From b3bc56cd42332caf0dd55f33a8e08f1a9b5ccd39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?= Date: Thu, 8 Oct 2026 23:36:27 +0200 Subject: [PATCH] v0.29.3 --- AGENTS.md | 2 +- CHANGELOG.md | 7 ++ Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 14 ++-- ROADMAP.md | 10 +++ SHA256SUMS | 32 ++++----- docs/TEST_REPORT.md | 24 ++++++- src/admin/openapi.json | 2 +- src/proxy/error_fallback.rs | 28 ++++++++ src/proxy/tests/authority_tests.rs | 103 +++++++++++++++++++++++++++++ src/proxy/upstream_helpers.rs | 16 +++-- tools/checks/check_source.py | 22 +++--- tools/checks/docs_check.py | 6 +- tools/checks/preflight.py | 4 +- tools/checks/release_smoke.py | 10 +-- 16 files changed, 230 insertions(+), 54 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 36e4268..32dcb28 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,7 +2,7 @@ Read README.md, ROADMAP.md and docs/TEST_REPORT.md before making changes. The project name is RustProxy; the Cargo package/binary remains `rust-proxy` for -compatibility. Current source version: 0.29.2. +compatibility. Current source version: 0.29.3. ## Delivery diff --git a/CHANGELOG.md b/CHANGELOG.md index 182a045..7cace1b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,13 @@ > test-only changes and packaging implementation notes were moved to > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md). +## 0.29.3 + +- Fix internal error fallback on empty GET/HEAD requests over HTTP/2 and HTTP/3 with unknown body length; safely probe truly empty bodies without replaying nonempty or unbounded payloads. +- Preserve the final status and response body of the internal fallback target, including its own 404 HTML, without overwriting it with RustProxy's global error page; warn when a named fallback location is missing. +- Add Rust regression tests for empty H2/H3 GET/HEAD, nonempty unknown-length request bodies, unbounded POST, and fallback error-page precedence. Rust compilation and live proxy verification remain pending in this build environment. +- Retain SQLite schema 9, Cold Cache format 3 and saved-configuration compatibility with 0.29.2. + ## 0.29.2 - Debian install/update now deploys managed logrotate policy (14 daily rotations, 100 MB max, compressed, copytruncate) and repairs the shell PATH profile on upgrade. diff --git a/Cargo.lock b/Cargo.lock index 04411eb..c68b862 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1688,7 +1688,7 @@ dependencies = [ [[package]] name = "rust-proxy" -version = "0.29.2" +version = "0.29.3" dependencies = [ "anyhow", "arc-swap", diff --git a/Cargo.toml b/Cargo.toml index 3d54448..097859a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rust-proxy" -version = "0.29.2" +version = "0.29.3" edition = "2021" rust-version = "1.88" description = "RustProxy - independent reverse proxy with local administration" diff --git a/README.md b/README.md index 1f66596..05ebced 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,9 @@ -# RustProxy 0.29.2 +# RustProxy 0.29.3 Independent Rust reverse proxy and static Web Server with a dashboard, SQLite configuration, streaming HTTP/TLS/WebSocket forwarding, raw TCP/UDP stream hosts, IP-bound vhosts and backend pools. -**0.29.2 release source.** +**0.29.3 release source.** ## Layer-4 streams @@ -11,7 +11,13 @@ Raw TCP/UDP forwarding has its own **Streams** page in the primary navigation, a Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost hostnames, including multi-address listeners. -## What changed in 0.29.2 +## What changed in 0.29.3 + +- Fix internal error fallback for empty GET/HEAD requests over HTTP/2 or HTTP/3 with unknown body-length hints by safely checking if the body stream is empty; nonempty and unbounded bodies remain protected from unsafe replay. +- Preserve the final status, headers and HTML returned by the internal fallback location, including its own 404 page, instead of replacing it with RustProxy's global error page. Warn when a named internal target cannot be found. +- Add Rust regression tests for empty H2/H3 GET/HEAD, unknown-length request bodies and response precedence. These Rust tests require a Cargo-enabled environment before production deployment. + +## Previously in 0.29.2 - Add Nginx-style **internal error fallbacks** for the vhost source and Custom locations. Configured upstream/Web Server statuses can internally hand the original method, URI, query string and request context to an `internal` Custom location without an HTTP redirect. Supported