Merge ~athos/ubuntu/+source/haproxy:MRE-focal into ubuntu/+source/haproxy:ubuntu/focal-devel

[Athos Ribeiro]

HAProxy MRE introducing the newest point release version for focal.

All relevant information is available at the MRE bug in LP: #2028418.

PPA: https://launchpad.net/~athos-ribeiro/+archive/ubuntu/haproxy-mre/+packages

DEP8 test results:

  - haproxy/2.0.33-0ubuntu0.1
    + ✅ haproxy on focal for amd64 @ 31.10.23 23:06:37 Log️ 🗒️
    + ✅ haproxy on focal for arm64 @ 31.10.23 23:03:26 Log️ 🗒️
    + ✅ haproxy on focal for armhf @ 31.10.23 23:02:18 Log️ 🗒️
    + ✅ haproxy on focal for ppc64el @ 31.10.23 22:59:11 Log️ 🗒️
    + ✅ haproxy on focal for s390x @ 31.10.23 23:00:08 Log️ 🗒️

[Sergio Durigan Junior (sergiodj)]

Thank you for the MP, Athos.

Also, thank you very much for the extremely well written MRE bug! It has made reviewing the changes much easier :-).

I agree with your analysis of the situation there. One of the major fixes being introduced here and in the Jammy MRE ("http: reject any empty content-length header value") is actually already part of the haproxy package we ship our users, because it's been fixed by the security team. Therefore, we're only left with one new major fix being backported.

Anyway, the changes LGTM. dep8 tests are passing (although they're somewhat superficial, as explained in the MRE document). I'm relying on the Microsoft Github's actions to have a better picture of the testing being done here. As I mentioned to you in the channel, I believe it may be worth patching the repository to make the "Spec Compliance" test run. It seems to be an important test and I'd like to see its results.

Otherwise, there's not much to say here. I also agree with leaving Lunar out of this MRE round.

I'm reviewing this MP as Needs Information just because of the "Spec Compliance" test. Let me know what you think.

Thanks.

review: Needs Information

[Sergio Durigan Junior (sergiodj)]

Athos was kind enough to patch the git repo and rerun the "Spec Compliance" test, which passed:

https://github.com/athos-ribeiro/haproxy-2.4/actions/runs/6962364281

Therefore, I'm approving this MP. Thanks again!

review: Approve

[Sergio Durigan Junior (sergiodj)]

Ops, Athos correctly told me that the "Spec Compliance" test only applies to haproxy-2.4, which will be MRE'd to Jammy. This means that the results I posted above do not apply to this MP. That doesn't change my approval, though.

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: athos-ribeiro, sergiodj
Uploaders: athos-ribeiro, sergiodj
MP auto-approved

review: Approve

[Athos Ribeiro (athos)]

Thanks, Sergio!

Uploaded!

diff --git a/.github/workflows/cross-zoo.yml b/.github/workflows/cross-zoo.yml
index e2a5816..f2c8d7a 100644
--- a/.github/workflows/cross-zoo.yml
+++ b/.github/workflows/cross-zoo.yml
@@ -97,7 +97,7 @@ jobs:
         sudo apt-get -yq --force-yes install \
             gcc-${{ matrix.platform.arch }} \
             ${{ matrix.platform.libs }}
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
 
     - name: install quictls
diff --git a/.github/workflows/vtest.yml b/.github/workflows/vtest.yml
index b919418..a12e4e1 100644
--- a/.github/workflows/vtest.yml
+++ b/.github/workflows/vtest.yml
@@ -147,3 +147,4 @@ jobs:
           sudo cat $asan
           echo "::endgroup::"
         done
+        exit 1
diff --git a/.gitignore b/.gitignore
index 3a760af..e5d132e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,6 +35,7 @@
 *.rej
 *.orig
 *.bak
+*.sw[op]
 # And reject some specific files
 /contrib/base64/base64rev
 /contrib/halog/halog
diff --git a/CHANGELOG b/CHANGELOG
index 4b5713f..305eea6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,67 @@
 ChangeLog :
 ===========
 
+2023/08/19 : 2.0.33
+    - BUG/MINOR: cfgparse-tcp: leak when re-declaring interface from bind line
+    - BUG/MINOR: proxy: add missing interface bind free in free_proxy
+    - BUG/MINOR: server: inherit from netns in srv_settings_cpy()
+    - BUG/MINOR: namespace: missing free in netns_sig_stop()
+    - BUG/MEDIUM: mworker: increase maxsock with each new worker
+    - DOC: Add tune.h2.max-frame-size option to table of contents
+    - BUG/MINOR: sample: Fix wrong overflow detection in add/sub conveters
+    - BUG/MINOR: http: Return the right reason for 302
+    - CI: explicitely highlight VTest result section if there's something
+    - DOC: configuration: describe Td in Timing events
+    - BUG/MINOR: chunk: fix chunk_appendf() to not write a zero if buffer is full
+    - BUG/MAJOR: http-ana: Get a fresh trash buffer for each header value replacement
+    - BUG/MAJOR: http: reject any empty content-length header value
+    - MINOR: ist: add new function ist_find_range() to find a character range
+    - MINOR: ist: Add istend() function to return a pointer to the end of the string
+    - MINOR: http: add new function http_path_has_forbidden_char()
+    - MINOR: h2: pass accept-invalid-http-request down the request parser
+    - BUG/MINOR: h1: do not accept '#' as part of the URI component
+    - BUG/MINOR: h2: reject more chars from the :path pseudo header
+    - REGTESTS: http-rules: verify that we block '#' by default for normalize-uri
+    - DOC: clarify the handling of URL fragments in requests
+    - BUG/MINOR: http: skip leading zeroes in content-length values
+
+2023/06/12 : 2.0.32
+    - BUG/MEDIUM: mworker: don't register mworker_accept_wrapper() when master FD is wrong
+    - BUG/MINOR: mworker: prevent incorrect values in uptime
+    - BUG/MINOR: ssl: Use 'date' instead of 'now' in ocsp stapling callback
+    - BUG/MINOR: mux-h2: make sure the h2c task exists before refreshing it
+    - BUG/MEDIUM: spoe: Don't set the default traget for the SPOE agent frontend
+    - BUG/MEDIUM: mux-h2: erase h2c->wait_event.tasklet on error path
+    - BUG/MEDIUM: mux-h1: Wakeup H1C on shutw if there is no I/O subscription
+    - MINOR: proxy/pool: prevent unnecessary calls to pool_gc()
+    - CI: bump "actions/checkout" to v3 for cross zoo matrix
+    - BUG/MEDIUM: Update read expiration date on synchronous send
+    - BUG/MINOR: mux-h2: make sure to produce a log on invalid requests
+    - MINOR: checks: make sure spread-checks is used also at boot time
+    - MINOR: clock: measure the total boot time
+    - BUG/MINOR: checks: postpone the startup of health checks by the boot time
+    - BUG/MEDIUM: mux-h1: Handle connection error after a synchronous send
+    - BUG/MINOR: mux-h1: Account consumed output data on synchronous connection error
+    - BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input
+    - BUG/MINOR: tcp-rules: Don't shortened the inspect-delay when EOI is set
+    - DOC: config: Clarify conditions to shorten the inspect-delay for TCP rules
+    - BUG/MINOR: hlua: unsafe hlua_lua2smp() usage
+    - SCRIPTS: publish-release: update the umask to keep group write access
+    - BUG/MINOR: log: fix memory error handling in parse_logsrv()
+    - BUG/MINOR: proxy: missing free in free_proxy for redirect rules
+    - MINOR: spoe: Don't stop disabled proxies
+    - BUG/MEDIUM: filters: Don't deinit filters for disabled proxies during startup
+    - BUG/MINOR: debug: do not emit empty lines in thread dumps
+    - BUG/MEDIUM: spoe: Don't start new applet if there are enough idle ones
+    - BUG/MINOR: server: incorrect report for tracking servers leaving drain
+    - MINOR: server: explicitly commit state change in srv_update_status()
+    - BUG/MINOR: server: don't miss proxy stats update on server state transitions
+    - BUG/MINOR: server: don't miss server stats update on server state transitions
+    - BUG/MINOR: server: don't use date when restoring last_change from state file
+    - DOC: config: Fix bind/server/peer documentation in the peers section
+    - CONTRIB: Add vi file extensions to .gitignore
+    - BUG/MINOR: spoe: Only skip sending new frame after a receive attempt
+
 2023/02/14 : 2.0.31
     - SCRIPTS: announce-release: add a link to the data plane API
     - CI: github: change "ubuntu-latest" to "ubuntu-20.04"
diff --git a/SUBVERS b/SUBVERS
index e1824da..a32020b 100644
--- a/SUBVERS
+++ b/SUBVERS
@@ -1,2 +1,2 @@
--c8b1c15
+-83002d4
 
diff --git a/VERDATE b/VERDATE
index 2f36592..cb54148 100644
--- a/VERDATE
+++ b/VERDATE
@@ -1,2 +1,2 @@
-2023-02-14 16:58:28 +0100
-2023/02/14
[phone]:32:22 +0200
+2023/08/19
diff --git a/VERSION b/VERSION
index e235558..520d2d2 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.0.31
+2.0.33
diff --git a/debian/changelog b/debian/changelog
index 1d940f1..8866696 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,22 @@
+haproxy (2.0.33-0ubuntu0.1) focal; urgency=medium
+
+  * New upstream release (LP: #2028418)
+    - Major and critical bug fixes according to the upstream changelog:
+      + BUG/MAJOR: http-ana: Get a fresh trash buffer for each header value
+        replacement
+      + BUG/MAJOR: http: reject any empty content-length header value
+    - For further information, refer to the upstream changelog at
+      https://www.haproxy.org/download/2.0/src/CHANGELOG and to the upstream
+      release announcements at
+      https://www.mail-archive.com/[e-mail]/msg43668.html
+      (2.0.32), and
+      https://www.mail-archive.com/[e-mail]/msg43904.html (2.0.33)
+    - Remove patches applied by upstream in debian/patches:
+      + CVE-2023-40225-1.patch
+      + CVE-2023-40225-2.patch
+
+ -- Athos Ribeiro <[e-mail]>  Tue, 31 Oct 2023 16:00:44 -0300
+
 haproxy (2.0.31-0ubuntu0.2) focal-security; urgency=medium
 
