haproxy-2.0.14-bp152.1.1

- Removed patch: haproxy-2.0-hpack-tbl.patch as already fixed in 2.0.14
- Update to version 2.0.14: (bsc#1169457)
  * [RELEASE] Released version 2.0.14
  * BUG/MINOR: namespace: avoid closing fd when socket failed in my_socketat
  * BUG/MEDIUM: muxes: Use the right argument when calling the destroy method.
  * SCRIPTS: announce-release: use mutt -H instead of -i to include the draft
  * MINOR: http-htx: Add a function to retrieve the headers size of an HTX message
  * MINOR: filters: Forward data only if the last filter forwards something
  * BUG/MINOR: filters: Count HTTP headers as filtered data but don't forward them
  * BUG/MINOR: http-ana: Matching on monitor-uri should be case-sensitive
  * BUG/MAJOR: http-ana: Always abort the request when a tarpit is triggered
  * MINOR: ist: add an iststop() function
  * BUG/MINOR: http: http-request replace-path duplicates the query string
  * BUG/MEDIUM: shctx: make sure to keep all blocks aligned
  * MINOR: compiler: move CPU capabilities definition from config.h and complete them
  * BUG/MEDIUM: ebtree: don't set attribute packed without unaligned access support
  * BUILD: fix recent build failure on unaligned archs
  * CLEANUP: cfgparse: Fix type of second calloc() parameter
  * BUG/MINOR: sample: fix the json converter's endian-sensitivity
  * BUG/MEDIUM: ssl: fix several bad pointer aliases in a few sample fetch functions
  * BUG/MINOR: connection: make sure to correctly tag local PROXY connections
  * MINOR: compiler: add new alignment macros
  * BUILD: ebtree: improve architecture-specific alignment
  * BUG/MINOR: sample: Make sure to return stable IDs in the unique-id fetch
  * BUG/MINOR: dns: ignore trailing dot
  * MINOR: contrib/prometheus-exporter: Add heathcheck status/code in server metrics
  * MINOR: contrib/prometheus-exporter: Add the last heathcheck duration metric
  * BUG/MEDIUM: random: initialize the random pool a bit better
  * MINOR: tools: add 64-bit rotate operators
  * BUG/MEDIUM: random: implement a thread-safe and process-safe PRNG
  * MINOR: backend: use a single call to ha_random32() for the random LB algo
  * BUG/MINOR: checks/threads: use ha_random() and not rand()
  * BUG/MAJOR: list: fix invalid element address calculation
  * MINOR: debug: report the task handler's pointer relative to main
  * BUG/MEDIUM: debug: make the debug_handler check for the thread in threads_to_dump
  * MINOR: haproxy: export main to ease access from debugger
  * BUG/MINOR: wdt: do not return an error when the watchdog couldn't be enabled
  * DOC: fix incorrect indentation of http_auth_*
  * OPTIM: startup: fast unique_id allocation for acl.
  * BUG/MINOR: pattern: Do not pass len = 0 to calloc()
  * DOC: configuration.txt: fix various typos
  * DOC: assorted typo fixes in the documentation and Makefile
  * BUG/MINOR: init: make the automatic maxconn consider the max of soft/hard limits
  * BUG/MAJOR: proxy_protocol: Properly validate TLV lengths
  * REGTEST: make the PROXY TLV validation depend on version 2.2
  * MINOR: htx: Add a function to return a block at a specific offset
  * BUG/MEDIUM: cache/filters: Fix loop on HTX blocks caching the response payload
  * BUG/MEDIUM: compression/filters: Fix loop on HTX blocks compressing the payload
  * BUG/MINOR: http-ana: Reset request analysers on a response side error
  * BUG/MINOR: lua: Ignore the reserve to know if a channel is full or not
  * BUG/MINOR: http-rules: Preserve FLT_END analyzers on reject action
  * BUG/MINOR: http-rules: Fix a typo in the reject action function
  * BUG/MINOR: rules: Preserve FLT_END analyzers on silent-drop action
  * BUG/MINOR: rules: Increment be_counters if backend is assigned for a silent-drop
  * DOC: fix typo about no-tls-tickets
  * DOC: improve description of no-tls-tickets
  * DOC: ssl: clarify security implications of TLS tickets
  * BUILD: wdt: only test for SI_TKILL when compiled with thread support
  * BUG/MEDIUM: random: align the state on 2*64 bits for ARM64
  * BUG/MINOR: haproxy: always initialize sleeping_thread_mask
  * BUG/MINOR: listener/mq: do not dispatch connections to remote threads when stopping
  * BUG/MINOR: haproxy/threads: try to make all threads leave together
  * DOC: proxy_protocol: Reserve TLV type 0x05 as PP2_TYPE_UNIQUE_ID
  * BUILD: on ARM, must be linked to libatomic.