bounded statuses are `403/404/500/502/503/504`; configuration cycles are rejected and runtime dispatch has a depth limit. - Execute error fallback before an intercepted response is finalized or cached. The target location re-enters the normal vhost/location pipeline, including ACL, headers, compression, cache policy and response processing. Request bodies are replayed only when safely bounded and replayable; otherwise the original error is retained. @@ -19,7 +25,7 @@ Named HTTP/HTTPS listener bind addresses use the same chip-style editor as vhost - Add streaming **multipart byte-range** responses for requests such as `Range: bytes=0-99,200-299`, with a maximum of 16 ranges and identity representation for multipart responses. - Add opt-in PHP-FPM **PATH_INFO** splitting. With `path_info: true`, `/index.php/foo/bar` securely resolves the existing `index.php` script, keeps `SCRIPT_FILENAME` on that file and sends `/foo/bar` as `PATH_INFO`. -0.29.2 keeps SQLite schema 9 and Cold Cache format 3. Existing 0.29.0 configuration remains compatible; new fields use safe/default-off serde defaults. Historical details are in [CHANGELOG.md](CHANGELOG.md). +0.29.3 keeps SQLite schema 9 and Cold Cache format 3. Existing 0.29.0 configuration remains compatible; new fields use safe/default-off serde defaults. Historical details are in [CHANGELOG.md](CHANGELOG.md). ### Historical 0.26.7 release notes diff --git a/ROADMAP.md b/ROADMAP.md index 3d08b17..f792d39 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,5 +1,15 @@ # RustProxy roadmap +## 0.29.3 - HTTP/2 and HTTP/3 internal fallback stabilization + +Current direction: 0.29.2 -> 0.29.3 + +- [x] Allow empty GET/HEAD bodies with unknown length hints to enter the internal error fallback path. +- [x] Preserve the final internal fallback response, including the fallback backend's HTML on HTTP 404. +- [x] Add Rust regression tests for fallback dispatch, request-body safety and error-page precedence. +- [ ] Run Rust unit tests, build and end-to-end HTTP/2/HTTP/3 fallback acceptance on a compiler-equipped machine. +- [x] Preserve SQLite schema 9 and Cold Cache format 3 without configuration migrations. + ## 0.29.2 - PHP-FPM operator controls and observability - [x] Add bounded, operator-only PHP_ADMIN_VALUE INI overrides per Web Service. diff --git a/SHA256SUMS b/SHA256SUMS index a02167b..44686cc 100644 --- a/SHA256SUMS +++ b/SHA256SUMS @@ -1,13 +1,13 @@ 61bf40a0572889dc8b0dda9eae4e93e44b0de9364b3c798106c85700ffb37c23 .dockerignore 4140a2956264b44f259e6a37fc00ba02097bbe68b09296e04d3d243c1287129b .env.example 9e6356475bf587091bab72246ec9e325b498f7e48a6220e9a18baa50d0a385a6 .gitignore -6168eae7ed217707898df7041be628b3d24b7dfa51f4aa5b3c5d7f7238e33c37 AGENTS.md -db6548b334df4476717cc4fbae4d61b4e20ca05733cb66f56f06e68d2306cf61 CHANGELOG.md -d81f6b20d330b8b67202f9736b5dc8f6314522c3f013895065452bfbb49809fa Cargo.lock -005ba4b3bd3bf5555b74448065a7a6012d7b944534a8bca04c1658031d978bbe Cargo.toml +8e809683178496518f708eaa180d9f29023426d73657a908d3dd3102bac1de4d AGENTS.md +14fa3bd7730d7d353c3964ece8a5435d756664b0695260528ffc3704b378c8a0 CHANGELOG.md +286285f4ec28ce638041b81013b8c8c5fe9150471ee5b7b18aeede3136c7d2ee Cargo.lock +e5647cd8a0998d3fff7e8a9ef3753dac28edc8280c377d516ad9c33e617a9a00 Cargo.toml 75b008f237b2226c62a7721b7901018ce83bfc2726f047a83a17c66fcb799f3b Dockerfile -46005f2fb18f4b737a9db696ad9e68175a53e006a7bac590a47bee9658d010f2 README.md -e63a65964f5c8bb244afafcaaed4dcce2d8d9e161cfb0730f399c4e786988ab5 ROADMAP.md +9c768f1884bb19cda9c7d2f66242e1f4424c78e98e2aa4323eb6acfa74cbb3d0 README.md +13bde8e3830c2611ac4f2aac2dbcd6d39318196b56a6d70023b18dda9daa7fb5 ROADMAP.md da8311e3db945290666324a2f24bf4521b365272d7ac3f862ded1be993eea646 UPDATE_CHECK.toml f645f218dd062bf6cb54a8ee634290562cad364a4cccf09f16e3c8303582af8c build.rs ea8d091843f86f4c66a5c76b20268b2feb397070851b6e05c5bc7d7a8d9157eb deploy/README.md @@ -21,7 +21,7 @@ bf687a851374d8f1fa59d050f3f76532f7c12f16a6daa7d3c36102c2d9a8ec9c docker-agent/d 9d77c90767fa929ee8338734d72ce83284d3d965673270f62cb2b1613d587a33 docker-agent/install.sh b68234472bec5cedd67c7cfe1de7d8806a965dfd4101f944aa6320132f18c14e docker-agent/main.go 3d4051a1f805d145df3877476e4b87773e74be8e123045065955a5133afdc68c docker-agent/main_test.go -ee4f99b6256713b346453789c78a40dd8eea267fc3179d72e2a3c834476b9749 docker-agent/model.go +68ad007eac216f115809695d3c2c6651e2850ff3d7334685ae6e49bc21b01087 docker-agent/model.go