   * SECURITY UPDATE: incorrect handling of empty content-length header
diff --git a/debian/patches/CVE-2023-40225-1.patch b/debian/patches/CVE-2023-40225-1.patch
deleted file mode 100644
index dd454a4..0000000
--- a/debian/patches/CVE-2023-40225-1.patch
+++ /dev/null
@@ -1,284 +0,0 @@
-From 4b400110a58da1aa58d58d6371875a3a64c0cff6 Mon Sep 17 00:00:00 2001
-From: Willy Tarreau <[e-mail]>
-Date: Wed, 9 Aug 2023 08:32:48 +0200
-Subject: [PATCH] BUG/MAJOR: http: reject any empty content-length header
- value
-
-The content-length header parser has its dedicated function, in order
-to take extreme care about invalid, unparsable, or conflicting values.
-But there's a corner case in it, by which it stops comparing values
-when reaching the end of the header. This has for a side effect that
-an empty value or a value that ends with a comma does not deserve
-further analysis, and it acts as if the header was absent.
-
-While this is not necessarily a problem for the value ending with a
-comma as it will be cause a header folding and will disappear, it is a
-problem for the first isolated empty header because this one will not
-be recontructed when next ones are seen, and will be passed as-is to the
-backend server. A vulnerable HTTP/1 server hosted behind haproxy that
-would just use this first value as "0" and ignore the valid one would
-then not be protected by haproxy and could be attacked this way, taking
-the payload for an extra request.
-
-In field the risk depends on the server. Most commonly used servers
-already have safe content-length parsers, but users relying on haproxy
-to protect a known-vulnerable server might be at risk (and the risk of
-a bug even in a reputable server should never be dismissed).
-
-A configuration-based work-around consists in adding the following rule
-in the frontend, to explicitly reject requests featuring an empty
-content-length header that would have not be folded into an existing
-one:
-
-    http-request deny if { hdr_len(content-length) 0 }
-
-The real fix consists in adjusting the parser so that it always expects a
-value at the beginning of the header or after a comma. It will now reject
-requests and responses having empty values anywhere in the C-L header.
-
-This needs to be backported to all supported versions. Note that the
-modification was made to functions h1_parse_cont_len_header() and
-http_parse_cont_len_header(). Prior to 2.8 the latter was in
-h2_parse_cont_len_header(). One day the two should be refused but the
-former is also used by Lua.
-
-The HTTP messaging reg-tests were completed to test these cases.
-
-Thanks to Ben Kallus of Dartmouth College and Narf Industries for
-reporting this! (this is in GH #2237).
-
-(cherry picked from commit 6492f1f29d738457ea9f382aca54537f35f9d856)
-Signed-off-by: Amaury Denoyelle <[e-mail]>
-(cherry picked from commit a32f99f6f991d123ea3e307bf8aa63220836d365)
-Signed-off-by: Amaury Denoyelle <[e-mail]>
-(cherry picked from commit 65921ee12d88e9fb1fa9f6cd8198fd64b3a3f37f)
-Signed-off-by: Amaury Denoyelle <[e-mail]>
-(cherry picked from commit d17c50010d591d1c070e1cb0567a06032d8869e9)
-[wt: applied to h2_parse_cont_len_header() in src/h2.c instead]
-Signed-off-by: Willy Tarreau <[e-mail]>
-(cherry picked from commit ba9afd2774c03e434165475b537d0462801f49bb)
-Signed-off-by: Willy Tarreau <[e-mail]>
-(cherry picked from commit e8ba5e106444fc78558f4ff26e9ce946f89216f4)
-[wt: legacy not affected, http_wait_for_request() tests for empty
- value (cf. proto_http.c:1099)]
-Signed-off-by: Willy Tarreau <[e-mail]>
----
- reg-tests/http-messaging/h1_to_h1.vtc |   26 ++++++++++++++
- reg-tests/http-messaging/h2_to_h1.vtc |   60 +++++++++++++++++++++++++++++++++
- src/h1.c                              |   22 +++++++++---
- src/h2.c                              |   22 +++++++++---
- 4 files changed, 122 insertions(+), 8 deletions(-)
-
-diff --git a/reg-tests/http-messaging/h1_to_h1.vtc b/reg-tests/http-messaging/h1_to_h1.vtc
-index 7694014..aeb3a60 100644
---- a/reg-tests/http-messaging/h1_to_h1.vtc
-+++ b/reg-tests/http-messaging/h1_to_h1.vtc
-@@ -269,3 +269,29 @@ client c3h1 -connect ${h1_feh1_sock} {
- 	# arrive here.
- 	expect_close
- } -run
-+
-+client c4h1 -connect ${h1_feh1_sock} {
-+	# this request is invalid and advertises an invalid C-L ending with an
-+        # empty value, which results in a stream error.
-+	txreq \
-+	  -req "GET" \
-+	  -url "/test31.html" \
-+          -hdr "content-length: 0," \
-+          -hdr "connection: close"
-+	rxresp
-+	expect resp.status == 400
-+	expect_close
-+} -run
-+
-+client c5h1 -connect ${h1_feh1_sock} {
-+	# this request is invalid and advertises an empty C-L, which results
-+	# in a stream error.
-+	txreq \
-+	  -req "GET" \
-+	  -url "/test41.html" \
-+          -hdr "content-length:" \
-+          -hdr "connection: close"
-+	rxresp
-+	expect resp.status == 400
-+	expect_close
-+} -run
-diff --git a/reg-tests/http-messaging/h2_to_h1.vtc b/reg-tests/http-messaging/h2_to_h1.vtc
-index 481aded..3ed3751 100644
---- a/reg-tests/http-messaging/h2_to_h1.vtc
-+++ b/reg-tests/http-messaging/h2_to_h1.vtc
-@@ -10,6 +10,8 @@ barrier b1 cond 2 -cyclic
- barrier b2 cond 2 -cyclic
- barrier b3 cond 2 -cyclic
- barrier b4 cond 2 -cyclic
-+barrier b5 cond 2 -cyclic
-+barrier b6 cond 2 -cyclic
- 
- server s1 {
- 	rxreq
-@@ -31,6 +33,12 @@ server s1 {
- 
- 	barrier b4 sync
- 	# the next request is never received
-+
-+	barrier b5 sync
-+	# the next request is never received
-+
-+	barrier b6 sync
-+	# the next request is never received
- } -repeat 2 -start
- 
- haproxy h1 -conf {
-@@ -115,6 +123,32 @@ client c1h2 -connect ${h1_feh2_sock} {
- 		txdata -data "this is sent and ignored"
- 		rxrst
- 	} -run
-+
-+	# fifth request is invalid and advertises an invalid C-L ending with an
-+        # empty value, which results in a stream error.
-+	stream 9 {
-+		barrier b5 sync
-+		txreq \
-+		  -req "GET" \
-+		  -scheme "https" \
-+		  -url "/test5.html" \
-+		  -hdr "content-length" "0," \
-+		  -nostrend
-+		rxrst
-+	} -run
-+
-+	# sixth request is invalid and advertises an empty C-L, which results
-+	# in a stream error.
-+	stream 11 {
-+		barrier b6 sync
-+		txreq \
-+		  -req "GET" \
-+		  -scheme "https" \
-+		  -url "/test6.html" \
-+		  -hdr "content-length" "" \
-+		  -nostrend
-+		rxrst
-+	} -run
- } -run
- 
- # HEAD requests : don't work well yet
-@@ -257,4 +291,30 @@ client c3h2 -connect ${h1_feh2_sock} {
- 		txdata -data "this is sent and ignored"
- 		rxrst
- 	} -run
-+
-+	# fifth request is invalid and advertises invalid C-L ending with an
-+        # empty value, which results in a stream error.
-+	stream 9 {
-+		barrier b5 sync
-+		txreq \
-+		  -req "POST" \
-+		  -scheme "https" \
-+		  -url "/test25.html" \
-+		  -hdr "content-length" "0," \
-+		  -nostrend
-+		rxrst
-+	} -run
-+
-+	# sixth request is invalid and advertises an empty C-L, which results
-+	# in a stream error.
-+	stream 11 {
-+		barrier b6 sync
-+		txreq \
-+		  -req "POST" \
-+		  -scheme "https" \
-+		  -url "/test26.html" \
-+		  -hdr "content-length" "" \
-+		  -nostrend
-+		rxrst
-+	} -run
- } -run
-diff --git a/src/h1.c b/src/h1.c
-index 69a7ced..248e315 100644
---- a/src/h1.c
-+++ b/src/h1.c
-@@ -32,13 +32,20 @@ int h1_parse_cont_len_header(struct h1m *h1m, struct ist *value)
- 	int not_first = !!(h1m->flags & H1_MF_CLEN);
- 	struct ist word;
- 
--	word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
-+	word.ptr = value->ptr;
- 	e = value->ptr + value->len;
- 
--	while (++word.ptr < e) {
--		/* skip leading delimitor and blanks */
--		if (unlikely(HTTP_IS_LWS(*word.ptr)))
-+	while (1) {
-+		if (word.ptr >= e) {
-+			/* empty header or empty value */
-+			goto fail;
-+		}
-+
-+		/* skip leading delimiter and blanks */
-+		if (unlikely(HTTP_IS_LWS(*word.ptr))) {
-+			word.ptr++;
- 			continue;
-+		}
- 
- 		/* digits only now */
- 		for (cl = 0, n = word.ptr; n < e; n++) {
-@@ -77,6 +84,13 @@ int h1_parse_cont_len_header(struct h1m *h1m, struct ist *value)
- 		h1m->flags |= H1_MF_CLEN;
- 		h1m->curr_len = h1m->body_len = cl;
- 		*value = word;
-+
-+		/* Now either n==e and we're done, or n points to the comma,
-+		 * and we skip it and continue.
-+		 */
-+		if (n++ == e)
-+			break;
-+
- 		word.ptr = n;
- 	}
- 	/* here we've reached the end with a single value or a series of
-diff --git a/src/h2.c b/src/h2.c
-index bfc0bda..77a9346 100644
---- a/src/h2.c
-+++ b/src/h2.c
-@@ -458,13 +458,20 @@ int h2_parse_cont_len_header(unsigned int *msgf, struct ist *value, unsigned lon
- 	int not_first = !!(*msgf & H2_MSGF_BODY_CL);
- 	struct ist word;
- 
--	word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
-+	word.ptr = value->ptr;
- 	e = value->ptr + value->len;
- 
--	while (++word.ptr < e) {
--		/* skip leading delimitor and blanks */
--		if (unlikely(HTTP_IS_LWS(*word.ptr)))
-+	while (1) {
-+		if (word.ptr >= e) {
-+			/* empty header or empty value */
-+			goto fail;
-+		}
-+
-+		/* skip leading delimiter and blanks */
-+		if (unlikely(HTTP_IS_LWS(*word.ptr))) {
-+			word.ptr++;
- 			continue;
-+		}
- 
- 		/* digits only now */
- 		for (cl = 0, n = word.ptr; n < e; n++) {
-@@ -503,6 +510,13 @@ int h2_parse_cont_len_header(unsigned int *msgf, struct ist *value, unsigned lon
- 		*msgf |= H2_MSGF_BODY_CL;
- 		*body_len = cl;
- 		*value = word;
-+
-+		/* Now either n==e and we're done, or n points to the comma,
-+		 * and we skip it and continue.
-+		 */
-+		if (n++ == e)
-+			break;
-+
- 		word.ptr = n;
- 	}
- 	/* here we've reached the end with a single value or a series of
--- 
-1.7.10.4
-
diff --git a/debian/patches/CVE-2023-40225-2.patch b/debian/patches/CVE-2023-40225-2.patch
deleted file mode 100644
index b4bfbc6..0000000
--- a/debian/patches/CVE-2023-40225-2.patch
+++ /dev/null
@@ -1,150 +0,0 @@
-From a90ecde20e53bb26a677b42f53db42900097af9a Mon Sep 17 00:00:00 2001
-From: Willy Tarreau <[e-mail]>
-Date: Wed, 9 Aug 2023 11:02:34 +0200
-Subject: [PATCH] BUG/MINOR: http: skip leading zeroes in content-length
- values
-
-Ben Kallus also noticed that we preserve leading zeroes on content-length
-values. While this is totally valid, it would be safer to at least trim
-them before passing the value, because a bogus server written to parse
-using "strtol(value, NULL, 0)" could inadvertently take a leading zero
-as a prefix for an octal value. While there is not much that can be done
-to protect such servers in general (e.g. lack of check for overflows etc),
-at least it's quite cheap to make sure the transmitted value is normalized
-and not taken for an octal one.
-
-This is not really a bug, rather a missed opportunity to sanitize the
-input, but is marked as a bug so that we don't forget to backport it to
-stable branches.
-
-A combined regtest was added to h1or2_to_h1c which already validates
-end-to-end syntax consistency on aggregate headers.
-
-(cherry picked from commit 22731762d9fe2c98d9e6c3942b1568266b23c69f)
-Signed-off-by: Amaury Denoyelle <[e-mail]>
-(cherry picked from commit c33738c7d4ed50e1758dbedd39dfe5bd929a5076)
-Signed-off-by: Amaury Denoyelle <[e-mail]>
-(cherry picked from commit 84462c9390c3efe95b748bb9fc3bd2edc3decd2f)
-Signed-off-by: Amaury Denoyelle <[e-mail]>
-(cherry picked from commit e2e464018fda41758bd42d3bcd6ac623c88a110e)
-[wt: applied the http.c to h2.c]
-Signed-off-by: Willy Tarreau <[e-mail]>
-(cherry picked from commit c48acd15011dc6c66977bc088065693f430821df)
-Signed-off-by: Willy Tarreau <[e-mail]>
-(cherry picked from commit 0ac860d19ad68bf4c1f6f8f3721801b7079368c6)
-[wt: legacy mode was not changed as it's really not suitable for this,
- since by then headers were known from their start and length and we
- can't adjust them afterwards without breaking all indexing]
-Signed-off-by: Willy Tarreau <[e-mail]>
----
- reg-tests/http-rules/h1or2_to_h1c.vtc |   16 ++++++++++++----
- src/h1.c                              |    8 ++++++++
- src/h2.c                              |    8 ++++++++
- 3 files changed, 28 insertions(+), 4 deletions(-)
-
---- haproxy-2.0.31.orig/reg-tests/http-rules/h1or2_to_h1c.vtc
-+++ haproxy-2.0.31/reg-tests/http-rules/h1or2_to_h1c.vtc
-@@ -27,11 +27,11 @@ server s1 {
- 	  -body "This is a body"
- 
- 	expect req.method == "GET"
--	expect req.http.fe-sl1-crc == 992395575
--	expect req.http.fe-sl2-crc == 1270056220
-+	expect req.http.fe-sl1-crc == 1874847043
-+	expect req.http.fe-sl2-crc == 1142278307
- 	expect req.http.fe-hdr-crc == 1719311923
--	expect req.http.be-sl1-crc == 2604236007
--	expect req.http.be-sl2-crc == 4181358964
-+	expect req.http.be-sl1-crc == 3455320059
-+	expect req.http.be-sl2-crc == 2509326257
- 	expect req.http.be-hdr-crc == 3634102538
- } -repeat 2 -start
- 
-@@ -53,6 +53,7 @@ haproxy h1 -conf {
- 	http-request set-var(req.path)       path
- 	http-request set-var(req.query)      query
- 	http-request set-var(req.param)      url_param(qs_arg)
-+	http-request set-var(req.cl)         req.fhdr(content-length)
- 
- 	http-request set-header     sl1      "sl1: "
- 
-@@ -65,8 +66,10 @@ haproxy h1 -conf {
- 
- 	http-request set-header     sl1      "%[req.fhdr(sl1)] method=<%[var(req.method)]>; uri=<%[var(req.uri)]>; path=<%[var(req.path)]>;"
- 	http-request set-header     sl1      "%[req.fhdr(sl1)] query=<%[var(req.query)]>; param=<%[var(req.param)]>"
-+	http-request set-header     sl1      "%[req.fhdr(sl1)] cl=<%[var(req.cl)]>"
- 	http-request set-header     sl2      "%[req.fhdr(sl2)] method=<%[method]>; uri=<%[url]>; path=<%[path]>; "
- 	http-request set-header     sl2      "%[req.fhdr(sl2)] query=<%[query]>; param=<%[url_param(qs_arg)]>"
-+	http-request set-header     sl2      "%[req.fhdr(sl2)] cl=<%[req.fhdr(content-length)]>"
- 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr1=<%[req.hdr(hdr1)]>; fhdr1=<%[req.fhdr(hdr1)]>;"
- 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr2=<%[req.hdr(hdr2)]>; fhdr2=<%[req.fhdr(hdr2)]>;"
- 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr3=<%[req.hdr(hdr3)]>; fhdr3=<%[req.fhdr(hdr3)]>;"
-@@ -120,6 +123,7 @@ haproxy h1 -conf {
- 	http-request set-var(req.path)       path
- 	http-request set-var(req.query)      query
- 	http-request set-var(req.param)      url_param(qs_arg)
-+	http-request set-var(req.cl)         req.fhdr(content-length)
- 
- 	http-request set-header     sl1      "sl1: "
- 
-@@ -132,8 +136,10 @@ haproxy h1 -conf {
- 
- 	http-request set-header     sl1      "%[req.fhdr(sl1)] method=<%[var(req.method)]>; uri=<%[var(req.uri)]>; path=<%[var(req.path)]>;"
- 	http-request set-header     sl1      "%[req.fhdr(sl1)] query=<%[var(req.query)]>; param=<%[var(req.param)]>"
-+	http-request set-header     sl1      "%[req.fhdr(sl1)] cl=<%[var(req.cl)]>"
- 	http-request set-header     sl2      "%[req.fhdr(sl2)] method=<%[method]>; uri=<%[url]>; path=<%[path]>; "
- 	http-request set-header     sl2      "%[req.fhdr(sl2)] query=<%[query]>; param=<%[url_param(qs_arg)]>"
-+	http-request set-header     sl2      "%[req.fhdr(sl2)] cl=<%[req.fhdr(content-length)]>"
- 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr1=<%[req.hdr(hdr1)]>; fhdr1=<%[req.fhdr(hdr1)]>;"
- 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr2=<%[req.hdr(hdr2)]>; fhdr2=<%[req.fhdr(hdr2)]>;"
- 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr3=<%[req.hdr(hdr3)]>; fhdr3=<%[req.fhdr(hdr3)]>;"
-@@ -171,6 +177,7 @@ client c1h1 -connect ${h1_feh1_sock} {
- 	txreq \
- 	  -req GET \
- 	  -url /path/to/file.extension?qs_arg=qs_value \
-+	  -hdr "content-length: 000, 00" \
- 	  -hdr "hdr1: val1" \
- 	  -hdr "hdr2:  val2a" \
- 	  -hdr "hdr2:    val2b" \
-@@ -205,6 +212,7 @@ client c1h2 -connect ${h1_feh2_sock} {
- 		  -req GET \
- 		  -scheme "https" \
- 		  -url /path/to/file.extension?qs_arg=qs_value \
-+		  -hdr "content-length" "000, 00" \
- 		  -hdr "hdr1" "val1" \
- 		  -hdr "hdr2" " val2a" \
- 		  -hdr "hdr2" "   val2b" \
---- haproxy-2.0.31.orig/src/h1.c
-+++ haproxy-2.0.31/src/h1.c
-@@ -56,6 +56,14 @@ int h1_parse_cont_len_header(struct h1m
- 					goto fail;
- 				break;
- 			}
-+
-+			if (unlikely(!cl && n > word.ptr)) {
-+				/* There was a leading zero before this digit,
-+				 * let's trim it.
-+				 */
-+				word.ptr = n;
-+			}
-+
- 			if (unlikely(cl > ULLONG_MAX / 10ULL))
- 				goto fail; /* multiply overflow */
- 			cl = cl * 10ULL;
---- haproxy-2.0.31.orig/src/h2.c
-+++ haproxy-2.0.31/src/h2.c
-@@ -482,6 +482,14 @@ int h2_parse_cont_len_header(unsigned in
- 					goto fail;
- 				break;
- 			}
-+
-+			if (unlikely(!cl && n > word.ptr)) {
-+				/* There was a leading zero before this digit,
-+				 * let's trim it.
-+				 */
-+				word.ptr = n;
-+			}
-+
- 			if (unlikely(cl > ULLONG_MAX / 10ULL))
- 				goto fail; /* multiply overflow */
- 			cl = cl * 10ULL;
diff --git a/debian/patches/series b/debian/patches/series
index 339dd4f..0945bb0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,5 +1,3 @@
 0002-Use-dpkg-buildflags-to-build-halog.patch
 haproxy.service-start-after-syslog.patch
 haproxy.service-add-documentation.patch
-CVE-2023-40225-1.patch
-CVE-2023-40225-2.patch
diff --git a/doc/configuration.txt b/doc/configuration.txt
index 4c7c59e..850f224 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -3,7 +3,7 @@
                           Configuration Manual
                          ----------------------
                               version 2.0
-                              2023/02/14
+                              2023/08/19
 
