Merge ~lucaskanashiro/ubuntu/+source/haproxy:kinetic-mre into ubuntu/+source/haproxy:ubuntu/kinetic-devel

[Lucas Kanashiro]

MRE update to version 2.4.22 (LP: #2012557). Some patches were removed (applied by upstream) and others refreshed.

the proposed package is available in this PPA:

https://launchpad.net/~lucaskanashiro/+archive/ubuntu/ha-stack

autopkgtest summary:

autopkgtest [18:52:16]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
proxy-localhost PASS
proxy-ssl-termination PASS
proxy-ssl-pass-through PASS

[Andreas Hasenack (ahasenack)]

This needs rebasing, security released 2.4.18-1ubuntu1.3

[Lucas Kanashiro (lucaskanashiro)]

Thanks for checking Andreas, the rebase is done.

[Andreas Hasenack (ahasenack)]

review: Needs Information

[Lucas Kanashiro (lucaskanashiro)]

Version string fixed.

[Andreas Hasenack (ahasenack)]

haha, gotta love version strings :)

+1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: lucaskanashiro, ahasenack
Uploaders: lucaskanashiro, ahasenack
MP auto-approved

review: Approve

[Lucas Kanashiro (lucaskanashiro)]

Thanks Andreas. Package uploaded:

Uploading haproxy_2.4.22-0ubuntu0.22.10.1.dsc
Uploading haproxy_2.4.22.orig.tar.gz
Uploading haproxy_2.4.22-0ubuntu0.22.10.1.debian.tar.xz
Uploading haproxy_2.4.22-0ubuntu0.22.10.1_source.changes

diff --git a/.cirrus.yml b/.cirrus.yml
index e754f83..deace96 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -1,7 +1,7 @@
 FreeBSD_task:
   freebsd_instance:
     matrix:
-      image_family: freebsd-13-0
+      image_family: freebsd-13-1
   only_if: $CIRRUS_BRANCH =~ 'master|next'
   install_script:
     - pkg update -f && pkg upgrade -y && pkg install -y openssl git gmake lua53 socat pcre
diff --git a/.github/matrix.py b/.github/matrix.py
index 264a3d2..abd6caf 100644
--- a/.github/matrix.py
+++ b/.github/matrix.py
@@ -10,6 +10,7 @@ import json
 import sys
 import urllib.request
 import re
+from os import environ
 
 if len(sys.argv) == 2:
     build_type = sys.argv[1]
@@ -40,7 +41,7 @@ def determine_latest_openssl(ssl):
         if "openssl-" in name:
             if name > latest_tag:
                latest_tag = name
-    return "OPENSSL={}".format(latest_tag[8:])
+    return "OPENSSL_VERSION={}".format(latest_tag[8:])
 
 def determine_latest_libressl(ssl):
     libressl_download_list = urllib.request.urlopen("http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/")
@@ -48,7 +49,7 @@ def determine_latest_libressl(ssl):
         decoded_line = line.decode("utf-8")
         if "libressl-" in decoded_line and ".tar.gz.asc" in decoded_line:
              l = re.split("libressl-|.tar.gz.asc", decoded_line)[1]
-    return "LIBRESSL={}".format(l)
+    return "LIBRESSL_VERSION={}".format(l)
 
 def clean_compression(compression):
     return compression.replace("USE_", "").lower()
@@ -67,7 +68,7 @@ matrix = []
 
 # Ubuntu
 
-os = "ubuntu-latest"
+os = "ubuntu-20.04"
 TARGET = "linux-glibc"
 for CC in ["gcc", "clang"]:
     matrix.append(
@@ -125,8 +126,8 @@ for CC in ["gcc", "clang"]:
     for ssl in [
         "stock",
         "OPENSSL_VERSION=1.0.2u",
-        "OPENSSL_VERSION=latest",
-        "LIBRESSL_VERSION=latest",
+        "OPENSSL_VERSION=3.0.2",
+        "LIBRESSL_VERSION=3.5.3",
 #        "BORINGSSL=yes",
     ]:
         flags = ["USE_OPENSSL=1"]
@@ -155,7 +156,7 @@ for CC in ["gcc", "clang"]:
 
 # ASAN
 
-os = "ubuntu-latest"
+os = "ubuntu-20.04"
 TARGET = "linux-glibc"
 for CC in ["gcc","clang"]:
     matrix.append(
@@ -207,4 +208,6 @@ for CC in ["clang"]:
 
 print(json.dumps(matrix, indent=4, sort_keys=True))
 
-print("::set-output name=matrix::{}".format(json.dumps({"include": matrix})))
+if environ.get('GITHUB_OUTPUT') is not None:
+    with open(environ.get('GITHUB_OUTPUT'), 'a') as f:
+        print("matrix={}".format(json.dumps({"include": matrix})), file=f)
diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
index 66bc154..a11f0fa 100644
--- a/.github/workflows/compliance.yml
+++ b/.github/workflows/compliance.yml
@@ -24,7 +24,7 @@ jobs:
         curl -fsSL https://github.com/summerwind/h2spec/releases/download/${H2SPEC_VERSION}/h2spec_linux_amd64.tar.gz -o h2spec.tar.gz
         tar xvf h2spec.tar.gz
         sudo install -m755 h2spec /usr/local/bin/h2spec
-        echo "::set-output name=version::${H2SPEC_VERSION}"
+        echo "version=${H2SPEC_VERSION}" >> $GITHUB_OUTPUT
     - name: Compile HAProxy with ${{ matrix.CC }}
       run: |
         make -j$(nproc) all \
@@ -47,7 +47,7 @@ jobs:
         fi
         echo "::endgroup::"
         haproxy -vv
-        echo "::set-output name=version::$(haproxy -v |awk 'NR==1{print $3}')"
+        echo "version=$(haproxy -v |awk 'NR==1{print $3}')" >> $GITHUB_OUTPUT
     - name: Launch HAProxy ${{ steps.show-version.outputs.version }}
       run: haproxy -f .github/h2spec.config -D
     - name: Run h2spec ${{ steps.install-h2spec.outputs.version }}
diff --git a/.github/workflows/cross-zoo.yml b/.github/workflows/cross-zoo.yml
 new file mode 100644
index 0000000..e2a5816
--- /dev/null
+++ b/.github/workflows/cross-zoo.yml
@@ -0,0 +1,110 @@
+#
+# this is naamed "zoo" after OpenSSL "cross zoo pipeline"
+#
+name: Cross Compile
+
+on:
+  schedule:
+    - cron: "0 0 21 * *"
+
+permissions:
+  contents: read
+
+jobs:
+  cross-compilation:
+    strategy:
+      matrix:
+        platform: [
+          {
+            arch: aarch64-linux-gnu,
+            libs: libc6-dev-arm64-cross,
+            target: linux-aarch64
+          }, {
+            arch: alpha-linux-gnu,
+            libs: libc6.1-dev-alpha-cross,
+            target: linux-alpha-gcc
+          }, {
+            arch: arm-linux-gnueabi,
+            libs: libc6-dev-armel-cross,
+            target: linux-armv4
+          }, {
+            arch: arm-linux-gnueabihf,
+            libs: libc6-dev-armhf-cross,
+            target: linux-armv4
+          }, {
+            arch: hppa-linux-gnu,
+            libs: libc6-dev-hppa-cross,
+            target: -static linux-generic32
+          }, {
+            arch: m68k-linux-gnu,
+            libs: libc6-dev-m68k-cross,
+            target: -static -m68040 linux-latomic
+          }, {
+            arch: mips-linux-gnu,
+            libs: libc6-dev-mips-cross,
+            target: -static linux-mips32
+          }, {
+            arch: mips64-linux-gnuabi64,
+            libs: libc6-dev-mips64-cross,
+            target: -static linux64-mips64
+          }, {
+            arch: mipsel-linux-gnu,
+            libs: libc6-dev-mipsel-cross,
+            target: linux-mips32
+          }, {
+            arch: powerpc64le-linux-gnu,
+            libs: libc6-dev-ppc64el-cross,
+            target: linux-ppc64le
+          }, {
+            arch: riscv64-linux-gnu,
+            libs: libc6-dev-riscv64-cross,
+            target: linux64-riscv64
+          }, {
+            arch: s390x-linux-gnu,
+            libs: libc6-dev-s390x-cross,
+            target: linux64-s390x
+          }, {
+            arch: sh4-linux-gnu,
+            libs: libc6-dev-sh4-cross,
+            target: no-async linux-latomic
+          }, {
+            arch: hppa-linux-gnu,
+            libs: libc6-dev-hppa-cross,
+            target: linux-generic32,
+          }, {
+            arch: m68k-linux-gnu,
+            libs: libc6-dev-m68k-cross,
+            target: -mcfv4e linux-latomic
+          }, {
+            arch: mips-linux-gnu,
+            libs: libc6-dev-mips-cross,
+            target: linux-mips32
+          }, {
+            arch: mips64-linux-gnuabi64,
+            libs: libc6-dev-mips64-cross,
+            target: linux64-mips64
+          }, {
+            arch: sparc64-linux-gnu,
+            libs: libc6-dev-sparc64-cross,
+            target: linux64-sparcv9
+          }
+        ]
+    runs-on: ubuntu-latest
+    steps:
+    - name: install packages
+      run: |
+        sudo apt-get update
+        sudo apt-get -yq --force-yes install \
+            gcc-${{ matrix.platform.arch }} \
+            ${{ matrix.platform.libs }}
+    - uses: actions/checkout@v2
+
+
+    - name: install quictls
+      run: |
+        QUICTLS_EXTRA_ARGS="--cross-compile-prefix=${{ matrix.platform.arch }}- ${{ matrix.platform.target }}" QUICTLS=yes scripts/build-ssl.sh
+
+    - name: Build
+      run: |
+        make ERR=1 CC=${{ matrix.platform.arch }}-gcc TARGET=linux-glibc USE_LIBCRYPT= USE_OPENSSL=1 USE_QUIC=1 USE_PROMEX=1 SSL_LIB=${HOME}/opt/lib SSL_INC=${HOME}/opt/include ADDLIB="-Wl,-rpath,${HOME}/opt/lib"
+
diff --git a/.github/workflows/vtest.yml b/.github/workflows/vtest.yml
index ea39662..781a2b3 100644
--- a/.github/workflows/vtest.yml
+++ b/.github/workflows/vtest.yml
@@ -50,7 +50,7 @@ jobs:
     - name: Generate cache key
       id: generate-cache-key
       run: |
-        echo "::set-output name=key::$(echo ${{ matrix.name }} | sha256sum | awk '{print $1}')"
+        echo "key=$(echo ${{ matrix.name }} | sha256sum | awk '{print $1}')" >> $GITHUB_OUTPUT
 
     - name: Cache SSL libs
       if: ${{ matrix.ssl && matrix.ssl != 'stock' && matrix.ssl != 'BORINGSSL=yes' && matrix.ssl != 'QUICTLS=yes' }}
@@ -114,6 +114,9 @@ jobs:
       run: make -C addons/wurfl/dummy
     - name: Compile HAProxy with ${{ matrix.CC }}
       run: |
+        echo "::group::Show compiler's version"
+        echo | ${{ matrix.CC }} -v
+        echo "::endgroup::"
         echo "::group::Show platform specific defines"
         echo | ${{ matrix.CC }} -dM -xc -E -
         echo "::endgroup::"
@@ -138,7 +141,7 @@ jobs:
         fi
         echo "::endgroup::"
         haproxy -vv
-        echo "::set-output name=version::$(haproxy -v |awk 'NR==1{print $3}')"
+        echo "version=$(haproxy -v |awk 'NR==1{print $3}')" >> $GITHUB_OUTPUT
     - name: Install problem matcher for VTest
       # This allows one to more easily see which tests fail.
       run: echo "::add-matcher::.github/vtest.json"
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 58283ff..022c7f6 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -56,9 +56,10 @@ jobs:
           TARGET=${{ matrix.TARGET }} \
           CC=${{ matrix.CC }} \
           DEBUG="-DDEBUG_STRICT -DDEBUG_MEMORY_POOLS -DDEBUG_POOL_INTEGRITY" \
+          DEBUG_CFLAGS="-g -Wno-deprecated-declarations" \
           ${{ join(matrix.FLAGS, ' ') }}
     - name: Show HAProxy version
       id: show-version
       run: |
         ./haproxy -vv
-        echo "::set-output name=version::$(./haproxy -v |awk 'NR==1{print $3}')"
+        echo "version=$(./haproxy -v |awk 'NR==1{print $3}')" >> $GITHUB_OUTPUT
diff --git a/CHANGELOG b/CHANGELOG
index f9eec74..d59309f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,196 @@
 ChangeLog :
 ===========
 
+2023/02/14 : 2.4.22
+    - BUG/MINOR: fcgi-app: prevent 'use-fcgi-app' in default section
+    - BUG/MEDIUM: ssl: wrong eviction from the session cache tree
+    - BUG/MINOR: ssl/crt-list: warn when a line is malformated
+    - BUG/MEDIUM: stick-table: do not leave entries in end of window during purge
+    - BUG/MEDIUM: cache: use the correct time reference when comparing dates
+    - DOC: config: fix option spop-check proxy compatibility
+    - DOC: config: 'http-send-name-header' option may be used in default section
+    - DOC: proxy-protocol: fix wrong byte in provided example
+    - BUG/MEDIUM: stconn: Schedule a shutw on shutr if data must be sent first
+    - CI: github: don't warn on deprecated openssl functions on windows
+    - BUG/CRITICAL: http: properly reject empty http header field names
+
+2023/01/27 : 2.4.21
+    - BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action
+    - BUG/MEDIIM: stconn: Flush output data before forwarding close to write side
+    - CI: github: change "ubuntu-latest" to "ubuntu-20.04"
+    - BUILD: peers: peers-t.h depends on stick-table-t.h
+    - BUG/MINOR: resolvers: Don't wait periodic resolution on healthcheck failure
+    - BUG/MEDIUM: ssl: Verify error codes can exceed 63
+    - BUG/MINOR: ssl: Fix potential overflow
+    - BUG/MEDIUM: mworker: fix segv in early failure of mworker mode with peers
+    - BUG/MINOR: promex: create haproxy_backend_agg_server_status
+    - MINOR: promex: introduce haproxy_backend_agg_check_status
+    - DOC: promex: Add missing backend metrics
+    - BUG/MAJOR: fcgi: Fix uninitialized reserved bytes
+    - REGTESTS: fix the race conditions in iff.vtc
+    - REGTESTS: startup: check maxconn computation
+    - BUG/MEDIUM: resolvers: Use tick_first() to update the resolvers task timeout
+    - LICENSE: wurfl: clarify the dummy library license.
+    - BUG/MINOR: ssl: Fix memory leak of find_chain in ssl_sock_load_cert_chain
+    - BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set
+    - BUG/MINOR: pool/stats: Use ullong to report total pool usage in bytes in stats
+    - BUILD: makefile: build the features list dynamically
+    - BUILD: makefile: sort the features list
+    - BUG/MINOR: http-fetch: Only fill txn status during prefetch if not already set
+    - BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned
+    - REGTEST: fix the race conditions in json_query.vtc
+    - REGTEST: fix the race conditions in digest.vtc
+    - REGTEST: fix the race conditions in hmac.vtc
+    - BUG/MINOR: http: Memory leak of http redirect rules' format string
+    - CLEANUP: htx: fix a typo in an error message of http_str_to_htx
+    - BUG/MINOR: h1-htx: Remove flags about protocol upgrade on non-101 responses
+    - BUG/MINOR: resolvers: Wait the resolution execution for a do_resolv action
+    - BUG/MINOR: promex: Don't forget to consume the request on error
+    - BUG/MINOR: http-ana: Report SF_FINST_R flag on error waiting the request body
+    - BUG/MINOR: http-fetch: Don't block HTTP sample fetch eval in HTTP_MSG_ERROR state
+    - BUG/MINOR: http-ana: make set-status also update txn->status
+    - BUG/MINOR: listeners: fix suspend/resume of inherited FDs
+    - DOC: config: fix wrong section number for "protocol prefixes"
+    - DOC: config: fix aliases for protocol prefixes "udp4@" and "udp6@"
+    - BUG/MINOR: mux-fcgi: Correctly set pathinfo
+    - DOC: config: fix "Address formats" chapter syntax
+    - BUG/MINOR: listener: close tiny race between resume_listener() and stopping
+    - BUG/MINOR: mux-h2: add missing traces on failed headers decoding
+    - BUILD: hpack: include global.h for the trash that is needed in debug mode
+    - BUG/MINOR: sink: free the forwarding task on exit
+
+2022/12/09 : 2.4.20
+    - BUG/MINOR: checks: update pgsql regex on auth packet
+    - DOC: config: Fix pgsql-check documentation to make user param mandatory
+    - BUG/MEDIUM: lua: Don't crash in hlua_lua2arg_check on failure
+    - BUG/MEDIUM: lua: handle stick table implicit arguments right.
+    - BUILD: h1: silence an initiialized warning with gcc-4.7 and -Os
+    - BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth()
+    - BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os
+    - BUG/MINOR: mux-h1: Account consumed output data on synchronous connection error
+    - MINOR: smtpchk: Update expect rule to fully match replies to EHLO commands
+    - BUG/MINOR: smtpchk: SMTP Service check should gracefully close SMTP transaction
+    - BUG/MINOR: backend: only enforce turn-around state when not redispatching
+    - DOC: configuration: missing 'if' in tcp-request content example
+    - BUG/MAJOR: stick-tables: do not try to index a server name for applets
+    - BUG/MINOR: server: make sure "show servers state" hides private bits
+    - CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in matrix.py
+    - CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in workflow definition
+    - BUG/MINOR: log: Preserve message facility when the log target is a ring buffer
+    - BUG/MINOR: ring: Properly parse connect timeout
+    - BUG/MEDIUM: compression: handle rewrite errors when updating response headers
+    - BUG/MINOR: sink: Only use backend capability for the sink proxies
+    - BUG/MINOR: sink: Set default connect/server timeout for implicit ring buffers
+    - CI: SSL: use proper version generating when "latest" semantic is used
+    - CI: SSL: temporarily stick to LibreSSL=3.5.3
+    - BUG/MINOR: stick-table: Use server_id instead of std_t_sint in process_store_rules()
+    - DOC: management: add forgotten "show startup-logs"
+    - BUG/MAJOR: stick-table: don't process store-response rules for applets
+    - BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task
+    - BUG/MINOR: log: fixing bug in tcp syslog_io_handler Octet-Counting
+    - CI: add monthly gcc cross compile jobs
+    - BUG/MINOR: ssl: Memory leak of AUTHORITY_KEYID struct when loading issuer
+    - BUG/MINOR: ssl: ocsp structure not freed properly in case of error
+    - CI: switch to the "latest" LibreSSL
+    - CI: emit the compiler's version in the build reports
+    - BUG/MEDIUM: wdt/clock: properly handle early task hangs
+    - BUG/MINOR: http-htx: Fix error handling during parsing http replies
+    - BUG/MINOR: resolvers: Set port before IP address when processing SRV records
+    - BUG/MINOR: mux-fcgi: Be sure to send empty STDING record in case of zero-copy
+    - BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once
+    - BUG/MINOR: mux-h1: Do not send a last null chunk on body-less answers
+    - REG-TESTS: cache: Remove T-E header for 304-Not-Modified responses
+    - DOC: config: fix alphabetical ordering of global section
+    - BUG/MEDIUM: ring: fix creation of server in uninitialized ring
+    - BUG/MINOR: pool/cli: use ullong to report total pool usage in bytes
+    - BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task
+    - BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists
+    - BUG/MINOR: ssl: don't initialize the keylog callback when not required
+    - BUG/MEDIUM: peers: messages about unkown tables not correctly ignored
+    - BUILD: peers: Remove unused variables
+    - BUG/MINOR: server/idle: at least use atomic stores when updating max_used_conns
+    - BUILD: listener: fix build warning on global_listener_rwlock without threads
+    - BUG/MINOR: cfgparse-listen: fix ebpt_next_dup pointer dereference on proxy "from" inheritance
+    - BUG/MINOR: log: fix parse_log_message rfc5424 size check
+    - BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action
+    - BUILD: http-htx: Silent build error about a possible NULL start-line
+    - BUG/MINOR: mux-h1: Fix handling of 408-Request-Time-Out
+    - Revert "BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action"
+    - DOC: config: provide some configuration hints for "http-reuse"
+    - DOC: config: clarify the fact that SNI should not be used in HTTP scenarios
+    - DOC: config: mention that a single monitor-uri rule is supported
+    - DOC: config: explain how default matching method for ACL works
+    - DOC: config: clarify the fact that "retries" is not just for connections
+    - DOC: config: clarify the -m dir and -m dom pattern matching methods
+    - SCRIPTS: announce-release: add a link to the data plane API
+    - Revert "CI: switch to the "latest" LibreSSL"
+    - Revert "CI: determine actual OpenSSL version dynamically"
+
+2022/09/28 : 2.4.19
+    - BUG/MEDIUM: mworker: use default maxconn in wait mode
+    - MINOR: http: Add function to get port part of a host
+    - MINOR: http: Add function to detect default port
+    - BUG/MEDIUM: h1: Improve authority validation for CONNCET request
+    - MINOR: http-htx: Use new HTTP functions for the scheme based normalization
+    - MINOR: ebtree: add ebmb_lookup_shorter() to pursue lookups
+    - BUG/MEDIUM: pattern: only visit equivalent nodes when skipping versions
+    - MINOR: peers: Use a dedicated reconnect timeout when stopping the local peer
+    - BUG/MEDIUM: peers: limit reconnect attempts of the old process on reload
+    - BUG/MINOR: peers: Use right channel flag to consider the peer as connected
+    - BUG/MEDIUM: dns: Properly initialize new DNS session
+    - MINOR: server: Constify source server to copy its settings
+    - REORG: server: Export srv_settings_cpy() function
+    - BUG/MEDIUM: proxy: Perform a custom copy for default server settings
+    - BUG/MINOR: ring/cli: fix a race condition between the writer and the reader
+    - BUG/MINOR: sink: fix a race condition between the writer and the reader
+    - BUILD: cfgparse: always defined _GNU_SOURCE for sched.h and crypt.h
+    - BUG/MEDIUM: poller: use fd_delete() to release the poller pipes
+    - BUG/MEDIUM: task: relax one thread consistency check in task_unlink_wq()
+    - BUILD: debug: silence warning on gcc-5
+    - BUG/MEDIUM: ring: fix too lax 'size' parser
+    - BUILD: http: silence an uninitialized warning affecting gcc-5
+    - BUG/MEDIUM: http-ana: fix crash or wrong header deletion by http-restrict-req-hdr-names
+    - BUG/MEDIUM: mux-h2: do not fiddle with ->dsi to indicate demux is idle
+    - BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized
+    - BUG/MAJOR: mworker: fix infinite loop on master with no proxies.
+    - BUG/MINOR: resolvers: return the correct value in resolvers_finalize_config()
+    - BUG/MINOR: tcpcheck: Disable QUICKACK only if data should be sent after connect
+    - REGTESTS: Fix prometheus script to perform HTTP health-checks
+    - DOC: configuration: do-resolve doesn't work with a port in the string
+    - BUG/MEDIUM: spoe: Properly update streams waiting for a ACK in async mode
+    - BUG/MEDIUM: peers: Add connect and server timeut to peers proxy
+    - BUG/MEDIUM: peers: Don't use resync timer when local resync is in progress
+    - BUG/MEDIUM: peers: Don't start resync on reload if local peer is not up-to-date
+    - BUG/MINOR: hlua: Rely on CF_EOI to detect end of message in HTTP applets
+    - BUG/MINOR: tcpcheck: Disable QUICKACK for default tcp-check (with no rule)
+    - BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input
+    - REGTESTS: http_request_buffer: Add a barrier to not mix up log messages
+    - BUG/MEDIUM: mux-h1: always use RST to kill idle connections in pools
+    - BUG/MINOR: mux-h2: fix the "show fd" dest buffer for the subscriber
+    - BUG/MINOR: mux-h1: fix the "show fd" dest buffer for the subscriber
+    - BUG/MINOR: mux-fcgi: fix the "show fd" dest buffer for the subscriber
+    - BUG/MINOR: regex: Properly handle PCRE2 lib compiled without JIT support
+    - BUILD: makefile: enable crypt(3) for NetBSD
+    - BUG/MINOR: h1: Support headers case adjustment for TCP proxies
+    - BUG/MINOR: task: always reset a new tasklet's call date
+    - BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals
+    - BUG/MINOR: signals/poller: ensure wakeup from signals
+    - CI: cirrus-ci: bump FreeBSD image to 13-1
+    - BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK
+    - MINOR: listener: small API change
+    - BUG/MINOR: stats: fixing stat shows disabled frontend status as 'OPEN'
+    - REGTESTS: healthcheckmail: Relax matching on the healthcheck log message
+    - REGTESTS: log: test the log-forward feature
+    - BUG/MEDIUM: sink: bad init sequence on tcp sink from a ring.
+    - REGTESTS: ssl/log: test the log-forward with SSL
+    - DOC: fix TOC in starter guide for subsection 3.3.8. Statistics
+    - BUG/MEDIUM: captures: free() an error capture out of the proxy lock
+    - BUILD: fd: fix a build warning on the DWCAS
+    - SCRIPTS: announce-release: update some URLs to https
+    - BUG/MINOR: log: improper behavior when escaping log data
+    - REGTESTS: 4be_1srv_smtpchk_httpchk_layer47errors: Return valid SMTP replies
+    - BUG/MEDIUM: resolvers: Remove aborted resolutions from query_ids tree
+
 2022/07/27 : 2.4.18
     - CI: determine actual LibreSSL version dynamically
     - MEDIUM: http-ana: Add a proxy option to restrict chars in request header names
diff --git a/Makefile b/Makefile
index c0a6a27..40c2b10 100644
--- a/Makefile
+++ b/Makefile
@@ -423,8 +423,8 @@ endif
 # NetBSD 8 and above
 ifeq ($(TARGET),netbsd)
   set_target_defaults = $(call default_opts, \
-    USE_POLL USE_TPROXY USE_THREAD USE_KQUEUE USE_ACCEPT4 USE_CLOSEFROM   \
-    USE_GETADDRINFO)
+    USE_POLL USE_TPROXY USE_LIBCRYPT USE_THREAD USE_KQUEUE USE_ACCEPT4        \
+    USE_CLOSEFROM USE_GETADDRINFO)
 endif
 
 # AIX 5.1 only
@@ -524,7 +524,11 @@ ignore_implicit = $(if $(subst environment,,$(origin $(1))),         \
 # is used to report a list of all flags which were used to build this version.
 # Do not assign anything to it.
 BUILD_OPTIONS  := $(foreach opt,$(use_opts),$(call ignore_implicit,$(opt)))
-BUILD_FEATURES := $(foreach opt,$(patsubst USE_%,%,$(use_opts)),$(if $(USE_$(opt)),+$(opt),-$(opt)))
+
+# Make a list of all known features with +/- prepended depending on their
+# activation status. Must be a macro so that dynamically enabled ones are
+# evaluated with their current status.
+BUILD_FEATURES  = $(foreach opt,$(patsubst USE_%,%,$(sort $(use_opts))),$(if $(USE_$(opt)),+$(opt),-$(opt)))
 
 # All USE_* options have their equivalent macro defined in the code (some might
 # possibly be unused though)
diff --git a/SUBVERS b/SUBVERS
index 994ee02..f042fd0 100644
--- a/SUBVERS
+++ b/SUBVERS
@@ -1,2 +1,2 @@
--1d80f18
+-f8e3218
 
diff --git a/VERDATE b/VERDATE
index 6a4d254..d8a3372 100644
--- a/VERDATE
+++ b/VERDATE
@@ -1,2 +1,2 @@
-2022-07-27 15:10:44 +0200
-2022/07/27
[phone]:57:13 +0100
+2023/02/14
diff --git a/VERSION b/VERSION
index cc2ff5a..76cb51e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.4.18
+2.4.22
diff --git a/addons/promex/README b/addons/promex/README
index e41ebdc..4e29e23 100644
--- a/addons/promex/README
+++ b/addons/promex/README
@@ -286,6 +286,8 @@ See prometheus export for the description of each field.
 | haproxy_backend_max_total_time_seconds              |
 | haproxy_backend_internal_errors_total               |
 | haproxy_backend_uweight                             |
+| haproxy_backend_agg_server_status                   |
+| haproxy_backend_agg_check_status                    |
 +-----------------------------------------------------+
 
