc warning about strncpy()
  - BUG/MINOR: sample: fix the closing bracket and LF in the debug converter
  - BUG/MINOR: sample: always check converters' arguments
  - BUG/MEDIUM: ssl: Don't set the max early data we can receive too early.
  - BUG/MEDIUM: session: do not report a failure when rejecting a session
  - BUG/MEDIUM: mworker: remain in mworker mode during reload
  - BUG/MAJOR: hashes: fix the signedness of the hash inputs
  - BUG/MEDIUM: cli: _getsocks must send the peers sockets
  - BUG/MINOR: stream: don't mistake match rules for store-request rules
  - BUG/MINOR: pattern: handle errors from fgets when trying to load patterns
  - BUG/MINOR: dns: Make dns_query_id_seed unsigned
  - BUG/MINOR: http-rules: Remove buggy deinit functions for HTTP rules
  - BUG/MINOR: stick-table: Use MAX_SESS_STKCTR as the max track ID during parsing
  - BUG/MINOR: tcp-rules: Fix memory releases on error path during action parsing
  - MINOR: proxy/http-ana: Add support of extra attributes for the cookie
    directive
  - BUG/MINOR: http_act: don't check capture id in backend
  - BUG/MINOR: dns: allow srv record weight set to 0
  - BUG/MEDIUM: pipe: fix a use-after-free in case of pipe creation error
  - BUG/MINOR: connection: fix ip6 dst_port copy in make_proxy_line_v2
  - MINOR: acl: Warn when an ACL is named 'or'
  - SCRIPTS: announce-release: place the send command in the mail's header
  - SCRIPTS: announce-release: allow the user to force to overwrite old files
  - BUG/MINOR: unix: better catch situations where the unix socket path length is
    close to the limit
  - BUG/MINOR: dns: allow 63 char in hostname
  - BUG/MEDIUM: listener: only consider running threads when resuming listeners
  - BUG/MINOR: tcp: avoid closing fd when socket failed in tcp_bind_listener
  - BUG/MINOR: tcp: don't try to set defaultmss when value is negative
  - SCRIPTS: make announce-release executable again


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.25-0
changelog:
  - BUG/MINOR: namespace: avoid closing fd when socket failed in my_socketat
  - SCRIPTS: announce-release: use mutt -H instead of -i to include the draft
  - CONTRIB: debug: add the possibility to decode the value as certain types only
  - CONTRIB: debug: support reporting multiple values at once
  - CONTRIB: debug: also support reading values from stdin
  - BUG/MEDIUM: shctx: make sure to keep all blocks aligned
  - MINOR: compiler: move CPU capabilities definition from config.h and complete
    them
  - BUG/MEDIUM: ebtree: don't set attribute packed without unaligned access
    support
  - BUILD: fix recent build failure on unaligned archs
  - MINOR: compiler: add new alignment macros
  - BUILD: ebtree: improve architecture-specific alignment
  - BUG/MINOR: sample: fix the json converter's endian-sensitivity
  - BUG/MINOR: sample: Make sure to return stable IDs in the unique-id fetch
  - BUG/MAJOR: list: fix invalid element address calculation
  - DOC: fix incorrect indentation of http_auth_*
  - BUG/MAJOR: proxy_protocol: Properly validate TLV lengths
  - REGTEST: make the PROXY TLV validation depend on version 2.2
  - BUG/MINOR: lua: Ignore the reserve to know if a channel is full or not
  - BUG/MINOR: http-rules: Preserve FLT_END analyzers on reject action
  - BUG/MINOR: http-rules: Fix a typo in the reject action function
  - BUG/MINOR: rules: Preserve FLT_END analyzers on silent-drop action
  - BUG/MINOR: rules: Increment be_counters if backend is assigned for a
    silent-drop
  - DOC: fix typo about no-tls-tickets
  - DOC: improve description of no-tls-tickets
  - DOC: ssl: clarify security implications of TLS tickets
  - DOC: proxy_protocol: Reserve TLV type 0x05 as PP2_TYPE_UNIQUE_ID
  - DOC: assorted typo fixes in the documentation
  - BUG/MINOR: peers: init bind_proc to 1 if it wasn't initialized
  - BUG/MINOR: peers: avoid an infinite loop with peers_fe is NULL
  - BUG/MINOR: stats: Fix color of draining servers on stats page
  - DOC: internals: Fix spelling errors in filters.txt
  - BUG/MEDIUM: http: unbreak redirects in legacy mode
  - MINOR: http-rules: Add a flag on redirect rules to know the rule direction
  - BUG/MINOR: http_ana: make sure redirect flags don't have overlapping bits
  - MINOR: http-rules: Handle the rule direction when a redirect is evaluated
  - BUG/MINOR: http-ana: Reset request analysers on error when waiting for
    response
  - BUG/CRITICAL: hpack: never index a header into the headroom after wrapping


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.26-0
changelog:
  - BUILD: chunk: properly declare pool_head_trash as extern
  - BUILD: cache: avoid a build warning with some compilers/linkers
  - BUG/MINOR: ssl: default settings for ssl server options are not used
  - BUG/MINOR: tools: fix the i386 version of the div64_32 function
  - DOC: option logasap does not depend on mode
  - BUG/MINOR: check: Update server address and port to execute an external check
  - BUG/MINOR: checks: Respect the no-check-ssl option
  - BUG/MINOR: checks/server: use_ssl member must be signed
  - BUG/MINOR: checks: chained expect will not properly wait for enough data
  - BUG/MEDIUM: capture: capture-req/capture-res converters crash without a stream
  - BUG/MEDIUM: capture: capture.{req,res}.* crash without a stream
  - BUG/MEDIUM: http: the "http_first_req" sample fetch could crash without
    a steeam
  - BUG/MEDIUM: http: the "unique-id" sample fetch could crash without a steeam
  - BUG/MEDIUM: shctx: really check the lock's value while waiting
  - BUG/MEDIUM: shctx: bound the number of loops that can happen around the lock
  - REGTEST: ssl: test the client certificate authentication
  - BUG/MINOR: sample: Set the correct type when a binary is converted to a string
  - BUG/MINOR: config: Make use_backend and use-server post-parsing less obscur
  - BUG/MEDIUM: http_ana: make the detection of NTLM variants safer
  - BUG/MINOR: cfgparse: Abort parsing the current line if an invalid \x sequence
    is encountered
  - BUG/MINOR: pollers: remove uneeded free in global init
  - BUILD: select: only declare existing local labels to appease clang
  - SCRIPTS: publish-release: pass -n to gzip to remove timestamp
  - BUG/MINOR: peers: fix internal/network key type mapping.
  - BUG/MEDIUM: lua: Reset analyse expiration timeout before executing
    a lua action
  - BUG/MEDIUM: hlua: Lock pattern references to perform set/add/del operations
  - BUG/MINOR: logs: prevent double line returns in some events.
  - BUG/MEDIUM: logs: fix trailing zeros on log message.
  - BUG/MINOR: proto-http: Fix detection of NTLM for the legacy HTTP version
  - BUG/MEDIUM: mworker: fix the copy of options in copy_argv()
  - BUG/MINOR: init: -x can have a parameter starting with a dash
  - BUG/MEDIUM: mworker: fix the reload with an -- option
  - BUG/MINOR: mworker: fix a memleak when execvp() failed
  - BUG/MEDIUM: pattern: fix thread safety of pattern matching
  - BUG/MINOR: ssl: fix ssl-{min,max}-ver with openssl < 1.1.0
  - BUG/MINOR: tcp-rules: tcp-response must check the buffer's fullness
  - BUG/MEDIUM: ebtree: use a byte-per-byte memcmp() to compare memory blocks
  - BUG/MINOR: spoe: add missing key length check before checking key names
  - BUG/MINOR: systemd: Wait for network to be online
  - BUG/MINOR: spoe: correction of setting bits for analyzer
  - BUG/MEDIUM: fetch: Fix hdr_ip misparsing IPv4 addresses due to missing NUL
  - MINOR: cli: make "show sess" stop at the last known session
  - DOC: ssl: add "allow-0rtt" and "ciphersuites" in crt-list
  - BUG/MEDIUM: pattern: Add a trailing \0 to match strings only if possible
  - BUG/MINOR: proxy: fix dump_server_state()'s misuse of the trash
  - BUG/MINOR: proxy: always initialize the trash in show servers state
  - BUG/MINOR: http_act: don't check capture id in backend (2)
  - BUG/MINOR: sample: Free str.area in smp_check_const_bool
  - BUG/MINOR: sample: Free str.area in smp_check_const_meth
  - BUG/MEDIUM: channel: Be aware of SHUTW_NOW flag when output data are peeked
  - BUILD: ebtree: fix build on libmusl after recent introduction of eb_memcmp()
  - BUG/MINOR: cfgparse: don't increment linenum on incomplete lines
  - BUG/MEDIUM: mux-h2: Emit an error if the response chunk formatting
    is incomplete
  - BUG/MEDIUM: dns: Release answer items when a DNS resolution is freed
  - BUG/MINOR: tcp-rules: Set the inspect-delay when a tcp-response action yields
  - SCRIPTS: announce-release: add the link to the wiki in the announce messages
  - SCRIPTS: git-show-backports: make -m most only show the left branch
  - SCRIPTS: git-show-backports: emit the shell command to backport a commit
  - DOC: Improve documentation on http-request set-src
  - BUG/MINOR: http: make url_decode() optionally convert '+' to SP
  - MINOR: checks: Add a way to send custom headers and payload during http checks
  - BUG/MINOR: checks: Compute the right HTTP request length for HTTP
    health checks
  - BUG/MINOR: checks: Remove a warning about http health checks
  - BUG/MINOR: threads: fix multiple use of argument inside HA_ATOMIC_CAS()
  - BUG/MINOR: threads: fix multiple use of argument inside
    HA_ATOMIC_UPDATE_{MIN,MAX}()
  - BUG/MINOR: pools: use %u not %d to report pool stats in "show pools"
  - MEDIUM: map: make the "clear map" operation yield
  - BUG/MEDIUM: server/checks: Init server check during config validity check
  - BUG/MEDIUM: checks: Always initialize checks before starting them
  - BUG/MINOR: checks: Respect check-ssl param when a port or an addr is specified
  - BUG/MINOR: server: Fix server_finalize_init() to avoid unused variable


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.27-0
changelog:
  - BUG/MINOR: dns: ignore trailing dot
  - BUG/MEDIUM: mux-h2: Don't fail if nothing is parsed for a legacy chunk
    response
  - BUG/MEDIUM: map/lua: Return an error if a map is loaded during runtime
  - BUG/MINOR: lua: Check argument type to convert it to IPv4/IPv6 arg validation
  - BUG/MINOR: lua: Check argument type to convert it to IP mask in arg validation
  - BUG/MINOR: stats: use strncmp() instead of memcmp() on health states
  - BUG/MINOR: reload: do not fail when no socket is sent
  - BUG/MINOR: startup: haproxy -s cause 100% cpu
  - BUG/MEDIUM: ssl: check OCSP calloc in ssl_sock_load_ocsp()
  - BUG/MINOR: threads: work around a libgcc_s issue with chrooting
  - BUILD: thread: limit the libgcc_s workaround to glibc only
  - MINOR: Commit .gitattributes
  - CLEANUP: Update .gitignore
  - BUILD: threads: better workaround for late loading of libgcc_s
  - BUG/MEDIUM: pattern: Renew the pattern expression revision when it is pruned
  - BUG/MEDIUM: pattern: fix memory leak in regex pattern functions
  - BUG/MEDIUM: ssl: does not look for all SNIs before chosing a certificate
  - BUG/MINOR: ssl: verifyhost is case sensitive
  - BUG/MEDIUM: h2: report frame bits only for handled types
  - BUG/MINOR: config: Fix memory leak on config parse listen
  - BUG/MEDIUM: listeners: do not pause foreign listeners
  - DOC: agent-check: fix typo in "fail" word expected reply
  - REGTESTS: add a few load balancing tests
  - REGTEST: fix host part in balance-uri-path-only.vtc
  - REGTEST: make abns_socket.vtc require 1.8
  - REGTEST: make map_regm_with_backref require 1.7
  - DOC: ssl: crt-list negative filters are only a hint
  - MINOR: counters: fix a typo in comment
  - BUG/MINOR: stats: fix validity of the json schema
  - MINOR: hlua: Display debug messages on stderr only in debug mode
  - BUG/MEDIUM: spoe: Unset variable instead of set it if no data provided
  - BUG/MEDIUM: lb: Always lock the server when calling server_{take,drop}_conn
  - BUG/MINOR: queue: properly report redistributed connections
  - BUG/MEDIUM: server: support changing the slowstart value from state-file
  - BUG/MAJOR: mux-h2: Don't try to send data if we know it is no longer possible
  - BUG/MINOR: extcheck: add missing checks on extchk_setenv()
  - BUG/MINOR: server: fix srv downtime calcul on starting
  - BUG/MINOR: server: fix down_time report for stats
  - BUG/MINOR: lua: initialize sample before using it
  - BUG/MINOR: cache: Inverted variables in http_calc_maxage function
  - BUG/MEDIUM: filters: Don't try to init filters for disabled proxies
  - BUG/MINOR: server: Set server without addr but with dns in RMAINT on startup
  - MINOR: server: Copy configuration file and line for server templates
  - BUG/MINOR: filters: Skip disabled proxies during startup only


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.28-0
changelog:
  - BUG/MINOR: config: copy extra cookie attributes from dfl proxy
  - BUG/MINOR: http-fetch: Extract cookie value even when no cookie name
  - BUG/MINOR: http-fetch: Fix calls w/o parentheses of the cookie sample fetches
  - MINOR: spoe: Don't close connection in sync mode on processing timeout
  - DOC: config: Move req.hdrs and req.hdrs_bin in L7 samples fetches section
  - BUG/MINOR: lua: lua-load doesn't check its parameters
  - BUG/MINOR: lua: Post init register function are not executed beyond
    the first one
  - BUG/MINOR: lua: Some lua init operation are processed unsafe
  - MINOR: actions: Export actions lookup functions
  - MINOR: actions: add a function returning a service pointer from its name
  - MINOR: cli: add a function to look up a CLI service description
  - BUG/MINOR: lua: warn when registering action, conv, sf, cli or applet
    multiple times
  - DOC/MINOR: Fix formatting in Management Guide
  - DOC: email change of the DeviceAtlas maintainer
  - BUG/MINOR: tools: make parse_time_err() more strict on the timer validity
  - BUG/MINOR: tools: Reject size format not starting by a digit
  - BUG/MEDIUM: lb-leastconn: Reposition a server using the right eweight
  - CLEANUP: lua: Remove declaration of an inexistant function
  - CLEANUP: stream: remove an obsolete debugging test
  - BUG/MEDIUM: mworker: fix again copy_argv()
  - BUILD: Makefile: have "make clean" destroy .o/.a/.s in contrib subdirs as well
  - CONTRIB: halog: fix build issue caused by %L printf format
  - CONTRIB: halog: mark the has_zero* functions unused
  - CONTRIB: halog: fix signed/unsigned build warnings on counts and timestamps
  - BUILD: plock: remove dead code that causes a warning in gcc 11
  - BUILD: hpack: hpack-tbl-t.h uses VAR_ARRAY but does not include compiler.h
  - MINOR: atomic: don't use ; to separate instruction on aarch64.
  - BUG/MINOR: cfgparse: Fail if the strdup() for `rule->be.name` for
    `use_backend` fails
  - SCRIPTS: improve announce-release to support different tag and versions
  - SCRIPTS: make announce release support preparing announces before tag exists
  - BUG/MINOR: srv: do not init address if backend is disabled
  - DOC: fix some spelling issues over multiple files
  - SCRIPTS: announce-release: fix typo in help message


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.29-0
changelog:
  - BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  - BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  - BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  - DOC: management: fix "show resolvers" alphabetical ordering
  - BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  - BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  - CLEANUP: remove unused src/cfgparse-listen.c
  - BUG/MINOR: server: re-align state file fields number
  - BUG/MINOR: server: Fix server-state-file-name directive
  - CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  - BUG/MEDIUM: config: don't pick unset values from last defaults section
  - BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  - CLEANUP: channel: fix comment in ci_putblk.
  - BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  - BUG/MINOR: session: atomically increment the tracked sessions counter
  - BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  - BUG/MINOR: sample: Always consider zero size string samples as unsafe
  - BUG/MINOR: server: Init params before parsing a new server-state line
  - BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  - BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  - BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  - BUG/MINOR: http-ana: Only consider dst address to process originalto option
  - BUG/MINOR: tcp-act: Don't forget to set the original port for
    IPv4 set-dst rule
  - BUG/MINOR: connection: Use the client's dst family for adressless servers
  - BUG/MEDIUM: spoe: Kill applets if there are pending connections and
    nbthread > 1
  - BUG/MAJOR: spoe: Be sure to remove all references on a released spoe applet
  - BUG/MEDIUM: spoe: Explicitly wakeup SPOE stream if waiting for more data
  - DOC: spoe: Add a note about fragmentation support in HAProxy
  - BUG/MEDIUM: dns: Consider the fact that dns answers are case-insensitive
  - BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  - BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  - BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  - BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  - BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  - CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  - BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  - BUG/MINOR: resolvers: Add missing case-insensitive comparisons
    of DNS hostnames
  - MINOR: time: export the global_now variable
  - OPTIM: freq-ctr: don't take the date lock for most updates
  - BUG/MINOR: freq_ctr/threads: make use of the last updated global time


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.30-0
changelog:
  - MINOR: time: also provide a global, monotonic global_now_ms timer
  - BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  - BUG/MEDIUM: time: make sure to always initialize the global tick
  - MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  - BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  - BUG/MINOR: tcp: fix silent-drop workaround for IPv6
  - BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  - BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.12-0
changelog:
  - DOC: Improve documentation of http-re(quest|sponse) replace-(header|value|uri)
  - DOC: clarify the fact that replace-uri works on a full URI
  - BUG/MINOR: sample: fix the closing bracket and LF in the debug converter
  - BUG/MINOR: sample: always check converters' arguments
  - BUG/MEDIUM: ssl: Don't set the max early data we can receive too early.
  - MINOR: task: only check TASK_WOKEN_ANY to decide to requeue a task
  - BUG/MAJOR: task: add a new TASK_SHARED_WQ flag to fix foreing requeuing
  - BUG/MEDIUM: ssl: Revamp the way early data are handled.
  - MINOR: fd/threads: make _GET_NEXT()/_GET_PREV() use the volatile attribute
  - BUG/MEDIUM: fd/threads: fix a concurrency issue between add and rm on
    the same fd
  - BUG/MINOR: ssl: openssl-compat: Fix getm_ defines
  - BUG/MEDIUM: stream: Be sure to never assign a TCP backend to an HTX stream
  - BUILD: ssl: improve SSL_CTX_set_ecdh_auto compatibility


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.13-0
changelog:
  - BUG/MINOR: checks: refine which errno values are really errors.
  - BUG/MEDIUM: checks: Only attempt to do handshakes if the connection is ready.
  - BUG/MEDIUM: connections: Hold the lock when wanting to kill a connection.
  - MINOR: config: disable busy polling on old processes
  - MINOR: ssl: Remove unused variable "need_out".
  - BUG/MINOR: h1: Report the right error position when a header value is invalid
  - BUG/MINOR: proxy: Fix input data copy when an error is captured
  - BUG/MEDIUM: http-ana: Truncate the response when a redirect rule is applied
  - BUG/MINOR: channel: inject output data at the end of output
  - BUG/MEDIUM: session: do not report a failure when rejecting a session
  - BUG/MINOR: stream-int: Don't trigger L7 retry if max retries is already
    reached
  - BUG/MINOR: mux-h2: use a safe list_for_each_entry in h2_send()
  - BUG/MEDIUM: mux-h2: fix missing test on sending_list in previous patch
  - BUG/MEDIUM: mux-h2: don't stop sending when crossing a buffer boundary
  - BUG/MINOR: cli/mworker: can't start haproxy with 2 programs
  - REGTEST: mcli/mcli_start_progs: start 2 programs
  - BUG/MEDIUM: mworker: remain in mworker mode during reload
  - BUG/MEDIUM: mux_h1: Don't call h1_send if we subscribed().
  - BUG/MAJOR: hashes: fix the signedness of the hash inputs
  - REGTEST: add sample_fetches/hashes.vtc to validate hashes
  - BUG/MEDIUM: cli: _getsocks must send the peers sockets
  - BUG/MINOR: stream: don't mistake match rules for store-request rules
  - BUG/MEDIUM: connection: add a mux flag to indicate splice usability
  - BUG/MINOR: pattern: handle errors from fgets when trying to load patterns
  - BUG/MINOR: cache: Fix leak of cache name in error path
  - BUG/MINOR: dns: Make dns_query_id_seed unsigned
  - BUG/MINOR: 51d: Fix bug when HTX is enabled
  - BUILD: pattern: include errno.h
  - BUG/MINOR: http-ana/filters: Wait end of the http_end callback for all filters
  - BUG/MINOR: http-rules: Remove buggy deinit functions for HTTP rules
  - BUG/MINOR: stick-table: Use MAX_SESS_STKCTR as the max track ID during parsing
  - BUG/MINOR: tcp-rules: Fix memory releases on error path during action parsing
  - MINOR: proxy/http-ana: Add support of extra attributes for the cookie
    directive
  - BUG/MINOR: http_act: don't check capture id in backend
  - BUG/MEDIUM: 0rtt: Only consider the SSL handshake.
  - BUG/MINOR: stktable: report the current proxy name in error messages
  - BUG/MEDIUM: mux-h2: make sure we don't emit TE headers with anything but
    "trailers"
  - BUILD: cfgparse: silence a bogus gcc warning on 32-bit machines
  - BUG/MINOR: dns: allow srv record weight set to 0
  - BUG/MEDIUM: ssl: Don't forget to free ctx->ssl on failure.
  - BUG/MINOR: tcpchecks: fix the connect() flags regarding delayed ack
  - BUG/MEDIUM: pipe: fix a use-after-free in case of pipe creation error
  - BUG/MINOR: connection: fix ip6 dst_port copy in make_proxy_line_v2
  - BUG/MEDIUM: connections: Don't forget to unlock when killing a connection.
  - BUG/MEDIUM: memory_pool: Update the seq number in pool_flush().
  - MINOR: memory: Only init the pool spinlock once.
  - BUG/MEDIUM: memory: Add a rwlock before freeing memory.
  - BUG/MAJOR: memory: Don't forget to unlock the rwlock if the pool is empty.
  - BUG/MINOR: ssl: we may only ignore the first 64 errors
  - CONTRIB: debug: add missing flags SF_HTX and SF_MUX
  - CONTRIB: debug: add the possibility to decode the value as certain types only
  - CONTRIB: debug: support reporting multiple values at once
  - MINOR: acl: Warn when an ACL is named 'or'
  - CONTRIB: debug: also support reading values from stdin
  - SCRIPTS: announce-release: place the send command in the mail's header
  - SCRIPTS: announce-release: allow the user to force to overwrite old files
  - MINOR: build: add linux-glibc-legacy build TARGET
  - BUG/MINOR: unix: better catch situations where the unix socket path length is
    close to the limit
  - MINOR: http: add a new "replace-path" action
  - BUG/MINOR: ssl: Possible memleak when allowing the 0RTT data buffer.
  - BUG/MINOR: dns: allow 63 char in hostname
  - BUG/MEDIUM: listener: only consider running threads when resuming listeners
  - BUG/MINOR: listener: enforce all_threads_mask on bind_thread on init
  - BUG/MINOR: tcp: avoid closing fd when socket failed in tcp_bind_listener
  - DOC: word converter ignores delimiters at the start or end of input string
  - BUG/MINOR: tcp: don't try to set defaultmss when value is negative
  - SCRIPTS: make announce-release executable again


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.14-0
changelog:
  - BUG/MINOR: namespace: avoid closing fd when socket failed in my_socketat
  - BUG/MEDIUM: muxes: Use the right argument when calling the destroy method.
  - SCRIPTS: announce-release: use mutt -H instead of -i to include the draft
  - MINOR: http-htx: Add a function to retrieve the headers size of an HTX message
  - MINOR: filters: Forward data only if the last filter forwards something
  - BUG/MINOR: filters: Count HTTP headers as filtered data but don't forward them
  - BUG/MINOR: http-ana: Matching on monitor-uri should be case-sensitive
  - BUG/MAJOR: http-ana: Always abort the request when a tarpit is triggered
  - MINOR: ist: add an iststop() function
  - BUG/MINOR: http: http-request replace-path duplicates the query string
  - BUG/MEDIUM: shctx: make sure to keep all blocks aligned
  - MINOR: compiler: move CPU capabilities definition from config.h and complete
    them
  - BUG/MEDIUM: ebtree: don't set attribute packed without unaligned access
    support
  - BUILD: fix recent build failure on unaligned archs
  - CLEANUP: cfgparse: Fix type of second calloc() parameter
  - BUG/MINOR: sample: fix the json converter's endian-sensitivity
  - BUG/MEDIUM: ssl: fix several bad pointer aliases in a few sample fetch
    functions
  - BUG/MINOR: connection: make sure to correctly tag local PROXY connections
  - MINOR: compiler: add new alignment macros
  - BUILD: ebtree: improve architecture-specific alignment
  - BUG/MINOR: sample: Make sure to return stable IDs in the unique-id fetch
  - BUG/MINOR: dns: ignore trailing dot
  - MINOR: contrib/prometheus-exporter: Add heathcheck status/code in server
    metrics
  - MINOR: contrib/prometheus-exporter: Add the last heathcheck duration metric
  - BUG/MEDIUM: random: initialize the random pool a bit better
  - MINOR: tools: add 64-bit rotate operators
  - BUG/MEDIUM: random: implement a thread-safe and process-safe PRNG
  - MINOR: backend: use a single call to ha_random32() for the random LB algo
  - BUG/MINOR: checks/threads: use ha_random() and not rand()
  - BUG/MAJOR: list: fix invalid element address calculation
  - MINOR: debug: report the task handler's pointer relative to main
  - BUG/MEDIUM: debug: make the debug_handler check for the thread
    in threads_to_dump
  - MINOR: haproxy: export main to ease access from debugger
  - BUG/MINOR: wdt: do not return an error when the watchdog couldn't be enabled
  - DOC: fix incorrect indentation of http_auth_*
  - OPTIM: startup: fast unique_id allocation for acl.
  - BUG/MINOR: pattern: Do not pass len = 0 to calloc()
  - DOC: configuration.txt: fix various typos
  - DOC: assorted typo fixes in the documentation and Makefile
  - BUG/MINOR: init: make the automatic maxconn consider the max of
    soft/hard limits
  - BUG/MAJOR: proxy_protocol: Properly validate TLV lengths
  - REGTEST: make the PROXY TLV validation depend on version 2.2
  - MINOR: htx: Add a function to return a block at a specific offset
  - BUG/MEDIUM: cache/filters: Fix loop on HTX blocks caching the response payload
  - BUG/MEDIUM: compression/filters: Fix loop on HTX blocks compressing
    the payload
  - BUG/MINOR: http-ana: Reset request analysers on a response side error
  - BUG/MINOR: lua: Ignore the reserve to know if a channel is full or not
  - BUG/MINOR: http-rules: Preserve FLT_END analyzers on reject action
  - BUG/MINOR: http-rules: Fix a typo in the reject action function
  - BUG/MINOR: rules: Preserve FLT_END analyzers on silent-drop action
  - BUG/MINOR: rules: Increment be_counters if backend is assigned for
    a silent-drop
  - DOC: fix typo about no-tls-tickets
  - DOC: improve description of no-tls-tickets
  - DOC: ssl: clarify security implications of TLS tickets
  - BUILD: wdt: only test for SI_TKILL when compiled with thread support
  - BUG/MEDIUM: random: align the state on 2*64 bits for ARM64
  - BUG/MINOR: haproxy: always initialize sleeping_thread_mask
  - BUG/MINOR: listener/mq: do not dispatch connections to remote threads when
    stopping
  - BUG/MINOR: haproxy/threads: try to make all threads leave together
  - DOC: proxy_protocol: Reserve TLV type 0x05 as PP2_TYPE_UNIQUE_ID
  - BUILD: on ARM, must be linked to libatomic.
  - BUILD: makefile: fix regex syntax in ARM platform detection
  - BUILD: makefile: fix expression again to detect ARM platform
  - BUG/MEDIUM: peers: resync ended with RESYNC_PARTIAL in wrong cases.
  - DOC: assorted typo fixes in the documentation
  - MINOR: wdt: Move the definitions of WDTSIG and DEBUGSIG into types/signal.h.
  - BUG/MEDIUM: wdt: Don't ignore WDTSIG and DEBUGSIG in __signal_process_queue().
  - MINOR: memory: Change the flush_lock to a spinlock, and don't get it in alloc.
  - BUG/MINOR: connections: Make sure we free the connection on failure.
  - REGTESTS: use "command -v" instead of "which"
  - REGTEST: increase timeouts on the seamless-reload test
  - BUG/MINOR: haproxy/threads: close a possible race in soft-stop detection
  - BUG/MINOR: peers: init bind_proc to 1 if it wasn't initialized
  - BUG/MINOR: peers: avoid an infinite loop with peers_fe is NULL
  - BUG/MINOR: peers: Use after free of "peers" section.
  - MINOR: listener: add so_name sample fetch
  - BUILD: ssl: only pass unsigned chars to isspace()
  - BUG/MINOR: stats: Fix color of draining servers on stats page
  - DOC: internals: Fix spelling errors in filters.txt
  - MINOR: http-rules: Add a flag on redirect rules to know the rule direction
  - BUG/MINOR: http_ana: make sure redirect flags don't have overlapping bits
  - MINOR: http-rules: Handle the rule direction when a redirect is evaluated
  - BUG/MINOR: filters: Use filter offset to decude the amount of forwarded data
  - BUG/MINOR: filters: Forward everything if no data filters are called
  - BUG/MINOR: http-ana: Reset request analysers on error when waiting
    for response
  - BUG/CRITICAL: hpack: never index a header into the headroom after wrapping


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.15-0
changelog:
  - BUG/MINOR: protocol_buffer: Wrong maximum shifting.
  - BUG/MINOR: peers: Incomplete peers sections should be validated.
  - DOC: hashing: update link to hashing functions
  - DOC: Improve documentation on http-request set-src
  - BUG/MINOR: ssl: default settings for ssl server options are not used
  - BUG/MEDIUM: http-ana: Handle NTLM messages correctly.
  - BUG/MINOR: tools: fix the i386 version of the div64_32 function
  - BUG/MINOR: http: make url_decode() optionally convert '+' to SP
  - DOC: option logasap does not depend on mode
  - BUG/MINOR: check: Update server address and port to execute an external check
  - MINOR: checks: Add a way to send custom headers and payload during http chekcs
  - BUG/MINOR: checks: Respect the no-check-ssl option
  - BUG/MINOR: checks: chained expect will not properly wait for enough data
  - BUG/MINOR: obj_type: Handle stream object in obj_base_ptr() function
  - BUG/MEDIUM: capture: capture-req/capture-res converters crash without a stream
  - BUG/MEDIUM: capture: capture.{req,res}.* crash without a stream
  - BUG/MEDIUM: http: the "http_first_req" sample fetch could crash without
    a steeam
  - BUG/MEDIUM: http: the "unique-id" sample fetch could crash without a steeam
  - BUG/MEDIUM: sample: make the CPU and latency sample fetches check for a stream
  - BUG/MEDIUM: listener: mark the thread as not stuck inside the loop
  - MINOR: threads: export the POSIX thread ID in panic dumps
  - BUG/MINOR: debug: properly use long long instead of long for the thread ID
  - BUG/MEDIUM: shctx: really check the lock's value while waiting
  - BUG/MEDIUM: shctx: bound the number of loops that can happen around the lock
  - MINOR: stream: report the list of active filters on stream crashes
  - REGTEST: ssl: test the client certificate authentication
  - BUG/MEDIUM: backend: don't access a non-existing mux from a previous
    connection
  - Revert "BUG/MINOR: connection: make sure to correctly tag local
    PROXY connections"
  - BUG/MEDIUM: server/checks: Init server check during config validity check
  - BUG/MINOR: checks/server: use_ssl member must be signed
  - BUG/MEDIUM: checks: Always initialize checks before starting them
  - BUG/MINOR: checks: Compute the right HTTP request length for HTTP
    health checks
  - BUG/MINOR: checks: Remove a warning about http health checks
  - BUG/MEDIUM: streams: Remove SF_ADDR_SET if we're retrying due to L7 retry.
  - BUG/MEDIUM: stream: Only allow L7 retries when using HTTP.
  - BUG/MAJOR: stream-int: always detach a faulty endpoint on connect failure
  - BUG/MEDIUM: connections: force connections cleanup on server changes
  - BUG/MEDIUM: ssl: fix the id length check within smp_fetch_ssl_fc_session_id()
  - CLEANUP: connections: align function declaration
  - BUG/MINOR: sample: Set the correct type when a binary is converted to a string
  - BUG/MINOR: threads: fix multiple use of argument inside HA_ATOMIC_CAS()
  - BUG/MINOR: threads: fix multiple use of argument inside
    HA_ATOMIC_UPDATE_{MIN,MAX}()
  - BUG/MEDIUM: lua: Fix dumping of stick table entries for STD_T_DICT
  - BUG/MINOR: config: Make use_backend and use-server post-parsing less obscur
  - BUG/MINOR: http-ana: fix NTLM response parsing again
  - BUG/MEDIUM: http_ana: make the detection of NTLM variants safer
  - BUG/MINOR: cfgparse: Abort parsing the current line if an invalid \x sequence
    is encountered
  - BUG/MINOR: pools: use %u not %d to report pool stats in "show pools"
  - BUG/MINOR: pollers: remove uneeded free in global init
  - BUG/MINOR: soft-stop: always wake up waiting threads on stopping
  - BUILD: select: only declare existing local labels to appease clang
  - BUG/MINOR: cache: Don't needlessly test "cache" keyword in parse_cache_flt()
  - BUG/MINOR: checks: Respect check-ssl param when a port or an addr is specified
  - BUG/MINOR: server: Fix server_finalize_init() to avoid unused variable
  - BUG/MINOR: lua: Add missing string length for lua sticktable lookup
  - BUG/MINOR: nameservers: fix error handling in parsing of resolv.conf
  - Revert "BUG/MEDIUM: connections: force connections cleanup on server changes"
  - SCRIPTS: publish-release: pass -n to gzip to remove timestamp
  - BUG/MINOR: peers: fix internal/network key type mapping.
  - BUG/MEDIUM: lua: Reset analyse expiration timeout before executing
    a lua action
  - BUG/MEDIUM: hlua: Lock pattern references to perform set/add/del operations
  - BUG/MEDIUM: contrib/prometheus-exporter: Properly set flags to dump metrics
  - BUG/MINOR: logs: prevent double line returns in some events.
  - BUG/MEDIUM: logs: fix trailing zeros on log message.
  - BUG/MINOR: proto-http: Fix detection of NTLM for the legacy HTTP version
  - BUILD: makefile: adjust the sed expression of "make help" for solaris
  - BUG/MEDIUM: mworker: fix the copy of options in copy_argv()
  - BUG/MINOR: init: -x can have a parameter starting with a dash
  - BUG/MINOR: init: -S can have a parameter starting with a dash
  - BUG/MEDIUM: mworker: fix the reload with an -- option
  - BUG/MINOR: mworker: fix a memleak when execvp() failed
  - BUG/MEDIUM: log: don't hold the log lock during writev() on a file descriptor
  - BUG/MEDIUM: pattern: fix thread safety of pattern matching
  - REGTESTS: Add missing OPENSSL to REQUIRE_OPTIONS for lua/txn_get_priv
  - REGTESTS: Add missing OPENSSL to REQUIRE_OPTIONS for
    compression/lua_validation
  - BUG/MINOR: ssl: fix ssl-{min,max}-ver with openssl < 1.1.0
  - REGTESTS: checks: Fix tls_health_checks when IPv6 addresses are used