 
 This document covers the configuration language as implemented in the version
@@ -650,6 +650,7 @@ The following keywords are supported in the "global" section :
    - tune.h2.header-table-size
    - tune.h2.initial-window-size
    - tune.h2.max-concurrent-streams
+   - tune.h2.max-frame-size
    - tune.http.cookielen
    - tune.http.logurilen
    - tune.http.maxhdr
@@ -2088,7 +2089,8 @@ peers <peersect>
   Creates a new peer list with name <peersect>. It is an independent section,
   which is referenced by one or more stick-tables.
 
-bind [<address>]:<port_range> [, ...] [param*]
+bind [<address>]:port [param*]
+bind /<path> [param*]
   Defines the binding parameters of the local peer of this "peers" section.
   Such lines are not supported with "peer" line in the same "peers" section.
 
@@ -2117,15 +2119,16 @@ enabled
   This re-enables a peers section which was previously disabled via the
   "disabled" keyword.
 
-peer <peername> <ip>:<port> [param*]
+peer <peername> [<address>]:port [param*]
+peer <peername> /<path> [param*]
   Defines a peer inside a peers section.
   If <peername> is set to the local peer name (by default hostname, or forced
   using "-L" command line option), haproxy will listen for incoming remote peer
-  connection on <ip>:<port>. Otherwise, <ip>:<port> defines where to connect to
-  to join the remote peer, and <peername> is used at the protocol level to
-  identify and validate the remote peer on the server side.
+  connection on the provided address. Otherwise, the address defines where to
+  connect to to join the remote peer, and <peername> is used at the protocol
+  level to identify and validate the remote peer on the server side.
 
-  During a soft restart, local peer <ip>:<port> is used by the old instance to
+  During a soft restart, local peer address is used by the old instance to
   connect the new one and initiate a complete replication (teaching process).
 
   It is strongly recommended to have the exact same peers declaration on all
@@ -2139,12 +2142,13 @@ peer <peername> <ip>:<port> [param*]
   Note: "peer" keyword may transparently be replaced by "server" keyword (see
   "server" keyword explanation below).
 
-server <peername> [<ip>:<port>] [param*]
+server <peername> [<address>:<port>] [param*]
+server <peername> [/<path>] [param*]
   As previously mentioned, "peer" keyword may be replaced by "server" keyword
   with a support for all "server" parameters found in 5.2 paragraph that are
-  related to transport settings. If the underlying peer is local, <ip>:<port>
-  parameters must not be present; these parameters must be provided on a "bind"
-  line (see "bind" keyword of this "peers" section).
+  related to transport settings. If the underlying peer is local, the address
+  parameter must not be present; it must be provided on a "bind" line (see
+  "bind" keyword of this "peers" section).
 
   A number of "server" parameters are irrelevant for "peers" sections. Peers by
   nature do not support dynamic host name resolution nor health checks, hence
@@ -6082,7 +6086,8 @@ no option accept-invalid-http-request
   remaining ones are blocked by default unless this option is enabled. This
   option also relaxes the test on the HTTP version, it allows HTTP/0.9 requests
   to pass through (no version specified) and multiple digits for both the major
-  and the minor version.
+  and the minor version. Finally, this option also allows incoming URLs to
+  contain fragment references ('#' after the path).
 
   This option should never be enabled by default as it hides application bugs
   and open security breaches. It should only be deployed after a problem has
@@ -10574,6 +10579,9 @@ tcp-request inspect-delay <timeout>
   Obviously this is unlikely to be very useful and might even be racy, so such
   setups are not recommended.
 
+  Note the inspection delay is shortened if an connection error or shutdown is
+  experienced or if the request buffer appears as full.
+
   As soon as a rule matches, the request is released and continues as usual. If
   the timeout is reached and no rule matches, the default policy will be to let
   it pass through unaffected.
@@ -16808,7 +16816,11 @@ path : string
   information from databases and keep them in caches. Note that with outgoing
   caches, it would be wiser to use "url" instead. With ACLs, it's typically
   used to match exact file names (e.g. "/login.php"), or directory parts using
-  the derivative forms. See also the "url" and "base" fetch methods.
+  the derivative forms. See also the "url" and "base" fetch methods. Please
+  note that any fragment reference in the URI ('#' after the path) is strictly
+  forbidden by the HTTP standard and will be rejected. However, if the frontend
+  receiving the request has "option accept-invalid-http-request", then this
+  fragment part will be accepted and will also appear in the path.
 
   ACL derivatives :
     path     : exact string match
@@ -16982,7 +16994,11 @@ url : string
   "path" is preferred over using "url", because clients may send a full URL as
   is normally done with proxies. The only real use is to match "*" which does
   not match in "path", and for which there is already a predefined ACL. See
-  also "path" and "base".
+  also "path" and "base". Please note that any fragment reference in the URI
+  ('#' after the path) is strictly forbidden by the HTTP standard and will be
+  rejected. However, if the frontend receiving the request has "option
+  accept-invalid-http-request", then this fragment part will be accepted and
+  will also appear in the url.
 
   ACL derivatives :
     url     : exact string match
@@ -17972,6 +17988,13 @@ Timings events in TCP mode:
     header (empty line) was never seen, most likely because the server timeout
     stroke before the server managed to process the request.
 
+  - Td: this is the total transfer time of the response payload till the last
+    byte sent to the client. In HTTP it starts after the last response header
+    (after Tr).
+
+    The data sent are not guaranteed to be received by the client, they can be
+    stuck in either the kernel or the network.
+
   - Ta: total active time for the HTTP request, between the moment the proxy
     received the first byte of the request header and the emission of the last
     byte of the response body. The exception is when the "logasap" option is
diff --git a/include/common/h2.h b/include/common/h2.h
index 6fbc2db..22acb94 100644
--- a/include/common/h2.h
+++ b/include/common/h2.h
@@ -201,10 +201,10 @@ extern struct h2_frame_definition h2_frame_definition[H2_FT_ENTRIES];
 
 /* various protocol processing functions */
 
-int h2_make_h1_request(struct http_hdr *list, char *out, int osize, unsigned int *msgf, unsigned long long *body_len);
+int h2_make_h1_request(struct http_hdr *list, char *out, int osize, unsigned int *msgf, unsigned long long *body_len, int relaxed);
 int h2_make_h1_trailers(struct http_hdr *list, char *out, int osize);
 int h2_parse_cont_len_header(unsigned int *msgf, struct ist *value, unsigned long long *body_len);
-int h2_make_htx_request(struct http_hdr *list, struct htx *htx, unsigned int *msgf, unsigned long long *body_len);
+int h2_make_htx_request(struct http_hdr *list, struct htx *htx, unsigned int *msgf, unsigned long long *body_len, int relaxed);
 int h2_make_htx_response(struct http_hdr *list, struct htx *htx, unsigned int *msgf, unsigned long long *body_len);
 int h2_make_htx_trailers(struct http_hdr *list, struct htx *htx);
 
diff --git a/include/common/ist.h b/include/common/ist.h
index 0d8b457..9c6c37a 100644
--- a/include/common/ist.h
+++ b/include/common/ist.h
@@ -204,6 +204,12 @@ static inline size_t istlen(const struct ist ist)
 	return ist.len;
 }
 
+/* returns the pointer to the end the string */
+static inline char *istend(const struct ist ist)
+{
+	return (ist.ptr + ist.len);
+}
+
 /* skips to next character in the string, always stops at the end */
 static inline struct ist istnext(const struct ist ist)
 {
@@ -647,6 +653,53 @@ static inline const char *ist_find_ctl(const struct ist ist)
 	return NULL;
 }
 
+/* Returns a pointer to the first character found <ist> that belongs to the
+ * range [min:max] inclusive, or NULL if none is present. The function is
+ * optimized for strings having no such chars by processing up to sizeof(long)
+ * bytes at once on architectures supporting efficient unaligned accesses.
+ * Despite this it is not very fast (~0.43 byte/cycle) and should mostly be
+ * used on low match probability when it can save a call to a much slower
+ * function. Will not work for characters 0x80 and above. It's optimized for
+ * min and max to be known at build time.
+ */
+static inline const char *ist_find_range(const struct ist ist, unsigned char min, unsigned char max)
+{
+	const union { unsigned long v; } __attribute__((packed)) *u;
+	const char *curr = (void *)ist.ptr - sizeof(long);
+	const char *last = curr + ist.len;
+	unsigned long l1, l2;
+
+	/* easier with an exclusive boundary */
+	max++;
+
+	do {
+		curr += sizeof(long);
+		if (curr > last)
+			break;
+		u = (void *)curr;
+		/* add 0x<min><min><min><min>..<min> then subtract
+		 * 0x<max><max><max><max>..<max> to the value to generate a
+		 * carry in the lower byte if the byte contains a lower value.
+		 * If we generate a bit 7 that was not there, it means the byte
+		 * was min..max.
+		 */
+		l2  = u->v;
+		l1  = ~l2 & ((~0UL / 255) * 0x80); /* 0x808080...80 */
+		l2 += (~0UL / 255) * min;          /* 0x<min><min>..<min> */
+		l2 -= (~0UL / 255) * max;          /* 0x<max><max>..<max> */
+	} while ((l1 & l2) == 0);
+
+	last += sizeof(long);
+	if (__builtin_expect(curr < last, 0)) {
+		do {
+			if ((unsigned char)(*curr - min) < (unsigned char)(max - min))
+				return curr;
+			curr++;
+		} while (curr < last);
+	}
+	return NULL;
+}
+
 /* looks for first occurrence of character <chr> in string <ist> and returns
  * the tail of the string starting with this character, or (ist.end,0) if not
  * found.
diff --git a/include/common/time.h b/include/common/time.h
index 3b0f640..8e1d6e7 100644
--- a/include/common/time.h
+++ b/include/common/time.h
@@ -60,7 +60,8 @@ extern THREAD_LOCAL unsigned int   samp_time;        /* total elapsed time over 
 extern THREAD_LOCAL unsigned int   idle_time;        /* total idle time over current sample */
 extern THREAD_LOCAL struct timeval now;              /* internal date is a monotonic function of real clock */
 extern THREAD_LOCAL struct timeval date;             /* the real current date */
-extern struct timeval start_date;       /* the process's start date */
+extern struct timeval start_date;                    /* the process's start date */
+extern struct timeval ready_date;                    /* date when the process was considered ready */
 extern THREAD_LOCAL struct timeval before_poll;      /* system date before calling poll() */
 extern THREAD_LOCAL struct timeval after_poll;       /* system date after leaving poll() */
 extern volatile unsigned long long global_now;
diff --git a/include/types/spoe.h b/include/types/spoe.h
index 56224e1..aef387d 100644
--- a/include/types/spoe.h
+++ b/include/types/spoe.h
@@ -272,6 +272,7 @@ struct spoe_agent {
 		struct freq_ctr conn_per_sec;   /* connections per second */
 		struct freq_ctr err_per_sec;    /* connetion errors per second */
 