  * BUILD: makefile: fix regex syntax in ARM platform detection
  * BUILD: makefile: fix expression again to detect ARM platform
  * BUG/MEDIUM: peers: resync ended with RESYNC_PARTIAL in wrong cases.
  * DOC: assorted typo fixes in the documentation
  * MINOR: wdt: Move the definitions of WDTSIG and DEBUGSIG into types/signal.h.
  * BUG/MEDIUM: wdt: Don't ignore WDTSIG and DEBUGSIG in __signal_process_queue().
  * MINOR: memory: Change the flush_lock to a spinlock, and don't get it in alloc.
  * BUG/MINOR: connections: Make sure we free the connection on failure.
  * REGTESTS: use "command -v" instead of "which"
  * REGTEST: increase timeouts on the seamless-reload test
  * BUG/MINOR: haproxy/threads: close a possible race in soft-stop detection
  * BUG/MINOR: peers: init bind_proc to 1 if it wasn't initialized
  * BUG/MINOR: peers: avoid an infinite loop with peers_fe is NULL
  * BUG/MINOR: peers: Use after free of "peers" section.
  * MINOR: listener: add so_name sample fetch
  * BUILD: ssl: only pass unsigned chars to isspace()
  * BUG/MINOR: stats: Fix color of draining servers on stats page
  * DOC: internals: Fix spelling errors in filters.txt
  * MINOR: http-rules: Add a flag on redirect rules to know the rule direction
  * BUG/MINOR: http_ana: make sure redirect flags don't have overlapping bits
  * MINOR: http-rules: Handle the rule direction when a redirect is evaluated
  * BUG/MINOR: filters: Use filter offset to decude the amount of forwarded data
  * BUG/MINOR: filters: Forward everything if no data filters are called
  * BUG/MINOR: http-ana: Reset request analysers on error when waiting for response
  * BUG/CRITICAL: hpack: never index a header into the headroom after wrapping
  2020/02/13 : 2.0.13
  * BUG/MINOR: checks: refine which errno values are really errors.
  * BUG/MEDIUM: checks: Only attempt to do handshakes if the connection is ready.
  * BUG/MEDIUM: connections: Hold the lock when wanting to kill a connection.
  * MINOR: config: disable busy polling on old processes
  * MINOR: ssl: Remove unused variable "need_out".
  * BUG/MINOR: h1: Report the right error position when a header value is invalid
  * BUG/MINOR: proxy: Fix input data copy when an error is captured
  * BUG/MEDIUM: http-ana: Truncate the response when a redirect rule is applied
  * BUG/MINOR: channel: inject output data at the end of output
  * BUG/MEDIUM: session: do not report a failure when rejecting a session
  * BUG/MINOR: stream-int: Don't trigger L7 retry if max retries is already reached
  * BUG/MINOR: mux-h2: use a safe list_for_each_entry in h2_send()
  * BUG/MEDIUM: mux-h2: fix missing test on sending_list in previous patch
  * BUG/MEDIUM: mux-h2: don't stop sending when crossing a buffer boundary
  * BUG/MINOR: cli/mworker: can't start haproxy with 2 programs
  * REGTEST: mcli/mcli_start_progs: start 2 programs
  * BUG/MEDIUM: mworker: remain in mworker mode during reload
  * BUG/MEDIUM: mux_h1: Don't call h1_send if we subscribed().
