Skip to content

v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 10:46
· 164 commits to master since this release
v1.0.0
ae5928f

Known issue

Nodes installed from the deb, rpm or tar.gz packages carry no GeoIP database (the container image bundles IPinfo Lite). Under traffic, nginx on such a node logs [crit] connect() to unix:/run/edgeweir-node/control.sock.geo failed about once every 5 seconds per worker. Requests and features are not affected. Fixed in the next patch release.

Changelog

  • 69ff152 Merge branch 'feat/site-g9' into feat/site-g15
  • 35e00fb Merge branch 'master' into feat/site-g9
  • ccfff27 build(proto): generate from proto/v0.23.0
  • 9c9d9e2 build(proto): generate from proto/v1.0.0
  • 4b913f1 build(proto): pin proto/v0.25.0
  • 0bb76cb build(proto): regenerate from proto/v0.22.1
  • 5922d41 build(proto): regenerate from proto/v0.24.0
  • b8bf41b build(proto): regenerate from proto/v0.26.0
  • ad7e57a build: Go 1.27.2 and golang.org/x/crypto v0.57.0
  • e369083 build: package-check verifies the release artifacts' binary tags, NOTICE, LICENSE and Lua modules
  • 30b0157 build: release builds with the tags nodynamic and wasm2go; NOTICE lists the third-party software in the binary
  • 9978da8 chore(proto): regenerate from proto/v0.22.0
  • f1d4e7c chore(proto): regenerate from proto/v0.28.0
  • 967feb5 docs(security): personal data in access logs, the live view and the internal upstream header
  • e23356f feat(agent): access log fields and options and the statistics dimensions in ReportLogs and ReportStats, with the data plane's bounds
  • d8754f5 feat(agent): bans made by rules carry their rule and network, access log lines the log rules that asked for them
  • 3e2a7c9 feat(agent): certificates of layer-4 applications that terminate TLS
  • 1cb2f50 feat(agent): every certificate of a site with key types and names, per-certificate OCSP, TLS session contexts and the cluster's session ticket keys
  • 8039a46 feat(agent): platform scan bans, certificate names and host matching
  • 6570a7b feat(agent): the image converter on image.sock converts in a child process within the node's worker, memory and time limits (--image-workers, --image-memory-mb, --image-timeout)
  • f5352b1 feat(cli): edgeweir-node accesslog, the data plane's live view as text or JSON Lines
  • c241014 feat(configir): a site's WebP / AVIF conversion (image-convert-v1, an extra feature of nodes that run the converter)
  • caf2937 feat(configir): a site's access control in the site table, validated as the console writes it, and its canonical form
  • 533d22e feat(configir): access authentication rules with their secrets attached by the agent, and auth failure counts
  • 3dc9fdc feat(configir): additional site certificates, client certificates and session ticket keys (proto v0.26.0)
  • 0afe63c feat(configir): domain forms and unknown host handling
  • eab5544 feat(configir): listener ports of sites, HTTPS redirect options, client address setting and layer-4 ranges and TLS (proto v0.23.0)
  • 5700a06 feat(configir): site access log options, access-logs-v2 and stats-dims-v1, v0.30.0 hash vector
  • 419a34a feat(configir): site-content-v1 and cache-zone-v1 settings, per-node cache sizes, PURGE keys and the agent socket
  • c4fc17b feat(configir): the waf-v2 actions, request body and crawler fields, CRS exclusion entries with their tokens, challenge-v2 protection and the rules body limit
  • cf10e94 feat(configir): validate rules-v3 expressions, header values, append and 303
  • 2daeef4 feat(lua): PURGE method, maintenance, charsets, cached Set-Cookie, error page classes and redirects, body limits and origin tries
  • 2445372 feat(lua): WebP / AVIF variants of cached images: Accept picks the class, the class joins the cache key, variants go through the image converter; Vary: Accept and the saved bytes in the statistics
  • cf28e7f feat(lua): a site's challenge page texts and bans after repeated challenge failures
  • 2011c70 feat(lua): access authentication before the rules: Basic, forward authentication through the origin layer and signed URLs A-D
  • 9799809 feat(lua): access control in the edge layer: site lists, geo, CORS preflights and headers, hotlink, user agents, WebSocket origins, security headers
  • 9ce6636 feat(lua): access log fields and options, block reasons, early refusals counted, live view, soft GeoIP lookups and statistics dimensions
  • 4d4b51d feat(lua): bans rules make hold IPv4 /16-/32 or IPv6 /48-/64 networks, written once
  • c6c59e6 feat(lua): one certificate per handshake by the ClientHello, session contexts per site, client certificates, X-Client-* headers and tls.client fields
  • f37dfb2 feat(lua): ports of sites, HTTPS redirect options, ip.peer, trusted proxies and layer-4 ranges, same-port origins and TLS
  • 24d0816 feat(lua): request body fields, form_value and json_value
  • 0cc932c feat(lua): suffix and pattern hosts, unknown host handling and scan bans