+		unsigned int    idles;          /* # of idle applets */
 		struct eb_root  idle_applets;   /* idle SPOE applets available to process data */
 		struct list     applets;        /* all SPOE applets for this agent */
 		struct list     sending_queue;  /* Queue of streams waiting to send data */
diff --git a/reg-tests/http-messaging/h1_to_h1.vtc b/reg-tests/http-messaging/h1_to_h1.vtc
index 7694014..aeb3a60 100644
--- a/reg-tests/http-messaging/h1_to_h1.vtc
+++ b/reg-tests/http-messaging/h1_to_h1.vtc
@@ -269,3 +269,29 @@ client c3h1 -connect ${h1_feh1_sock} {
 	# arrive here.
 	expect_close
 } -run
+
+client c4h1 -connect ${h1_feh1_sock} {
+	# this request is invalid and advertises an invalid C-L ending with an
+        # empty value, which results in a stream error.
+	txreq \
+	  -req "GET" \
+	  -url "/test31.html" \
+          -hdr "content-length: 0," \
+          -hdr "connection: close"
+	rxresp
+	expect resp.status == 400
+	expect_close
+} -run
+
+client c5h1 -connect ${h1_feh1_sock} {
+	# this request is invalid and advertises an empty C-L, which results
+	# in a stream error.
+	txreq \
+	  -req "GET" \
+	  -url "/test41.html" \
+          -hdr "content-length:" \
+          -hdr "connection: close"
+	rxresp
+	expect resp.status == 400
+	expect_close
+} -run
diff --git a/reg-tests/http-messaging/h2_to_h1.vtc b/reg-tests/http-messaging/h2_to_h1.vtc
index 481aded..3ed3751 100644
--- a/reg-tests/http-messaging/h2_to_h1.vtc
+++ b/reg-tests/http-messaging/h2_to_h1.vtc
@@ -10,6 +10,8 @@ barrier b1 cond 2 -cyclic
 barrier b2 cond 2 -cyclic
 barrier b3 cond 2 -cyclic
 barrier b4 cond 2 -cyclic
+barrier b5 cond 2 -cyclic
+barrier b6 cond 2 -cyclic
 
 server s1 {
 	rxreq
@@ -31,6 +33,12 @@ server s1 {
 
 	barrier b4 sync
 	# the next request is never received
+
+	barrier b5 sync
+	# the next request is never received
+
+	barrier b6 sync
+	# the next request is never received
 } -repeat 2 -start
 
 haproxy h1 -conf {
@@ -115,6 +123,32 @@ client c1h2 -connect ${h1_feh2_sock} {
 		txdata -data "this is sent and ignored"
 		rxrst
 	} -run
+
+	# fifth request is invalid and advertises an invalid C-L ending with an
+        # empty value, which results in a stream error.
+	stream 9 {
+		barrier b5 sync
+		txreq \
+		  -req "GET" \
+		  -scheme "https" \
+		  -url "/test5.html" \
+		  -hdr "content-length" "0," \
+		  -nostrend
+		rxrst
+	} -run
+
+	# sixth request is invalid and advertises an empty C-L, which results
+	# in a stream error.
+	stream 11 {
+		barrier b6 sync
+		txreq \
+		  -req "GET" \
+		  -scheme "https" \
+		  -url "/test6.html" \
+		  -hdr "content-length" "" \
+		  -nostrend
+		rxrst
+	} -run
 } -run
 
 # HEAD requests : don't work well yet
@@ -257,4 +291,30 @@ client c3h2 -connect ${h1_feh2_sock} {
 		txdata -data "this is sent and ignored"
 		rxrst
 	} -run
+
+	# fifth request is invalid and advertises invalid C-L ending with an
+        # empty value, which results in a stream error.
+	stream 9 {
+		barrier b5 sync
+		txreq \
+		  -req "POST" \
+		  -scheme "https" \
+		  -url "/test25.html" \
+		  -hdr "content-length" "0," \
+		  -nostrend
+		rxrst
+	} -run
+
+	# sixth request is invalid and advertises an empty C-L, which results
+	# in a stream error.
+	stream 11 {
+		barrier b6 sync
+		txreq \
+		  -req "POST" \
+		  -scheme "https" \
+		  -url "/test26.html" \
+		  -hdr "content-length" "" \
+		  -nostrend
+		rxrst
+	} -run
 } -run
diff --git a/reg-tests/http-rules/fragment_in_uri.vtc b/reg-tests/http-rules/fragment_in_uri.vtc
new file mode 100644
index 0000000..6217513
--- /dev/null
+++ b/reg-tests/http-rules/fragment_in_uri.vtc
@@ -0,0 +1,35 @@
+varnishtest "check for fragments in URL"
+#REQUIRE_VERSION=2.0
+
+# This reg-test checks that '#' is properly blocked in requests
+
+feature ignore_unknown_macro
+
+server s1 {
+    rxreq
+    txresp -hdr "connection: close"
+} -start
+
+haproxy h1 -conf {
+    global
+
+    defaults
+        mode http
+        timeout connect 1s
+        timeout client  1s
+        timeout server  1s
+
+    frontend fe_fragment_block
+        bind "fd@${fe_fragment_block}"
+        default_backend be
+
+    backend be
+        server s1 ${s1_addr}:${s1_port}
+
+} -start
+
+client c11 -connect ${h1_fe_fragment_block_sock} {
+    txreq -url "/#foo"
+    rxresp
+    expect resp.status == 400
+} -run
diff --git a/reg-tests/http-rules/h1or2_to_h1c.vtc b/reg-tests/http-rules/h1or2_to_h1c.vtc
index 16e2639..e6b7df4 100644
--- a/reg-tests/http-rules/h1or2_to_h1c.vtc
+++ b/reg-tests/http-rules/h1or2_to_h1c.vtc
@@ -27,11 +27,11 @@ server s1 {
 	  -body "This is a body"
 
 	expect req.method == "GET"
-	expect req.http.fe-sl1-crc == 992395575
-	expect req.http.fe-sl2-crc == 1270056220
+	expect req.http.fe-sl1-crc == 1874847043
+	expect req.http.fe-sl2-crc == 1142278307
 	expect req.http.fe-hdr-crc == 1719311923
-	expect req.http.be-sl1-crc == 2604236007
-	expect req.http.be-sl2-crc == 4181358964
+	expect req.http.be-sl1-crc == 3455320059
+	expect req.http.be-sl2-crc == 2509326257
 	expect req.http.be-hdr-crc == 3634102538
 } -repeat 2 -start
 
@@ -53,6 +53,7 @@ haproxy h1 -conf {
 	http-request set-var(req.path)       path
 	http-request set-var(req.query)      query
 	http-request set-var(req.param)      url_param(qs_arg)
+	http-request set-var(req.cl)         req.fhdr(content-length)
 
 	http-request set-header     sl1      "sl1: "
 
@@ -65,8 +66,10 @@ haproxy h1 -conf {
 
 	http-request set-header     sl1      "%[req.fhdr(sl1)] method=<%[var(req.method)]>; uri=<%[var(req.uri)]>; path=<%[var(req.path)]>;"
 	http-request set-header     sl1      "%[req.fhdr(sl1)] query=<%[var(req.query)]>; param=<%[var(req.param)]>"
+	http-request set-header     sl1      "%[req.fhdr(sl1)] cl=<%[var(req.cl)]>"
 	http-request set-header     sl2      "%[req.fhdr(sl2)] method=<%[method]>; uri=<%[url]>; path=<%[path]>; "
 	http-request set-header     sl2      "%[req.fhdr(sl2)] query=<%[query]>; param=<%[url_param(qs_arg)]>"
+	http-request set-header     sl2      "%[req.fhdr(sl2)] cl=<%[req.fhdr(content-length)]>"
 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr1=<%[req.hdr(hdr1)]>; fhdr1=<%[req.fhdr(hdr1)]>;"
 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr2=<%[req.hdr(hdr2)]>; fhdr2=<%[req.fhdr(hdr2)]>;"
 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr3=<%[req.hdr(hdr3)]>; fhdr3=<%[req.fhdr(hdr3)]>;"
@@ -120,6 +123,7 @@ haproxy h1 -conf {
 	http-request set-var(req.path)       path
 	http-request set-var(req.query)      query
 	http-request set-var(req.param)      url_param(qs_arg)
+	http-request set-var(req.cl)         req.fhdr(content-length)
 
 	http-request set-header     sl1      "sl1: "
 
@@ -132,8 +136,10 @@ haproxy h1 -conf {
 
 	http-request set-header     sl1      "%[req.fhdr(sl1)] method=<%[var(req.method)]>; uri=<%[var(req.uri)]>; path=<%[var(req.path)]>;"
 	http-request set-header     sl1      "%[req.fhdr(sl1)] query=<%[var(req.query)]>; param=<%[var(req.param)]>"
+	http-request set-header     sl1      "%[req.fhdr(sl1)] cl=<%[var(req.cl)]>"
 	http-request set-header     sl2      "%[req.fhdr(sl2)] method=<%[method]>; uri=<%[url]>; path=<%[path]>; "
 	http-request set-header     sl2      "%[req.fhdr(sl2)] query=<%[query]>; param=<%[url_param(qs_arg)]>"
+	http-request set-header     sl2      "%[req.fhdr(sl2)] cl=<%[req.fhdr(content-length)]>"
 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr1=<%[req.hdr(hdr1)]>; fhdr1=<%[req.fhdr(hdr1)]>;"
 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr2=<%[req.hdr(hdr2)]>; fhdr2=<%[req.fhdr(hdr2)]>;"
 	http-request set-header     hdr      "%[req.fhdr(hdr)] hdr3=<%[req.hdr(hdr3)]>; fhdr3=<%[req.fhdr(hdr3)]>;"
@@ -171,6 +177,7 @@ client c1h1 -connect ${h1_feh1_sock} {
 	txreq \
 	  -req GET \
 	  -url /path/to/file.extension?qs_arg=qs_value \
+	  -hdr "content-length: 000, 00" \
 	  -hdr "hdr1: val1" \
 	  -hdr "hdr2:  val2a" \
 	  -hdr "hdr2:    val2b" \
@@ -205,6 +212,7 @@ client c1h2 -connect ${h1_feh2_sock} {
 		  -req GET \
 		  -scheme "https" \
 		  -url /path/to/file.extension?qs_arg=qs_value \
+		  -hdr "content-length" "000, 00" \
 		  -hdr "hdr1" "val1" \
 		  -hdr "hdr2" " val2a" \
 		  -hdr "hdr2" "   val2b" \
diff --git a/scripts/publish-release b/scripts/publish-release
index d785244..f356076 100755
--- a/scripts/publish-release
+++ b/scripts/publish-release
@@ -22,6 +22,9 @@ NEW=
 DIR=
 DOC=( )
 
+# need to have group write on emitted files for others to update
+umask 002
+
 die() {
 	[ "$#" -eq 0 ] || echo "$*" >&2
 	exit 1
diff --git a/src/checks.c b/src/checks.c
index 06d6bff..b9f3c9d 100644
--- a/src/checks.c
+++ b/src/checks.c
@@ -2517,6 +2517,7 @@ static int start_check_task(struct check *check, int mininter,
 {
 	struct task *t;
 	unsigned long thread_mask = MAX_THREADS_MASK;
+	unsigned long boottime = tv_ms_remain(&start_date, &ready_date);
 
 	if (check->type == PR_O2_EXT_CHK)
 		thread_mask = 1;
@@ -2535,11 +2536,19 @@ static int start_check_task(struct check *check, int mininter,
 	if (mininter < srv_getinter(check))
 		mininter = srv_getinter(check);
 
+	if (global.spread_checks > 0) {
+		int rnd;
+
+		rnd  = srv_getinter(check) * global.spread_checks / 100;
+		rnd -= (int) (2 * rnd * (ha_random32() / 4294967295.0));
+		mininter += rnd;
+	}
+
 	if (global.max_spread_checks && mininter > global.max_spread_checks)
 		mininter = global.max_spread_checks;
 