  * BUG/MAJOR: hashes: fix the signedness of the hash inputs
  * REGTEST: add sample_fetches/hashes.vtc to validate hashes
  * BUG/MEDIUM: cli: _getsocks must send the peers sockets
  * BUG/MINOR: stream: don't mistake match rules for store-request rules
  * BUG/MEDIUM: connection: add a mux flag to indicate splice usability
  * BUG/MINOR: pattern: handle errors from fgets when trying to load patterns
  * BUG/MINOR: cache: Fix leak of cache name in error path
  * BUG/MINOR: dns: Make dns_query_id_seed unsigned
  * BUG/MINOR: 51d: Fix bug when HTX is enabled
  * BUILD: pattern: include errno.h
  * BUG/MINOR: http-ana/filters: Wait end of the http_end callback for all filters
  * BUG/MINOR: http-rules: Remove buggy deinit functions for HTTP rules
  * BUG/MINOR: stick-table: Use MAX_SESS_STKCTR as the max track ID during parsing
  * BUG/MINOR: tcp-rules: Fix memory releases on error path during action parsing
  * MINOR: proxy/http-ana: Add support of extra attributes for the cookie directive
  * BUG/MINOR: http_act: don't check capture id in backend
  * BUG/MEDIUM: 0rtt: Only consider the SSL handshake.
  * BUG/MINOR: stktable: report the current proxy name in error messages
  * BUG/MEDIUM: mux-h2: make sure we don't emit TE headers with anything but "trailers"
  * BUILD: cfgparse: silence a bogus gcc warning on 32-bit machines
  * BUG/MINOR: dns: allow srv record weight set to 0
  * BUG/MEDIUM: ssl: Don't forget to free ctx->ssl on failure.
  * BUG/MINOR: tcpchecks: fix the connect() flags regarding delayed ack
  * BUG/MEDIUM: pipe: fix a use-after-free in case of pipe creation error
  * BUG/MINOR: connection: fix ip6 dst_port copy in make_proxy_line_v2
  * BUG/MEDIUM: connections: Don't forget to unlock when killing a connection.
  * BUG/MEDIUM: memory_pool: Update the seq number in pool_flush().
  * MINOR: memory: Only init the pool spinlock once.
  * BUG/MEDIUM: memory: Add a rwlock before freeing memory.
  * BUG/MAJOR: memory: Don't forget to unlock the rwlock if the pool is empty.
  * BUG/MINOR: ssl: we may only ignore the first 64 errors
  * CONTRIB: debug: add missing flags SF_HTX and SF_MUX
  * CONTRIB: debug: add the possibility to decode the value as certain types only
  * CONTRIB: debug: support reporting multiple values at once
  * MINOR: acl: Warn when an ACL is named 'or'
  * CONTRIB: debug: also support reading values from stdin
  * SCRIPTS: announce-release: place the send command in the mail's header
  * SCRIPTS: announce-release: allow the user to force to overwrite old files
  * MINOR: build: add linux-glibc-legacy build TARGET
  * BUG/MINOR: unix: better catch situations where the unix socket path length is close to the limit
  * MINOR: http: add a new "replace-path" action
  * BUG/MINOR: ssl: Possible memleak when allowing the 0RTT data buffer.
  * BUG/MINOR: dns: allow 63 char in hostname
  * BUG/MEDIUM: listener: only consider running threads when resuming listeners
  * BUG/MINOR: listener: enforce all_threads_mask on bind_thread on init
  * BUG/MINOR: tcp: avoid closing fd when socket failed in tcp_bind_listener
  * DOC: word converter ignores delimiters at the start or end of input string
  * BUG/MINOR: tcp: don't try to set defaultmss when value is negative
  * SCRIPTS: make announce-release executable again
  2019/12/21 : 2.0.12
  * DOC: Improve documentation of http-re(quest|sponse) replace-(header|value|uri)
  * DOC: clarify the fact that replace-uri works on a full URI
  * BUG/MINOR: sample: fix the closing bracket and LF in the debug converter
  * BUG/MINOR: sample: always check converters' arguments
  * BUG/MEDIUM: ssl: Don't set the max early data we can receive too early.