 * Server metrics
diff --git a/addons/promex/service-prometheus.c b/addons/promex/service-prometheus.c
index b267f98..d31b666 100644
--- a/addons/promex/service-prometheus.c
+++ b/addons/promex/service-prometheus.c
@@ -289,6 +289,8 @@ const struct promex_metric promex_st_metrics[ST_F_TOTAL_FIELDS] = {
 	[ST_F_NEED_CONN_EST]        = { .n = IST("need_connections_current"),         .type = PROMEX_MT_GAUGE,    .flags = (                                                                       PROMEX_FL_SRV_METRIC) },
 	[ST_F_UWEIGHT]              = { .n = IST("uweight"),                          .type = PROMEX_MT_GAUGE,    .flags = (                                               PROMEX_FL_BACK_METRIC | PROMEX_FL_SRV_METRIC) },
 	[ST_F_AGG_SRV_CHECK_STATUS] = { .n = IST("agg_server_check_status"),	      .type = PROMEX_MT_GAUGE,    .flags = (                                               PROMEX_FL_BACK_METRIC                       ) },
+	[ST_F_AGG_SRV_STATUS ]      = { .n = IST("agg_server_status"),	              .type = PROMEX_MT_GAUGE,    .flags = (                                               PROMEX_FL_BACK_METRIC                       ) },
+	[ST_F_AGG_CHECK_STATUS]     = { .n = IST("agg_check_status"),	              .type = PROMEX_MT_GAUGE,    .flags = (                                               PROMEX_FL_BACK_METRIC                       ) },
 };
 
 /* Description of overridden stats fields */
@@ -792,6 +794,7 @@ static int promex_dump_back_metrics(struct appctx *appctx, struct htx *htx)
 	double secs;
 	enum promex_back_state bkd_state;
 	enum promex_srv_state srv_state;
+	enum healthcheck_status srv_check_status;
 
 	for (;appctx->st2 < ST_F_TOTAL_FIELDS; appctx->st2++) {
 		if (!(promex_st_metrics[appctx->st2].flags & appctx->ctx.stats.flags))
@@ -800,6 +803,8 @@ static int promex_dump_back_metrics(struct appctx *appctx, struct htx *htx)
 		while (appctx->ctx.stats.obj1) {
 			struct promex_label labels[PROMEX_MAX_LABELS-1] = {};
 			unsigned int srv_state_count[PROMEX_SRV_STATE_COUNT] = { 0 };
+			unsigned int srv_check_count[HCHK_STATUS_SIZE] = { 0 };
+			const char *check_state;
 
 			px = appctx->ctx.stats.obj1;
 
@@ -814,7 +819,8 @@ static int promex_dump_back_metrics(struct appctx *appctx, struct htx *htx)
 				return -1;
 
 			switch (appctx->st2) {
-				case ST_F_AGG_SRV_CHECK_STATUS:
+				case ST_F_AGG_SRV_CHECK_STATUS: // DEPRECATED
+				case ST_F_AGG_SRV_STATUS:
 					if (!px->srv)
 						goto next_px;
 					sv = px->srv;
@@ -833,6 +839,28 @@ static int promex_dump_back_metrics(struct appctx *appctx, struct htx *htx)
 					}
 					appctx->ctx.stats.st_code = 0;
 					goto next_px;
+				case ST_F_AGG_CHECK_STATUS:
+					if (!px->srv)
+						goto next_px;
+					sv = px->srv;
+					while (sv) {
+						srv_check_status = sv->check.status;
+						srv_check_count[srv_check_status] += 1;
+						sv = sv->next;
+					}
+					for (; appctx->ctx.stats.st_code < HCHK_STATUS_SIZE; appctx->ctx.stats.st_code++) {
+						if (get_check_status_result(appctx->ctx.stats.st_code) < CHK_RES_FAILED)
+								continue;
+						val = mkf_u32(FO_STATUS, srv_check_count[appctx->ctx.stats.st_code]);
+						check_state = get_check_status_info(appctx->ctx.stats.st_code);
+						labels[1].name = ist("state");
+						labels[1].value = ist(check_state);
+						if (!promex_dump_metric(appctx, htx, prefix, &promex_st_metrics[appctx->st2],
+									&val, labels, &out, max))
+							goto full;
+					}
+					appctx->ctx.stats.st_code = 0;
+					goto next_px;
 				case ST_F_STATUS:
 					bkd_state = ((px->lbprm.tot_weight > 0 || !px->srv) ? 1 : 0);
 					for (; appctx->ctx.stats.st_code < PROMEX_BACK_STATE_COUNT; appctx->ctx.stats.st_code++) {
@@ -1547,6 +1575,7 @@ static void promex_appctx_handle_io(struct appctx *appctx)
 	res->flags |= CF_READ_NULL;
 	si_shutr(si);
 	si_shutw(si);
+	goto out;
 }
 
 struct applet promex_applet = {
diff --git a/addons/wurfl/dummy/wurfl/wurfl.h b/addons/wurfl/dummy/wurfl/wurfl.h
index 3b450fc..7659561 100644
--- a/addons/wurfl/dummy/wurfl/wurfl.h
+++ b/addons/wurfl/dummy/wurfl/wurfl.h
@@ -4,11 +4,16 @@
  * Copyright (c) ScientiaMobile, Inc.
  * http://www.scientiamobile.com
  *
- * This software package is the property of ScientiaMobile Inc. and is licensed
- * commercially according to a contract between the Licensee and ScientiaMobile Inc. (Licensor).
- * If you represent the Licensee, please refer to the licensing agreement which has been signed
- * between the two parties. If you do not represent the Licensee, you are not authorized to use
- * this software in any way.
+ * This software package is the property of ScientiaMobile Inc. and is distributed under
+ * a dual licensing scheme:
+ *
+ * 1) commercially according to a contract between the Licensee and ScientiaMobile Inc. (Licensor).
+ *    If you represent the Licensee, please refer to the licensing agreement which has been signed
+ *    between the two parties. If you do not represent the Licensee, you are not authorized to use
+ *    this software in any way.
+ *
+ * 2) LGPL when used in the context of the HAProxy project with the purpose of testing compatibility
+ *    of HAProxy with ScientiaMobile software.
  *
  */
 
diff --git a/debian/changelog b/debian/changelog
index 02ccd97..ca7af92 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,23 @@
+haproxy (2.4.22-0ubuntu0.22.10.1) kinetic; urgency=medium
+
+  * New upstream release (LP: #2012557).
+    - Major and critical bug fixes according to the upstream changelog:
+      + BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized
+      + BUG/MAJOR: mworker: fix infinite loop on master with no proxies.
+      + BUG/MAJOR: stick-tables: do not try to index a server name for applets
+      + BUG/MAJOR: stick-table: don't process store-response rules for applets
+      + BUG/MAJOR: fcgi: Fix uninitialized reserved bytes
+      + BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned
+      + BUG/CRITICAL: http: properly reject empty http header field names
+    - Remove patches applied by upstream in debian/patches:
+      + CVE-2023-0056.patch
+      + CVE-2023-25725.patch
+      + CVE-2023-0836.patch
+    - Refresh existing patches in debian/patches:
+      + reproducible.patch
+
+ -- Lucas Kanashiro <[e-mail]>  Wed, 22 Mar 2023 18:39:05 -0300
+
 haproxy (2.4.18-1ubuntu1.3) kinetic-security; urgency=medium
 
   * SECURITY UPDATE: information leak via uninitialized bytes
diff --git a/debian/patches/CVE-2023-0056.patch b/debian/patches/CVE-2023-0056.patch
 deleted file mode 100644
index dd8b02d..0000000
--- a/debian/patches/CVE-2023-0056.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 827a6299e6995c5c3ba620d8b7cbacdaef67f2c4 Mon Sep 17 00:00:00 2001
-From: Christopher Faulet <[e-mail]>
-Date: Thu, 22 Dec 2022 09:47:01 +0100
-Subject: [PATCH] BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream
- flag set
-
-As state in RFC9113#8.1, HEADERS frame with the ES flag set that carries an
-informational status code is malformed. However, there is no test on this
-condition.
-
-On 2.4 and higher, it is hard to predict consequences of this bug because
-end of the message is only reported with a flag. But on 2.2 and lower, it
-leads to a crash because there is an unexpected extra EOM block at the end
-of an interim response.
-
-Now, when a ES flag is detected on a HEADERS frame for an interim message, a
-stream error is sent (RST_STREAM/PROTOCOL_ERROR).
-
-This patch should solve the issue #1972. It should be backported as far as
-2.0.
----
- src/mux_h2.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/src/mux_h2.c
-+++ b/src/mux_h2.c
-@@ -4940,6 +4940,11 @@ next_frame:
- 		*flags |= H2_SF_HEADERS_RCVD;
- 
- 	if (h2c->dff & H2_F_HEADERS_END_STREAM) {
-+		if (msgf & H2_MSGF_RSP_1XX) {
-+			/* RFC9113#8.1 : HEADERS frame with the ES flag set that carries an informational status code is malformed */
-+			TRACE_STATE("invalid interim response with ES flag!", H2_EV_RX_FRAME|H2_EV_RX_HDR|H2_EV_H2C_ERR|H2_EV_PROTO_ERR, h2c->conn);
-+			goto fail;
-+		}
- 		/* no more data are expected for this message */
- 		htx->flags |= HTX_FL_EOM;
- 	}
diff --git a/debian/patches/CVE-2023-0836.patch b/debian/patches/CVE-2023-0836.patch
 deleted file mode 100644
index f708696..0000000
--- a/debian/patches/CVE-2023-0836.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From f988992d16f45ef03d5bbb024a1042ed8123e4c5 Mon Sep 17 00:00:00 2001
-From: Youfu Zhang <[e-mail]>
-Date: Fri, 9 Dec 2022 19:15:48 +0800
-Subject: [PATCH] BUG/MAJOR: fcgi: Fix uninitialized reserved bytes
-
-The output buffer is not zero-initialized. If we don't clear reserved
-bytes, fcgi requests sent to backend will leak sensitive data.
-
-This patch must be backported as far as 2.2.
-
-(cherry picked from commit 2e6bf0a2722866ae0128a4392fa2375bd1f03ff8)
-Signed-off-by: Christopher Faulet <[e-mail]>
-(cherry picked from commit db03179fee55c60a92ce6b86a0f04dbb9ba0328b)
-Signed-off-by: Christopher Faulet <[e-mail]>
----
- src/fcgi.c |    8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/src/fcgi.c b/src/fcgi.c
-index dcf2db2..1d1a82b 100644
---- a/src/fcgi.c
-+++ b/src/fcgi.c
-@@ -47,7 +47,7 @@ int fcgi_encode_record_hdr(struct buffer *out, const struct fcgi_header *h)
- 	out->area[len++] = ((h->len >> 8) & 0xff);
- 	out->area[len++] = (h->len & 0xff);
- 	out->area[len++] = h->padding;
--	len++; /* rsv */
-+	out->area[len++] = 0; /* rsv */
- 
- 	out->data = len;
- 	return 1;
-@@ -94,7 +94,11 @@ int fcgi_encode_begin_request(struct buffer *out, const struct fcgi_begin_reques
- 	out->area[len++] = ((r->role >> 8) & 0xff);
- 	out->area[len++] = (r->role & 0xff);
- 	out->area[len++] = r->flags;
--	len += 5; /* rsv */
-+	out->area[len++] = 0; /* rsv */
-+	out->area[len++] = 0;
-+	out->area[len++] = 0;
-+	out->area[len++] = 0;
-+	out->area[len++] = 0;
- 
- 	out->data = len;
- 	return 1;
--- 
-1.7.10.4
-
diff --git a/debian/patches/CVE-2023-25725.patch b/debian/patches/CVE-2023-25725.patch
 deleted file mode 100644
index 1897223..0000000
--- a/debian/patches/CVE-2023-25725.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From a6c7ac9d51248a641f456906549120d3f6387049 Mon Sep 17 00:00:00 2001
-From: Willy Tarreau <[e-mail]>
-Date: Thu, 9 Feb 2023 21:36:54 +0100
-Subject: BUG/CRITICAL: http: properly reject empty http header field names
-
-The HTTP header parsers surprizingly accepts empty header field names,
-and this is a leftover from the original code that was agnostic to this.
-
-When muxes were introduced, for H2 first, the HPACK decompressor needed
-to feed headers lists, and since empty header names were strictly
-forbidden by the protocol, the lists of headers were purposely designed
-to be terminated by an empty header field name (a principle that is
-similar to H1's empty line termination). This principle was preserved
-and generalized to other protocols migrated to muxes (H1/FCGI/H3 etc)
-without anyone ever noticing that the H1 parser was still able to deliver
-empty header field names to this list. In addition to this it turns out
-that the HPACK decompressor, despite a comment in the code, may
-successfully decompress an empty header field name, and this mistake
-was propagated to the QPACK decompressor as well.
-
-The impact is that an empty header field name may be used to truncate
-the list of headers and thus make some headers disappear. While for
-H2/H3 the impact is limited as haproxy sees a request with missing
-headers, and headers are not used to delimit messages, in the case of
-HTTP/1, the impact is significant because the presence (and sometimes
-contents) of certain sensitive headers is detected during the parsing.
-Thus, some of these headers may be seen, marked as present, their value
-extracted, but never delivered to upper layers and obviously not
-forwarded to the other side either. This can have for consequence that
-certain important header fields such as Connection, Upgrade, Host,
-Content-length, Transfer-Encoding etc are possibly seen as different
-between what haproxy uses to parse/forward/route and what is observed
-in http-request rules and of course, forwarded. One direct consequence
-is that it is possible to exploit this property in HTTP/1 to make
-affected versions of haproxy forward more data than is advertised on
-the other side, and bypass some access controls or routing rules by
-crafting extraneous requests.  Note, however, that responses to such
-requests will normally not be passed back to the client, but this can
-still cause some harm.
-
-This specific risk can be mostly worked around in configuration using
-the following rule that will rely on the bug's impact to precisely
-detect the inconsistency between the known body size and the one
-expected to be advertised to the server (the rule works from 2.0 to
-2.8-dev):
-
-  http-request deny if { fc_http_major 1 } !{ req.body_size 0 } !{ req.hdr(content-length) -m found } !{ req.hdr(transfer-encoding) -m found } !{ method CONNECT }
-
-This will exclusively block such carefully crafted requests delivered
-over HTTP/1. HTTP/2 and HTTP/3 do not need content-length, and a body
-that arrives without being announced with a content-length will be
-forwarded using transfer-encoding, hence will not cause discrepancies.
-In HAProxy 2.0 in legacy mode ("no option http-use-htx"), this rule will
-simply have no effect but will not cause trouble either.
-
-A clean solution would consist in modifying the loops iterating over
-these headers lists to check the header name's pointer instead of its
-length (since both are zero at the end of the list), but this requires
-to touch tens of places and it's very easy to miss one. Functions such
-as htx_add_header(), htx_add_trailer(), htx_add_all_headers() would be
-good starting points for such a possible future change.
-
-Instead the current fix focuses on blocking empty headers where they
-are first inserted, hence in the H1/HPACK/QPACK decoders. One benefit
-of the current solution (for H1) is that it allows "show errors" to
-report a precise diagnostic when facing such invalid HTTP/1 requests,
-with the exact location of the problem and the originating address:
-
-  $ printf "GET / HTTP/1.1\r\nHost: localhost\r\n:empty header\r\n\r\n" | nc 0 8001
-  HTTP/1.1 400 Bad request
-  Content-length: 90
-  Cache-Control: no-cache
-  Connection: close
-  Content-Type: text/html
-
-  <html><body><h1>400 Bad request</h1>
-  Your browser sent an invalid request.
-  </body></html>
-
-  $ socat /var/run/haproxy.stat <<< "show errors"
-  Total events captured on [10/Feb/2023:16:29:37.530] : 1
-
-  [10/Feb/2023:16:29:34.155] frontend decrypt (#2): invalid request
-    backend <NONE> (#-1), server <NONE> (#-1), event #0, src 127.0.0.1:31092
-    buffer starts at 0 (including 0 out), 16334 free,
-    len 50, wraps at 16336, error at position 33
-    H1 connection flags 0x00000000, H1 stream flags 0x00000810
-    H1 msg state MSG_HDR_NAME(17), H1 msg flags 0x00001410
-    H1 chunk len 0 bytes, H1 body len 0 bytes :
-
-    00000  GET / HTTP/1.1\r\n
-    00016  Host: localhost\r\n
-    00033  :empty header\r\n
-    00048  \r\n
-
-I want to address sincere and warm thanks for their great work to the
-team composed of the following security researchers who found the issue
-together and reported it: Bahruz Jabiyev, Anthony Gavazzi, and Engin
-Kirda from Northeastern University, Kaan Onarlioglu from Akamai
-Technologies, Adi Peleg and Harvey Tuch from Google. And kudos to Amaury
-Denoyelle from HAProxy Technologies for spotting that the HPACK and
-QPACK decoders would let this pass despite the comment explicitly
-saying otherwise.
-
-This fix must be backported as far as 2.0. The QPACK changes can be
-dropped before 2.6. In 2.0 there is also the equivalent code for legacy
-mode, which doesn't suffer from the list truncation, but it would better
-be fixed regardless.
----
- src/h1.c        | 4 ++++
- src/hpack-dec.c | 9 +++++++++
- src/qpack-dec.c | 9 +++++++++
- 3 files changed, 22 insertions(+)
-
---- a/src/h1.c
-+++ b/src/h1.c
-@@ -706,6 +706,10 @@ int h1_headers_to_hdr_list(char *start,
- 
- 		if (likely(*ptr == ':')) {
- 			col = ptr - start;
-+			if (col <= sol) {
-+				state = H1_MSG_HDR_NAME;
-+				goto http_msg_invalid;
-+			}
- 			EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_l1_sp, http_msg_ood, state, H1_MSG_HDR_L1_SP);
- 		}
- 
---- a/src/hpack-dec.c
-+++ b/src/hpack-dec.c
-@@ -419,6 +419,15 @@ int hpack_decode_frame(struct hpack_dht
- 			/* <name> and <value> are correctly filled here */
- 		}
- 
-+		/* We must not accept empty header names (forbidden by the spec and used
-+		 * as a list termination).
-+		 */
-+		if (!name.len) {
-+			hpack_debug_printf("##ERR@%d##\n", __LINE__);
-+			ret = -HPACK_ERR_INVALID_ARGUMENT;
-+			goto leave;
-+		}
-+
- 		/* here's what we have here :
- 		 *   - name.len > 0
- 		 *   - value is filled with either const data or data allocated from tmp
diff --git a/debian/patches/reproducible.patch b/debian/patches/reproducible.patch
index bbc95b8..e499a79 100644
--- a/debian/patches/reproducible.patch
+++ b/debian/patches/reproducible.patch
@@ -1,8 +1,6 @@
-diff --git a/Makefile b/Makefile
-index 566bdb26a3e7..8603dea25c21 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -975,7 +975,7 @@ src/haproxy.o:	src/haproxy.c $(DEP)
+@@ -995,7 +995,7 @@
  	      -DBUILD_ARCH='"$(strip $(ARCH))"' \
  	      -DBUILD_CPU='"$(strip $(CPU))"' \
  	      -DBUILD_CC='"$(strip $(CC))"' \
diff --git a/debian/patches/series b/debian/patches/series
index 25260a8..276b0d5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,6 +4,3 @@ haproxy.service-add-documentation.patch
 # applied during the build process:
 # debianize-dconv.patch
 reproducible.patch
-CVE-2023-0056.patch
-CVE-2023-25725.patch
-CVE-2023-0836.patch
diff --git a/doc/configuration.txt b/doc/configuration.txt
index 5d4c052..0c23dd1 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -3,7 +3,7 @@
                           Configuration Manual
                          ----------------------
                               version 2.4
-                              2022/07/27
+                              2023/02/14
 
 
 This document covers the configuration language as implemented in the version
@@ -965,32 +965,36 @@ of them have command-line equivalents.
 The following keywords are supported in the "global" section :
 
  * Process management and security
+   - 51degrees-cache-size
+   - 51degrees-data-file
+   - 51degrees-property-name-list
+   - 51degrees-property-separator
    - ca-base
    - chroot
-   - crt-base
    - cpu-map
+   - crt-base
    - daemon
    - default-path
    - description
    - deviceatlas-json-file
    - deviceatlas-log-level
-   - deviceatlas-separator
    - deviceatlas-properties-cookie
+   - deviceatlas-separator
    - expose-experimental-directives
    - external-check
    - gid
    - group
-   - hard-stop-after
    - h1-case-adjust
    - h1-case-adjust-file
+   - h2-workaround-bogus-websocket-clients
+   - hard-stop-after
    - insecure-fork-wanted
    - insecure-setuid-wanted
    - issuers-chain-path
-   - h2-workaround-bogus-websocket-clients
    - localpeer
    - log
-   - log-tag
    - log-send-hostname
+   - log-tag
    - lua-load
    - lua-load-per-thread
    - lua-prepend-path
@@ -1003,13 +1007,9 @@ The following keywords are supported in the "global" section :
    - pp2-never-send-local
    - presetenv
    - resetenv
-   - uid
-   - ulimit-n
-   - user
    - set-dumpable
    - set-var
    - setenv
-   - stats
    - ssl-default-bind-ciphers
    - ssl-default-bind-ciphersuites
    - ssl-default-bind-curves
@@ -1020,25 +1020,25 @@ The following keywords are supported in the "global" section :
    - ssl-dh-param-file
    - ssl-server-verify
    - ssl-skip-self-issued-ca
+   - stats
+   - strict-limits
+   - uid
+   - ulimit-n
    - unix-bind
    - unsetenv
-   - 51degrees-data-file
-   - 51degrees-property-name-list
-   - 51degrees-property-separator
-   - 51degrees-cache-size
+   - user
+   - wurfl-cache-size
    - wurfl-data-file
    - wurfl-information-list
    - wurfl-information-list-separator
-   - wurfl-cache-size
-   - strict-limits
 
  * Performance tuning
    - busy-polling
    - max-spread-checks
+   - maxcompcpuusage
+   - maxcomprate
    - maxconn
    - maxconnrate
-   - maxcomprate
-   - maxcompcpuusage
    - maxpipes
    - maxsessrate
    - maxsslconn
@@ -1046,16 +1046,16 @@ The following keywords are supported in the "global" section :
    - maxzlibmem
    - no-memory-trimming
    - noepoll
-   - nokqueue
    - noevports
-   - nopoll
-   - nosplice
    - nogetaddrinfo
+   - nokqueue
+   - nopoll
    - noreuseport
+   - nosplice
    - profiling.tasks
-   - spread-checks
    - server-state-base
    - server-state-file
+   - spread-checks
    - ssl-engine
    - ssl-mode-async
    - tune.buffers.limit
@@ -1074,9 +1074,9 @@ The following keywords are supported in the "global" section :
    - tune.idletimer
    - tune.lua.forced-yield
    - tune.lua.maxmem
+   - tune.lua.service-timeout
    - tune.lua.session-timeout
    - tune.lua.task-timeout
-   - tune.lua.service-timeout
    - tune.maxaccept
    - tune.maxpollevents
    - tune.maxrewrite
@@ -1092,13 +1092,13 @@ The following keywords are supported in the "global" section :
    - tune.sndbuf.client
    - tune.sndbuf.server
    - tune.ssl.cachesize
+   - tune.ssl.capture-cipherlist-size
+   - tune.ssl.default-dh-param
+   - tune.ssl.force-private-cache
    - tune.ssl.keylog
    - tune.ssl.lifetime
-   - tune.ssl.force-private-cache
    - tune.ssl.maxrecord
-   - tune.ssl.default-dh-param
    - tune.ssl.ssl-ctx-cache-size
-   - tune.ssl.capture-cipherlist-size
    - tune.vars.global-max-size
    - tune.vars.proc-max-size
    - tune.vars.reqres-max-size
@@ -1115,6 +1115,36 @@ The following keywords are supported in the "global" section :
 3.1. Process management and security
 ------------------------------------
 
+51degrees-data-file <file path>
+  The path of the 51Degrees data file to provide device detection services. The
+  file should be unzipped and accessible by HAProxy with relevant permissions.
+
+  Please note that this option is only available when HAProxy has been
+  compiled with USE_51DEGREES.
+
+51degrees-property-name-list [<string> ...]
+  A list of 51Degrees property names to be load from the dataset. A full list
+  of names is available on the 51Degrees website:
+  https://51degrees.com/resources/property-dictionary
+
+  Please note that this option is only available when HAProxy has been
+  compiled with USE_51DEGREES.
+
+51degrees-property-separator <char>
+  A char that will be appended to every property value in a response header
+  containing 51Degrees results. If not set that will be set as ','.
+
+  Please note that this option is only available when HAProxy has been
+  compiled with USE_51DEGREES.
+
+51degrees-cache-size <number>
+  Sets the size of the 51Degrees converter cache to <number> entries. This
+  is an LRU cache which reminds previous device detections and their results.
+  By default, this cache is disabled.
+
+  Please note that this option is only available when HAProxy has been
+  compiled with USE_51DEGREES.
+
 ca-base <dir>
   Assigns a default directory to fetch SSL CA certificates and CRLs from when a
   relative path is used with "ca-file", "ca-verify-file" or "crl-file"
@@ -1267,6 +1297,13 @@ default-path { current | config | parent | origin <path> }
   paths. A robust approach could consist in prefixing all files names with
   their respective site name, or in doing so at the directory level.
 
+description <text>
+  Add a text that describes the instance.
+
+  Please note that it is required to escape certain characters (# for example)
+  and this text is inserted into a html page so you should avoid using
+  "<" and ">" characters.
+
 deviceatlas-json-file <path>
   Sets the path of the DeviceAtlas JSON data file to be loaded by the API.
   The path must be a valid JSON data file and accessible by HAProxy process.
@@ -1275,15 +1312,15 @@ deviceatlas-log-level <value>
   Sets the level of information returned by the API. This directive is
   optional and set to 0 by default if not set.
 
-deviceatlas-separator <char>
-  Sets the character separator for the API properties results. This directive
-  is optional and set to | by default if not set.
-
 deviceatlas-properties-cookie <name>
   Sets the client cookie's name used for the detection if the DeviceAtlas
   Client-side component was used during the request. This directive is optional
   and set to DAPROPS by default if not set.
 
+deviceatlas-separator <char>
+  Sets the character separator for the API properties results. This directive
+  is optional and set to | by default if not set.
+
 expose-experimental-directives
   This statement must appear before using directives tagged as experimental or
   the config file will be rejected.
@@ -1309,22 +1346,6 @@ group <group name>
   Similar to "gid" but uses the GID of group name <group name> from /etc/group.
   See also "gid" and "user".
 
-hard-stop-after <time>
-  Defines the maximum time allowed to perform a clean soft-stop.
-
-  Arguments :
-    <time>  is the maximum time (by default in milliseconds) for which the
-            instance will remain alive when a soft-stop is received via the
-            SIGUSR1 signal.
-
-  This may be used to ensure that the instance will quit even if connections
-  remain opened during a soft-stop (for example with long timeouts for a proxy
-  in tcp mode). It applies both in TCP and HTTP mode.
-
-  Example:
-    global
-      hard-stop-after 30s
-
 h1-case-adjust <from> <to>
   Defines the case adjustment to apply, when enabled, to the header name
   <from>, to change it to <to> before sending it to HTTP/1 clients or
@@ -1374,6 +1395,33 @@ h1-case-adjust-file <hdrs-file>
   See "h1-case-adjust", "option h1-case-adjust-bogus-client" and
   "option h1-case-adjust-bogus-server".
 
+h2-workaround-bogus-websocket-clients
+  This disables the announcement of the support for h2 websockets to clients.
+  This can be use to overcome clients which have issues when implementing the
+  relatively fresh RFC8441, such as Firefox 88. To allow clients to
+  automatically downgrade to http/1.1 for the websocket tunnel, specify h2
+  support on the bind line using "alpn" without an explicit "proto" keyword. If
+  this statement was previously activated, this can be disabled by prefixing
+  the keyword with "no'.
+
+hard-stop-after <time>
+  Defines the maximum time allowed to perform a clean soft-stop.
+
+  Arguments :
+    <time>  is the maximum time (by default in milliseconds) for which the
+            instance will remain alive when a soft-stop is received via the
+            SIGUSR1 signal.
+
+  This may be used to ensure that the instance will quit even if connections
+  remain opened during a soft-stop (for example with long timeouts for a proxy
+  in tcp mode). It applies both in TCP and HTTP mode.
+
+  Example:
+    global
+      hard-stop-after 30s
+
+  See also: grace
+
 insecure-fork-wanted
   By default HAProxy tries hard to prevent any thread and process creation
   after it starts. Doing so is particularly important when using Lua files of
@@ -1421,15 +1469,6 @@ issuers-chain-path <dir>
   "issuers-chain-path" directory. All other certificates with the same issuer
   will share the chain in memory.
 