 	/* check this every ms */
-	t->expire = tick_add(now_ms, MS_TO_TICKS(mininter * srvpos / nbcheck));
+	t->expire = tick_add(now_ms, MS_TO_TICKS(boottime + mininter * srvpos / nbcheck));
 	check->start = now;
 	task_queue(t);
 
diff --git a/src/chunk.c b/src/chunk.c
index 100783e..b62e323 100644
--- a/src/chunk.c
+++ b/src/chunk.c
@@ -153,15 +153,19 @@ int chunk_printf(struct buffer *chk, const char *fmt, ...)
 int chunk_appendf(struct buffer *chk, const char *fmt, ...)
 {
 	va_list argp;
+	size_t room;
 	int ret;
 
 	if (!chk->area || !chk->size)
 		return 0;
 
+	room = chk->size - chk->data;
+	if (!room)
+		return chk->data;
+
 	va_start(argp, fmt);
-	ret = vsnprintf(chk->area + chk->data, chk->size - chk->data, fmt,
-			argp);
-	if (ret >= chk->size - chk->data)
+	ret = vsnprintf(chk->area + chk->data, room, fmt, argp);
+	if (ret >= room)
 		/* do not copy anything in case of truncation */
 		chk->area[chk->data] = 0;
 	else
diff --git a/src/debug.c b/src/debug.c
index b35bff5..4303d04 100644
--- a/src/debug.c
+++ b/src/debug.c
@@ -164,9 +164,10 @@ void ha_task_dump(struct buffer *buf, const struct task *task, const char *pfx)
 	if (hlua && hlua->T) {
 		chunk_appendf(buf, "stack traceback:\n    ");
 		append_prefixed_str(buf, hlua_traceback(hlua->T, "\n    "), pfx, '\n', 0);
-		b_putchr(buf, '\n');
 	}
-	else
+
+	/* we may need to terminate the current line */
+	if (*b_peek(buf, b_data(buf)-1) != '\n')
 		b_putchr(buf, '\n');
 #endif
 }
diff --git a/src/filters.c b/src/filters.c
index a7327e8..8027d3e 100644
--- a/src/filters.c
+++ b/src/filters.c
@@ -292,10 +292,9 @@ flt_init_all()
 	int err_code = 0;
 
 	for (px = proxies_list; px; px = px->next) {
-		if (px->state == PR_STSTOPPED) {
-			flt_deinit(px);
+		if (px->state == PR_STSTOPPED)
 			continue;
-		}
+
 		err_code |= flt_init(px);
 		if (err_code & (ERR_ABORT|ERR_FATAL)) {
 			ha_alert("Failed to initialize filters for proxy '%s'.\n",
diff --git a/src/flt_spoe.c b/src/flt_spoe.c
index 128461b..d329f9f 100644
--- a/src/flt_spoe.c
+++ b/src/flt_spoe.c
@@ -1276,6 +1276,7 @@ spoe_release_appctx(struct appctx *appctx)
 		if (appctx->st0 == SPOE_APPCTX_ST_IDLE) {
 			eb32_delete(&spoe_appctx->node);
 			_HA_ATOMIC_SUB(&agent->counters.idles, 1);
+			agent->rt[tid].idles--;
 		}
 
 		appctx->st0 = SPOE_APPCTX_ST_END;
@@ -1489,6 +1490,7 @@ spoe_handle_connecting_appctx(struct appctx *appctx)
 
 		default:
 			_HA_ATOMIC_ADD(&agent->counters.idles, 1);
+			agent->rt[tid].idles++;
 			appctx->st0 = SPOE_APPCTX_ST_IDLE;
 			SPOE_APPCTX(appctx)->node.key = 0;
 			eb32_insert(&agent->rt[tid].idle_applets, &SPOE_APPCTX(appctx)->node);
@@ -1731,12 +1733,6 @@ spoe_handle_processing_appctx(struct appctx *appctx)
 		      (agent->b.be->nbpend ||
 		       (srv && (srv->nbpend || (srv->maxconn && srv->served >= srv_dynamic_maxconn(srv))))));
 
-	/* Don"t try to send new frame we are waiting for at lease a ack, in
-	 * sync mode or if applet must be closed ASAP
-	 */
-	if (appctx->st0 == SPOE_APPCTX_ST_WAITING_SYNC_ACK || (close_asap && SPOE_APPCTX(appctx)->cur_fpa))
-		skip_sending = 1;
-
 	/* receiving_frame loop */
 	while (!skip_receiving) {
 		ret = spoe_handle_receiving_frame_appctx(appctx, &skip_receiving);
@@ -1757,6 +1753,12 @@ spoe_handle_processing_appctx(struct appctx *appctx)
 		}
 	}
 
+	/* Don"t try to send new frame we are waiting for at lease a ack, in
+	 * sync mode or if applet must be closed ASAP
+	 */
+	if (appctx->st0 == SPOE_APPCTX_ST_WAITING_SYNC_ACK || (close_asap && SPOE_APPCTX(appctx)->cur_fpa))
+		skip_sending = 1;
+
 	/* send_frame loop */
 	while (!skip_sending && SPOE_APPCTX(appctx)->cur_fpa < agent->max_fpa) {
 		ret = spoe_handle_sending_frame_appctx(appctx, &skip_sending);
@@ -1803,6 +1805,7 @@ spoe_handle_processing_appctx(struct appctx *appctx)
 			goto next;
 		}
 		_HA_ATOMIC_ADD(&agent->counters.idles, 1);
+		agent->rt[tid].idles++;
 		appctx->st0 = SPOE_APPCTX_ST_IDLE;
 		eb32_insert(&agent->rt[tid].idle_applets, &SPOE_APPCTX(appctx)->node);
 	}
@@ -1968,6 +1971,7 @@ spoe_handle_appctx(struct appctx *appctx)
 
 		case SPOE_APPCTX_ST_IDLE:
 			_HA_ATOMIC_SUB(&agent->counters.idles, 1);
+			agent->rt[tid].idles--;
 			eb32_delete(&SPOE_APPCTX(appctx)->node);
 			if (stopping &&
 			    LIST_ISEMPTY(&agent->rt[tid].sending_queue) &&
@@ -2110,8 +2114,8 @@ spoe_queue_context(struct spoe_context *ctx)
 	struct spoe_appctx *spoe_appctx;
 
 	/* Check if we need to create a new SPOE applet or not. */
-	if (!eb_is_empty(&agent->rt[tid].idle_applets) &&
-	    (agent->rt[tid].processing == 1 || agent->rt[tid].processing < read_freq_ctr(&agent->rt[tid].processing_per_sec)))
+	if (agent->rt[tid].processing < agent->rt[tid].idles  ||
+	    agent->rt[tid].processing < read_freq_ctr(&agent->rt[tid].processing_per_sec))
 		goto end;
 
 	SPOE_PRINTF(stderr, "%d.%06d [SPOE/%-15s] %s: stream=%p"
@@ -3038,6 +3042,14 @@ spoe_sig_stop(struct sig_handler *sh)
 	while (p) {
 		struct flt_conf *fconf;
 
+		/* SPOE filter are not initialized for disabled proxoes. Move to
+		 * the next one
+		 */
+		if (p->state == PR_STSTOPPED) {
+			p = p->next;
+			continue;
+		}
+
 		list_for_each_entry(fconf, &p->filter_configs, list) {
 			struct spoe_config *conf;
 			struct spoe_agent  *agent;
@@ -3079,7 +3091,6 @@ spoe_init(struct proxy *px, struct flt_conf *fconf)
         conf->agent_fe.accept = frontend_accept;
         conf->agent_fe.srv = NULL;
         conf->agent_fe.timeout.client = TICK_ETERNITY;
-	conf->agent_fe.default_target = &spoe_applet.obj_type;
 	conf->agent_fe.fe_req_ana = AN_REQ_SWITCHING_RULES;
 
 	if (!sighandler_registered) {
@@ -3170,6 +3181,7 @@ spoe_check(struct proxy *px, struct flt_conf *fconf)
 		conf->agent->rt[i].engine_id    = NULL;
 		conf->agent->rt[i].frame_size   = conf->agent->max_frame_size;
 		conf->agent->rt[i].processing   = 0;
+		conf->agent->rt[i].idles        = 0;
 		LIST_INIT(&conf->agent->rt[i].applets);
 		LIST_INIT(&conf->agent->rt[i].sending_queue);
 		LIST_INIT(&conf->agent->rt[i].waiting_queue);
diff --git a/src/h1.c b/src/h1.c
index 69a7ced..30c49ea 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -32,13 +32,20 @@ int h1_parse_cont_len_header(struct h1m *h1m, struct ist *value)
 	int not_first = !!(h1m->flags & H1_MF_CLEN);
 	struct ist word;
 
-	word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
+	word.ptr = value->ptr;
 	e = value->ptr + value->len;
 
-	while (++word.ptr < e) {
-		/* skip leading delimitor and blanks */
-		if (unlikely(HTTP_IS_LWS(*word.ptr)))
+	while (1) {
+		if (word.ptr >= e) {
+			/* empty header or empty value */
+			goto fail;
+		}
+
+		/* skip leading delimiter and blanks */
+		if (unlikely(HTTP_IS_LWS(*word.ptr))) {
+			word.ptr++;
 			continue;
+		}
 
 		/* digits only now */
 		for (cl = 0, n = word.ptr; n < e; n++) {
@@ -49,6 +56,14 @@ int h1_parse_cont_len_header(struct h1m *h1m, struct ist *value)
 					goto fail;
 				break;
 			}
+
+			if (unlikely(!cl && n > word.ptr)) {
+				/* There was a leading zero before this digit,
+				 * let's trim it.
+				 */
+				word.ptr = n;
+			}
+
 			if (unlikely(cl > ULLONG_MAX / 10ULL))
 				goto fail; /* multiply overflow */
 			cl = cl * 10ULL;
@@ -77,6 +92,13 @@ int h1_parse_cont_len_header(struct h1m *h1m, struct ist *value)
 		h1m->flags |= H1_MF_CLEN;
 		h1m->curr_len = h1m->body_len = cl;
 		*value = word;
+
+		/* Now either n==e and we're done, or n points to the comma,
+		 * and we skip it and continue.
+		 */
+		if (n++ == e)
+			break;
+
 		word.ptr = n;
 	}
 	/* here we've reached the end with a single value or a series of
@@ -390,11 +412,11 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
     defined(__ARM_ARCH_7A__)
 		/* speedup: skip bytes not between 0x21 and 0x7e inclusive */
 		while (ptr <= end - sizeof(int)) {
-			int x = *(int *)ptr - 0x21212121;
+			int x = *(int *)ptr - 0x24242424;
 			if (x & 0x80808080)
 				break;
 
-			x -= 0x5e5e5e5e;
+			x -= 0x5b5b5b5b;
 			if (!(x & 0x80808080))
 				break;
 
@@ -406,8 +428,15 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 			goto http_msg_ood;
 		}
 	http_msg_rquri2:
-		if (likely((unsigned char)(*ptr - 33) <= 93)) /* 33 to 126 included */
+		if (likely((unsigned char)(*ptr - 33) <= 93)) { /* 33 to 126 included */
+			if (*ptr == '#') {
+				if (h1m->err_pos < -1) /* PR_O2_REQBUG_OK not set */
+					goto invalid_char;
+				if (h1m->err_pos == -1) /* PR_O2_REQBUG_OK set: just log */
+					h1m->err_pos = ptr - start + skip;
+			}
 			EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rquri2, http_msg_ood, state, H1_MSG_RQURI);
+		}
 
 		if (likely(HTTP_IS_SPHT(*ptr))) {
 			sl.rq.u.len = ptr - sl.rq.u.ptr;
diff --git a/src/h2.c b/src/h2.c
index bfc0bda..a36b93b 100644
--- a/src/h2.c
+++ b/src/h2.c
@@ -61,6 +61,26 @@ static int has_forbidden_char(const struct ist ist, const char *start)
 	return 0;
 }
 
+/* Looks into <ist> for forbidden characters for :path values (0x00..0x1F,
+ * 0x20, 0x23), starting at pointer <start> which must be within <ist>.
+ * Returns non-zero if such a character is found, 0 otherwise. When run on
+ * unlikely header match, it's recommended to first check for the presence
+ * of control chars using ist_find_ctl().
+ */
+static inline int http_path_has_forbidden_char(const struct ist ist, const char *start)
+{
+	do {
+		if ((uint8_t)*start <= 0x23) {
+			if ((uint8_t)*start < 0x20)
+				return 1;
+			if ((1U << ((uint8_t)*start & 0x1F)) & ((1<<3) | (1<<0)))
+				return 1;
+		}
+		start++;
+	} while (start < istend(ist));
+	return 0;
+}
+
 /* Prepare the request line into <*ptr> (stopping at <end>) from pseudo headers
  * stored in <phdr[]>. <fields> indicates what was found so far. This should be
  * called once at the detection of the first general header field or at the end
@@ -158,8 +178,12 @@ static int h2_prepare_h1_reqline(uint32_t fields, struct ist *phdr, char **ptr, 
  *
  * The Cookie header will be reassembled at the end, and for this, the <list>
  * will be used to create a linked list, so its contents may be destroyed.
+ *
+ * When <relaxed> is non-nul, some non-dangerous checks will be ignored. This
+ * is in order to satisfy "option accept-invalid-http-request" for
+ * interoperability purposes.
  */
-int h2_make_h1_request(struct http_hdr *list, char *out, int osize, unsigned int *msgf, unsigned long long *body_len)
+int h2_make_h1_request(struct http_hdr *list, char *out, int osize, unsigned int *msgf, unsigned long long *body_len, int relaxed)
 {
 	struct ist phdr_val[H2_PHDR_NUM_ENTRIES];
 	char *out_end = out + osize;
@@ -196,9 +220,15 @@ int h2_make_h1_request(struct http_hdr *list, char *out, int osize, unsigned int
 		/* RFC7540#10.3: intermediaries forwarding to HTTP/1 must take care of
 		 * rejecting NUL, CR and LF characters.
 		 */
-		ctl = ist_find_ctl(list[idx].v);
-		if (unlikely(ctl) && has_forbidden_char(list[idx].v, ctl))
-			goto fail;
+		if (phdr == H2_PHDR_IDX_PATH && !relaxed) {
+			ctl = ist_find_range(list[idx].v, 0, '#');
+			if (unlikely(ctl) && http_path_has_forbidden_char(list[idx].v, ctl))
+				goto fail;
+		} else {
+			ctl = ist_find_ctl(list[idx].v);
+			if (unlikely(ctl) && has_forbidden_char(list[idx].v, ctl))
+				goto fail;
+		}
 
 		if (phdr > 0 && phdr < H2_PHDR_NUM_ENTRIES) {
 			/* insert a pseudo header by its index (in phdr) and value (in value) */
@@ -458,13 +488,20 @@ int h2_parse_cont_len_header(unsigned int *msgf, struct ist *value, unsigned lon
 	int not_first = !!(*msgf & H2_MSGF_BODY_CL);
 	struct ist word;
 
