Skip to content

roxy 0.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 17:34
· 91 commits to main since this release
v0.1.1
6b5b369
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A hardening release: a day of fixes from a full read of the code against the docs, plus the CI changes needed to trust the checked-in WASM fixtures.

Fixes

WASM addon host

  • A guest head with tens of thousands of header fields no longer panics the host; it is refused at limits.max_headers and logged as an invalid response (#434).
  • A guest that writes to stdout or stderr no longer fails every exchange through its layer; only the exchange's own streams and pending responses count as leaked (#438).
  • A handler that returns without responding is treated like a trap: the instance is discarded and the host is told (#439).
  • Endpoint call bodies are bounded by the in-flight permits: a call waits for its slot before its body leaves the guest (#435).

Rules

  • like patterns are capped at 1 KiB and compiled with the same size limits as matches, so no policy can panic the compiler; ? now matches one character, as documented (#440).
  • Host and SNI literals that can never match (trailing dot, non-ASCII, bracketed IPv6) are compile errors with a rewrite hint (#441).

Service layers

  • A connection whose write side has died fails its exchanges at once (service:closed) instead of after first_byte_timeout (#442).
  • Body frames on an ended stream are dropped without crediting, so a misbehaving service cannot grow roxy's memory (#436).
  • WebSockets through a service layer are now covered by tests (#449).

Proxy

  • Response-body inspection now applies response_body_idle_timeout; a stalled upstream under a body rule gets a 504 instead of holding the slot (#437).

Docs, repo and CI

  • The reference no longer overclaims: timeouts, drain and linger limits, hop-by-hop list, node 410 handling, lease fields and several others corrected (#451); HTTP/1.0 close-delimited responses documented (#443); SECURITY.md added (#448).
  • CI pins Rust 1.99.0 (matching the release builds) and a dated fuzz nightly; the WASM test components build reproducibly and CI fails if the checked-in fixtures drift (#450).
  • cargo deny ignores RUSTSEC-2024-0449 (unsafe-libyaml via serde_yaml_ng) until the YAML parser is replaced (#454).

Removed

  • The dead transparent-listener config shape (mode: transparent, allow_passthrough, upstream_target) is gone; those keys are now unknown-field errors.
  • The globset dependency.

Upgrade notes

  • A policy with a host literal ending in a dot, containing non-ASCII, or written as [::1] now fails roxy check; rewrite it as the diagnostic suggests.

What's Changed

  • roxy-addon: move untouched bodies and heads host-side to cut a no-op layer's cost (#403) by @tcatling in #418
  • Remove the unused MetricSource trait from roxy-rules by @tcatling in #417
  • Post-head faults carry their reason into the request event by @tcatling in #419
  • Addons: a layer subscribes to the parts of the exchange it needs (#319) by @tcatling in #420
  • Service layers: spread streams across connections and batch flushes by @tcatling in #423
  • roxy-node: judge certificate expiry by an injectable clock by @tcatling in #428
  • Addon interface: heads as records, bodies as bare streams (roxy:addon@0.2.0) by @tcatling in #424
  • Docs: rewrite the performance page around what a reader can expect by @tcatling in #426
  • first_byte_timeout: one budget per head for WASM layers too by @tcatling in #431
  • deny: ignore RUSTSEC-2024-0449 (unsafe-libyaml) until the YAML parser is replaced by @tcatling in #455
  • Docs: say what the code does where the reference overclaimed by @tcatling in #457
  • roxy-wasm: a handler that returns without answering fails the exchange before settling by @tcatling in #460
  • build(deps): bump the actions-minor-patch group with 3 updates by @dependabot[bot] in #452
  • build(deps): bump the cargo group across 2 directories with 3 updates by @dependabot[bot] in #453
  • CI: pin the toolchain to 1.99.0 and check the wasm fixtures for drift by @tcatling in #456
  • Service layers: fail a stream closed when its message cannot be queued by @tcatling in #461
  • Service layers: drop body frames on an ended stream without crediting them by @tcatling in #462
  • Rules: bound like patterns and compile them with the regex limits by @tcatling in #459
  • Rules: reject host literals that can never match by @tcatling in #463
  • Add SECURITY.md pointing at private vulnerability reporting by @tcatling in #464
  • Apply response_body_idle_timeout while collecting a body for inspection by @tcatling in #467
  • Document and test HTTP/1.0 close-delimited response framing by @tcatling in #466
  • WASM host: hold a guest head to max_headers before lowering it by @tcatling in #458
  • WASM host: take the endpoint-call permit before the body leaves the guest by @tcatling in #465
  • Service layers: test WebSockets and the remaining failure paths through a stream by @tcatling in #468
  • WASM host: let a guest print to stdout and stderr by @tcatling in #469
  • Release 0.1.1 by @tcatling in #471

Full Changelog: v0.1.0...v0.1.1

Contributors

dependabot and tcatling
Assets 6
Loading