-h2-workaround-bogus-websocket-clients
-  This disables the announcement of the support for h2 websockets to clients.
-  This can be use to overcome clients which have issues when implementing the
-  relatively fresh RFC8441, such as Firefox 88. To allow clients to
-  automatically downgrade to http/1.1 for the websocket tunnel, specify h2
-  support on the bind line using "alpn" without an explicit "proto" keyword. If
-  this statement was previously activated, this can be disabled by prefixing
-  the keyword with "no'.
-
 localpeer <name>
   Sets the local instance's peer name. It will be ignored if the "-L"
   command line argument is specified or if used after "peers" section
@@ -1762,6 +1801,26 @@ server-state-file <file>
   configuration. See also "server-state-base" and "show servers state",
   "load-server-state-from-file" and "server-state-file-name"
 
+set-dumpable
+  This option is better left disabled by default and enabled only upon a
+  developer's request. If it has been enabled, it may still be forcibly
+  disabled by prefixing it with the "no" keyword. It has no impact on
+  performance nor stability but will try hard to re-enable core dumps that were
+  possibly disabled by file size limitations (ulimit -f), core size limitations
+  (ulimit -c), or "dumpability" of a process after changing its UID/GID (such
+  as /proc/sys/fs/suid_dumpable on Linux). Core dumps might still be limited by
+  the current directory's permissions (check what directory the file is started
+  from), the chroot directory's permission (it may be needed to temporarily
+  disable the chroot directive or to move it to a dedicated writable location),
+  or any other system-specific constraint. For example, some Linux flavours are
+  notorious for replacing the default core file with a path to an executable
+  not even installed on the system (check /proc/sys/kernel/core_pattern). Often,
+  simply writing "core", "core.%p" or "/var/log/core/core.%p" addresses the
+  issue. When trying to enable this option waiting for a rare issue to
+  re-appear, it's often a good idea to first try to obtain such a dump by
+  issuing, for example, "kill -11" to the "haproxy" process and verify that it
+  leaves a core where expected when dying.
+
 set-var <var-name> <expr>
   Sets the process-wide variable '<var-name>' to the result of the evaluation
   of the sample expression <expr>. The variable '<var-name>' may only be a
@@ -1785,26 +1844,6 @@ setenv <name> <value>
   the configuration file sees the new value. See also "presetenv", "resetenv",
   and "unsetenv".
 
-set-dumpable
-  This option is better left disabled by default and enabled only upon a
-  developer's request. If it has been enabled, it may still be forcibly
-  disabled by prefixing it with the "no" keyword. It has no impact on
-  performance nor stability but will try hard to re-enable core dumps that were
-  possibly disabled by file size limitations (ulimit -f), core size limitations
-  (ulimit -c), or "dumpability" of a process after changing its UID/GID (such
-  as /proc/sys/fs/suid_dumpable on Linux). Core dumps might still be limited by
-  the current directory's permissions (check what directory the file is started
-  from), the chroot directory's permission (it may be needed to temporarily
-  disable the chroot directive or to move it to a dedicated writable location),
-  or any other system-specific constraint. For example, some Linux flavours are
-  notorious for replacing the default core file with a path to an executable
-  not even installed on the system (check /proc/sys/kernel/core_pattern). Often,
-  simply writing "core", "core.%p" or "/var/log/core/core.%p" addresses the
-  issue. When trying to enable this option waiting for a rare issue to
-  re-appear, it's often a good idea to first try to obtain such a dump by
-  issuing, for example, "kill -11" to the "haproxy" process and verify that it
-  leaves a core where expected when dying.
-
 ssl-default-bind-ciphers <ciphers>
   This setting is only available when support for OpenSSL was built in. It sets
   the default string describing the list of cipher algorithms ("cipher suite")
@@ -1995,6 +2034,10 @@ ssl-skip-self-issued-ca
   certificates. It's useless for BoringSSL, .issuer is ignored because ocsp
   bits does not need it. Requires at least OpenSSL 1.0.2.
 
+stats maxconn <connections>
+  By default, the stats socket is limited to 10 concurrent connections. It is
+  possible to change this value with "stats maxconn".
+
 stats socket [<address:port>|<path>] [param*]
   Binds a UNIX socket to <path> or a TCPv4/v6 address to <address:port>.
   Connections to this socket will return various statistics outputs and even
@@ -2011,9 +2054,12 @@ stats timeout <timeout, in milliseconds>
   to change this value with "stats timeout". The value must be passed in
   milliseconds, or be suffixed by a time unit among { us, ms, s, m, h, d }.
 
-stats maxconn <connections>
-  By default, the stats socket is limited to 10 concurrent connections. It is
-  possible to change this value with "stats maxconn".
+strict-limits
+  Makes process fail at startup when a setrlimit fails. HAProxy tries to set the
+  best setrlimit according to what has been calculated. If it fails, it will
+  emit a warning. This option is here to guarantee an explicit failure of
+  HAProxy when those limits fail. It is enabled by default. It may still be
+  forcibly disabled by prefixing it with the "no" keyword.
 
 uid <number>
   Changes the process's user ID to <number>. It is recommended that the user ID
@@ -2061,42 +2107,14 @@ node <name>
   nodes, it becomes easy to immediately spot what server is handling the
   traffic.
 
-description <text>
-  Add a text that describes the instance.
-
-  Please note that it is required to escape certain characters (# for example)
-  and this text is inserted into a html page so you should avoid using
-  "<" and ">" characters.
-
-51degrees-data-file <file path>
-  The path of the 51Degrees data file to provide device detection services. The
-  file should be unzipped and accessible by HAProxy with relevant permissions.
-
-  Please note that this option is only available when HAProxy has been
-  compiled with USE_51DEGREES.
-
-51degrees-property-name-list [<string> ...]
-  A list of 51Degrees property names to be load from the dataset. A full list
-  of names is available on the 51Degrees website:
-  https://51degrees.com/resources/property-dictionary
-
-  Please note that this option is only available when HAProxy has been
-  compiled with USE_51DEGREES.
-
-51degrees-property-separator <char>
-  A char that will be appended to every property value in a response header
-  containing 51Degrees results. If not set that will be set as ','.
-
-  Please note that this option is only available when HAProxy has been
-  compiled with USE_51DEGREES.
-
-51degrees-cache-size <number>
-  Sets the size of the 51Degrees converter cache to <number> entries. This
-  is an LRU cache which reminds previous device detections and their results.
-  By default, this cache is disabled.
+wurfl-cache-size <size>
+  Sets the WURFL Useragent cache size. For faster lookups, already processed user
+  agents are kept in a LRU cache :
+  - "0"     : no cache is used.
+  - <size>  : size of lru cache in elements.
 
-  Please note that this option is only available when HAProxy has been
-  compiled with USE_51DEGREES.
+  Please note that this option is only available when HAProxy has been compiled
+  with USE_WURFL=1.
 
 wurfl-data-file <file path>
   The path of the WURFL data file to provide device detection services. The
@@ -2152,22 +2170,6 @@ wurfl-patch-file [<file path>]
   Please note that this option is only available when HAProxy has been compiled
   with USE_WURFL=1.
 
-wurfl-cache-size <size>
-  Sets the WURFL Useragent cache size. For faster lookups, already processed user
-  agents are kept in a LRU cache :
-  - "0"     : no cache is used.
-  - <size>  : size of lru cache in elements.
-
-  Please note that this option is only available when HAProxy has been compiled
-  with USE_WURFL=1.
-
-strict-limits
-  Makes process fail at startup when a setrlimit fails. HAProxy tries to set the
-  best setrlimit according to what has been calculated. If it fails, it will
-  emit a warning. This option is here to guarantee an explicit failure of
-  HAProxy when those limits fail. It is enabled by default. It may still be
-  forcibly disabled by prefixing it with the "no" keyword.
-
 3.2. Performance tuning
 -----------------------
 
@@ -2204,6 +2206,24 @@ max-spread-checks <delay in milliseconds>
   even if the servers' check intervals are larger. When servers run with
   shorter intervals, their intervals will be respected though.
 
+maxcompcpuusage <number>
+  Sets the maximum CPU usage HAProxy can reach before stopping the compression
+  for new requests or decreasing the compression level of current requests.
+  It works like 'maxcomprate' but measures CPU usage instead of incoming data
+  bandwidth. The value is expressed in percent of the CPU used by HAProxy. A
+  value of 100 disable the limit. The default value is 100. Setting a lower
+  value will prevent the compression work from slowing the whole process down
+  and from introducing high latencies.
+
+maxcomprate <number>
+  Sets the maximum per-process input compression rate to <number> kilobytes
+  per second. For each session, if the maximum is reached, the compression
+  level will be decreased during the session. If the maximum is reached at the
+  beginning of a session, the session will not compress at all. If the maximum
+  is not reached, the compression level will be increased up to
+  tune.comp.maxlevel. A value of zero means there is no limit, this is the
+  default value.
+
 maxconn <number>
   Sets the maximum per-process number of concurrent connections to <number>. It
   is equivalent to the command-line argument "-n". Proxies will stop accepting
@@ -2229,25 +2249,6 @@ maxconnrate <number>
   value close to its expected share. Also, lowering tune.maxaccept can improve
   fairness.
 
-maxcomprate <number>
-  Sets the maximum per-process input compression rate to <number> kilobytes
-  per second. For each session, if the maximum is reached, the compression
-  level will be decreased during the session. If the maximum is reached at the
-  beginning of a session, the session will not compress at all. If the maximum
-  is not reached, the compression level will be increased up to
-  tune.comp.maxlevel. A value of zero means there is no limit, this is the
-  default value.
-
-maxcompcpuusage <number>
-  Sets the maximum CPU usage HAProxy can reach before stopping the compression
-  for new requests or decreasing the compression level of current requests.
-  It works like 'maxcomprate' but measures CPU usage instead of incoming data
-  bandwidth. The value is expressed in percent of the CPU used by HAProxy. In
-  case of multiple processes (nbproc > 1), each process manages its individual
-  usage. A value of 100 disable the limit. The default value is 100. Setting
-  a lower value will prevent the compression work from slowing the whole
-  process down and from introducing high latencies.
-
 maxpipes <number>
   Sets the maximum per-process number of pipes to <number>. Currently, pipes
   are only used by kernel-based tcp splicing. Since a pipe contains two file
@@ -2323,17 +2324,21 @@ noepoll
   equivalent to the command-line argument "-de". The next polling system
   used will generally be "poll". See also "nopoll".
 
-nokqueue
-  Disables the use of the "kqueue" event polling system on BSD. It is
-  equivalent to the command-line argument "-dk". The next polling system
-  used will generally be "poll". See also "nopoll".
-
 noevports
   Disables the use of the event ports event polling system on SunOS systems
   derived from Solaris 10 and later. It is equivalent to the command-line
   argument "-dv". The next polling system used will generally be "poll". See
   also "nopoll".
 
+nogetaddrinfo
+  Disables the use of getaddrinfo(3) for name resolving. It is equivalent to
+  the command line argument "-dG". Deprecated gethostbyname(3) will be used.
+
+nokqueue
+  Disables the use of the "kqueue" event polling system on BSD. It is
+  equivalent to the command-line argument "-dk". The next polling system
+  used will generally be "poll". See also "nopoll".
+
 nopoll
   Disables the use of the "poll" event polling system. It is equivalent to the
   command-line argument "-dp". The next polling system used will be "select".
@@ -2341,6 +2346,10 @@ nopoll
   platforms supported by HAProxy. See also "nokqueue", "noepoll" and
   "noevports".
 
+noreuseport
+  Disables the use of SO_REUSEPORT - see socket(7). It is equivalent to the
+  command line argument "-dR".
+
 nosplice
   Disables the use of kernel tcp splicing between sockets on Linux. It is
   equivalent to the command line argument "-dS". Data will then be copied
@@ -2351,14 +2360,6 @@ nosplice
   case of doubt. See also "option splice-auto", "option splice-request" and
   "option splice-response".
 
-nogetaddrinfo
-  Disables the use of getaddrinfo(3) for name resolving. It is equivalent to
-  the command line argument "-dG". Deprecated gethostbyname(3) will be used.
-
-noreuseport
-  Disables the use of SO_REUSEPORT - see socket(7). It is equivalent to the
-  command line argument "-dR".
-
 profiling.memory { on | off }
   Enables ('on') or disables ('off') per-function memory profiling. This will
   keep usage statistics of malloc/calloc/realloc/free calls anywhere in the
@@ -2604,18 +2605,18 @@ tune.lua.session-timeout <timeout>
   counts only the pure Lua runtime. If the Lua does a sleep, the sleep is
   not taken in account. The default timeout is 4s.
 
-tune.lua.task-timeout <timeout>
-  Purpose is the same as "tune.lua.session-timeout", but this timeout is
-  dedicated to the tasks. By default, this timeout isn't set because a task may
-  remain alive during of the lifetime of HAProxy. For example, a task used to
-  check servers.
-
 tune.lua.service-timeout <timeout>
   This is the execution timeout for the Lua services. This is useful for
   preventing infinite loops or spending too much time in Lua. This timeout
   counts only the pure Lua runtime. If the Lua does a sleep, the sleep is
   not taken in account. The default timeout is 4s.
 
+tune.lua.task-timeout <timeout>
+  Purpose is the same as "tune.lua.session-timeout", but this timeout is
+  dedicated to the tasks. By default, this timeout isn't set because a task may
+  remain alive during of the lifetime of HAProxy. For example, a task used to
+  check servers.
+
 tune.maxaccept <number>
   Sets the maximum number of consecutive connections a process may accept in a
   row before switching to other work. In single process mode, higher numbers
@@ -2756,6 +2757,26 @@ tune.ssl.cachesize <number>
   pre-allocated upon startup and are shared between all processes if "nbproc"
   is greater than 1. Setting this value to 0 disables the SSL session cache.
 
+tune.ssl.capture-cipherlist-size <number>
+  Sets the maximum size of the buffer used for capturing client hello cipher
+  list, extensions list, elliptic curves list and elliptic curve point
+  formats. If the value is 0 (default value) the capture is disabled,
+  otherwise a buffer is allocated for each SSL/TLS connection.
+
+tune.ssl.default-dh-param <number>
+  Sets the maximum size of the Diffie-Hellman parameters used for generating
+  the ephemeral/temporary Diffie-Hellman key in case of DHE key exchange. The
+  final size will try to match the size of the server's RSA (or DSA) key (e.g,
+  a 2048 bits temporary DH key for a 2048 bits RSA key), but will not exceed
+  this maximum value. Only 1024 or higher values are allowed. Higher values
+  will increase the CPU load, and values greater than 1024 bits are not
+  supported by Java 7 and earlier clients. This value is not used if static
+  Diffie-Hellman parameters are supplied either directly in the certificate
+  file or by using the ssl-dh-param-file parameter.
+  If there is neither a default-dh-param nor a ssl-dh-param-file defined, and
+  if the server's PEM file of a given frontend does not specify its own DH
+  parameters, then DHE ciphers will be unavailable for this frontend.
+
 tune.ssl.force-private-cache
   This option disables SSL session cache sharing between all processes. It
   should normally not be used since it will force many renegotiations due to
@@ -2824,28 +2845,12 @@ tune.ssl.maxrecord <number>
   best value. HAProxy will automatically switch to this setting after an idle
   stream has been detected (see tune.idletimer above).
 
-tune.ssl.default-dh-param <number>
-  Sets the maximum size of the Diffie-Hellman parameters used for generating
-  the ephemeral/temporary Diffie-Hellman key in case of DHE key exchange. The
-  final size will try to match the size of the server's RSA (or DSA) key (e.g,
-  a 2048 bits temporary DH key for a 2048 bits RSA key), but will not exceed
-  this maximum value. Default value if 2048. Only 1024 or higher values are
-  allowed. Higher values will increase the CPU load, and values greater than
-  1024 bits are not supported by Java 7 and earlier clients. This value is not
-  used if static Diffie-Hellman parameters are supplied either directly
-  in the certificate file or by using the ssl-dh-param-file parameter.
-
 tune.ssl.ssl-ctx-cache-size <number>
   Sets the size of the cache used to store generated certificates to <number>
   entries. This is a LRU cache. Because generating a SSL certificate
   dynamically is expensive, they are cached. The default cache size is set to
   1000 entries.
 
-tune.ssl.capture-cipherlist-size <number>
-  Sets the maximum size of the buffer used for capturing client-hello cipher
-  list. If the value is 0 (default value) the capture is disabled, otherwise
-  a buffer is allocated for each SSL/TLS connection.
-
 tune.vars.global-max-size <size>
 tune.vars.proc-max-size <size>
 tune.vars.reqres-max-size <size>
@@ -3619,7 +3624,7 @@ http-error                                X          X         X         X
 http-request                              -          X         X         X
 http-response                             -          X         X         X
 http-reuse                                X          -         X         X
-http-send-name-header                     -          -         X         X
+http-send-name-header                     X          -         X         X
 id                                        -          X         X         X
 ignore-persist                            -          -         X         X
 load-server-state-from-file               X          -         X         X
@@ -3677,7 +3682,7 @@ option socket-stats                  (*)  X          X         X         -
 option splice-auto                   (*)  X          X         X         X
 option splice-request                (*)  X          X         X         X
 option splice-response               (*)  X          X         X         X
-option spop-check                         -          -         -         X
+option spop-check                         X          -         X         X
 option srvtcpka                      (*)  X          -         X         X
 option ssl-hello-chk                      X          -         X         X
 -- keyword -------------------------- defaults - frontend - listen -- backend -
@@ -6162,7 +6167,8 @@ http-request do-resolve(<var>,<resolvers>,[ipv4,ipv6]) <expr> :
   based on information found in the request (IE a Host header).
   If this action is used to find the server's IP address (using the
   "set-dst" action), then the server IP address in the backend must be set
-  to 0.0.0.0.
+  to 0.0.0.0. The do-resolve action takes an host-only parameter, any port must
+  be removed from the string.
 
   Example:
     resolvers mydns
@@ -6177,7 +6183,7 @@ http-request do-resolve(<var>,<resolvers>,[ipv4,ipv6]) <expr> :
 
     frontend fe
       bind 10.42.0.1:80
-      http-request do-resolve(txn.myip,mydns,ipv4) hdr(Host),lower
+      http-request do-resolve(txn.myip,mydns,ipv4) hdr(Host),lower,regsub(:[0-9]*$,)
       http-request capture var(txn.myip) len 40
 
       # return 503 when the variable is not set,
@@ -6814,9 +6820,11 @@ http-request set-uri <fmt> [ { if | unless } <condition> ]
 
   This rewrites the request URI with the result of the evaluation of format
   string <fmt>. The scheme, authority, path and query string are all replaced
-  at once. This can be used to rewrite hosts in front of proxies, or to
-  perform complex modifications to the URI such as moving parts between the
-  path and the query string.
+  at once. This can be used to rewrite hosts in front of proxies, or to perform
+  complex modifications to the URI such as moving parts between the path and
+  the query string. If an absolute URI is set, it will be sent as is to
+  HTTP/1.1 servers. If it is not the desired behavior, the host, the path
+  and/or the query string should be set separately.
   See also "http-request set-path" and "http-request set-query".
 
 http-request set-var(<var-name>) <expr> [ { if | unless } <condition> ]
@@ -7541,7 +7549,26 @@ http-reuse { never | safe | aggressive | always }
   because almost no new connection will be established while idle connections
   remain available. This is particularly true with the "always" strategy.
 
-  See also : "option http-keep-alive", "server maxconn"
+  The rules to decide to keep an idle connection opened or to close it after
+  processing are also governed by the "tune.pool-low-fd-ratio" (default: 20%)
+  and "tune.pool-high-fd-ratio" (default: 25%). These correspond to the
+  percentage of total file descriptors spent in idle connections above which
+  haproxy will respectively refrain from keeping a connection opened after a
+  response, and actively kill idle connections. Some setups using a very high
+  ratio of idle connections, either because of too low a global "maxconn", or
+  due to a lot of HTTP/2 or HTTP/3 traffic on the frontend (few connections)
+  but HTTP/1 connections on the backend, may observe a lower reuse rate because
+  too few connections are kept open. It may be desirable in this case to adjust
+  such thresholds or simply to increase the global "maxconn" value.
+
+  Similarly, when thread groups are explicitly enabled, it is important to
+  understand that idle connections are only usable between threads from a same
+  group. As such it may happen that unfair load between groups leads to more
+  idle connections being needed, causing a lower reuse rate. The same solution
+  may then be applied (increase global "maxconn" or increase pool ratios).
+
+  See also : "option http-keep-alive", "server maxconn", "thread-groups",
+             "tune.pool-high-fd-ratio", "tune.pool-low-fd-ratio"
 
 
 http-send-name-header [<header>]
@@ -8073,7 +8100,9 @@ monitor-uri <uri>
   Monitor requests are processed very early, just after the request is parsed
   and even before any "http-request". The only rulesets applied before are the
   tcp-request ones. They cannot be logged either, and it is the intended
-  purpose. They are only used to report HAProxy's health to an upper component,
+  purpose. Only one URI may be configured for monitoring; when multiple
+  "monitor-uri" statements are present, the last one will define the URI to
+  be used. They are only used to report HAProxy's health to an upper component,
   nothing more. However, it is possible to add any number of conditions using
   "monitor fail" and ACLs so that the result can be adjusted to whatever check
   can be imagined (most often the number of available servers in a backend).
@@ -9350,7 +9379,7 @@ no option persist
   See also : "option redispatch", "retries", "force-persist"
 
 
-option pgsql-check [ user <username> ]
+option pgsql-check user <username>
   Use PostgreSQL health checks for server testing
   May be used in sections :   defaults | frontend | listen | backend
                                  yes   |    no    |   yes  |   yes
@@ -9610,7 +9639,7 @@ no option splice-response
 option spop-check
   Use SPOP health checks for server testing
   May be used in sections :   defaults | frontend | listen | backend
-                                 no    |    no    |   no   |   yes
+                                 yes   |    no    |   yes  |   yes
   Arguments : none
 
   It is possible to test that the server correctly talks SPOP protocol instead
@@ -10175,24 +10204,26 @@ redirect scheme   <sch> [code <code>] <option> [{if | unless} <condition>]
 
 
 retries <value>
-  Set the number of retries to perform on a server after a connection failure
+  Set the number of retries to perform on a server after a failure
   May be used in sections:    defaults | frontend | listen | backend
                                  yes   |    no    |   yes  |   yes
   Arguments :
-    <value>   is the number of times a connection attempt should be retried on
-              a server when a connection either is refused or times out. The
-              default value is 3.
+    <value>   is the number of times a request or connection attempt should be
+              retried on a server after a failure.
 
-  It is important to understand that this value applies to the number of
-  connection attempts, not full requests. When a connection has effectively
-  been established to a server, there will be no more retry.
+  By default, retries apply only to new connection attempts. However, when
+  the "retry-on" directive is used, other conditions might trigger a retry
+  (e.g. empty response, undesired status code), and each of them will count
+  one attempt, and when the total number attempts reaches the value here, an
+  error will be returned.
 
   In order to avoid immediate reconnections to a server which is restarting,
   a turn-around timer of min("timeout connect", one second) is applied before
-  a retry occurs.
+  a retry occurs on the same server.
 
-  When "option redispatch" is set, the last retry may be performed on another
-  server even if a cookie references a different server.
+  When "option redispatch" is set, some retries may be performed on another
+  server even if a cookie references a different server. By default this will
+  only be the last retry unless an argument is passed to "option redispatch".
 
   See also : "option redispatch"
 
@@ -12423,7 +12454,7 @@ tcp-request content <action> [{if | unless} <condition>]
   evaluated.
 
   Example:
-    tcp-request content use-service lua.deny { src -f /etc/haproxy/blacklist.lst }
+    tcp-request content use-service lua.deny if { src -f /etc/haproxy/blacklist.lst }
 
   Example:
 
@@ -14986,8 +15017,10 @@ sni <expression>
   The "sni" parameter evaluates the sample fetch expression, converts it to a
   string and uses the result as the host name sent in the SNI TLS extension to
   the server. A typical use case is to send the SNI received from the client in
-  a bridged HTTPS scenario, using the "ssl_fc_sni" sample fetch for the
-  expression, though alternatives such as req.hdr(host) can also make sense. If
+  a bridged TCP/SSL scenario, using the "ssl_fc_sni" sample fetch for the
+  expression. THIS MUST NOT BE USED FOR HTTPS, where req.hdr(host) should be
+  used instead, since SNI in HTTPS must always match the Host field and clients
+  are allowed to use different host names over the same connection). If
   "verify required" is set (which is the recommended setting), the resulting
   name will also be matched against the server certificate's names. See the
   "verify" directive for more details. If you want to set a SNI for health
@@ -15679,7 +15712,11 @@ possible to convert the sample to lowercase before matching, like this :
 All ACL-specific criteria imply a default matching method. Most often, these
 criteria are composed by concatenating the name of the original sample fetch
 method and the matching method. For example, "hdr_beg" applies the "beg" match
-to samples retrieved using the "hdr" fetch method. Since all ACL-specific
+to samples retrieved using the "hdr" fetch method. This matching method is only
+usable when the keyword is used alone, without any converter. In case any such
+converter were to be applied after such an ACL keyword, the default matching
+method from the ACL keyword is simply ignored since what will matter for the
+matching is the output type of the last converter. Since all ACL-specific
 criteria rely on a sample fetch method, it is always possible instead to use
 the original sample fetch method and the explicit matching method using "-m".
 
@@ -15805,13 +15842,24 @@ different forms :
   - suffix match    (-m end) : the patterns are compared with the end of the
     extracted string, and the ACL matches if any of them matches.
 
-  - subdir match    (-m dir) : the patterns are looked up inside the extracted
-    string, delimited with slashes ("/"), and the ACL matches if any of them
-    matches.
-
-  - domain match    (-m dom) : the patterns are looked up inside the extracted
-    string, delimited with dots ("."), and the ACL matches if any of them
-    matches.
+  - subdir match    (-m dir) : the patterns are looked up anywhere inside the
+    extracted string, delimited with slashes ("/"), the beginning or the end
+    of the string. The ACL matches if any of them matches. As such, the string
+    "/images/png/logo/32x32.png", would match "/images", "/images/png",
+    "images/png", "/png/logo", "logo/32x32.png" or "32x32.png" but not "png"
+    nor "32x32".
+
+  - domain match    (-m dom) : the patterns are looked up anywhere inside the
+    extracted string, delimited with dots ("."), colons (":"), slashes ("/"),
+    question marks ("?"), the beginning or the end of the string. This is made
+    to be used with URLs. Leading and trailing delimiters in the pattern are
+    ignored. The ACL matches if any of them matches. As such, in the example
+    string "http://www1.dc-eu.example.com:80/blah", the patterns "http",
+    "www1", ".www1", "dc-eu", "example", "com", "80", "dc-eu.example",
+    "blah", ":www1:", "dc-eu.example:80" would match, but not "eu" nor "dc".
+    Using it to match domain suffixes for filtering or routing is generally
+    not a good idea, as the routing could easily be fooled by prepending the
+    matching prefix in front of another domain for example.
 
 String matching applies to verbatim strings as they are passed, with the
 exception of the backslash ("\") which makes it possible to escape some
@@ -18860,6 +18908,16 @@ ssl_fc_sni : string
   requires that the SSL library is built with support for TLS extensions
   enabled (check haproxy -vv).
 
+  CAUTION! Except under very specific conditions, it is normally not correct to
+  use this field as a substitute for the HTTP "Host" header field. For example,
+  when forwarding an HTTPS connection to a server, the SNI field must be set
+  from the HTTP Host header field using "req.hdr(host)" and not from the front
+  SNI value. The reason is that SNI is solely used to select the certificate
+  the server side will present, and that clients are then allowed to send
+  requests with different Host values as long as they match the names in the
+  certificate. As such, "ssl_fc_sni" should normally not be used as an argument
+  to the "sni" server keyword, unless the backend works in TCP mode.
+
   ACL derivatives :
     ssl_fc_sni_end : suffix match
     ssl_fc_sni_reg : regex match
@@ -22093,8 +22151,8 @@ Optionally, a prefix could be used to force the address family and/or the
 socket type and the transport method.
 
 
-11.1 Address family prefixes
-----------------------------
+11.1. Address family prefixes
+-----------------------------
 
 'abns@<name>' following <name> is an abstract namespace (Linux only).
 
@@ -22129,8 +22187,8 @@ socket type and the transport method.
                start by slash '/'.
 