  * MINOR: task: only check TASK_WOKEN_ANY to decide to requeue a task
  * BUG/MAJOR: task: add a new TASK_SHARED_WQ flag to fix foreing requeuing
  * BUG/MEDIUM: ssl: Revamp the way early data are handled.
  * MINOR: fd/threads: make _GET_NEXT()/_GET_PREV() use the volatile attribute
  * BUG/MEDIUM: fd/threads: fix a concurrency issue between add and rm on the same fd
  * BUG/MINOR: ssl: openssl-compat: Fix getm_ defines
  * BUG/MEDIUM: stream: Be sure to never assign a TCP backend to an HTX stream
  * BUILD: ssl: improve SSL_CTX_set_ecdh_auto compatibility
  2019/12/11 : 2.0.11
  * BUG/MINOR: stream: init variables when the list is empty
  * BUG/MINOR: contrib/prometheus-exporter: Use HTX errors and not legacy ones
  * BUG/MINOR: contrib/prometheus-exporter: decode parameter and value only
  * BUG/MINOR: http-htx: Don't make http_find_header() fail if the value is empty
  * DOC: Clarify behavior of server maxconn in HTTP mode
  * DOC: clarify matching strings on binary fetches
  * DOC: move the "group" keyword at the right place
  * BUG/MEDIUM: stream-int: don't subscribed for recv when we're trying to flush data
  * BUG/MINOR: stream-int: avoid calling rcv_buf() when splicing is still possible
  * BUG/MEDIUM: listener/thread: fix a race when pausing a listener
  * BUG/MINOR: ssl: certificate choice can be unexpected with openssl >= 1.1.1
  * BUG/MEDIUM: mux-h1: Never reuse H1 connection if a shutw is pending
  * BUG/MINOR: mux-h1: Don't rely on CO_FL_SOCK_RD_SH to set H1C_F_CS_SHUTDOWN
  * BUG/MINOR: mux-h1: Fix conditions to know whether or not we may receive data
  * BUG/MEDIUM: tasks: Make sure we switch wait queues in task_set_affinity().
  * BUG/MEDIUM: checks: Make sure we set the task affinity just before connecting.
  * BUG/MINOR: mux-h1: Be sure to set CS_FL_WANT_ROOM when EOM can't be added
  * BUG/MINOR: proxy: make soft_stop() also close FDs in LI_PAUSED state
  * BUG/MINOR: listener/threads: always use atomic ops to clear the FD events
  * BUG/MINOR: listener: also clear the error flag on a paused listener
  * BUG/MEDIUM: listener/threads: fix a remaining race in the listener's accept()
  * DOC: document the listener state transitions
  * BUG/MAJOR: dns: add minimalist error processing on the Rx path
  * BUG/MEDIUM: proto_udp/threads: recv() and send() must not be exclusive.
  * BUG/MEDIUM: kqueue: Make sure we report read events even when no data.
  * DOC: listeners: add a few missing transitions
  * BUG/MINOR: tasks: only requeue a task if it was already in the queue
  * DOC: proxies: HAProxy only supports 3 connection modes
  * BUILD/MINOR: ssl: shut up a build warning about format truncation
  * BUILD/MINOR: tools: shut up the format truncation warning in get_gmt_offset()
  * BUILD: do not disable -Wformat-truncation anymore
  * DOC: remove references to the outdated architecture.txt
  * BUG/MINOR: log: fix minor resource leaks on logformat error path
  * BUG/MINOR: mworker: properly pass SIGTTOU/SIGTTIN to workers
  * BUG/MINOR: listener: do not immediately resume on transient error
  * BUG/MINOR: server: make "agent-addr" work on default-server line
  * BUG/MINOR: listener: fix off-by-one in state name check
  * BUILD/MINOR: unix sockets: silence an absurd gcc warning about strncpy()

- CVE-2020-11100: Fixed an H2/HPAC vulnerability (bsc#1168023)