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.16-0
changelog:
  - MINOR: http: Add 410 to http-request deny
  - MINOR: http: Add 404 to http-request deny
  - BUG/MINOR: tcp-rules: tcp-response must check the buffer's fullness
  - BUG/MEDIUM: ebtree: use a byte-per-byte memcmp() to compare memory blocks
  - BUG/MINOR: spoe: add missing key length check before checking key names
  - BUG/MINOR: cli: allow space escaping on the CLI
  - BUG/MINOR: mworker/cli: fix the escaping in the master CLI
  - BUG/MINOR: mworker/cli: fix semicolon escaping in master CLI
  - REGTEST: http-rules: test spaces in ACLs
  - REGTEST: http-rules: test spaces in ACLs with master CLI
  - MEDIUM: map: make the "clear map" operation yield
  - BUG/MINOR: systemd: Wait for network to be online
  - REGTEST: Add a simple script to tests errorfile directives in proxy sections
  - BUG/MINOR: spoe: correction of setting bits for analyzer
  - BUG/MINOR: http_ana: clarify connection pointer check on L7 retry
  - MINOR: spoe: Don't systematically create new applets if processing rate is low
  - REGTEST: ssl: tests the ssl_f_* sample fetches
  - REGTEST: ssl: add some ssl_c_* sample fetches test
  - BUG/MEDIUM: fetch: Fix hdr_ip misparsing IPv4 addresses due to missing NUL
  - MINOR: cli: make "show sess" stop at the last known session
  - DOC: ssl: add "allow-0rtt" and "ciphersuites" in crt-list
  - BUG/MEDIUM: pattern: Add a trailing \0 to match strings only if possible
  - BUG/MINOR: proxy: fix dump_server_state()'s misuse of the trash
  - BUG/MINOR: proxy: always initialize the trash in show servers state
  - DOC: configuration: add missing index entries for
    tune.pool-{low,high}-fd-ratio
  - DOC: configuration: fix alphabetical ordering for
    tune.pool-{high,low}-fd-ratio
  - BUG/MINOR: http_act: don't check capture id in backend (2)
  - BUG/MINOR: mux-h1: Fix the splicing in TUNNEL mode
  - BUG/MINOR: mux-h1: Don't read data from a pipe if the mux is unable to receive
  - BUG/MINOR: mux-h1: Disable splicing only if input data was processed
  - BUG/MEDIUM: mux-h1: Disable splicing for the conn-stream if read0 is received
  - BUG/MEDIUM: mux-h1: Subscribe rather than waking up in h1_rcv_buf()
  - MINOR: connection: move the CO_FL_WAIT_ROOM cleanup to the reader only
  - BUG/MEDIUM: connection: Continue to recv data to a pipe when the FD
    is not ready
  - BUG/MINOR: backend: Remove CO_FL_SESS_IDLE if a client remains on
    the last server
  - MINOR: http: Add support for http 413 status
  - BUG/MAJOR: stream: Mark the server address as unset on new outgoing connection
  - BUG/MEDIUM: stream-int: Disable connection retries on plain HTTP proxy mode
  - DOC: configuration: remove obsolete mentions of H2 being converted to HTTP/1.x
  - BUG/MINOR: sample: Free str.area in smp_check_const_bool
  - BUG/MINOR: sample: Free str.area in smp_check_const_meth
  - CONTRIB: da: fix memory leak in dummy function da_atlas_open()
  - BUG/MEDIUM: mux-h1: Continue to process request when switching in tunnel mode
  - BUG/MEDIUM: log: issue mixing sampled to not sampled log servers.
  - BUG/MEDIUM: channel: Be aware of SHUTW_NOW flag when output data are peeked


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.17-0
changelog:
  - BUILD: ebtree: fix build on libmusl after recent introduction of eb_memcmp()
  - REGEST: Add reg tests about error files
  - BUG/MINOR: threads: Don't forget to init each thread toremove_lock.
  - MINOR: pools: increase MAX_BASE_POOLS to 64
  - BUILD: thread: add parenthesis around values of locking macros
  - BUG/MINOR: cfgparse: don't increment linenum on incomplete lines
  - BUG/MEDIUM: resolve: fix init resolving for ring and peers section.
  - BUG/MEDIUM: mux-h2: Emit an error if the response chunk formatting
    is incomplete
  - BUG/MAJOR: dns: Make the do-resolve action thread-safe
  - BUG/MEDIUM: dns: Release answer items when a DNS resolution is freed
  - BUG/MEDIUM: mux-h1: Wakeup the H1C in h1_rcv_buf() if more data are expected
  - BUG/MEDIUM: mux-h1: Disable the splicing when nothing is received
  - BUG/MINOR: debug: Don't dump the lua stack if it is not initialized
  - MEDIUM: lua: Add support for the Lua 5.4
  - BUG/MEDIUM: dns: Don't yield in do-resolve action on a final evaluation
  - BUG/MINOR: tcp-rules: Set the inspect-delay when a tcp-response action yields
  - MINOR: connection: Preinstall the mux for non-ssl connect
  - MINOR: stream-int: Be sure to have a mux to do sends and receives
  - SCRIPTS: announce-release: add the link to the wiki in the announce messages


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.18-0
changelog:
  - SCRIPTS: git-show-backports: make -m most only show the left branch
  - SCRIPTS: git-show-backports: emit the shell command to backport a commit
  - BUG/MEDIUM: mux-h2: Don't fail if nothing is parsed for a legacy chunk
    response
  - BUG/MEDIUM: mux-h1: Refresh H1 connection timeout after a synchronous send
  - BUG/MEDIUM: map/lua: Return an error if a map is loaded during runtime
  - BUG/MINOR: lua: Check argument type to convert it to IPv4/IPv6 arg validation
  - BUG/MINOR: lua: Check argument type to convert it to IP mask in arg validation
  - BUG/MINOR: snapshots: leak of snapshots on deinit()
  - BUG/MINOR: stats: use strncmp() instead of memcmp() on health states
  - BUG/MEDIUM: htx: smp_prefetch_htx() must always validate the direction
  - BUG/MINOR: reload: do not fail when no socket is sent
  - DOC: cache: Use '<name>' instead of '<id>' in error message
  - BUG/MAJOR: contrib/spoa-server: Fix unhandled python call leading to memory
    leak
  - BUG/MINOR: contrib/spoa-server: Ensure ip address references are freed
  - BUG/MINOR: contrib/spoa-server: Do not free reference to NULL
  - BUG/MINOR: contrib/spoa-server: Updating references to free in case of failure
  - BUG/MEDIUM: contrib/spoa-server: Fix ipv4_address used instead of ipv6_address
  - BUG/MINOR: startup: haproxy -s cause 100% cpu
  - BUG/MEDIUM: doc: Fix replace-path action description
  - BUG/MEDIUM: ssl: check OCSP calloc in ssl_sock_load_ocsp()
  - BUG/MINOR: threads: work around a libgcc_s issue with chrooting
  - BUILD: thread: limit the libgcc_s workaround to glibc only
  - MINOR: Commit .gitattributes
  - CLEANUP: Update .gitignore
  - BUG/MINOR: auth: report valid crypto(3) support depending on build options
  - BUG/MEDIUM: mux-h1: always apply the timeout on half-closed connections
  - BUILD: threads: better workaround for late loading of libgcc_s
  - BUG/MEDIUM: pattern: Renew the pattern expression revision when it is pruned
  - BUG/MEDIUM: http-ana: Don't wait to send 1xx responses received from servers
  - BUG/MEDIUM: ssl: does not look for all SNIs before chosing a certificate
  - BUG/MINOR: ssl: verifyhost is case sensitive
  - BUG/MINOR: server: report correct error message for invalid port on "socks4"
  - BUG/MINOR: http-fetch: Don't set the sample type during the htx prefetch
  - BUG/MEDIUM: h2: report frame bits only for handled types
  - BUG/MINOR: Fix memory leaks cfg_parse_peers
  - BUG/MINOR: config: Fix memory leak on config parse listen
  - BUG/MEDIUM: listeners: do not pause foreign listeners
  - DOC: spoa-server: fix false friends `actually`
  - DOC: agent-check: fix typo in "fail" word expected reply
  - REGTESTS: add a few load balancing tests
  - REGTEST: fix host part in balance-uri-path-only.vtc
  - REGTEST: make abns_socket.vtc require 1.8
  - REGTEST: make map_regm_with_backref require 1.7


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.19-0
changelog:
  - DOC: ssl: crt-list negative filters are only a hint
  - BUILD: makefile: Fix building with closefrom() support enabled
  - BUG/MINOR: Fix several leaks of 'log_tag' in init().
  - BUG/MEDIUM: queue: make pendconn_cond_unlink() really thread-safe
  - MINOR: counters: fix a typo in comment
  - BUG/MINOR: stats: fix validity of the json schema
  - MINOR: hlua: Display debug messages on stderr only in debug mode
  - BUG/MINOR: peers: Inconsistency when dumping peer status codes.
  - BUG/MINOR: mux-h1: Always set the session on frontend h1 stream
  - BUG/MEDIUM: mux-h2: Don't handle pending read0 too early on streams
  - BUG/MINOR: http-htx: Expect no body for 204/304 internal HTTP responses
  - BUG/MEDIUM: h1: Always try to receive more in h1_rcv_buf().
  - BUG/MINOR: init: only keep rlim_fd_cur if max is unlimited
  - BUG/MINOR: mux-h2: do not stop outgoing connections on stopping
  - MINOR: fd: report an error message when failing initial allocations
  - BUG/MEDIUM: task: bound the number of tasks picked from the wait queue at once
  - BUG/MEDIUM: spoe: Unset variable instead of set it if no data provided
  - BUG/MEDIUM: mux-h1: Get the session from the H1S when capturing bad messages
  - BUG/MEDIUM: lb: Always lock the server when calling server_{take,drop}_conn
  - BUG/MINOR: peers: Possible unexpected peer seesion reset after collisions.
  - BUG/MINOR: queue: properly report redistributed connections
  - BUG/MEDIUM: server: support changing the slowstart value from state-file
  - BUG/MINOR: http-ana: Don't send payload for internal responses to HEAD
    requests
  - BUG/MAJOR: mux-h2: Don't try to send data if we know it is no longer possible
  - BUG/MINOR: extcheck: add missing checks on extchk_setenv()
  - BUG/MINOR: log: fix memory leak on logsrv parse error
  - BUG/MINOR: server: fix srv downtime calcul on starting
  - BUG/MINOR: server: fix down_time report for stats
  - BUG/MINOR: lua: initialize sample before using it
  - BUG/MINOR: cache: Inverted variables in http_calc_maxage function
  - BUG/MEDIUM: filters: Don't try to init filters for disabled proxies
  - BUG/MINOR: server: Set server without addr but with dns in RMAINT on startup
  - MINOR: server: Copy configuration file and line for server templates
  - BUG/MEDIUM: mux-pt: Release the tasklet during an HTTP upgrade
  - BUG/MINOR: filters: Skip disabled proxies during startup only
  - BUG/MEDIUM: stick-table: limit the time spent purging old entries
  - MINOR: http-htx: Add understandable errors for the errorfiles parsing
  - BUG/MINOR: http-htx: Just warn if payload of an errorfile doesn't match
    the C-L


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.20-0
changelog:
  - BUG/MINOR: pattern: a sample marked as const could be written
  - BUG/MINOR: lua: set buffer size during map lookups
  - BUG/MINOR: peers: Do not ignore a protocol error for dictionary entries.
  - BUG/MINOR: peers: Missing TX cache entries reset.
  - BUG/MEDIUM: peers: fix decoding of multi-byte length in stick-table messages
  - BUG/MINOR: http-fetch: Extract cookie value even when no cookie name
  - BUG/MINOR: http-fetch: Fix calls w/o parentheses of the cookie sample fetches
  - BUG/MAJOR: spoe: Be sure to remove all references on a released spoe applet
  - MINOR: spoe: Don't close connection in sync mode on processing timeout
  - MINOR: cfgparse: tighten the scope of newnameserver variable, free it
    on error.
  - BUILD: http-htx: fix build warning regarding long type in printf
  - BUG/MEDIUM: filters: Forward all filtered data at the end of http filtering
  - BUG/MINOR: http-ana: Don't wait for the body of CONNECT requests
  - BUG/MAJOR: filters: Always keep all offsets up to date during data filtering
  - BUG/MAJOR: peers: fix partial message decoding
  - DOC: config: Move req.hdrs and req.hdrs_bin in L7 samples fetches section
  - MINOR: plock: use an ARMv8 instruction barrier for the pause instruction
  - BUG/MINOR: lua: lua-load doesn't check its parameters
  - BUG/MINOR: lua: Post init register function are not executed beyond
    the first one
  - BUG/MINOR: lua: Some lua init operation are processed unsafe
  - MINOR: actions: Export actions lookup functions
  - MINOR: actions: add a function returning a service pointer from its name
  - MINOR: cli: add a function to look up a CLI service description
  - BUG/MINOR: lua: warn when registering action, conv, sf, cli or applet
    multiple times
  - DOC/MINOR: Fix formatting in Management Guide
  - BUG/MAJOR: spoa/python: Fixing return None
  - DOC: spoa/python: Fixing typo in IP related error messages
  - DOC: spoa/python: Rephrasing memory related error messages
  - DOC: spoa/python: Fixing typos in comments
  - BUG/MINOR: spoa/python: Cleanup references for failed Module Addobject
    operations
  - BUG/MINOR: spoa/python: Cleanup ipaddress objects if initialization fails
  - BUG/MEDIUM: spoa/python: Fixing PyObject_Call positional arguments
  - BUG/MEDIUM: spoa/python: Fixing references to None
  - DOC: email change of the DeviceAtlas maintainer
  - BUG/MINOR: tools: make parse_time_err() more strict on the timer validity
  - BUG/MINOR: tools: Reject size format not starting by a digit
  - BUG/MEDIUM: lb-leastconn: Reposition a server using the right eweight
  - CLEANUP: lua: Remove declaration of an inexistant function
  - CLEANUP: contrib/prometheus-exporter: typo fixes for ssl reuse metric
  - REGTESTS: make use of HAPROXY_ARGS and pass -dM by default
  - BUILD: Makefile: have "make clean" destroy .o/.a/.s in contrib subdirs as well
  - BUG/MINOR: mux-h1: Don't set CS_FL_EOI too early for protocol upgrade requests
  - BUG/MEDIUM: http-ana: Never for sending data in TUNNEL mode
  - CONTRIB: halog: fix build issue caused by %L printf format
  - CONTRIB: halog: mark the has_zero* functions unused
  - CONTRIB: halog: fix signed/unsigned build warnings on counts and timestamps
  - BUILD: plock: remove dead code that causes a warning in gcc 11
  - BUILD: hpack: hpack-tbl-t.h uses VAR_ARRAY but does not include compiler.h
  - MINOR: atomic: don't use ; to separate instruction on aarch64.
  - BUG/MINOR: cfgparse: Fail if the strdup() for `rule->be.name` for
    `use_backend` fails
  - SCRIPTS: improve announce-release to support different tag and versions
  - SCRIPTS: make announce release support preparing announces before tag exists
  - BUG/MINOR: srv: do not init address if backend is disabled
  - BUILD: Makefile: exclude broken tests by default
  - MINOR: contrib/prometheus-exporter: export build_info
  - DOC: fix some spelling issues over multiple files
  - SCRIPTS: announce-release: fix typo in help message
  - DOC: Add maintainers for the Prometheus exporter
  - BUG/MINOR: sample: fix concat() converter's corruption with non-string
    variables


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.21-0
changelog:
  - BUG/MINOR: sample: check alloc_trash_chunk return value in concat()
  - BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  - BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable
  - BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  - BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  - BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  - BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  - BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  - BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  - BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  - DOC: management: fix "show resolvers" alphabetical ordering
  - BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  - BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  - BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  - BUILD: Makefile: move REGTESTST_TYPE default setting
  - BUG/MEDIUM: mux-h2: handle remaining read0 cases
  - BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  - BUG/MEDIUM: mux-h2: Be sure to enter in demux loop even if dbuf is empty
  - BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  - BUG/MINOR: server: re-align state file fields number
  - BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  - BUG/MINOR: backend: hold correctly lock when killing idle conn
  - BUG/MINOR: server: Fix server-state-file-name directive
  - CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  - BUG/MEDIUM: config: don't pick unset values from last defaults section
  - BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  - BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  - CLEANUP: channel: fix comment in ci_putblk.
  - BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  - BUG/MINOR: session: atomically increment the tracked sessions counter
  - BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  - BUG/MINOR: sample: Always consider zero size string samples as unsafe
  - BUG/MINOR: server: Init params before parsing a new server-state line
  - BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  - BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  - BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  - BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  - BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  - BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  - BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  - BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  - BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  - BUG/MEDIUM: resolvers: Reset address for unresolved servers
  - BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  - BUG/MINOR: http-ana: Only consider dst address to process originalto option
  - BUG/MINOR: tcp-act: Don't forget to set the original port
    for IPv4 set-dst rule
  - BUG/MINOR: connection: Use the client's dst family for adressless servers
  - BUG/MEDIUM: spoe: Kill applets if there are pending connections
    and nbthread > 1
  - DOC: spoe: Add a note about fragmentation support in HAProxy
  - BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout
  - BUG/MEDIUM: dns: Consider the fact that dns answers are case-insensitive
  - BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  - BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  - BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  - BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  - BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  - BUG/MINOR: session: Add some forgotten tests on session's listener
  - CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  - BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  - BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  - BUG/MINOR: resolvers: Add missing case-insensitive comparisons
    of DNS hostnames
  - MINOR: time: export the global_now variable
  - BUG/MINOR: freq_ctr/threads: make use of the last updated global time


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.22-0
changelog:
  - MINOR: time: also provide a global, monotonic global_now_ms timer
  - BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  - MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master
    CLI socket
  - MINOR: lua: Slightly improve function dumping the lua traceback
  - BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  - BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  - BUG/MEDIUM: time: make sure to always initialize the global tick
  - BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  - MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  - BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  - BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent
  - BUG/MINOR: stats: Apply proper styles in HTML status page.
  - BUG/MINOR: tcp: fix silent-drop workaround for IPv6
  - BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  - BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  - BUG/MAJOR: dns: fix null pointer dereference in snr_update_srv_status
  - BUG/MAJOR: dns: disabled servers through SRV records never recover
  - BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  - MINOR: resolvers: Use a function to remove answers attached to a resolution
  - MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  - MINOR: resolvers: Add function to change the srv status based on
    SRV resolution
  - MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  - BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.23-0
changelog:
  - DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  - BUG/MINOR: tools: fix parsing "us" unit for timers
  - DOC: clarify that compression works for HTTP/2
  - BUG/MEDIUM: sample: Fix adjusting size in field converter
  - BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  - BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  - BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  - BUG/MINOR: logs: Report the true number of retries if there was no connection
  - BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  - BUG/MINOR: server: free srv.lb_nodes in free_server
  - BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  - BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  - BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  - BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  - BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  - BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  - BUG/MINOR: peers: remove useless table check if initial resync is finished
  - BUG/MEDIUM: peers: re-work connection to new process during reload.
  - BUG/MEDIUM: peers: re-work refcnt on table to protect against flush
  - BUG/MINOR: htx: Preserve HTX flags when draining data from an HTX message
  - BUG/MINOR: applet: Notify the other side if data were consumed by an applet
  - BUG/MEDIUM: peers: initialize resync timer to get an initial full resync
  - BUG/MEDIUM: peers: register last acked value as origin receiving a resync req
  - BUG/MEDIUM: peers: stop considering ack messages teaching a full resync
  - BUG/MEDIUM: peers: reset starting point if peers appears longly disconnected
  - BUG/MEDIUM: peers: reset commitupdate value in new conns
  - BUG/MEDIUM: peers: re-work updates lookup during the sync on the fly
  - BUG/MEDIUM: peers: reset tables stage flags stages on new conns
  - MINOR: peers: add informative flags about resync process for debugging
  - MINOR: hlua: Add error message relative to the Channel manipulation and
    HTTP mode
  - BUG/MINOR: hlua: Don't rely on top of the stack when using Lua buffers
  - BUG/MEDIUM: cli: prevent memory leak on write errors
  - BUG/MINOR: stream: Decrement server current session counter on L7 retry
  - BUG/MINOR: stream: properly clear the previous error mask on L7 retries
  - BUG/MINOR: stream: Reset stream final state and si error type on L7 retry
  - BUG/MINOR: http_fetch: fix possible uninit sockaddr in fetch_url_ip/port
  - MINOR: channel: Rely on HTX version if appropriate in channel_may_recv()
  - BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive
  - MEDIUM: mux-h1: Don't block reads when waiting for the other side
  - REGTESTS: Add script to test abortonclose option
  - BUG/MEDIUM: ebtree: Invalid read when looking for dup entry
  - BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  - BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  - BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  - BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  - BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  - BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  - BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  - BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  - BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  - BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  - BUG/MINOR: http: Missing calloc return value check while parsing
    tcp-request/tcp-response
  - BUG/MINOR: http: Missing calloc return value check while parsing
    tcp-request rule
  - BUG/MINOR: compression: Missing calloc return value check in
    comp_append_type/algo
  - BUG/MINOR: worker: Missing calloc return value check in
    mworker_env_to_proc_list
  - BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  - BUG/MINOR: http: Missing calloc return value check in make_arg_list
  - BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  - BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  - BUG/MEDIUM: compression: Add a flag to know the filter is still
    processing data
  - BUG/MEDIUM: dns: reset file descriptor if send returns an error
  - BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  - DOC: lua: Add a warning about buffers modification in HTTP
  - BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  - BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  - BUG/MINOR: ssl: use atomic ops to update global shctx stats
  - BUG/MINOR: mworker: fix typo in chroot error message
  - BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue
  - MINOR: mux-h2: obey http-ignore-probes during the preface
  - BUG/MEDIUM: dns: send messages on closed/reused fd if fd was detected broken
  - BUG/MEDIUM: spoe: Register pre/post analyzers in start_analyze
    callback function
  - BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  - MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  - DOC: config: Add missing actions in "tcp-request session" documentation
  - BUG/MINOR: resolvers: answser item list was randomly purged or errors
  - BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  - BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  - BUG/MEDIUM: sock: make sure to never miss early connection failures
  - BUG/MINOR: cli: fix server name output in "show fd"
  - BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  - DOC: stick-table: add missing documentation about gpt0 stored type
  - DOC: peers: fix the protocol tag name in the doc
  - DOC: config: use CREATE USER for mysql-check
  - BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  - MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  - BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  - Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request
    content" rules"
  - MINOR: pools/debug: slightly relax DEBUG_DONT_SHARE_POOLS
  - BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  - MINOR: pools: do not maintain the lock during pool_flush()
  - BUG/MEDIUM: pools: Always update free_list in pool_gc().
  - MEDIUM: memory: make pool_gc() run under thread isolation
  - MEDIUM: pools: use a single pool_gc() function for locked and lockless
  - BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  - CLEANUP: pools: remove now unused seq and pool_free_list
  - BUG/MINOR: server-state: load SRV resolution only if params match the config
  - BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.24-0
changelog:
  - BUG/MEDIUM: tcp-check: Do not dereference inexisting connection
  - BUILD: add detection of missing important CFLAGS
  - BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  - BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  - BUG/MINOR: systemd: must check the configuration using -Ws
  - BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  - BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  - BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  - BUG/MINOR: server: update last_change on maint->ready transitions too
  - MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  - BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one
    is released
  - BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  - DOC: Improve the lua documentation
  - DOC: config: Fix 'http-response send-spoe-group' documentation
  - MINOR: mux-h1/proxy: Add a proxy option to disable clear h2 upgrade
  - DOC/MINOR: fix typo in management document
  - BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  - REGTESTS: add a test to prevent h2 desync attacks


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.25-0
changelog:
  - BUG/MEDIUM: sock: really fix detection of early connection failures in for 2.3
  - REGTESTS: abortonclose: after retries, 503 is expected, not close
  - BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  - MINOR: compiler: implement an ONLY_ONCE() macro
  - BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  - BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  - BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  - BUG/MINOR: tools: Fix loop condition in dump_text()
  - CLEANUP: Add missing include guard to signal.h
  - DOC: configuration: remove wrong tcp-request examples in tcp-response
  - BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB
  - CLEANUP: htx: remove comments about "must be < 256 MB"
  - BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  - Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn
    may receive"
  - MINOR: action: Use a generic function to check validity of an action rule list
  - REGTESTS: mark http_abortonclose as broken


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.4-0
changelog:
  - BUILD: threads: better workaround for late loading of libgcc_s
  - BUG/MEDIUM: pattern: Renew the pattern expression revision when it is pruned
  - BUG/MINOR: Fix type passed of sizeof() for calloc()
  - BUG/MINOR: ssl: verifyhost is case sensitive
  - BUG/MINOR: server: report correct error message for invalid port on "socks4"
  - BUG/MEDIUM: ssl: Don't call ssl_sock_io_cb() directly.
  - BUG/MINOR: ssl/crt-list: crt-list could end without a \n
  - BUG/MINOR: h2/trace: do not display "stream error" after a frame ACK
  - BUG/MINOR: http-fetch: Don't set the sample type during the htx prefetch
  - BUG/MINOR: config: Fix memory leak on config parse listen
  - BUG/MEDIUM: h2: report frame bits only for handled types
  - BUG/MINOR: Fix memory leaks cfg_parse_peers
  - MINOR: h2/trace: also display the remaining frame length in traces
  - MINOR: backend: make the "whole" option of balance uri take only one bit
  - MINOR: backend: add a new "path-only" option to "balance uri"
  - REGTESTS: add a few load balancing tests
  - BUG/MEDIUM: listeners: do not pause foreign listeners
  - BUILD: trace: include tools.h
  - REGTESTS: use "command" instead of "which" for better POSIX compatibility
  - DOC: agent-check: fix typo in "fail" word expected reply
  - BUG/MINOR: ssl/crt-list: exit on warning out of crtlist_parse_line()
  - REGTEST: fix host part in balance-uri-path-only.vtc
  - REGTEST: make agent-check.vtc require 1.8
  - REGTEST: make abns_socket.vtc require 1.8
  - REGTEST: make map_regm_with_backref require 1.7


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.5-0
changelog:
  - BUILD: ssl_crtlist: work around another bogus gcc-9.3 warning
  - BUILD: makefile: Fix building with closefrom() support enabled
  - MINOR: ssl: Add error if a crt-list might be truncated
  - BUG/MINOR: Fix several leaks of 'log_tag' in init().
  - DOC: tcp-rules: Refresh details about L7 matching for tcp-request content
    rules
  - BUG/MINOR: tcpcheck: Set socks4 and send-proxy flags before the connect call
  - BUG/MEDIUM: queue: make pendconn_cond_unlink() really thread-safe
  - MINOR: ssl: Add warning if a crt-list might be truncated
  - MINOR: counters: fix a typo in comment
  - BUG/MINOR: stats: fix validity of the json schema
  - MINOR: hlua: Display debug messages on stderr only in debug mode
  - BUG/MINOR: peers: Inconsistency when dumping peer status codes.
  - BUG/MINOR: mux-h1: Be sure to only set CO_RFL_READ_ONCE for the first read
  - BUG/MINOR: mux-h1: Always set the session on frontend h1 stream
  - DOC: fix a confusing typo on a regsub example
  - DOC: Add missing stats fields in the management doc
  - BUG/MEDIUM: mux-fcgi: Don't handle pending read0 too early on streams
  - BUG/MEDIUM: mux-h2: Don't handle pending read0 too early on streams
  - DOC: Fix typos in configuration.txt
  - BUG/MINOR: http: Fix content-length of the default 500 error
  - BUG/MINOR: http-htx: Expect no body for 204/304 internal HTTP responses
  - CLEANUP: tree-wide: use VAR_ARRAY instead of [0] in various definitions
  - BUILD: connection: fix build on clang after the VAR_ARRAY cleanup
  - BUG/MINOR: init: only keep rlim_fd_cur if max is unlimited
  - BUG/MINOR: mux-h2: do not stop outgoing connections on stopping
  - MINOR: fd: report an error message when failing initial allocations
  - BUG/MINOR: connection: fix loop iter on connection takeover
  - BUG/MEDIUM: task: bound the number of tasks picked from the wait queue at once
  - BUG/MEDIUM: spoe: Unset variable instead of set it if no data provided
  - BUG/MEDIUM: mux-h1: Get the session from the H1S when capturing bad messages
  - BUG/MEDIUM: lb: Always lock the server when calling server_{take,drop}_conn
  - DOC: fix typo in MAX_SESS_STKCTR
  - BUG/MINOR: peers: Possible unexpected peer seesion reset after collisions.
  - BUG/MINOR: disable dynamic OCSP load with BoringSSL
  - BUILD: ssl: make BoringSSL use its own version numbers
  - MINOR: ssl: 'ssl-load-extra-del-ext' removes the certificate extension
  - BUG/MINOR: queue: properly report redistributed connections
  - BUG/MEDIUM: server: support changing the slowstart value from state-file
  - BUG/MINOR: http-ana: Don't send payload for internal responses to HEAD
    requests
  - BUG/MAJOR: mux-h2: Don't try to send data if we know it is no longer possible
  - Revert "MINOR: ssl: 'ssl-load-extra-del-ext' removes the certificate
    extension"
  - BUG/MEDIUM: ssl: OCSP must work with BoringSSL
  - BUG/MINOR: extcheck: add missing checks on extchk_setenv()
  - BUG/MINOR: log: fix memory leak on logsrv parse error
  - BUG/MINOR: log: fix risk of null deref on error path
  - BUG/MINOR: server: fix srv downtime calcul on starting
  - BUG/MINOR: server: fix down_time report for stats
  - BUG/MINOR: lua: initialize sample before using it
  - MINOR: ist: Add a case insensitive istmatch function
  - BUG/MINOR: cache: Manage multiple values in cache-control header value
  - BUG/MINOR: cache: Inverted variables in http_calc_maxage function
  - BUG/MEDIUM: filters: Don't try to init filters for disabled proxies
  - BUG/MINOR: proxy/server: Skip per-proxy/server post-check for disabled proxies
  - BUG/MINOR: checks: Report a socket error before any connection attempt
  - BUG/MINOR: server: Set server without addr but with dns in RMAINT on startup
  - MINOR: server: Copy configuration file and line for server templates
  - BUG/MEDIUM: mux-pt: Release the tasklet during an HTTP upgrade
  - BUG/MINOR: filters: Skip disabled proxies during startup only
  - BUG/MEDIUM: stick-table: limit the time spent purging old entries
  - CLEANUP: mux-h2: Remove the h1 parser state from the h2 stream
  - BUG/MEDIUM: server: make it possible to kill last idle connections