e52b31d0abf65ae3034f6cb367cca113633014ce8d1d799ad4dd5624d2c7b8bb docker-agent/network.go 634790f35ff4627df2a78cec2ed371f6e9ec9df00afb386075595fc7f3ed72eb docker-agent/rustproxy-docker-agent.service 5220d669171ec3ad65f50e0bc8de5178dadaa4904def8e1a4f61002aa9e9a55b docker-agent/server.go @@ -60,7 +60,7 @@ a2bb837cdd3559d58158880c1f832badf64035376a3623050bb4e40c2bca104c docs/ROADMAP_H 620b69e566d27af04f0604f4ca3f88cf95cdfea7fbc6ae9dd92446d2b2b5d9be docs/SECURITY_AUDIT.md d5c5c59f6e63b8d83dad5d159657c4d4039dfeb4cc1d8af210169b576adbf7e2 docs/SETTINGS.md 3611defd206cde107e75cac006159856d12cd8f15df7ae2eb9ec3592ed2b4abd docs/STREAMS.md -bbf21108ebf9e9b73f346383cae2cf33807ad250a1e1086d273e8b997e173d78 docs/TEST_REPORT.md +24fbc7f7a4db65b14437ebaa02cb48387039ddde5f8f826e5ff116b10162235e docs/TEST_REPORT.md cfb452d8496839e832b5fbacdd4e52525b0ecc3112fbb62340c1e580bd5c1717 docs/TODO.md 8ee6187a5460ca45643b7fd789e27bffd264449e3a92ff70e9359edee011bbbb docs/TRANSFORM.md 660687fc961f71aae2bdf71595aa47a336fa782f4e78ceee8c1d1e63e46393ee docs/TRANSPORT.md @@ -182,7 +182,7 @@ e9f72e65c9ceb255248f460cd7a003fff33e4b258160e248353c3e1fb4e952fb src/admin/file 1596561bb57976268b02e36e8ace426091045ee9d3f8832ce775eccdbc30bc81 src/admin/file_logs_io.rs de331ab75c31df65a4f0f1607dbfb26972799bff5d9f232d8e914c38225cffc7 src/admin/logging_api.rs 58802528128f53e493f7339063433a747b605007a8842b5efc670132d897d6f7 src/admin/mod.rs -1bdda508bfcc5cb1fa88ea0ce342808f71c1929baf783cc1fac8a738147c9ff9 src/admin/openapi.json +325ea183ae4ab6f5cf228d7027db31a2f7f08190acc709fbcc0af3f1a5de2752 src/admin/openapi.json 6c2b9a0ecb2f4172f110a363c22a6be32895dbcff9605fe7aa94efe91e0a536a src/admin/operations.rs 5287fff6b3ad436ac695e9b66feb1b0b5705b744a9f00cec7ea6a3e951e5eebf src/admin/preferences.rs 31bd90ee5f5ec2984920225ff6b57e07db3e0758092fb55d7c230e3590c1b015 src/admin/public.rs @@ -372,7 +372,7 @@ e03f0d6b3f35dae6b98c394837aa0d17e4d73a8306767b4c607868bc00c30286 src/prometheus b5856fd38a957b2ca9c7e3606d84d13d5cfcf3a45b487b15ae1d2dc248cbda57 src/proxy/body.rs 16b9d4db3b20b2ab14c47ac14fcd18d3d8ca77c3ad9a1f37866ebfa60f379862 src/proxy/body/tests.rs f0cb26ed34c35bacc74b914457acac8a611390de14cf46e2e6d3bcc848e914e8 src/proxy/cache_helpers.rs -7bb29e31861757415c9c4d34d3b0b933c67d86a5758e9bdbcde6b54b307b689a src/proxy/error_fallback.rs +af6885dddecef81c3b12a61e7e0bd9d77123321c5cec0e15d0e77f29e7868fed src/proxy/error_fallback.rs cfb0910af8cd868bde3f6c9992319e46d5328d6d8f69c50701df0ea12bef2108 src/proxy/forward/cache_lookup.rs e5eec11349cda99d08b27f730202a57457fb2f48f856537b07dbda669168b5bd src/proxy/forward/response.rs 8ad9a8dee80a7c16a60f1dd0126790daf3cde1a13e28a2595a0ef64f3fd63792 src/proxy/forward/route_cache.rs @@ -384,9 +384,9 @@ c438066616527a3108f2ad53e3698ae9b2a80961714394cdd0a450c92f99d992 src/proxy/head 5cb7522ceb9a9f083a15596ac4898559295e38d1138c80099577211de8a868ec src/proxy/headers/tests.rs f202c0fe0bc4e786a906d7337d368cd81bcac15ffdbbfd35d5b0d49126d9895a src/proxy/mod.rs 55133ceace2e5262d9c54fa41bea099a27b817d1e09c1cd0e2493fd9cee4da38 src/proxy/redirect_helpers.rs -3c6ffd4b8578af0836976707f918d73b9516ab37d97e68744d3d608fbaa30438 src/proxy/tests/authority_tests.rs +c3cbffe01436901190aaf88ee280279c85bdf00b560c02a04e20a267844cf39d src/proxy/tests/authority_tests.rs e80c7fe44abb7607c64ea02d56542753dc25290b3bcf4c4d45b75f2db6ca90d0 src/proxy/types.rs -ed1a4dfb68054252c3fb0b64de4dcd9ce00d394e008b79cb169012ef4075297f src/proxy/upstream_helpers.rs +6fb90a995dd6b81f681cd283d71f3dbea09b8dcb4a4b17a433e0213d6a55e245 src/proxy/upstream_helpers.rs 69f775f6746b4c6d729dc10961dbef54168846f4ce9cf7fe453ab5a2b879c9b8 src/proxy/websocket.rs 016a60b2471edd3df9bbe9f92a9cebea11047178b83ff0e3b2351c12814a4939 src/proxy/websocket/handshake.rs 7e9c4d4c207badabf90630223964bb2ad641f06d4149843cab751f192b8b4adf src/proxy/websocket/tests.rs @@ -493,12 +493,12 @@ eecf680f001f2110dde4eceaccf2f922859a16c946a644f8854e8de4d3771f7c tests/policies 728999110a6d8cacb62bc0399bc333fa23a66526ee23f563a3c93bf00e5fad19 tests/transport_config.rs b04362ad082a32c9ccc4cf38c46f44d71347adecf7aba3224b3af3ea4872e3d0 tools/README.md 358c1e94dd2b4a756430e5335747f0b437345b1713670a9972c5bcf78b837ccb tools/audit/admin_audit.py -fa6565e6edca33225b86a4589f9b3f0a823369069a9634825b1e0a4b2d37af31 tools/checks/check_source.py -0c01cc6980d2ed09f9dab9f2985980375981bbc930e53c7179fb9016d31aea67 tools/checks/docs_check.py +ecb7aee67967502c809f497478b5eb8c2ad8faf702dc5149f5829313409dc42d tools/checks/check_source.py +aa6b1685f19ff7ba39c48c3c53602bce5c04710d59dbd69949fcb7e66de0bf4a tools/checks/docs_check.py 4f7821e7e25b09ce251d25a0b3fb4d8ce8396c36a5ed971c2637aeb325425909 tools/checks/langs_check.py cf762780c4085791c72c3c5f93054d7f2a1107403bee0616a1f4113bbcbb99f9 tools/checks/memory_contracts.py -c8b6981af08a78b06f7eaaa251514cec7f807a3e8508c1991049eb9d781c007a tools/checks/preflight.py -cfa24e9792d9e151b84937ec274b23f1e266ebaee63e62056e1bdfa2fee02af1 tools/checks/release_smoke.py +a7004a3ba3c954124497d171037008ddad168e14afb0dfd46d0742d017925c82 tools/checks/preflight.py +14fe411c10eadb7ce9f7385d3e62a442302c14ca9d45c956cbca1cc6a1ac9788 tools/checks/release_smoke.py f69845bc26ec33160fc756953991cf32aa8ad6a7fb4a131caa2093db91e783ef tools/checks/rust_module_contracts.py ecfe0bb21a7549225a19b0846bb6de8c99cbfbbf5a706d33cf84db2c7146abed tools/checks/rust_source.py adf84a983e0dbba228e47d71ec2d5c9964f7ca9989d5139de58f96ee961b035a tools/checks/security_contracts.py diff --git a/docs/TEST_REPORT.md b/docs/TEST_REPORT.md index d320ae5..4cce713 100644 --- a/docs/TEST_REPORT.md +++ b/docs/TEST_REPORT.md @@ -1,7 +1,19 @@ -# Verification report - RustProxy 0.29.2 +# Verification report - RustProxy 0.29.3 ## Changes +0.29.3 fallback correction (operator report): the replay-body guard +treated HTTP/2 and HTTP/3 GET/HEAD bodies with unknown size hints as non-replayable, +even when the stream was empty. The fallback guard now performs the existing +bounded empty-body probe for GET/HEAD; a true empty stream is replayable, while +nonempty/unknown-length request bodies are forwarded only once. The internal +target lookup now warns when the named location cannot be resolved. Added Rust +async regression tests for empty H2/H3 GET/HEAD, unknown-length GET payload +preservation, and unbounded POST non-consumption. The observer also preserves the +final internal fallback response (including its 404 HTML) instead of applying a +second global/vhost error page; a Rust test exercises this precedence. These Rust tests have not been +executed in this environment because Cargo is unavailable. + Same-version 0.29.2 correction: Web Server main routes no longer inherit `transient_unavailable` from the vhost backend configuration. When the Web Server source has no enabled Reverse Proxy Custom Locations, backend definitions are not compiled. An enabled reverse-proxy Custom Location still compiles and uses the backend pool. Removed fallback-only Prometheus metrics, retained PHP/Web Server metrics. Validated operator-controlled PHP_ADMIN_VALUE FastCGI configuration per Web Service, @@ -19,6 +31,12 @@ This source package is not certified for production deployment. ## Checks performed +- 0.29.3 release identity: `Cargo.toml`, the root `rust-proxy` entry in `Cargo.lock`, administration OpenAPI version, README, CHANGELOG, ROADMAP, AGENTS and verification-report heading were updated to 0.29.3; the fallback source changes from the tested 0.29.2 correction are retained. +- 0.29.3 offline validation: `python3 tools/checks/version_contracts.py`, `python3 tools/checks/check_source.py`, `python3 tools/checks/release_smoke.py` passed; `bash ./dev.sh test` passed all listed non-Rust checks and stopped at missing Cargo with exit 127. This does not constitute compilation or successful runtime testing of RustProxy 0.29.3. + + +- Fallback correction: `bash ./dev.sh test` passed Rust-independent module, source, upgrade/SQLite, security, browser UI and documentation checks. It exited 127 at the missing Rust/Cargo toolchain. `bash ./dev.sh check` also exited 127 because Rust/Cargo is unavailable. The added Rust regression tests and the live HTTP/2/HTTP/3 proxy behavior remain **unverified** pending a compiler-enabled runtime and an operator test against `origin-1`/`origin-2`. + - Same-version correction: `python3 tools/checks/check_source.py` and `python3 tools/checks/release_smoke.py` passed. `bash ./dev.sh test` passed the Rust-independent checks and stopped at missing Rust/Cargo (exit 127). No live 503 regression test or Rust compilation could be performed. - `./dev.sh test`: all Rust-independent release, upgrade, security, JS, UI, documentation and source checks passed; exited 127 at the missing `cargo` toolchain guard. @@ -30,6 +48,6 @@ This source package is not certified for production deployment. Installer/update now installs /etc/logrotate.d/rustproxy using the recorded service user/group. Updates repair /etc/profile.d/rustproxy-path.sh rather than