  - Added patch: haproxy-2.0-hpack-tbl.patch

- Update to version 2.0.10+git0.ac198b92: (bsc#1157712) (bsc#1157714)
  * [RELEASE] Released version 2.0.10
  * SCRIPTS: git-show-backports: add "-s" to proposed cherry-pick commands
  * SCRIPTS: create-release: show the correct origin name in suggested commands
  * BUG/MAJOR: mux-h2: don't try to decode a response HEADERS frame in idle state
  * BUG/MAJOR: h2: make header field name filtering stronger
  * BUG/MAJOR: h2: reject header values containing invalid chars
  * MINOR: ist: add ist_find_ctl()
  * BUG/MINOR: ssl: fix curve setup with LibreSSL
  * BUG/MINOR: cli: fix out of bounds in -S parser
  * DOC: Add documentation about the use-service action
  * DOC: Add missing stats fields in the management manual
  * BUG/MINOR: mux-h1: Adjust header case when chunked encoding is add to a message
  * BUG/MINOR: mux-h1: Fix a UAF in cfg_h1_headers_case_adjust_postparser()
  * MEDIUM: mux-h1: Add the support of headers adjustment for bogus HTTP/1 apps
  * REGTEST: vtest can now enable mcli with its own flag
  * MINOR: stats: Report max times in addition of the averages for sessions
  * BUG/MINOR: stream-int: Fix si_cs_recv() return value
  * MINOR: contrib/prometheus-exporter: Add a param to ignore servers in maintenance
  * MINOR: contrib/prometheus-exporter: filter exported metrics by scope
  * MINOR: contrib/prometheus-exporter: report the number of idle conns per server
  * BUG/MINOR: contrib/prometheus-exporter: Rename some metrics
  * MINOR: contrib/prometheus-exporter: Report metrics about max times for sessions
  * MINOR: counters: Add fields to store the max observed for {q,c,d,t}_time
  * MINOR: stream: Remove the lock on the proxy to update time stats
  * MINOR: freq_ctr: Make the sliding window sums thread-safe
  * BUG/MINOR: http-ana: Properly catch aborts during the payload forwarding
  * BUG/MINOR: mux-h1: Fix tunnel mode detection on the response path
  * BUILD: debug: Avoid warnings in dev mode with -02 because of some BUG_ON tests
  * BUG/MEDIUM: stream-int: Don't loose events on the CS when an EOS is reported
  * BUILD/MINOR: ssl: fix compiler warning about useless statement
  * BUG/MINOR: peers: "peer alive" flag not reset when deconnecting.
  * BUG/MEDIUM: mworker: don't fill the -sf argument with -1 during the reexec

- Update to version 2.0.9+git6.26b7b800:
  * BUG/MINOR: ssl: fix crt-list neg filter for openssl < 1.1.1
  * BUG/MINOR: peers: Wrong null "server_name" data field handling.
  * MINOR: peers: Add debugging information to "show peers".
  * MINOR: peers: Add TX/RX heartbeat counters.
  * MINOR: peers: Alway show the table info for disconnected peers.

- Update to version 2.0.9+git1.caf02113:
  * BUG/MINOR: init: fix set-dumpable when using uid/gid

- Update to version 2.0.9+git0.efac87ee (bsc#1154980) (CVE-2019-18277):
  * [RELEASE] Released version 2.0.9
  * BUG/MINOR: mux-h1: Don't set CS_FL_EOS on a read0 when receiving data to pipe
  * BUG/MEDIUM: filters: Don't call TCP callbacks for HTX streams
  * BUG/MINOR: log: limit the size of the startup-logs
  * BUILD: contrib/da: remove an "unused" warning
  * MINOR: memory: also poison the area on freeing
  * CLEANUP: session: slightly simplify idle connection cleanup logic
  * BUG/MEDIUM: Make sure we leave the session list in session_free().