-	word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
+	word.ptr = value->ptr;
 	e = value->ptr + value->len;
 
-	while (++word.ptr < e) {
-		/* skip leading delimitor and blanks */
-		if (unlikely(HTTP_IS_LWS(*word.ptr)))
+	while (1) {
+		if (word.ptr >= e) {
+			/* empty header or empty value */
+			goto fail;
+		}
+
+		/* skip leading delimiter and blanks */
+		if (unlikely(HTTP_IS_LWS(*word.ptr))) {
+			word.ptr++;
 			continue;
+		}
 
 		/* digits only now */
 		for (cl = 0, n = word.ptr; n < e; n++) {
@@ -475,6 +512,14 @@ int h2_parse_cont_len_header(unsigned int *msgf, struct ist *value, unsigned lon
 					goto fail;
 				break;
 			}
+
+			if (unlikely(!cl && n > word.ptr)) {
+				/* There was a leading zero before this digit,
+				 * let's trim it.
+				 */
+				word.ptr = n;
+			}
+
 			if (unlikely(cl > ULLONG_MAX / 10ULL))
 				goto fail; /* multiply overflow */
 			cl = cl * 10ULL;
@@ -503,6 +548,13 @@ int h2_parse_cont_len_header(unsigned int *msgf, struct ist *value, unsigned lon
 		*msgf |= H2_MSGF_BODY_CL;
 		*body_len = cl;
 		*value = word;
+
+		/* Now either n==e and we're done, or n points to the comma,
+		 * and we skip it and continue.
+		 */
+		if (n++ == e)
+			break;
+
 		word.ptr = n;
 	}
 	/* here we've reached the end with a single value or a series of
@@ -626,8 +678,12 @@ static struct htx_sl *h2_prepare_htx_reqline(uint32_t fields, struct ist *phdr, 
  *
  * The Cookie header will be reassembled at the end, and for this, the <list>
  * will be used to create a linked list, so its contents may be destroyed.
+ *
+ * When <relaxed> is non-nul, some non-dangerous checks will be ignored. This
+ * is in order to satisfy "option accept-invalid-http-request" for
+ * interoperability purposes.
  */
-int h2_make_htx_request(struct http_hdr *list, struct htx *htx, unsigned int *msgf, unsigned long long *body_len)
+int h2_make_htx_request(struct http_hdr *list, struct htx *htx, unsigned int *msgf, unsigned long long *body_len, int relaxed)
 {
 	struct ist phdr_val[H2_PHDR_NUM_ENTRIES];
 	uint32_t fields; /* bit mask of H2_PHDR_FND_* */
@@ -664,11 +720,18 @@ int h2_make_htx_request(struct http_hdr *list, struct htx *htx, unsigned int *ms
 		}
 
 		/* RFC7540#10.3: intermediaries forwarding to HTTP/1 must take care of
-		 * rejecting NUL, CR and LF characters.
+		 * rejecting NUL, CR and LF characters. For :path we reject all CTL
+		 * chars, spaces, and '#'.
 		 */
-		ctl = ist_find_ctl(list[idx].v);
-		if (unlikely(ctl) && has_forbidden_char(list[idx].v, ctl))
-			goto fail;
+		if (phdr == H2_PHDR_IDX_PATH && !relaxed) {
+			ctl = ist_find_range(list[idx].v, 0, '#');
+			if (unlikely(ctl) && http_path_has_forbidden_char(list[idx].v, ctl))
+				goto fail;
+		} else {
+			ctl = ist_find_ctl(list[idx].v);
+			if (unlikely(ctl) && has_forbidden_char(list[idx].v, ctl))
+				goto fail;
+		}
 
 		if (phdr > 0 && phdr < H2_PHDR_NUM_ENTRIES) {
 			/* insert a pseudo header by its index (in phdr) and value (in value) */
diff --git a/src/haproxy.c b/src/haproxy.c
index f6166d4..b22e954 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -1994,7 +1994,18 @@ static void init(int argc, char **argv)
 		}
 	}
 
+	/* update the ready date that will be used to count the startup time
+	 * during config checks (e.g. to schedule certain tasks if needed)
+	 */
+	gettimeofday(&date, NULL);
+	ready_date = date;
+
 	err_code |= check_config_validity();
+
+	/* update the ready date to also account for the check time */
+	gettimeofday(&date, NULL);
+	ready_date = date;
+
 	if (err_code & (ERR_ABORT|ERR_FATAL)) {
 		ha_alert("Fatal errors found in configuration.\n");
 		exit(1);
@@ -2565,6 +2576,7 @@ void deinit(void)
 				free(rdr->cond);
 			}
 			free(rdr->rdr_str);
+			free(rdr->cookie_str);
 			list_for_each_entry_safe(lf, lfb, &rdr->rdr_fmt, list) {
 				LIST_DEL(&lf->list);
 				free(lf);
@@ -2664,6 +2676,7 @@ void deinit(void)
 			LIST_DEL(&l->by_bind);
 			free(l->name);
 			free(l->counters);
+			free(l->interface);
 			free(l);
 		}
 
@@ -3258,6 +3271,10 @@ int main(int argc, char **argv)
 			   argv[0], (int)limit.rlim_cur, global.maxconn, global.maxsock, global.maxsock);
 	}
 
+	/* update the ready date a last time to also account for final setup time */
+	gettimeofday(&date, NULL);
+	ready_date = date;
+
 	if (global.mode & (MODE_DAEMON | MODE_MWORKER | MODE_MWORKER_WAIT)) {
 		struct proxy *px;
 		struct peers *curpeers;
@@ -3323,7 +3340,7 @@ int main(int argc, char **argv)
 					list_for_each_entry(child, &proc_list, list) {
 						if (child->relative_pid == relative_pid &&
 						    child->reloads == 0 && child->options & PROC_O_TYPE_WORKER) {
-							child->timestamp = now.tv_sec;
+							child->timestamp = date.tv_sec;
 							child->pid = ret;
 							child->version = strdup(haproxy_version);
 							break;
diff --git a/src/hlua.c b/src/hlua.c
index bd8a679..b97442d 100644
--- a/src/hlua.c
+++ b/src/hlua.c
@@ -3622,7 +3622,9 @@ __LJMP static int hlua_applet_tcp_set_var(lua_State *L)
 	memset(&smp, 0, sizeof(smp));
 	hlua_lua2smp(L, 3, &smp);
 
-	/* Store the sample in a variable. */
+	/* Store the sample in a variable. We don't need to dup the smp, vars API
+	 * already takes care of duplicating dynamic var data.
+	 */
 	smp_set_owner(&smp, s->be, s->sess, s, 0);
 	vars_set_by_name(name, len, &smp);
 	return 0;
@@ -4158,7 +4160,9 @@ __LJMP static int hlua_applet_http_set_var(lua_State *L)
 	memset(&smp, 0, sizeof(smp));
 	hlua_lua2smp(L, 3, &smp);
 
-	/* Store the sample in a variable. */
+	/* Store the sample in a variable. We don't need to dup the smp, vars API
+	 * already takes care of duplicating dynamic var data.
+	 */
 	smp_set_owner(&smp, s->be, s->sess, s, 0);
 	vars_set_by_name(name, len, &smp);
 	return 0;
@@ -5768,7 +5772,9 @@ __LJMP static int hlua_set_var(lua_State *L)
 	memset(&smp, 0, sizeof(smp));
 	hlua_lua2smp(L, 3, &smp);
 
-	/* Store the sample in a variable. */
+	/* Store the sample in a variable. We don't need to dup the smp, vars API
+	 * already takes care of duplicating dynamic var data.
+	 */
 	smp_set_owner(&smp, htxn->p, htxn->s->sess, htxn->s, htxn->dir & SMP_OPT_DIR);
 	vars_set_by_name(name, len, &smp);
 	return 0;
@@ -6507,6 +6513,10 @@ static int hlua_sample_conv_wrapper(const struct arg *arg_p, struct sample *smp,
 
 		/* Convert the returned value in sample. */
 		hlua_lua2smp(stream->hlua->T, -1, smp);
+		/* dup the smp before popping the related lua value and
+		 * returning it to haproxy
+		 */
+		smp_dup(smp);
 		lua_pop(stream->hlua->T, 1);
 		return 1;
 
@@ -6655,6 +6665,10 @@ static int hlua_sample_fetch_wrapper(const struct arg *arg_p, struct sample *smp
 
 		/* Convert the returned value in sample. */
 		hlua_lua2smp(stream->hlua->T, -1, smp);
+		/* dup the smp before popping the related lua value and
+		 * returning it to haproxy
+		 */
+		smp_dup(smp);
 		lua_pop(stream->hlua->T, 1);
 
 		/* Set the end of execution flag. */
diff --git a/src/http.c b/src/http.c
index 1ee891c..74833a8 100644
--- a/src/http.c
+++ b/src/http.c
@@ -449,7 +449,7 @@ const char *http_get_reason(unsigned int status)
 	case 226: return "IM Used";
 	case 300: return "Multiple Choices";
 	case 301: return "Moved Permanently";
-	case 302: return "Moved Temporarily";
+	case 302: return "Found";
 	case 303: return "See Other";
 	case 304: return "Not Modified";
 	case 305: return "Use Proxy";
diff --git a/src/http_msg.c b/src/http_msg.c
index e07c81c..c38a0f0 100644
--- a/src/http_msg.c
+++ b/src/http_msg.c
@@ -716,11 +716,11 @@ const char *http_parse_reqline(struct http_msg *msg,
     defined(__ARM_ARCH_7A__)
 		/* speedup: skip bytes not between 0x21 and 0x7e inclusive */
 		while (ptr <= end - sizeof(int)) {
-			int x = *(int *)ptr - 0x21212121;
+			int x = *(int *)ptr - 0x24242424;
 			if (x & 0x80808080)
 				break;
 
-			x -= 0x5e5e5e5e;
+			x -= 0x5b5b5b5b;
 			if (!(x & 0x80808080))
 				break;
 
@@ -732,8 +732,15 @@ const char *http_parse_reqline(struct http_msg *msg,
 			goto http_msg_ood;
 		}
 	http_msg_rquri2:
-		if (likely((unsigned char)(*ptr - 33) <= 93)) /* 33 to 126 included */
+		if (likely((unsigned char)(*ptr - 33) <= 93)) { /* 33 to 126 included */
+			if (*ptr == '#') {
+				if (msg->err_pos < -1) /* PR_O2_REQBUG_OK not set */
+					goto invalid_char;
+				if (msg->err_pos == -1) /* PR_O2_REQBUG_OK set: just log */
+					msg->err_pos = ptr - msg_start;
+			}
 			EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_rquri2, http_msg_ood, state, HTTP_MSG_RQURI);
+		}
 
 		if (likely(HTTP_IS_SPHT(*ptr))) {
 			msg->sl.rq.u_l = ptr - msg_start - msg->sl.rq.u;
diff --git a/src/log.c b/src/log.c
index a63ba61..708b4db 100644
--- a/src/log.c
+++ b/src/log.c
@@ -834,6 +834,10 @@ int parse_logsrv(char **args, struct list *logsrvs, int do_del, char **err)
 			}
 
 			node = malloc(sizeof(*node));
+			if (!node) {
+				memprintf(err, "out of memory error");
+				goto error;
+			}
 			memcpy(node, logsrv, sizeof(struct logsrv));
 			node->ref = logsrv;
 			LIST_INIT(&node->list);
diff --git a/src/mux_h1.c b/src/mux_h1.c
index 4c91672..426e996 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -553,8 +553,10 @@ static void h1_release(struct h1c *h1c)
 			h1c->task = NULL;
 		}
 