 
-11.2 Socket type prefixes
--------------------------
+11.2. Socket type prefixes
+--------------------------
 
 Previous "Address family prefixes" can also be prefixed to force the socket
 type and the transport method. The default depends of the statement using
@@ -22139,7 +22197,7 @@ This is the case for "log" statement where the default is syslog over UDP
 but we could force to use syslog over TCP.
 
 Those prefixes were designed for internal purpose and users should
-instead use aliases of the next section "11.5.3 Protocol prefixes".
+instead use aliases of the next section "11.3 Protocol prefixes".
 
 If users need one those prefixes to perform what they expect because
 they can not configure the same using the protocol prefixes, they should
@@ -22152,8 +22210,8 @@ report this to the maintainers.
                             to "datagram".
 
 
-11.3 Protocol prefixes
-----------------------
+11.3. Protocol prefixes
+-----------------------
 
 'tcp@<address>[:port1[-port2]]' following <address> is considered as an IPv4
                                 or IPv6 address depending of the syntax but
@@ -22190,14 +22248,14 @@ report this to the maintainers.
                                  method is forced to "datagram". Depending on
                                  the statement using this address, a port or
                                  port range can or must be specified.
-                                 It is considered as an alias of 'stream+ipv4@'.
+                                 It is considered as an alias of 'dgram+ipv4@'.
 
 'udp6@<address>[:port1[-port2]]' following <address> is always considered as
                                  an IPv6 address but socket type and transport
                                  method is forced to "datagram". Depending on
                                  the statement using this address, a port or
                                  port range can or must be specified.
-                                 It is considered as an alias of 'stream+ipv4@'.
+                                 It is considered as an alias of 'dgram+ipv4@'.
 
 'uxdg@<path>'    following string is considered as a unix socket <path> but
                  transport method is forced to "datagram". It is considered as
diff --git a/doc/intro.txt b/doc/intro.txt
index 325ba76..d6e8648 100644
--- a/doc/intro.txt
+++ b/doc/intro.txt
@@ -41,6 +41,7 @@ Summary
 3.3.5.        Load balancing
 3.3.6.        Stickiness
 3.3.7.        Logging
+3.3.8.        Statistics
 3.4.      Standard features
 3.4.1.        Sampling and converting information
 3.4.2.        Maps
@@ -50,7 +51,6 @@ Summary
 3.4.6.        Formatted strings
 3.4.7.        HTTP rewriting and redirection
 3.4.8.        Server protection
-3.4.9.        Statistics
 3.5.      Advanced features
 3.5.1.        Management
 3.5.2.        System-specific capabilities
diff --git a/doc/management.txt b/doc/management.txt
index 56e4f66..56f119e 100644
--- a/doc/management.txt
+++ b/doc/management.txt
@@ -2919,6 +2919,10 @@ show ssl crt-list [-n] [<filename>]
     ecdsa.pem:3 [verify none allow-0rtt ssl-min-ver TLSv1.0 ssl-max-ver TLSv1.3] localhost !www.test1.com
     ecdsa.pem:4 [verify none allow-0rtt ssl-min-ver TLSv1.0 ssl-max-ver TLSv1.3]
 
+show startup-logs
+  Dump all messages emitted during the startup of the current haproxy process,
+  each startup-logs buffer is unique to its haproxy worker.
+
 show table
   Dump general information on all known stick-tables. Their name is returned
   (the name of the proxy which holds them), their type (currently zero, always
diff --git a/doc/proxy-protocol.txt b/doc/proxy-protocol.txt
index 4d49d5c..fac0331 100644
--- a/doc/proxy-protocol.txt
+++ b/doc/proxy-protocol.txt
@@ -500,7 +500,7 @@ protocol. Identifying the protocol version is easy :
     - if the incoming byte count is 16 or above and the 13 first bytes match
       the protocol signature block followed by the protocol version 2 :
 
-           \x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A\x02
+           \x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A\x20
 
     - otherwise, if the incoming byte count is 8 or above, and the 5 first
       characters match the US-ASCII representation of "PROXY" then the protocol
diff --git a/include/haproxy/buf.h b/include/haproxy/buf.h
index 6cfd9d3..fc7b6fb 100644
--- a/include/haproxy/buf.h
+++ b/include/haproxy/buf.h
@@ -445,7 +445,7 @@ static inline void b_slow_realign(struct buffer *b, char *swap, size_t output)
 
 	/* process output data in two steps to cover wrapping */
 	if (block1 > b_size(b) - b_head_ofs(b)) {
-		block2 = b_size(b) - b_head_ofs(b);
+		block2 = b_peek_ofs(b, block1);
 		block1 -= block2;
 	}
 	memcpy(swap + b_size(b) - output, b_head(b), block1);
diff --git a/include/haproxy/bug.h b/include/haproxy/bug.h
index a2a9f6d..445dd7c 100644
--- a/include/haproxy/bug.h
+++ b/include/haproxy/bug.h
@@ -42,8 +42,10 @@ static inline __attribute((always_inline)) void ha_crash_now(void)
 #if __GNUC_PREREQ__(5, 0)
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Warray-bounds"
+#if __GNUC_PREREQ__(6, 0)
 #pragma GCC diagnostic ignored "-Wnull-dereference"
 #endif
+#endif
 	*(volatile char *)1 = 0;
 #if __GNUC_PREREQ__(5, 0)
 #pragma GCC diagnostic pop
diff --git a/include/haproxy/http.h b/include/haproxy/http.h
index d0f3fd2..8a86cb6 100644
--- a/include/haproxy/http.h
+++ b/include/haproxy/http.h
@@ -36,6 +36,8 @@ extern const uint8_t http_char_classes[256];
 enum http_meth_t find_http_meth(const char *str, const int len);
 int http_get_status_idx(unsigned int status);
 const char *http_get_reason(unsigned int status);
+struct ist http_get_host_port(const struct ist host);
+int http_is_default_port(const struct ist schm, const struct ist port);
 int http_validate_scheme(const struct ist schm);
 struct ist http_get_scheme(const struct ist uri);
 struct ist http_get_authority(const struct ist uri, int no_userinfo);
diff --git a/include/haproxy/listener-t.h b/include/haproxy/listener-t.h
index c350290..476e65a 100644
--- a/include/haproxy/listener-t.h
+++ b/include/haproxy/listener-t.h
@@ -156,12 +156,21 @@ struct ssl_bind_conf {
 #endif
 };
 
+/*
+ * In OpenSSL 3.0.0, the biggest verify error code's value is 94 and on the
+ * latest 1.1.1 it already reaches 79 so we need to size the ca/crt-ignore-err
+ * arrays accordingly. If the max error code increases, the arrays might need to
+ * be resized.
+ */
+#define SSL_MAX_VFY_ERROR_CODE 94
+#define IGNERR_BF_SIZE ((SSL_MAX_VFY_ERROR_CODE >> 6) + 1)
+
 /* "bind" line settings */
 struct bind_conf {
 #ifdef USE_OPENSSL
 	struct ssl_bind_conf ssl_conf; /* ssl conf for ctx setting */
-	unsigned long long ca_ignerr;  /* ignored verify errors in handshake if depth > 0 */
-	unsigned long long crt_ignerr; /* ignored verify errors in handshake if depth == 0 */
+	unsigned long long ca_ignerr_bitfield[IGNERR_BF_SIZE];   /* ignored verify errors in handshake if depth > 0 */
+	unsigned long long crt_ignerr_bitfield[IGNERR_BF_SIZE];  /* ignored verify errors in handshake if depth == 0 */
 	SSL_CTX *initial_ctx;      /* SSL context for initial negotiation */
 	SSL_CTX *default_ctx;      /* SSL context of first/default certificate */
 	struct ssl_bind_conf *default_ssl_conf; /* custom SSL conf of default_ctx */
diff --git a/include/haproxy/listener.h b/include/haproxy/listener.h
index 3fb078f..bb502c6 100644
--- a/include/haproxy/listener.h
+++ b/include/haproxy/listener.h
@@ -39,23 +39,29 @@ void listener_set_state(struct listener *l, enum li_state st);
  * closes upon SHUT_WR and refuses to rebind. So a common validation path
  * involves SHUT_WR && listen && SHUT_RD. In case of success, the FD's polling
  * is disabled. It normally returns non-zero, unless an error is reported.
+ * It will need to operate under the proxy's lock. The caller is
+ * responsible for indicating in lpx whether the proxy locks is
+ * already held (non-zero) or not (zero) so that the function picks it.
  */
-int pause_listener(struct listener *l);
+int pause_listener(struct listener *l, int lpx);
 
 /* This function tries to resume a temporarily disabled listener.
  * The resulting state will either be LI_READY or LI_FULL. 0 is returned
  * in case of failure to resume (eg: dead socket).
+ * It will need to operate under the proxy's lock. The caller is
+ * responsible for indicating in lpx whether the proxy locks is
+ * already held (non-zero) or not (zero) so that the function picks it.
  */
-int resume_listener(struct listener *l);
+int resume_listener(struct listener *l, int lpx);
 
 /*
  * This function completely stops a listener. It will need to operate under the
- * proxy's lock, the protocol's lock, and the listener's lock. The caller is
- * responsible for indicating in lpx, lpr, lli whether the respective locks are
+ * proxy's lock and the protocol's lock. The caller is
+ * responsible for indicating in lpx, lpr whether the respective locks are
  * already held (non-zero) or not (zero) so that the function picks the missing
  * ones, in this order.
  */
-void stop_listener(struct listener *l, int lpx, int lpr, int lli);
+void stop_listener(struct listener *l, int lpx, int lpr);
 
 /* This function adds the specified listener's file descriptor to the polling
  * lists if it is in the LI_LISTEN state. The listener enters LI_READY or
diff --git a/include/haproxy/peers-t.h b/include/haproxy/peers-t.h
index ee9d905..93920fd 100644
--- a/include/haproxy/peers-t.h
+++ b/include/haproxy/peers-t.h
@@ -31,6 +31,7 @@
 
 #include <haproxy/api-t.h>
 #include <haproxy/dict-t.h>
+#include <haproxy/stick_table-t.h>
 #include <haproxy/thread-t.h>
 
 
diff --git a/include/haproxy/pool.h b/include/haproxy/pool.h
index 9264998..0547dcb 100644
--- a/include/haproxy/pool.h
+++ b/include/haproxy/pool.h
@@ -55,8 +55,8 @@ void pool_free_nocache(struct pool_head *pool, void *ptr);
 void dump_pools_to_trash();
 void dump_pools(void);
 int pool_total_failures();
-unsigned long pool_total_allocated();
-unsigned long pool_total_used();
+unsigned long long pool_total_allocated();
+unsigned long long pool_total_used();
 void pool_flush(struct pool_head *pool);
 void pool_gc(struct pool_head *pool_ctx);
 struct pool_head *create_pool(char *name, unsigned int size, unsigned int flags);
diff --git a/include/haproxy/server.h b/include/haproxy/server.h
index c927de3..fdb285c 100644
--- a/include/haproxy/server.h
+++ b/include/haproxy/server.h
@@ -45,6 +45,7 @@ extern struct dict server_key_dict;
 int srv_downtime(const struct server *s);
 int srv_lastsession(const struct server *s);
 int srv_getinter(const struct check *check);
+void srv_settings_cpy(struct server *srv, const struct server *src, int srv_tmpl);
 int parse_server(const char *file, int linenum, char **args, struct proxy *curproxy, const struct proxy *defproxy, int parse_flags);
 int srv_update_addr(struct server *s, void *ip, int ip_sin_family, const char *updater);
 const char *srv_update_addr_port(struct server *s, const char *addr, const char *port, char *updater);
@@ -254,18 +255,21 @@ static inline enum srv_initaddr srv_get_next_initaddr(unsigned int *list)
 
 static inline void srv_use_conn(struct server *srv, struct connection *conn)
 {
-	unsigned int curr;
+	unsigned int curr, prev;
 
 	curr = _HA_ATOMIC_ADD_FETCH(&srv->curr_used_conns, 1);
 
+
 	/* It's ok not to do that atomically, we don't need an
 	 * exact max.
 	 */
-	if (srv->max_used_conns < curr)
-		srv->max_used_conns = curr;
+	prev = HA_ATOMIC_LOAD(&srv->max_used_conns);
+	if (prev < curr)
+		HA_ATOMIC_STORE(&srv->max_used_conns, curr);
 
-	if (srv->est_need_conns < curr)
-		srv->est_need_conns = curr;
+	prev = HA_ATOMIC_LOAD(&srv->est_need_conns);
+	if (prev < curr)
+		HA_ATOMIC_STORE(&srv->est_need_conns, curr);
 }
 
 static inline void conn_delete_from_tree(struct ebmb_node *node)
diff --git a/include/haproxy/sink.h b/include/haproxy/sink.h
index 51d507c..a9f8099 100644
--- a/include/haproxy/sink.h
+++ b/include/haproxy/sink.h
@@ -28,6 +28,8 @@
 
 extern struct list sink_list;
 
+extern struct proxy *sink_proxies_list;
+
 struct sink *sink_find(const char *name);
 struct sink *sink_new_fd(const char *name, const char *desc, enum log_fmt, int fd);
 ssize_t __sink_write(struct sink *sink, const struct ist msg[], size_t nmsg,
diff --git a/include/haproxy/ssl_sock-t.h b/include/haproxy/ssl_sock-t.h
index 974b836..35270ca 100644
--- a/include/haproxy/ssl_sock-t.h
+++ b/include/haproxy/ssl_sock-t.h
@@ -52,16 +52,20 @@
 #define SSL_SOCK_SEND_UNLIMITED     0x00000004
 #define SSL_SOCK_RECV_HEARTBEAT     0x00000008
 
-/* bits 0xFFFF0000 are reserved to store verify errors */
+/* bits 0xFFFFFF00 are reserved to store verify errors.
+ * The CA en CRT error codes will be stored on 7 bits each
+ * (since the max verify error code does not exceed 127)
+ * and the CA error depth will be stored on 4 bits.
+ */
 
 /* Verify errors macros */
-#define SSL_SOCK_CA_ERROR_TO_ST(e) (((e > 63) ? 63 : e) << (16))
-#define SSL_SOCK_CAEDEPTH_TO_ST(d) (((d > 15) ? 15 : d) << (6+16))
-#define SSL_SOCK_CRTERROR_TO_ST(e) (((e > 63) ? 63 : e) << (4+6+16))
+#define SSL_SOCK_CA_ERROR_TO_ST(e) (((e > 127) ? 127 : e) << (8))
+#define SSL_SOCK_CAEDEPTH_TO_ST(d) (((d > 15) ? 15 : d) << (7+8))
+#define SSL_SOCK_CRTERROR_TO_ST(e) (((e > 127) ? 127 : e) << (4+7+8))
 
-#define SSL_SOCK_ST_TO_CA_ERROR(s) ((s >> (16)) & 63)
-#define SSL_SOCK_ST_TO_CAEDEPTH(s) ((s >> (6+16)) & 15)
-#define SSL_SOCK_ST_TO_CRTERROR(s) ((s >> (4+6+16)) & 63)
+#define SSL_SOCK_ST_TO_CA_ERROR(s) ((s >> (8)) & 127)
+#define SSL_SOCK_ST_TO_CAEDEPTH(s) ((s >> (7+8)) & 15)
+#define SSL_SOCK_ST_TO_CRTERROR(s) ((s >> (4+7+8)) & 127)
 
 /* ssl_methods flags for ssl options */
 #define MC_SSL_O_ALL            0x0000
diff --git a/include/haproxy/ssl_sock.h b/include/haproxy/ssl_sock.h
index c68425a..9db4ec4 100644
--- a/include/haproxy/ssl_sock.h
+++ b/include/haproxy/ssl_sock.h
@@ -149,6 +149,29 @@ int ssl_sock_is_ssl(struct connection *conn)
 		return 1;
 }
 
+static inline int cert_ignerr_bitfield_get(const unsigned long long *bitfield, int bit_index)
+{
+	int byte_index = bit_index >> 6;
+	int val = 0;
+
+	if (byte_index < IGNERR_BF_SIZE)
+		val = bitfield[byte_index] & (1ULL << (bit_index & 0x3F));
+
+	return val != 0;
+}
+
+static inline void cert_ignerr_bitfield_set(unsigned long long *bitfield, int bit_index)
+{
+	int byte_index = bit_index >> 6;
+
+	if (byte_index < IGNERR_BF_SIZE)
+		bitfield[byte_index] |= (1ULL << (bit_index & 0x3F));
+}
+
+static inline void cert_ignerr_bitfield_set_all(unsigned long long *bitfield)
+{
+	memset(bitfield, -1, IGNERR_BF_SIZE*sizeof(*bitfield));
+}
 
 #endif /* USE_OPENSSL */
 #endif /* _HAPROXY_SSL_SOCK_H */
diff --git a/include/haproxy/stats-t.h b/include/haproxy/stats-t.h
index 17641f5..920a311 100644
--- a/include/haproxy/stats-t.h
+++ b/include/haproxy/stats-t.h
@@ -443,7 +443,9 @@ enum stat_field {
 	ST_F_USED_CONN_CUR,
 	ST_F_NEED_CONN_EST,
 	ST_F_UWEIGHT,
+	ST_F_AGG_SRV_STATUS,
 	ST_F_AGG_SRV_CHECK_STATUS,
+	ST_F_AGG_CHECK_STATUS,
 
 	/* must always be the last one */
 	ST_F_TOTAL_FIELDS
diff --git a/include/haproxy/stream.h b/include/haproxy/stream.h
index 1ec87b1..5a61c20 100644
--- a/include/haproxy/stream.h
+++ b/include/haproxy/stream.h
@@ -337,7 +337,7 @@ static inline void stream_choose_redispatch(struct stream *s)
 	       ((s->be->conn_retries - si->conn_retries) %
 	        (s->be->conn_retries + 1 + s->be->redispatch_after) == 0))) ||
 	     (!(s->flags & SF_DIRECT) && s->be->srv_act > 1 &&
-	      ((s->be->lbprm.algo & BE_LB_KIND) == BE_LB_KIND_RR)))) {
+	      ((s->be->lbprm.algo & BE_LB_KIND) != BE_LB_KIND_HI)))) {
 		sess_change_server(s, NULL);
 		if (may_dequeue_tasks(objt_server(s->target), s->be))
 			process_srv_queue(objt_server(s->target), 0);
diff --git a/include/haproxy/task.h b/include/haproxy/task.h
index d31c893..b3ffdf2 100644
--- a/include/haproxy/task.h
+++ b/include/haproxy/task.h
@@ -281,7 +281,7 @@ static inline struct task *task_unlink_wq(struct task *t)
 
 	if (likely(task_in_wq(t))) {
 		locked = t->state & TASK_SHARED_WQ;
-		BUG_ON(!locked && t->thread_mask != tid_bit);
+		BUG_ON(!locked && t->thread_mask != tid_bit && !(global.mode & MODE_STOPPING));
 		if (locked)
 			HA_RWLOCK_WRLOCK(TASK_WQ_LOCK, &wq_lock);
 		__task_unlink_wq(t);
@@ -526,6 +526,7 @@ static inline void tasklet_init(struct tasklet *t)
 	t->process = NULL;
 	t->tid = -1;
 #ifdef DEBUG_TASK
+	t->call_date = 0;
 	t->debug.caller_idx = 0;
 #endif
 	LIST_INIT(&t->list);
diff --git a/include/haproxy/tcpcheck-t.h b/include/haproxy/tcpcheck-t.h
index 29cb4cc..439fe18 100644
--- a/include/haproxy/tcpcheck-t.h
+++ b/include/haproxy/tcpcheck-t.h
@@ -35,6 +35,7 @@
 #define TCPCHK_OPT_DEFAULT_CONNECT 0x0008  /* Do a connect using server params */
 #define TCPCHK_OPT_IMPLICIT        0x0010  /* Implicit connect */
 #define TCPCHK_OPT_SOCKS4          0x0020  /* check the connection via socks4 proxy */
+#define TCPCHK_OPT_HAS_DATA        0x0040  /* data should be sent after conncetion */
 
 enum tcpcheck_send_type {
 	TCPCHK_SEND_UNDEF = 0,  /* Send is not parsed. */
diff --git a/include/haproxy/tools.h b/include/haproxy/tools.h
index a95844a..30b6bfa 100644
--- a/include/haproxy/tools.h
+++ b/include/haproxy/tools.h
@@ -406,7 +406,8 @@ char *encode_chunk(char *start, char *stop,
 
 /*
  * Tries to prefix characters tagged in the <map> with the <escape>
- * character. The input <string> must be zero-terminated. The result will
+ * character. The input <string> is processed until string_stop
+ * is reached or NULL-byte is encountered. The result will
  * be stored between <start> (included) and <stop> (excluded). This
  * function will always try to terminate the resulting string with a '\0'
  * before <stop>, and will return its position if the conversion
@@ -414,7 +415,7 @@ char *encode_chunk(char *start, char *stop,
  */
 char *escape_string(char *start, char *stop,
 		    const char escape, const long *map,
-		    const char *string);
+		    const char *string, const char *string_stop);
 
 /*
  * Tries to prefix characters tagged in the <map> with the <escape>
diff --git a/include/import/ebmbtree.h b/include/import/ebmbtree.h
index f99c16b..2d63ed1 100644
--- a/include/import/ebmbtree.h
+++ b/include/import/ebmbtree.h
@@ -118,6 +118,59 @@ struct ebmb_node *ebmb_lookup_longest(struct eb_root *root, const void *x);
 struct ebmb_node *ebmb_lookup_prefix(struct eb_root *root, const void *x, unsigned int pfx);
 struct ebmb_node *ebmb_insert_prefix(struct eb_root *root, struct ebmb_node *new, unsigned int len);
 
+/* start from a valid leaf and find the next matching prefix that's either a
+ * duplicate, or immediately shorter than the node's current one and still
+ * matches it. The purpose is to permit a caller that is not satisfied with a
+ * result provided by ebmb_lookup_longest() to evaluate the next matching
+ * entry. Given that shorter keys are necessarily attached to nodes located
+ * above the current one, it's sufficient to restart from the current leaf and
+ * go up until we find a shorter prefix, or a non-matching one.
+ */
+static inline struct ebmb_node *ebmb_lookup_shorter(struct ebmb_node *start)
+{
+	eb_troot_t *t = start->node.leaf_p;
+	struct ebmb_node *node;
+
+	/* first, chcek for duplicates */
+	node = ebmb_next_dup(start);
+	if (node)
+		return node;
+
+	while (1) {
+		if (eb_gettag(t) == EB_LEFT) {
+			/* Walking up from left branch. We must ensure that we never
+			 * walk beyond root.
+			 */
+			if (unlikely(eb_clrtag((eb_untag(t, EB_LEFT))->b[EB_RGHT]) == NULL))
+				return NULL;
+			node = container_of(eb_root_to_node(eb_untag(t, EB_LEFT)), struct ebmb_node, node);
+		} else {
+			/* Walking up from right branch, so we cannot be below
+			 * root. However, if we end up on a node with an even
+			 * and positive bit, this is a cover node, which mandates
+			 * that the left branch only contains cover values, so we
+			 * must descend it.
+			 */
+			node = container_of(eb_root_to_node(eb_untag(t, EB_RGHT)), struct ebmb_node, node);
+			if (node->node.bit > 0 && !(node->node.bit & 1))
+				return ebmb_entry(eb_walk_down(t, EB_LEFT), struct ebmb_node, node);
+		}
+
+		/* Note that <t> cannot be NULL at this stage */
+		t = node->node.node_p;
+
+		/* this is a node attached to a deeper (and possibly different)
+		 * leaf, not interesting for us.
+		 */
+		if (node->node.pfx >= start->node.pfx)
+			continue;
+
+		if (check_bits(start->key, node->key, 0, node->node.pfx) == 0)
+			break;
+	}
+	return node;
+}
+
 /* The following functions are less likely to be used directly, because their
  * code is larger. The non-inlined version is preferred.
  */
diff --git a/reg-tests/cache/if-modified-since.vtc b/reg-tests/cache/if-modified-since.vtc
index 8ae1cce..387fc7e 100644
--- a/reg-tests/cache/if-modified-since.vtc
+++ b/reg-tests/cache/if-modified-since.vtc
@@ -62,6 +62,10 @@ haproxy h1 -conf {
                server www ${s1_addr}:${s1_port}
                http-response cache-store my_cache
 
+               # Remove Transfer-Encoding header because of a vtest issue with
+               # 304-Not-Modified responses
+               http-after-response del-header transfer-encoding if { status eq 304 }
+
        cache my_cache
                total-max-size 3
                max-age 20
@@ -149,4 +153,3 @@ client c1 -connect ${h1_fe_sock} {
        expect resp.bodylen == 0
 
 } -run
-
diff --git a/reg-tests/cache/if-none-match.vtc b/reg-tests/cache/if-none-match.vtc
index ba3336a..bc7d67b 100644
--- a/reg-tests/cache/if-none-match.vtc
+++ b/reg-tests/cache/if-none-match.vtc
@@ -47,6 +47,10 @@ haproxy h1 -conf {
                server www ${s1_addr}:${s1_port}
                http-response cache-store my_cache
 
+               # Remove Transfer-Encoding header because of a vtest issue with
+               # 304-Not-Modified responses
+               http-after-response del-header transfer-encoding if { status eq 304 }
+
        cache my_cache
                total-max-size 3
                max-age 20
diff --git a/reg-tests/checks/4be_1srv_smtpchk_httpchk_layer47errors.vtc b/reg-tests/checks/4be_1srv_smtpchk_httpchk_layer47errors.vtc
index f9f37a1..ea72701 100644
--- a/reg-tests/checks/4be_1srv_smtpchk_httpchk_layer47errors.vtc
+++ b/reg-tests/checks/4be_1srv_smtpchk_httpchk_layer47errors.vtc
@@ -8,7 +8,7 @@ barrier b cond 3
 
 syslog S1 -level notice {
     recv
-    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/srv1 succeeded.+reason: Layer7 check passed.+code: 2(20|48).+check duration: [[:digit:]]+ms.+status: 1/1 UP."
+    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/srv1 succeeded.+reason: Layer7 check passed.+code: 221.+check duration: [[:digit:]]+ms.+status: 1/1 UP."
     barrier b sync
     recv
     expect ~ "Health check for server be1/srv1 failed.+reason: Layer7 timeout.+check duration: [[:digit:]]+ms.+status: 0/1 DOWN"
@@ -36,12 +36,17 @@ server s1 {
     send "2"
     send "2"
     send "0"
-    send "\r\n\r\n"
+    send "\r\n"
     recv 16
     send "2"
     send "4"
     send "8"
-    send "\r\n\r\n"
+    send "\r\n"
+    recv 6
+    send "2"
+    send "2"
+    send "1"
+    send " ok\r\n"
 } -start
 
 server s2 {
diff --git a/reg-tests/checks/pgsql-check.vtc b/reg-tests/checks/pgsql-check.vtc
index 968a18c..05c5a71 100644
--- a/reg-tests/checks/pgsql-check.vtc
+++ b/reg-tests/checks/pgsql-check.vtc
@@ -23,6 +23,11 @@ server s3 {
   send "Not a PostgreSQL response"
 } -start
 
+server s4 {
+  recv 23
+  sendhex "52000000170000000A534352414D2D5348412D3235360000"
+} -start
+
 syslog S1 -level notice {
     recv
     expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/srv succeeded, reason: Layer7 check passed.+info: \"PostgreSQL server is ok\".+check duration: [[:digit:]]+ms, status: 1/1 UP."
@@ -38,6 +43,10 @@ syslog S3 -level notice {
     expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be3/srv failed, reason: Layer7 wrong status.+info: \"PostgreSQL unknown error\".+check duration: [[:digit:]]+ms, status: 0/1 DOWN."
 } -start
 
+syslog S4 -level notice {
+    recv
+    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be4/srv succeeded, reason: Layer7 check passed.+info: \"PostgreSQL server is ok\".+check duration: [[:digit:]]+ms, status: 1/1 UP."
+} -start
 
 haproxy h1 -conf {
     defaults
@@ -64,6 +73,12 @@ haproxy h1 -conf {
         option pgsql-check user postgres
         server srv ${s3_addr}:${s3_port} check inter 1s rise 1 fall 1
 