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.6-0
changelog:
  - BUG/MINOR: ssl: don't report 1024 bits DH param load error when it's higher
  - MINOR: http-htx: Add understandable errors for the errorfiles parsing
  - BUG/MINOR: http-htx: Just warn if payload of an errorfile doesn't match
    the C-L
  - MINOR: ssl: add ssl_{c,s}_chain_der fetch methods
  - BUG/MINOR: ssl: double free w/ smp_fetch_ssl_x_chain_der()
  - DOC: config: Fix a typo on ssl_c_chain_der
  - BUG/MINOR: pattern: a sample marked as const could be written
  - BUG/MINOR: lua: set buffer size during map lookups
  - BUG/MINOR: peers: Do not ignore a protocol error for dictionary entries.
  - BUG/MINOR: peers: Missing TX cache entries reset.
  - BUG/MEDIUM: peers: fix decoding of multi-byte length in stick-table messages
  - BUG/MINOR: http-fetch: Extract cookie value even when no cookie name
  - BUG/MINOR: http-fetch: Fix calls w/o parentheses of the cookie sample fetches
  - BUG/MEDIUM: check: reuse srv proto only if using same mode
  - MINOR: check: report error on incompatible proto
  - MINOR: check: report error on incompatible connect proto
  - BUG/MINOR: http-htx: Handle warnings when parsing http-error and http-errors
  - BUG/MAJOR: spoe: Be sure to remove all references on a released spoe applet
  - MINOR: spoe: Don't close connection in sync mode on processing timeout
  - BUG/MINOR: tcpcheck: Don't warn on unused rules if check option is after
  - MINOR: init: Fix the prototype for per-thread free callbacks
  - MINOR: config/mux-h2: Return ERR_ flags from init_h2() instead of a status
  - MINOR: cfgparse: tighten the scope of newnameserver variable, free it on
    error.
  - REGTEST: make ssl_client_samples and ssl_server_samples require to 2.2
  - MINOR: peers: Add traces to peer_treat_updatemsg().
  - BUILD: http-htx: fix build warning regarding long type in printf
  - BUG/MEDIUM: filters: Forward all filtered data at the end of http filtering
  - BUG/MINOR: http-ana: Don't wait for the body of CONNECT requests
  - BUG/MINOR: ssl: segv on startup when AKID but no keyid
  - BUG/MEDIUM: http-ana: Don't eval http-after-response ruleset on empty messages
  - DOC: clarify how to create a fallback crt
  - BUG/MINOR: http_htx: Fix searching headers by substring
  - DOC: better describes how to configure a fallback crt
  - BUG/MAJOR: filters: Always keep all offsets up to date during data filtering
  - REGTESTS: Add sample_fetches/cook.vtc
  - REGTESTS: converter: add url_dec test
  - MINOR: http_act: Add -m flag for del-header name matching method
  - BUILD: Make DEBUG part of .build_opts
  - BUILD: Show the value of DEBUG= in haproxy -vv
  - BUG/MEDIUM: http_act: Restore init of log-format list
  - BUG/MAJOR: peers: fix partial message decoding
  - DOC: better document the config file format and escaping/quoting rules
  - DOC: Clarify %HP description in log-format
  - BUG/MINOR: tcpcheck: Don't forget to reset tcp-check flags on new kind of
    check
  - MINOR: tcpcheck: Don't handle anymore in-progress send rules in tcpcheck_main
  - BUG/MAJOR: tcpcheck: Allocate input and output buffers from the buffer pool
  - DOC: config: Move req.hdrs and req.hdrs_bin in L7 samples fetches section
  - BUG/MINOR: http-fetch: Fix smp_fetch_body() when called from a health-check
  - MINOR: plock: use an ARMv8 instruction barrier for the pause instruction


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.7-0
changelog:
  - BUG/MINOR: lua: missing "\n" in error message
  - BUG/MINOR: lua: lua-load doesn't check its parameters
  - BUG/MINOR: lua: Post init register function are not executed beyond the first
    one
  - BUG/MINOR: lua: Some lua init operation are processed unsafe
  - MINOR: actions: Export actions lookup functions
  - MINOR: actions: add a function returning a service pointer from its name
  - MINOR: cli: add a function to look up a CLI service description
  - BUG/MINOR: lua: warn when registering action, conv, sf, cli or applet multiple
    times
  - BUG/MAJOR: ring: tcp forward on ring can break the reader counter.
  - BUILD/MINOR: haproxy DragonFlyBSD affinity build update.
  - DOC/MINOR: Fix formatting in Management Guide
  - BUG/MINOR: mux-h1: Handle keep-alive timeout for idle frontend connections
  - BUG/MAJOR: spoa/python: Fixing return None
  - DOC: spoa/python: Fixing typo in IP related error messages
  - DOC: spoa/python: Rephrasing memory related error messages
  - DOC: spoa/python: Fixing typos in comments
  - BUG/MINOR: spoa/python: Cleanup references for failed Module Addobject
    operations
  - BUG/MINOR: spoa/python: Cleanup ipaddress objects if initialization fails
  - BUG/MEDIUM: spoa/python: Fixing PyObject_Call positional arguments
  - BUG/MEDIUM: spoa/python: Fixing references to None
  - DOC: email change of the DeviceAtlas maintainer
  - BUG/MINOR: http-check: Use right condition to consider HTX message as full
  - BUG/MINOR: tcpcheck: Don't rearm the check timeout on each read
  - MINOR: tcpcheck: Only wait for more payload data on HTTP expect rules
  - BUG/MINOR: tools: make parse_time_err() more strict on the timer validity
  - BUG/MINOR: tools: Reject size format not starting by a digit
  - BUG/MEDIUM: lb-leastconn: Reposition a server using the right eweight
  - CLEANUP: contrib/prometheus-exporter: typo fixes for ssl reuse metric
  - BUG/MEDIUM: ssl/crt-list: bad behavior with "commit ssl cert"
  - REGTESTS: make use of HAPROXY_ARGS and pass -dM by default
  - BUILD: SSL: fine guard for SSL_CTX_add_server_custom_ext call
  - BUILD: Makefile: have "make clean" destroy .o/.a/.s in contrib subdirs as well
  - BUG/MINOR: mux-h1: Don't set CS_FL_EOI too early for protocol upgrade requests
  - BUG/MEDIUM: http-ana: Never for sending data in TUNNEL mode
  - BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request
  - CONTRIB: halog: fix build issue caused by %L printf format
  - CONTRIB: halog: mark the has_zero* functions unused
  - CONTRIB: halog: fix signed/unsigned build warnings on counts and timestamps
  - CONTRIB: debug: address "poll" utility build on non-linux platforms
  - BUILD: plock: remove dead code that causes a warning in gcc 11
  - BUILD: ssl: fine guard for SSL_CTX_get0_privatekey call
  - BUG/MINOR: dns: SRV records ignores duplicated AR records
  - BUG/MEDIUM: mux_h2: Add missing braces in h2_snd_buf()around trace+wakeup
  - BUILD: hpack: hpack-tbl-t.h uses VAR_ARRAY but does not include compiler.h
  - MINOR: atomic: don't use ; to separate instruction on aarch64.
  - BUG/MINOR: sink: Return an allocation failure in __sink_new if strdup() fails
  - BUG/MINOR: cfgparse: Fail if the strdup() for `rule->be.name` for
    `use_backend` fails
  - BUG/MINOR: tcpcheck: Report a L7OK if the last evaluated rule is a send rule
  - SCRIPTS: improve announce-release to support different tag and versions
  - SCRIPTS: make announce release support preparing announces before tag exists
  - BUG/MINOR: srv: do not init address if backend is disabled
  - BUG/MINOR: srv: do not cleanup idle conns if pool max is null
  - MINOR: converter: adding support for url_enc
  - BUILD: Makefile: exclude broken tests by default
  - CLEANUP: cfgparse: replace "realloc" with "my_realloc2" to fix to memory
    leak on error
  - MINOR: contrib/prometheus-exporter: export build_info
  - DOC: fix some spelling issues over multiple files
  - SCRIPTS: announce-release: fix typo in help message
  - DOC: Add maintainers for the Prometheus exporter
  - BUG/MINOR: sample: fix concat() converter's corruption with non-string
    variables


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.9-0
changelog:
  - BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable
  - MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities
  - MINOR: server: Forbid server definitions in frontend sections
  - BUG/MINOR: threads: Fixes the number of possible cpus report for Mac.
  - MINOR: peers: Add traces for peer control messages.
  - BUG/MINOR: dns: SRV records ignores duplicated AR records (v2)
  - BUILD: peers: fix build warning about unused variable
  - BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  - BUG/MINOR: peers: Possible appctx pointer dereference.
  - MINOR: build: discard echoing in help target
  - BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  - BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd"
    helper
  - BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  - BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  - BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  - DOC: Improve documentation of the various hdr() fetches
  - BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  - BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  - BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file()
  - MINOR: contrib: Make the wireshark peers dissector compile for more distribs.
  - CLEANUP: tools: make resolve_sym_name() take a const pointer
  - CLEANUP: cli: make "show fd" use a const connection to access other fields
  - MINOR: cli: make "show fd" also report the xprt and xprt_ctx
  - MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps.
  - MINOR: ssl: provide a "show fd" helper to report important SSL information
  - MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them
  - MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber when
    known
  - MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber when
    known
  - MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber
    when known
  - MINOR: cli: give the show_fd helpers the ability to report a suspicious entry
  - MINOR: cli/show_fd: report some easily detectable suspicious states
  - MINOR: ssl/show_fd: report some FDs as suspicious when possible
  - MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls
  - MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls
  - MINOR: h1: Raise the chunk size limit up to (2^52 - 1)
  - DOC: management: fix "show resolvers" alphabetical ordering
  - BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  - BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store
  - BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  - BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  - BUILD: Makefile: move REGTESTST_TYPE default setting
  - BUG/MEDIUM: mux-h2: handle remaining read0 cases
  - BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  - MINOR: cli/show_fd: report local and report ports when known
  - MINOR: config: Deprecate and ignore tune.chksize global option
  - BUG/MAJOR: connection: reset conn->owner when detaching from session list
  - BUG/MEDIUM: lists: Lock the element while we check if it is in a list.
  - MINOR: task: remove __tasklet_remove_from_tasklet_list()
  - BUG/MEDIUM: task: close a possible data race condition on a tasklet's list
    link
  - DOC: fix "smp_size" vs "sample_size" in "log" directive arguments
  - BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.10-0
changelog:
  - MINOR: check: do not ignore a connection header for http-check send
  - BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro
  - BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro
  - BUILD: ssl: guard SSL_CTX_set_msg_callback with
    SSL_CTRL_SET_MSG_CALLBACK macro
  - BUG/MINOR: intops: fix mul32hi()'s off-by-one
  - BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors
  - BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  - BUG/MINOR: server: re-align state file fields number
  - BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  - BUG/MINOR: backend: hold correctly lock when killing idle conn
  - BUG/MINOR: server: Fix server-state-file-name directive
  - CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  - BUG/MEDIUM: config: don't pick unset values from last defaults section
  - BUG/MINOR: stats: revert the change on ST_CONVDONE
  - BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  - BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  - DOC: tune: explain the origin of block size for ssl.cachesize
  - CLEANUP: channel: fix comment in ci_putblk.
  - BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  - BUG/MINOR: session: atomically increment the tracked sessions counter
  - BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  - BUG/MINOR: sample: Always consider zero size string samples as unsafe
  - BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions
  - DOC: explain the relation between pool-low-conn and tune.idle-pool.shared
  - BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer
  - BUG/MINOR: http-rules: Always replace the response status on a return action
  - BUG/MINOR: server: Init params before parsing a new server-state line
  - BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  - BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  - BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert"
  - MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes
  - BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  - BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  - BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  - BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  - BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  - BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl()
  - BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned
  - BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record
  - BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  - BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  - BUG/MEDIUM: resolvers: Reset address for unresolved servers
  - BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
  - CLEANUP: muxes: Remove useless if condition in show_fd function
  - BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  - BUG/MINOR: http-ana: Only consider dst address to process originalto option
  - BUG/MINOR: tcp-act: Don't forget to set the original port for
    IPv4 set-dst rule
  - BUG/MINOR: connection: Use the client's dst family for adressless servers
  - BUG/MEDIUM: spoe: Kill applets if there are pending connections
    and nbthread > 1
  - DOC: spoe: Add a note about fragmentation support in HAProxy
  - BUG/MINOR: mux-h2: Fix typo in scheme adjustment
  - BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout
  - BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust()


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.11-0
changelog:
  - BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ().
  - BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  - BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  - BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  - BUG/MEDIUM: stick-tables: fix ref counter in table entry using
    multiple http tracksc.
  - BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  - BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check
  - BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  - BUG/MINOR: session: Add some forgotten tests on session's listener
  - BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check
  - CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  - Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with
    an additional record"
  - BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  - BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  - BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  - BUG/MEDIUM: resolvers: Don't set an address-less server as UP
  - BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item
  - MINOR: resolvers: new function find_srvrq_answer_record()
  - BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item
  - BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete
  - MINOR: resolvers: Use a function to remove answers attached to a resolution
  - MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  - MINOR: resolvers: Add function to change the srv status based on
    SRV resolution
  - MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  - BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks
  - BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set
  - MINOR: resolvers: Use milliseconds for cached items in resolver responses
  - MINOR: resolvers: Don't try to match immediatly renewed ADD items
  - BUG/MINOR: resolvers: Add missing case-insensitive comparisons
    of DNS hostnames
  - MINOR: time: export the global_now variable
  - BUG/MINOR: freq_ctr/threads: make use of the last updated global time


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.12-0
changelog:
  - MINOR: time: also provide a global, monotonic global_now_ms timer
  - BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  - MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master
    CLI socket
  - MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua
  - BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable
  - BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
  - BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro
  - MINOR: lua: Slightly improve function dumping the lua traceback
  - BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  - BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  - MINOR: fd: make fd_clr_running() return the remaining running mask
  - MINOR: fd: remove the unneeded running bit from fd_insert()
  - BUG/MEDIUM: fd: do not wait on FD removal in fd_delete()
  - CLEANUP: fd: remove unused fd_set_running_excl()
  - BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available.
  - BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  - MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  - BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  - BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent
  - BUG/MINOR: payload: Wait for more data if buffer is empty
    in payload/payload_lv
  - BUG/MINOR: stats: Apply proper styles in HTML status page.
  - BUG/MEDIUM: time: make sure to always initialize the global tick
  - BUG/MINOR: tcp: fix silent-drop workaround for IPv6
  - BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  - BUG/MINOR: ssl: Fix update of default certificate
  - BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is
    a default one
  - BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  - BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free
  - REGTESTS: ssl: add missing file simple.crt-list from previous SSL fix


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.13-0
changelog:
  - BUG/MEDIUM: ssl: ckch_inst->ctx not assigned with multi-bundle certificates
  - REGTESTS: ssl: "set ssl cert" and multi-certificates bundle


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.14-0
changelog:
  - DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  - REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken
  - CONTRIB: halog: fix issue with array of type char
  - BUG/MINOR: tools: fix parsing "us" unit for timers
  - DOC: clarify that compression works for HTTP/2
  - MINOR: No longer rely on deprecated sample fetches for predefined ACLs
  - BUG/MEDIUM: sample: Fix adjusting size in field converter
  - DOC: ssl: Certificate hot update only works on fronted certificates
  - BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  - BUG/MINOR: checks: Set missing id to the dummy checks frontend
  - MINOR: logs: Add support of checks as session origin to format lf strings
  - BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections
  - MINOR: connection: Make bc_http_major compatible with tcp-checks
  - BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check
  - BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  - BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  - BUG/MINOR: logs: Report the true number of retries if there was no connection
  - BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  - BUG/MINOR: server: free srv.lb_nodes in free_server
  - BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  - BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  - BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  - BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  - BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  - BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  - BUG/MINOR: peers: remove useless table check if initial resync is finished
  - BUG/MEDIUM: peers: re-work connection to new process during reload.
  - BUG/MEDIUM: peers: re-work refcnt on table to protect against flush
  - BUG/MINOR: mux-fcgi: Don't send normalized uri to FCGI application
  - BUG/MINOR: htx: Preserve HTX flags when draining data from an HTX message
  - BUG/MINOR: applet: Notify the other side if data were consumed by an applet
  - BUG/MEDIUM: peers: initialize resync timer to get an initial full resync
  - BUG/MEDIUM: peers: register last acked value as origin receiving a resync req
  - BUG/MEDIUM: peers: stop considering ack messages teaching a full resync
  - BUG/MEDIUM: peers: reset starting point if peers appears longly disconnected
  - BUG/MEDIUM: peers: reset commitupdate value in new conns
  - BUG/MEDIUM: peers: re-work updates lookup during the sync on the fly
  - BUG/MEDIUM: peers: reset tables stage flags stages on new conns
  - MINOR: peers: add informative flags about resync process for debugging


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.15-0
changelog:
  - REGTESTS: add minimal CLI "add map" tests
  - BUG/MINOR: hlua: Don't rely on top of the stack when using Lua buffers
  - BUG/MEDIUM: cli: prevent memory leak on write errors
  - BUG/MINOR: ssl/cli: fix a lock leak when no memory available
  - MINOR: pools/debug: slightly relax DEBUG_DONT_SHARE_POOLS
  - BUG/MEDIUM: dns: reset file descriptor if send returns an error
  - BUG/MINOR: stream: Decrement server current session counter on L7 retry
  - BUG/MINOR: stream: properly clear the previous error mask on L7 retries
  - BUG/MINOR: stream: Reset stream final state and si error type on L7 retry
  - BUG/MINOR: checks: Handle synchronous connect when a tcpcheck is started
  - BUG/MINOR: checks: Reschedule check on observe mode only if fastinter is set
  - BUG/MINOR: http_fetch: fix possible uninit sockaddr in fetch_url_ip/port
  - MINOR: channel: Rely on HTX version if appropriate in channel_may_recv()
  - BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive
  - MINOR: conn-stream: Force mux to wait for read events if abortonclose is set
  - MEDIUM: mux-h1: Don't block reads when waiting for the other side
  - BUG/MEDIUM: mux-h1: Properly report client close if abortonclose option is set
  - REGTESTS: Add script to test abortonclose option
  - BUG/MEDIUM: ebtree: Invalid read when looking for dup entry
  - BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  - BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  - BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  - BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  - BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  - BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  - BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  - BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  - BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  - BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  - BUG/MINOR: http: Missing calloc return value check while parsing
    tcp-request/tcp-response
  - BUG/MINOR: http: Missing calloc return value check while parsing
    tcp-request rule
  - BUG/MINOR: compression: Missing calloc return value check in
    comp_append_type/algo
  - BUG/MINOR: worker: Missing calloc return value check in
    mworker_env_to_proc_list
  - BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  - BUG/MINOR: http: Missing calloc return value check in make_arg_list
  - BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  - BUG/MINOR: lua/vars: prevent get_var() from allocating a new name
  - DOC/MINOR: move uuid in the configuration to the right alphabetical order
  - BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  - DOC: use the req.ssl_sni in examples
  - BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  - BUG/MEDIUM: compression: Add a flag to know the filter is still processing
    data
  - MINOR: hlua: Add error message relative to the Channel manipulation and
    HTTP mode
  - BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  - BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  - DOC: lua: Add a warning about buffers modification in HTTP
  - BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  - BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  - BUG/MINOR: ssl: use atomic ops to update global shctx stats
  - BUG/MINOR: mworker: fix typo in chroot error message
  - BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue
  - MINOR: mux-h2: obey http-ignore-probes during the preface
  - BUG/MEDIUM: dns: send messages on closed/reused fd if fd was detected broken
  - BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  - REGTESTS: fix maxconn update with agent-check
  - MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  - DOC: config: Add missing actions in "tcp-request session" documentation
  - BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  - BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  - BUG/MINOR: resolvers: answser item list was randomly purged or errors
  - MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  - MEDIUM: resolvers: add a ref between servers and srv request or used SRV
    record
  - BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  - BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  - BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  - BUG/MEDIUM: sock: make sure to never miss early connection failures
  - BUG/MINOR: cli: fix server name output in "show fd"
  - BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  - DOC: stick-table: add missing documentation about gpt0 stored type
  - DOC: peers: fix the protocol tag name in the doc
  - DOC: config: use CREATE USER for mysql-check
  - BUG/MINOR: resolvers: Always attach server on matching record on resolution
  - BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  - MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  - BUG/MEDIUM: resolvers: Make 1st server of a template take part to
    SRV resolution
  - BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  - Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request
    content" rules"
  - BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  - MINOR: pools: do not maintain the lock during pool_flush()
  - MEDIUM: pools: use a single pool_gc() function for locked and lockless
  - BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  - CLEANUP: pools: remove now unused seq and pool_free_list
  - BUG/MAJOR: pools: fix incomplete backport of lockless pool fix
  - BUG/MAJOR: pools: second fix for incomplete backport of lockless pool fix
  - BUG/MINOR: server-state: load SRV resolution only if params match the config
  - BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  - MINOR: resolvers: Clean server in a dedicated function when removing
    a SRV item
  - MINOR: resolvers: Remove server from named_servers tree when removing
    a SRV item
  - BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  - BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.16-0
changelog:
  - BUILD: add detection of missing important CFLAGS
  - BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  - BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  - BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  - BUG/MINOR: check: fix the condition to validate a port-less server
  - BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  - BUG/MINOR: systemd: must check the configuration using -Ws
  - BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  - BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  - BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  - BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  - BUG/MINOR: select: fix excess number of dead/skip reported
  - BUG/MINOR: poll: fix abnormally high skip_fd counter
  - BUG/MINOR: pollers: always program an update for migrated FDs
  - BUG/MINOR: server: update last_change on maint->ready transitions too
  - MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  - BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one
    is released
  - BUG/MINOR: buffer: fix buffer_dump() formatting
  - BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  - DOC: Improve the lua documentation
  - DOC: config: Fix 'http-response send-spoe-group' documentation
  - BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  - DOC/MINOR: fix typo in management document
  - MINOR: http: add a new function http_validate_scheme() to validate a scheme
  - BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  - BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  - BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  - BUG/MEDIUM: h2: give :authority precedence over Host
  - REGTESTS: add a test to prevent h2 desync attacks


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.17-0
changelog:
  - BUG/MEDIUM: h2: match absolute-path not path-absolute for :path
  - BUG/MEDIUM: sock: really fix detection of early connection failures in for 2.3
  - REGTESTS: abortonclose: after retries, 503 is expected, not close
  - BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  - BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  - MINOR: compiler: implement an ONLY_ONCE() macro
  - BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  - BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  - BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  - BUG/MINOR: tools: Fix loop condition in dump_text()
  - CLEANUP: Add missing include guard to signal.h
  - DOC: configuration: remove wrong tcp-request examples in tcp-response
  - BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB
  - CLEANUP: htx: remove comments about "must be < 256 MB"
  - BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  - Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn
    may receive"
  - MINOR: action: Use a generic function to check validity of an action rule list
  - REGTESTS: mark http_abortonclose as broken


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.30-0
changelog:
  - DOC/MINOR: reformat configuration.txt's "quoting and escaping" table
  - BUG/MINOR: mworker: stop doing strtok directly from the env
  - BUG/MEDIUM: mworker: don't register mworker_accept_wrapper() when master FD
    is wrong
  - BUG/MINOR: mworker: prevent incorrect values in uptime
  - BUG/MINOR: ring: do not realign ring contents on resize
  - DOC: config: Fix description of options about HTTP connection modes
  - DOC: config: Add the missing tune.fail-alloc option from global listing
  - DOC: config: Clarify the meaning of 'hold' in the 'resolvers' section
  - BUG/MINOR: http-check: Don't set HTX_SL_F_BODYLESS flag with a log-format body
  - BUG/MINOR: http-check: Skip C-L header for empty body when it's not mandatory
  - BUG/MINOR: ssl: Use 'date' instead of 'now' in ocsp stapling callback
  - BUG/MINOR: mux-h2: make sure the h2c task exists before refreshing it
  - BUG/MEDIUM: spoe: Don't set the default traget for the SPOE agent frontend
  - BUG/MEDIUM: mux-h2: erase h2c->wait_event.tasklet on error path
  - BUG/MEDIUM: mux-h1: Wakeup H1C on shutw if there is no I/O subscription
  - BUILD: da: extends CFLAGS to support API v3 from 3.1.7 and onwards.
  - MINOR: proxy/pool: prevent unnecessary calls to pool_gc()
  - DOC: config: strict-sni allows to start without certificate
  - BUG/MINOR: stick_table: alert when type len has incorrect characters
  - CI: bump "actions/checkout" to v3 for cross zoo matrix
  - BUG/MINOR: cfgparse: make sure to include openssl-compat
  - BUG/MEDIUM: proxy/sktable: prevent watchdog trigger on soft-stop
  - BUG/MEDIUM: Update read expiration date on synchronous send
  - BUG/MINOR: mux-h2: make sure to produce a log on invalid requests
  - MINOR: checks: make sure spread-checks is used also at boot time
  - MINOR: clock: measure the total boot time
  - BUG/MINOR: checks: postpone the startup of health checks by the boot time
  - BUILD: checks: fix build failure on macos after last fix
  - BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input
  - BUG/MINOR: tcp-rules: Don't shortened the inspect-delay when EOI is set
  - DOC: config: Clarify conditions to shorten the inspect-delay for TCP rules
  - DOC/MINOR: config: Fix typo in description for `ssl_bc` in configuration.txt
  - BUG/MINOR: hlua: unsafe hlua_lua2smp() usage
  - SCRIPTS: publish-release: update the umask to keep group write access
  - BUG/MINOR: log: fix memory error handling in parse_logsrv()
  - BUG/MINOR: proxy: missing free in free_proxy for redirect rules
  - MINOR: spoe: Don't stop disabled proxies
  - BUG/MEDIUM: filters: Don't deinit filters for disabled proxies during startup
  - BUG/MINOR: debug: do not emit empty lines in thread dumps
  - BUG/MEDIUM: spoe: Don't start new applet if there are enough idle ones
  - CI: switch to Fastly CDN to download LibreSSL
  - BUILD: ssl: switch LibreSSL to Fastly CDN
  - BUG/MINOR: server: incorrect report for tracking servers leaving drain
  - MINOR: server: explicitly commit state change in srv_update_status()
  - BUG/MINOR: server: don't miss proxy stats update on server state transitions
  - BUG/MINOR: server: don't miss server stats update on server state transitions
  - BUG/MINOR: server: don't use date when restoring last_change from state file
  - CI: cirrus-ci: bump FreeBSD image to 13-1
  - DOC: config: Fix bind/server/peer documentation in the peers section
  - CONTRIB: Add vi file extensions to .gitignore
  - BUG/MINOR: spoe: Only skip sending new frame after a receive attempt
  - BUG/MINOR: cfgparse-tcp: leak when re-declaring interface from bind line
  - BUG/MINOR: proxy: add missing interface bind free in free_proxy


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.31-0
changelog:
  - BUG/MINOR: server: inherit from netns in srv_settings_cpy()
  - BUG/MINOR: namespace: missing free in netns_sig_stop()
  - BUG/MEDIUM: mworker: increase maxsock with each new worker
  - DOC: Add tune.h2.max-frame-size option to table of contents
  - BUG/MINOR: ring: maxlen warning reported as alert
  - BUG/MINOR: sample: Fix wrong overflow detection in add/sub conveters
  - BUG/MINOR: http: Return the right reason for 302
  - CI: explicitely highlight VTest result section if there's something
  - BUG/MINOR: h1-htx: Return the right reason for 302 FCGI responses
  - DOC: configuration: describe Td in Timing events
  - BUG/MINOR: chunk: fix chunk_appendf() to not write a zero if buffer is full
  - BUG/MAJOR: http-ana: Get a fresh trash buffer for each header value
    replacement
  - BUG/MAJOR: http: reject any empty content-length header value
  - MINOR: ist: add new function ist_find_range() to find a character range
  - MINOR: ist: Add istend() function to return a pointer to the end of the string
  - MINOR: http: add new function http_path_has_forbidden_char()
  - MINOR: h2: pass accept-invalid-http-request down the request parser
  - BUG/MINOR: h1: do not accept '#' as part of the URI component
  - BUG/MINOR: h2: reject more chars from the :path pseudo header
  - REGTESTS: http-rules: verify that we block '#' by default for normalize-uri
  - DOC: clarify the handling of URL fragments in requests
  - BUG/MINOR: http: skip leading zeroes in content-length values


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.32-0
changelog:
  - BUG/MINOR: stktable: allow sc-set-gpt(0) from tcp-request connection
  - SCRIPTS: git-show-backports: automatic ref and base detection with -m
  - DOC: lua: fix core.register_action typo
  - BUG/MEDIUM: stconn: Wake applets on sending path if there is a pending
    shutdown
  - BUG/MEDIUM: stconn/stream: Forward shutdown on write timeout
  - BUG/MINOR: hlua/action: incorrect message on E_YIELD error
  - CI: Update to actions/checkout@v4
  - BUG/MEDIUM: hlua: don't pass stale nargs argument to lua_resume()
  - MINOR: buf: Add b_force_xfer() function
  - BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records
  - BUG/MINOR: freq_ctr: fix possible negative rate with the scaled API
  - BUG/MAJOR: mux-h2: Report a protocol error for any DATA frame before headers
  - MINOR: pattern: fix pat_{parse,match}_ip() function comments
  - BUG/MINOR: hlua: fix invalid use of lua_pop on error paths
  - BUG/MINOR: hlua_fcn: potentially unsafe stktable_data_ptr usage
  - BUILD: ssl: buggy -Werror=dangling-pointer since gcc 13.0
  - BUG/MEDIUM: actions: always apply a longest match on prefix lookup
  - BUG/MEDIUM: mux-h2: Don't report an error on shutr if a shutw is pending
  - BUG/MEDIUM: peers: Be sure to always refresh recconnect timer in sync task
  - BUG/MINOR: mux-h2: commit the current stream ID even on reject
  - BUG/MINOR: ssl: suboptimal certificate selection with TLSv1.3 and dual
    ECDSA/RSA
  - BUG/MEDIUM: ssl: segfault when cipher is NULL
  - BUG/MINOR: tcpcheck: Report hexstring instead of binary one on check failure
  - BUG/MINOR: stktable: missing free in parse_stick_table()
  - BUG/MINOR: cfgparse/stktable: fix error message on stktable_init() failure
  - BUG/MINOR: stick-table/cli: Check for invalid ipv4 key
  - DOC: management: -q is quiet all the time
  - DOC: config: use the word 'backend' instead of 'proxy' in 'track' description
  - BUG/MINOR: stconn: Handle abortonclose if backend connection was already
    set up
  - MINOR: connection: Add a CTL flag to notify mux it should wait for reads again
  - MEDIUM: mux-h1: Handle MUX_SUBS_RECV flag in h1_ctl() and susbscribe for reads
  - BUG/MEDIUM: stream: Properly handle abortonclose when set on backend only
  - REGTESTS: http: Improve script testing abortonclose option
  - BUG/MEDIUM: stream: Don't call mux .ctl() callback if not implemented
  - MINOR: htx: Use a macro for overhead induced by HTX
  - MINOR: channel: Add functions to get info on buffers and deal with HTX streams
  - BUG/MINOR: stconn: Fix streamer detection for HTX streams
  - BUG/MINOR: stconn: Use HTX-aware channel's functions to get info on buffer
  - BUG/MEDIUM: mux-h2: fail earlier on malloc in takeover()
  - BUG/MEDIUM: mux-h1: fail earlier on malloc in takeover()
  - BUG/MEDIUM: mux-fcgi: fail earlier on malloc in takeover()
  - REGTESTS: http: add a test to validate chunked responses delivery
  - DOC: 51d: updated 51Degrees repo URL for v3.2.10
  - DOC: config: specify supported sections for "max-session-srv-conns"
  - DOC: config: add matrix entry for "max-session-srv-conns"
  - REGTESTS: sample: Test the behavior of consecutive delimiters for the field
    converter
  - BUG/MINOR: sample: Make the `word` converter compatible with `-m found`
  - DOC: Clarify the differences between field() and word()
  - BUG/MINOR: startup: set GTUNE_SOCKET_TRANSFER correctly
  - BUILD: ssl: work around bogus warning in gcc 12's -Wformat-truncation
  - BUG/MEDIUM: ssl: fix the gcc-12 broken fix :-(


