Skip to content

v1.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 05:22
· 73 commits to master since this release
v1.6.0
1c5f6a6

Changes

  • IP greylist (proto v1.6.0, greylist-v1). Greylisted addresses are challenged or rate limited instead of blocked: a challenge entry sends the request to the chosen challenge first, a rate-limit entry allows each client (an IPv4 address, an IPv6 /64) a number of requests per window on each node and answers 429 ip-greylisted beyond it. Entries come over the ban channel (GetBans with greylist), expire on their own and survive a restart; a ban of the same address wins. Older agents never receive greylist entries.
  • Kernel connection limits (conn-limit-v1). With NodeConfig.connection_limits, nodes that manage the nftables table inet edgeweir limit each client's concurrent TCP connections and new connections per second (with a burst) on the configured ports, after the allow sets and the ban sets; packets over a limit are dropped. UDP is not limited. The node reports whether the limits are active, or why not, in its ban status.
  • Encoded path exemptions (encoded-path-exemptions-v1). A site may name raw path prefixes where %2F and/or ; path parameters no longer make a path ambiguous, so access control and caching apply there as for any other path; paths that stay ambiguous (..%2F, ..;, %2E, %25 …) are still handled at the strictest scope.
  • PROXY protocol to HTTP origins (origin-proxy-protocol-v1). An origin can receive a PROXY protocol v1 or v2 header at the start of every connection, naming the visitor's address and the node address and port the visitor reached; over TLS the header goes before the handshake. Origin connections are pooled per visitor connection in each nginx worker and never shared between visitors. This needs edgeweir-openresty 1.31.1.1-3 (proxy_protocol_header for HTTP upstreams); the agent announces the feature only when a configuration test with the directive passes.
  • gRPC active health checks (active-health-grpc-v1). Active health checks can probe grpc.health.v1.Health/Check (optionally for one service) over h2c or TLS with ALPN h2; an origin is up when it answers SERVING.
  • Origin CA rotation (origin-ca-rotation-v1). During a rotation the node trusts the previous Origin CA (NodeConfig.origin_ca_previous) next to the current one, each with its own CRL, for origin TLS and active health checks.
  • Debug logs on demand (debug-logs-v1). The agent and the supervisor keep recent log entries of every level in memory (--debug-log-buffer, 5000 by default, at most 4 MiB, 0 turns it off); the console pulls them with a DebugLogsTask and the node uploads the matching entries once (UploadDebugLogs). Nothing is written to disk or uploaded otherwise.
  • --stats-interval (1s–1m, default 1m): how often finished minutes of statistics are drained and uploaded; shortened only in end-to-end tests.

With an older console nothing changes: it sends none of the new fields or tasks.

Upgrade: use the console's node upgrade, or the install command with --version 1.6.0.

Changelog

  • c13268a Merge branch 'e2e-speed-2'
  • f441634 Merge branch 'encoded-path-exemptions'
  • 4d1c907 Merge branch 'feat/greylist-connlimit'
  • b180576 Merge branch 'feat/node-debug-log-pull'
  • 8c3adaf Merge branch 'feat/origin-ca-rotation'
  • 266ce94 Merge branch 'feat/origin-proxy-grpc-health'
  • 00f5378 Merge branch 'feat/origin-proxy-grpc-health' (pool key tests)
  • b9f5b79 build(openresty): proxy_protocol_header for HTTP upstreams; release 1.31.1.1-3
  • d3b9c6a build(proto): generate DebugLogsTask and UploadDebugLogs (unreleased proto)
  • d9cfb48 build(proto): generate NodeConfig.origin_ca_previous (console proto, before its tag)
  • 0f0f7ec build(proto): generate Site.encoded_path_exemptions
  • 86c0373 build(proto): generate from proto/v1.6.0
  • 7bf2a47 build(proto): generate from the console's proto with Origin.proxy_protocol_version and gRPC health checks
  • b683e52 build(proto): generate greylist and connection limit messages (pre-tag)
  • 7b700b9 docs(architecture): PROXY protocol to HTTP origins and grpc.health.v1 probes
  • 2f92cd0 feat(agent): --stats-interval for shorter statistics uploads in end-to-end tests
  • 9e77ec7 feat(bans): greylist entries from GetBans, kept apart from bans
  • 3d6e148 feat(configir): PROXY protocol per origin and gRPC active health checks
  • 4b9fbc0 feat(configir): validate and hand over encoded path exemptions
  • 4adafd4 feat(dataplane): PROXY protocol to HTTP origins
  • 62e4f6a feat(healthcheck): grpc.health.v1 probes and PROXY protocol headers
  • 3639d0b feat(lua): encoded path exemptions in path scopes, access authentication and the cache key
  • e7166c8 feat(lua): greylist entries challenge or rate-limit their addresses
  • 3eaec0e feat(nft): per-client connection count and new connection rate limits
  • e840afd feat(nodelog): debug log ring buffer of every level, pulled with DebugLogsTask
  • 7f15f11 feat(origin-ca): trust the previous Origin CA during a rotation (origin-ca-rotation-v1)
  • 1c5f6a6 style(configir): gofmt the v1.6.0 vectors
  • cbe3131 test(configir): encoded path prefixes against the shared vectors
  • ccbf38a test(lua): pool keys of PROXY protocol origins per client connection; document per-worker pools

Verify

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/marvinli001/edgeweir-node/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt
sha256sum --ignore-missing -c checksums.txt
gh attestation verify <artifact> --repo marvinli001/edgeweir-node
Assets 26
Loading