+    backend be4
+        log ${S4_addr}:${S4_port} daemon
+        option log-health-checks
+        option pgsql-check user postgres
+        server srv ${s4_addr}:${s4_port} check inter 1s rise 1 fall 1
+
     listen pgsql1
         bind "fd@${pgsql}"
         tcp-request inspect-delay 100ms
@@ -75,3 +90,4 @@ haproxy h1 -conf {
 syslog S1 -wait
 syslog S2 -wait
 syslog S3 -wait
+syslog S4 -wait
diff --git a/reg-tests/checks/smtp-check.vtc b/reg-tests/checks/smtp-check.vtc
index 29d0ddb..9d8bb8a 100644
--- a/reg-tests/checks/smtp-check.vtc
+++ b/reg-tests/checks/smtp-check.vtc
@@ -10,6 +10,8 @@ server s1 {
   send "220 smtp-check.vtc SMTP Server\r\n"
   recv 16
   send "250 smtp-check.vtc\r\n"
+  recv 6
+  send "221 smtp-check.vtc closing\r\n"
 } -start
 
 server s2 {
@@ -18,6 +20,8 @@ server s2 {
   send "250-smtp-check.vtc\r\n"
   send "250-KEYWORD\r\n"
   send "250 LAST KEYWORD\r\n"
+  recv 6
+  send "221 smtp-check.vtc closing\r\n"
 } -start
 
 server s3 {
@@ -36,12 +40,12 @@ server s5 {
 
 syslog S1 -level notice {
     recv
-    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/srv succeeded, reason: Layer7 check passed.+code: 250.+info: \"smtp-check.vtc\".+check duration: [[:digit:]]+ms, status: 1/1 UP."
+    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/srv succeeded, reason: Layer7 check passed.+code: 221.+info: \"smtp-check.vtc closing\".+check duration: [[:digit:]]+ms, status: 1/1 UP."
 } -start
 
 syslog S2 -level notice {
     recv
-    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be2/srv succeeded, reason: Layer7 check passed.+code: 250.+info: \"smtp-check.vtc\".+check duration: [[:digit:]]+ms, status: 1/1 UP."
+    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be2/srv succeeded, reason: Layer7 check passed.+code: 221.+info: \"smtp-check.vtc closing\".+check duration: [[:digit:]]+ms, status: 1/1 UP."
 } -start
 
 syslog S3 -level notice {
diff --git a/reg-tests/contrib/prometheus.vtc b/reg-tests/contrib/prometheus.vtc
index ebe0b87..766db47 100644
--- a/reg-tests/contrib/prometheus.vtc
+++ b/reg-tests/contrib/prometheus.vtc
@@ -8,12 +8,12 @@ feature ignore_unknown_macro
 server s1 {
 	rxreq
 	txresp
-} -repeat 2 -start
+} -start
 
 server s2 {
 	rxreq
 	txresp
-} -repeat 2 -start
+}  -start
 
 haproxy h1 -conf {
     defaults
@@ -33,8 +33,9 @@ haproxy h1 -conf {
 
     backend be
 	stick-table type ip size 1m expire 10s store http_req_rate(10s)
+	option httpchk
 	server s1 ${s1_addr}:${s1_port}
-	server s2 ${s2_addr}:${s2_port} check maxqueue 10 maxconn 12 pool-max-conn 42
+	server s2 ${s2_addr}:${s2_port} check inter 5s maxqueue 10 maxconn 12 pool-max-conn 42
 } -start
 
 client c1 -connect ${h1_stats_sock} {
diff --git a/reg-tests/converter/digest.vtc b/reg-tests/converter/digest.vtc
index a14f1cc..511daca 100644
--- a/reg-tests/converter/digest.vtc
+++ b/reg-tests/converter/digest.vtc
@@ -7,7 +7,7 @@ feature ignore_unknown_macro
 
 server s1 {
 	rxreq
-	txresp
+	txresp -hdr "Connection: close"
 } -repeat 2 -start
 
 haproxy h1 -conf {
diff --git a/reg-tests/converter/hmac.vtc b/reg-tests/converter/hmac.vtc
index f9d9d35..391e04a 100644
--- a/reg-tests/converter/hmac.vtc
+++ b/reg-tests/converter/hmac.vtc
@@ -7,7 +7,7 @@ feature ignore_unknown_macro
 
 server s1 {
 	rxreq
-	txresp
+	txresp -hdr "Connection: close"
 } -repeat 2 -start
 
 haproxy h1 -conf {
diff --git a/reg-tests/converter/iif.vtc b/reg-tests/converter/iif.vtc
index 22414e0..3a6d6a6 100644
--- a/reg-tests/converter/iif.vtc
+++ b/reg-tests/converter/iif.vtc
@@ -5,7 +5,7 @@ feature ignore_unknown_macro
 
 server s1 {
 	rxreq
-	txresp
+	txresp -hdr "Connection: close"
 } -repeat 3 -start
 
 haproxy h1 -conf {
diff --git a/reg-tests/converter/json_query.vtc b/reg-tests/converter/json_query.vtc
index b420942..9db77eb 100644
--- a/reg-tests/converter/json_query.vtc
+++ b/reg-tests/converter/json_query.vtc
@@ -5,7 +5,7 @@ feature ignore_unknown_macro
 
 server s1 {
 	rxreq
-	txresp
+	txresp -hdr "Connection: close"
 } -repeat 8 -start
 
 haproxy h1 -conf {
diff --git a/reg-tests/http-messaging/h1_host_normalization.vtc b/reg-tests/http-messaging/h1_host_normalization.vtc
 new file mode 100644
index 0000000..6ea32d2
--- /dev/null
+++ b/reg-tests/http-messaging/h1_host_normalization.vtc
@@ -0,0 +1,276 @@
+varnishtest "H1 authority validation and host normalizarion based on the scheme (rfc3982 6.3.2) or the method (connect)"
+
+#REQUIRE_VERSION=2.4
+feature ignore_unknown_macro
+
+syslog S1 -level info {
+    # C1
+    recv
+    expect ~ "^.* uri: GET http://toto:poue@hostname/c1 HTTP/1.1; host: {hostname}$"
+
+    # C2
+    recv
+    expect ~ "^.* uri: GET http://hostname:8080/c2 HTTP/1.1; host: {hostname:8080}$"
+
+    # C3
+    recv
+    expect ~ "^.* uri: GET https://hostname/c3 HTTP/1.1; host: {hostname}$"
+
+    # C4
+    recv
+    expect ~ "^.* uri: GET https://hostname:80/c4 HTTP/1.1; host: {hostname:80}$"
+
+    # C5
+    recv
+    expect ~ "^.* uri: CONNECT hostname:80 HTTP/1.1; host: {hostname}$"
+    recv
+    expect ~ "^.* uri: CONNECT hostname:80 HTTP/1.1; host: {hostname}$"
+
+    # C6
+    recv
+    expect ~ "^.* uri: CONNECT hostname:443 HTTP/1.1; host: {hostname}$"
+    recv
+    expect ~ "^.* uri: CONNECT hostname:443 HTTP/1.1; host: {hostname}$"
+
+    recv
+    expect ~ "^.* uri: CONNECT hostname:8443 HTTP/1.1; host: {hostname:8443}$"
+} -start
+
+haproxy h1 -conf {
+    defaults
+        mode http
+        timeout connect 1s
+        timeout client  1s
+        timeout server  1s
+
+    frontend fe
+        bind "fd@${fe}"
+
+        http-request capture req.hdr(host) len 512
+        log-format "uri: %r; host: %hr"
+        log ${S1_addr}:${S1_port} len 2048 local0 debug err
+
+        http-request return status 200
+} -start
+
+# default port 80 with http scheme => should be normalized
+# Be sure userinfo are skipped
+client c1 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "http://toto:poue@hostname:80/c1" \
+      -hdr "host: hostname:80"
+
+    rxresp
+    expect resp.status == 200
+} -run
+
+# port 8080 with http scheme => no normalization
+client c2 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "http://hostname:8080/c2" \
+      -hdr "host: hostname:8080"
+
+    rxresp
+    expect resp.status == 200
+} -run
+
+# default port 443 with https scheme => should be normalized
+client c3 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "https://hostname:443/c3" \
+      -hdr "host: hostname:443"
+
+    rxresp
+    expect resp.status == 200
+} -run
+
+# port 80 with https scheme => no normalization
+client c4 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "https://hostname:80/c4" \
+      -hdr "host: hostname:80"
+
+    rxresp
+    expect resp.status == 200
+} -run
+
+# CONNECT on port 80 => should be normalized
+client c5 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "hostname:80" \
+      -hdr "host: hostname:80"
+
+    rxresp
+    expect resp.status == 200
+} -run
+client c5 -connect ${h1_fe_sock} {
+
+    txreq \
+      -req "CONNECT" \
+      -url "hostname:80" \
+      -hdr "host: hostname"
+
+    rxresp
+    expect resp.status == 200
+} -run
+
+# CONNECT on port 443 => should be normalized
+client c6 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "hostname:443" \
+      -hdr "host: hostname:443"
+
+    rxresp
+    expect resp.status == 200
+} -run
+client c6 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "hostname:443" \
+      -hdr "host: hostname"
+
+    rxresp
+    expect resp.status == 200
+} -run
+
+# CONNECT on port non-default port => no normalization
+client c7 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "hostname:8443" \
+      -hdr "host: hostname:8443"
+
+    rxresp
+    expect resp.status == 200
+} -run
+
+# host miss-match => error
+client c8 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "http://hostname1/" \
+      -hdr "host: hostname2"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# port miss-match => error
+client c9 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "http://hostname:80/" \
+      -hdr "host: hostname:81"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# no host port with a non-default port in abs-uri  => error
+client c10 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "http://hostname:8080/" \
+      -hdr "host: hostname"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# non-default host port with a default in abs-uri  => error
+client c11 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "http://hostname/" \
+      -hdr "host: hostname:81"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# miss-match between host headers => error
+client c12 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "http://hostname1/" \
+      -hdr "host: hostname1" \
+      -hdr "host: hostname2"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# miss-match between host headers but with a normalization => error
+client c13 -connect ${h1_fe_sock} {
+    txreq \
+      -req "GET" \
+      -url "http://hostname1/" \
+      -hdr "host: hostname1:80" \
+      -hdr "host: hostname1"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# CONNECT authoriy without port => error
+client c14 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "hostname" \
+      -hdr "host: hostname"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# host miss-match with CONNECT => error
+client c15 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "hostname1:80" \
+      -hdr "host: hostname2:80"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# port miss-match with CONNECT => error
+client c16 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "hostname:80" \
+      -hdr "host: hostname:443"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# no host port with non-default port in CONNECT authority => error
+client c17 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "hostname:8080" \
+      -hdr "host: hostname"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+# no authority => error
+client c18 -connect ${h1_fe_sock} {
+    txreq \
+      -req "CONNECT" \
+      -url "/" \
+      -hdr "host: hostname"
+
+    rxresp
+    expect resp.status == 400
+} -run
+
+syslog S1 -wait
diff --git a/reg-tests/http-messaging/http_request_buffer.vtc b/reg-tests/http-messaging/http_request_buffer.vtc
index f1cec1a..e712e32 100644
--- a/reg-tests/http-messaging/http_request_buffer.vtc
+++ b/reg-tests/http-messaging/http_request_buffer.vtc
@@ -9,6 +9,8 @@ feature ignore_unknown_macro
 # thanks to "http-buffer-request". If this was the case, c2 client
 # could not connect to s1 server and this would lead to make this test fail.
 
+barrier b1 cond 2 -cyclic
+
 server s1 {
 	rxreq
 	expect req.bodylen == 257
@@ -23,11 +25,17 @@ server s1 {
 
 syslog S -level info {
 	recv
-	expect ~ "[^:\\[ ]*\\[[0-9]*\\]: .* .* fe1 fe1/<NOSRV> .* 408 .* - - cD-- .* .* \"GET /this-is-a-long-url-this-is-a-long-url-this-is-a-long-url-this-is-a-long-url-this-is-a-long-url-this-is-a-long-url-this-is-a-long-url HTTP/1\\.1\""
+	expect ~ "[^:\\[ ]*\\[[0-9]*\\]: .* .* fe1 fe1/<NOSRV> .* 408 .* - - cR-- .* .* \"GET /this-is-a-long-url-this-is-a-long-url-this-is-a-long-url-this-is-a-long-url-this-is-a-long-url-this-is-a-long-url-this-is-a-long-url HTTP/1\\.1\""
+	barrier b1 sync
+
 	recv
 	expect ~ "[^:\\[ ]*\\[[0-9]*\\]: .* .* fe1 be1/srv1 [0-9]*/[0-9]*/[0-9]*/[0-9]*/[0-9]* 200 .* - - ---- .* .* \"GET / HTTP/1\\.1\""
+	barrier b1 sync
+
 	recv
 	expect ~ "[^:\\[ ]*\\[[0-9]*\\]: .* .* fe2 be1/srv1 [0-9]*/[0-9]*/[0-9]*/[0-9]*/[0-9]* 200 .* - - ---- .* .* \"POST /1 HTTP/1\\.1\""
+	barrier b1 sync
+
 	recv
 	expect ~ "[^:\\[ ]*\\[[0-9]*\\]: .* .* fe2 be1/<NOSRV> [0-9]*/-1/-1/-1/[0-9]* -1 .* - - CR-- .* .* \"POST /2 HTTP/1\\.1\""
 } -start
@@ -88,6 +96,9 @@ client c1 -connect ${h1_fe1_sock} {
 	expect resp.status == 408
 } -run
 
+# Wait matching on log message
+barrier b1 sync
+
 # Payload is fully sent
 #   ==> Request must be sent to the server. A 200 must be received
 client c2 -connect ${h1_fe1_sock} {
@@ -96,6 +107,9 @@ client c2 -connect ${h1_fe1_sock} {
 	expect resp.status == 200
 } -run
 
+# Wait matching on log message
+barrier b1 sync
+
 # Payload is fully sent in 2 steps (with a small delay, smaller than the client
 # timeout) and splitted on a chunk size.
 #   ==> Request must be sent to the server. A 200 must be received
@@ -107,6 +121,9 @@ client c3 -connect ${h1_fe2_sock} {
 	expect resp.status == 200
 } -run
 
+# Wait matching on log message
+barrier b1 sync
+
 # Last CRLF of the request payload is missing but payload is sent in 2 steps
 # (with a small delay, smaller than the client timeout) and splitted on a chunk
 # size. The client aborts before sending the last CRLF.
diff --git a/reg-tests/http-rules/restrict_req_hdr_names.vtc b/reg-tests/http-rules/restrict_req_hdr_names.vtc
index 57bc7e1..b493c84 100644
--- a/reg-tests/http-rules/restrict_req_hdr_names.vtc
+++ b/reg-tests/http-rules/restrict_req_hdr_names.vtc
@@ -35,6 +35,32 @@ server s5 {
     txresp
 } -start
 
+server s6 {
+    rxreq
+    expect req.http.x_my_hdr_with_lots_of_underscores  == <undef>
+    txresp
+} -start
+
+server s7 {
+    rxreq
+    expect req.http.x_my_hdr-1  == <undef>
+    expect req.http.x-my-hdr-2  == on
+    txresp
+} -start
+
+server s8 {
+    rxreq
+    expect req.http.x-my_hdr-1  == <undef>
+    expect req.http.x-my_hdr-2  == <undef>
+    txresp
+} -start
+
+server s9 {
+    rxreq
+    expect req.http.x-my-hdr-with-trailing-underscore_  == <undef>
+    txresp
+} -start
+
 haproxy h1 -conf {
     defaults
         mode http
@@ -50,6 +76,10 @@ haproxy h1 -conf {
         use_backend be-fcgi1 if { path /req4 }
         use_backend be-fcgi2 if { path /req5 }
         use_backend be-fcgi3 if { path /req6 }
+        use_backend be-http4 if { path /req7 }
+        use_backend be-http5 if { path /req8 }
+        use_backend be-http6 if { path /req9 }
+        use_backend be-http7 if { path /req10 }
 
     backend be-http1
         server s1 ${s1_addr}:${s1_port}
@@ -72,6 +102,22 @@ haproxy h1 -conf {
     backend be-fcgi3
         option http-restrict-req-hdr-names reject
 
+    backend be-http4
+        option http-restrict-req-hdr-names delete
+        server s6 ${s6_addr}:${s6_port}
+
+    backend be-http5
+        option http-restrict-req-hdr-names delete
+        server s7 ${s7_addr}:${s7_port}
+
+    backend be-http6
+        option http-restrict-req-hdr-names delete
+        server s8 ${s8_addr}:${s8_port}
+
+    backend be-http7
+        option http-restrict-req-hdr-names delete
+        server s9 ${s9_addr}:${s9_port}
+
     defaults
         mode http
         timeout connect 1s
@@ -114,6 +160,22 @@ client c1 -connect ${h1_fe1_sock} {
     txreq -req GET -url /req6 -hdr "X-my_hdr: on"
     rxresp
     expect resp.status == 403
+
+    txreq -req GET -url /req7 -hdr "X_my_hdr_with_lots_of_underscores: on"
+    rxresp
+    expect resp.status == 200
+
+    txreq -req GET -url /req8 -hdr "X_my_hdr-1: on" -hdr "X-my-hdr-2: on"
+    rxresp
+    expect resp.status == 200
+
+    txreq -req GET -url /req9 -hdr "X-my_hdr-1: on" -hdr "X-my_hdr-2: on"
+    rxresp
+    expect resp.status == 200
+
+    txreq -req GET -url /req10 -hdr "X-my-hdr-with-trailing-underscore_: on"
+    rxresp
+    expect resp.status == 200
 } -run
 
 client c2 -connect ${h1_fe2_sock} {
diff --git a/reg-tests/log/log_forward.vtc b/reg-tests/log/log_forward.vtc
 new file mode 100644
index 0000000..3977f4c
--- /dev/null
+++ b/reg-tests/log/log_forward.vtc
@@ -0,0 +1,57 @@
+varnishtest "Test the TCP load-forward"
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.3-dev1)'"
+feature ignore_unknown_macro
+
+server s1 {
+    rxreq
+	txresp
+} -repeat 500 -start
+
+syslog Slg1 -level info {
+    recv
+    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: .* \"GET /client_c1 HTTP/1.1\""
+} -repeat 50 -start
+
+haproxy h1 -conf {
+	defaults
+		mode http
+		option httplog
+		timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+	frontend fe1
+		bind "fd@${fe_1}"
+		log 127.0.0.1:1514 local0
+#		log ${Slg1_addr}:${Slg1_port} local0
+		default_backend be
+
+	backend be
+		server app1 ${s1_addr}:${s1_port}
+
+	ring myring
+		description "My local buffer"
+		format rfc5424
+		maxlen 1200
+		size 32764
+		timeout connect 5s
+		timeout server 10s
+		# syslog tcp server
+		server mysyslogsrv 127.0.0.1:2514
+
+	log-forward syslog2tcp
+		dgram-bind 127.0.0.1:1514
+		log ring@myring local0 # To TCP log
+
+	log-forward syslog2local
+		bind 127.0.0.1:2514
+		log ${Slg1_addr}:${Slg1_port} local0 # To VTest syslog
+} -start
+
+client c1 -connect ${h1_fe_1_sock} {
+    txreq -url "/client_c1"
+    rxresp
+    expect resp.status == 200
+} -repeat 50 -start
+
+syslog Slg1 -wait
diff --git a/reg-tests/mailers/healthcheckmail.vtc b/reg-tests/mailers/healthcheckmail.vtc
index 43bf588..d36a0d3 100644
--- a/reg-tests/mailers/healthcheckmail.vtc
+++ b/reg-tests/mailers/healthcheckmail.vtc
@@ -5,7 +5,7 @@ feature ignore_unknown_macro
 