  • 0d927f1 feat(lua): the live view shows the site it found for requests no site counts, without a sampled line
  • c7581d7 feat(lua): the waf-v2 actions, access log lines of log rules, rate limit bans, CRS modes and exclusions by path, lazy body and crawler fields
  • eb29b4a feat(lua): verified search engine crawlers by reverse and forward DNS
  • 5d4b456 feat(proto): bump contract to proto/v0.30.0
  • abaca0a feat(proto): regenerate for proto v0.25.0
  • acaa2c5 feat(proto): regenerate for proto/v0.27.0 (access authentication rules, auth failure counts)
  • 261e445 feat(proto): regenerate from proto/v0.29.0
  • 3b4ac04 feat(proto): regenerate from proto/v0.31.0
  • f33ed03 feat(render): CRS exclusion entries selected by their tokens, and lua_shared_dict edgeweir_bots
  • 3f70cc6 feat(render): TLS session cache and the cluster's ticket keys for the HTTPS listeners, early data explicitly off
  • 025e0a2 feat(render): edgeweir_tap for the live view, edgeweir_topstats 16 MiB, X-Edgeweir-Upstream never leaves the edge
  • 9d24605 feat(render): server names for suffix and pattern domains
  • 4748fa9 feat(render): site servers per bound port, realip of the client address modes, layer-4 port ranges and TLS, worker_connections per listening socket
  • f6e52f2 feat(render): the edge's local hop to the origin layer waits up to 86400 s
  • 5d38a89 fix(agent): PURGE is limited per client address at the edge and per site for accepted requests only
  • 984d914 fix(agent): a conversion child whose runtime counts as cgo (a build without the release tags) drops its capabilities on its own thread instead of panicking
  • bf14ed8 fix(agent): drain access logs again while a call returns a full batch, at most 20 calls a tick, uploading each before the next
  • 393e74b fix(agent): kernel bans never drop the cluster's trusted proxies
  • 3f00e74 fix(agent): originals read into memory before their conversion share a budget of --image-memory-mb
  • 29731de fix(agent): the default site's certificate names its DNS names when unknown hosts use it
  • 5bf65f4 fix(cli): edgeweir-node accesslog counts the requests the live view dropped over its rate as missed
  • 9402507 fix(configir): Diff carries the client address and unknown hosts
  • e52dc55 fix(configir): accept maintenance CIDRs the console normalizes (IPv4-mapped text)
  • bd87057 fix(configir): error page redirects checked like the console, mapped maintenance CIDRs as IPv4, included cache key names keep "*"
  • 2aaafe6 fix(configir): no placeholders in an error page redirect's host or port
  • ec16196 fix(configir): redirect hosts limited to forms both URL parsers read alike; mapped maintenance prefixes tested
  • 0adf4fc fix(imageconv): at most one iCCP of 64 KiB; a slow original streams through
  • 0b30039 fix(imageconv): convert in builds linked with cgo and under the race detector
  • 825a955 fix(lua): PURGE counted per client network in a shared dict of its own, not in edgeweir_meta
  • e55e939 fix(lua): a lifted CC ban counts the client afresh
  • 3ee5ba1 fix(lua): a lifted scan ban counts the network afresh
  • cca1fdd fix(lua): a lifted scan ban keeps the count; the next request over the threshold bans again
  • c285ed6 fix(lua): a preflight the origin answers gets the edge's preflight headers
  • 95c9bc0 fix(lua): access log headers and query strings only as the access phase took them from the client; none for requests refused before the signature was removed
  • 9b489a7 fix(lua): access log lines of REVALIDATED responses carry the origin's status and time but no address
  • 86efdf3 fix(lua): ambiguous raw paths, forward authentication headers and Basic budgets
  • a3213e0 fix(lua): an authentication service that does not answer (503 auth-unavailable) is no block reason
  • 454cbd6 fix(lua): disabled sites match node IP hosts by exact name only; a site bound to other ports hands its TLS handshake to the default site like its requests
  • 39c73ce fix(lua): no CRS exclusion entry applies to an ambiguous raw path
  • 9b0ebf4 fix(lua): no HTTPS redirect for hosts the certificate does not name, suffix and pattern names are no exact hosts, a leading dot has no parent, handed requests keep their host in the cache key
  • 7cee383 fix(lua): node IP hosts match exact names only, hosts longer than 253 skip patterns, a higher Lua match limit, Force HTTPS on a handed request needs the default certificate
  • ae5928f fix(lua): one rule for an ambiguous path, identity headers on every request, Basic successes
  • 610f48c fix(lua): referring hosts in statistics keep underscores in labels and leave out IPv6 literals, as the agent validates them
  • 65f760a fix(lua): requests refused before a signed URL's signature left the path log and count no path
  • 5184e01 fix(lua): scan protection bans again whenever the address is not banned
  • cacf061 fix(lua): soft GeoIP lookups after the bans, the client certificate and maintenance, at most 200 cache misses a second per worker