-		if (h1c->wait_event.tasklet)
+		if (h1c->wait_event.tasklet) {
 			tasklet_free(h1c->wait_event.tasklet);
+			h1c->wait_event.tasklet = NULL;
+		}
 
 		h1s_destroy(h1c->h1s);
 		if (conn) {
@@ -2210,7 +2212,8 @@ static int h1_process(struct h1c * h1c)
 	if (!h1s_data_pending(h1s) && h1s && h1s->cs && h1s->cs->data_cb->wake &&
 	    (h1s->flags & H1S_F_REOS || h1c->flags & H1C_F_CS_ERROR ||
 	    conn->flags & (CO_FL_ERROR | CO_FL_SOCK_WR_SH))) {
-		if (h1c->flags & H1C_F_CS_ERROR || ((conn->flags & CO_FL_ERROR) && !b_data(&h1c->ibuf)))
+		if (h1c->flags & H1C_F_CS_ERROR || ((conn->flags & CO_FL_ERROR) &&
+		     ((h1s->cs->flags & (CS_FL_EOI|CS_FL_EOS)) || !b_data(&h1c->ibuf))))
 			h1s->cs->flags |= CS_FL_ERROR;
 		h1s->cs->data_cb->wake(h1s->cs);
 	}
@@ -2496,6 +2499,9 @@ static void h1_shutw_conn(struct connection *conn)
 	conn_xprt_shutw(conn);
 	conn_sock_shutw(conn, (h1c && !(h1c->flags & H1C_F_ST_SILENT_SHUT)));
 	h1c->flags = (h1c->flags & ~H1C_F_CS_SHUTW_NOW) | H1C_F_CS_SHUTDOWN;
+
+	if (h1c->wait_event.tasklet && !h1c->wait_event.events)
+		tasklet_wakeup(h1c->wait_event.tasklet);
 }
 
 /* Called from the upper layer, to unsubscribe to events */
@@ -2600,15 +2606,21 @@ static size_t h1_snd_buf(struct conn_stream *cs, struct buffer *buf, size_t coun
 
 		if (!(h1c->flags & (H1C_F_OUT_FULL|H1C_F_OUT_ALLOC)))
 			ret = h1_process_output(h1c, buf, count);
+
 		if (!ret)
 			break;
 		total += ret;
 		count -= ret;
+
 		if ((h1c->wait_event.events & SUB_RETRY_SEND) || !h1_send(h1c))
 			break;
+
+		if ((h1c->conn->flags & (CO_FL_ERROR|CO_FL_SOCK_WR_SH)))
+			break;
 	}
 
-	if (h1c->flags & H1C_F_CS_ERROR)
+	if (h1c->flags & H1C_F_CS_ERROR || ((h1c->conn->flags & CO_FL_ERROR) &&
+	     ((cs->flags & (CS_FL_EOI|CS_FL_EOS)) || !b_data(&h1c->ibuf))))
 		cs->flags |= CS_FL_ERROR;
 
 	h1_refresh_timeout(h1c);
diff --git a/src/mux_h2.c b/src/mux_h2.c
index 3141b36..6aaaa3a 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -608,6 +608,7 @@ static int h2_init(struct connection *conn, struct proxy *prx, struct session *s
 
 	h2c->proxy = prx;
 	h2c->task = NULL;
+	h2c->wait_event.tasklet = NULL;
 	h2c->idle_start = now_ms;
 	if (tick_isset(h2c->timeout)) {
 		t = task_new(tid_bit);
@@ -2117,8 +2118,10 @@ static struct h2s *h2c_frt_handle_headers(struct h2c *h2c, struct h2s *h2s)
 		if (h2s->st != H2_SS_CLOSED) {
 			error = h2c_decode_headers(h2c, &h2s->rxbuf, &h2s->flags, &body_len);
 			/* unrecoverable error ? */
-			if (h2c->st0 >= H2_CS_ERROR)
+			if (h2c->st0 >= H2_CS_ERROR) {
+				sess_log(h2c->conn->owner);
 				goto out;
+			}
 
 			if (error == 0) {
 				/* Demux not blocked because of the stream, it is an incomplete frame */
@@ -2131,6 +2134,7 @@ static struct h2s *h2c_frt_handle_headers(struct h2c *h2c, struct h2s *h2s)
 				/* Failed to decode this frame (e.g. too large request)
 				 * but the HPACK decompressor is still synchronized.
 				 */
+				sess_log(h2c->conn->owner);
 				h2s_error(h2s, H2_ERR_INTERNAL_ERROR);
 				h2c->st0 = H2_CS_FRAME_E;
 				goto out;
@@ -2141,6 +2145,7 @@ static struct h2s *h2c_frt_handle_headers(struct h2c *h2c, struct h2s *h2s)
 		 * the data and send another RST.
 		 */
 		error = h2c_decode_headers(h2c, &rxbuf, &flags, &body_len);
+		sess_log(h2c->conn->owner);
 		h2s = (struct h2s*)h2_error_stream;
 		goto send_rst;
 	}
@@ -2156,8 +2161,10 @@ static struct h2s *h2c_frt_handle_headers(struct h2c *h2c, struct h2s *h2s)
 	error = h2c_decode_headers(h2c, &rxbuf, &flags, &body_len);
 
 	/* unrecoverable error ? */
-	if (h2c->st0 >= H2_CS_ERROR)
+	if (h2c->st0 >= H2_CS_ERROR) {
+		sess_log(h2c->conn->owner);
 		goto out;
+	}
 
 	if (error <= 0) {
 		if (error == 0) {
@@ -2170,6 +2177,7 @@ static struct h2s *h2c_frt_handle_headers(struct h2c *h2c, struct h2s *h2s)
 		/* Failed to decode this stream (e.g. too large request)
 		 * but the HPACK decompressor is still synchronized.
 		 */
+		sess_log(h2c->conn->owner);
 		h2s = (struct h2s*)h2_error_stream;
 		goto send_rst;
 	}
@@ -3436,7 +3444,7 @@ static void h2_detach(struct conn_stream *cs)
 		/* refresh the timeout if none was active, so that the last
 		 * leaving stream may arm it.
 		 */
-		if (!tick_isset(h2c->task->expire))
+		if (h2c->task && !tick_isset(h2c->task->expire))
 			h2c_update_timeout(h2c);
 		return;
 	}
@@ -3905,10 +3913,12 @@ next_frame:
 		if (h2c->flags & H2_CF_IS_BACK)
 			outlen = h2_make_htx_response(list, htx, &msgf, body_len);
 		else
-			outlen = h2_make_htx_request(list, htx, &msgf, body_len);
+			outlen = h2_make_htx_request(list, htx, &msgf, body_len,
+					     !!(((const struct session *)h2c->conn->owner)->fe->options2 & PR_O2_REQBUG_OK));
 	} else {
 		/* HTTP/1 mode */
-		outlen = h2_make_h1_request(list, b_tail(rxbuf), try, &msgf, body_len);
+		outlen = h2_make_h1_request(list, b_tail(rxbuf), try, &msgf, body_len,
+					     !!(((const struct session *)h2c->conn->owner)->fe->options2 & PR_O2_REQBUG_OK));
 		if (outlen > 0)
 			b_add(rxbuf, outlen);
 	}
diff --git a/src/mworker.c b/src/mworker.c
index 487d071..8b646a7 100644
--- a/src/mworker.c
+++ b/src/mworker.c
@@ -173,6 +173,8 @@ int mworker_env_to_proc_list()
 
 			} else if (strncmp(subtoken, "fd=", 3) == 0) {
 				child->ipc_fd[0] = atoi(subtoken+3);
+				if (child->ipc_fd[0] > -1)
+					global.maxsock++;
 			} else if (strncmp(subtoken, "pid=", 4) == 0) {
 				child->pid = atoi(subtoken+4);
 			} else if (strncmp(subtoken, "rpid=", 5) == 0) {
@@ -388,6 +390,9 @@ static int mworker_pipe_register_per_thread()
 	if (tid != 0)
 		return 1;
 
+	if (proc_self->ipc_fd[1] < 0) /* proc_self was incomplete and we can't find the socketpair */
+		return 1;
+
 	fcntl(proc_self->ipc_fd[1], F_SETFL, O_NONBLOCK);
 	/* In multi-tread, we need only one thread to process
 	 * events on the pipe with master
@@ -483,12 +488,15 @@ static int cli_io_handler_show_proc(struct appctx *appctx)
 	struct stream_interface *si = appctx->owner;
 	struct mworker_proc *child;
 	int old = 0;
-	int up = now.tv_sec - proc_self->timestamp;
+	int up = date.tv_sec - proc_self->timestamp;
 	char *uptime = NULL;
 
 	if (unlikely(si_ic(si)->flags & (CF_WRITE_ERROR|CF_SHUTW)))
 		return 1;
 
+	if (up < 0) /* must never be negative because of clock drift */
+		up = 0;
+
 	chunk_reset(&trash);
 
 	chunk_printf(&trash, "#%-14s %-15s %-15s %-15s %-15s %-15s\n", "<PID>", "<type>", "<relative PID>", "<reloads>", "<uptime>", "<version>");
@@ -501,7 +509,9 @@ static int cli_io_handler_show_proc(struct appctx *appctx)
 
 	chunk_appendf(&trash, "# workers\n");
 	list_for_each_entry(child, &proc_list, list) {
-		up = now.tv_sec - child->timestamp;
+		up = date.tv_sec - child->timestamp;
+		if (up < 0) /* must never be negative because of clock drift */
+			up = 0;
 
 		if (!(child->options & PROC_O_TYPE_WORKER))
 			continue;
@@ -523,7 +533,9 @@ static int cli_io_handler_show_proc(struct appctx *appctx)
 
 		chunk_appendf(&trash, "# old workers\n");
 		list_for_each_entry(child, &proc_list, list) {
-			up = now.tv_sec - child->timestamp;
+			up = date.tv_sec - child->timestamp;
+			if (up <= 0) /* must never be negative because of clock drift */
+				up = 0;
 
 			if (!(child->options & PROC_O_TYPE_WORKER))
 				continue;
@@ -543,7 +555,9 @@ static int cli_io_handler_show_proc(struct appctx *appctx)
 	chunk_appendf(&trash, "# programs\n");
 	old = 0;
 	list_for_each_entry(child, &proc_list, list) {
-		up = now.tv_sec - child->timestamp;
+		up = date.tv_sec - child->timestamp;
+		if (up < 0) /* must never be negative because of clock drift */
+			up = 0;
 
 		if (!(child->options & PROC_O_TYPE_PROG))
 			continue;
@@ -561,7 +575,9 @@ static int cli_io_handler_show_proc(struct appctx *appctx)
 	if (old) {
 		chunk_appendf(&trash, "# old programs\n");
 		list_for_each_entry(child, &proc_list, list) {
-			up = now.tv_sec - child->timestamp;
+			up = date.tv_sec - child->timestamp;
+			if (up < 0) /* must never be negative because of clock drift */
+				up = 0;
 
 			if (!(child->options & PROC_O_TYPE_PROG))
 				continue;
diff --git a/src/namespace.c b/src/namespace.c
index 89a968e..ad53d1e 100644
--- a/src/namespace.c
+++ b/src/namespace.c
@@ -54,6 +54,7 @@ static void netns_sig_stop(struct sig_handler *sh)
 		entry = container_of(node, struct netns_entry, node);
 		free(entry->node.key);
 		close(entry->fd);
+		free(entry);
 		node = next;
 	}
 }
diff --git a/src/proto_htx.c b/src/proto_htx.c
index 51fdd47..91fdbfb 100644
--- a/src/proto_htx.c
+++ b/src/proto_htx.c
@@ -2642,11 +2642,12 @@ int htx_transform_header_str(struct stream* s, struct channel *chn, struct htx *
 			     struct ist name, const char *str, struct my_regex *re, int action)
 {
 	struct http_hdr_ctx ctx;
-	struct buffer *output = get_trash_chunk();
 
 	/* find full header is action is ACT_HTTP_REPLACE_HDR */
 	ctx.blk = NULL;
 	while (http_find_header(htx, name, &ctx, (action == ACT_HTTP_REPLACE_HDR))) {
+		struct buffer *output = get_trash_chunk();
+
 		if (!regex_exec_match2(re, ctx.value.ptr, ctx.value.len, MAX_MATCH, pmatch, 0))
 			continue;
 
diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index fc26a7c..5882e6b 100644
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -1917,8 +1917,10 @@ static int bind_parse_interface(char **args, int cur_arg, struct proxy *px, stru
 	}
 
 	list_for_each_entry(l, &conf->listeners, by_bind) {
-		if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6)
+		if (l->addr.ss_family == AF_INET || l->addr.ss_family == AF_INET6) {
+			free(l->interface);
 			l->interface = strdup(args[cur_arg + 1]);
+		}
 	}
 
 	return 0;
diff --git a/src/proxy.c b/src/proxy.c
index cb5f8e1..d3d62ab 100644
--- a/src/proxy.c
+++ b/src/proxy.c
@@ -1022,8 +1022,8 @@ struct task *manage_proxy(struct task *t, void *context, unsigned short state)
 			 * to push to a new process and
 			 * we are free to flush the table.
 			 */
-			stktable_trash_oldest(p->table, p->table->current);
-			pool_gc(NULL);
+			if (stktable_trash_oldest(p->table, p->table->current))
+				pool_gc(NULL);
 		}
 		if (p->table->current) {
 			/* some entries still remain, let's recheck in one second */
diff --git a/src/sample.c b/src/sample.c
index e713f29..6153832 100644
--- a/src/sample.c
+++ b/src/sample.c
@@ -2451,12 +2451,12 @@ static inline long long int arith_add(long long int a, long long int b)
 	 * +------+----------+----------+
 	 */
 	if ((a ^ b) >= 0) {
-		/* signs are differents. */
+		/* signs are same. */
 		if (a < 0) {
 			if (LLONG_MIN - a > b)
 				return LLONG_MIN;
 		}
-		if (LLONG_MAX - a < b)
+		else if (LLONG_MAX - a < b)
 			return LLONG_MAX;
 	}
 	return a + b;
diff --git a/src/server.c b/src/server.c
index bef825d..5f1510f 100644
--- a/src/server.c
+++ b/src/server.c
@@ -1832,6 +1832,7 @@ void srv_settings_cpy(struct server *srv, const struct server *src, int srv_tmpl
 	if (srv_tmpl)
 		srv->srvrq = src->srvrq;
 