 syslog S1 -level notice {
     recv
-    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/srv1 failed.+reason: Socket error.+info: \".+\".+check duration: [[:digit:]]+ms.+status: 0/1 DOWN."
+    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Health check for server be1/srv1 failed.+check duration: [[:digit:]]+ms.+status: 0/1 DOWN."
     recv info
     expect ~ "[^:\\[ ]\\[${h1_pid}\\]: Result=SUCCESS Bytes=[[:digit:]]+"
 } -start
diff --git a/reg-tests/ssl/log_forward_ssl.vtc b/reg-tests/ssl/log_forward_ssl.vtc
 new file mode 100644
index 0000000..6b7515b
--- /dev/null
+++ b/reg-tests/ssl/log_forward_ssl.vtc
@@ -0,0 +1,60 @@
+varnishtest "Test the TCP+SSL load-forward"
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.3-dev1)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
+feature ignore_unknown_macro
+
+server s1 {
+    rxreq
+	txresp
+} -repeat 500 -start
+
+syslog Slg1 -level info {
+    recv
+    expect ~ "[^:\\[ ]\\[${h1_pid}\\]: .* \"GET /client_c1 HTTP/1.1\""
+} -repeat 50 -start
+
+haproxy h1 -conf {
+	global
+		insecure-fork-wanted
+	defaults
+		mode http
+		option httplog
+		timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+		timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+	frontend fe1
+		bind "fd@${fe_1}"
+		log 127.0.0.1:1514 local0
+#		log ${Slg1_addr}:${Slg1_port} local0
+		default_backend be
+
+	backend be
+		server app1 ${s1_addr}:${s1_port}
+
+	ring myring
+		description "My local buffer"
+		format rfc5424
+		maxlen 1200
+		size 32764
+		timeout connect 5s
+		timeout server 10s
+		# syslog tcp server
+		server mysyslogsrv 127.0.0.1:2514 ssl verify none
+
+	log-forward syslog2tcp
+		dgram-bind 127.0.0.1:1514
+		log ring@myring local0 # To TCP log
+
+	log-forward syslog2local
+		bind 127.0.0.1:2514 ssl crt ${testdir}/common.pem
+		log ${Slg1_addr}:${Slg1_port} local0 # To VTest syslog
+} -start
+
+client c1 -connect ${h1_fe_1_sock} {
+    txreq -url "/client_c1"
+    rxresp
+    expect resp.status == 200
+} -repeat 50 -start
+
+syslog Slg1 -wait
diff --git a/reg-tests/startup/automatic_maxconn.vtc b/reg-tests/startup/automatic_maxconn.vtc
 new file mode 100644
index 0000000..686a5c5
--- /dev/null
+++ b/reg-tests/startup/automatic_maxconn.vtc
@@ -0,0 +1,102 @@
+#REGTEST_TYPE=broken
+#REQUIRE_VERSION=2.2
+#REQUIRE_OPTION=OPENSSL
+
+# Check the maxconn computation with the -m parameter
+# Broken because it can't work with ASAN.
+
+varnishtest "Automatic maxconn computation"
+
+
+feature ignore_unknown_macro
+
+server s1 {
+    rxreq
+    txresp
+} -start
+
+
+haproxy h1 -arg "-m 1024" -conf {
+} -start
+
+haproxy h1 -cli {
+	send "show info"
+	expect ~ ".*Maxconn: 29000\n.*"
+}
+
+haproxy h2 -arg "-m 384" -conf {
+} -start
+
+haproxy h2 -cli {
+	send "show info"
+	expect ~ ".*Maxconn: 10000\n.*"
+}
+
+haproxy h3 -arg "-m 256" -conf {
+} -start
+
+haproxy h3 -cli {
+	send "show info"
+	expect ~ ".*Maxconn: 7300\n.*"
+}
+
+# 1 SSL front but no back
+
+haproxy h4 -arg "-m 256" -conf {
+	defaults
+		mode http
+		timeout connect 1s
+		timeout client  1s
+		timeout server  1s
+
+	frontend fe1
+		bind "fd@${fe1}" ssl crt ${testdir}/common.pem
+
+} -start
+
+haproxy h4 -cli {
+	send "show info"
+	expect ~ ".*Maxconn: 1900\n.*"
+}
+
+# 1 SSL back but not front
+
+haproxy h5 -arg "-m 256" -conf {
+	defaults
+		mode http
+		timeout connect 1s
+		timeout client  1s
+		timeout server  1s
+
+	listen li2
+		bind "fd@${li2}"
+		server ssl "${s1_addr}:${s1_port}" ssl verify none
+
+} -start
+
+haproxy h5 -cli {
+	send "show info"
+	expect ~ ".*Maxconn: 1900\n.*"
+}
+
+
+# 1 SSL front and 1 back
+
+haproxy h6 -arg "-m 256" -conf {
+	defaults
+		mode http
+		timeout connect 1s
+		timeout client  1s
+		timeout server  1s
+
+	listen li3
+		bind "fd@${li3}" ssl crt ${testdir}/common.pem
+		server ssl "${s1_addr}:${s1_port}" ssl verify none
+
+} -start
+
+haproxy h6 -cli {
+	send "show info"
+	expect ~ ".*Maxconn: 1700\n.*"
+}
+
diff --git a/reg-tests/startup/common.pem b/reg-tests/startup/common.pem
 new file mode 100644
index 0000000..206e417
--- /dev/null
+++ b/reg-tests/startup/common.pem
@@ -0,0 +1,117 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAnb0BDF7FsqzslakNg7u/n/JQkq6nheuKwvyTqECfpc9y7uSB
+e/vrEFqBaDSLQagJxuZdL5geFeVtRbdAoB97N1/LZa6vecjjgGSP0Aag/gS/ocnM
+RIyvlVWWT9MrD46OG3qZY1ORU1ltrVL0NKttJP8xME7j3bTwIDElx/hNI0n7L+yS
+kAe2xb/7CbZRfoOhjTVAcGv4aSLVc/Hi8k6VkIzdOEtH6TcghXmuGcuqvLNH9Buo
+syngKTcQ8zg6J+e64aVvC+e7vi94uil9Qu+JHm0pkDzAZ2WluNsuXlrJToPirWyj
+6/YdN6xgSI1hbZkBmUPAebgYuxBt6huvfyQd3wIDAQABAoIBABojc8UE/2W4WgwC
+04Z82ig7Ezb7Ui9S9M+S4zUCYHItijIkE4DkIfO3y7Hk4x6iJdyb191HK9UdC5p9
+32upS9XFPgM/izx3GZvxDhO+xXbSep7ovbyuQ3pPkHTx3TTavpm3GyvmcTKKoy4R
+jP4dWhzDXPdQW1ol3ZS4EDau4rlyClY6oi1mq9aBEX3MqVjB/nO7s2AbdgclAgP2
+OZMhTzWYR1k5tYySHCXh3ggGMCikyvHU0+SsGyrstYzP1VYi/n3f0VgqW/5ZjG8x
+6SHpe04unErPF3HuSun2ZMCFdBxaTFZ8FENb8evrSXe3nQOc9W21RQdRRrNNUbjl
+JYI4veECgYEA0ATYKMS1VCUYRZoQ49b5GTg7avUYqfW4bEo4fSfBue8NrnKR3Wu8
+PPBiCTuIYq1vSF+60B7Vu+hW0A8OuQ2UuMxLpYcQ7lKfNad/+yAfoWWafIqCqNU9
+at0QMdbW6A69d6jZt7OrXtleBsphCnN58jTz4ch4PIa2Oyq46NUXCvUCgYEAwh8t
+G6BOHOs3yRNI2s9Y9EEfwoil2uIKrZhqiL3AwdIpu5uNIMuPnbaEpXvRX6jv/qtL
+321i8vZLc31aM7zfxQ6B4ReQFJfYC80FJsWvcLwT9hB9mTJpLS4sIu5tzQc87O6w
+RtjFMom+5ns5hfPB4Eccy0EtbQWVY4nCzUeO6QMCgYBSvqqRRPXwG7VU8lznlHqP
+upuABzChYrnScY+Y0TixUlL54l79Wb6N6vzEOWceAWkzu8iewrU4QspNhr/PgoR3
+IeSxWlG0yy7Dc/ZnmTabx8O06I/iwrfkizzG5nOj6UEamRLJjPGNEB/jyZriQl7u
+pnugg1K4mMliLbNSAnlhBQKBgQCmYepbv260Qrex1KGhSg9Ia3k5V74weYYFfJnz
+UhChD+1NK+ourcsOtp3C6PlwMHBjq5aAjlU9QfUxq8NgjQaO8/xGXdfUjsFSfAtq
+TA4vZkUFpuTAJgEYBHc4CXx7OzTxLzRPxQRgaMgC7KNFOMR34vu/CsJQq3R7uFwL
+bsYC2QKBgQCtEmg1uDZVdByX9zyUMuRxz5Tq/vDcp+A5lJj2mha1+bUMaKX2+lxQ
+vPxY55Vaw/ukWkJirRrpGv6IytBn0dLAFSlKZworZGBaxsm8OGTFJ5Oe9+kZTjI9
+hvjpClOA1otbmj2F2uZAbuIjxQGDNUkLoifN5yDYCC8JPujHuHmULw==
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIGeTCCBGGgAwIBAgIBAjANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJGUjEW
+MBQGA1UECBMNSWxlLWRlLUZyYW5jZTEOMAwGA1UEBxMFUGFyaXMxEDAOBgNVBAoT
+B296b24uaW8xFTATBgNVBAMTDE96b24gVGVzdCBDQTEeMBwGCSqGSIb3DQEJARYP
+c3VwcG9ydEBvem9uLmlvMB4XDTE2MDExNzIzMDIzOFoXDTE4MDExNjIzMDIzOFow
+gb4xCzAJBgNVBAYTAkZSMRYwFAYDVQQIEw1JbGUtZGUtRnJhbmNlMRowGAYDVQQH
+ExFOZXVpbGx5LXN1ci1TZWluZTEYMBYGA1UEChMPVE9BRCBDb25zdWx0aW5nMRcw
+FQYDVQQLEw5lUGFyYXBoZXIgVGVhbTEWMBQGA1UEAxMNd3d3LnRlc3QxLmNvbTEw
+MC4GCSqGSIb3DQEJARYhYXJuYXVsdC5taWNoZWxAdG9hZC1jb25zdWx0aW5nLmZy
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnb0BDF7FsqzslakNg7u/
+n/JQkq6nheuKwvyTqECfpc9y7uSBe/vrEFqBaDSLQagJxuZdL5geFeVtRbdAoB97
+N1/LZa6vecjjgGSP0Aag/gS/ocnMRIyvlVWWT9MrD46OG3qZY1ORU1ltrVL0NKtt
+JP8xME7j3bTwIDElx/hNI0n7L+ySkAe2xb/7CbZRfoOhjTVAcGv4aSLVc/Hi8k6V
+kIzdOEtH6TcghXmuGcuqvLNH9BuosyngKTcQ8zg6J+e64aVvC+e7vi94uil9Qu+J
+Hm0pkDzAZ2WluNsuXlrJToPirWyj6/YdN6xgSI1hbZkBmUPAebgYuxBt6huvfyQd
+3wIDAQABo4IBvzCCAbswCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMB
+MB0GA1UdDgQWBBTIihFNVNgOseQnsWEcAQxAbIKE4TCBsgYDVR0jBIGqMIGngBRv
+G9At9gzk2MW5Z7JVey1LtPIZ8KGBg6SBgDB+MQswCQYDVQQGEwJGUjEWMBQGA1UE
+CBMNSWxlLWRlLUZyYW5jZTEOMAwGA1UEBxMFUGFyaXMxEDAOBgNVBAoTB296b24u
+aW8xFTATBgNVBAMTDE96b24gVGVzdCBDQTEeMBwGCSqGSIb3DQEJARYPc3VwcG9y
+dEBvem9uLmlvggkA15FtIaGcrk8wDAYDVR0TAQH/BAIwADAaBgNVHREEEzARgg9j
+b21tb25OYW1lOmNvcHkwCQYDVR0SBAIwADBIBgNVHR8EQTA/MD2gO6A5hjdodHRw
+Oi8vb3BlbnNzbGNhLnRvYWQtY29uc3VsdGluZy5jb20vb3BlbnZwbi9MYXRlc3Qu
+Y3JsMBEGCWCGSAGG+EIBAQQEAwIGQDAxBglghkgBhvhCAQ0EJBYiVE9BRC1Db25z
+dWx0aW5nIHNlcnZlciBjZXJ0aWZpY2F0ZTANBgkqhkiG9w0BAQsFAAOCAgEAewDa
+9BukGNJMex8gsXmmdaczTr8yh9Uvw4NJcZS38I+26o//2g+d6i7wxcQg8hIm62Hj
+0TblGU3+RsJo4uzcWxxA5YUYlVszbHNBRpQengEE5pjwHvoXVMNES6Bt8xP04+Vj
+0qVnA8gUaDMk9lN5anK7tF/mbHOIJwHJZYCa2t3y95dIOVEXFwOIzzbSbaprjkLN
+w0BgR5paJz7NZWNqo4sZHUUz94uH2bPEd01SqHO0dJwEVxadgxuPnD05I9gqGpGX
+Zf3Rn7EQylvUtX9mpPaulQPXc3emefewLUSSAdnZrVikZK2J/B4lSi9FpUwl4iQH
+pZoE0QLQHtB1SBKacnOAddGSTLSdFvpzjErjjWSpMukF0vutmrP86GG3xtshWVhI
+u+yLfDJVm/pXfaeDtWMXpxIT/U1i0avpk5MZtFMRC0MTaxEWBTnnJm+/yiaAXQYg
+E1ZIP0mkZkiUojIawTR7JTjHGhIraP9UVPNceVy0DLfETHEou3vhwBn7PFOz7piJ
+wjp3A47DStJD4fapaX6B1fqM+n34CMD9ZAiJFgQEIQfObAWC9hyr4m+pqkp1Qfuw
+vsAP/ZoS1CBirJfm3i+Gshh+VeH+TAmO/NBBYCfzBdgkNz4tJCkOc7CUT/NQTR/L
+N2OskR/Fkge149RJi7hHvE3gk/mtGtNmHJPuQ+s=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIJazCCBVOgAwIBAgIUWHoc5e2FUECgyCvyVf8wCtt8gTYwDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCRlIxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDA4MDQxODU4MTZaFw0yMDA5
+MDMxODU4MTZaMEUxCzAJBgNVBAYTAkZSMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggQiMA0GCSqGSIb3DQEB
+AQUAA4IEDwAwggQKAoIEAQDARiuHkhrnf38Md1nxGDSneJfwv/QksdNNMNTJBdjg
+OVmaRCIAyz43oefTWDQ/TebbSwB+Lg9pud1zadGWhlZRhCgBPP8JDMhIKH4eXIRk
+5IIa8WD08EwvSlqJL0r4gsMtVsxy7BZHAkka/2Ket9pyGt4kG5n75RFdc6BI80/8
+RwJt/MDxPrcVBAT7LnCluxQpyya9mZCabj7l+9a2yU2hgWS6QqfZJ133krkP/MMh
+AEQkSoA4mmBwWk9yPqXmUqiOi7v6iLkIUEh5SgYVPRk9BtU/kDaUdSwuqRrpCZo4
+SsWZWFLxBmLHkSh+G+BWjCVYMQr2ye7e+VMT/20+5xAfq4fj9n5BsPcx3QcVuTof
+RAc/Oygnt4MYnIcUb7zRFvCAvgpUHL7BnEn6nhyXjHJGqGDchsg8m9t3v/Y3ohq+
+qmrSzdeuylE1n3W5aWJlbFmyXegNP45MJ0xicesVrXEWF7YD/ir9mGJ8bQYr4blf
+77PrbF02komC6AzVPKOJa0jR+eW1wErzYlkYgez6ylBWCiHJd1dhEHlK3h2rXdYa
+Gnb45ILCLpEDjNEUrHifLLNXwqJpgZQsJU6BgMgk7ZgBfAKrCfTeg0rkCqCAPeVb
+8eSLf7FBF7YBRJ5P6u8qXc4RtgEu607GaWV0gIMfyVBY52oV+OaNsEdFetrJnp3c
+friG8vJ+7jdq6zjUCGgnfUIHoViJPh3JuFfhA3jT0gQDKW5PeI7dxhrNvlqdYfHI
+fxX7Y1/J6cTQkqJ1cai2f0bwJIJiTAThNbG+zrtjJ7fZ3wJ4udyU/IKrwShqtmTb
+1Ofj0tJDdwOH8i84vIySLUvR9aAb7ClFlnsx6rzwOxG90W7C0LA2M0EHm4FezJm/
+FfujnZwEWr1T9Wki6qE0MHCbdN/TTDws//EKkkE44FC+amL96w0IQl70vpE37j2A
+zlDWvFFID95SIxfmpkwWDvXDKv6gr1GMLeysCl2fgpY05Xidw5cEo9/tEkuWn/dG
+x/D9hnLBGeroA0251ES12jemqDjI2U0tfaeHakjwSsoWElf94Qmuh2iPZ+1zIxQs
+7o6nAWN8X9hfsmrDTTHlww0TEfrjlbzG5Yh+0ZRxmejgiUyOCXck+eh/ZXMXvfWh
+y3CorIIuWgkRjm80PYkdaRDJdZuyP6R7tXfTXNVzAiSQf0Qx9ru2KB2Fs/XZPamH
+KjItAU5Q6msIVvaRMS0muQgV+b6hqSEBzqXqJfAlpVLHXr5FqK+U7EB9y02B6piB
+tAmxqXP8OOCoQql6/vgIcrDFUOo6KtGBW36ef74XE3KCUVaIzVJZSIt6i/Vi0bZj
+bAjsJUQ3qDlHdorv9TRVOhnC1GUz7SuYnpEOyiXmyx3LAgMBAAGjUzBRMB0GA1Ud
+DgQWBBQ62csZcH/meQcENHhNbqz9LMzwjjAfBgNVHSMEGDAWgBQ62csZcH/meQcE
+NHhNbqz9LMzwjjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IEAQBA
+wLsGf3R1+/I2zQE+lsj7RasZtA/Cos92iEGDAPvFbx9e+roG8Gg8KBsEJu/HN0JH
+lMMiQ8dDRHSBMvRBENL5/57oOOhmqc+1u5sazLuANhzAYPZG17Klib7YpEwWoXar
+FDDiJYtCyLW0oNLpCswYopWK9GC0RJNucB0NFvOxehJ2sP2/fxGBQMB09L6mjKjd
+4KsOzyd3dNf0VYS6jB+/1pcKSHKQUo9HRHB5FK04PsYHoh4AtmEHvmYQKcWWidgU
+v26ftlH00ERzuW2juqBbz9mghlNRqXi0IyZ9b4tSj29dxW+WWFzo7j2zEPaD6z2W
+DEHq7zvON+g+q6qLgWeszqMgJzjvWjMj00E/t06PoHPiz/cAnDKEqp+ZzxCIFrxj
+/qneChpogDWyLbawhyyzbZvbirx5znOSbWjPZgydqaNEFViqbxwinBx4Xxabo6XN
+TU020FuMWmgfbIcvtgjKgyKqc97l7JMNNm7LQV9+9W0U5zdIqQKLZ9MMrd2w3xh4
+MAB8NKnwzHReK0TWwUU9HSgFAGdEX6HnyZ3bQ13ijg+sNBRMEi0gBHaqZKDdyoft
+B2u2uasSwioV48dbSIcHl+rTBKxiMh5XQ7ENnaGOJkjsIqTVzizqnPHU8eMBnSbb
+dsXlamROYII44+j3Ku6OGt51w86eGk4VxI3tmaECcJKqTkwUFD8AcNDrkjtmLuxK
+12yjnoM+u1cclfqQ5NOtRc6MJZ27jCobfBBhVdKVDp4X1WNyqGlbsU5adDAzknuI
+GT7MJO7lGjkZX2n54BNPSfrSknYMOVYcZqL0Dbcrhx5IyEmg+iOlOu1HO1tdnZop
+ej4vT+1V2w9Sa4Wo3UCo84jcm5v/4z7jCYh4BRQ60CFb7GLxZoqXIslcGSPool3n
+jl8JWoaLXrJUPfZGXo1iAlayJ5EiMyZl4eB/TBUf6TMm8vLvsPiUT+CEsjLppOdS
+eYppZAZ6H1JrJGs5kKBdOJHGn6Pkp5QsHIswOBd1HqHrBbYbZmDaDLRHduILWLrM
+e0/IfDdeXB/bKfmZoEpT8xRiauw15p0AHLumiK7KISAehfgBqUnxx+YmgGoZ7EWX
+KnMYAfCuC6oJ1DL0gp4Z9yMK1eu+GV1sLxPq9ZruEHW1R+H+4sGyiA5Gso2tgB6/
+XW//wxKclNp5LZR7hqfs/kGuh5asrJrnEbMwWn2+tr/LqfYtYh1D6nHfIXpT0o1d
+rNy/HrsKnRDMWxjm03r4hCViuNVD3Zb9anAF/NSPDVu8ATM5JbJNrCYX4eipz6ZE
+aQBkwIBkTPgtgP4r8v2G+uMYDw8nq7xh72FK107aeTTwc6MgU5jfeFNMr2XJisJd
+lSem1ngKYQSEzjVsTE4c
+-----END CERTIFICATE-----
diff --git a/scripts/announce-release b/scripts/announce-release
index 37e2ac4..c990821 100755
--- a/scripts/announce-release
+++ b/scripts/announce-release
@@ -210,20 +210,21 @@ else
 fi
 
 (echo "Please find the usual URLs below :"
- echo "   Site index       : http://www.haproxy.org/"
- echo "   Documentation    : http://docs.haproxy.org/"
+ echo "   Site index       : https://www.haproxy.org/"
+ echo "   Documentation    : https://docs.haproxy.org/"
  echo "   Wiki             : https://github.com/haproxy/wiki/wiki"
- echo "   Discourse        : http://discourse.haproxy.org/"
+ echo "   Discourse        : https://discourse.haproxy.org/"
  echo "   Slack channel    : https://slack.haproxy.org/"
  echo "   Issue tracker    : https://github.com/haproxy/haproxy/issues"
- echo "   Sources          : http://www.haproxy.org/download/${BRANCH}/src/"
- echo "   Git repository   : http://git.haproxy.org/git/${gitdir}/"
- echo "   Git Web browsing : http://git.haproxy.org/?p=${gitdir}"
- echo "   Changelog        : http://www.haproxy.org/download/${BRANCH}/src/CHANGELOG"
- echo "   Pending bugs     : http://www.haproxy.org/l/pending-bugs"
- echo "   Reviewed bugs    : http://www.haproxy.org/l/reviewed-bugs"
- echo "   Code reports     : http://www.haproxy.org/l/code-reports"
- echo "   Latest builds    : http://www.haproxy.org/l/dev-packages"
+ echo "   Sources          : https://www.haproxy.org/download/${BRANCH}/src/"
+ echo "   Git repository   : https://git.haproxy.org/git/${gitdir}/"
+ echo "   Git Web browsing : https://git.haproxy.org/?p=${gitdir}"
+ echo "   Changelog        : https://www.haproxy.org/download/${BRANCH}/src/CHANGELOG"
+ echo "   Dataplane API    : https://github.com/haproxytech/dataplaneapi/releases/latest"
+ echo "   Pending bugs     : https://www.haproxy.org/l/pending-bugs"
+ echo "   Reviewed bugs    : https://www.haproxy.org/l/reviewed-bugs"
+ echo "   Code reports     : https://www.haproxy.org/l/code-reports"
+ echo "   Latest builds    : https://www.haproxy.org/l/dev-packages"
 ) >> "$OUTPUT"
 
 # sign
diff --git a/src/backend.c b/src/backend.c
index 6f2cc05..64780e4 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -2326,7 +2326,6 @@ void back_handle_st_cer(struct stream *s)
 
 		/* only wait when we're retrying on the same server */
 		if ((si->state == SI_ST_ASS ||
-		     (s->be->lbprm.algo & BE_LB_KIND) != BE_LB_KIND_RR ||
 		     (s->be->srv_act <= 1)) && !reused) {
 			si->state = SI_ST_TAR;
 			si->exp = tick_add(now_ms, MS_TO_TICKS(delay));
diff --git a/src/cache.c b/src/cache.c
index ad4e715..ecf62fb 100644
--- a/src/cache.c
+++ b/src/cache.c
@@ -136,7 +136,7 @@ struct cache_st {
 struct cache_entry {
 	unsigned int complete;    /* An entry won't be valid until complete is not null. */
 	unsigned int latest_validation;     /* latest validation date */
-	unsigned int expire;      /* expiration date */
+	unsigned int expire;      /* expiration date (wall clock time) */
 	unsigned int age;         /* Origin server "Age" header value */
 
 	struct eb32_node eb;     /* ebtree node used to hold the cache object */
@@ -188,7 +188,7 @@ struct cache_entry *entry_exist(struct cache *cache, char *hash)
 	if (memcmp(entry->hash, hash, sizeof(entry->hash)))
 		return NULL;
 
-	if (entry->expire > now.tv_sec) {
+	if (entry->expire > date.tv_sec) {
 		return entry;
 	} else {
 		delete_entry(entry);
@@ -249,7 +249,7 @@ struct cache_entry *secondary_entry_exist(struct cache *cache, struct cache_entr
 		 * when we find them. Calling delete_entry would be too costly
 		 * so we simply call eb32_delete. The secondary_entry count will
 		 * be updated when we try to insert a new entry to this list. */
-		if (entry->expire <= now.tv_sec) {
+		if (entry->expire <= date.tv_sec) {
 			eb32_delete(&entry->eb);
 			entry->eb.key = 0;
 		}
@@ -258,7 +258,7 @@ struct cache_entry *secondary_entry_exist(struct cache *cache, struct cache_entr
 	}
 
 	/* Expired entry */
-	if (entry && entry->expire <= now.tv_sec) {
+	if (entry && entry->expire <= date.tv_sec) {
 		eb32_delete(&entry->eb);
 		entry->eb.key = 0;
 		entry = NULL;
@@ -283,7 +283,7 @@ static unsigned int clear_expired_duplicates(struct eb32_node **dup_tail)
 	while (prev) {
 		entry = container_of(prev, struct cache_entry, eb);
 		prev = eb32_prev_dup(prev);
-		if (entry->expire <= now.tv_sec) {
+		if (entry->expire <= date.tv_sec) {
 			eb32_delete(&entry->eb);
 			entry->eb.key = 0;
 		}
@@ -315,7 +315,7 @@ static struct eb32_node *insert_entry(struct cache *cache, struct cache_entry *n
 	struct eb32_node *prev = NULL;
 	struct cache_entry *entry = NULL;
 	unsigned int entry_count = 0;
-	unsigned int last_clear_ts = now.tv_sec;
+	unsigned int last_clear_ts = date.tv_sec;
 
 	struct eb32_node *node = eb32_insert(&cache->entries, &new_entry->eb);
 
@@ -338,7 +338,7 @@ static struct eb32_node *insert_entry(struct cache *cache, struct cache_entry *n
 			 * space. In order to avoid going over the same list too
 			 * often, we first check the timestamp of the last check
 			 * performed. */
-			if (last_clear_ts == now.tv_sec) {
+			if (last_clear_ts == date.tv_sec) {
 				/* Too many entries for this primary key, clear the
 				 * one that was inserted. */
 				eb32_delete(node);
@@ -351,7 +351,7 @@ static struct eb32_node *insert_entry(struct cache *cache, struct cache_entry *n
 				/* Still too many entries for this primary key, delete
 				 * the newly inserted one. */
 				entry = container_of(prev, struct cache_entry, eb);
-				entry->last_clear_ts = now.tv_sec;
+				entry->last_clear_ts = date.tv_sec;
 				eb32_delete(node);
 				node->key = 0;
 				return NULL;
@@ -811,8 +811,8 @@ int http_calc_maxage(struct stream *s, struct cache *cache, int *true_maxage)
 				/* A request having an expiring date earlier
 				 * than the current date should be considered as
 				 * stale. */
-				expires = (expires_val >= now.tv_sec) ?
-					(expires_val - now.tv_sec) : 0;
+				expires = (expires_val >= date.tv_sec) ?
+					(expires_val - date.tv_sec) : 0;
 			}
 			else {
 				/* Following RFC 7234#5.3, an invalid date
@@ -886,7 +886,7 @@ static time_t get_last_modified_time(struct htx *htx)
 	/* Fallback on the current time if no "Last-Modified" or "Date" header
 	 * was found. */
 	if (!last_modified)
-		last_modified = now.tv_sec;
+		last_modified = date.tv_sec;
 
 	return last_modified;
 }
@@ -1120,7 +1120,7 @@ enum act_return http_action_store_cache(struct act_rule *rule, struct proxy *px,
 	 * is set by the end of this function (in case of concurrent accesses to
 	 * the same resource). This way the second access will find an existing
 	 * but not yet usable entry in the tree and will avoid storing its data. */
-	object->expire = now.tv_sec + 2;
+	object->expire = date.tv_sec + 2;
 
 	memcpy(object->hash, txn->cache_hash, sizeof(object->hash));
 	if (vary_signature)
@@ -1224,8 +1224,8 @@ enum act_return http_action_store_cache(struct act_rule *rule, struct proxy *px,
 	if (cache_ctx) {
 		cache_ctx->first_block = first;
 		/* store latest value and expiration time */
-		object->latest_validation = now.tv_sec;
-		object->expire = now.tv_sec + effective_maxage;
+		object->latest_validation = date.tv_sec;
+		object->expire = date.tv_sec + effective_maxage;
 		return ACT_RET_CONT;
 	}
 
@@ -1416,7 +1416,7 @@ static int htx_cache_add_age_hdr(struct appctx *appctx, struct htx *htx)
 	char *end;
 
 	chunk_reset(&trash);
-	age = MAX(0, (int)(now.tv_sec - cache_ptr->latest_validation)) + cache_ptr->age;
+	age = MAX(0, (int)(date.tv_sec - cache_ptr->latest_validation)) + cache_ptr->age;
 	if (unlikely(age > CACHE_ENTRY_MAX_AGE))
 		age = CACHE_ENTRY_MAX_AGE;
 	end = ultoa_o(age, b_head(&trash), b_size(&trash));
@@ -2602,13 +2602,13 @@ static int cli_io_handler_show_cache(struct appctx *appctx)
 			entry = container_of(node, struct cache_entry, eb);
 			next_key = node->key + 1;
 
-			if (entry->expire > now.tv_sec) {
+			if (entry->expire > date.tv_sec) {
 				chunk_printf(&trash, "%p hash:%u vary:0x", entry, read_u32(entry->hash));
 				for (i = 0; i < HTTP_CACHE_SEC_KEY_LEN; ++i)
 					chunk_appendf(&trash, "%02x", (unsigned char)entry->secondary_key[i]);
 				chunk_appendf(&trash, " size:%u (%u blocks), refcount:%u, expire:%d\n",
 					      block_ptr(entry)->len, block_ptr(entry)->block_count,
-					      block_ptr(entry)->refcount, entry->expire - (int)now.tv_sec);
+					      block_ptr(entry)->refcount, entry->expire - (int)date.tv_sec);
 			} else {
 				/* time to remove that one */
 				delete_entry(entry);
diff --git a/src/cfgparse-listen.c b/src/cfgparse-listen.c
index 4603376..35bd498 100644
--- a/src/cfgparse-listen.c
+++ b/src/cfgparse-listen.c
@@ -292,6 +292,8 @@ int cfg_parse_listen(const char *file, int linenum, char **args, int kwm)
 			curr_defproxy = last_defproxy;
 
 		if (strcmp(args[arg], "from") == 0) {
+			struct ebpt_node *next_by_name;
+
 			curr_defproxy = proxy_find_by_name(args[arg+1], PR_CAP_DEF, 0);
 
 			if (!curr_defproxy) {
@@ -300,8 +302,8 @@ int cfg_parse_listen(const char *file, int linenum, char **args, int kwm)
 				goto out;
 			}
 
-			if (ebpt_next_dup(&curr_defproxy->conf.by_name)) {
-				struct proxy *px2 = container_of(ebpt_next_dup(&curr_defproxy->conf.by_name), struct proxy, conf.by_name);
+			if ((next_by_name = ebpt_next_dup(&curr_defproxy->conf.by_name))) {
+				struct proxy *px2 = container_of(next_by_name, struct proxy, conf.by_name);
 
 				ha_alert("parsing [%s:%d] : ambiguous defaults section name '%s' referenced by %s '%s' exists at least at %s:%d and %s:%d.\n",
 					 file, linenum, args[arg+1], proxy_cap_str(rc), name,
diff --git a/src/cfgparse-ssl.c b/src/cfgparse-ssl.c
index 654b020..fcd0416 100644
--- a/src/cfgparse-ssl.c
+++ b/src/cfgparse-ssl.c
@@ -758,7 +758,7 @@ static int bind_parse_ignore_err(char **args, int cur_arg, struct proxy *px, str
 {
 	int code;
 	char *p = args[cur_arg + 1];
-	unsigned long long *ignerr = &conf->crt_ignerr;
+	unsigned long long *ignerr = conf->crt_ignerr_bitfield;
 
 	if (!*p) {
 		memprintf(err, "'%s' : missing error IDs list", args[cur_arg]);
@@ -766,21 +766,21 @@ static int bind_parse_ignore_err(char **args, int cur_arg, struct proxy *px, str
 	}
 
 	if (strcmp(args[cur_arg], "ca-ignore-err") == 0)
-		ignerr = &conf->ca_ignerr;
+		ignerr = conf->ca_ignerr_bitfield;
 
 	if (strcmp(p, "all") == 0) {
-		*ignerr = ~0ULL;
+		cert_ignerr_bitfield_set_all(ignerr);
 		return 0;
 	}
 
 	while (p) {
 		code = atoi(p);
-		if ((code <= 0) || (code > 63)) {
-			memprintf(err, "'%s' : ID '%d' out of range (1..63) in error IDs list '%s'",
-			          args[cur_arg], code, args[cur_arg + 1]);
+		if ((code <= 0) || (code > SSL_MAX_VFY_ERROR_CODE)) {
+			memprintf(err, "'%s' : ID '%d' out of range (1..%d) in error IDs list '%s'",
+			          args[cur_arg], code, SSL_MAX_VFY_ERROR_CODE, args[cur_arg + 1]);
 			return ERR_ALERT | ERR_FATAL;
 		}
-		*ignerr |= 1ULL << code;
+		cert_ignerr_bitfield_set(ignerr, code);
 		p = strchr(p, ',');
 		if (p)
 			p++;
diff --git a/src/cfgparse.c b/src/cfgparse.c
index 4b42ec0..27bab1d 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -10,10 +10,10 @@
  *
  */
 
-#ifdef USE_LIBCRYPT
-/* This is to have crypt() defined on Linux */
+/* This is to have crypt() and sched_setaffinity() defined on Linux */
 #define _GNU_SOURCE
 
+#ifdef USE_LIBCRYPT
 #ifdef USE_CRYPT_H
 /* some platforms such as Solaris need this */
 #include <crypt.h>
@@ -29,6 +29,9 @@
 #include <pwd.h>
 #include <grp.h>
 #include <errno.h>
+#ifdef USE_CPU_AFFINITY
+#include <sched.h>
+#endif
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -62,6 +65,7 @@
 #include <haproxy/lb_map.h>
 #include <haproxy/listener.h>
 #include <haproxy/log.h>
+#include <haproxy/sink.h>
 #include <haproxy/mailers.h>
 #include <haproxy/namespace.h>
 #include <haproxy/obj_type-t.h>
@@ -2630,6 +2634,7 @@ int check_config_validity()
 {
 	int cfgerr = 0;
 	struct proxy *curproxy = NULL;
+	struct proxy *init_proxies_list = NULL;
 	struct stktable *t;
 	struct server *newsrv = NULL;
 	int err_code = 0;
@@ -2707,7 +2712,11 @@ int check_config_validity()
 		proxies_list = next;
 	}
 
-	for (curproxy = proxies_list; curproxy; curproxy = curproxy->next) {
+	/* starting to initialize the main proxies list */
+	init_proxies_list = proxies_list;
+
+init_proxies_list_stage1:
+	for (curproxy = init_proxies_list; curproxy; curproxy = curproxy->next) {
 		struct switching_rule *rule;
 		struct server_rule *srule;
 		struct sticking_rule *mrule;
@@ -2837,11 +2846,16 @@ int check_config_validity()
 		case PR_MODE_CLI:
 			cfgerr += proxy_cfg_ensure_no_http(curproxy);
 			break;
+
 		case PR_MODE_SYSLOG:
+			/* this mode is initialized as the classic tcp proxy */
+			cfgerr += proxy_cfg_ensure_no_http(curproxy);
+			break;
+
 		case PR_MODE_PEERS:
 		case PR_MODES:
 			/* should not happen, bug gcc warn missing switch statement */
-			ha_alert("config : %s '%s' cannot use peers or syslog mode for this proxy. NOTE: PLEASE REPORT THIS TO DEVELOPERS AS YOU'RE NOT SUPPOSED TO BE ABLE TO CREATE A CONFIGURATION TRIGGERING THIS!\n",
+			ha_alert("config: %s '%s' cannot initialize this proxy mode (peers) in this way. NOTE: PLEASE REPORT THIS TO DEVELOPERS AS YOU'RE NOT SUPPOSED TO BE ABLE TO CREATE A CONFIGURATION TRIGGERING THIS!\n",
 				 proxy_type_str(curproxy), curproxy->id);
 			cfgerr++;
 			break;
@@ -3966,6 +3980,24 @@ out_uri_auth_compat:
 		}
 	}
 