warning. logrotate uses copytruncate because RustProxy holds open log descriptors; some log records may be lost during truncate. Rust build and live Debian/systemd acceptance remain unverified in this environment. -## Version identity (0.29.2 source maintenance) +## Version identity (0.29.3 source release) -`Cargo.toml` package version is the canonical release identity. Rust uses `CARGO_PKG_VERSION` at build time; `build.rs` substitutes the admin HTML placeholder. Packaging, upgrade and dev scripts read the manifest with `scripts/version.py`. Run `python3 tools/checks/version_contracts.py` to check that executable paths do not hardcode a version. Historical documentation and external dashboards may retain manually managed versions. Rust compilation/runtime verification is still pending. +`Cargo.toml` package version is the canonical release identity (now 0.29.3). Rust uses `CARGO_PKG_VERSION` at build time; `build.rs` substitutes the admin HTML placeholder. Packaging, upgrade and dev scripts read the manifest with `scripts/version.py`. Run `python3 tools/checks/version_contracts.py` to check that executable paths do not hardcode a version. Historical documentation and external dashboards may retain manually managed versions. Rust compilation/runtime verification is still pending. diff --git a/src/admin/openapi.json b/src/admin/openapi.json index fdae581..5c3e111 100644 --- a/src/admin/openapi.json +++ b/src/admin/openapi.json @@ -2,7 +2,7 @@ "openapi": "3.0.3", "info": { "title": "RustProxy Administration API", - "version": "0.29.2", + "version": "0.29.3", "description": "Administration API for the active panel origin. Sign in through the panel; the same-origin HttpOnly cookie authenticates all private operations. Mutations also require the exact Origin, X-RustProxy-Request: 1 and a session-bound X-CSRF-Token. Loopback HTTP is the default; Settings can enable HTTPS before using a non-loopback administration bind. This document contains no live configuration or credentials. Object schemas marked extensible are summaries: full configuration validation is authoritative in Rust." }, "servers": [ diff --git a/src/proxy/error_fallback.rs b/src/proxy/error_fallback.rs index 0b320bd..ed40a85 100644 --- a/src/proxy/error_fallback.rs +++ b/src/proxy/error_fallback.rs @@ -8,6 +8,11 @@ struct InternalFallbackRoute { #[derive(Clone)] struct FinalRouteContext(crate::config::CompiledRoute); +/// The named location has already produced the terminal HTTP response. +/// In particular, do not replace its 404 HTML with a global/vhost error page. +#[derive(Clone, Copy)] +struct ErrorFallbackResponse; + #[derive(Clone)] struct ErrorFallbackRequest { method: Method, @@ -88,6 +93,21 @@ async fn prepare_error_fallback_body(request: &mut Request, enabled: bool) -> Re return Ok(ErrorFallbackBody::Replayable(Bytes::new())); } let Some(length) = request.body().size_hint().exact() else { + // HTTP/2 and HTTP/3 frequently expose an *empty* GET/HEAD body as a + // stream with no exact size hint. Refusing to inspect that stream + // silently disables the configured 404 fallback. Only peek for safe + // bodyless methods; an actual payload is replayed back into the + // original request and is never discarded or forwarded twice. + if request.method() == Method::GET || request.method() == Method::HEAD { + return match empty_for_cache(request).await { + Ok(true) => Ok(ErrorFallbackBody::Replayable(Bytes::new())), + Ok(false) => Ok(ErrorFallbackBody::Unavailable), + Err(_) => Err(error( + StatusCode::BAD_REQUEST, + "RustProxy: invalid or incomplete request body\n", + )), + }; + } return Ok(ErrorFallbackBody::Unavailable); }; if length > MAX_ERROR_FALLBACK_REPLAY_BODY_BYTES { @@ -131,6 +151,13 @@ async fn execute_error_fallback( .select_internal_on(host, &frontend.id, &fallback.target, local.0, tls) .cloned() else { + tracing::warn!( + vhost = %frontend.id, + route = %route.id, + target = %fallback.target, + status = status.as_u16(), + "error fallback target could not be resolved on this frontend" + ); return None; }; let ErrorFallbackBody::Replayable(body) = body else { @@ -148,6 +175,7 @@ async fn execute_error_fallback( }, ); let mut response = Box::pin(forward_request(state, peer, local, request)).await; + response.extensions_mut().insert(ErrorFallbackResponse); if response.extensions().get::().is_none() { response.extensions_mut().insert(FinalRouteContext(target)); } diff --git a/src/proxy/tests/authority_tests.rs b/src/proxy/tests/authority_tests.rs index f08c9e7..101bcd4 100644 --- a/src/proxy/tests/authority_tests.rs +++ b/src/proxy/tests/authority_tests.rs @@ -307,3 +307,106 @@ fn upstream_uri_preserves_nested_url_query_without_rejecting_valid_separators() let uri = upstream_uri(backend, suffix).unwrap(); assert_eq!