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.33-0
changelog:
  - DOC: configuration: typo req.ssl_hello_type
  - BUG/MEDIUM: mux-h2: Report too large HEADERS frame only when rxbuf is empty
  - BUG/MEDIUM: stconn: Forward shutdown on write timeout only if it
    is forwardable
  - BUG/MEDIUM: spoe: Never create new spoe applet if there is no server up
  - BUG/MEDIUM: cli: some err/warn msg dumps add LR into CSV output on stat's CLI
  - BUG/MEDIUM: pool: fix rare risk of deadlock in pool_flush()
  - BUG/MINOR: h1-htx: properly initialize the err_pos field
  - BUG/MEDIUM: h1: always reject the NUL character in header values
  - BUG/MAJOR: ssl_sock: Always clear retry flags in read/write functions
  - DOC: internal: update missing data types in peers-v2.0.txt
  - CI: Update to actions/cache@v4
  - BUG/MINOR: hlua: Fix log level to the right value when set via
    TXN:set_loglevel
  - BUG/MINOR: cfgparse: report proper location for log-format-sd errors
  - BUG/MINOR: ssl: fix possible ctx memory leak in sample_conv_aes_gcm()
  - BUG/MEDIUM: spoe: Return an invalid frame on recv if size is too small
  - BUG/MINOR: session: ensure conn owner is set after insert into session
  - BUG/MINOR: server: 'source' interface ignored from 'default-server' directive
  - BUG/MINOR: backend: properly handle redispatch 0
  - CLEANUP: pools: remove unused arguments to pool_evict_from_cache()
  - BUG/MEDIUM: spoe: Don't rely on stream's expiration to detect processing
    timeout


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.11-0
changelog:
  - BUG/MINOR: mux-fcgi: Don't send normalized uri to FCGI application
  - BUG/MINOR: htx: Preserve HTX flags when draining data from an HTX message
  - BUG/MINOR: applet: Notify the other side if data were consumed by an applet
  - BUG/MEDIUM: peers: initialize resync timer to get an initial full resync
  - BUG/MEDIUM: peers: register last acked value as origin receiving a resync req
  - BUG/MEDIUM: peers: stop considering ack messages teaching a full resync
  - BUG/MEDIUM: peers: reset starting point if peers appears longly disconnected
  - BUG/MEDIUM: peers: reset commitupdate value in new conns
  - BUG/MEDIUM: peers: re-work updates lookup during the sync on the fly
  - BUG/MEDIUM: peers: reset tables stage flags stages on new conns
  - MINOR: peers: add informative flags about resync process for debugging
  - REGTESTS: add minimal CLI "add map" tests
  - BUG/MINOR: hlua: Don't rely on top of the stack when using Lua buffers
  - BUG/MEDIUM: cli: prevent memory leak on write errors
  - BUG/MINOR: ssl/cli: fix a lock leak when no memory available
  - MINOR: compat: automatically include malloc.h on glibc
  - MEDIUM: pools: call malloc_trim() from pool_gc()
  - MINOR: pools/debug: slightly relax DEBUG_DONT_SHARE_POOLS
  - MINOR: debug: add a new "debug dev sym" command in expert mode
  - BUG/MEDIUM: dns: reset file descriptor if send returns an error
  - BUG/MINOR: stream: Decrement server current session counter on L7 retry
  - BUG/MINOR: stream: properly clear the previous error mask on L7 retries
  - BUG/MINOR: stream: Reset stream final state and si error type on L7 retry
  - BUG/MINOR: checks: Handle synchronous connect when a tcpcheck is started
  - BUG/MINOR: checks: Reschedule check on observe mode only if fastinter is set
  - BUG/MINOR: http_fetch: fix possible uninit sockaddr in fetch_url_ip/port
  - MINOR: channel: Rely on HTX version if appropriate in channel_may_recv()
  - BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive
  - MINOR: conn-stream: Force mux to wait for read events if abortonclose is set
  - MEDIUM: mux-h1: Don't block reads when waiting for the other side
  - BUG/MEDIUM: mux-h1: Properly report client close if abortonclose option is set
  - REGTESTS: Add script to test abortonclose option
  - BUG/MEDIUM: ebtree: Invalid read when looking for dup entry
  - BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  - BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  - BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  - BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  - BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  - BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  - BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  - BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  - BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  - BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  - BUG/MINOR: http: Missing calloc return value check while parsing
    tcp-request/tcp-response
  - BUG/MINOR: http: Missing calloc return value check while parsing
    tcp-request rule
  - BUG/MINOR: compression: Missing calloc return value check
    in comp_append_type/algo
  - BUG/MINOR: worker: Missing calloc return value check
    in mworker_env_to_proc_list
  - BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  - BUG/MINOR: http: Missing calloc return value check in make_arg_list
  - BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  - BUG/MINOR: lua/vars: prevent get_var() from allocating a new name
  - DOC/MINOR: move uuid in the configuration to the right alphabetical order
  - BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  - DOC: use the req.ssl_sni in examples
  - BUILD: make tune.ssl.keylog available again
  - BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  - BUG/MEDIUM: compression: Add a flag to know the filter is still
    processing data
  - BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  - MINOR: pools: do not maintain the lock during pool_flush()
  - MINOR: pools: call malloc_trim() under thread isolation
  - MEDIUM: pools: use a single pool_gc() function for locked and lockless
  - BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  - CLEANUP: pools: remove now unused seq and pool_free_list
  - BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  - BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  - DOC: lua: Add a warning about buffers modification in HTTP
  - BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  - BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  - BUG/MINOR: ssl: use atomic ops to update global shctx stats
  - BUG/MINOR: mworker: fix typo in chroot error message
  - BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue
  - MINOR: backend: only skip LB when there are actual connections
  - BUG/MINOR: stats: make "show stat typed desc" work again
  - MINOR: mux-h2: obey http-ignore-probes during the preface
  - BUG/MEDIUM: dns: send messages on closed/reused fd if fd was detected broken
  - BUILD: cfgparse-ssl: Remove const from defpx param in keylog parsing function
  - BUG/MINOR: resolvers: answser item list was randomly purged or errors
  - MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  - MEDIUM: resolvers: add a ref between servers and srv request or used
    SRV record
  - BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  - BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  - BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  - BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  - REGTESTS: fix maxconn update with agent-check
  - MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  - DOC: config: Add missing actions in "tcp-request session" documentation
  - BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  - BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  - BUG/MEDIUM: sock: make sure to never miss early connection failures
  - BUG/MINOR: cli: fix server name output in "show fd"
  - BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  - DOC: stick-table: add missing documentation about gpt0 stored type
  - DOC: peers: fix the protocol tag name in the doc
  - DOC: config: use CREATE USER for mysql-check
  - BUG/MINOR: server-state: load SRV resolution only if params match the config
  - BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  - MINOR: resolvers: Clean server in a dedicated function when removing
    a SRV item
  - MINOR: resolvers: Remove server from named_servers tree when removing
    a SRV item
  - BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  - BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()
  - BUG/MINOR: resolvers: Always attach server on matching record on resolution
  - BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  - MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  - BUG/MEDIUM: resolvers: Make 1st server of a template take part to
    SRV resolution
  - BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  - Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request
    content" rules"


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.12-0
changelog:
  - BUG/MAJOR: pools: fix incomplete backport of lockless pool fix
  - BUG/MAJOR: pools: second fix for incomplete backport of lockless pool fix


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.13-0
changelog:
  - BUILD: add detection of missing important CFLAGS
  - BUILD: lua: silence a build warning with TCC
  - BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  - BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  - BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  - BUG/MINOR: check: fix the condition to validate a port-less server
  - BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  - BUG/MINOR: systemd: must check the configuration using -Ws
  - BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  - BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  - BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  - BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  - BUG/MINOR: select: fix excess number of dead/skip reported
  - BUG/MINOR: poll: fix abnormally high skip_fd counter
  - BUG/MINOR: pollers: always program an update for migrated FDs
  - BUG/MINOR: server: update last_change on maint->ready transitions too
  - MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  - BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one
    is released
  - BUG/MINOR: buffer: fix buffer_dump() formatting
  - BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  - DOC: Improve the lua documentation
  - DOC: config: Fix 'http-response send-spoe-group' documentation
  - BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  - BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during
    config check
  - DOC/MINOR: fix typo in management document
  - MINOR: http: add a new function http_validate_scheme() to validate a scheme
  - BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  - BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  - BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  - BUG/MEDIUM: h2: give :authority precedence over Host
  - REGTESTS: add a test to prevent h2 desync attacks


author: Anton Novojilov <andy@essentialkaos.com> - 2.3.14-0
changelog:
  - BUG/MEDIUM: h2: match absolute-path not path-absolute for :path
  - BUG/MEDIUM: sock: really fix detection of early connection failures in for 2.3
  - REGTESTS: abortonclose: after retries, 503 is expected, not close
  - BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  - BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  - MINOR: compiler: implement an ONLY_ONCE() macro
  - BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  - BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  - BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  - BUG/MINOR: tools: Fix loop condition in dump_text()
  - CLEANUP: Add missing include guard to signal.h
  - BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser
  - DOC: configuration: remove wrong tcp-request examples in tcp-response
  - BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB
  - CLEANUP: htx: remove comments about "must be < 256 MB"
  - BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  - Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn
    may receive"
  - MINOR: action: Use a generic function to check validity of an action rule list
  - REGTESTS: mark http_abortonclose as broken


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.23-0
changelog:
  - DEV: hpack: fix `trash` build regression
  - BUG/MINOR: ssl: ssl-(min|max)-ver parameter not duplicated for bundles in
    crt-list
  - BUG/MINOR: mworker: stop doing strtok directly from the env
  - BUG/MEDIUM: mworker: don't register mworker_accept_wrapper() when master FD
    is wrong
  - MINOR: startup: HAPROXY_STARTUP_VERSION contains the version used to start
  - BUG/MINOR: sched: properly report long_rq when tasks remain in the queue
  - BUG/MEDIUM: sched: allow a bit more TASK_HEAVY to be processed when needed
  - BUG/MINOR: mworker: prevent incorrect values in uptime
  - BUG/MINOR: cache: Cache response even if request has "no-cache" directive
  - BUG/MINOR: cache: Check cache entry is complete in case of Vary
  - BUG/MINOR: ring: do not realign ring contents on resize
  - DOC: config: Fix description of options about HTTP connection modes
  - DOC: config: Add the missing tune.fail-alloc option from global listing
  - DOC: config: Clarify the meaning of 'hold' in the 'resolvers' section
  - BUG/MINOR: http-check: Don't set HTX_SL_F_BODYLESS flag with a log-format body
  - BUG/MINOR: http-check: Skip C-L header for empty body when it's not mandatory
  - BUG/MINOR: http-ana: Do a L7 retry on read error if there is no response
  - BUG/MINOR: ssl: Use 'date' instead of 'now' in ocsp stapling callback
  - BUG/MINOR: init: properly detect NUMA bindings on large systems
  - BUG/MINOR: init: make sure to always limit the total number of threads
  - DOC/CLEANUP: fix typos
  - BUG/MINOR: mux-h2: make sure the h2c task exists before refreshing it
  - BUG/MEDIUM: listener: duplicate inherited FDs if needed
  - BUG/MEDIUM: spoe: Don't set the default traget for the SPOE agent frontend
  - BUG/MINOR: proto_ux: report correct error when bind_listener fails
  - BUG/MINOR: protocol: fix minor memory leak in protocol_bind_all()
  - BUG/MINOR: sock_unix: match finalname with tempname in sock_unix_addrcmp()
  - BUG/MEDIUM: connection: Clear flags when a conn is removed from an idle list
  - BUG/MEDIUM: connection: Preserve flags when a conn is removed from an idle
    list
  - BUG/MEDIUM: mux-h2: erase h2c->wait_event.tasklet on error path
  - BUG/MEDIUM: mux-h1: Wakeup H1C on shutw if there is no I/O subscription
  - BUILD: da: extends CFLAGS to support API v3 from 3.1.7 and onwards.
  - MINOR: proxy/pool: prevent unnecessary calls to pool_gc()
  - DOC: config: strict-sni allows to start without certificate
  - BUG/MEDIUM: channel: Improve reports for shut in co_getblk()
  - BUG/MEDIUM: dns: Properly handle error when a response consumed
  - MINOR: proxy: check if p is NULL in free_proxy()
  - BUG/MINOR: sink: free forward_px on deinit()
  - BUG/MINOR: log: free log forward proxies on deinit()
  - BUG/MINOR: hlua: enforce proper running context for register_x functions
  - CLEANUP: hlua: fix conflicting comment in hlua_ctx_destroy()
  - BUG/MEDIUM: resolvers: Force the connect timeout for DNS resolutions
  - BUG/MINOR: stick_table: alert when type len has incorrect characters
  - CI: bump "actions/checkout" to v3 for cross zoo matrix
  - REGTESTS: fix the race conditions in log_uri.vtc
  - BUG/MEDIUM: log: Properly handle client aborts in syslog applet
  - CLEANUP: backend: Remove useless debug message in assign_server()
  - BUG/MINOR: cfgparse: make sure to include openssl-compat
  - BUG/MEDIUM: proxy/sktable: prevent watchdog trigger on soft-stop
  - BUG/MEDIUM: Update read expiration date on synchronous send
  - BUG/MINOR: mux-h2: make sure to produce a log on invalid requests
  - MINOR: checks: make sure spread-checks is used also at boot time
  - MINOR: clock: measure the total boot time
  - BUG/MINOR: checks: postpone the startup of health checks by the boot time
  - BUG/MINOR: clock: fix the boot time measurement method for 2.6 and older
  - BUG/MINOR: tcp-rules: Don't shortened the inspect-delay when EOI is set
  - DOC: config: Clarify conditions to shorten the inspect-delay for TCP rules
  - DOC: add size format section to manual
  - DOC/MINOR: config: Fix typo in description for `ssl_bc` in configuration.txt
  - BUG/MINOR: hlua: unsafe hlua_lua2smp() usage
  - SCRIPTS: publish-release: update the umask to keep group write access
  - BUG/MINOR: log: fix memory error handling in parse_logsrv()
  - BUG/MINOR: proxy: missing free in free_proxy for redirect rules
  - MINOR: spoe: Don't stop disabled proxies
  - BUILD: mjson: Fix warning about unused variables
  - BUG/MINOR: debug: do not emit empty lines in thread dumps
  - BUG/MEDIUM: spoe: Don't start new applet if there are enough idle ones
  - CI: switch to Fastly CDN to download LibreSSL
  - BUILD: ssl: switch LibreSSL to Fastly CDN
  - BUG/MINOR: server: incorrect report for tracking servers leaving drain
  - MINOR: server: explicitly commit state change in srv_update_status()
  - BUG/MINOR: server: don't miss proxy stats update on server state transitions
  - BUG/MINOR: server: don't miss server stats update on server state transitions
  - BUG/MINOR: server: don't use date when restoring last_change from state file
  - CI: cirrus-ci: bump FreeBSD image to 13-1
  - BUG/MEDIUM: filters: Don't deinit filters for disabled proxies during startup
  - MINOR: proxy: add http_free_redirect_rule() function
  - BUG/MINOR: http_rules: fix errors paths in http_parse_redirect_rule()
  - DOC: config: Fix bind/server/peer documentation in the peers section
  - CONTRIB: Add vi file extensions to .gitignore
  - BUG/MINOR: spoe: Only skip sending new frame after a receive attempt
  - BUG/MINOR: cfgparse-tcp: leak when re-declaring interface from bind line
  - BUG/MINOR: proxy: add missing interface bind free in free_proxy


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.24-0
changelog:
  - MINOR: proto_uxst: add resume method
  - CLEANUP: listener: function comment typo in stop_listener()
  - BUG/MINOR: listener: null pointer dereference suspected by coverity
  - MINOR: listener/api: add lli hint to listener functions
  - MINOR: listener: add relax_listener() function
  - MINOR: listener: workaround for closing a tiny race between resume_listener()
    and stopping
  - MINOR: listener: make sure we don't pause/resume bypassed listeners
  - BUG/MEDIUM: listener: fix pause_listener() suspend return value handling
  - BUG/MINOR: listener: fix resume_listener() resume return value handling
  - BUG/MEDIUM: resume from LI_ASSIGNED in default_resume_listener()
  - MINOR: listener: pause_listener() becomes suspend_listener()
  - BUG/MEDIUM: listener/proxy: fix listeners notify for proxy resume
  - MEDIUM: proto_ux: properly suspend named UNIX listeners
  - MINOR: proto_ux: ability to dump ABNS names in error messages
  - MINOR: lua: Add a function to get a reference on a table in the stack
  - CLEANUP: Remove unused function hlua_get_top_error_string
  - MINOR: hlua: add simple hlua reference handling API
  - BUG/MINOR: hlua: fix reference leak in core.register_task()
  - BUG/MINOR: hlua: fix reference leak in hlua_post_init_state()
  - MINOR: hlua: simplify lua locking
  - BUG/MEDIUM: hlua: prevent deadlocks with main lua lock
  - BUG/MINOR: server: inherit from netns in srv_settings_cpy()
  - BUG/MINOR: namespace: missing free in netns_sig_stop()
  - BUG/MEDIUM: mworker: increase maxsock with each new worker
  - DOC: Add tune.h2.max-frame-size option to table of contents
  - BUILD: debug: avoid a build warning related to epoll_wait() in debug code
  - BUG/MINOR: tcp_sample: bc_{dst,src} return IP not INT
  - BUG/MINOR: cache: A 'max-age=0' cache-control directive can be overriden
    by a s-maxage
  - BUG/MEDIUM: sink: invalid server list in sink_new_from_logsrv()
  - BUG/MINOR: sink: missing sft free in sink_deinit()
  - BUG/MINOR: ring: size warning incorrectly reported as fatal error
  - BUG/MINOR: ring: maxlen warning reported as alert
  - BUG/MINOR: log: LF upsets maxlen for UDP targets
  - MINOR: sink/api: pass explicit maxlen parameter to sink_write()
  - BUG/MEDIUM: log: improper use of logsrv->maxlen for buffer targets
  - BUG/MINOR: log: fix missing name error message in cfg_parse_log_forward()
  - BUG/MINOR: log: fix multiple error paths in cfg_parse_log_forward()
  - BUG/MINOR: log: free errmsg on error in cfg_parse_log_forward()
  - BUG/MINOR: sink: invalid sft free in sink_deinit()
  - BUG/MINOR: sink: fix errors handling in cfg_post_parse_ring()
  - BUG/MINOR: sink/log: properly deinit srv in sink_new_from_logsrv()
  - BUG/MINOR: config: Remove final '\n' in error messages
  - BUG/MINOR: hlua: hlua_yieldk ctx argument should support pointers
  - BUG/MINOR: sample: Fix wrong overflow detection in add/sub conveters
  - BUG/MINOR: http: Return the right reason for 302
  - CI: explicitely highlight VTest result section if there's something
  - BUG/MINOR: hlua: add check for lua_newstate
  - BUG/MINOR: h1-htx: Return the right reason for 302 FCGI responses
  - BUG/MEDIUM: listener: Acquire proxy's lock in relax_listener() if necessary
  - DOC: configuration: describe Td in Timing events
  - BUG/MINOR: chunk: fix chunk_appendf() to not write a zero if buffer is full
  - BUG/MAJOR: http-ana: Get a fresh trash buffer for each header value
    replacement
  - BUG/MAJOR: http: reject any empty content-length header value
  - MINOR: ist: add new function ist_find_range() to find a character range
  - MINOR: http: add new function http_path_has_forbidden_char()
  - MINOR: h2: pass accept-invalid-http-request down the request parser
  - REGTESTS: http-rules: add accept-invalid-http-request for normalize-uri tests
  - BUG/MINOR: h1: do not accept '#' as part of the URI component
  - BUG/MINOR: h2: reject more chars from the :path pseudo header
  - REGTESTS: http-rules: verify that we block '#' by default for normalize-uri
  - DOC: clarify the handling of URL fragments in requests
  - BUG/MINOR: http: skip leading zeroes in content-length values


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.25-0
changelog:
  - BUG/MEDIUM: dns: Be sure to unlock DSS when existing dns_session_io_handler()
  - BUG/MINOR: hlua: fix invalid use of lua_pop on error paths
  - BUG/MINOR: stktable: allow sc-set-gpt(0) from tcp-request connection
  - SCRIPTS: git-show-backports: automatic ref and base detection with -m
  - BUILD: Makefile: add the USE_QUIC option to make help
  - BUG/MINOR: hlua_fcn: potentially unsafe stktable_data_ptr usage
  - DOC: lua: fix core.register_action typo
  - BUG/MINOR: ssl_sock: fix possible memory leak on OOM
  - BUG/MEDIUM: stconn: Wake applets on sending path if there is a pending
    shutdown
  - BUG/MEDIUM: stconn/stream: Forward shutdown on write timeout
  - BUG/MINOR: hlua/action: incorrect message on E_YIELD error
  - CI: Update to actions/checkout@v4
  - MINOR: hlua: add hlua_stream_ctx_prepare helper function
  - BUG/MEDIUM: hlua: streams don't support mixing lua-load with
    lua-load-per-thread
  - BUG/MEDIUM: hlua: don't pass stale nargs argument to lua_resume()
  - BUG/MINOR: hlua/init: coroutine may not resume itself
  - MINOR: buf: Add b_force_xfer() function
  - BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records
  - BUG/MINOR: promex: fix backend_agg_check_status
  - BUG/MINOR: freq_ctr: fix possible negative rate with the scaled API
  - BUG/MAJOR: mux-h2: Report a protocol error for any DATA frame before headers
  - BUG/MINOR: server: add missing free for server->rdr_pfx
  - MINOR: pattern: fix pat_{parse,match}_ip() function comments
  - BUG/MEDIUM: listener/proxy: fix listeners notify for proxy resume (2nd try)
  - BUG/MINOR: debug: enter ha_panic() only once
  - BUILD: ssl: buggy -Werror=dangling-pointer since gcc 13.0
  - BUG/MEDIUM: actions: always apply a longest match on prefix lookup
  - BUG/MINOR: mux-h2: make up other blocked streams upon removal from list
  - BUG/MEDIUM: mux-h2: Don't report an error on shutr if a shutw is pending
  - BUG/MEDIUM: peers: Be sure to always refresh recconnect timer in sync task
  - BUG/MINOR: mux-h2: commit the current stream ID even on reject
  - BUG/MINOR: mux-h2: update tracked counters with req cnt/req err
  - BUG/MINOR: ssl: suboptimal certificate selection with TLSv1.3 and dual
    ECDSA/RSA
  - BUG/MEDIUM: ssl: segfault when cipher is NULL
  - BUG/MINOR: tcpcheck: Report hexstring instead of binary one on check failure
  - BUG/MINOR: stktable: missing free in parse_stick_table()
  - BUG/MINOR: cfgparse/stktable: fix error message on stktable_init() failure
  - CLEANUP: htx: Properly indent htx_reserve_max_data() function
  - BUG/MINOR: stick-table/cli: Check for invalid ipv4 key
  - BUG/MINOR: mux-h1: Properly handle http-request and http-keep-alive timeouts
  - DOC: management: -q is quiet all the time
  - DOC: config: use the word 'backend' instead of 'proxy' in 'track' description
  - BUG/MINOR: stconn: Handle abortonclose if backend connection was already
    set up
  - MINOR: connection: Add a CTL flag to notify mux it should wait for reads again
  - MEDIUM: mux-h1: Handle MUX_SUBS_RECV flag in h1_ctl() and susbscribe for reads
  - BUG/MEDIUM: stream: Properly handle abortonclose when set on backend only
  - REGTESTS: http: Improve script testing abortonclose option
  - BUG/MEDIUM: stream: Don't call mux .ctl() callback if not implemented
  - MINOR: htx: Use a macro for overhead induced by HTX
  - MINOR: channel: Add functions to get info on buffers and deal with HTX streams
  - BUG/MINOR: stconn: Fix streamer detection for HTX streams
  - BUG/MINOR: stconn: Use HTX-aware channel's functions to get info on buffer
  - BUG/MEDIUM: mux-h2: fail earlier on malloc in takeover()
  - BUG/MEDIUM: mux-h1: fail earlier on malloc in takeover()
  - BUG/MEDIUM: mux-fcgi: fail earlier on malloc in takeover()
  - BUG/MINOR: stream/cli: report correct stream age in "show sess"
  - MINOR: stktable: add stktable_deinit function
  - BUG/MINOR: proxy/stktable: missing frees on proxy cleanup
  - REGTESTS: http: add a test to validate chunked responses delivery
  - BUG/MINOR: server: do not leak default-server in defaults sections
  - DOC: 51d: updated 51Degrees repo URL for v3.2.10
  - REGTESTS: connection: disable http_reuse_be_transparent.vtc if !TPROXY
  - DOC: lua: add sticktable class reference from Proxy.stktable
  - DOC: lua: fix Proxy.get_mode() output
  - BUG/MINOR: config: Stopped parsing upon unmatched environment variables
  - DOC: config: specify supported sections for "max-session-srv-conns"
  - DOC: config: add matrix entry for "max-session-srv-conns"
  - REGTESTS: sample: Test the behavior of consecutive delimiters for the field
    converter
  - BUG/MINOR: sample: Make the `word` converter compatible with `-m found`
  - DOC: Clarify the differences between field() and word()
  - BUG/MINOR: cache: Remove incomplete entries from the cache when stream
    is closed
  - BUG/MEDIUM: pattern: don't trim pools under lock in pat_ref_purge_range()
  - BUG/MINOR: startup: set GTUNE_SOCKET_TRANSFER correctly


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.26-0
changelog:
  - BUG/MINOR: sock: mark abns sockets as non-suspendable and always unbind them
  - BUG/MEDIUM: connection: report connection errors even when no mux is installed
  - DOC: configuration: typo req.ssl_hello_type
  - BUG/MEDIUM: mux-h2: Report too large HEADERS frame only when rxbuf is empty
  - DOC: config: Update documentation about local haproxy response
  - BUG/MEDIUM: stconn: Forward shutdown on write timeout only if it is
    forwardable
  - BUG/MEDIUM: spoe: Never create new spoe applet if there is no server up
  - BUG/MEDIUM: cli: some err/warn msg dumps add LR into CSV output on stat's CLI
  - BUG/MINOR: vars/cli: fix missing LF after "get var" output
  - BUG/MEDIUM: pool: fix rare risk of deadlock in pool_flush()
  - BUG/MINOR: h1-htx: properly initialize the err_pos field
  - BUG/MINOR: h1: Don't support LF only at the end of chunks
  - BUG/MEDIUM: h1: Don't support LF only to mark the end of a chunk size
  - BUG/MEDIUM: h1: always reject the NUL character in header values
  - BUG/MAJOR: ssl_sock: Always clear retry flags in read/write functions
  - BUG/MINOR: ssl: Clear the ckch instance when deleting a crt-list line
  - BUILD: address a few remaining calloc(size, n) cases
  - DOC: configuration: clarify http-request wait-for-body
  - DOC: install: recommend pcre2
  - DOC: internal: update missing data types in peers-v2.0.txt
  - CI: Update to actions/cache@v4
  - DEV: makefile: add a new "range" target to iteratively build all commits
  - DEV: makefile: fix POSIX compatibility for "range" target
  - BUG/MEDIUM: hlua: Don't loop if a lua socket does not consume received data
  - BUG/MINOR: ist: allocate nul byte on istdup
  - BUG/MINOR: ssl/cli: duplicate cleaning code in cli_parse_del_crtlist
  - DOC: configuration: clarify ciphersuites usage
  - BUG/MINOR: hlua: Fix log level to the right value when set via
    TXN:set_loglevel
  - MINOR: hlua: Be able to disable logging from lua
  - BUG/MINOR: tools: seed the statistical PRNG slightly better
  - BUG/MINOR: hlua: fix unsafe lua_tostring() usage with empty stack
  - BUG/MINOR: hlua: don't use lua_tostring() from unprotected contexts
  - BUG/MEDIUM: hlua: improper lock usage with SET_SAFE_LJMP()
  - BUG/MAJOR: hlua: improper lock usage with hlua_ctx_resume()
  - BUG/MINOR: cfgparse: report proper location for log-format-sd errors
  - DOC: configuration: clarify ciphersuites usage (V2)
  - BUG/MINOR: ssl: fix possible ctx memory leak in sample_conv_aes_gcm()
  - BUG/MINOR: listener: Wake proxy's mngmt task up if necessary on session
    release
  - BUG/MINOR: listener: Don't schedule frontend without task in
    listener_release()
  - BUG/MEDIUM: spoe: Don't rely on stream's expiration to detect processing
    timeout
  - BUG/MINOR: spoe: Be sure to be able to quickly close IDLE applets on soft-stop
  - CI: temporarily adjust kernel entropy to work with ASAN/clang
  - BUG/MEDIUM: spoe: Return an invalid frame on recv if size is too small
  - BUG/MINOR: session: ensure conn owner is set after insert into session
  - BUG/MEDIUM: mux-fcgi: Properly handle EOM flag on end-of-trailers HTX block
  - BUG/MINOR: server: 'source' interface ignored from 'default-server' directive
  - BUG/MINOR: server: ignore 'enabled' for dynamic servers
  - BUG/MINOR: backend: properly handle redispatch 0
  - BUG/MINOR: ist: only store NUL byte on succeeded alloc
  - DEBUG: lua: precisely identify if stream is stuck inside lua or not
  - MINOR: hlua: use accessors for stream hlua ctx
  - BUG/MEDIUM: hlua: streams don't support mixing lua-load with
    lua-load-per-thread (2nd try)
  - BUG/MINOR: proxy: fix logformat expression leak in use_backend rules


author: Anton Novojilov <andy@essentialkaos.com> - 2.6.14-0
changelog:
  - BUG/MINOR: fd: always remove late updates when freeing fd_updt[]
  - MINOR: ssl: ssl_sock_load_cert_chain() display error strings
  - CI: switch to Fastly CDN to download LibreSSL
  - BUILD: ssl: switch LibreSSL to Fastly CDN
  - BUG/MEDIUM: spoe: Don't start new applet if there are enough idle ones
  - BUG/MINOR: resolvers: Use sc_need_room() to wait more room when dumping stats
  - MINOR: quic: use real sending rate measurement
  - DEV: haring: automatically disable DEBUG_STRICT
  - DEV: haring: update readme to suggest using the same build options for haring
  - BUG/MINOR: mux-quic: prevent quic_conn error code to be overwritten
  - BUG/MINOR: debug: do not emit empty lines in thread dumps
  - BUG/MINOR: quic: Wrong key update cipher context initialization for encryption
  - BUILD: ssl: buggy -Werror=dangling-pointer since gcc 13.0
  - DOC: configuration: add info about ssl-engine for 2.6
  - BUG/MINOR: quic: Possible crash when dumping version information
  - BUILD: mjson: Fix warning about unused variables
  - MINOR: spoe: Don't stop disabled proxies
  - BUG/MEDIUM: filters: Don't deinit filters for disabled proxies during startup
  - MINOR: http-rules: Add missing actions in http-after-response ruleset
  - BUG/MINOR: quic: Buggy acknowlegments of acknowlegments function
  - BUG/MEDIUM: mux-fcgi: Don't request more room if mux is waiting for more data
  - BUG/MINOR: proxy: missing free in free_proxy for redirect rules
  - MINOR: proxy: add http_free_redirect_rule() function
  - BUG/MINOR: http_rules: fix errors paths in http_parse_redirect_rule()
  - BUG/MINOR: errors: handle malloc failure in usermsgs_put()
  - BUG/MINOR: log: fix memory error handling in parse_logsrv()
  - MINOR: htx: add function to set EOM reliably
  - MINOR: checks: make sure spread-checks is used also at boot time
  - MINOR: clock: measure the total boot time
  - BUG/MINOR: checks: postpone the startup of health checks by the boot time
  - BUG/MINOR: clock: fix the boot time measurement method for 2.6 and older
  - BUG/MINOR: tcp-rules: Don't shortened the inspect-delay when EOI is set
  - REGTESTS: log: Reduce response inspect-delay for last_rule.vtc
  - DOC: config: Clarify conditions to shorten the inspect-delay for TCP rules
  - REGTESTS: log: Reduce again response inspect-delay for last_rule.vtc
  - DOC: add size format section to manual
  - DOC/MINOR: config: Fix typo in description for `ssl_bc` in configuration.txt
  - BUG/MINOR: hlua: unsafe hlua_lua2smp() usage
  - SCRIPTS: publish-release: update the umask to keep group write access
  - BUG/MINOR: mux-quic: properly handle buf alloc failure
  - BUG/MINOR: mux-quic: handle properly recv ncbuf alloc failure
  - BUG/MINOR: quic: do not alloc buf count on alloc failure
  - BUG/MINOR: mux-quic: differentiate failure on qc_stream_desc alloc
  - BUG/MINOR: mux-quic: handle properly Tx buf exhaustion
  - MINOR: mux-quic: uninline qc_attach_sc()
  - BUG/MEDIUM: mux-quic: fix EOI for request without payload
  - BUG/MINOR: quic: Wrong token length check (quic_generate_retry_token())
  - BUG/MINOR: quic: Missing Retry token length on receipt
  - DOC: config: Fix bind/server/peer documentation in the peers section
  - CONTRIB: Add vi file extensions to .gitignore
  - BUG/MINOR: spoe: Only skip sending new frame after a receive attempt
  - BUG/MINOR: quic: Possible crash when SSL session init fails
  - DOC: config: fix jwt_verify() example using var()
  - BUG/MINOR: cfgparse-tcp: leak when re-declaring interface from bind line
  - BUG/MINOR: proxy: add missing interface bind free in free_proxy