  * BUG/MEDIUM: listeners: always pause a listener on out-of-resource condition
  * BUG/MINOR: queue/threads: make the queue unlinking atomic
  * DOC: management: fix typo on "cache_lookups" stats output
  * DOC: management: document cache_hits and cache_lookups in the CSV format
  * DOC: management: document reuse and connect counters in the CSV format
  * BUG: dns: timeout resolve not applied for valid resolutions
  * BUG/MINOR: action: do-resolve now use cached response
  * BUG/MEDIUM: stream: Be sure to release allocated captures for TCP streams
  * MINOR: doc: http-reuse connection pool fix
  * BUG/MEDIUM: stream: Be sure to support splicing at the mux level to enable it
  * BUG/MEDIUM: mux-h1: Disable splicing for chunked messages
  * BUG/MEDIUM: mux-h2: immediately report connection errors on streams
  * BUG/MEDIUM: mux-h2: immediately remove a failed connection from the idle list
  * BUG/MEDIUM: mux-h2: report no available stream on a connection having errors
  * BUG/MINOR: config: Update cookie domain warn to RFC6265
  * BUG/MEDIUM: servers: Only set SF_SRV_REUSED if the connection if fully ready.
  * BUG/MEDIUM: stream_interface: Only use SI_ST_RDY when the mux is ready.
  * MINOR: mux: Add a new method to get informations about a mux.
  * BUG/MINOR: spoe: fix off-by-one length in UUID format string
  * BUG/MAJOR: stream-int: Don't receive data from mux until SI_ST_EST is reached
  * BUG/MINOR: mux-h2: Don't pretend mux buffers aren't full anymore if nothing sent
  * BUG/MINOR: cli: don't call the kw->io_release if kw->parse failed
  * MINOR: tcp: avoid confusion in time parsing init
  * BUG/MINOR: mux-h2: do not emit logs on backend connections
  * MINOR: config: warn on presence of "\n" in header values/replacements

- Update to version 2.0.8+git0.60e6020c:
  * [RELEASE] Released version 2.0.8
  * BUG/MEDIUM: pattern: make the pattern LRU cache thread-local and lockless
  * BUG/MINOR: stick-table: fix an incorrect 32 to 64 bit key conversion
  * BUG/MINOR: ssl: fix memcpy overlap without consequences.
  * BUG/MEDIUM: http: unbreak redirects in legacy mode
  * BUG/MINOR: mux-h2: also make sure blocked legacy connections may expire
  * BUG/MINOR: sample: Make the `field` converter compatible with `-m found`
  * BUG/MINOR: cache: alloc shctx after check config
  * BUG/MINOR: stick-table: Never exceed (MAX_SESS_STKCTR-1) when fetching a stkctr
  * BUG/MINOR: ssl: Fix fd leak on error path when a TLS ticket keys file is parsed
  * BUG/MINOR: mworker/cli: reload fail with inherited FD
  * BUG/MEDIUM: ssl: 'tune.ssl.default-dh-param' value ignored with openssl > 1.1.1
  * CLEANUP: bind: handle warning label on bind keywords parsing.
  * CLEANUP: ssl: make ssl_sock_load_dh_params handle errcode/warn
  * CLEANUP: ssl: make ssl_sock_put_ckch_into_ctx handle errcode/warn
  * CLEANUP: ssl: make ssl_sock_load_cert*() return real error codes
  * REGTEST: mcli/mcli_show_info: launch a 'show info' on the master CLI
  * BUG/MEDIUM: mux_pt: Only call the wake emthod if nobody subscribed to receive.
  * BUG/MEDIUM: mux_pt: Don't destroy the connection if we have a stream attached.
  * Revert e8826ded5fea3593d89da2be5c2d81c522070995.
  * BUG/MAJOR: idle conns: schedule the cleanup task on the correct threads
  * BUG/MEDIUM: mux_pt: Make sure we don't have a conn_stream before freeing.
  * BUG/MINOR: tcp: Don't alter counters returned by tcp info fetchers
  * BUG/MINOR: mworker/ssl: close openssl FDs unconditionally
  * BUG/MINOR: http-htx: Properly set htx flags on error files to support keep-alive
  * MINOR: version: make the version strings variables, not constants
  * BUG/MINOR: WURFL: fix send_log() function arguments
  * BUG/MINOR: mux-h1: Capture ignored parsing errors
  * BUG/MINOR: mux-h1: Mark the output buffer as full when the xfer is interrupted
  * BUG/MINOR: chunk: Fix tests on the chunk size in functions copying data
  * BUG/MEDIUM: htx: Catch chunk_memcat() failures when HTX data are formatted to h1
  * BUILD: ssl: wrong #ifdef for SSL engines code
  * BUG/MINOR: ssl: abort on sni_keytypes allocation failure
  * BUG/MINOR: ssl: free the sni_keytype nodes
  * BUG/MINOR: ssl: abort on sni allocation failure
  * BUG/MEDIUM: applet: always check a fast running applet's activity before killing
  * MINOR: stats: mention in the help message support for "json" and "typed"
  * DOC: fix typo in Prometheus exporter doc
  * DOC: clarify some points around http-send-name-header's behavior
  * BUG/MEDIUM: cache: make sure not to cache requests with absolute-uri
  * BUG/MINOR: peers: crash on reload without local peer.