(uri.path_and_query().unwrap().as_str(), suffix); } + +#[tokio::test] +async fn error_fallback_replays_empty_unknown_length_h2_h3_get_and_head() { + use bytes::Bytes; + + for version in [Version::HTTP_2, Version::HTTP_3] { + for method in [Method::GET, Method::HEAD] { + let stream = futures_util::stream::empty::>(); + let mut request = Request::builder() + .version(version) + .method(method.clone()) + .uri("https://www.example.test/missing?query=1") + .body(Body::from_stream(stream)) + .unwrap(); + assert_eq!(request.body().size_hint().exact(), None); + let result = match prepare_error_fallback_body(&mut request, true).await { + Ok(result) => result, + Err(response) => panic!("unexpected status {}", response.status()), + }; + assert!( + matches!(result, ErrorFallbackBody::Replayable(ref bytes) if bytes.is_empty()), + "an empty {method:?} request over {version:?} should allow fallback" + ); + assert!(request.body().is_end_stream()); + assert_eq!(request.uri().path_and_query().unwrap().as_str(), "/missing?query=1"); + } + } +} + +#[tokio::test] +async fn error_fallback_preserves_unknown_length_get_payload_without_replaying_it() { + use bytes::Bytes; + + let stream = futures_util::stream::iter([Ok::<_, std::io::Error>( + Bytes::from_static(b"unexpected-payload"), + )]); + let mut request = Request::builder() + .method(Method::GET) + .version(Version::HTTP_3) + .uri("https://www.example.test/missing") + .body(Body::from_stream(stream)) + .unwrap(); + let result = match prepare_error_fallback_body(&mut request, true).await { + Ok(result) => result, + Err(response) => panic!("unexpected status {}", response.status()), + }; + assert!(matches!(result, ErrorFallbackBody::Unavailable)); + assert_eq!( + request.into_body().collect().await.unwrap().to_bytes(), + Bytes::from_static(b"unexpected-payload") + ); +} + +#[tokio::test] +async fn error_fallback_does_not_poll_unknown_length_post_payload() { + use bytes::Bytes; + + let stream = futures_util::stream::pending::>(); + let mut request = Request::builder() + .method(Method::POST) + .version(Version::HTTP_2) + .uri("https://www.example.test/form") + .body(Body::from_stream(stream)) + .unwrap(); + let result = match prepare_error_fallback_body(&mut request, true).await { + Ok(result) => result, + Err(response) => panic!("unexpected status {}", response.status()), + }; + assert!(matches!(result, ErrorFallbackBody::Unavailable)); +} + +#[tokio::test] +async fn fallback_terminal_404_html_takes_precedence_over_builtin_error_page() { + use bytes::Bytes; + + let mut response = Response::builder() + .status(StatusCode::NOT_FOUND) + .header("content-type", "text/html; charset=utf-8") + .body(Body::from("ReactPHP 404")) + .unwrap(); + response.extensions_mut().insert(ErrorFallbackResponse); + let configured_page = crate::pages::Page { + kind: crate::pages::Kind::Builtin, + status: Some(404), + html: String::new(), + }; + if should_replace_error_page(&response, false) { + crate::pages::replace_error(&mut response, &configured_page); + } + assert_eq!(response.status(), StatusCode::NOT_FOUND); + assert_eq!( + response.into_body().collect().await.unwrap().to_bytes(), + Bytes::from_static(b"ReactPHP 404") + ); + + // A normal response with no fallback is still eligible for the configured + // global/vhost error-page replacement. + let response = Response::builder() + .status(StatusCode::NOT_FOUND) + .body(Body::empty()) + .unwrap(); + assert!(should_replace_error_page(&response, false)); +} diff --git a/src/proxy/upstream_helpers.rs b/src/proxy/upstream_helpers.rs index 697b5a6..6ca8d79 100644 --- a/src/proxy/upstream_helpers.rs +++ b/src/proxy/upstream_helpers.rs @@ -11,6 +11,15 @@ fn request_id_hash(sequence: u64) -> String { format!