author: Anton Novojilov <andy@essentialkaos.com> - 2.6.15-0
changelog:
  - BUG/MINOR: quic: Wrong encryption level flags checking
  - BUG/MINOR: server: inherit from netns in srv_settings_cpy()
  - BUG/MINOR: namespace: missing free in netns_sig_stop()
  - BUG/MINOR: quic: Missing initialization (packet number space probing)
  - BUG/MEDIUM: mworker: increase maxsock with each new worker
  - BUG/MINOR: quic: ticks comparison without ticks API use
  - DOC: Add tune.h2.max-frame-size option to table of contents
  - REGTESTS: h1_host_normalization : Add a barrier to not mix up log messages
  - BUG/MINOR: mworker: leak of a socketpair during startup failure
  - BUG/MEDIUM: mux-h2: make sure control frames do not refresh the idle timeout
  - BUG/MINOR: mux-h2: refresh the idle_timer when the mux is empty
  - BUG/MEDIUM: quic: error checking buffer large enought to receive the retry tag
  - BUG/MINOR: config: fix stick table duplicate name check
  - BUG/MINOR: quic: Missing random bits in Retry packet header
  - BUG/MINOR: quic: Wrong Retry paquet version field endianess
  - BUG/MINOR: quic: Wrong endianess for version field in Retry token
  - IMPORT: slz: implement a synchronous flush() operation
  - MINOR: compression/slz: add support for a pure flush of pending bytes
  - BUILD: debug: avoid a build warning related to epoll_wait() in debug code
  - MINOR: quic: Move QUIC encryption level structure definition
  - MINOR: quic: Move packet number space related functions
  - MINOR: quic: Reduce the maximum length of TLS secrets
  - CLEANUP: quic: Remove server specific about Initial packet number space
  - BUG/MINOR: tcp_sample: bc_{dst,src} return IP not INT
  - BUG/MINOR: cache: A 'max-age=0' cache-control directive can be overriden
    by a s-maxage
  - BUG/MEDIUM: sink: invalid server list in sink_new_from_logsrv()
  - BUG/MINOR: sink: missing sft free in sink_deinit()
  - BUG/MINOR: ring: size warning incorrectly reported as fatal error
  - BUG/MINOR: ring: maxlen warning reported as alert
  - BUG/MINOR: log: LF upsets maxlen for UDP targets
  - MINOR: sink/api: pass explicit maxlen parameter to sink_write()
  - BUG/MEDIUM: log: improper use of logsrv->maxlen for buffer targets
  - BUG/MINOR: log: fix missing name error message in cfg_parse_log_forward()
  - BUG/MINOR: log: fix multiple error paths in cfg_parse_log_forward()
  - BUG/MINOR: log: free errmsg on error in cfg_parse_log_forward()
  - BUG/MINOR: sink: invalid sft free in sink_deinit()
  - BUG/MINOR: sink: fix errors handling in cfg_post_parse_ring()
  - BUG/MINOR: sink/log: properly deinit srv in sink_new_from_logsrv()
  - BUG/MINOR: config: Remove final '\n' in error messages
  - BUG/MEDIUM: quic: token IV was not computed using a strong secret
  - BUG/MINOR: quic: retry token remove one useless intermediate expand
  - BUG/MEDIUM: quic: missing check of dcid for init pkt including a token
  - BUG/MEDIUM: quic: timestamp shared in token was using internal time clock
  - BUG/MINOR: hlua: hlua_yieldk ctx argument should support pointers
  - DOC: config: Fix fc_src description to state the source address is returned
  - BUG/MINOR: sample: Fix wrong overflow detection in add/sub conveters
  - BUG/MINOR: http: Return the right reason for 302
  - CI: explicitely highlight VTest result section if there's something
  - BUILD: quic: fix warning during compilation using gcc-6.5
  - BUG/MINOR: hlua: add check for lua_newstate
  - BUG/MINOR: h1-htx: Return the right reason for 302 FCGI responses
  - BUG/MINOR: quic: Missing parentheses around PTO probe variable.
  - BUG/MEDIUM: listener: Acquire proxy's lock in relax_listener() if necessary
  - MINOR: quic: Make ->set_encryption_secrets() be callable two times
  - MINOR: quic: Useless call to SSL_CTX_set_quic_method()
  - BUG/MEDIUM: h3: Properly report a C-L header was found to the HTX start-line
  - DOC: configuration: describe Td in Timing events
  - BUG/MINOR: chunk: fix chunk_appendf() to not write a zero if buffer is full
  - BUG/MEDIUM: h3: Be sure to handle fin bit on the last DATA frame
  - BUG/MAJOR: http-ana: Get a fresh trash buffer for each header value
    replacement
  - REORG: http: move has_forbidden_char() from h2.c to http.h
  - BUG/MAJOR: h3: reject header values containing invalid chars
  - BUG/MAJOR: http: reject any empty content-length header value
  - MINOR: ist: add new function ist_find_range() to find a character range
  - MINOR: http: add new function http_path_has_forbidden_char()
  - MINOR: h2: pass accept-invalid-http-request down the request parser
  - REGTESTS: http-rules: add accept-invalid-http-request for normalize-uri tests
  - BUG/MINOR: h1: do not accept '#' as part of the URI component
  - BUG/MINOR: h2: reject more chars from the :path pseudo header
  - BUG/MINOR: h3: reject more chars from the :path pseudo header
  - REGTESTS: http-rules: verify that we block '#' by default for normalize-uri
  - DOC: clarify the handling of URL fragments in requests
  - BUG/MINOR: http: skip leading zeroes in content-length values


author: Anton Novojilov <andy@essentialkaos.com> - 2.6.16-0
changelog:
  - CI: get rid of travis-ci wrapper for Coverity scan
  - BUG/MINOR: hlua: fix invalid use of lua_pop on error paths
  - BUG/MINOR: stktable: allow sc-set-gpt(0) from tcp-request connection
  - DOC: typo: fix sc-set-gpt references
  - SCRIPTS: git-show-backports: automatic ref and base detection with -m
  - BUILD: Makefile: add the USE_QUIC option to make help
  - MINOR: atomic: make sure to always relax after a failed CAS
  - BUG/MINOR: hlua_fcn: potentially unsafe stktable_data_ptr usage
  - DOC: lua: fix core.register_action typo
  - BUG/MINOR: ssl_sock: fix possible memory leak on OOM
  - BUG/MINOR: ssl/cli: can't find ".crt" files when replacing a certificate
  - BUG/MEDIUM: stconn: Wake applets on sending path if there is a pending
    shutdown
  - BUG/MEDIUM: stconn: Don't block sends if there is a pending shutdown
  - BUG/MINOR: quic: Possible skipped RTT sampling
  - BUG/MAJOR: quic: Really ignore malformed ACK frames.
  - BUG/MEDIUM: h1-htx: Ensure chunked parsing with full output buffer
  - DOC: configuration: update examples for req.ver
  - BUG/MINOR: quic: Wrong RTT adjusments
  - BUG/MEDIUM: stconn/stream: Forward shutdown on write timeout
  - BUG/MINOR: hlua/action: incorrect message on E_YIELD error
  - CI: Update to actions/checkout@v4
  - BUG/MINOR: quic: Wrong RTT computation (srtt and rrt_var)
  - BUG/MINOR: quic: Leak of frames to send.
  - BUG/MINOR: quic: Wrong cluster secret initialization
  - MINOR: hlua: add hlua_stream_ctx_prepare helper function
  - BUG/MEDIUM: hlua: streams don't support mixing lua-load with
    lua-load-per-thread
  - Revert "BUG/MEDIUM: quic: missing check of dcid for init pkt including
    a token"
  - CI: musl: highlight section if there are coredumps
  - CI: musl: drop shopt in workflow invocation
  - BUG/MEDIUM: hlua: don't pass stale nargs argument to lua_resume()
  - BUG/MINOR: hlua/init: coroutine may not resume itself
  - BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records
  - BUG/MINOR: promex: fix backend_agg_check_status
  - BUG/MINOR: freq_ctr: fix possible negative rate with the scaled API
  - BUG/MAJOR: mux-h2: Report a protocol error for any DATA frame before headers
  - BUG/MINOR: server: add missing free for server->rdr_pfx
  - MINOR: pattern: fix pat_{parse,match}_ip() function comments
  - BUG/MEDIUM: server/cli: don't delete a dynamic server that has streams
  - BUILD: bug: make BUG_ON() void to avoid a rare warning
  - BUG/MEDIUM: actions: always apply a longest match on prefix lookup
  - BUG/MEDIUM: quic_conn: let the scheduler kill the task when needed
  - MINOR: hlua: Set context's appctx when the lua socket is created
  - MINOR: hlua: Don't preform operations on a not connected socket
  - MINOR: hlua: Save the lua socket's timeout in its context
  - MINOR: hlua: Save the lua socket's server in its context
  - MINOR: hlua: Test the hlua struct first when the lua socket is connecting
  - BUG/MEDIUM: hlua: Initialize appctx used by a lua socket on connect only
  - BUG/MINOR: mux-h1: Ignore C-L when sending H1 messages if T-E is also set
  - BUG/MEDIUM: h1: Ignore C-L value in the H1 parser if T-E is also set
  - BUG/MINOR: hq-interop: simplify parser requirement
  - BUG/MINOR: quic: Avoid crashing with unsupported cryptographic algos
  - BUG/MINOR: quic: reject packet with no frame
  - BUG/MINOR: mux-quic: support initial 0 max-stream-data
  - BUG/MINOR: h3: strengthen host/authority header parsing
  - BUG/MINOR: mux-quic: fix free on qcs-new fail alloc
  - BUG/MINOR: mux-h2: make up other blocked streams upon removal from list
  - BUG/MEDIUM: mux-h2: Don't report an error on shutr if a shutw is pending
  - BUG/MINOR: mux-h2: fix http-request and http-keep-alive timeouts again
  - BUG/MEDIUM: peers: Be sure to always refresh recconnect timer in sync task
  - BUG/MEDIUM: peers: Fix synchro for huge number of tables
  - BUG/MINOR: mux-h2: commit the current stream ID even on reject
  - BUG/MINOR: mux-h2: update tracked counters with req cnt/req err
  - DOC: internal: filters: fix reference to entities.pdf
  - BUG/MINOR: ssl: load correctly @system-ca when ca-base is define
  - MINOR: connection: add conn_pr_mode_to_proto_mode() helper func
  - BUG/MEDIUM: server: "proto" not working for dynamic servers
  - BUG/MINOR: ssl: suboptimal certificate selection with TLSv1.3 and dual
    ECDSA/RSA
  - BUG/MEDIUM: ssl: segfault when cipher is NULL
  - BUG/MINOR: tcpcheck: Report hexstring instead of binary one on check failure
  - BUG/MINOR: stktable: missing free in parse_stick_table()
  - BUG/MINOR: cfgparse/stktable: fix error message on stktable_init() failure
  - CLEANUP: htx: Properly indent htx_reserve_max_data() function
  - BUG/MINOR: stick-table/cli: Check for invalid ipv4 key
  - BUG/MINOR: mux-h1: Properly handle http-request and http-keep-alive timeouts
  - BUG/MEDIUM: pool: fix releasable pool calculation when overloaded
  - DOC: management: -q is quiet all the time
  - DOC: config: use the word 'backend' instead of 'proxy' in 'track' description
  - BUG/MEDIUM: applet: Remove appctx from buffer wait list on release
  - DOC: quic: Wrong syntax for "quic-cc-algo" keyword.
  - BUG/MINOR: stconn: Handle abortonclose if backend connection was already
    set up
  - MINOR: connection: Add a CTL flag to notify mux it should wait for reads again
  - MEDIUM: mux-h1: Handle MUX_SUBS_RECV flag in h1_ctl() and susbscribe for reads
  - BUG/MEDIUM: stream: Properly handle abortonclose when set on backend only
  - REGTESTS: http: Improve script testing abortonclose option
  - BUG/MINOR: http-client: Don't forget to commit changes on HTX message
  - BUG/MEDIUM: stream: Don't call mux .ctl() callback if not implemented
  - MINOR: htx: Use a macro for overhead induced by HTX
  - MINOR: channel: Add functions to get info on buffers and deal with HTX streams
  - BUG/MINOR: stconn: Fix streamer detection for HTX streams
  - BUG/MINOR: stconn: Use HTX-aware channel's functions to get info on buffer
  - BUG/MINOR: quic: do not consider idle timeout on CLOSING state
  - BUG/MINOR: mux-quic: fix early close if unset client timeout
  - BUG/MINOR: ssl: use a thread-safe sslconns increment
  - MINOR: frontend: implement a dedicated actconn increment function
  - BUG/MINOR: quic: idle timer task requeued in the past
  - BUG/MEDIUM: quic: Avoid trying to send ACK frames from an empty ack ranges
    tree
  - BUG/MEDIUM: quic: Possible crashes when sending too short Initial packets
  - BUG/MINOR: sink: don't learn srv port from srv addr
  - MEDIUM: quic: count quic_conn instance for maxconn
  - MEDIUM: quic: count quic_conn for global sslconns
  - BUG/MEDIUM: quic: fix actconn on quic_conn alloc failure
  - BUG/MEDIUM: quic: fix sslconns on quic_conn alloc failure
  - BUG/MEDIUM: mux-h2: fail earlier on malloc in takeover()
  - BUG/MEDIUM: mux-h1: fail earlier on malloc in takeover()
  - BUG/MEDIUM: mux-fcgi: fail earlier on malloc in takeover()
  - BUG/MINOR: stream/cli: report correct stream age in "show sess"
  - MINOR: stktable: add stktable_deinit function
  - BUG/MINOR: proxy/stktable: missing frees on proxy cleanup
  - REGTESTS: http: add a test to validate chunked responses delivery
  - BUG/MINOR: startup: set GTUNE_SOCKET_TRANSFER correctly
  - BUG/MINOR: sock: mark abns sockets as non-suspendable and always unbind them
  - BUG/MEDIUM: quic: Possible crash for connections to be killed
  - BUG/MINOR: server: do not leak default-server in defaults sections
  - DOC: 51d: updated 51Degrees repo URL for v3.2.10
  - DOC: config: fix timeout check inheritance restrictions
  - REGTESTS: connection: disable http_reuse_be_transparent.vtc if !TPROXY
  - DOC: lua: add sticktable class reference from Proxy.stktable
  - DOC: lua: fix Proxy.get_mode() output
  - BUG/MINOR: quic: fix CONNECTION_CLOSE_APP encoding
  - BUG/MINOR: h3: always reject PUSH_PROMISE
  - DOC: config: fix missing characters in set-spoe-group action
  - BUG/MINOR: quic_tp: fix preferred_address decoding
  - BUG/MINOR: config: Stopped parsing upon unmatched environment variables
  - BUG/MINOR: cfgparse-listen: fix warning being reported as an alert
  - DOC: config: specify supported sections for "max-session-srv-conns"
  - DOC: config: add matrix entry for "max-session-srv-conns"
  - DOC: config: fix monitor-fail typo
  - REGTESTS: sample: Test the behavior of consecutive delimiters for the field
    converter
  - BUG/MINOR: sample: Make the `word` converter compatible with `-m found`
  - DOC: Clarify the differences between field() and word()
  - BUG/MINOR: cache: Remove incomplete entries from the cache when stream
    is closed
  - BUG/MEDIUM: pattern: don't trim pools under lock in pat_ref_purge_range()
  - BUG/MINOR: quic: Possible memory leak from TX packets
  - BUG/MEDIUM: quic: Avoid some crashes upon TX packet allocation failures
  - BUG/MINOR: quic: Possible leak of TX packets under heavy load


author: Anton Novojilov <andy@essentialkaos.com> - 2.6.17-0
changelog:
  - BUG/MEDIUM: connection: report connection errors even when no mux is installed
  - BUG/MEDIUM: mworker: set the master variable earlier
  - BUG/MEDIUM: proxy: always initialize the default settings after init
  - DOC: configuration: typo req.ssl_hello_type
  - BUG/MINOR: mworker/cli: fix set severity-output support
  - BUG/MEDIUM: mux-h2: Report too large HEADERS frame only when rxbuf is empty
  - BUG/MINOR: resolvers: default resolvers fails when network not configured
  - DOC: config: Update documentation about local haproxy response
  - MINOR: stats: store the parent proxy in stats ctx (http)
  - BUG/MEDIUM: stats: unhandled switching rules with TCP frontend
  - MINOR: h3: check connection error during sending
  - BUG/MINOR: h3: close connection on header list too big
  - BUG/MINOR: h3: properly handle alloc failure on finalize
  - BUG/MINOR: h3: close connection on sending alloc errors
  - CLEANUP: quic: Remaining useless code into server part
  - BUG/MEDIUM: h3: fix incorrect snd_buf return value
  - BUG/MEDIUM: stconn: Forward shutdown on write timeout only if it is
    forwardable
  - BUG/MEDIUM: spoe: Never create new spoe applet if there is no server up
  - BUG/MEDIUM: h3: fix regression which completely prevents any send
  - BUG/MINOR: mux-quic: do not prevent non-STREAM sending on flow control
  - MINOR: compiler: add a new DO_NOT_FOLD() macro to prevent code folding
  - MINOR: debug: make sure calls to ha_crash_now() are never merged
  - MINOR: debug: make ABORT_NOW() store the caller's line number when using abort
  - MINOR: debug: make BUG_ON() catch build errors even without DEBUG_STRICT
  - BUG/MEDIUM: cli: some err/warn msg dumps add LR into CSV output on stat's CLI
  - BUG/MINOR: vars/cli: fix missing LF after "get var" output
  - BUG/MINOR: jwt: fix jwt_verify crash on 32-bit archs
  - BUG/MEDIUM: pool: fix rare risk of deadlock in pool_flush()
  - BUG/MINOR: h1-htx: properly initialize the err_pos field
  - BUG/MINOR: h1: Don't support LF only at the end of chunks
  - BUG/MEDIUM: h1: Don't support LF only to mark the end of a chunk size
  - BUG/MEDIUM: h1: always reject the NUL character in header values
  - BUG/MAJOR: ssl_sock: Always clear retry flags in read/write functions
  - BUG/MINOR: ssl: Clear the ckch instance when deleting a crt-list line
  - REGTESTS: ssl: Fix empty line in cli command input
  - BUG/MINOR: h3: fix checking on NULL Tx buffer
  - CLEANUP: quic: Remove unused CUBIC_BETA_SCALE_FACTOR_SHIFT macro.
  - MINOR: quic: Stop hardcoding a scale shifting value
    (CUBIC_BETA_SCALE_FACTOR_SHIFT)
  - MINOR: quic: extract qc_stream_buf free in a dedicated function
  - MINOR: h3: add traces for stream sending function
  - BUG/MEDIUM: h3: do not crash on invalid response status code
  - BUG/MEDIUM: qpack: allow 6xx..9xx status codes
  - BUG/MEDIUM: quic: fix crash on invalid qc_stream_buf_free() BUG_ON
  - BUG/MINOR: quic: Wrong ack ranges handling when reaching the limit.
  - CLEANUP: quic: Code clarifications for QUIC CUBIC (RFC 9438)
  - BUG/MINOR: quic: fix possible integer wrap around in cubic window calculation
  - MINOR: quic: Stop using 1024th of a second.
  - BUG/MEDIUM: quic: Wrong K CUBIC calculation.
  - MINOR: quic: Update K CUBIC calculation (RFC 9438)
  - MINOR: quic: Dynamic packet reordering threshold
  - BUG/MINOR: diag: run the final diags before quitting when using -c
  - BUILD: address a few remaining calloc(size, n) cases
  - DOC: configuration: clarify http-request wait-for-body
  - DOC: httpclient: add dedicated httpclient section
  - DOC: install: recommend pcre2
  - DOC: internal: update missing data types in peers-v2.0.txt
  - CI: Update to actions/cache@v4
  - DEV: makefile: add a new "range" target to iteratively build all commits
  - DEV: makefile: fix POSIX compatibility for "range" target
  - BUG/MAJOR: promex: fix crash on deleted server
  - BUG/MINOR: quic: reject unknown frame type
  - BUG/MINOR: quic: reject HANDSHAKE_DONE as server
  - BUG/MINOR: qpack: reject invalid increment count decoding
  - BUG/MINOR: qpack: reject invalid dynamic table capacity
  - BUG/MEDIUM: applet: Immediately free appctx on early error
  - BUG/MEDIUM: hlua: Be able to garbage collect uninitialized lua sockets
  - BUG/MEDIUM: hlua: Don't loop if a lua socket does not consume received data
  - MINOR: quic: warn on bind on multiple addresses if no IP_PKTINFO support
  - BUG/MINOR: ist: allocate nul byte on istdup
  - BUG/MINOR: stats: drop srv refcount on early release
  - BUG/MAJOR: server: fix stream crash due to deleted server
  - BUG/MINOR: ist: only store NUL byte on succeeded alloc
  - BUG/MINOR: ssl/cli: duplicate cleaning code in cli_parse_del_crtlist
  - DOC: configuration: clarify ciphersuites usage
  - BUG/MINOR: hlua: Fix log level to the right value when set via
    TXN:set_loglevel
  - MINOR: hlua: Be able to disable logging from lua
  - BUG/MINOR: tools: seed the statistical PRNG slightly better
  - BUG/MINOR: hlua: fix unsafe lua_tostring() usage with empty stack
  - BUG/MINOR: hlua: don't use lua_tostring() from unprotected contexts
  - BUG/MINOR: hlua: fix possible crash in hlua_filter_new() under load
  - BUG/MINOR: hlua: improper lock usage in hlua_filter_callback()
  - BUG/MINOR: hlua: improper lock usage in hlua_filter_new()
  - BUG/MEDIUM: hlua: improper lock usage with SET_SAFE_LJMP()
  - BUG/MAJOR: hlua: improper lock usage with hlua_ctx_resume()
  - BUG/MINOR: ssl/cli: typo in new ssl crl-file CLI description
  - BUG/MINOR: cfgparse: report proper location for log-format-sd errors
  - DOC: configuration: clarify ciphersuites usage (V2)
  - BUG/MINOR: ssl: fix possible ctx memory leak in sample_conv_aes_gcm()
  - BUG/MINOR: hlua: segfault when loading the same filter from different contexts
  - BUG/MINOR: hlua: missing lock in hlua_filter_new()
  - BUG/MINOR: hlua: fix missing lock in hlua_filter_delete()
  - BUG/MINOR: listener: Wake proxy's mngmt task up if necessary on session
    release
  - BUG/MINOR: listener: Don't schedule frontend without task in
    listener_release()
  - BUG/MEDIUM: spoe: Don't rely on stream's expiration to detect processing
    timeout
  - BUG/MINOR: spoe: Be sure to be able to quickly close IDLE applets on soft-stop
  - CI: temporarily adjust kernel entropy to work with ASAN/clang
  - BUG/MEDIUM: spoe: Return an invalid frame on recv if size is too small
  - BUG/MINOR: session: ensure conn owner is set after insert into session
  - BUG/MINOR: mux-quic: close all QCS before freeing QCC tasklet
  - BUG/MEDIUM: mux-fcgi: Properly handle EOM flag on end-of-trailers HTX block
  - BUG/MINOR: server: 'source' interface ignored from 'default-server' directive
  - BUG/MINOR: server: ignore 'enabled' for dynamic servers
  - BUG/MINOR: backend: properly handle redispatch 0
  - DOC: config: Remove httpclient.timeout.connect parameter
  - DEBUG: lua: precisely identify if stream is stuck inside lua or not
  - MINOR: hlua: use accessors for stream hlua ctx
  - BUG/MEDIUM: hlua: streams don't support mixing lua-load with
    lua-load-per-thread (2nd try)
  - BUG/MINOR: proxy: fix logformat expression leak in use_backend rules


author: Anton Novojilov <andy@essentialkaos.com> - 1.10.10-0
changelog:
  - https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-1.10/hdf5-1.10.10/src/hdf5-1.10.10-RELEASE.txt


author: Gleb Goncharov <g.goncharov@fun-box.ru> - 2.1.0-0
changelog:
  - Linux: Delay accounting metrics
  - DragonFly BSD support
  - Support for real-time signals
  - 'c' key now works with threads as well
  - Session column renamed from SESN to SID
  - Improved UI for meter style selection
  - Improved code for constructing process tree
  - Compile-time option to disable setuid
  - Error checking of various standard library operations
  - Replacement of sprintf with snprintf
  - Linux: performance improvements in battery meter
  - Linux: update process TTY device
  - Linux: add support for sorting TASK_IDLE
  - Linux: add upper-bound to running process counter
  - BUGFIX: avoid crash when battery is removed
  - BUGFIX: macOS: fix infinite loop in tree view


author: Anton Novojilov <andy@essentialkaos.com> - 2.2.0-0
changelog:
  - Solaris/Illumos/OpenIndiana support
  - -t/--tree flag for starting in tree-view mode
  - macOS: detects High Sierra version to avoid OS bug
  - OpenBSD: read battery data
  - Various automake and build improvements
  - Check for pkg-config when building with --enable-delayacct
  - Avoid some bashisms in configure script
  - Use CFLAGS from ncurses*-config if present
  - Header generator supports non-UTF-8 environments
  - Linux: changed detection of kernel threads
  - Collapse current subtree pressing Backspace
  - BUGFIX: fix behavior of SYSCR column
  - BUGFIX: obtain exit code of lsof correctly
  - BUGFIX: fix crash with particular keycodes
  - BUGFIX: fix issue with small terminals
  - BUGFIX: fix terminal color issues
  - BUGFIX: preserve LDFLAGS when building
  - BUGFIX: fixed overflow for systems with >= 100 signals


author: Anton Novojilov <andy@essentialkaos.com> - 3.0.0-0
changelog:
  - Support ZFS ARC statistics
  - Support more than 2 smaller CPU meter columns
  - Support Linux proportional set size metrics
  - Support Linux pressure stall information metrics
  - New display option to show CPU frequency in CPU meters
  - Update Linux sysfs battery discovery for recent kernels
  - Add hardware topology information in the affinity panel
  - Add timestamp reporting to the strace screen
  - Add simple, optional vim key mapping mode
  - Added an option to disable the mouse
  - Add Solaris11 compatibility
  - Without an argument -u uses $USER value automatically
  - Support less(1) search navigation shortcuts
  - Update the FreeBSD maximum PID to match FreeBSD change
  - Report values larger than 100 terabytes
  - Widen ST_UID (UID) column to allow for UIDs > 9999
  - BUGFIX: fix makefiles for building with clang
  - BUGFIX: fix <sys/sysmacros.h> major() usage
  - BUGFIX: fix the STARTTIME column on FreeBSD
  - BUGFIX: truncate overwide jail names on FreeBSD
  - BUGFIX: fix reported memory values on FreeBSD
  - BUGFIX: fix reported CPU meter values on OpenBSD
  - BUGFIX: correctly identify other types of zombie process
  - BUGFIX: improve follow-process handling in some situations
  - BUGFIX: fix custom meters reverting to unexpected setting
  - BUGFIX: close pipe after running lsof(1)
  - BUGFIX: meters honour setting of counting CPUs from 0/1


author: Anton Novojilov <andy@essentialkaos.com> - 3.0.1-0
changelog:
  - Coverity fixes, CI improvements, documentation updates
  - BUGFIX: Fix early exit with longer sysfs battery paths
  - BUGFIX: Improve OOM output, fix sorting
  - Rework check buttons and tree open/closed
  - Add -U/--no-unicode option to disable unicode
  - Improvements to the affinity panel


author: Anton Novojilov <andy@essentialkaos.com> - 3.0.2-0
changelog:
  - BUGFIX: Drop 'vim_mode' - several issues, needs rethink
  - BUGFIX: fix regression in -u optional-argument handling
  - Build system rework to remove python, header generation
  - BUGFIX: report nice level correctly on Solaris
  - CI, code quality improvements


author: Anton Novojilov <andy@essentialkaos.com> - 3.0.3-0
changelog:
  - Improved command display/sort functionality
  - Add screen for active file locks
  - Calculate library size (M_LRS column) from maps file
  - Add a Zram meter
  - Add Linux cwd process column
  - Dynamically load libsensors at runtime
  - Improve PressureStall Meter display strings
  - Hide process selection on ESC
  - Fully support non-ascii characters in Meter-Bar
  - Add support to change numeric options in settings screen
  - Rename virtual memory column from M_SIZE to M_VIRT
  - Add process column for normalized CPU usage
  - Show CPU temperature in CPU meter
  - Drop hideThreads Setting
  - Add a systemd meter
  - Add a network IO meter
  - Add a SELinux meter
  - Compress size of default FunctionBar
  - Updates to the OpenFiles screen
  - Continue updating header data in paused mode
  - BUGFIX: Handle data wraparounds in IO meters
  - BUGFIX: Update InfoScreen content on resize
  - Add security attribute process column
  - Add DiskIOMeter for IO read/write usage
  - Read CPU frequency from sysfs by default
  - Add Linux process column for context switches
  - Several FreeBSD and Mac OS X platform updates
  - Add process environment for FreeBSD
  - Parse POWER_SUPPLY_CAPACITY for Linux Battery meter
  - Add octuple-column CPU meters.
  - BUGFIX: On Linux consider ZFS ARC to be cache
  - BUGFIX: Limit screen title length to window width
  - Show selected command wrapped in a separate window
  - Allow to pass '/' for item search
  - Document implicit incremental search
  - Handle 'q' as quit if first character
  - Avoid expensive build of process tree when not using it
  - Include documentation for COMM and EXE
  - Distinguish display of no permissions for reading M_LRS
  - Only calculate M_LRS size every 2 seconds
  - Improvements to comm / cmdline display functionality
  - Merged view for COMM, EXE and cmdline
  - Consistent kernel thread display for COMM/EXE columns
  - Central fault handling for all platforms
  - Handle parsing envID & VPid from process status file
  - Use threshold for display of guest/steal/irq meters
  - Enhance highlighting of semi-large and large numbers
  - Documentation on the repository style guide
  - Align processor identifier to the right
  - Document M_PSS, M_PSSWP, M_SWAP in man page
  - Add Date and DateTime meters
  - BUGFIX: Fix Solaris 11.4 due to missing ZFS ARC kstats
  - Code hardening, speedups, fd and memory leak fixes
  - Number CPUs from zero by default
  - Remove residual python checks during the build process


author: Anton Novojilov <andy@essentialkaos.com> - 3.0.4-0
changelog:
  - Separate tree and list sort orders
  - Invert Process_compare so that superclass matches run first
  - Unhardcode Mac OS tick-to-milliseconds conversion
  - Check if clock_gettime needs linking of librt
  - Define O_PATH if not already defined
  - Add column on Mac for processes running under translation
  - Configure check for additional linker flags for keypad(3)
  - PSI Meter: constant width and only print ten-duration as bar
  - Sort in paused mode after inverting sort order
  - Handle absence of package CPU temperature
  - Meter: restore non-wide-character build
  - LibSensors: restore temperature for Raspberry Pi
  - MainPanel: do not reset hideProcessSelection on KEY_SHUFFLE
  - BarMeter: rework text padding
  - Panel: rework drawing of FunctionBar
  - Meter: fix artifacts with very tiny width
  - DragonFlyBSD updates
  - BUGFIX: Fix dlopen issue for libsensors5 for some platforms
  - BUGFIX: Fix broken tree display on inverted sort order
  - BUGFIX: Fix pause mode ("Z") in tree view
  - BUGFIX: Correct timebase for non-x86 CPUs on Darwin
  - BUGFIX: Avoid NULL dereference on zombie processes
  - Document dynamic bindings and assumed external configuration
  - Update key mapping documentation for sorting


author: Anton Novojilov <andy@essentialkaos.com> - 3.0.5-0
changelog:
  - BUGFIX / SECURITY: InfoScreen: fix uncontrolled format string
  - BUGFIX: Improve white text in the Light Terminal colour scheme
    (both of the above thanks to V)
  - Enable the function bar on the main screen to be hidden (see Setup ->
    Display options)
  - BUGFIX: Reduce layout issues esp. around printing wide characters (not
    complete yet)
  - BUGFIX: Make the follow function exit cleanly after followed process died
  - Solaris: make Process callbacks static
  - Update help and man page for improved -t / -s options
  - Drop usage of formatted error messages from <err.h>
  - Show arrow indicating order of sorted process column
  - Lots of plumbing around the internal Hashtable, hardening and code cleanups
  - LibSensors: add support for Ryzen CPUs
  - BUGFIX: Fix CPU percentage on M1 silicon Macs
  - LoadMeter: dynamically adjust color and total of bar
  - Find libsensors.so.4 for Fedora and friends
  - Add support to display CPU frequencies on Solarish platforms
  - Enable going back to previous search matches (Shift-F3)
  - Added keybind 'N' for sorting by PID (drops 'n'/'N' as not used before much)


