Skip to content

Commit

Permalink
Various changelog edits
Browse files Browse the repository at this point in the history
  • Loading branch information
daghf committed Nov 7, 2023
1 parent 7720cec commit 37f7a85
Showing 1 changed file with 44 additions and 34 deletions.
78 changes: 44 additions & 34 deletions doc/changes.rst
Original file line number Diff line number Diff line change
Expand Up @@ -35,23 +35,6 @@ release process.
Varnish Cache 7.3.1 (2023-11-07)
================================

* The ``vcl_req_reset`` feature (controllable through the ``feature``
parameter, see `varnishd(1)`) has been added and enabled by default
to terminate client side VCL processing early when the client is
gone.

*req_reset* events trigger a VCL failure and are reported to
`vsl(7)` as ``Timestamp: Reset`` and accounted to ``main.req_reset``
in `vsc` as visible through ``varnishstat(1)``.

In particular, this feature is used to reduce resource consumption
of HTTP/2 "rapid reset" attacks (see below).

Note, in particular, that *req_reset* events may lead to client
tasks for which no VCL is called ever. Presumably, this is thus the
first time that valid `vcl(7)` client transactions may not contain
any ``VCL_call`` records.

* Added mitigation options and visibility for HTTP/2 "rapid reset"
attacks (CVE-2023-44487_, 3996_, 3997_, 3998_, 3999_).

Expand Down Expand Up @@ -85,37 +68,64 @@ Varnish Cache 7.3.1 (2023-11-07)
``main.sc_rapid_reset`` in `vsc` as visible through
``varnishstat(1)``.

* The ``cli_limit`` parameter default has been increased from 48KB to
64KB.
* A race condition has been fixed in the backend probe code which
could trigger a panic with dynamic backends (dyn100_).

* ``VSUB_closefrom()`` now falls back to the base implementation not
only if ``close_range()`` was determined to be unusable at compile
time, but also at run time. That is to say, even if
``close_range()`` is compiled in, the fallback to the naive
implementation remains.
* A bug has been fixed in the ESI code which would prevent use of
internal status codes >1000 as their modulus 1000 value (3958_).

* Fixed ``varnishd -I`` error reporting when a final newline or
carriage return is missing in the CLI command file (3995_).
* Fixed a performance issue in http/2 upload processing (3930_).

* Improved and updated the build system with respect to autoconf and
automake.
* A regression introduced with Varnish Cache 7.3.0 was fixed: On
HTTP/2 connections, URLs starting with ``//`` no longer trigger a
protocol error (3911_).

* Improved ``VSB_tofile()`` error reporting, added support for partial
writes and support of VSBs larger than INT_MAX.
* A bug has been fixed where ``unset bereq.body`` had no effect when
used with a cached body (3914_).

* Fixed a compatibility issue in the abstract socket support (3908_).

* Improved HPACK header validation.

* Fixed scopes of protected headers (3984_).
* HTTP/2 header field validation is now more strict with respect to
allowed characters (3952_).

* The ``vcl_req_reset`` feature (controllable through the ``feature``
parameter, see `varnishd(1)`) has been added and enabled by default
to terminate client side VCL processing early when the client is
gone.

*req_reset* events trigger a VCL failure and are reported to
`vsl(7)` as ``Timestamp: Reset`` and accounted to ``main.req_reset``
in `vsc` as visible through ``varnishstat(1)``.

In particular, this feature is used to reduce resource consumption
of HTTP/2 "rapid reset" attacks (see below).

Note that *req_reset* events may lead to client tasks for which no
VCL is called ever. Presumably, this is thus the first time that
valid `vcl(7)` client transactions may not contain any ``VCL_call``
records.

* The ``cli_limit`` parameter default has been increased from 48KB to
64KB.


.. _CVE-2023-44487: https://nvd.nist.gov/vuln/detail/CVE-2023-44487

.. _3984: https://github.com/varnishcache/varnish-cache/issues/3984
.. _3995: https://github.com/varnishcache/varnish-cache/issues/3995
.. _3996: https://github.com/varnishcache/varnish-cache/issues/3996
.. _3908: https://github.com/varnishcache/varnish-cache/issues/3908
.. _3911: https://github.com/varnishcache/varnish-cache/issues/3911
.. _3914: https://github.com/varnishcache/varnish-cache/issues/3914
.. _3930: https://github.com/varnishcache/varnish-cache/issues/3930
.. _3952: https://github.com/varnishcache/varnish-cache/issues/3952
.. _3958: https://github.com/varnishcache/varnish-cache/issues/3958
.. _3996: https://github.com/varnishcache/varnish-cache/pull/3996
.. _3997: https://github.com/varnishcache/varnish-cache/pull/3997
.. _3998: https://github.com/varnishcache/varnish-cache/pull/3998
.. _3999: https://github.com/varnishcache/varnish-cache/pull/3999

.. _dyn100: https://github.com/nigoroll/libvmod-dynamic/issues/100

================================
Varnish Cache 7.3.0 (2023-03-15)
================================
Expand Down

0 comments on commit 37f7a85

Please sign in to comment.