("{:x}", hash.finalize()) } +fn should_replace_error_page(response: &Response, minimal_welcome: bool) -> bool { + !minimal_welcome + && response.extensions().get::().is_none() + && response + .extensions() + .get::() + .is_none() +} + async fn observe(State(state): State>, mut request: Request, next: Next) -> Response { let snapshot = state.config.load_full(); let (frontend_context, route_context) = response_context(&snapshot, &request); @@ -205,12 +214,7 @@ async fn observe(State(state): State>, mut request: Request, next: Next .as_ref() .and_then(|f| f.pages.errors.get(&code)) .or_else(|| snapshot.envelope.config.pages.errors.get(&code)); - if !minimal_welcome - && response - .extensions() - .get::() - .is_none() - { + if should_replace_error_page(&response, minimal_welcome) { if let Some(page) = custom_error { crate::pages::replace_error(&mut response, page); } diff --git a/tools/checks/check_source.py b/tools/checks/check_source.py index 64627d7..c21142d 100755 --- a/tools/checks/check_source.py +++ b/tools/checks/check_source.py @@ -24,7 +24,7 @@ def read_docker_agent_source() -> str: preflight(root) manifest = tomllib.loads((root / "Cargo.toml").read_text()) -assert manifest["package"]["version"] == "0.29.2" +assert manifest["package"]["version"] == "0.29.3" assert manifest["dependencies"]["quinn"]["version"] == "0.11.12" h3dep = manifest["dependencies"]["h3"] assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"] @@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"] lock_path = root / "Cargo.lock" if lock_path.exists(): lock = lock_path.read_text() - assert 'name = "rust-proxy"\nversion = "0.29.2"' in lock + assert 'name = "rust-proxy"\nversion = "0.29.3"' in lock assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries" for release_doc, marker in { - "README.md": "# RustProxy 0.29.2", - "CHANGELOG.md": "## 0.29.2", - "ROADMAP.md": "## 0.29.2", - "AGENTS.md": "Current source version: 0.29.2.", - "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.29.2", + "README.md": "# RustProxy 0.29.3", + "CHANGELOG.md": "## 0.29.3", + "ROADMAP.md": "## 0.29.3", + "AGENTS.md": "Current source version: 0.29.3.", + "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.29.3", }.items(): assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}" assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable" @@ -285,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi assert '"StreamMetrics"' in openapi and '"streams"' in openapi -for marker in ['"version": "0.29.2"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']: +for marker in ['"version": "0.29.3"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']: assert marker in openapi, marker for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']: assert marker in openapi, marker @@ -1396,7 +1396,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log" assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241 assert 'location.pathname === "/logging"' in settings_js_0241 -assert '"RuntimeInformation"' in openapi and '"version": "0.29.2"' in openapi +assert '"RuntimeInformation"' in openapi and '"version": "0.29.3"' in openapi # 0.24.1 compiler and hostname-cardinality regressions. tls_0241 = rust_source(root, "src/tls.rs") @@ -1518,7 +1518,7 @@ assert 'listener-active-item' in runtime_web_0280 and 'listener-active-feature' assert 'cache-via-enabled' in cache_web_0280 and 'via_header:' in cache_web_0280 assert 'location-header-direction location-header-editor' in vhost_core_0280 -# 0.29.2 internal-error/multipart/PATH_INFO contracts. +# 0.29.3 internal-error/multipart/PATH_INFO contracts. vhost_model_0291 = rust_source(root, "src/vhost.rs") vhost_validation_0291 = rust_source(root, "src/vhost/validation.rs") config_snapshot_0291 = rust_source(root, "src/config/internal_routing.rs") @@ -1635,5 +1635,5 @@ for marker_0282 in [ assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text() assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text() -print("PASS: 0.29.2 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.") +print("PASS: 0.29.3 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.") print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.") diff --git a/tools/checks/docs_check.py b/tools/checks/docs_check.py index 526f6e2..ce3eaba 100755 --- a/tools/checks/docs_check.py +++ b/tools/checks/docs_check.