+	/*
+	 * We have just initialized the main proxies list
+	 * we must also configure the log-forward proxies list
+	 */
+	if (init_proxies_list == proxies_list) {
+		init_proxies_list = cfg_log_forward;
+		/* check if list is not null to avoid infinite loop */
+		if (init_proxies_list)
+			goto init_proxies_list_stage1;
+	}
+
+	if (init_proxies_list == cfg_log_forward) {
+		init_proxies_list = sink_proxies_list;
+		/* check if list is not null to avoid infinite loop */
+		if (init_proxies_list)
+			goto init_proxies_list_stage1;
+	}
+
 	/***********************************************************/
 	/* At this point, target names have already been resolved. */
 	/***********************************************************/
@@ -4087,7 +4119,11 @@ out_uri_auth_compat:
 
 	/* perform the final checks before creating tasks */
 
-	for (curproxy = proxies_list; curproxy; curproxy = curproxy->next) {
+	/* starting to initialize the main proxies list */
+	init_proxies_list = proxies_list;
+
+init_proxies_list_stage2:
+	for (curproxy = init_proxies_list; curproxy; curproxy = curproxy->next) {
 		struct listener *listener;
 		unsigned int next_id;
 
@@ -4209,6 +4245,17 @@ out_uri_auth_compat:
 	}
 
 	/*
+	 * We have just initialized the main proxies list
+	 * we must also configure the log-forward proxies list
+	 */
+	if (init_proxies_list == proxies_list) {
+		init_proxies_list = cfg_log_forward;
+		/* check if list is not null to avoid infinite loop */
+		if (init_proxies_list)
+			goto init_proxies_list_stage2;
+	}
+
+	/*
 	 * Recount currently required checks.
 	 */
 
diff --git a/src/check.c b/src/check.c
index 1a40b6f..2205063 100644
--- a/src/check.c
+++ b/src/check.c
@@ -1715,6 +1715,13 @@ static int init_srv_agent_check(struct server *srv)
 		LIST_INSERT(srv->agent.tcpcheck_rules->list, &chk->list);
 	}
 
+	/* <chk> is always defined here and it is a CONNECT action. If there is
+	 * a preset variable, it means there is an agent string defined and data
+	 * will be sent after the connect.
+	 */
+	if (!LIST_ISEMPTY(&srv->agent.tcpcheck_rules->preset_vars))
+		chk->connect.options |= TCPCHK_OPT_HAS_DATA;
+
 
 	err = init_check(&srv->agent, PR_O2_TCPCHK_CHK);
 	if (err) {
diff --git a/src/dns.c b/src/dns.c
index 1ef5e87..c4b2af0 100644
--- a/src/dns.c
+++ b/src/dns.c
@@ -1023,7 +1023,7 @@ struct dns_session *dns_session_new(struct dns_stream_server *dss)
 	if (dss->maxconn && (dss->maxconn <= dss->cur_conns))
 		return NULL;
 
-	ds = pool_alloc(dns_session_pool);
+	ds = pool_zalloc(dns_session_pool);
 	if (!ds)
 		return NULL;
 
diff --git a/src/ev_epoll.c b/src/ev_epoll.c
index 330c38c..041d6d8 100644
--- a/src/ev_epoll.c
+++ b/src/ev_epoll.c
@@ -185,7 +185,7 @@ static void _do_poll(struct poller *p, int exp, int wake)
 
 	thread_harmless_now();
 
-	/* now let's wait for polled events */
+	/* Now let's wait for polled events. */
 	wait_time = wake ? 0 : compute_poll_timeout(exp);
 	tv_entering_poll();
 	activity_count_runtime();
@@ -201,7 +201,7 @@ static void _do_poll(struct poller *p, int exp, int wake)
 		}
 		if (timeout || !wait_time)
 			break;
-		if (signal_queue_len || wake)
+		if (wake)
 			break;
 		if (tick_isset(exp) && tick_is_expired(exp, now_ms))
 			break;
diff --git a/src/ev_evports.c b/src/ev_evports.c
index 109e59c..e012e00 100644
--- a/src/ev_evports.c
+++ b/src/ev_evports.c
@@ -153,9 +153,7 @@ static void _do_poll(struct poller *p, int exp, int wake)
 
 	thread_harmless_now();
 
-	/*
-	 * Determine how long to wait for events to materialise on the port.
-	 */
+	/* Now let's wait for polled events. */
 	wait_time = wake ? 0 : compute_poll_timeout(exp);
 	tv_entering_poll();
 	activity_count_runtime();
@@ -195,7 +193,7 @@ static void _do_poll(struct poller *p, int exp, int wake)
 			break;
 		if (timeout || !wait_time)
 			break;
-		if (signal_queue_len || wake)
+		if (wake)
 			break;
 		if (tick_isset(exp) && tick_is_expired(exp, now_ms))
 			break;
diff --git a/src/ev_kqueue.c b/src/ev_kqueue.c
index d51a833..0d81d67 100644
--- a/src/ev_kqueue.c
+++ b/src/ev_kqueue.c
@@ -141,7 +141,7 @@ static void _do_poll(struct poller *p, int exp, int wake)
 	}
 	fd_nbupdt = 0;
 
-	/* now let's wait for events */
+	/* Now let's wait for polled events. */
 	wait_time = wake ? 0 : compute_poll_timeout(exp);
 	fd = global.tune.maxpollevents;
 	tv_entering_poll();
@@ -167,7 +167,7 @@ static void _do_poll(struct poller *p, int exp, int wake)
 		}
 		if (timeout || !wait_time)
 			break;
-		if (signal_queue_len || wake)
+		if (wake)
 			break;
 		if (tick_isset(exp) && tick_is_expired(exp, now_ms))
 			break;
diff --git a/src/ev_poll.c b/src/ev_poll.c
index c30aadb..4d136a0 100644
--- a/src/ev_poll.c
+++ b/src/ev_poll.c
@@ -21,6 +21,7 @@
 #include <haproxy/api.h>
 #include <haproxy/fd.h>
 #include <haproxy/global.h>
+#include <haproxy/signal.h>
 #include <haproxy/ticks.h>
 #include <haproxy/time.h>
 
@@ -198,7 +199,7 @@ static void _do_poll(struct poller *p, int exp, int wake)
 		}
 	}
 
-	/* now let's wait for events */
+	/* Now let's wait for polled events. */
 	wait_time = wake ? 0 : compute_poll_timeout(exp);
 	tv_entering_poll();
 	activity_count_runtime();
diff --git a/src/fcgi-app.c b/src/fcgi-app.c
index 29a3602..8fca1e9 100644
--- a/src/fcgi-app.c
+++ b/src/fcgi-app.c
@@ -589,7 +589,7 @@ static int proxy_parse_use_fcgi_app(char **args, int section, struct proxy *curp
 	struct fcgi_flt_conf *fcgi_conf = NULL;
 	int retval = 0;
 
-	if (!(curpx->cap & PR_CAP_BE)) {
+	if ((curpx->cap & PR_CAP_DEF) || !(curpx->cap & PR_CAP_BE)) {
 		memprintf(err, "'%s' only available in backend or listen section", args[0]);
 		retval = -1;
 		goto end;
diff --git a/src/fcgi.c b/src/fcgi.c
index 1c2543d..778ce9e 100644
--- a/src/fcgi.c
+++ b/src/fcgi.c
@@ -47,7 +47,7 @@ int fcgi_encode_record_hdr(struct buffer *out, const struct fcgi_header *h)
 	out->area[len++] = ((h->len >> 8) & 0xff);
 	out->area[len++] = (h->len & 0xff);
 	out->area[len++] = h->padding;
-	len++; /* rsv */
+	out->area[len++] = 0; /* rsv */
 
 	out->data = len;
 	return 1;
@@ -94,7 +94,11 @@ int fcgi_encode_begin_request(struct buffer *out, const struct fcgi_begin_reques
 	out->area[len++] = ((r->role >> 8) & 0xff);
 	out->area[len++] = (r->role & 0xff);
 	out->area[len++] = r->flags;
-	len += 5; /* rsv */
+	out->area[len++] = 0; /* rsv */
+	out->area[len++] = 0;
+	out->area[len++] = 0;
+	out->area[len++] = 0;
+	out->area[len++] = 0;
 
 	out->data = len;
 	return 1;
diff --git a/src/fd.c b/src/fd.c
index b9c8ccc..3c9629f 100644
--- a/src/fd.c
+++ b/src/fd.c
@@ -206,7 +206,7 @@ lock_self:
 #ifdef HA_CAS_IS_8B
 		 unlikely(!_HA_ATOMIC_CAS(((uint64_t *)&_GET_NEXT(fd, off)), (uint64_t *)&cur_list.u64, next_list.u64))
 #else
-		 unlikely(!_HA_ATOMIC_DWCAS(((long *)&_GET_NEXT(fd, off)), (uint32_t *)&cur_list.u32, &next_list.u32))
+		 unlikely(!_HA_ATOMIC_DWCAS(((long *)&_GET_NEXT(fd, off)), (uint32_t *)&cur_list.u32, (const uint32_t *)&next_list.u32))
 #endif
 	    );
 	next = cur_list.ent.next;
@@ -666,9 +666,9 @@ static void deinit_pollers_per_thread()
 	/* rd and wr are init at the same place, but only rd is init to -1, so
 	  we rely to rd to close.   */
 	if (poller_rd_pipe > -1) {
-		close(poller_rd_pipe);
+		fd_delete(poller_rd_pipe);
 		poller_rd_pipe = -1;
-		close(poller_wr_pipe[tid]);
+		fd_delete(poller_wr_pipe[tid]);
 		poller_wr_pipe[tid] = -1;
 	}
 }
diff --git a/src/flt_http_comp.c b/src/flt_http_comp.c
index a9c49f5..66eb601 100644
--- a/src/flt_http_comp.c
+++ b/src/flt_http_comp.c
@@ -304,23 +304,18 @@ set_compression_response_header(struct comp_state *st, struct stream *s, struct 
 	struct htx_sl *sl;
 	struct http_hdr_ctx ctx;
 
-	/*
-	 * Add Content-Encoding header when it's not identity encoding.
-	 * RFC 2616 : Identity encoding: This content-coding is used only in the
-	 * Accept-Encoding header, and SHOULD NOT be used in the Content-Encoding
-	 * header.
-	 */
-	if (st->comp_algo->cfg_name_len != 8 || memcmp(st->comp_algo->cfg_name, "identity", 8) != 0) {
-		struct ist v = ist2(st->comp_algo->ua_name, st->comp_algo->ua_name_len);
-
-		if (!http_add_header(htx, ist("Content-Encoding"), v))
-			goto error;
-	}
-
 	sl = http_get_stline(htx);
 	if (!sl)
 		goto error;
 
+	/* add "Transfer-Encoding: chunked" header */
+	if (!(msg->flags & HTTP_MSGF_TE_CHNK)) {
+		if (!http_add_header(htx, ist("Transfer-Encoding"), ist("chunked")))
+			goto error;
+		msg->flags |= HTTP_MSGF_TE_CHNK;
+		sl->flags |= (HTX_SL_F_XFER_ENC|HTX_SL_F_CHNK);
+	}
+
 	/* remove Content-Length header */
 	if (msg->flags & HTTP_MSGF_CNT_LEN) {
 		ctx.blk = NULL;
@@ -330,14 +325,6 @@ set_compression_response_header(struct comp_state *st, struct stream *s, struct 
 		sl->flags &= ~HTX_SL_F_CLEN;
 	}
 
-	/* add "Transfer-Encoding: chunked" header */
-	if (!(msg->flags & HTTP_MSGF_TE_CHNK)) {
-		if (!http_add_header(htx, ist("Transfer-Encoding"), ist("chunked")))
-			goto error;
-		msg->flags |= HTTP_MSGF_TE_CHNK;
-		sl->flags |= (HTX_SL_F_XFER_ENC|HTX_SL_F_CHNK);
-	}
-
 	/* convert "ETag" header to a weak ETag */
 	ctx.blk = NULL;
 	if (http_find_header(htx, ist("ETag"), &ctx, 1)) {
@@ -355,6 +342,19 @@ set_compression_response_header(struct comp_state *st, struct stream *s, struct 
 	if (!http_add_header(htx, ist("Vary"), ist("Accept-Encoding")))
 		goto error;
 
+	/*
+	 * Add Content-Encoding header when it's not identity encoding.
+	 * RFC 2616 : Identity encoding: This content-coding is used only in the
+	 * Accept-Encoding header, and SHOULD NOT be used in the Content-Encoding
+	 * header.
+	 */
+	if (st->comp_algo->cfg_name_len != 8 || memcmp(st->comp_algo->cfg_name, "identity", 8) != 0) {
+		struct ist v = ist2(st->comp_algo->ua_name, st->comp_algo->ua_name_len);
+
+		if (!http_add_header(htx, ist("Content-Encoding"), v))
+			goto error;
+	}
+
 	return 1;
 
   error:
diff --git a/src/flt_spoe.c b/src/flt_spoe.c
index cb7eed4..4826aa0 100644
--- a/src/flt_spoe.c
+++ b/src/flt_spoe.c
@@ -1259,7 +1259,7 @@ spoe_release_appctx(struct appctx *appctx)
 	/* Destroy the task attached to this applet */
 	task_destroy(spoe_appctx->task);
 
-	/* Notify all waiting streams */
+	/* Report an error to all streams in the appctx waiting queue */
 	list_for_each_entry_safe(ctx, back, &spoe_appctx->waiting_queue, list) {
 		LIST_DELETE(&ctx->list);
 		LIST_INIT(&ctx->list);
@@ -1271,8 +1271,8 @@ spoe_release_appctx(struct appctx *appctx)
 		task_wakeup(ctx->strm->task, TASK_WOKEN_MSG);
 	}
 
-	/* If the applet was processing a fragmented frame, notify the
-	 * corresponding stream. */
+	/* If the applet was processing a fragmented frame, report an error to
+	 * the corresponding stream. */
 	if (spoe_appctx->frag_ctx.ctx) {
 		ctx = spoe_appctx->frag_ctx.ctx;
 		ctx->spoe_appctx = NULL;
@@ -1281,7 +1281,11 @@ spoe_release_appctx(struct appctx *appctx)
 		task_wakeup(ctx->strm->task, TASK_WOKEN_MSG);
 	}
 
-	if (!LIST_ISEMPTY(&agent->rt[tid].waiting_queue)) {
+	if (!LIST_ISEMPTY(&agent->rt[tid].applets)) {
+		/* If there are still some running applets, remove reference on
+		 * the current one from streams in the async waiting queue. In
+		 * async mode, the ACK may be received from another appctx.
+		 */
 		list_for_each_entry_safe(ctx, back, &agent->rt[tid].waiting_queue, list) {
 			if (ctx->spoe_appctx == spoe_appctx)
 				ctx->spoe_appctx = NULL;
@@ -1289,16 +1293,25 @@ spoe_release_appctx(struct appctx *appctx)
 		goto end;
 	}
 	else {
-		/* It is the last running applet and the sending and waiting
-		 * queues are not empty. Try to start a new one if HAproxy is
-		 * not stopping.
+		/* It is the last running applet and the sending and async
+		 * waiting queues are not empty. So try to start a new applet if
+		 * HAproxy is not stopping. On success, we remove reference on
+		 * the current appctx from streams in the async waiting queue.
+		 * In async mode, the ACK may be received from another appctx.
 		 */
 		if (!stopping &&
 		    (!LIST_ISEMPTY(&agent->rt[tid].sending_queue) || !LIST_ISEMPTY(&agent->rt[tid].waiting_queue)) &&
-		    spoe_create_appctx(agent->spoe_conf))
+		    spoe_create_appctx(agent->spoe_conf)) {
+			list_for_each_entry_safe(ctx, back, &agent->rt[tid].waiting_queue, list) {
+				if (ctx->spoe_appctx == spoe_appctx)
+					ctx->spoe_appctx = NULL;
+			}
 			goto end;
+		}
 
-		/* otherwise, notify all waiting streams */
+		/* Otherwise, report an error to all streams in the sending and
+		 * async waiting queues.
+		 */
 		list_for_each_entry_safe(ctx, back, &agent->rt[tid].sending_queue, list) {
 			LIST_DELETE(&ctx->list);
 			LIST_INIT(&ctx->list);
diff --git a/src/h1.c b/src/h1.c
index 3a6c1c3..73de48b 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -130,6 +130,50 @@ void h1_parse_xfer_enc_header(struct h1m *h1m, struct ist value)
 	}
 }
 
+/* Validate the authority and the host header value for CONNECT method. If there
+ * is hast header, its value is normalized. 0 is returned on success, -1 if the
+ * authority is invalid and -2 if the host is invalid.
+ */
+static int h1_validate_connect_authority(struct ist authority, struct ist *host_hdr)
+{
+	struct ist uri_host, uri_port, host, host_port;
+
+	if (!isttest(authority))
+		goto invalid_authority;
+	uri_host = authority;
+	uri_port = http_get_host_port(authority);
+	if (!isttest(uri_port))
+		goto invalid_authority;
+	uri_host.len -= (istlen(uri_port) + 1);
+
+	if (!host_hdr || !isttest(*host_hdr))
+		goto end;
+
+	/* Get the port of the host header value, if any */
+	host = *host_hdr;
+	host_port = http_get_host_port(*host_hdr);
+	if (isttest(host_port)) {
+		host.len -= (istlen(host_port) + 1);
+		if (!isteqi(host, uri_host) || !isteq(host_port, uri_port))
+			goto invalid_host;
+		if (http_is_default_port(IST_NULL, uri_port))
+			*host_hdr = host; /* normalize */
+	}
+	else {
+		if (!http_is_default_port(IST_NULL, uri_port) || !isteqi(host, uri_host))
+			goto invalid_host;
+	}
+
+  end:
+	return 0;
+
+  invalid_authority:
+	return -1;
+
+  invalid_host:
+	return -2;
+}
+
 /* Parse the Connection: header of an HTTP/1 request, looking for "close",
  * "keep-alive", and "upgrade" values, and updating h1m->flags according to
  * what was found there. Note that flags are only added, not removed, so the
@@ -706,6 +750,10 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 
 		if (likely(*ptr == ':')) {
 			col = ptr - start;
+			if (col <= sol) {
+				state = H1_MSG_HDR_NAME;
+				goto http_msg_invalid;
+			}
 			EAT_AND_JUMP_OR_RETURN(ptr, end, http_msg_hdr_l1_sp, http_msg_ood, state, H1_MSG_HDR_L1_SP);
 		}
 
@@ -868,22 +916,9 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 				else if (isteqi(n, ist("upgrade"))) {
 					h1_parse_upgrade_header(h1m, v);
 				}
-				else if (!(h1m->flags & (H1_MF_HDRS_ONLY|H1_MF_RESP)) && isteqi(n, ist("host"))) {
-					if (host_idx == -1) {
-						struct ist authority;
-
-						authority = http_get_authority(sl.rq.u, 1);
-						if (authority.len && !isteqi(v, authority)) {
-							if (h1m->err_pos < -1) {
-								state = H1_MSG_HDR_L2_LWS;
-								ptr = v.ptr; /* Set ptr on the error */
-								goto http_msg_invalid;
-							}
-							if (h1m->err_pos == -1) /* capture the error pointer */
-								h1m->err_pos = v.ptr - start + skip; /* >= 0 now */
-						}
+				else if (!(h1m->flags & H1_MF_RESP) && isteqi(n, ist("host"))) {
+					if (host_idx == -1)
 						host_idx = hdr_count;
-					}
 					else {
 						if (!isteqi(v, hdr[host_idx].v)) {
 							state = H1_MSG_HDR_L2_LWS;
@@ -934,6 +969,48 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 		if (restarting)
 			goto restart;
 
+
+		if (!(h1m->flags & (H1_MF_HDRS_ONLY|H1_MF_RESP))) {
+			struct ist authority;
+
+			authority = http_get_authority(sl.rq.u, 1);
+			if (sl.rq.meth == HTTP_METH_CONNECT) {
+				struct ist *host = ((host_idx != -1) ? &hdr[host_idx].v : NULL);
+				int ret;
+
+				ret = h1_validate_connect_authority(authority, host);
+				if (ret < 0) {
+					if (h1m->err_pos < -1) {
+						state = H1_MSG_LAST_LF;
+						/* WT: gcc seems to see a path where sl.rq.u.ptr was used
+						 * uninitialized, but it doesn't know that the function is
+						 * called with initial states making this impossible.
+						 */
+						ALREADY_CHECKED(sl.rq.u.ptr);
+						ptr = ((ret == -1) ? sl.rq.u.ptr : host->ptr); /* Set ptr on the error */
+						goto http_msg_invalid;
+					}
+					if (h1m->err_pos == -1) /* capture the error pointer */
+						h1m->err_pos = ((ret == -1) ? sl.rq.u.ptr : host->ptr) - start + skip; /* >= 0 now */
+				}
+			}
+			else if (host_idx != -1 && istlen(authority)) {
+				struct ist host = hdr[host_idx].v;
+
+				/* For non-CONNECT method, the authority must match the host header value */
+				if (!isteqi(authority, host)) {
+					if (h1m->err_pos < -1) {
+						state = H1_MSG_LAST_LF;
+						ptr = host.ptr; /* Set ptr on the error */
+						goto http_msg_invalid;
+					}
+					if (h1m->err_pos == -1) /* capture the error pointer */
+						h1m->err_pos = v.ptr - start + skip; /* >= 0 now */
+				}
+
+			}
+		}
+
 		state = H1_MSG_DATA;
 		if (h1m->flags & H1_MF_XFER_ENC) {
 			if (h1m->flags & H1_MF_CLEN) {
diff --git a/src/h1_htx.c b/src/h1_htx.c
index b6a91f2..650acba 100644
--- a/src/h1_htx.c
+++ b/src/h1_htx.c
@@ -279,6 +279,9 @@ static int h1_postparse_res_hdrs(struct h1m *h1m, union h1_sl *h1sl, struct htx 
 		goto output_full;
 	}
 
+	if ((h1m->flags & (H1_MF_CONN_UPG|H1_MF_UPG_WEBSOCKET)) && code != 101)
+		h1m->flags &= ~(H1_MF_CONN_UPG|H1_MF_UPG_WEBSOCKET);
+
 	if (((h1m->flags & H1_MF_METH_CONNECT) && code >= 200 && code < 300) || code == 101) {
 		h1m->flags &= ~(H1_MF_CLEN|H1_MF_CHNK);
 		h1m->flags |= H1_MF_XFER_LEN;
diff --git a/src/haproxy.c b/src/haproxy.c
index b484195..2f85293 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -1,6 +1,6 @@
 /*
  * HAProxy : High Availability-enabled HTTP/TCP proxy
- * Copyright 2000-2022 Willy Tarreau <[e-mail]>.
+ * Copyright 2000-2023 Willy Tarreau <[e-mail]>.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -2080,6 +2080,10 @@ static void init(int argc, char **argv)
 			exit(1);
 	}
 
+	/* set the default maxconn in the master, but let it be rewritable with -n */
+	if (global.mode & MODE_MWORKER_WAIT)
+		global.maxconn = DEFAULT_MAXCONN;
+
 	if (cfg_maxconn > 0)
 		global.maxconn = cfg_maxconn;
 
@@ -2629,7 +2633,7 @@ void run_poll_loop()
 		if (killed > 1)
 			break;
 
-		/* expire immediately if events are pending */
+		/* expire immediately if events or signals are pending */
 		wake = 1;
 		if (thread_has_tasks())
 			activity[tid].wake_tasks++;
@@ -2639,6 +2643,10 @@ void run_poll_loop()
 			if (thread_has_tasks()) {
 				activity[tid].wake_tasks++;
 				_HA_ATOMIC_AND(&sleeping_thread_mask, ~tid_bit);
+			} else if (signal_queue_len) {
+				/* this check is required to avoid
+				 * a race with wakeup on signals using wake_threads() */
+				_HA_ATOMIC_AND(&sleeping_thread_mask, ~tid_bit);
 			} else
 				wake = 0;
 		}
diff --git a/src/hlua.c b/src/hlua.c
index 0af3eb0..aea338f 100644
--- a/src/hlua.c
+++ b/src/hlua.c
@@ -738,7 +738,11 @@ __LJMP int hlua_lua2arg_check(lua_State *L, int first, struct arg *argp,
 					break;
 
 				case ARGT_TAB:
-					argp[idx].data.prx = p;
+					if (!p->table) {
+						msg = "Mandatory argument expected";
+						goto error;
+					}
+					argp[idx].data.t = p->table;
 					argp[idx].type = ARGT_TAB;
 					argp[idx+1].type = ARGT_STOP;
 					break;
@@ -979,6 +983,7 @@ __LJMP int hlua_lua2arg_check(lua_State *L, int first, struct arg *argp,
 	return 0;
 
   error:
+	argp[idx].type = ARGT_STOP;
 	for (i = 0; i < idx; i++) {
 		if (argp[i].type == ARGT_STR)
 			chunk_destroy(&argp[i].data.str);
@@ -4421,7 +4426,7 @@ __LJMP static int hlua_applet_http_getline_yield(lua_State *L, int status, lua_K
 	/* The message was fully consumed and no more data are expected
 	 * (EOM flag set).
 	 */
-	if (htx_is_empty(htx) && (htx->flags & HTX_FL_EOM))
+	if (htx_is_empty(htx) && (req->flags & CF_EOI))
 		stop = 1;
 
 	htx_to_buf(htx, &req->buf);
@@ -4513,7 +4518,7 @@ __LJMP static int hlua_applet_http_recv_yield(lua_State *L, int status, lua_KCon
 	/* The message was fully consumed and no more data are expected
 	 * (EOM flag set).
 	 */
-	if (htx_is_empty(htx) && (htx->flags & HTX_FL_EOM))
+	if (htx_is_empty(htx) && (req->flags & CF_EOI))
 		len = 0;
 
 	htx_to_buf(htx, &req->buf);
diff --git a/src/hlua_fcn.c b/src/hlua_fcn.c
index 26aa509..010bd13 100644
--- a/src/hlua_fcn.c
+++ b/src/hlua_fcn.c
@@ -1305,6 +1305,7 @@ int hlua_proxy_pause(lua_State *L)
 	struct proxy *px;
 
 	px = hlua_check_proxy(L, 1);
+	/* safe to call without PROXY_LOCK - pause_proxy takes it */
 	pause_proxy(px);
 	return 0;
 }
@@ -1314,6 +1315,7 @@ int hlua_proxy_resume(lua_State *L)
 	struct proxy *px;
 
 	px = hlua_check_proxy(L, 1);
+	/* safe to call without PROXY_LOCK - resume_proxy takes it */
 	resume_proxy(px);
 	return 0;
 }
@@ -1323,6 +1325,7 @@ int hlua_proxy_stop(lua_State *L)
 	struct proxy *px;
 
 	px = hlua_check_proxy(L, 1);
+	/* safe to call without PROXY_LOCK - stop_proxy takes it */
 	stop_proxy(px);
 	return 0;
 }
diff --git a/src/hpack-dec.c b/src/hpack-dec.c
index 4fa9bfd..ed39007 100644
--- a/src/hpack-dec.c
+++ b/src/hpack-dec.c
@@ -32,6 +32,7 @@
 
 #include <import/ist.h>
 #include <haproxy/chunk.h>
+#include <haproxy/global.h>
 #include <haproxy/h2.h>
 #include <haproxy/hpack-dec.h>
 #include <haproxy/hpack-huff.h>
@@ -419,6 +420,15 @@ int hpack_decode_frame(struct hpack_dht *dht, const uint8_t *raw, uint32_t len,
 			/* <name> and <value> are correctly filled here */
 		}
 
+		/* We must not accept empty header names (forbidden by the spec and used
+		 * as a list termination).
+		 */
+		if (!name.len) {
+			hpack_debug_printf("##ERR@%d##\n", __LINE__);
+			ret = -HPACK_ERR_INVALID_ARGUMENT;
+			goto leave;
+		}
+
 		/* here's what we have here :
 		 *   - name.len > 0
 		 *   - value is filled with either const data or data allocated from tmp
diff --git a/src/http.c b/src/http.c
index 0b00e47..c10b433 100644
--- a/src/http.c
+++ b/src/http.c
@@ -468,6 +468,38 @@ const char *http_get_reason(unsigned int status)
 	}
 }
 