author: Anton Novojilov <andy@essentialkaos.com> - 3.1.0-0
changelog:
  - Updated COPYING file to remove the PLPA exemption (appendix 2)
    With this change the license is now GPLv2 without any additional wording.
  - Improved default sort ordering
    Note for users: This may lead to an inverted sort order on startup of
    htop 3.1.0 compared to previous versions.
    This is due to what is stored in your htoprc file. Solution: Press I
    (to invert sort order).
    This changed setting will be saved by htop on exit as long as it can
    write to your htoprc file.
  - The compile-time option to cater specifically for running htop as
    setuid has been removed
  - Add read-only option
    This allows htop to be run in an non-intrusive fashion where it acts only
    as a process viewer disabling all functions to manipulate system state.
    Note: This is not a security feature!
  - Move the code for handling the command line formatting related tasks
    to be shared across all platforms
    This means important features like stale binary/library highlighting
    can now be available on all supported platforms.
  - Make the EXE and COMM columns available on all platforms
    All supported platforms have the name of the executable (EXE) and a
    self-chosen thread/command name (COMM) available one way or the other.
    Moving this column to be handled as a platform-independently available
    information simplifies the markup of the command line.
  - Introduce configuration file versioning and config_reader_min_version
    Starting with this version the configuration file contains a version
    identifying the minimum version of the configuration parser needed to
    fully understand the configuration file format.
    Old configuration file formats are automatically upgraded when
    saving the config file (htoprc).
  - Make the configuration parser friendlier to users
    With this change only settings that cannot be parsed properly are
    reset to their defaults.
  - Improve default display for systems with many CPUs
  - Add the process ELAPSED time column
  - Improve the process STATE column sorting
  - Reworked handling resize and redrawing of the UI
  - Fixed an issue where the LED meter mode could overflow allotted space
  - Allow text mode Meters to span empty neighbors to the right
  - Rescale graph meters when value of total changes
  - Update generic process field display
    Usually "uninteresting" values in columns like 1 thread, nice value
    of 0, CPU and memory of 0%, idle/sleeping state, etc. are shown with
    reduced intensity (dark grey)
  - Option and key ("*") to collapse / expand all branches under PID 1
    (and PID 2 if kernel threads are shown)
  - Keep following a process when inverting the sort order, displaying
    the help screen or hiding/unhiding userland threads.
    If a thread is currently selected the selection is updated to point
    to the thread's parent process.
  - Reorder process scanning to be performed before updating the display
    of the meters in the header
  - Always check the user for a process for any changes.
    This affects multiple platforms that previously didn't correctly handle
    the user field for a process to change at runtime (e.g. due to seteuid
    or similar syscalls).
  - Disable mouse option when support is unavailable
  - Support curses libraries without ncurses mouse support
  - Support offline and hot-swapping of CPUs on all platforms
  - Fix the CPU Meter for machines with more than 256 CPUs
  - Supplemented the "show updated/deleted executables" feature (red basename)
    to indicate when linked libraries were updated (yellow basename)
  - Apply the stale binary highlighting for the EXE column in addition to
    the command line field
  - Add new combined Memory and Swap meter
  - Implement bar and graph mode for NetworkIO Meter
  - Rework TTY column to be more consistent across platforms
  - Make the CWD column generally available on all platforms
  - Add Performance Co-Pilot (PCP) platform support
    This is added via a separate pcp-htop(1) binary which provides remote host
    analysis, new Meters for any PCP metric and new Columns for any PCP process
    metric - see the pcp-htop(5) man page for further details.
  - Add Linux columns and key bindings for process autogroup identifier
    and nice value
  - Change available and used memory reporting on Linux to be based on
    MemAvailable (Kernel 3.14+)
  - Add a new SysArchMeter showing kernel and platform information
  - Linux memory usage explicitly treats tmpfs memory usage as shared memory
    This is to make memory used by tmpfs visible as this cannot be freed
    unlike normal filesystem cache data.
  - Exclude zram devices when calculating DiskIO on Linux
  - Use PATH lookup for systemctl in systemd meter
  - Add native platform support for NetBSD
    This allows htop to run on NetBSD without the need for active Linux
    emulation of the procfs filesystem.
  - Add NetworkIO, DiskIO, CPU frequency, and battery meter support on NetBSD
  - Fix NetBSD display of in-use and cached memory
  - Rework NetBSD CPU and memory accounting
  - Fix NetBSD accounting of user and kernel threads
  - Initial work to allow building with default libcurses on NetBSD
  - FreeBSD updates - implement process majflt and processor column values
  - Add FreeBSD support for CPU frequency and temperature
  - Fixes and cleanups for ZFS Meters and metrics
  - Correctly color the ZFS ARC ratio
  - Bugfixes related to CPU time display/calculations for darwin on M1 systems
  - Harmonize the handling of multiple batteries across different platforms.
    The system is now considered to run on AC if at least one power supply
    marked as AC is found in the system.
    Battery capacity is summed up over all batteries found.
    This also changes the old behavior that batteries reported by the
    system after the first AC adapter where sometimes ignored.
  - Correctly handle multiple batteries on Darwin.
    Resolves a possible memory leak on systems with multiple batteries.
  - Handle Linux Shmem being part of Cached in the MemoryMeter
  - Add SwapCached to the Linux swap meter
  - Convert process time to days if applicable
  - Always show the number of threads in the TaskMeter, even when threads
    are not shown in the process list
  - Fix Linux --drop-capabilities option handling
  - Correctly detect failure to initialize Linux boottime
  - Overhaul the Linux memory fields to partition them like free(1) now does
  - Improve the Linux process I/O column values
  - Rework the libsensors parsing on Linux
  - Update the MemoryMeter to display shared memory
  - Update OpenBSD platform - implement additional columns, scan LWP,
    proper markup for STATE, show CPU frequency
  - Fix the tree view on OpenBSD when hiding kernel threads
  - Remove old InfoScreen lines before re-scanning
  - Document historic naming of Light-Weight Processes column aka threads
  - Improve user interaction when the last process entry is selected
  - Draw the panel header on the TraceScreen
  - Add mouse wheel scroll and fix mouse selection on the InfoScreen
  - Add a HugepageMeter and subtract hugepages from normal memory
  - Display wide characters in LED meters and restore non-wide ncurses support
  - Add command line option to drop Linux capabilities
  - Support scheduler affinity on platforms beyond Linux
  - Report on any failure to write the configuration file
  - Cache stderr to be able to print assert messages.
    These messages are shown in case htop terminates unexpectedly.
  - Print current settings on crash
  - Reset signal handlers on program exit
  - Add configure script option to create a static htop binary
  - Resolved longer-standing compilation issues on Solaris/Illumos
  - Check for availability of set_escdelay in configure
  - Build system updates for autotools 2.70


author: Anton Novojilov <andy@essentialkaos.com> - 3.1.1-0
changelog:
  - Update license headers to explicitly say GPLv2+
  - Document minimum version for libcap
  - Fix mouse wheel collision with autogroups nice adjustment
  - Adjust Makefile.am macro definitions for older automake versions
  - Ensure consistent reporting of MemoryMeter 'used' memory
  - Report hugepage memory as real and used memory (as before)
  - Handle procExeDeleted, usesDeletedLib without mergedCommandline mode
  - Validate meter configuration before proceeding beyond htoprc parsing
  - Properly release memory on partially read configuration
  - Handle interrupted sampling from within libpcp PDU transfers
  - On Linux, provide O_PATH value if not defined
  - On Linux, always compute procExeDeleted if already set
  - Workaround for Rosetta 2 on Darwin
  - Fix FreeBSD cmdline memory leak in Process_updateCmdline, and
  - Plug a Disk I/O meter memory leak on FreeBSD


author: Anton Novojilov <andy@essentialkaos.com> - 3.1.2-0
changelog:
  - Bugfix for crash when storing modified settings at exit
  - Generate xz-compressed source tarball (with configure) using github actions
  - Allow -u UID with numerical value as argument
  - Added documentation for obsolete/state libraries/program files highlighting
  - Some obsolete/stale library highlighting refinements
  - Column width issues resolved
  - Dynamic UID column sizing improved
  - Discard stale information from Disk and Network I/O meters
  - Refined Linux kernel thread detection
  - Reworked process state handling
  - New CCGROUP column showing abbreviated cgroup name
  - New OFFSET column in the list of open files screen


author: Anton Novojilov <andy@essentialkaos.com> - 3.2.0-0
changelog:
  - Support for displaying multiple tabs in the user interface
  - Allow multiple filter and search terms (logical OR, separate by "|")
  - Set correct default sorting direction (defaultSortDesc)
  - Improve performance for process lookup and update
  - Rework the IOMeters initial display
  - Removed duplicate sections on COMM and EXE
  - Highlight process UNINTERRUPTIBLE_WAIT state (D)
  - Show only integer value when CPU% more than 99.9%
  - Handle rounding ambiguity between 99.9 and 100.0%
  - No longer leaves empty the last column in header
  - Fix header layout and meters reset if a header column is empty
  - Fix PID and UID column widths off-by-one error
  - On Linux, read generic sysfs batteries
  - On Linux, do not collect LRS per thread (it is process-wide)
  - On Linux, dynamically adjust the SECATTR and CGROUP column widths
  - On Linux, fix a crash in LXD
  - On FreeBSD, add support for showing process emulation
  - On Darwin, lazily set process TTY name
  - Always set SIGCHLD to default handling
  - Avoid zombie processes on signal races
  - Ensure last line is cleared when SIGINT is received
  - Instead of SIGTERM, pre-select the last sent signal
  - Internal Hashtable performance and sizing improvements
  - Add heuristics for guessing LXC or Docker from /proc/1/mounts
  - Force elapsed time display to zero if process started in the future
  - Avoid extremely large year values when printing time
  - Fix division by zero when calculating IO rates
  - Fix out of boundary writes in XUtils
  - Fix custom thread name display issue
  - Use AC_CANONICAL_HOST, not AC_CANONICAL_TARGET in configure.ac
  - Support libunwind of LLVM


author: Anton Novojilov <andy@essentialkaos.com> - 3.2.1-0
changelog:
  - Fix setting to show all branches collapsed by default
  - Restore functionality of stripExeFromCmdline setting
  - Fix some command line display settings not being honored without restart
  - Display single digit precision for CPU% greater than 99.9%
  - On Linux, FreeBSD and PCP consider only shrinkable ZFS ARC as cache
  - On Linux, increase field width of CPUD% and SWAPD% columns
  - Colorize process state characters in help screen
  - Use mousemask(3X) to enable and disable mouse control
  - Fix heap buffer overflow in Vector_compact
  - On Solaris, fix a process time scaling error
  - On Solaris, fix the build
  - On NetBSD, OpenBSD and Solaris ensure env buffer size is sufficient
  - On Linux, resolve processes exiting interfering with sampling
  - Fix ProcessList quadratic removal when scanning processes
  - Under LXC, limit CPU count to that given by /proc/cpuinfo
  - Improve container detection for LXC
  - Some minor documentation fixes


author: Anton Novojilov <andy@essentialkaos.com> - 3.2.2-0
changelog:
  - CPUMeter now can show frequency in text mode
  - Add option to render distribution path prefixes shadowed
  - DiskIOMeter converts to bytes per second (not per interval)
  - DiskIOMeter uses complete units, including missing "iB/s"
  - DiskIOMeter indicates read and write in meter mode
  - NetworkIOMeter converts to packets per second, shows packet rate
  - Allow continued process following when changing display settings
  - Update the panel header when changing to another tab
  - Drop margin around the header if there are no meters
  - Use Unicode replacement character for non-printable characters
  - Default color preset uses bold blue for better visibility
  - Update the Panel header on sort order inversions ('I')
  - Toggle the header meters with pound key
  - Fix ScreenPanel to handle quitting the panel while renaming
  - Add fallback for HOME environment variable using passwd database
  - Replace meaningless ID column with FD column in lock screen
  - Use device format in the lock screen matching the files screen
  - On Linux, improvements to file-descriptor lock detection
  - On Linux, further distinguish systemd states in the SystemdMeter
  - On Linux, improvements to cgroup and container identification
  - On Linux, support openat(2) without readlinkat(2) platforms
  - On Darwin, fix current process buffer handling for busy systems
  - On DragonFly BSD, fix incorrect processor time of processes
  - On FreeBSD, fix an issue with the memory graph not showing correctly
  - On FreeBSD, add support for displaying shared memory usage
  - On PCP, use pmLookupDescs(3) if available for efficiency
  - On PCP, normalize generic columns values for consistent display
  - On PCP, changes preparing for configurable, dynamic screens
  - Handle invalid process columns from the configuration file
  - Avoid undefined behaviour with deeply nested processes
  - Fix crash when removing the currently active screen
  - Prevent possible crash on a very early error path
  - Include automake for Debian/Ubuntu
  - Restore non-mouse support
  - Reject unsupported command line arguments
  - Document idle process state
  - Clarify M_TRS/M_DRS columns


author: Anton Novojilov <andy@essentialkaos.com> - 3.3.0-0
changelog:
  - Multiple refactorings and code improvements
  - Shorten docker container IDs to 12 characters
  - Settings: preserve empty header
  - Fix execlp() argument without pointer cast
  - OpenFilesScreen: Make column sizing dynamic for file size, offset and inode
  - Add support for "truss" (FreeBSD equivalent of "strace")
  - Darwin: add NetworkIOMeter support
  - HeaderLayout: add "3 columns - 40/30/30", "... 30/40/30" & "... 30/30/40"
  - Meter: use correct unicode characters for digit '9'
  - Note in manual re default memory units of KiB
  - Add column for process container name
  - Add logic to filter the container name (+type) from the CGroup name
  - Change NetworkIOMeter value unit from KiB/s to bytes/second
  - Cap DiskIOMeter "utilisation" percentage at 100%
  - PCP platform implementation of frontswap and zswap accounting
  - Shorten podman/libpod container IDs to 12 characters
  - Write configuration to temporary file first
  - Incorporate shared memory in bar text
  - Move shared memory next to used memory
  - Correct order of memory meter in help
  - Add recalculate to Ctrl-L refresh
  - Update process list on thread visibility toggling
  - Support dynamic screens with 'top-most' entities beyond processes
  - Introduce Row and Table classes for screens beyond top-processes
  - Rework ZramMeter and remove MeterClass.comprisedValues
  - More robust logic for CPU process percentages (Linux & PCP)
  - Show year as start time for processes older than a year
  - Short-term fix for docker container detection
  - default color preset: use bold blue for better visibility
  - Document 'O' keyboard shortcut
  - Implement logic for '--max-iterations'
  - Update F5 key label on tab switch (Tree <-> List)
  - Force re-sorting of the process list view after switching between
    list/treeview mode
  - Linux: (hack) work around the fact that Zswapped pages may be SwapCached
  - Linux: implement zswap support
  - {Memory,Swap}Meter: add "compressed memory" metrics
  - Darwin: add DiskIOMeter support
  - Fix scroll relative to followed process
  - ZramMeter: update bar mode
  - Use shared real memory on FreeBSD
  - Increase Search and Filter max string length to 128
  - Improve CPU computation code
  - Remove LXC special handling for the CPU count
  - Create new File Descriptor meter
  - PCP: add IRQ PSI meter
  - Linux: add IRQ PSI meter
  - Linux: highlight username if process has elevated privileges
  - Add support for scheduling policies
  - Add a systemd user meter to monitor user units.
  - FreeBSD: remove duplicate zfs ARC size subtraction


author: Anton Novojilov <andy@essentialkaos.com> - 1.8.0-0
changelog:
  - Updated unicode test file (input-3)
  - Allow testing installed version
  - Allow importing as a module
  - Minor deduplication tweak to git-icdiff
  - Add pip instructions to readme
  - Allow using --tabsize
  - Allow non-recursive directory diffing


author: Anton Novojilov <andy@essentialkaos.com> - 1.9.3-0
changelog:
  - Add --exclude-lines (-E) which can exclude comments
  - Add --color-map so you can choose which colors to use for what
  - Allow highlighted characters to be bold
  - Support configuring git-icdiff with gitconfig
  - Don't choke on bad terminal sizes
  - Print proper error messages instead of raising exceptions
  - Allow the line numbers to be colorized
  - Add a LICENSE file


author: Anton Novojilov <andy@essentialkaos.com> - 1.9.5-0
changelog:
  - Error handling: unknown encoding
  - pipes: stop printing an error when pipes close
  - git-icdiff: start search for pager in icdiff.pager
  - fix: fix the unknown option 'default' error when call git config
  - feat: show the real file name when displaying git diff result
  - fix FIRST_TIME_CHECK_GIT_DIFF
  - options parsing: fall back to 80 columns on errors, and clean things up


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.0.kh12-0
changelog:
  - Fix up some incorrect or stale block cases from previous release for non-ogg
    streams. Usually cause by short write triggers or queue jumps.
  - Change default charset for non-ogg streams to utf8 instead of latin1, you can
    still use latin1 either with <charset> mount setting or charset= query param
    to metadata.
  - Global listeners count could get messed up with fallback to files, also make
    it a regular update stat in-line with other global stats.
  - Avoid possible crash case on log re-opening, not so common.


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.0.kh13-0
changelog:
  - Fix an annoying race case. memory corruption in certain cases that are hard
    to trigger normally but typically involes a listener disconnecting in certain
    conditions.
  - Tightened up use-after-free cases with regard to the queue pruning.
  - Leak fixes with intro via auth.
  - Allow seconds to be specified in burst and queue size fields. Just specify
    the number followed by s eg 30s or 5s. Eventually we could make this the
    default so that is can apply to various bitrates.
  - Small minor cleanups across the board.


author: Anton Novojilov <andy@essentialkaos.com> - 2.4.0.kh14-0
changelog:
  - Fixed bug with logs rotation.
  - Allow for using secs (eg 5s) in queue/min-queue/burst measures.
  - Allow multiple icy sources on same port. Just embed in password a
    mountpoint:pass. The shoutcast-mount tag still creates the +1 port and sets
    a default mountpoint but source can override this.
  - Fix log issue which could cause a deadlock if on-[dis]connect or auth cmd
    are used.
  - Allow configure to accept ICY_CHARSET to set alternate in build. The default
    ICY metadata is assumed to be UTF8, but some sites still have issues with
    setting tags or parameters, so allow a different default if they need it.
  - Regression on FLV wrapped aac metadata fixed.
  - Crash/corruption fix if using stream auth and metadata updates via admin.
  - Fix for glibc rwlock priority.
  - Added the icy-metadata in headers allowed with CORS.
  - Rework XFF to be earlier, useful in cases where banned IPs apply.
  - Allow wildcards in XFF.
  - Drop the BSD NOPUSH setting for now. Have seen poor performance because of
    it in certain cases.
  - Openssl API cleanups. eg API differences between versions.
  - Various small fixes, build and operational.


author: Anton Novojilov <andy@essentialkaos.com> - 1.6.0-0
changelog:
  - Allow to use custom memory management functions for loaded images
  - Add __imlib_LoadImageWrapper() handling all load() calls
  - imlib2_conv: Report error on save failure
  - Autofoo cosmetics
  - Trivial cleanups in imlib2_... test programs
  - Add imlib2_test_load program
  - Cleanups in load() functions
  - Centralize handling of im->format
  - Sort loaders in Makefile.am
  - Remove obsolete dmalloc stuff
  - Move SWAP.. macro definitions to common.h
  - Use common PIXEL_ARGB() macro to compose pixels
  - Add new ICO loader
  - Spec file simlifications and cleanups
  - Fix memory leak in imlib_list_fonts()
  - XPM loader: Refactor exit cleanup handling
  - XPM loader: Fix potentially uninitialized pixel data
  - XPM loader: Fixup after "Refactor exit cleanup handling"
  - Revert "XPM loader: Fix potentially uninitialized pixel data"
  - XPM loader: Cosmetics (reduce indent level)
  - XPM loader: Fix several colormap issues
  - XPM loader: Simplify pixel value handling
  - XPM loader: Add missing pixels (malformed xpm)
  - XPM loader: More simplifications
  - JPG loader: Refactor
  - JPG loader: Do proper CMYK conversion
  - Add new WebP loader
  - Remove pointless im->data checks in loaders
  - WepP loader: Fix memory leak in error path
  - JPG loader: Fix memory leaks in error paths
  - Fix ABI break
  - ICO loader: Add binary flag to fopen()
  - JPG loader: Refactor error handling
  - Rename/add byte swap macros
  - BMP loader: Major makeover - numerous bug fixes and feature enhancements
  - Miscellaneous imlib_test_load tweaks
  - GZIP loader: Check filename before uncompress
  - imlib2_test_load: Fixup after recent change
  - Re-indent everything using indent-2.2.12
  - TGA loader: Refactor
  - Eliminate WRITE_RGBA()
  - Simplify autogen.sh
  - Simplify pixel color handling in api.c
  - Use pixel instead of r,b,g,a in __imlib_render_str()
  - Use macro for pixel color access in savers
  - Eliminate READ_RGBA()
  - XPM loader: Accept signature not at the very start of the file
  - Simplify loader lookup functions
  - imlib2_view: Enable selecting next/prev using keys too
  - imlib2_view: Fix event processing bug
  - imlib2_test_load: Fixup recent breakage for real
  - imlib2_test_load: Check progress conditionally
  - imlib2_view: Add verbose option, quit on Escape too
  - TGA loader - Mostly cosmetic refactoring
  - TGA loader: More mostly cosmetic changes
  - TGA loader: Support horiontal flip
  - TGA loader: Add simple 16 bpp handling
  - TGA loader: Tweak error handling
  - ICO loader: Fix non-immediate loading
  - Remove __imlib_AllocateData() w,h args
  - imlib2_view: Fix next/prev selection if last/first image is bad
  - ICO loader: Fix memory leak in error path
  - XPM loader: Correct signature check (avoid accessing unset data)
  - gz, bz2 loaders: Simplify, eliminate unnecessary strdups, cosmetics
  - Check filename before opening archive file.
  - tga loader: implement handling of palette


author: Anton Novojilov <andy@essentialkaos.com> - 1.6.1-0
changelog:
  - gz loader: Use FILE, not fd
  - gz, bz2 loaders: Fix recent breakage when file name has more than two dots
  - Quit on 'q' or 'esc' key press in all imlib2_... test utilities
  - Rename imlib2_test_load to imlib2_load
  - imlib2_load: Optionally write to stderr instead of stdout
  - imlib2_view: Add progress debug options
  - Enable specifying loader/filter paths with environment variables
  - BMP loader: Remove some bogus conditions
  - XPM loader: Minor optimization for cpp > 2
  - LBM loader: Fix header-only loading
  - BMP loader: Fix size calculation when saving files


author: Anton Novojilov <andy@essentialkaos.com> - 1.7.0-0
changelog:
  - GIF loader: Don't close file descriptor twice
  - Introduce imlib_load_image_from_fd()
  - Don't rescan loaders
  - XPM loader: Major speedup for cpp > 2
  - imlib2_load: Properly check non-full loads (load data too)
  - imlib2_load: Use getopt()
  - imlib2_load: Add repeated load option
  - Simplify __imlib_FileExtension()
  - Refactor many __imlib_File...() functions to use common __imlib_FileStat()
  - Drop the __imlib_IsRealFile() file check in __imlib_File...() functions
  - image.c: Add some space for readability
  - image.c: Remove some unnecessary clearing of calloc'ed structs
  - image.c: Rework some obscure file name stuff in __imlib_SaveImage()
  - image.c: Don't strdup() real_name when not necessary in __imlib_LoadImage()
  - image.c: Use real_file to get file time
  - image.c: Introduce __imlib_ErrorFromErrno()
  - image.c: Use loader return value, not im->w to determine load success
  - Loader cleanups
  - Saver cleanups
  - image.c/h: Cleanups
  - image.c: Move image tag functions to separate file
  - image.c: Move loader functions to separate file
  - image.c: Enable non-dirty pixmap cache cleaning
  - image.c: Minor refactoring of pixmap cache cleaners
  - image.c: Move data_memory_func assignment to better place
  - imlib2_view: Various tweaks
  - Fix loader cleanup breakage (gif)
  - image.c: Remove redundant pixmap unref
  - image.c: Add infrastructure to simplify progress handling
  - Loaders: Simplify/fix progress handling
  - Savers: Simplify progress handling
  - Introduce __imlib_LoadEmbedded()
  - Introduce __imlib_LoaderSetFormats()
  - Make ImlibLoader struct opaque
  - autogen.sh: Add -n as alternative to NOCONFIGURE
  - Fix enum conversion warnings (gcc10)
  - JPG, PNG loaders: Avoid clobber warnings
  - Add a couple of consts
  - TIFF loader: Minor speedup
  - ID3 loader: Some mostly cosmetic rearrangements
  - GZ, BZ2 loaders: Accept more file names
  - __imlib_FileExtension: Use basename if there are no dots
  - Revert "JPG, PNG loaders: Avoid clobber warnings"
  - JPG, PNG loaders: Avoid clobber warnings - Take N+1
  - Add infrastructure for new loader entry - load2()
  - Move loaders to load2()
  - Reduce number of stat() calls during load
  - configure.ac: Drop initial config.cache removal
  - imlib2_load: Optionally use imlib_load_image_fd()
  - Fix build without X11
  - Remove a couple of unused includes
  - ICO loader: Do not crash on invalid files
  - ICO loader: Handle malloc failures


author: Anton Novojilov <andy@essentialkaos.com> - 1.9.1-0
changelog:
  - x11_color: Simplify and fix error paths
  - JPEG loader: Use mmap'ed file access
  - modules: Eliminate __imlib_TrimLoaderList()
  - Introduce strsplit()
  - modules: Cosmetics, mostly
  - modules: Enable setting multiple loader/filter paths
  - test: Add test_misc
  - modules: Fix signdness warning
  - TIFF loader: Change default save compression type
  - imlib2_load: Remove unused macro
  - imlib2_conv: Cosmetic changes
  - imlib2_conv: Drop obsolete .db stuff, simplify
  - imlib2_conv: Enable passing attached data to saver v1.9.1
  - check for some alloc failures
  - check for alloc failures some more
  - modules: check for filepath truncation


author: Anton Novojilov <andyone@fun-box.ru> - 0.20.0-0
changelog:
  - Added support of resources usage limits configuration (systemd feature)
  - Added support of kill mode configuration (systemd feature)


author: Anton Novojilov <andyone@fun-box.ru> - 0.21.0-0
changelog:
  - Migrated to ek.v10
  - Added support of memlock limit configuration
  - Fixed support of reload signal for Systemd


author: Anton Novojilov <andyone@fun-box.ru> - 0.22.0-0
changelog:
  - Added 'start_on_device' option for v2 procfile format
  - Dropped 'reload_signal' support for Upstart ≤ 1.10.0
  - Fixed 'reload_signal' support for Systemd


author: Anton Novojilov <andyone@fun-box.ru> - 0.23.0-0
changelog:
  - Migrated to ek.v12
  - Migrated to go-simpleyaml.v12
  - Added support of required dependencies definition
  - Added option 'strong_dependencies' for strong dependencies configuration (for
    using 'Requires' instead of 'Wants' for systemd units)
  - Added option 'resources:cpu_affinity' for CPU affinity configuration


author: Anton Novojilov <andyone@fun-box.ru> - 0.24.0-0
changelog:
  - Added respawn delay configuration
  - Improved systemd dependencies configuration
  - Minor UI improvements
  - Code refactoring


author: Anton Novojilov <andy@essentialkaos.com> - 5.2.0-0
changelog:
  - Implement oversize_threshold, which uses a dedicated arena for allocations
    crossing the specified threshold to reduce fragmentation.
  - Add extents usage information to stats.
  - Log time information for sampled allocations.
  - Support 0 size in sdallocx.
  - Output rate for certain counters in malloc_stats.
  - Add configure option --enable-readlinkat, which allows the use of readlinkat
    over readlink.
  - Add configure options --{enable,disable}-{static,shared} to allow not building
    unwanted libraries.
  - Add configure option --disable-libdl to enable fully static builds.
  - Add mallctl interfaces.
  - Update MSVC builds.
  - Workaround a compiler optimizer bug on s390x.
  - Make use of pthread_set_name_np(3) on FreeBSD.
  - Implement malloc_getcpu() to enable percpu_arena for windows.
  - Link against -pthread instead of -lpthread.
  - Make background_thread not dependent on libdl.
  - Add stringify to fix a linker directive issue on MSVC.
  - Detect and fall back when 8-bit atomics are unavailable.
  - Fall back to the default pthread_create(3) if dlsym(3) fails.
  - Refactor the TSD module.
  - Avoid taking extents_muzzy mutex when muzzy is disabled.
  - Avoid taking large_mtx for auto arenas on the tcache flush path.
  - Optimize ixalloc by avoiding a size lookup.
  - Implement opt.oversize_threshold which uses a dedicated arena for requests
    crossing the threshold, also eagerly purges the oversize extents. Default
    the threshold to 8 MiB.
  - Clean compilation with -Wextra.
  - Refactor the size class module.
  - Refactor the stats emitter.
  - Optimize pow2_ceil.
  - Avoid runtime detection of lazy purging on FreeBSD.
  - Optimize mmap(2) alignment handling on FreeBSD.
  - Improve error handling for THP state initialization.
  - Rework the malloc() fast path.
  - Rework the free() fast path.
  - Refactor and optimize the tcache fill / flush paths.
  - Optimize sync / lwsync on PowerPC.
  - Bypass extent_dalloc() when retain is enabled.
  - Optimize the locking on large deallocation.
  - Reduce the number of pages committed from sanity checking in debug build.
  - Deprecate OSSpinLock.
  - Lower the default number of background threads to 4 (when the feature is
    enabled).
  - Optimize the trylock spin wait.
  - Use arena index for arena-matching checks.
  - Avoid forced decay on thread termination when using background threads.
  - Disable muzzy decay by default.
  - Only initialize libgcc unwinder when profiling is enabled.
  - Fix background thread index issues with max_background_threads.
  - Fix stats output for opt.lg_extent_max_active_fit.
  - Fix opt.prof_prefix initialization.
  - Properly trigger decay on tcache destroy.
  - Fix tcache.flush.
  - Detect whether explicit extent zero out is necessary with huge pages or
    custom extent hooks, which may change the purge semantics.
  - Fix a side effect caused by extent_max_active_fit combined with decay-based
    purging, where freed extents can accumulate and not be reused for an
    extended period of time.
  - Fix a missing unlock on extent register error handling.


author: Anton Novojilov <andy@essentialkaos.com> - 5.2.1-0
changelog:
  - Fix a severe virtual memory leak on Windows. This regression was first
    released in 5.0.0.
  - Fix size 0 handling in posix_memalign(). This regression was first released
    in 5.2.0.
  - Fix the prof_log unit test which may observe unexpected backtraces from
    compiler optimizations. The test was first added in 5.2.0.
  - Fix the declaration of the extent_avail tree. This regression was first
    released in 5.1.0.
  - Fix an incorrect reference in jeprof. This functionality was first released
    in 3.0.0.
  - Fix an assertion on the deallocation fast-path. This regression was first
    released in 5.2.0.
  - Fix the TLS_MODEL attribute in headers. This regression was first released
    in 5.0.0.
  - Implement opt.retain on Windows and enable by default on 64-bit.
  - Optimize away a branch on the operator delete path.
  - Add format annotation to the format generator function.
  - Refactor and improve the size class header generation.
  - Remove best fit.
  - Avoid blocking on background thread locks for stats.
  - Added CRC check for all sources.


author: Anton Novojilov <andy@essentialkaos.com> - 2.14.0-0
changelog:
  - Fixed bug with searching PID
  - Removed unclear part with exiting from script inside kv.error method


author: Anton Novojilov <andy@essentialkaos.com> - 2.14.1-0
changelog:
  - Fixed bug with lack of exiting from script on error
  - Fixed bug with help content output
  - Code refactoring


author: Anton Novojilov <andy@essentialkaos.com> - 2.15.0-0
changelog:
  - Brand new PID searching system which works without search pattern
  - Print error if user try to source init script (e.g . script)
  - Fixed bug with searching real username in tmux session


author: Anton Novojilov <andy@essentialkaos.com> - 2.17.0-0
changelog:
  - Added backward compatibility with systemd for start, stop and restart commands
  - Removed deprecated consoletype usage
  - Improved colors support check
  - Added NO_COLOR support
  - Code refactoring