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -"""Rust-independent documentation/Reader consistency checks for the 0.29.2 release.""" +"""Rust-independent documentation/Reader consistency checks for the 0.29.3 release.""" from pathlib import Path import re from rust_source import rust_source @@ -64,11 +64,11 @@ assert '"/docs/content.json"' in admin readme = (ROOT / "README.md").read_text(encoding="utf-8") roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8") changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8") -assert readme.startswith("# RustProxy 0.29.2") +assert readme.startswith("# RustProxy 0.29.3") assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive" assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme -assert roadmap.startswith("# RustProxy roadmap") and "## 0.29.2" and "## 0.29.1" in roadmap and "## 0.29.0" in roadmap and "## 0.28.2" in roadmap and "## 0.28.1" in roadmap and "## 0.27.3" in roadmap and "## 0.27.2" in roadmap and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap +assert roadmap.startswith("# RustProxy roadmap") and "## 0.29.3" and "## 0.29.1" in roadmap and "## 0.29.0" in roadmap and "## 0.28.2" in roadmap and "## 0.28.1" in roadmap and "## 0.27.3" in roadmap and "## 0.27.2" in roadmap and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap assert "## 0.24." not in roadmap and "## Web Server follow-up" in roadmap and "docs/ROADMAP_HISTORY.md" in roadmap assert changelog.startswith("# Changelog\n") for release in ["0.29.1", "0.29.0", "0.28.2", "0.28.1", "0.28.0", "0.27.3", "0.27.2", "0.27.1", "0.27.0", "0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]: diff --git a/tools/checks/preflight.py b/tools/checks/preflight.py index 80563fb..6d4c464 100755 --- a/tools/checks/preflight.py +++ b/tools/checks/preflight.py @@ -75,10 +75,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]: raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}") for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]: if not (root / path).is_file(): - raise ValueError(f"Incomplete RustProxy 0.29.2 source tree: missing {path}") + raise ValueError(f"Incomplete RustProxy 0.29.3 source tree: missing {path}") text = (root / "src/lib.rs").read_text(encoding="utf-8") if '#[path = "auth/mod.rs"]' not in text: - raise ValueError("src/lib.rs is not the 0.29.2 entry point; extract the complete package, not individual files.") + raise ValueError("src/lib.rs is not the 0.29.3 entry point; extract the complete package, not individual files.") return messages diff --git a/tools/checks/release_smoke.py b/tools/checks/release_smoke.py index 7b050e3..0fb75ab 100755 --- a/tools/checks/release_smoke.py +++ b/tools/checks/release_smoke.py @@ -135,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None: assert backup.is_dir() assert (backup / "src/obsolete.rs").is_file() assert not (target / "src/obsolete.rs").exists() - assert 'version = "0.29.2"' in (target / "Cargo.toml").read_text(encoding="utf-8") + assert 'version = "0.29.3"' in (target / "Cargo.toml").read_text(encoding="utf-8") assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n" assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n" assert (target / "langs/site.json").is_file() @@ -146,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None: assert (target / "docker-agent/certificate.go").is_file() assert (target / "docker-agent/server.go").is_file() manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8")) - assert manifest["to_version"] == "0.29.2" + assert manifest["to_version"] == "0.29.3" assert manifest["removed_obsolete_runtime_state"] is True assert not legacy.exists() assert not (backup / "legacy-data").exists() @@ -619,7 +619,7 @@ def source_contract_smoke() -> None: assert marker in admin, marker anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0] assert '"/api/status"' not in anonymous_block - assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.29.2"' in openapi_0241 + assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.29.3"' in openapi_0241 assert 'id="panel-logging"' not in html for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']: assert marker in html, marker @@ -1109,7 +1109,7 @@ def source_contract_smoke() -> None: assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8") assert '"/api/config/history/restore"' in openapi - for marker in ['"version": "0.29.2"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']: + for marker in ['"version": "0.29.3"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']: assert marker in openapi, marker assert '"software_update"' in openapi and '"update_available"' in openapi for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']: @@ -1314,7 +1314,7 @@ def main() -> None: source_contract_smoke() container_contract_smoke() grafana_contract_smoke() - print("PASS: 0.29.2 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.") + print("PASS: 0.29.3 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.") if __name__ == "__main__":