+/* Returns the ist string corresponding to port part (without ':') in the host
+ * <host> or IST_NULL if not found.
+*/
+struct ist http_get_host_port(const struct ist host)
+{
+	char *start, *end, *ptr;
+
+	start = istptr(host);
+	end = istend(host);
+	for (ptr = end; ptr > start && isdigit((unsigned char)*--ptr););
+
+	/* no port found */
+	if (likely(*ptr != ':' || ptr+1 == end || ptr == start))
+		return IST_NULL;
+
+	return istnext(ist2(ptr, end - ptr));
+}
+
+
+/* Return non-zero if the port <port> is a default port. If the scheme <schm> is
+ * set, it is used to detect default ports (HTTP => 80 and HTTPS => 443)
+ * port. Otherwise, both are considered as default ports.
+ */
+int http_is_default_port(const struct ist schm, const struct ist port)
+{
+	if (!isttest(schm))
+		return (isteq(port, ist("443")) || isteq(port, ist("80")));
+	else
+		return (isteq(port, ist("443")) && isteqi(schm, ist("https://"))) ||
+			(isteq(port, ist("80")) && isteqi(schm, ist("http://")));
+}
+
 /* Returns non-zero if the scheme <schm> is syntactically correct according to
  * RFC3986#3.1, otherwise zero. It expects only the scheme and nothing else
  * (particularly not the following "://").
diff --git a/src/http_act.c b/src/http_act.c
index f88c856..59e614f 100644
--- a/src/http_act.c
+++ b/src/http_act.c
@@ -1877,6 +1877,8 @@ static void release_http_redir(struct act_rule *rule)
 	free(redir->cookie_str);
 	list_for_each_entry_safe(lf, lfb, &redir->rdr_fmt, list) {
 		LIST_DELETE(&lf->list);
+		release_sample_expr(lf->expr);
+		free(lf->arg);
 		free(lf);
 	}
 	free(redir);
diff --git a/src/http_ana.c b/src/http_ana.c
index 4491ea1..2e2095b 100644
--- a/src/http_ana.c
+++ b/src/http_ana.c
@@ -938,9 +938,8 @@ int http_wait_for_request_body(struct stream *s, struct channel *req, int an_bit
 {
 	struct session *sess = s->sess;
 	struct http_txn *txn = s->txn;
-	struct http_msg *msg = &s->txn->req;
 
-	DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_HTTP_ANA, s, txn, msg);
+	DBG_TRACE_ENTER(STRM_EV_STRM_ANA|STRM_EV_HTTP_ANA, s, txn, &s->txn->req);
 
 
 	switch (http_wait_for_msg_body(s, req, s->be->timeout.httpreq, 0)) {
@@ -998,7 +997,7 @@ int http_wait_for_request_body(struct stream *s, struct channel *req, int an_bit
 	if (!(s->flags & SF_ERR_MASK))
 		s->flags |= SF_ERR_PRXCOND;
 	if (!(s->flags & SF_FINST_MASK))
-		s->flags |= (msg->msg_state < HTTP_MSG_DATA ? SF_FINST_R : SF_FINST_D);
+		s->flags |= SF_FINST_R;
 
 	req->analysers &= AN_REQ_FLT_END;
 	req->analyse_exp = TICK_ETERNITY;
@@ -2655,17 +2654,21 @@ static enum rule_result http_req_restrict_header_names(struct stream *s, struct 
 
 		if (type == HTX_BLK_HDR) {
 			struct ist n = htx_get_blk_name(htx, blk);
-			int i;
+			int i, end = istlen(n);
 
-			for (i = 0; i < istlen(n); i++) {
+			for (i = 0; i < end; i++) {
 				if (!isalnum((unsigned char)n.ptr[i]) && n.ptr[i] != '-') {
-					/* Block the request or remove the header */
-					if (px->options2 & PR_O2_RSTRICT_REQ_HDR_NAMES_BLK)
-						goto block;
-					blk = htx_remove_blk(htx, blk);
-					continue;
+					break;
 				}
 			}
+
+			if (i < end) {
+				/* Disallowed character found - block the request or remove the header */
+				if (px->options2 & PR_O2_RSTRICT_REQ_HDR_NAMES_BLK)
+					goto block;
+				blk = htx_remove_blk(htx, blk);
+				continue;
+			}
 		}
 		if (type == HTX_BLK_EOH)
 			break;
@@ -2778,6 +2781,7 @@ int http_res_set_status(unsigned int status, struct ist reason, struct stream *s
 
 	if (!http_replace_res_status(htx, ist2(trash.area, trash.data), reason))
 		return -1;
+	s->txn->status = status;
 	return 0;
 }
 
@@ -4241,7 +4245,7 @@ enum rule_result http_wait_for_msg_body(struct stream *s, struct channel *chn,
 	if (!(s->flags & SF_ERR_MASK))
 		s->flags |= SF_ERR_CLITO;
 	if (!(s->flags & SF_FINST_MASK))
-		s->flags |= SF_FINST_D;
+		s->flags |= SF_FINST_R;
 	_HA_ATOMIC_INC(&sess->fe->fe_counters.failed_req);
 	if (sess->listener && sess->listener->counters)
 		_HA_ATOMIC_INC(&sess->listener->counters->failed_req);
@@ -4254,7 +4258,7 @@ enum rule_result http_wait_for_msg_body(struct stream *s, struct channel *chn,
 	if (!(s->flags & SF_ERR_MASK))
 		s->flags |= SF_ERR_SRVTO;
 	if (!(s->flags & SF_FINST_MASK))
-		s->flags |= SF_FINST_D;
+		s->flags |= SF_FINST_R;
 	stream_inc_http_fail_ctr(s);
 	http_reply_and_close(s, txn->status, http_error_message(s));
 	ret = HTTP_RULE_RES_ABRT;
@@ -5205,8 +5209,10 @@ struct http_txn *http_create_txn(struct stream *s)
 
 	txn->auth.method = HTTP_AUTH_UNKNOWN;
 
-	vars_init(&s->vars_txn,    SCOPE_TXN);
-	vars_init(&s->vars_reqres, SCOPE_REQ);
+	/* here we don't want to re-initialize s->vars_txn and s->vars_reqres
+	 * variable lists, because they were already initialized upon stream
+	 * creation in stream_new(), and thus may already contain some variables
+	 */
 
 	return txn;
 }
diff --git a/src/http_fetch.c b/src/http_fetch.c
index 3950eea..6678c85 100644
--- a/src/http_fetch.c
+++ b/src/http_fetch.c
@@ -222,7 +222,7 @@ struct htx *smp_prefetch_htx(struct sample *smp, struct channel *chn, struct che
 	if (IS_HTX_STRM(s)) {
 		htx = htxbuf(&chn->buf);
 
-		if (msg->msg_state == HTTP_MSG_ERROR || (htx->flags & HTX_FL_PARSING_ERROR))
+		if (htx->flags & HTX_FL_PARSING_ERROR)
 			return NULL;
 
 		if (msg->msg_state < HTTP_MSG_BODY) {
@@ -307,7 +307,7 @@ struct htx *smp_prefetch_htx(struct sample *smp, struct channel *chn, struct che
 			if (txn->meth == HTTP_METH_GET || txn->meth == HTTP_METH_HEAD)
 				s->flags |= SF_REDIRECTABLE;
 		}
-		else
+		else if (txn->status == -1)
 			txn->status = sl->info.res.status;
 		if (sl->flags & HTX_SL_F_VER_11)
 			msg->flags |= HTTP_MSGF_VER_11;
@@ -330,20 +330,21 @@ static int smp_fetch_meth(const struct arg *args, struct sample *smp, const char
 {
 	struct channel *chn = SMP_REQ_CHN(smp);
 	struct http_txn *txn;
-	struct htx *htx;
+	struct htx *htx = NULL;
 	int meth;
 
 	txn = (smp->strm ? smp->strm->txn : NULL);
 	if (!txn)
 		return 0;
 
-	if (txn->meth == HTTP_METH_OTHER) {
+	meth = txn->meth;
+	if (meth == HTTP_METH_OTHER) {
 		htx = smp_prefetch_htx(smp, chn, NULL, 1);
 		if (!htx)
 			return 0;
+		meth = txn->meth;
 	}
 
-	meth = txn->meth;
 	smp->data.type = SMP_T_METH;
 	smp->data.u.meth.meth = meth;
 	if (meth == HTTP_METH_OTHER) {
diff --git a/src/http_htx.c b/src/http_htx.c
index 6f5c1a1..60525bb 100644
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -388,6 +388,9 @@ int http_replace_req_uri(struct htx *htx, const struct ist uri)
 		goto fail;
 
 	sl = http_get_stline(htx);
+	ALREADY_CHECKED(sl); /* the stline exists because http_replace_stline() succeded */
+	sl->flags &= ~HTX_SL_F_NORMALIZED_URI;
+
 	if (!http_update_host(htx, sl, uri))
 		goto fail;
 
@@ -918,7 +921,7 @@ int http_str_to_htx(struct buffer *buf, struct ist raw, char **errmsg)
 	ret = h1_headers_to_hdr_list(raw.ptr, raw.ptr + raw.len,
 				     hdrs, sizeof(hdrs)/sizeof(hdrs[0]), &h1m, &h1sl);
 	if (ret <= 0) {
-		memprintf(errmsg, "unabled to parse headers (error offset: %d)", h1m.err_pos);
+		memprintf(errmsg, "unable to parse headers (error offset: %d)", h1m.err_pos);
 		goto error;
 	}
 
@@ -1565,6 +1568,7 @@ struct http_reply *http_parse_http_reply(const char **args, int *orig_arg, struc
 			fd = -1;
 			obj[objlen] = '\0';
 			reply->type = HTTP_REPLY_LOGFMT;
+			LIST_INIT(&reply->body.fmt);
 			cur_arg++;
 		}
 		else if (strcmp(args[cur_arg], "lf-string") == 0) {
@@ -1581,6 +1585,7 @@ struct http_reply *http_parse_http_reply(const char **args, int *orig_arg, struc
 			obj = strdup(args[cur_arg]);
 			objlen = strlen(args[cur_arg]);
 			reply->type = HTTP_REPLY_LOGFMT;
+			LIST_INIT(&reply->body.fmt);
 			cur_arg++;
 		}
 		else if (strcmp(args[cur_arg], "hdr") == 0) {
@@ -1721,12 +1726,6 @@ struct http_reply *http_parse_http_reply(const char **args, int *orig_arg, struc
 	return NULL;
 }
 
-static int uri_is_default_port(const struct ist scheme, const struct ist port)
-{
-	return (isteq(port, ist("443")) && isteqi(scheme, ist("https://"))) ||
-	        (isteq(port, ist("80")) && isteqi(scheme, ist("http://")));
-}
-
 /* Apply schemed-based normalization as described on rfc3986 on section 6.3.2.
  * Returns 0 if no error has been found else non-zero.
  *
@@ -1741,7 +1740,6 @@ int http_scheme_based_normalize(struct htx *htx)
 	struct http_hdr_ctx ctx;
 	struct htx_sl *sl;
 	struct ist uri, scheme, authority, host, port;
-	char *start, *end, *ptr;
 
 	sl = http_get_stline(htx);
 
@@ -1755,25 +1753,16 @@ int http_scheme_based_normalize(struct htx *htx)
 	if (!isttest(scheme))
 		return 0;
 
-	/* Extract the port if present in authority. To properly support ipv6
-	 * hostnames, do a reverse search on the last ':' separator as long as
-	 * digits are found.
-	 */
-	authority = http_get_authority(uri, 0);
-	start = istptr(authority);
-	end = istend(authority);
-	for (ptr = end; ptr > start && isdigit((unsigned char)*--ptr); )
-		;
-
-	/* if no port found, no normalization to proceed */
-	if (likely(*ptr != ':'))
+	/* Extract the port if present in authority */
+	authority = http_get_authority(uri, 1);
+	port = http_get_host_port(authority);
+	if (!isttest(port)) {
+		/* if no port found, no normalization to proceed */
 		return 0;
+	}
+	host = isttrim(authority, istlen(authority) - istlen(port) - 1);
 
-	/* split host/port on the ':' separator found */
-	host = ist2(start, ptr - start);
-	port = istnext(ist2(ptr, end - ptr));
-
-	if (istlen(port) && uri_is_default_port(scheme, port)) {
+	if (istlen(port) && http_is_default_port(scheme, port)) {
 		/* reconstruct the uri with removal of the port */
 		struct buffer *temp = get_trash_chunk();
 		struct ist meth, vsn;
diff --git a/src/listener.c b/src/listener.c
index 0ffd0fe..67616f5 100644
--- a/src/listener.c
+++ b/src/listener.c
@@ -45,6 +45,7 @@ static struct bind_kw_list bind_keywords = {
 /* list of the temporarily limited listeners because of lack of resource */
 static struct mt_list global_listener_queue = MT_LIST_HEAD_INIT(global_listener_queue);
 static struct task *global_listener_queue_task;
+__decl_thread(static HA_RWLOCK_T global_listener_rwlock);
 
 /* listener status for stats */
 const char* li_status_st[LI_STATE_COUNT] = {
@@ -297,13 +298,14 @@ void enable_listener(struct listener *listener)
 
 /*
  * This function completely stops a listener. It will need to operate under the
- * proxy's lock, the protocol's lock, and the listener's lock. The caller is
- * responsible for indicating in lpx, lpr, lli whether the respective locks are
- * already held (non-zero) or not (zero) so that the function picks the missing
- * ones, in this order. The proxy's listeners count is updated and the proxy is
+ * It will need to operate under the proxy's lock and the protocol's lock.
+ * The caller is responsible for indicating in lpx, lpr whether the
+ * respective locks are already held (non-zero) or not (zero) so that the
+ * function picks the missing ones, in this order.
+ * The proxy's listeners count is updated and the proxy is
  * disabled and woken up after the last one is gone.
  */
-void stop_listener(struct listener *l, int lpx, int lpr, int lli)
+void stop_listener(struct listener *l, int lpx, int lpr)
 {
 	struct proxy *px = l->bind_conf->frontend;
 
@@ -320,8 +322,7 @@ void stop_listener(struct listener *l, int lpx, int lpr, int lli)
 	if (!lpr)
 		HA_SPIN_LOCK(PROTO_LOCK, &proto_lock);
 
-	if (!lli)
-		HA_RWLOCK_WRLOCK(LISTENER_LOCK, &l->lock);
+	HA_RWLOCK_WRLOCK(LISTENER_LOCK, &l->lock);
 
 	if (l->state > LI_INIT) {
 		do_unbind_listener(l);
@@ -332,8 +333,7 @@ void stop_listener(struct listener *l, int lpx, int lpr, int lli)
 		proxy_cond_disable(px);
 	}
 
-	if (!lli)
-		HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &l->lock);
+	HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &l->lock);
 
 	if (!lpr)
 		HA_SPIN_UNLOCK(PROTO_LOCK, &proto_lock);
@@ -422,12 +422,18 @@ int default_resume_listener(struct listener *l)
  * closes upon SHUT_WR and refuses to rebind. So a common validation path
  * involves SHUT_WR && listen && SHUT_RD. In case of success, the FD's polling
  * is disabled. It normally returns non-zero, unless an error is reported.
+ * It will need to operate under the proxy's lock. The caller is
+ * responsible for indicating in lpx whether the proxy locks is
+ * already held (non-zero) or not (zero) so that the function picks it.
  */
-int pause_listener(struct listener *l)
+int pause_listener(struct listener *l, int lpx)
 {
 	struct proxy *px = l->bind_conf->frontend;
 	int ret = 1;
 
+	if (!lpx)
+		HA_RWLOCK_WRLOCK(PROXY_LOCK, &px->lock);
+
 	HA_RWLOCK_WRLOCK(LISTENER_LOCK, &l->lock);
 
 	if ((global.mode & (MODE_DAEMON | MODE_MWORKER)) &&
@@ -450,6 +456,10 @@ int pause_listener(struct listener *l)
 	}
   end:
 	HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &l->lock);
+
+	if (!lpx)
+		HA_RWLOCK_WRUNLOCK(PROXY_LOCK, &px->lock);
+
 	return ret;
 }
 
@@ -462,13 +472,19 @@ int pause_listener(struct listener *l)
  * state, it's totally rebound. This can happen if a pause() has completely
  * stopped it. If the resume fails, 0 is returned and an error might be
  * displayed.
+ * It will need to operate under the proxy's lock. The caller is
+ * responsible for indicating in lpx whether the proxy locks is
+ * already held (non-zero) or not (zero) so that the function picks it.
  */
-int resume_listener(struct listener *l)
+int resume_listener(struct listener *l, int lpx)
 {
 	struct proxy *px = l->bind_conf->frontend;
 	int was_paused = px && px->li_paused;
 	int ret = 1;
 
+	if (!lpx)
+		HA_RWLOCK_WRLOCK(PROXY_LOCK, &px->lock);
+
 	HA_RWLOCK_WRLOCK(LISTENER_LOCK, &l->lock);
 
 	/* check that another thread didn't to the job in parallel (e.g. at the
@@ -484,6 +500,10 @@ int resume_listener(struct listener *l)
 	if (l->state == LI_READY)
 		goto end;
 
+	/* the listener might have been stopped in parallel */
+	if (l->state < LI_PAUSED)
+		goto end;
+
 	if (l->rx.proto->resume)
 		ret = l->rx.proto->resume(l);
 
@@ -503,6 +523,10 @@ int resume_listener(struct listener *l)
 	}
   end:
 	HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &l->lock);
+
+	if (!lpx)
+		HA_RWLOCK_WRUNLOCK(PROXY_LOCK, &px->lock);
+
 	return ret;
 }
 
@@ -545,7 +569,7 @@ void dequeue_all_listeners()
 		/* This cannot fail because the listeners are by definition in
 		 * the LI_LIMITED state.
 		 */
-		resume_listener(listener);
+		resume_listener(listener, 0);
 	}
 }
 
@@ -558,7 +582,7 @@ void dequeue_proxy_listeners(struct proxy *px)
 		/* This cannot fail because the listeners are by definition in
 		 * the LI_LIMITED state.
 		 */
-		resume_listener(listener);
+		resume_listener(listener, 0);
 	}
 }
 
@@ -1084,7 +1108,7 @@ void listener_accept(struct listener *l)
 	      (!tick_isset(global_listener_queue_task->expire) ||
 	       tick_is_expired(global_listener_queue_task->expire, now_ms))))) {
 		/* at least one thread has to this when quitting */
-		resume_listener(l);
+		resume_listener(l, 0);
 
 		/* Dequeues all of the listeners waiting for a resource */
 		dequeue_all_listeners();
@@ -1103,7 +1127,7 @@ void listener_accept(struct listener *l)
 	 * Let's put it to pause in this case.
 	 */
 	if (l->rx.proto && l->rx.proto->rx_listening(&l->rx) == 0) {
-		pause_listener(l);
+		pause_listener(l, 0);
 		goto end;
 	}
 
@@ -1112,7 +1136,9 @@ void listener_accept(struct listener *l)
 	 * later than <expire> ahead. The listener turns to LI_LIMITED.
 	 */
 	limit_listener(l, &global_listener_queue);
+	HA_RWLOCK_RDLOCK(LISTENER_LOCK, &global_listener_rwlock);
 	task_schedule(global_listener_queue_task, expire);
+	HA_RWLOCK_RDUNLOCK(LISTENER_LOCK, &global_listener_rwlock);
 	goto end;
 
  limit_proxy:
@@ -1141,7 +1167,7 @@ void listener_release(struct listener *l)
 	_HA_ATOMIC_DEC(&l->thr_conn[tid]);
 
 	if (l->state == LI_FULL || l->state == LI_LIMITED)
-		resume_listener(l);
+		resume_listener(l, 0);
 
 	/* Dequeues all of the listeners waiting for a resource */
 	dequeue_all_listeners();
@@ -1162,6 +1188,7 @@ static int listener_queue_init()
 	/* very simple initialization, users will queue the task if needed */
 	global_listener_queue_task->context = NULL; /* not even a context! */
 	global_listener_queue_task->process = manage_global_listener_queue;
+	HA_RWLOCK_INIT(&global_listener_rwlock);
 
 	return 0;
 }
@@ -1199,7 +1226,9 @@ struct task *manage_global_listener_queue(struct task *t, void *context, unsigne
 	dequeue_all_listeners();
 
  out:
+	HA_RWLOCK_WRLOCK(LISTENER_LOCK, &global_listener_rwlock);
 	t->expire = TICK_ETERNITY;
+	HA_RWLOCK_WRUNLOCK(LISTENER_LOCK, &global_listener_rwlock);
 	task_queue(t);
 	return t;
 }
diff --git a/src/log.c b/src/log.c
index c431937..fbc8a2f 100644
--- a/src/log.c
+++ b/src/log.c
@@ -1381,17 +1381,21 @@ char *lf_text_len(char *dst, const char *src, size_t len, size_t size, const str
 	}
 
 	if (src && len) {
-		if (++len > size)
-			len = size;
+		/* escape_string and strlcpy2 will both try to add terminating NULL-byte
+		 * to dst, so we need to make sure that extra byte will fit into dst
+		 * before calling them
+		 */
 		if (node->options & LOG_OPT_ESC) {
 			char *ret;
 
-			ret = escape_string(dst, dst + len, '\\', rfc5424_escape_map, src);
+			ret = escape_string(dst, (dst + size - 1), '\\', rfc5424_escape_map, src, src + len);
 			if (ret == NULL || *ret != '\0')
 				return NULL;
 			len = ret - dst;
 		}
 		else {
+			if (++len > size)
+				len = size;
 			len = strlcpy2(dst, src, len);
 		}
 
@@ -1402,6 +1406,7 @@ char *lf_text_len(char *dst, const char *src, size_t len, size_t size, const str
 		if (size < 2)
 			return NULL;
 		*(dst++) = '-';
+		size -= 1;
 	}
 
 	if (node->options & LOG_OPT_QUOTE) {
@@ -1877,7 +1882,7 @@ static inline void __do_send_log(struct logsrv *logsrv, int nblogger, int level,
 		if (msg.len > logsrv->maxlen)
 			msg.len = logsrv->maxlen;
 
-		sent = sink_write(logsrv->sink, &msg, 1, level, logsrv->facility, metadata);
+		sent = sink_write(logsrv->sink, &msg, 1, level, facility, metadata);
 	}
 	else if (logsrv->addr.ss_family == AF_CUST_EXISTING_FD) {
 		struct ist msg;
@@ -3418,6 +3423,7 @@ void parse_log_message(char *buf, size_t buflen, int *level, int *facility,
 		 */
 
 		p += 2;
+		*size -= 2;
 		/* timestamp is NILVALUE '-' */
 		if (*size > 2 && (p[0] == '-') && p[1] == ' ') {
 			metadata[LOG_META_TIME] = ist2(p, 1);
@@ -3811,7 +3817,7 @@ static void syslog_io_handler(struct appctx *appctx)
 			if (buf->area[to_skip - 1] != ' ')
 				goto parse_error;
 
-			msglen = strtol(trash.area, &p, 10);
+			msglen = strtol(buf->area, &p, 10);
 			if (!msglen || p != &buf->area[to_skip - 1])
 				goto parse_error;
 
diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
index d916496..7334b56 100644
--- a/src/mux_fcgi.c
+++ b/src/mux_fcgi.c
@@ -1399,7 +1399,7 @@ static int fcgi_set_default_param(struct fcgi_conn *fconn, struct fcgi_strm *fst
 		 * captured
 		 */
 		params->scriptname = ist2(path.ptr + pmatch[1].rm_so, pmatch[1].rm_eo - pmatch[1].rm_so);
-		if (!(params->mask & FCGI_SP_PATH_INFO) &&  (pmatch[2].rm_so == -1 || pmatch[2].rm_eo == -1))
+		if (!(params->mask & FCGI_SP_PATH_INFO) && !(pmatch[2].rm_so == -1 || pmatch[2].rm_eo == -1))
 			params->pathinfo = ist2(path.ptr + pmatch[2].rm_so, pmatch[2].rm_eo - pmatch[2].rm_so);
 
 	  check_index:
@@ -2188,9 +2188,10 @@ static size_t fcgi_strm_send_stdin(struct fcgi_conn *fconn, struct fcgi_strm *fs
 	size = htx_get_blksz(blk);
 	if (unlikely(size == count && htx_nbblks(htx) == 1 && type == HTX_BLK_DATA)) {
 		void *old_area = mbuf->area;
+		int eom = (htx->flags & HTX_FL_EOM);
 
 		 /* Last block of the message: Reserve the size for the empty stdin record */
-		if (htx->flags & HTX_FL_EOM)
+		if (eom)
 			extra_bytes = FCGI_RECORD_HEADER_SZ;
 
 		if (b_data(mbuf)) {
@@ -2226,6 +2227,8 @@ static size_t fcgi_strm_send_stdin(struct fcgi_conn *fconn, struct fcgi_strm *fs
 
 		htx = (struct htx *)buf->area;
 		htx_reset(htx);
+		if (eom)
+			goto empty_stdin;
 		goto end;
 	}
 
@@ -2275,7 +2278,9 @@ static size_t fcgi_strm_send_stdin(struct fcgi_conn *fconn, struct fcgi_strm *fs
 					    b_data(&outbuf) + v.len + extra_bytes <= b_room(mbuf) &&
 					    b_data(mbuf) <= MAX_DATA_REALIGN)
 						goto realign_again;
-					v.len = b_room(&outbuf) - FCGI_RECORD_HEADER_SZ - extra_bytes;
+					v.len = (FCGI_RECORD_HEADER_SZ + extra_bytes > b_room(&outbuf)
+						 ? 0
+						 : b_room(&outbuf) - FCGI_RECORD_HEADER_SZ - extra_bytes);
 				}
 				if (!v.len || !chunk_memcat(&outbuf, v.ptr, v.len)) {
 					if (outbuf.data == FCGI_RECORD_HEADER_SZ)
@@ -2306,6 +2311,7 @@ static size_t fcgi_strm_send_stdin(struct fcgi_conn *fconn, struct fcgi_strm *fs
 
 	/* Send the empty stding here to finish the message */
 	if (htx_is_empty(htx) && (htx->flags & HTX_FL_EOM)) {
+	  empty_stdin:
 		TRACE_PROTO("sending FCGI STDIN record", FCGI_EV_TX_RECORD|FCGI_EV_TX_STDIN, fconn->conn, fstrm, htx);
 		if (!fcgi_strm_send_empty_stdin(fconn, fstrm)) {
 			/* bytes already reserved for this record. It should not fail */
@@ -4184,14 +4190,14 @@ static int fcgi_show_fd(struct buffer *msg, struct connection *conn)
 		if (fstrm->cs)
 			chunk_appendf(msg, " .cs.flg=0x%08x .cs.data=%p",
 				      fstrm->cs->flags, fstrm->cs->data);
-		chunk_appendf(&trash, " .subs=%p", fstrm->subs);
+		chunk_appendf(msg, " .subs=%p", fstrm->subs);
 		if (fstrm->subs) {
-			chunk_appendf(&trash, "(ev=%d tl=%p", fstrm->subs->events, fstrm->subs->tasklet);
-			chunk_appendf(&trash, " tl.calls=%d tl.ctx=%p tl.fct=",
+			chunk_appendf(msg, "(ev=%d tl=%p", fstrm->subs->events, fstrm->subs->tasklet);
+			chunk_appendf(msg, " tl.calls=%d tl.ctx=%p tl.fct=",
 				      fstrm->subs->tasklet->calls,
 				      fstrm->subs->tasklet->context);
-			resolve_sym_name(&trash, NULL, fstrm->subs->tasklet->process);
-			chunk_appendf(&trash, ")");
+			resolve_sym_name(msg, NULL, fstrm->subs->tasklet->process);
+			chunk_appendf(msg, ")");
 		}
 	}
 	return 0;
diff --git a/src/mux_h1.c b/src/mux_h1.c
index 8d5de5e..c29c4ed 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2133,7 +2133,7 @@ static size_t h1_process_output(struct h1c *h1c, struct buffer *buf, size_t coun
 					/* EOM flag is set or empty payload (C-L to 0) and it is the last block */
 					if (htx_is_unique_blk(chn_htx, blk) &&
 					    ((chn_htx->flags & HTX_FL_EOM) || ((h1m->flags & H1_MF_CLEN) && !h1m->curr_len))) {
-						if (h1m->flags & H1_MF_CHNK) {
+						if ((h1m->flags & H1_MF_CHNK) && !(h1s->flags & H1S_F_BODYLESS_RESP)) {
 							if (!chunk_memcat(&tmp, "\r\n0\r\n\r\n", 7))
 								goto full;
 						}
@@ -2556,9 +2556,10 @@ static int h1_handle_req_tout(struct h1c *h1c)
 		_HA_ATOMIC_INC(&sess->listener->counters->failed_req);
 
 	h1c->errcode = 408;
+	ret = h1_send_error(h1c);
 	if (b_data(&h1c->ibuf) || !(sess->fe->options & PR_O_NULLNOLOG))
-		ret = h1_send_error(h1c);
-	sess_log(sess);