+	srv->netns                    = src->netns;
 	srv->check.via_socks4         = src->check.via_socks4;
 	srv->socks4_addr              = src->socks4_addr;
 }
@@ -3132,7 +3133,7 @@ static void srv_update_state(struct server *srv, int version, char **params)
 					srv_adm_set_drain(srv);
 			}
 
-			srv->last_change = date.tv_sec - srv_last_time_change;
+			srv->last_change = now.tv_sec - srv_last_time_change;
 			srv->check.status = srv_check_status;
 			srv->check.result = srv_check_result;
 
@@ -4982,6 +4983,7 @@ static void srv_update_status(struct server *s)
 	struct proxy *px = s->proxy;
 	int prev_srv_count = s->proxy->srv_bck + s->proxy->srv_act;
 	int srv_was_stopping = (s->cur_state == SRV_ST_STOPPING) || (s->cur_admin & SRV_ADMF_DRAIN);
+	enum srv_state srv_prev_state = s->cur_state;
 	int log_level;
 	struct buffer *tmptrash = NULL;
 
@@ -4996,7 +4998,6 @@ static void srv_update_status(struct server *s)
 		s->next_admin = s->cur_admin;
 
 		if ((s->cur_state != SRV_ST_STOPPED) && (s->next_state == SRV_ST_STOPPED)) {
-			s->last_change = now.tv_sec;
 			if (s->proxy->lbprm.set_server_status_down)
 				s->proxy->lbprm.set_server_status_down(s);
 
@@ -5027,13 +5028,9 @@ static void srv_update_status(struct server *s)
 				free_trash_chunk(tmptrash);
 				tmptrash = NULL;
 			}
-			if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0)
-				set_backend_down(s->proxy);
-
 			s->counters.down_trans++;
 		}
 		else if ((s->cur_state != SRV_ST_STOPPING) && (s->next_state == SRV_ST_STOPPING)) {
-			s->last_change = now.tv_sec;
 			if (s->proxy->lbprm.set_server_status_down)
 				s->proxy->lbprm.set_server_status_down(s);
 
@@ -5057,22 +5054,10 @@ static void srv_update_status(struct server *s)
 				free_trash_chunk(tmptrash);
 				tmptrash = NULL;
 			}
-
-			if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0)
-				set_backend_down(s->proxy);
 		}
 		else if (((s->cur_state != SRV_ST_RUNNING) && (s->next_state == SRV_ST_RUNNING))
 			 || ((s->cur_state != SRV_ST_STARTING) && (s->next_state == SRV_ST_STARTING))) {
-			if (s->proxy->srv_bck == 0 && s->proxy->srv_act == 0) {
-				if (s->proxy->last_change < now.tv_sec)		// ignore negative times
-					s->proxy->down_time += now.tv_sec - s->proxy->last_change;
-				s->proxy->last_change = now.tv_sec;
-			}
-
-			if (s->cur_state == SRV_ST_STOPPED && s->last_change < now.tv_sec)	// ignore negative times
-				s->down_time += now.tv_sec - s->last_change;
 
-			s->last_change = now.tv_sec;
 			if (s->next_state == SRV_ST_STARTING && s->warmup)
 				task_schedule(s->warmup, tick_add(now_ms, MS_TO_TICKS(MAX(1000, s->slowstart / 20))));
 
@@ -5118,9 +5103,6 @@ static void srv_update_status(struct server *s)
 				free_trash_chunk(tmptrash);
 				tmptrash = NULL;
 			}
-
-			if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0)
-				set_backend_down(s->proxy);
 		}
 		else if (s->cur_eweight != s->next_eweight) {
 			/* now propagate the status change to any LB algorithms */
@@ -5134,9 +5116,6 @@ static void srv_update_status(struct server *s)
 				if (px->lbprm.set_server_status_down)
 					px->lbprm.set_server_status_down(s);
 			}
-
-			if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0)
-				set_backend_down(s->proxy);
 		}
 
 		s->next_admin = next_admin;
@@ -5174,13 +5153,9 @@ static void srv_update_status(struct server *s)
 				free_trash_chunk(tmptrash);
 				tmptrash = NULL;
 			}
-			/* commit new admin status */
-
-			s->cur_admin = s->next_admin;
 		}
 		else {	/* server was still running */
 			check->health = 0; /* failure */
-			s->last_change = now.tv_sec;
 
 			s->next_state = SRV_ST_STOPPED;
 			if (s->proxy->lbprm.set_server_status_down)
@@ -5213,9 +5188,6 @@ static void srv_update_status(struct server *s)
 				free_trash_chunk(tmptrash);
 				tmptrash = NULL;
 			}
-			if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0)
-				set_backend_down(s->proxy);
-
 			s->counters.down_trans++;
 		}
 	}
@@ -5235,7 +5207,6 @@ static void srv_update_status(struct server *s)
 		 * that the server might still be in drain mode, which is naturally dealt
 		 * with by the lower level functions.
 		 */
-
 		if (s->check.state & CHK_ST_ENABLED) {
 			s->check.state &= ~CHK_ST_PAUSED;
 			check->health = check->rise; /* start OK but check immediately */
@@ -5248,7 +5219,6 @@ static void srv_update_status(struct server *s)
 				s->next_state = SRV_ST_STOPPING;
 			}
 			else {
-				s->last_change = now.tv_sec;
 				s->next_state = SRV_ST_STARTING;
 				if (s->slowstart > 0) {
 					if (s->warmup)
@@ -5306,11 +5276,6 @@ static void srv_update_status(struct server *s)
 				px->lbprm.set_server_status_down(s);
 		}
 
-		if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0)
-			set_backend_down(s->proxy);
-		else if (!prev_srv_count && (s->proxy->srv_bck || s->proxy->srv_act))
-			s->proxy->last_change = now.tv_sec;
-
 		/* If the server is set with "on-marked-up shutdown-backup-sessions",
 		 * and it's not a backup server and its effective weight is > 0,
 		 * then it can accept new connections, so we shut down all streams
@@ -5380,15 +5345,12 @@ static void srv_update_status(struct server *s)
 			}
 		}
 		/* don't report anything when leaving drain mode and remaining in maintenance */
-
-		s->cur_admin = s->next_admin;
 	}
 
 	if (!(s->next_admin & SRV_ADMF_MAINT)) {
 		if (!(s->cur_admin & SRV_ADMF_DRAIN) && (s->next_admin & SRV_ADMF_DRAIN)) {
 			/* drain state is applied only if not yet in maint */
 
-			s->last_change = now.tv_sec;
 			if (px->lbprm.set_server_status_down)
 				px->lbprm.set_server_status_down(s);
 
@@ -5416,26 +5378,14 @@ static void srv_update_status(struct server *s)
 				free_trash_chunk(tmptrash);
 				tmptrash = NULL;
 			}
-
-			if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0)
-				set_backend_down(s->proxy);
 		}
 		else if ((s->cur_admin & SRV_ADMF_DRAIN) && !(s->next_admin & SRV_ADMF_DRAIN)) {
 			/* OK completely leaving drain mode */
-			if (s->proxy->srv_bck == 0 && s->proxy->srv_act == 0) {
-				if (s->proxy->last_change < now.tv_sec)         // ignore negative times
-					s->proxy->down_time += now.tv_sec - s->proxy->last_change;
-				s->proxy->last_change = now.tv_sec;
-			}
-
-			if (s->last_change < now.tv_sec)                        // ignore negative times
-				s->down_time += now.tv_sec - s->last_change;
-			s->last_change = now.tv_sec;
 			server_recalc_eweight(s, 0);
 
 			tmptrash = alloc_trash_chunk();
 			if (tmptrash) {
-				if (!(s->next_admin & SRV_ADMF_FDRAIN)) {
+				if (s->cur_admin & SRV_ADMF_FDRAIN) {
 					chunk_printf(tmptrash,
 						     "%sServer %s/%s is %s (leaving forced drain)",
 						     s->flags & SRV_F_BACKUP ? "Backup " : "",
@@ -5499,15 +5449,38 @@ static void srv_update_status(struct server *s)
 				free_trash_chunk(tmptrash);
 				tmptrash = NULL;
 			}
-
-			/* commit new admin status */
-
-			s->cur_admin = s->next_admin;
 		}
 	}
 
 	/* Re-set log strings to empty */
 	*s->adm_st_chg_cause = 0;
+
+	/* explicitly commit state changes (even if it was already applied implicitly
+	 * by some lb state change function), so we don't miss anything
+	 */
+	srv_lb_commit_status(s);
+
+	/* check if server stats must be updated due the the server state change */
+	if (srv_prev_state != s->cur_state) {
+		if (srv_prev_state == SRV_ST_STOPPED) {
+			/* server was down and no longer is */
+			if (s->last_change < now.tv_sec)                        // ignore negative times
+				s->down_time += now.tv_sec - s->last_change;
+		}
+		s->last_change = now.tv_sec;
+	}
+
+	/* check if backend stats must be updated due to the server state change */
+	if (prev_srv_count && s->proxy->srv_bck == 0 && s->proxy->srv_act == 0)
+		set_backend_down(s->proxy); /* backend going down */
+	else if (!prev_srv_count && (s->proxy->srv_bck || s->proxy->srv_act)) {
+		/* backend was down and is back up again:
+		 * no helper function, updating last_change and backend downtime stats
+		 */
+		if (s->proxy->last_change < now.tv_sec)         // ignore negative times
+			s->proxy->down_time += now.tv_sec - s->proxy->last_change;
+		s->proxy->last_change = now.tv_sec;
+	}
 }
 
 struct task *srv_cleanup_toremove_connections(struct task *task, void *context, unsigned short state)
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index b33580f..ac1109f 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1162,7 +1162,7 @@ int ssl_sock_ocsp_stapling_cbk(SSL *ssl, void *arg)
 	if (!ocsp ||
 	    !ocsp->response.area ||
 	    !ocsp->response.data ||
-	    (ocsp->expire < now.tv_sec))
+	    (ocsp->expire < date.tv_sec))
 		return SSL_TLSEXT_ERR_NOACK;
 
 	ssl_buf = OPENSSL_malloc(ocsp->response.data);
diff --git a/src/stream_interface.c b/src/stream_interface.c
index 1adecf3..09e62d9 100644
--- a/src/stream_interface.c
+++ b/src/stream_interface.c
@@ -955,6 +955,22 @@ void si_sync_send(struct stream_interface *si)
 		return;
 
 	si_cs_send(cs);
+
+	if (likely(oc->flags & CF_WRITE_ACTIVITY)) {
+		struct channel *ic = si_ic(si);
+
+		if (tick_isset(ic->rex) && !(si->flags & SI_FL_INDEP_STR)) {
+			/* Note: to prevent the client from expiring read timeouts
+			 * during writes, we refresh it. We only do this if the
+			 * interface is not configured for "independent streams",
+			 * because for some applications it's better not to do this,
+			 * for instance when continuously exchanging small amounts
+			 * of data which can full the socket buffers long before a
+			 * write timeout is detected.
+			 */
+			ic->rex = tick_add_ifset(now_ms, ic->rto);
+		}
+	}
 }
 
 /* Updates at once the channel flags, and timers of both stream interfaces of a
diff --git a/src/tcp_rules.c b/src/tcp_rules.c
index 229c102..2ac0234 100644
--- a/src/tcp_rules.c
+++ b/src/tcp_rules.c
@@ -123,7 +123,7 @@ int tcp_inspect_request(struct stream *s, struct channel *req, int an_bit)
 	 * - if one rule returns KO, then return KO
 	 */
 
-	if ((req->flags & (CF_EOI|CF_SHUTR|CF_READ_ERROR)) || channel_full(req, global.tune.maxrewrite) ||
+	if ((req->flags & (CF_SHUTR|CF_READ_ERROR)) || channel_full(req, global.tune.maxrewrite) ||
 	    si_rx_blocked_room(chn_prod(req)) ||
 	    !s->be->tcp_req.inspect_delay || tick_is_expired(req->analyse_exp, now_ms))
 		partial = SMP_OPT_FINAL;
@@ -301,7 +301,7 @@ int tcp_inspect_response(struct stream *s, struct channel *rep, int an_bit)
 	 * - if one rule returns OK, then return OK
 	 * - if one rule returns KO, then return KO
 	 */
-	if ((rep->flags & (CF_EOI|CF_SHUTR|CF_READ_ERROR)) || channel_full(rep, global.tune.maxrewrite) ||
+	if ((rep->flags & (CF_SHUTR|CF_READ_ERROR)) || channel_full(rep, global.tune.maxrewrite) ||
 	    si_rx_blocked_room(chn_prod(rep)) ||
 	    !s->be->tcp_rep.inspect_delay || tick_is_expired(rep->analyse_exp, now_ms))
 		partial = SMP_OPT_FINAL;
diff --git a/src/time.c b/src/time.c
index c2bdbdc..7d89008 100644
--- a/src/time.c
+++ b/src/time.c
@@ -26,7 +26,8 @@ THREAD_LOCAL unsigned int   samp_time;       /* total elapsed time over current 
 THREAD_LOCAL unsigned int   idle_time;       /* total idle time over current sample */
 THREAD_LOCAL struct timeval now;             /* internal date is a monotonic function of real clock */
 THREAD_LOCAL struct timeval date;            /* the real current date */
-struct timeval start_date;      /* the process's start date */
+struct timeval start_date;                   /* the process's start date */
+struct timeval ready_date;                   /* date when the process was considered ready */
 THREAD_LOCAL struct timeval before_poll;     /* system date before calling poll() */
 THREAD_LOCAL struct timeval after_poll;      /* system date after leaving poll() */