  • d97c4f1 fix(lua): the live view keeps sequence numbers dense, counts requests over the rate as dropped, and waits for a number another worker is still storing
  • 4da1c43 fix(lua): the saved bytes read $request_method, available wherever stats.log runs
  • 82e2d7d fix(lua): the scan ban guard only covers concurrent workers (1 s)
  • 469b39a fix(lua): the site's charset applies to origin-layer responses only, not to pages the node makes
  • 1f12a3a fix(render): edgeweir_logs 32 MiB, for 2000 queued lines whose path, User-Agent and Referer come from the client
  • 56d7d0e fix(render): names of unbound sites without a certificate stay unknown hosts on HTTPS, node IP access before the generic server and on a default site without a certificate, HTTP/2 where the default server negotiates it, patterns ordered by their own site
  • bc93e78 fix(render): node IP hosts and requests without Host on the server of their handling before any regex name, unbound sites' IP names by node IP access, patterns skip hosts longer than 253 instead of a guard server
  • 84e0c56 fix(render): pattern server names without PCRE limits, a guard server for hosts longer than a DNS name, the generic server takes requests without Host, unbound sites never fall to another site
  • e301dd0 fix(render): the default site's server keeps h2c and $host "_"; wildcards take one label with a default site; pattern server names carry match limits and stay case-sensitive
  • 69be7ba perf(lua): workers remember the live view's marks for 250 ms, so requests take no edgeweir_tap lock while nobody watches
  • ca448ab test(configir): Basic users hashed with fewer than 1000 or more than 200000 iterations are left out
  • 7e1338f test(configir): Host header vectors shared with the console
  • 27492b3 test(configir): content hash vector of proto v0.22.0 shared with the console
  • 866eb11 test(configir): content hash vector of proto v0.23.0 shared with the console
  • ca7886f test(configir): content hash vector of proto v0.24.0 shared with the console
  • 6f4b06a test(configir): content hash vector of proto v0.26.0 shared with the console
  • abc1a38 test(configir): point the keys_zone note at ADR-0035
  • 4913d11 test(configir): the proto v0.28.0 content hash vector shared with the console
  • c2312a8 test(configir): the rules body limit reaches the site table only when set
  • fca3585 test(configir): the v0.24.0 hash vector byte-identical to the console's copy
  • 6793c67 test(configir): the v0.31.0 content hash vector shared with the console
  • daa6761 test(configir): the v0.31.0 vector as the console formats it
  • e50b2fd test(e2e): G10 suffix and pattern hosts, unknown hosts and scan bans
  • 1c6f91d test(e2e): G11 certificates chosen by the ClientHello, required client certificates, session resumption per site, ticket key rotation and no early data
  • b9c217b test(e2e): G14 smoke checks for rule bans, custom responses, close, CRS skips and exclusions by path, body fields, rate limit bans, access log lines and challenge additions
  • d9c8e50 test(e2e): G15 smoke checks for content settings, PURGE, maintenance, origin tries and cache zones
  • e1b658e test(e2e): G16 smoke checks for access log fields and options, blocked requests on a site that samples nothing, edgeweir-node accesslog and the statistics dimensions, with synthetic GeoIP data
  • d685d5a test(e2e): G16 smoke checks pass the response to status_of and header_of as arguments
  • 7338aa6 test(e2e): G9 smoke checks: sites bound to listener ports, ip.peer and X-Forwarded-For behind the PROXY protocol, a layer-4 port range on the arriving port
  • d65d9c4 test(e2e): WebP / AVIF variants by Accept, cached once each, HEAD and ranges, limits, purges and the saved bytes
  • 27a7ca2 test(e2e): a preflight handed to the origin gets the edge's preflight headers
  • 5541e9f test(e2e): a request without Host is node IP access while unknown hosts go to the default site
  • 077abc7 test(e2e): read the node log completely before looking for a conversion
  • db1f530 test(e2e): rules-v3 in the container smoke test
  • 37935c1 test(e2e): smoke checks for Basic, signed URLs A-D and forward authentication
  • d54947b test(e2e): smoke checks for site lists, CORS preflights at the edge, hotlink, user agents, security headers and WebSocket origins
  • bbbe8a5 test(e2e): the suffix server name skips hosts that start with a dot
  • cf20baa test(lua): block reasons, log fields and options, forced lines, live view, soft GeoIP, UA classes and dimension bounds
  • a53d22a test(lua): ip.peer in the expression vectors shared with the console
  • 5c3c6c5 test(lua): the control API's live view endpoint
  • 1efe871 test(lua): the sampled queue holds 2000 lines of client-sized fields in edgeweir_logs as rendered (32 MiB)

Verify

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/marvinli001/edgeweir-node/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt
sha256sum --ignore-missing -c checksums.txt
gh attestation verify <artifact> --repo marvinli001/edgeweir-node
Assets 26
Loading