  * BUG/MEDIUM: mux-h2: do not enforce timeout on long connections
  * BUILD: ebtree: make eb_is_empty() and eb_is_dup() take a const
  * MINOR: mux-h2: add a per-connection list of blocked streams
  * BUG/MINOR: action: do-resolve does not yield on requests with body
  * BUG/MEDIUM: lua: Store stick tables into the sample's `t` field
  * BUG/MINOR: lua: Properly initialize the buffer's fields for string samples in hlua_lua2(smp|arg)
  * BUG/MINOR: stats: Add a missing break in a switch statement

- Update to version 2.0.7+git0.1909aa1e:
  * [RELEASE] Released version 2.0.7
  * BUG/MEDIUM: namespace: fix fd leak in master-worker mode
  * DOC: Fix documentation about the cli command to get resolver stats
  * BUG/MINOR: contrib/prometheus-exporter: Return the time averages in seconds
  * MINOR: stats: Add the support of float fields in stats
  * MINOR: spoe: Support the async mode with several threads
  * MINOR: spoe: Improve generation of the engine-id
  * BUG/MEDIUM: spoe: Use a different engine-id per process
  * BUG/MINOR: mux-h1: Do h2 upgrade only on the first request
  * BUG/MAJOR: mux_h2: Don't consume more payload than received for skipped frames
  * BUG/MINOR: mux-h2: Use the dummy error when decoding headers for a closed stream
  * BUG/MEDIUM: mux-h2: don't reject valid frames on closed streams
  * BUG/MEDIUM: namespace: close open namespaces during soft shutdown
  * BUG/MINOR: mux-h2: do not wake up blocked streams before the mux is ready
  * BUG/MEDIUM: checks: make sure the connection is ready before trying to recv
  * BUG/MEDIUM: stream-int: Process connection/CS errors during synchronous sends
  * BUG/MINOR: stream-int: Process connection/CS errors first in si_cs_send()
  * BUG/MEDIUM: check/threads: make external checks run exclusively on thread 1
  * BUG/MAJOR: mux-h2: Handle HEADERS frames received after a RST_STREAM frame
  * BUG/MINOR: mux-h2: Be sure to have a connection to unsubcribe
  * BUG/MEDIUM: stick-table: Properly handle "show table" with a data type argument

- Update to version 2.0.6+git0.58706ab4:
  * [RELEASE] Released version 2.0.6
  * MINOR: sample: Add UUID-fetch
  * BUG/MINOR: Missing stat_field_names (since f21d17bb)
  * BUG/MINOR: backend: Fix a possible null pointer dereference
  * BUG/MINOR: acl: Fix memory leaks when an ACL expression is parsed
  * BUG/MINOR: filters: Properly set the HTTP status code on analysis error
  * BUG/MEDIUM: http: also reject messages where "chunked" is missing from transfer-enoding
  * BUG/MINOR: ssl: always check for ssl connection before getting its XPRT context
  * BUG/MINOR: listener: Fix a possible null pointer dereference
  * MINOR: stats: report the number of idle connections for each server
  * BUG/MEDIUM: connection: don't keep more idle connections than ever needed
  * BUG/MAJOR: ssl: ssl_sock was not fully initialized.