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.8-0
changelog:
  - Improve identifing interface as macvlan when reading interface details
  - Enslave a VMAC to the VRF master of the underlying interface.
  - Use addattr32 rather than addattr_l for if_index.
  - Only include VRF support if kernel headers support it.
  - Fix --enable-timer-debug configure option.
  - Fix some configure.ac enable option tests.
  - Include stdbool.h in process.c.
  - Fix diagnostic message re ignoring weight of tracked interface.
  - Fix track_bfds with weights.
  - Correct conditional compilation definition name.
  - Fix memory leak in HTTP_GET/SSL_GET.
  - Fix two memory leaks in DNS_CHECK.
  - Don't consider retries for BFD_CHECK. The BFD_CHECKer doesn't support
    retries, and the check was causing the checker not to transition to
    down state.
  - Fix memory leak with BFD_CHECK.
  - Restart global notify FIFO handler after reload.
  - modify @WITH_REGEX@ to @WITH_REGEX_TRUE@
  - Fix compiling without BFD support.
  - Stop bfd process sending double the number of packets.
    If a bfd process received an initial bfd packet, it scheduled a
    second bfd_sender_thread thereby causing two packets to be sent
    in every interval.
  - Use timerfd for select timeouts rather than select timeout parameter
    This is a precursor to moving to using epoll.
  - Use epoll rather than select.
    epoll is both more efficient than select and also doesn't have a
    file descriptor limit of 1024, which limited the number of vrrp
    instances that could be managed.
    This commit also introduces read-black trees and the list_head
    list type.
  - Add --enable-timer-check option for logging calls for getting time
    Calls to update the current time from the kernel are made too
    frequently, and this patch logs when the calls are made, and how
    long since the previous call, so unnecessary calls can be removed.
  - Add debug option for monitoring epoll queues.
    This is enabled by --enable-epoll-debug and replaces
    --enable-timer-debug.
  - Use system monotonic clock to generate a monotonic clock.
    Rather than have our own code for creating a monotonic clock, use
    the kernel's monotonic clock.
  - Make some functions in timer.c inline.
    The functions had one line of code so inlining them is more
    efficient.
  - Fix requeueing read and write threads after read/write timeouts.
  - Fix initial allocating and final freeing of thread_master epoll_events.
  - When cleaning up threads, also clean up their thread_events.
  - Add thread_close_fd() function to release thread_event_t on close
    When a file descriptor that has been monitored by epoll is closed
    the thread_event_t structure used for managing epoll for that fd
    has to be release. Therefore calls to close() and replace by calls
    to thread_close_fd().
  - Make parent process write log entry when it is reloading.
  - Move checking for thread timeouts to timerfd_handler
    There is no point in checking for thread timeouts if the timerfd
    isn't readable; in other words only check for thread timeouts if
    the timer has expired.
  - Make bfd reschuling timer threads more efficient.
  - Streamline DNS_CHECK code.
  - Fix buffer overrun with track file path names.
  - Add timestamp when writing mem_check entries to file.
  - Ensure thread_event_t released for ready threads at termination.
  - Increase open file limit if large number of VRRP instances.
    Each VRRP instance can use up to 2 file descriptors, and so if there
    are more than 500 ish VRRP instances the number of open files
    can exceed the default per process limit (1024 on my system).
    The commit allows 2 file descriptors per vrrp instance plus a few more,
    and if the RLIMIT_NOFILE value returned by getrlimit isn't high enough,
    keepalived will increase the limit.
  - Ensure that child processes run with standard priorities/limits.
    When child processes such as notify scripts, track_scripts and
    MISC_CHECK scripts are run, they should not inherit any elevated
    priorities, system limits etc from the parent keepalived process.
  - Change multiple spaces to tabs in scheduler.h.
  - Add family to sockpool listing.
  - Fix a multiline definition expansion issue.
  - Free allocated cache when closing/freeing netlink socket.
    When running on a system with 500+ interfaces configured and adding
    1000 VMAC interfaces, the heap was growing by 340Mb due the netlink
    cahce not being freed after creating each VMAC interface. With this
    patch the heap only grow by 3.7Mb (if creating 1000 VMAC interfaces
    the heap grep by 905Mb now reduced to 6.1Mb).
  - Stop using netlink cache when adding and configuring VMAC interfaces.
    When running on a system with 500+ interfaces configured and adding
    1000 VMAC interfaces, it was taking 2.3 seconds to add the interfaces.
    Without populating a netlink cache each time a VMAC interface is created
    it now takes 0.38 seconds to add the interfaces (if creating 1000 VMAC
    interfaces it was taking 6.1 seconds, now reduced to 0.89 seconds, and
    the heap growth is reduced from 6.1Mb to 3.9Mb).
  - Add function rtnk_link_get_kernel for dynamic linking.
  - Fix compiling without JSON support.
  - Add support for recording perf profiling data for vrrp process.
  - Add comment re usage of MAX_ALLOC_LIST.
  - Some streamlining of scheduler.c.
  - Merge --enable-epoll-debug and --enable-dump-threads functionality.
  - Let thread_add_unuse() set thread type, and use thread_add_unuse() more.
  - Use break rather than return in process_threads().
  - Fix segfault when reloading with HTTP_GET and no regex configured.
  - Merge the next-generation scheduler.
  - Make all debug options need enabling at runtime.
    Previously if configure enabled a debug option its output was always
    recorded, which meant that if one didn't want the output, configure/
    compile was needed. This commit adds command line options that need to
    be set in order to turn the debugging on.
  - Remove unwanted debug message.
  - Fix parsing --debug options.
  - Fix rb tree insertion with timers.
  - Add missing functions for thread debugging.
  - Add vrrp instance VMAC flags when dumping configuration.
  - Ensure parent thread terminates if child has permanant config error.
  - Ensure don't delete VMAC interface if keepalived didn't create it.
    and sundry fixes.
  - If receive lower priority advert, send GARP messages for sync group.
    A recent update to issue #542 identified that following recovery
    from a split brain situation, GARP messages weren't being sent. It
    transpired that, if a member of a sync group in master state received
    a lower priority advert and vrrp_higher_prio_send_advert is set, a
    further (lower priority) advert is sent, and the instance and all the
    members of the sync group transition to backup (the other members of
    the sync group don't send a further advert since they haven't received
    a higher priority advert). This meant that the other members of the
    sync group on the keepalived instance that remained master didn't
    receive a lower priority advert, and so didn't send further GARP
    messages.
    This commit changes keepalived's behaviour, so that if a vrrp instance
    is sending GARP messages due to receiving a lower priority advert
    and it is a member of a sync group, keepalived will also send GARP
    messages for any other member of the sync group that have
    garp_lower_prio_rep set.
  - Allow 0.0.0.0 and default/default6 for rule/route to/from addresses.
  - Check return value of SSL_CTX_new().
  - Check return values of SSL_new() and BIO_new_socket().
  - Only allow subnet masks with routes or virtual IP addresses.
    For example, if specifying a via address or preferred source address
    for a route, it isn't valid to specify a subnet mask.
  - Add inet/inet6 to specify ip route/rule family if ambiguous.
  - Remove superfluous parameter from parse_route().
  - Add "any" and "all" as synonyms for "default".
  - Fix memory leak if route destination address is wrong address family.
  - Add ttl-propagate route option.
  - Fix checking return status of kill().
  - Fix building with --enable-debug configure option.
  - Stop delay in reload when using network namespaces.
    If running in a network namespace, getaddrinfo() could take over
    30 seconds before timing out while trying to contact a name
    server. To alleviate this, the hostname is remembered from when
    keepalived started.
  - Fix spelling of propagate in propagate_signal().
  - Fix effective_priority after reload if tracked interface down.
  - Cosmetic grammatical changes.
  - Add debug option for dumping vrrp fd lists.
  - Fix calculation for vrrp fd timers.
    Starting or reloading keepalived when an interface that was tracked
    interface was failed was stopping other vrrp instances that were on
    the same interface but not using VMACs coming up.
  - Move code for initialising tracking priorities to vrrp_track.c.
  - Don't overwrite track file on reload.
  - Don't attempt to write track file if path not specified.
  - Fix compiling when not using --enable-vrrp-fd-debug.
  - Fix compiling with configure --enable-vrrp-fd-debug.
  - Add sync group track_bfds and track file status to config dump.
  - Move initialisation of track_files.
  - Don't alter effective_priority if track_file take vrrp instance down.
  - Don't log vrrp instance in fault state at reload if already fault.
  - Fix calculating fd timer if all vrrp sands are set to TIMER_DISABLED.
  - Don't make all sync groups transition to backup on reload
    If a sync group was in master state, and can still be after a reload
    then allow it to stay in master state.
  - Don't have track_bfd list in vrrp_sgroup_t in BFD not enabled.
  - Fix memory leak re vrrp_sgroup_t track lists.
  - Tidy up some freeing of MALLOC'd memory.
    Use FREE_PTR if it is not known if the pointer is valid, and don't
    clear the pointer afterr FREE/FREE_PTR since FREE does it anyway.
  - Add memory.c list size definition and move definition from memory.h.
  - Increase size of checksum value for MEM_CHECK.
  - Don't store checksum of memory allocation block. It can be calculated
    from the size, so do so.
  - Make the checksum for memory allocation blocks unsigned.
  - Use an enum for memory allocation block types.
  - Update comment re debug bit for memory detect error.
  - In memory alloc debug code report free or realloc for not alloc'd.
  - Allow for PIDs up to 2^22 (7 decimal digits).
  - Add function for dumping memory allocation while running.
  - Fix max memory allocation size calculations.
  - Fix reporting original and new file/line/func for realloc.
  - Check matching block for realloc is allocated.
    The same memory block may have been previously allocated and freed,
    so we need to make sure that the block we find is currently marked
    as allocated.
  - Use a new MEMCHECK struct for realloc overrun detected
    It was marking the allocated block as an overrun block, whereas it
    needs to be an allocated block, so use a new block to mark the
    overrun.
  - Tidy up working of a couple of memory allocation messages.
  - Use for loops rather than while blocks in memory allocation code.
  - Report number of mallocs and reallocs with MEMCHECK.
  - Attempt to log first free after double free in MEMCHECK.
  - Streamline use of buf/buffer in memory.c.
  - Always use first free entry in alloc_list for MEMCHECK.
  - Define MEMCHECK alloc_list size via configure.
  - Align keepalived_free() and keepalived_realloc().
  - Make char * const where possible for MEMCHECK.
  - Merge MEMCHECK keepalived_free() and keepalived_realloc().
    Most of the code was common between the two (or should have been),
    so it makes sense for them to use common code.
  - Ensure only relevant thread types run during shutdown.
  - Fix building without --enable-mem-check.
  - Use rbtree search for finding child thread on child termination.
    It was doing a linear search of the rbtree in timeout order. This
    commit adds another rbtree for child processes (vrrp track scripts
    and check_misc scripts), sorted by PID, to make the search by PID
    more efficient.
  - Make rbtree compare function thread_timer_cmp() more efficient.
  - Remove child_remover functionality - it was superfluous.
  - Fix checking that there are no duplicate vrrp instances configured
    The tuple {interface, family, vrid} must be unique. The check for
    this was being made completely incorrectly.
  - Delay creating vrrp notify FIFO.
  - Remove struct sockaddr_storage saddr from sock_t.
  - Use an rbtree for finding vrrp instance for received advert.
    Previously the code search a list of pointers to vrrp instances and
    looked for a matching fd and vrid. In order to optimise this, it was
    implemented using an mlist whose index was a hash of the fd and vrid.
    This commit changes the approach and uses an rbtree for each sock_t.
    Since the sock_t that the advert was received on is known, the rbtree
    search is only searching for a match on the vrid.
    Not only is this more efficient, but it is simpler, uses standard code,
    and reduces the code by over 60 lines.
  - Use an rbtree for finding vrrp instance for socket timeout.
    Previously the code search a list of pointers to vrrp instances and
    looked for matching file descriptor and sands < time_now. In order to
    optimise this, it was implemented using an mlist whose index was a hash
    of the fd.
    This commit changes the approach and uses a second rbtree for each sock_t.
    Since the sock_t that the timeout occurred on is known, the rbtree
    search is only searching for a match of the sands.
    Not only is this more efficient, but it is simpler, uses standard code,
    and reduces the code by over 220 lines.
  - Remove superfluous checks of rbtree node != NULL in rb_move().
  - Remove superfluous check of node != NULL in rb_next().
  - Update rbtree code to Linux 4.18.10.
  - Fix debug logging of sands timers before time_now.
  - Update rb_for_each_entry etc and rb_move to use rb_entry_safe.
    With the added definition of rb_entry_safe in the rbtree code
    updated to Linux 4.18.10, the refinition of rb_entry was reverted
    to the kernel definition. That meant that rb_for_each_entry,
    rb_for_eacn_entry_safe and rb_move neded to be updated to use
    rb_entry_safe rather than rb_entry.
  - Add support functions for rbtree rb_root_cached.
    This is in preparation for the use of rb_root_cached in the next
    patch.
  - Use cached rbtrees where the key is a timeval_t sands
    When the key of an rbtree is a timeval_t sands keepalived will frequently
    need to access the first node of the tree in order to calculate the next
    timeout. This applies to the read, write, child and timer threads queues,
    and also the vrrp queues on a sock_t.
    The use of cached rbtrees for these is ideal since it gives direct access
    to the first node of the queue.
  - Add thread_add_read_sands to avoid introducing timer errors.
    When using thread_add_read and the timeout was held as timeval_t,
    it was converted to and offset from time_now, and then converted
    back to a timeval_t, but time_now was updated, resulting in a
    slightly different value being used as the timeout. Using
    thread_add_read_sands() avoids the double conversion and results in the
    timeout being more accurate.
  - Replace NETLINK_TIMER with TIMER_NEVER.
    It makes the code easier to read, and since NETLINK_TIMER was defined
    to be TIMER_NEVER it doesn't change the functionality.
  - Handle preempt delays not expiring at same time on sync group
    If different vrrp instances in a sync group had preempt delays
    that expired at different times keepalived looped with very small
    to epoll_wait() until all preempt delays had expired, causing high
    CPU utilisation.
    Keepalived now reschedules vrrp instances with a delay of
    3 * advert_int + skew time while waiting for all vrrp instances in
    the sync group to expire their preempt delays.
  - Fix segfault when receive netlink message for default route added.
  - Move vrf_master_index into conditional compilation block.
  - Store interface macvlan type.
  - Make vrp_master_ifp point to self for VRF master interfaces.
  - Log if cannot create a VMAC due to existing interface with same name.
  - Handle delete/create of macvlan i/fs which aren't keepalived's.
  - Tidying up keepalived_netlink.c.
  - Handle VRFs changing on macvlan i/fs which have VMACs configured on them.
  - Fix recreating our VMACs if they are deleted.
  - Fix detecting address add/deletion from underlying i/f of our vmacs.
  - Don't use configured_ifp or base_ifp if not _HAVE_VRRP_VMAC_.
  - Distinguish between VMAC on real i/f and no VMAC on macvlan i/f
    If keepalived is configured to have a non VMAC interface on a macvlan
    interface, we want to use the macvlan interface rather than the
    underlying interface, whereas if we have a VMAC interface on a macvlan
    interface, we create the VMAC on the underlying interface of the macvlan.
  - Update duplicate VRID check where vrrp instance configured on macvlan.
    If a VRRP instance is configured on a macvlan interface, the duplicate
    VRID check needs to be done on the underlying interface.
  - Check for VRID conflicts when changeable interfaces are added
    For example, a vrrp instance could be configured on a macvlan, and
    that macvlan could be deleted and recreated with another base interface.
    The VRIDs in this case need to be checked for duplicates against the
    base interface, and so the VRID check needs to be done dynamically.
    In order to allow VRID conflicts to produce config errors at startup,
    by default keepalived assumes that there won't be interface movements
    as described above, and will only handle it if the global_defs option
    'dynamic_interfaces' is used along with the option 'allow_if_changes'.
  - Remove some comments inserted for tracking changes to code.
  - Fix building with --enable-debug configure option.
  - Check that '{'s and '}'s are balanced in the configuration file.
  - Allow more flexibility re placing of { and }.
  - Improve reporting additional '}'s in configuration.
  - Minor improvements re thread handling and cancellation.
  - Remove unused THREAD_IF_UP and THREAD_IF_DOWN.
  - Replace getpagesize() with sysconf(_SC_PAGESIZE).
  - Increase netlink receive buffer for dumps to 16KiB.
  - Dynamically set the netlink receive buffer size.
  - Sort out setting netlink receive buffer size.


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.9-0
changelog:
  - Fix updating a timer thread's timeout.
    Issue #1042 identified that the BFD process could segfault. This
    was tracked down to a timer thread which had already expired having
    its timeout updated by timer_thread_update_timeout().
    The sands timer should only be updated if the thread is on a waiting
    queue, and not if it has already timed out or it is unused.
  - Don't requeue read thread if it is not waiting.
    This update matches commit 09a2a37 - Fix updating a timer thread's
    timeout should.
  - Allow BFD instance to recover after send error.
    If sendto failed in bfd_send_packet(), the bfd instance was put into
    admin down state, but there was no means for the bfd instance to
    transition out of admin down state.
    This commit makes keepalived log the first instance of a sequence of
    failures to send a bfd packet, but does not bring the bfd instance down
    in case the error is a transient error. If the error is longer lasting,
    the remote system will timeout, transition to down state, and send a message
    saying it is down.
    Once the bfd instance can start sending again the bfd instance can now
    transition again to up state.
  - Make DGB definition use log_message() rather than syslog().
  - Fix building with --enable-debug configure option.
  - Start list of required kernel features in INSTALL file.
    Issue #1024 asked what kernel features are needed to support keepalived.
    The simple answer was that it isn't recorded anywhere, so this is a
    start of making a list of the features required.
  - Make list_remove() call list free function and add list_transfer().
    If an element is being removed from a list, the free function should
    be called.
    list_transfer() allows a list element to be moved from one list to
    another without freeing and reallocating the list element control
    information.
  - Add mem_check diagnostics re calling functions of list functions.
    When using mem_check, mallocs and frees were recorded against the
    list functions, and the originating functions weren't identified.
    This patch adds recording of the functions calling the list
    functions so that the originating function is identified.
  - Simplify the processing of comments in configuration files.
    This commit moves the handling (and removal) of comments to a
    single function (called from read_line()) which simplifies the
    processing of config files.
  - Add ~SEQ(start, step, end) config functionality
    Where a configuration has repeated blocks of configuration where
    the only thing that changes is a numeric value (e.g. for VRIDs
    from 1 to 255) this allows the block to be defined once, and a
    single line using ~SEQ can then generate all the blocks.
  - Use REALLOC when building a multiline definition.
    The code used to use MALLOC, strcpy() and FREE, but REALLOC can do
    all this for us.
  - Improve mem-check diagnostics.
    When using an allocation list of over 50,000 entries, it was quite slow
    searching thtough all the entries to find the matching memory allocation,
    and to find free entries. This commit changes to using malloc() to create
    entries, and a red-black tree to hold the entries. It also has a separate
    list of free entries.
    This commit also adds 4 more types of memory allocation error, and
    improves the consistency of the entries in the log files.
  - Don't attempt to delete VMAC when underlying interface is deleted.
    If the underlying interface of one of our vmacs is deleted, and we
    know the vmac has been deleted, don't attempt to delete it again.
  - Include master state in determining if vmacs are up or down
    Netlink doesn't send messages for a state change of a macvlan when
    the master device changes state, so we have to track that for
    ourselves.
  - Turn off parser debugging.
  - Make test/mk_if create iptables chains.
  - Handle interfaces not existing when keepalived terminates.
    If the underlying interface of a vmac we created has been deleted,
    the vmac will not exist so don't attempt to delete it again. Also,
    don't attempt to reset the configuration of the underlying interface.
  - Handle the underlying interface of a macvlan interface going up/down.
    The kernel doesn't send netlink messages for macvlans going up or
    down when the underlying interface transitions (it doesn't even
    update their status to say they are up/down), but the interfaces
    don't work. We need to track the state of the underlying interfaces
    and propagate that to the macvlan interfaces.
  - Fix duplicate value in track_t enum.
  - Fix check for matching track types.
  - Treat macvtap interfaces in the same way as macvlan interfaces.
  - Improve handling of interfaces not existing when keepalived starts.
  - Fix handling interface deletion and creation of vmacs on macvlan i/fs.
  - When interface created, open sockets on it if used by VRRP directly
    If an interface is created that has vrrp instances configured on it
    that don't use VMACs, or use vmac_xmit_base, then the raw sockets
    must be opened.
  - Force seeing a transition to up state when an interface is created.
  - Fix netlink remnant data error.
  - Add command line and configuration option to set umask.
    Issue #1048 identified that files created by keepalived are created
    with mode 0666. This commit changes the default to 0644, and also
    allows the umask to be specified in the configuration or as a command
    line option.
  - Fix compile warning introduced in commit c6247a9.
    Commit c6247a9 - "Add command line and configuration option to set umask"
    introduced a compile warning, although the code would have worked OK.
  - When opening files for write, ensure they aren't symbolic links.
    Issue #1048 identified that if, for example, a non privileged user
    created a symbolic link from /etc/keepalvied.data to /etc/passwd,
    writing to /etc/keepalived.data (which could be invoked via DBus)
    would cause /etc/passwd to be overwritten.
    This commit stops keepalived writing to pathnames where the ultimate
    component is a symbolic link, by setting O_NOFOLLOW whenever opening
    a file for writing.
    This might break some setups, where, for example, /etc/keepalived.data
    was a symbolic link to /home/fred/keepalived.data. If this was the case,
    instead create a symbolic link from /home/fred/keepalived.data to
    /tmp/keepalived.data, so that the file is still accessible via
    /home/fred/keepalived.data.
    There doesn't appear to be a way around this backward incompatibility,
    since even checking if the pathname is a symbolic link prior to opening
    for writing would create a race condition.
  - Make netlink error messages more meaningful.
  - Fix compiling without support for macvlans.
  - fix uninitialized structure.
    The linkinfo and linkattr structures were not initialized,
    so we should not expect that unexistant attributes are set
    to NULL. Add the missing memset().
  - fix socket allocation with dynamic interfaces.
    When there are several vrrp instance binding different interfaces that
    don't exist at startup, their ifindex is set to 0 in the sock. The
    function already_exist_sock() that lookup for an existing socket will
    always return the first sock because the ifindex is the same.
    Later, when an interface appears, the fd will be created for one
    instance, and all instances will wrongly use this fd to send the
    advertisments.
    Fix this by using the interface structure pointer instead of the
    ifindex as the key for sock lookup.
    The problem was identified by Olivier Matz
    who also provided a patch fixing the problem. This patch is a slight
    rework of Olivier's patch, better using the existing data structures
    that keepalived already holds.
  - When creating a macvlan interface, use AF_UNSPEC rather than AF_INET.
  - Stop using libnl for configuring interfaces.
    Since there is code to configure the interfaces using netlink without
    using libnl, there is no point in having code to do it using libnl.
  - Fix building on Centos 6.5.
  - Stop including some files not needed after libnl removal for i/fs.
  - Fix some compilation issues when building without vrrp support.
  - Stop using linbl for mcast group membership and setting rx buf sizes.
    Since there is code to handle multicast group membership and
    setting kernel netlink receive buffer sizes without using libnl,
    there is no point in having code to do it using libnl.
    This now means that the vrrp functionality no longer uses libnl.
  - Add some sanity checking of configure options.
    Certain invalid combinations of configure options could cause compile
    errors, e.g. --disable-vrrp --enable-vrrp-fd-debug. This commit ensures
    that invalid combinations aren't allowed, in order to stop the compile
    errors.
  - Fix invalid configuration combination caught by previous commit.
  - Use netlink to set/clear rp_filter on interfaces.
  - Fix configure for building without vrrp.
  - Actually update the .travis.yml file to fix the problem.
  - Fix conditional compilation re epoll-thread-dump debugging.
  - Update INSTALL file now no longer use libnl-route-3.
  - Stop cast to incompatible function type warnings from gcc 8.1.
  - Update snapcraft.yaml not to include libnl-route-3.
  - keepalived exit with non-zero exit code if config file not readable.
  - Allow specifying default config file at configure time.
  - Use keepalived define for exit code when malloc failure.
  - Fix configuring fixed interface type.
  - Add configuring keepalived default configuration file.
  - Fix return value in get_time_rtt() error path.
  - Update generation of git-commit.h.
  - snapcraft.yaml: Enable all sensible build options. Preserve build time
    version in the snap version. Expose genhash.
  - snapcraft.yaml: Build keepalived with Linux 3.13 headers.
  - snap: Add an install hook to make sure a keepalived configuration exists.
  - snap: Move the hooks to the correct location.
  - snap: Make sure /etc/keepalived exists.
  - Fix building with IP_MULTICAST_ALL in linux/in.h but not netinet/in.h
    Issue #1054 identified that configure was checking the definition of
    IP_MULTICAST_ALL in linux/in.h but including netinet/in.h, which also
    has the definition, but only from glibc 2.17.
    This commit creates a local definition (in lib/config.h) of IP_MULTICAST_ALL
    if it is defined in linux/in.h but not in netinet/in.h. The reason for
    this is that compiles using linux/in.h fail due to conflicting definitions.
  - Fix creating iptables tables in mk_if.
  - Update .travis.yml to use xenial.
  - Update .travis.yml to add --enable-regex option.
  - Tidy up .travis.yml file.
  - snap: Build multiple keepalived binaries.
  - Updated snapcraft builds to support multiple kernel versions.


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.10-0
changelog:
  - Fix compiling on Alpine Linux.
  - Stop printf compiler warning on Alpine Linux due to rlim_t.
  - manpage cosmetic.
  - Fix removing snmpd read threads when snmpd becomes unavailable.
  - Update to support libipset version 7.
  - Use ipset_printf for ipset messages so can go to log.
  - When opening files for write, ensure files can only be read by root.
    Issue #1048 referred to CVE-2018-19046 regarding files used for
    debugging purposes could potentially be read by non root users.
    This commit ensures that such log files cannot be opened by non root
    users.
  - Disable fopen_safe() append mode by default
    If a non privileged user creates /tmp/keepalived.log and has it open
    for read (e.g. tail -f), then even though keepalived will change the
    owner to root and remove all read/write permissions from non owners,
    the application which already has the file open will be able to read
    the added log entries.
    Accordingly, opening a file in append mode is disabled by default, and
    only enabled if --enable-smtp-alert-debug or --enable-log-file (which
    are debugging options and unset by default) are enabled.
    This should further alleviate security concerns related to CVE-2018-19046.
  - vrrp: add support to constant time memcmp.
    Just an update to use best practise security design pattern. While
    comparing password or hmac you need to ensure comparison function
    is time constant in order to figth against any timing attacks. We
    turn off potential compiler optimizations for this particular
    function to avoid any short circuit.
  - Make sure a non privileged user cannot read keepalived file output
    Ensure that when a file such as /tmp/keepalived.data is wriiten,
    no non privileged can have a previous version of that file already
    open, thereby allowing them to read the data.
    This should fully resolve CVE-2018-19046.


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.11-0
changelog:
  - Fix segfault while shutting down when SNMP activity occurs.
    Issue #1061 identified that keepalived could segfault when it
    shut down. It appears that this was caused by data being received
    on the file descriptors that the snmp agent requests keepalived
    to monitor with epoll(). Since the read threads weren't being
    processed during a shutdown, the first time an snmp fd was ready,
    keepalived discarded the read thread. The second time that fd became
    ready there was no thread to handle the fd, and, since the assert()
    statement was not compiled in, non existant data was queued to the
    thread ready queue.
    This commit changes the assert() calls to continue, so that non existant
    data is no longer queued to the thread ready queue.
  - While shutting down, continue to handle snmp agent fds.
    Since we don't shutdown the snmp connection until the very end of
    the shutdown process (we need to be able to send snmp traps), we
    should continue to handle the snmp fds on behalf of the snmp agent
    while shutting down.
  - Ensure snmp agent is in correct state when initialising/closing
    Make sure the snmp agent is not already initialised before
    initialising it, and make sure it has been initialised before
    closing it.
  - Disable asserts in bfd code by default and add --enable-asserts
    Asserts were enabled by default in the bfd code, which shouldn't be
    the case.
    Add --enable-asserts configure option so that the asserts tests can
    be enabled while debugging.
  - Remove debugging log message accidently left in.
  - Update receive buffers when interface is created.
    The receive buffer size used by keepalived is based on the largest
    MTU of any interface that keepalived uses. If dynamic interfaces
    are being used and an interface is created after keepalived has
    started, the MTU of the new interface may be larger than the
    previous largest, so the receive buffer may need to be increased
    in size.
    Further, if vrrp_rx_bufs_policy is MTU, then the kernel receive
    buffers on the receive socket may need to be increased.
  - Handle MTU sizes being changed.
    Issue #1068 identified that the MTU size wasn't being updated in
    keepalived if it changed.
    This commit now updates the MTU size and adjusts receive buffer
    sizes accordingly.
  - Fix syntax error in configure.ac.
  - Fix double free when global data smtp_helo_name copied from local_name
    Issue #1071 identified a double free fault. It occurred when smtp_helo_name
    was not set, in which case it was set to point to the same malloc'd memory
    as local_name. At termination keepalived freed both local_name and
    smtp_helo_name.
    If keepalived needs to use local_name for smtp_helo_name it now malloc's
    additional memory to copy the string into.
  - Rename TIMER_MAX to TIMER_MAXIMUM.
    ulibC defines TIMER_MAX, so to avoid naming conflict rename it.
    This issue was reported by Paul Gildea  who also
    provided the patch.
  - Fix segfault when smtp alerts configured.
  - First working version of nftables.
  - Restructed code around how iptables/nftables are called
    This commit also allows building keepalived without iptables
    support, thereby allowing only nftables support.
    Adding any other mechanism to handle no_accept mode, i.e. blocking
    receiving and sending to/from VIPs should be added to vrrp_firewall.c,
    in a similar way to how nftables/iptables are used.
  - Update doc files re nftables.
  - Make nftables handle dont_track_primary appropriately.
  - Fix config reload with nftables.
  - Set base chain priorities from configuration.
  - Use iptables by default if neither iptables or nftables configured.
    But if the build of keepalived does not include iptables, then use
    nftables default.
  - Stop dumping keywords - left turned on after debugging.
  - Make umask configuration apply to created file.
  - Add libmnl and libnftnl to travis file.
  - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not defined.
  - Fix compilation failure when build with nftables but without iptables.
  - Fix order of include files in configure COLLISION test.
    Since Linux 4.4.11 (commit 1575c09) including linux/if.h after
    net/if.h works, whereas until glibc fix their headers including
    net/if.h after linux/if.h causes compiler redefinition errors.
    Unfortunately the test for the collision was done the wrong way
    round, as identified in issue #1079. The patch included in the
    issue report corrects the order of inclusion of the header files.
    What we should do is ensure that glibc header files are included
    before Linux header files, so that at least if kernel headers from
    4.4.11 onwards are used, the conflict will not occur.
  - Set CLOEXEC on netlink sockets.
  - Correct error message for invalid route metric.
  - Add track_process for vrrp to monitor if another process is running.
    Configurations frequently include a track_script to check that a process
    is running, often haproxy or nginx. Using any of pgrep, pkill, killall,
    pidof, etc, has an overhead of reading all /proc/[1-9]*/status and/or
    /proc/[1-9]*/cmdline files. In particular reading the cmdline files
    has a significant overhead on a system that is swapping, since the
    cmdline files provide access to part of the address space of each
    process, which may need to be fetched from the swap space.
    This commit reads the /proc/[1-9]*/stat and/or the /proc/[1-9]*/cmdline
    files only when keepalived starts, and after that uses the process events
    connector to track process creation and termination.
    keepalived will ignore zombie processes, whereas pgrep etc include them.
    A minimum number of instances of a process can be specified, and also a
    delay so that if a process is restarted, it won't cause monitoring vrrp
    instances to immediately transition to fault state but to wait the
    configured time and it the monitored process starts again it
    won't transition to fault state.
    There are potential difficulties with the process event connector if a
    large number of process events occur very rapidly, since there can be
    a receive buffer overrun on the netlink socket. This code will detect
    that happening, increase the receive buffer size, and reread the processes
    from /proc.
  - Add missing #include to track_process.c.
  - Fix number of elements of fd_set read for snmp select info.
  - Remove thread_event_t when EPOLL_CTL_DEL fails.
    If snmpd closes a file descriptor, when keepalived attempts to
    unregister the fd from epoll an error is returned. However, we still
    need to remove the thread_event_t from the io_events rbtree.
  - Fix connection to snmpd after it has to reconnect.
    Issue #1080 identified that keepalived wasn't handling a connection
    failure and reconnect to snmpd properly. The problem was created when
    the change from select() to epoll() was made.
    This commit makes keepalived unregister and reregister the snmp file
    descriptors after snmpd reconnects.
  - Fix retry count for SMTP_CHECK checker.
    The checker was doing one too few retries.
  - Make healthchecker failure reporting consistent
    Some healthcheckers were reporting all failures, and others only when
    the retries expired. This commit by default makes the checkers only
    report failure when the retries expire, unless the global keyword
    checker_log_all_failures or log_all_failures on the specific checker
    is configured.
  - After reload, reinitialise current track processes state.
  - Remove unused variable in track_process.c.
  - Add configure checks re --with-kernel-dir.
  - Convert remaining select() to epoll_wait().
    keepalived was using select() for handling the termination of child
    processes, but the main scheduling loop now uses epoll_wait(), so
    convert the select() to epoll_wait() from consistency.
  - Stop keepalived leaving zombie child processes.
    keepalived wasn't reaping the termination of its child processes,
    so this commit adds waitpid() calls once it knows the processes
    have terminated.
  - Fix make distclean and make distcheck.
  - Also skip route not configured with down interface.
    Otherwise, if keepalived has virtual_routes configured, we create
    a virtual interface and bring it up and down, current code will bring
    VRRP state to FAULT and never return.
  - Stop vrrp process entering infinite loop when track script times out
    Issue #1093 identified that the vrrp process was entering an infinite
    loop after a track script timed out. This was due to a child process
    thread having an RB tree for PIDs as well as for the timeout, and if
    a child process timed out, the thread wasn't being removed from the
    PID RB tree. This commit now ensures it is removed.
  - Fix the abbreviation of Shortest Expected Delay.
  - Don't free unallocated memory if not tracking processes.
  - vrrp: Rewrote JSON code
    Remove dependency to json-c extralib by using a simple streaming JSON writter.
    Refactored code to make it simple to maintain.
  - vrrp: Fix JSON handling for v{route;rule}.
  - autoconf: fix nftables selection
    We need to inhibit nftable compilation if compiling system has
    kernel header file nf_tables.h but not libnftnl nor libmnl.


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.12-0
changelog:
  - Documentation related.
    Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage.
    Update README manifest to reflect actual Keepalived goal and features.
  - Improve error message if process events connector not enabled in
    kernel.
  - Add option to disable track-process functionality
    Issue #1099 reported that their kernel did not support the proc events
    connector, and it would therefore be helpful to have an option to build
    keepalived without the track-process functionality.
    This commit adds the --disable-track-process configure option.
  - Fix vrrp instances going to fault state when have virtual routes
    If an interface going down caused a vrrp instance to go to fault
    state, and the vrrp instance also had virtual routes, the state
    of the vrrp instance would be set to backup when the deletion of
    the virtual route was detected. This commit ensures that the vrrp
    instance stays in fault state until the interface is brought up
    again.
  - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file.
    Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on
    Linux 2.4, which is no longer supported by keepalived. The options
    in the spec file for Reh Hat Linux 9 have twice caused people to
    specify wrong options to configure when trying to build keepalived,
    so the options are removed to i) avoid confusion and ii) they are
    not longer relevant.
  - Add global option vrrp_min_garp.
    By default keepalived sends 5 gratuitous ARP/NA messages after
    transitioning to master, and 5 more 5 seconds later. This isn't
    necessary with modern switches, and so if the vrrp_min_garp option
    is set, only one gratuitious ARP/NA message is sent after transition
    to master, and no repeat messages are sent 4 seconds later.
  - Standardise definition of _INCLUDE_UNUSED_CODE_
  - Remove out of date comment re VRRP over IPv6.
  - Correct typo in keepalived.conf.5.
  - Directly use structure sizes for packet header lengths.
  - vrrp_state_fault_rx() is not used.
    Wrap the function in conditional compilation so it is not compiled
  - Convert so list loops to use LIST_FOREACH.
  - Don't recalculate vrrp packet header address.
    vrrp_get_header() calculates the address of the vrrp header in a
    received packet, but it was being recalculated in vrrp_in_chk().
    This commit passes the already calculated address to vrrp_in_chk().
  - Ensure a received packet has an AH header if and only if AH auth.
    Ensure that a received packet has an AH header if we expect AH
    authentication, and doesn't have an AH header if we don't expect
    AH authentication.
  - Ensure all protocol headers received before return pointer to vrrp header
    vrrp_get_header() returns a pointer to the vrrp header, but it now returns
    NULL if insufficient data has been received to include all the (IP,
    possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP
    packet).
    This means that when a pointer to the VRRP header is returned, all fields in
    all protocol headers can safely be accessed.
  - Add check of received IPv6 hop count in multicast adverts
    The VRRP RFC requires that IPv6 hop count MUST be checked to be 255,
    just as the TTL for IPv6 must be 255. Previously that wasn't being
    checked, since IPv6 raw sockets don't provide access to the IPv6
    header.
    Using recvmsg() rather than recvfrom(), and setting socket option
    IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as
    ancillary data, and that can now be checked.
  - Improve reading from vrrp receive sockets.
    Previously no check was made of the return value from recvfrom()/
    recvmsg(). This meant than an error could occur (e.g. EINTR), or no
    data might be returned, and keepalived would still attempt to process
    the receive buffer as though data had been received.
  - Enhance and streamline checking of validity of received VRRP packet
    This includes checking that a packet is multicast, unless unicast is
    expected in which case it is checked for unicast, ensuring that if
    AH authentication is used, the next header protocol is VRRP.
    The sequence of some checks is revised to ensure that the fields being
    checked are valid to be accessed prior to accessing them, e.g. check
    that the packet is VRRP version 2 before checking the authentication.
  - Stop clearing receive buffer before receiving VRRP packets.
    This is no longer necessary now that the appropriate checks are
    made of the return status of recvmsg(), and also that the checks
    of received packet length and packet headers now do all necessary
    checks.
  - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO
    support.
  - Update keepalived.spec.in build-requires.
    The kernel package required for building keepalived is kernel-headers
    not kernel-devel. Also, it is superfluous to have package kernel in
    the build-requires!
  - Add missing file (build.setup) to tarball.
  - Fix calculating print format to rlim_t in configure.ac.
  - Fix compiler warnings on 32 bit systems re HASH_UPDATE.
    Removing all the casts stopped the warnings.
  - Use PRI_rlim_t when printing rlim_t types.
  - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems.
  - Fix some space/tab formatting.
  - Stop declaring some timer definitions unsigned to stop compiler
    warnings.
    TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings
    on some systems due to being defined with a 'U' unsigned suffix. Removing
    the unsigned specifier stopped the compiler warnings.
  - Fix compiler warning due to incorrect format specifier.
    An int64_t should use % PRIi64 and not %ld
  - Stop an uninitialized variable compiler warning.
  - Fix MEM_CHECK debugging on processors without unaligned memory
    access.
  - Don't attempt to use unopened socket for getting ipset version.
  - Tidy up an error message.
  - vrrp: make vrrp_dispatcher_read() async while catching error.
    During investigations we decided to update previous patch to resubmit
    into I/O MUX on read error. It will make read procedure I/O MUX freindly
    by removing potential sync operation potentially leading to a global
    I/O MUX desync. We aggreed, the situation is really and very exceptionnal
    but could happen.
  - vrrp: vrrp_arp_thread split.
    Split the function for maintainability purpose.


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.13-0
changelog:
  - Add BFD build option to keepalived.spec rpm file
    Issue #1114 identified that the keepalived.spec file was not being
    generated to build BFD support even if keepalived had been configured
    to support it.
  - Copy tarball to rpmbuild/SOURCES when building in place
    It seems that even when building in place, rpmbuild expects the
    tarball to be in the rpmbuild/SOURCES directory.
  - Fix configure check for __always_inline
  - Handle interface MAC addresses changing
    When an interface is added to a bond interface, if it is the first
    interface added, the MAC address of the bond interface is changed
    to the MAC address of the added interface. When subsequent interfaces
    are added, their MAC addresses are changed to that of the bond
    interface.
    Issue #1112 identified that if a bond interface is deleted and
    recreated, the gratuitous ARPs were sent with the wrong source MAC
    address.
    This commit now updates interface MAC addresses from the netlink
    RTM_NEWLINK messages, so that the correct MAC address is always
    used.
  - Minor tidying up of opening gratuitous ARP socket.
  - Streamline setting SOCK_NONBLOCK on vrrp sockets.
  - Use netlink reported hardware address length for unsolicited NAs
    ETH_ALEN is correct for Ethernet type interaces, but is not right
    for Infiniband interfaces.
  - Minor tidying up of opening gratuitous NA socket.
  - Make gratuitous ARP/NA sockets non blocking
    keepalived shouldn't block when sending gratutious ARP/NA messages.
    It is better to lose the messages than for keepalived to block, so
    set the sockets non blocking.
  - Use netlink provided broadcast address for gratuitous ARP
    If an interface has a non-standard broadcast address, we should
    honour it.
  - Fix building on pre 3.10 kernels re track_process
    Issue #1119 reported that keepalived wouldn't build on CentOS 6.
    Various PROC_EVENT_* declarations were assumed to exist, some of which
    were not introduced until Linux v3.10. Most of them are not needed, but
    PROC_EVENT_COMM is used by the track_process code.
    This commit now checks for the existence of the PROC_EVENT_* declarations,
    but since keepalived uses PROC_EVENT_COMM, track_process is not supported
    prior to Linux v3.2.
  - Make track_process work prior to Linux 3.2, but with limitations
    Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which
    means that keepalived is unable to detect changes to process name
    (/proc/PID/comm) prior to Linux 3.2. most processes do not change
    their process name, and so using track_process prior to Linux 3.2
    is safe so long as the monitored processes are known not to change
    their process name.
  - Stop configure failing when nftables is not supported.
  - Streamline socket use with linkbeat.
    Previously the socket used for ioctls was opened and closed twice per
    poll if using MII or ETHTOOL polling, and once per poll if using ioctl
    polling. This commit opens the socket once at startup, uses that socket
    for all linkbeat polls, and closes it on termination.
  - Enable linkbeat polling to work with dynamic interfaces.
  - Add linkbeat_interfaces configuration block
    It was not possible to indicate that an interface that wasn't used
    as the interface of a vrrp instance, but was used either as a track
    interface, or for virtual/static ip addresses or routes should use
    linkbeat. This commit adds that capability.
  - Add ability to specify linkbeat type in linkbeat_interfaces block.
  - Add --disable-linkbeat configure option
    Does anyone use linkbeat anymore? This commit enables keepalived to
    be build without the linkbeat code.
  - Don't remove link local IPv6 address from VMAC that isn't keepalived's
    If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface
    already had a (non-default) link local addresss and the link local
    address that matched the interface's MAC address was added, keepalived
    was removing it as soon as it was added. This commit stop keepalived
    removing the address when we shouldn't.
  - Set configure init type correctly in keepalived.spec file.
  - Fix handling of VMACs with multiple reloads
    If a configuration is loaded that has a VRRP instance using a VMAC,
    then the configuration is updated to remove that VRRP instance and
    keepalived reloads its configuration, then the configuration is
    updated again to reinstate the VRRP instance and the configuration
    is again reloaded, keepalived thought the VMAC interface still
    existed, whereas it was deleted following the first reload.
    This commit ensures that keepalived properly detects whether an
    interface exists following a reload.
  - Remember more than one interface local address per interface
    Keepalived needs a local address for each interface it sends adverts
    on. If the address keepalived is using is deleted and another address
    is configured on the interface, then keepalived should start using
    that address. To do this, a list of configured address on each
    interfaces needs to be maintained.
  - Don't consider VIPs as local addresses when restart after crash
    Keepalived maintains a list of addresses per interface that can be
    used as source adddresses for adverts. To build the list, keepalived
    reads the addresses configured on interfaces when it starts. However,
    if keepalived crashed it will have left VIPs configured on interfaces,
    and we don't want to use them as advert source addresses.
    This commit makes keepalived compare the addresses on interfaces
    to VIPs, and ignores any addresses that are VIPs.
  - Fix removing left over VIPs at startup.
  - Use read_timer() when parsing config where appropriate.
  - Allow fractional warmup, delay_loop and delay_before_retry for checkers
    To shorten the real server monitoring interval, make it possible to specify
    decimal value for following items:
    warmup
    delay_loop
    delay_before_retry
  - Update connect_timeout configuration options
    Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch
    allows setting the connect_timeout to a resolution of micro-seconds.
    The patch also adds the ability to set a default value at the virtual
    server and real server levels.
  - Fix unused variable warning when building only with RFC compliant
    SNMP.
  - It enable to set zero value as mintime for delay_loop and connect_timeout.
  - Add option not to check for EINTR if using signalfd()
    If keepalived is using signalfd(), there are no asynchronous signal
    handlers, and therefore EINTR cannot be returned.
    Currently the check for EINTR is enabled by default, and configure
    option --disable-eintr-debug disables the check, while
    --enable-eintr-debug enables writing log entries if EINTR is returned.
    Once sufficient testing has been performed, the default will be
    changed not to test for EINTR if signalfd() is supported.
  - Make checking for EAGAIN/EWOULDBLOCK consistent
    The code in some places checked errno for EAGAIN and EWOULDBLOCK
    and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK,
    so the check is not necessary, but EAGAIN is not guaranteed to be the
    same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN
    if they are the same value, but checks both if they are different.
  - Ensure default connection timeout for smtp checker hosts set.
  - Set default connection timeout if no smtp check host specified.
  - Fix min timer value, zero to 0.000001Sec.
  - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler().
  - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds.
  - vrrp: vrrp_dispatcher_read() performance extension
    We took time with Quentin to simulate and rework this code. We introduced
    2 imbricated while loop:
    (1) First one is catching recvfrom EINTR (this code trig
        only on kernel older than 2.6.22 where signalfd was firstly introduced).
        Newer kernel will immediately break the loop (hey guys: if you are running
        older than 2.6.22 it is worth considering upgrading).
    (2) Second loop will continue reading from socket until same VRID advert
        has been received during the same cycle. After simulating, it appears that
        during contention with a lot of VRRP instances (around 1500), this design
        is needed to relax socket recvq from growing. This can be viewed as a
        Poll-Mode activation during contention and fallback to regular I/O MUX
        during normal operations. This loop breaks immediately and re-submit
        opration to I/O MUX when there is no more to be read.
  - Fix conversion from long for double in read_timer().
  - Remove variable timer of unsigned long cast in read_timer().
    When Double type variable timer is cast to long type, it's scale falls.


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.14-0
changelog:
  - Add compiler warning -Wfloat-conversion and fix new warnings.
    It was discovered that passing 0.000001 as a parameter specified
    as uint32_t to a function did not generate any warning of type
    mismatch, or loss of precision.
    This commit adds -Wfloat-conversion and fixes 3 instances of new
    warnings that were generated.
  - For non systemd enviroment, it occurs syntax error 'fi'.
    To avoid syntax error, modify keepalived.spec.in.
  - When uninstall keepalived with init upstart, stop keepalived process.
  - Fix type re LOG_INGO should be LOG_INFO * 6git stash --cached.
    The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and
    so isn't currently compiled.
  - Register missing thread function for thread debugging.
  - Fix reutrn value of notify_script_compare misusing issue.
  - Fix typo in keepalived.conf man page re BFD min_rx.
  - Fix segfault when bfd process reloads config.
    Issue #1145 reported the bdf process was segfaulting when reloading.
    The bfd process was freeing and allocating a new thread_master_t
    when reloading, which doesn't work. This commit changes the bfd
    process to clean and reinitialise the thread_master_t.
  - Fix segfault in handle_proc_ev().
    On Linux 3.10 the ack bit can be set in a connector message, and
    the CPU number is set to UINT32_MAX. This commit skips acks, and
    also checks that CPU number is within range of the number of CPUs
    on the system.
  - Fix OpenSSL init failure with OpenSSL v1.1.1.
    OpenSSL v1.1.1, but not v1.1.0h or v1.1.1b failed in SSL_CTX_new()
    if OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously
    been called.
    This commit doesn't call OPENSSL_init_crypto() if doing so causes
    SSL_CTX_new() to fail.
  - Remove all references to libnfnetlink.
    Commit 2899da6 (Stop using linbl for mcast group membership and
    setting rx buf sizes) stopped using libnfnetlink, but INSTALL and
    keepalived.spec.in were not updated accordingly.
  - Fix genhash re OPENSSL_init_crypto bug and improve configure.ac.
    Commit fe6d6ac (Fix OpenSSL init failure with OpenSSL v1.1.1) didn't
    update the identical code in genhash/ssl.c. Also, an improvement for
    the test in configure.ac was suggested.
  - Fix log output when real server removed.
    FMT_VS() and FMT_RS() both call inet_sockaddrtotrio which uses a
    static buffer to return the formatted string, but since FMT_VS(),
    wheich simply calls format_vs() copies the returned string to its
    own static buffer, if FMT_VS() was called before FMT_RS() then
    the returned strings from both could be used.
    The problem occurs when both FMT_VS() and FMT_RS() are used as
    parameters to log_message() (or printf etc). It appeared to work
    fine on x86_64, but was writing the same IP address for both the
    real server and virtual server on ARM architectures. This is due
    to the compiler evaluating parameters to the log_message() function
    call in a different order on the different architectures.
    This commit adds inet_sockaddrtotrio_r() which allows the output
    to be in a buffer specified by the caller, and so FMT_VS() and
    FMT_RS() can now be called in either order without one overwriting
    a buffer used by the other.
  - Streamline some string formatting with FMT_RS() and FMR_VS().
    Following commit 9fe353d (Fix log output when real server removed)
    some code can be streamlined now that the order of calling FMT_VS()
    and FMT_RS() does not matter.
  - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with FMT_CHK().
    They were all simply defined to be FMT_CHK() so just replace them
    with that. This made it much simpler to find all used of FMT_CHK().
  - Fix building with gcc 4.4.7 (Centos 6.5).
    gcc v4.4.7 doesn't support -Wfloat-conversion, so check for it at
    configure time.
  - Add dumping checker config/status when receive SIGUSR1.
  - Don't put alpha mode checkers into failed state at reload
    If a new checker is added at a reload, unless the real server aleady
    has failed checkers, then ignore the alpha mode of the checker. This
    means that the real server, if up, won't be taken down and then brought
    back up again almost straight away. If the real server already has
    failed checkers, then setting an alpha mode checker down initially
    won't take down the real server, so we can allow the alpha mode setting
    to apply.
  - Handle alpha mode checkers initial failure at startup better.
  - Fix compile failure discovered by Travis-CI.
  - Fix calling syslog when not using signalfd().
    Pull request #1149 identified that syslog is AS-Unsafe (see signal-safety
    man page), and that therefore signals should be blocked when calling it.
    This commit blocks signals when calling syslog()/vsyslog() when signalfd()
    is not being used.
  - Rationalise function attributes.
  - Fix enable-optimise configure option.
  - Use AS_HELP_STRING for all options in configure.ac.
  - Streamline genhash -h option.
  - Make genhash -v version match keepalived.
  - Fix config check of virtual server quorum against weights of real
    servers.
  - Fix some configure tested checks for OPENSSL_init_crypto.
  - Add infrastructure for adding additional compiler warnings.
  - Add standard and extra compiler warnings.
  - Add and resolve missing-declarations and missing-prototypes warnings
    Approximately 16 additional functions are now declared static.
  - Add and resolve old-style-definitions warnings
  - Add and resolve redundant-decls warnings
  - Add and resolve jump-misses-init warnings
  - Add and resolve shadow warnings
  - Add and resolve unsuffixed-float-constants warnings
  - Add and resolve suggest-attribute=const warnings
  - Add and resolve suggest-attribute=format warnings
  - Add and resolve suggest-attribute=malloc warnings
  - Add and resolve suggest-attribute=noreturn warnings
  - Add and resolve suggest-attribute=pure warnings
  - Add and resolve unused-macros warnings
  - Add and resolve null-dereference warnings
  - Add and resolve float-equal warnings
  - Add and resolve stack-protector warnings
  - Add and resolve strict-overflow=4 warnings
  - Add and resolve pointer-arith warnings
    This particularly includes adding a number of bytes to a void *.
  - Add and resolve cast-qual warnings
  - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7
  - Remove static from zalloc()
  - Fix some compiler warnings on Ubuntu Xenial, and add comments re
    others.
  - Rename LIST parameters to lst in list_head.h to avoid upper case.
  - Fix real server checkers moving from failed to OK on reload.
  - add rs judgement in migrate_checkers.
  - Detect connection failure in genhash and exit rather than loop.
  - Add another function pure attribute.
  - Fix sending notifies for vrrp instances at startup when in sync group
    Issue #1155 idenfified that notify scripts for vrrp instance transition
    to backup state when keepalived started up were not being sent if
    the vrrp instance was in a sync group. It was also the case that SNMP
    traps, SMTP alerts and FIFO notifies were not being sent either.
    This commit make keepalived send the initial notifies when the vrrp
    instance is in a sync group.
  - Fix building keepalived RPM on Fedora 26.
    For some reason -fPIC is needed when testing for the presence of
    setns().
  - Add vrrp_startup_delay configuration option.
    Some systems that start keepalived at boot time need to delay the
    startup of the vrrp instances, due to network interfaces taking
    time to properly come up. This commit adds a global configuration
    option vrrp_startup_delay that delays the vrrp instances starting
    up, for the specified number of seconds.
  - Handle checkers properly when reload immediately after startup.
  - Streamline some of the SMTP checker code.
  - Create separate checker for each host in SMTP_CHECK block
    Having multiple host entries in an SMTP_CHECK block is deprecated.
    This commit streamlines the SMTP_CHECK code by creating a separate
    SMTP checker for each host declared in the SMTP_CHECK block, so that
    apart from parsing the configuration, the code no longer handles
    multiple hosts per checker.
    The support for parsing configuration with multiple hosts is only
    enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is
    currently enabled, but when support for multiple hosts in the
    SMTP_CHECK block is finally removed, it will simply be a matter of
    deleting all code in the WITH_HOST_ENTRIES conditional blocks.
  - Make checker fail if ENETUNREACH returned by connect().
    The connect() call can return some immediate errors such as ENETUNREACH.
    These were not being treated as a failure of the checker, since the code
    used to assume that any non success return by connect() meant that the
    connection was in progress.
    keepalived will now treat ENETUNREACH, EHOSTUNREACH, ECONNREFUSED,
    EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED, ETIMEDOUT, when returned
    by connect(), as meaning that the checker has failed.
  - Don't set SO_LINGER with a timeout of 0
    SO_LINGER with a timeout of 0 causes a TCP connection to be reset
    rather than cleanly closed. Instead of specifying a timeout of 0,
    use 5 seconds, so that there is an orderly shutdown of the TCP
    connection, but the close socket doesn't remain in TIMED_WAIT state
    for more than a short time.
  - nftables: fix build with kernel lower than 4.1.
  - Remove dead code and cosmectics.
    Remove code marked as UNUSED where things simply go nowhere even if
    define is set. We keep for the moment UNUSED code related to debug
    helpers used during coding process.


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.15-0
changelog:
  - Fix uninitialised variable.
  - Fix rpmbuild on CentOS7, and rely on auto-requires.
  - Add option to flush lvs on shutdown.
    Currently all known virtual servers and their real servers are
    removed one at a time at shutdown. With large configurations on
    a busy system, this can take some time.
    Add an option just like the existing 'lvs_flush' which operates
    on shutdown. Typical environments with a single keepalived instance
    can take advantage of this option to achieve a faster shutdown or
    restart cycle.
  - Make alpha mode checkers on new real servers start down on reload.
    Patch #1180 identified that new real servers with alpha mode checkers
    were being added online immediately, and if the checker then failed
    were being removed. This commit makes real servers that didn't exist
    before the reload start in down state if they have alpha mode checkers.
  - Remove duplicate config dump entry.
  - Make new real servers at reload start down if have alpha mode
    checkers.
  - Close checker and smtp_alert sockets on reload.
    Issue #1177 identified that sockets were being left open (lost) after
    a reload. It transpired that these were sockets opened by TCP_CHECK,
    HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK checkers, and by smtp_alerts
    in the process of being sent.
    This commit adds an extra parameter to thread_add_read() and
    thread_add_write() to allow indicating that the scheduler should close
    the socket when destroying threads.
  - Send vrrp group backup notifies at startup.
  - Make inhibit_on_failure be inherited by real server from virtual
    server.
  - Allow real and sorry servers to be configured with port 0
    This is to maintain backwards compatibility with keepalived prior
    to commit d87f07c - "Ensure always check return from inet_stosockaddr
    when parsing config".
    The proper way to configure this is to omit the port, which requires
    the next commit.
  - Don't setup IPVS config with real and virtual servers ports
    different.
    If the real server is using DR or TUN, the port of the real server must
    be the same as the port of the virtual server. This commit uses the
    virtual server port for the real server when configuring IPVS.
  - Log warnings if real server and virtual server ports don't match
    This commit adds logging warnings if virtual and real server ports,
    when using TUN or DR, don't match.
    It also sets the real server ports to be the same as the virtual server
    ports. Although listing the IPVS configuration with ipvsadm will look
    different, the kernel ignored the port of a real server when using DR
    or TUN, so the behaviour isn't changed, but when looking at the
    configuration it now shows what is actually happening.
  - Fix warning when protocol specified for virtual server with fwmark.
  - Add log message that nb_get_retry is deprecated.
  - Fix whitespace in configure.ac.
  - Fix configure error when systemd not installed
    configure was trying to execute
      pkg-config --variable=systemdsystemunitdir systemd
    even if systemd was not available.
    This commit makes configure only execute the above if it has determined
    that systemd is the correct init package to use.
  - Correct references to RFC6527 (VRRPv3 SNMP RFC).
  - nsure checker->has_run is always set once a checker has run.
  - Fix some indentation in configure.ac.
  - Update fopen_safe() to open temporary file in destination directory
    rename() in fopen_safe() was failing if the file being created
    was not on the same filesystem as /tmp.
  - Add ${_RANDOM} configuration keyword.
    It might seem strange to introduce random elements to configuration
    files, but it can be useful for testing.
  - Fix using ~SEQ() in multiline configuration definitions.
  - Make blank lines terminate a multiline definition.
  - Minor updates for lvs_flush_on_stop.
  - Add option to skip deleting real servers on shutdown or reload
    If a virtual server is removed, the kernel will remove its real servers,
    so keepalived doesn't explicitly need to do so.
    The lvs_flush_onstop option removes all LVS configuration, whereas this
    new option will only remove the virtual servers managed by keepalived.
  - Correct error message re checker_log_all_failures.
  - Fix syntax error in configure.ac.
  - Fix track_process initialisation for processes with PIDs starting 9.
  - Remove debugging log message.
  - Remove inappropriate function const attributes
    They were causing iptables/ipsets not to be initialised.
  - Stop warning: function might be candidate for attribute â€˜constâ€™
    Depending on what configure options are selected, gcc can output
    the above warning for initialise_debug_options().
    This commit ensures that the warning is not produced.
  - Enable strict-config-checks option in keepalived.spec RPM file.
  - vrrp: relax attribute 'const' warning at iptables helpers.
  - Propagate libm to KA_LIBS.
  - Fix building on Alpine Linux.
    Alpine (musl) doesn't have a definition of __GNU_PREREQ, so create a
    dummy definition.


author: Anton Novojilov <andy@essentialkaos.com> - 2.0.16-0
changelog:
  - Add log_unknown_vrids keyword.
    Commit 21e6f5f added logging when a VRRP packet was received on an
    interface and the VRID in the advert was not configured on that
    interface.
    Due to valid uses of keepalived having a VRRP instance on an
    interface, but there being other, independent, VRRP instances with
    different VRIDs on the same interface, this patch only enables logging
    of unknown VRIDs if it is specifically configured.
  - Stop segfault when reload and using -x option.
  - Fix compilation error found by Travis-CI.
  - Fix a couple of typos.
  - Ensure check command line when needed for track process.
  - Check if comm really changed when get PROC_EVENT_COMM_CHANGE.
  - Fix debounce delay handling for track_process.
  - Optimise add_process().
  - Remove processes no longer being monitored.
  - Optimise check_process().
  - Ignore process threads for track_process.
  - Allow matching of process parameters in track_process
    This additional functionality was requested in issue #1190.
  - Allow separate delay timers for fork and process exit in
    track_process.
  - Add quorum_max for track_process.
    This allows track_process to go to fault state if more than a
    specified number of instances of a process are running. In particular
    it can go to fault state if more than one instance is running, and
    also if any instance of a process is running.
  - Add configuring process name.
    With up to 4 processes running all named keepalived, it can be
    difficult to know which is which. The commit adds the option to
    allow process name to be set independantly for each process.
  - Handle macvlans/macvtaps being moved into different namespace from parent
    If a macvlan or macvtap interface is moved into a different namespace from
    its parent, and the interface is in the namespace in which keepalived is
    running, keepalived is unable to get information about, or configure, the
    parent interface. In this case, treat the macvlan/macvtap interface as though
    it doesn't have a parent interface.
    There are a couple of consequences of this in this situation:
    1) If a vrrp instance is configured with use_vmac and its configured interface
        is such a macvlan/macvtap interface, keepalived cannot ensure that the
        arp_ignore and arp_filter settings are correct on the parent
    2) keepalived cannot check that there a not duplicate VRIDs being used on the
        interface.
  - Typo writing word error fix.
  - Add vrrp instance priority change notifications on FIFOs only.
    Issue #1213 requested notification of vrrp instance priority changes,
    and this commit implements that with new FIFO messages:
    INSTANCE "VI_0" MASTER_PRIORITY 220
    INSTANCE "VI_0" BACKUP_PRIORITY 254
    This has been implemented via notify FIFOs only, since the order of
    processing of scripts is indeterminate if events happen quickly in
    succession, potentially causing the last processed priority by a
    script not to be the lastest priority, and using SMTP notification
    would be ridiculous.
  - Allow user and group ownership of FIFOs to be configured.
  - Remove extraneous debugging message from process_name commit
    Commit 4ad6d11 - "Add configuring process name" accidentally left
    a debugging log message in the code. This commit removes it.
  - Fix FREE error if tracked process has no parameters.
  - Fix track processes when reloading.
  - Fix route add/delete on reload if only change via address
    If a virtual_iproute
    src 100.100.100.100 2.2.2.2/32 via 100.100.100.2 dev eth0
    is changed to
    src 100.100.100.100 2.2.2.2/32 via 100.100.100.1 dev eth0
    on a reload the route didn't get updated. The reason is that the
    via address wasn't used in the comparison of routes, so keepalived
    didn't detect that it had changed.
  - Define TASK_COMM_LEN rather than use numbers in code.
  - Fix promote_secondaries.
  - Add snmpd.service to keepalived.service if SNMP enabled.
  - Add issue templates for github.
  - Make utils.c function parameters const where appropriate.
  - Add missing info to check process dump file.
  - Make ipvs_talk() error message more meaningful
    The error message used to just output the IPVS command number, now
    the name of the command is reported too.
  - Make more use of LIST_FOREACH in ipwrapper.c.
  - Change VS_ISEQ etc to be functions and correct them.
  - Resolve removing virtual servers in virtual server groups after
    reloading.
  - Update NOTE_vrrp_vmac.txt re sysctl settings.
  - Ignore base interfaces of macvlans if in a different namespace.
  - Don't lose sin_addr_l and sin6_addr_l lists from interface when recreate
    Issue #1232 identified that keepalived segfaulted when an interface was
    recreated. This commit resolves the problem of the address lists being
    lost.
  - Fix commit 128bfe6 for pre v4.0 kernels
    Commit 128bfe6 - "Ignore base interfaces of macvlans if in a different
    namespace" added using IFLA_LINK_NETNSID to detect if the parent of an
    interface was in a different namespace. Unfortunately that was only
    introduced in Linux v4.0, so don't attempt to use it if it is not
    defined.
    For kernels older than v4.0 if a macvlan interface's parent is in
    another network namespace, but the ifindex of the parent interface also
    exists in the namespace in which keepalived is running, then keepalived
    will believe the parent of the macvlan is the wrong interface.
  - Fix commit 3207f5c - IFLA_LINK_NETNSID is not #define'd
    This fixes commit 3207f5c - "Fix commit 128bfe6 for pre v4.0 kernels".
    A configure test is needed to check for IFLA_LINK_NETNSID.
  - Further fixes/improvements for MACVLAN parents in different
    namespaces.
  - allow to set zero weight for real server.
  - Add comments re needing to enable protocol 112 in an AWS security
    group.
  - Check if base i/f of a residual macvlan is in correct namespace.
  - Stop segfault if using DBus and have invalid VRRP configuration.
    If a VRRP instance was removed by vrrp_complete_init() it was causing
    a segfault in the DBus code. The commit moves the initialisation of
    DBus until after the validity of the VRRP instances has been checked.
  - Handle DBus process properly when reloading.
    DBus may change from being enabled to disabled or vice versa and
    the code didn't handle that.
  - Close DBus pipes when stop using DBus.
  - Add some more LIST_FOREACH to DBus code.
  - Move a g_free() to after last use of the freed string in vrrp_dbus.
  - Fix error in man page.
  - Handle network namespace name properly when reloading.
  - Don't call g_hash_table_remove() when using g_hash_table_foreach_remove()
    g_hash_table_foreach_remove() removes each object from the hash table,
    so calling g_hash_table_remove() as well made it not work properly.
  - Resolve various aspects of reloading when also using DBus.
    1. Add ability for DBus to be enabled and disabled at reload
    2. Correctly handle vrrp_instance name change for matching interface/
       family/VRID.
    3. Correct handling of interface/family/VRID change for a vrrp_instance
       with the same name.
  - Resolve segfault when a vrrp_instance has no interface specified.
  - Fix sending priority 0 adverts after reload for deleted vrrp
    instances.
    During a reload, vrrp_dispatcher_release() was called prior to
    reloading the configuration, and it closed all the vrrp send/receive
    sockets. However it isn't until after the reload that it is known which
    vrrp instances no longer exist, and clear_diff_vrrp() attempted to send 0
    priority adverts for those instances. Since the sockets had already been
    closed, the adverts could not be sent. Worse, the socket_t structures had
    been released, but the released memory was accessed in attempting to send
    the adverts.
    This commit delays calling vrrp_dispatcher_release() until after the new
    configuration has been reloaded, and it sends 0 priority adverts before
    all the old sockets are closed. Following this new sockets are opened.
    It would be possible to make the code more efficient and retain the sockets
    that still need to be used, rather than closing them and opening new ones,
    but that is for another commit.
  - Update some comments in vrrp_snmp.c.
  - Use structure initialisation to clear struct, rather than memset.
  - Fix logging if receive EPOLLHUP, EPOLLERR and add for EPOLLRDHUP.
  - Add support for network timestamp debugging.
  - Check return code from recvfrom() before other values for
    track_process.
  - Use IPV6_RECVPKTINFO rather than IPV6_RECVHOPLIMIT when check
    multicast.
  - Ensure virtual servers are properly removed when reloading.
    Pull request #1246 provided a patch to resolve the issue of virtual
    servers in a virtual server group that are deleted from the virtual
    server group on a reload weren't being removed from the IPVS
    configuration. However, the patch didn't quite work with the current
    HEAD of the master branch.
    This commit incorporates that patch provided and makes the necessary
    adjustments for it to work correctly.
  - Cosmetic changes to IPVS code.
  - Make clear the IPv6 instances use VRRP version 3.
  - Delete redundant code.
  - Update comments in vrrp_nftables.c.
  - Update for gcc v9
    Detect if -Wchkp is no longer supported, and fix a -Wstrict-overflow
    warning in write_backtrace().
  - Add additional compiler warnings available in gcc verion 9.