  * BUG/MINOR: lb/leastconn: ignore the server weights for empty servers
  * MINOR: contrib/prometheus-exporter: Report DRAIN/MAINT/NOLB status for servers
  * BUG/MINOR: checks: do not uselessly poll for reads before the connection is up
  * BUG/MINOR: checks: make __event_chk_srv_r() report success before closing
  * BUG/MINOR: checks: start sending the request right after connect()
  * BUG/MINOR: checks: stop polling for write when we have nothing left to send
  * BUG/MEDIUM: cache: Don't cache objects if the size of headers is too big
  * BUG/MEDIUM: cache: Properly copy headers splitted on several shctx blocks
  * BUG/MINOR: mux-h1: Be sure to update the count before adding EOM after trailers
  * BUG/MINOR: mux-h1: Don't stop anymore input processing when the max is reached
  * BUG/MINOR: mux-h1: Fix size evaluation of HTX messages after headers parsing
  * BUG/MINOR: h1: Properly reset h1m when parsing is restarted
  * BUG/MINOR: http-ana: Reset response flags when 1xx messages are handled
  * BUG/MEDIUM: peers: local peer socket not bound.
  * BUG/MEDIUM: proto-http: Always start the parsing if there is no outgoing data
  * BUG/MEDIUM: url32 does not take the path part into account in the returned hash.
  * BUG/MEDIUM: listener/threads: fix an AB/BA locking issue in delete_listener()
  * BUG/MINOR: mworker: disable SIGPROF on re-exec
  * DOC: fixed typo in management.txt
  * BUG/MEDIUM: mux-h1: do not report errors on transfers ending on buffer full
  * BUG/MEDIUM: mux-h1: do not truncate trailing 0CRLF on buffer boundary
  * MEDIUM: debug: make the thread dump code show Lua backtraces
  * MINOR: lua: export applet and task handlers
  * MINOR: tools: add append_prefixed_str()
  * MINOR: debug: indicate the applet name when the task is task_run_applet()

- Use %license instead of %doc [bsc#1082318]
- Recommend apparmor, it's not required to work (make haproxy
  useable in a container)

- enable prometheus exporter

- enable verbose make output

- Update to version 2.0.5+git0.d905f49a:
  * [RELEASE] Released version 2.0.5
  * BUG/MEDIUM: mux_pt: Don't call unsubscribe if we did not subscribe.
  * MINOR: fd: make sure to mark the thread as not stuck in fd_update_events()
  * BUG/MINOR: stats: Wait the body before processing POST requests
  * BUG/MEDIUM: lua: Fix test on the direction to set the channel exp timeout
  * BUG/MEDIUM: mux_h1: Don't bother subscribing in recv if we're not connected.
  * BUG/MINOR: Fix prometheus '# TYPE' and '# HELP' headers
  * BUG/MINOR: lua: fix setting netfilter mark
  * BUG/MEDIUM: proxy: Don't use cs_destroy() when freeing the conn_stream.
  * BUG/MEDIUM: proxy: Don't forget the SF_HTX flag when upgrading TCP=>H1+HTX.
  * BUG/MINOR: buffers/threads: always clear a buffer's head before releasing it
  * MINOR: ssl: ssl_fc_has_early should work for BoringSSL
  * BUG/MINOR: ssl: fix 0-RTT for BoringSSL
  * BUG/MEDIUM: stick-table: Wrong stick-table backends parsing.
  * [RELEASE] Released version 2.0.4
  * BUG/MEDIUM: checks: make sure to close nicely when we're the last to speak
  * BUG/MINOR: mux-h2: always reset rcvd_s when switching to a new frame
  * BUG/MINOR: mux-h2: always send stream window update before connection's
  * BUG/MEDIUM: mux-h2: do not recheck a frame type after a state transition
  * BUG/MINOR: mux-h2: do not send REFUSED_STREAM on aborted uploads
  * BUG/MINOR: mux-h2: use CANCEL, not STREAM_CLOSED in h2c_frt_handle_data()
  * BUG/MINOR: mux-h2: don't refrain from sending an RST_STREAM after another one
  * BUG/MEDIUM: fd: Always reset the polled_mask bits in fd_dodelete().
  * BUG/MEDIUM: proxy: Make sure to destroy the stream on upgrade from TCP to H2
  * BUG/MEDIUM: mux-h2: split the stream's and connection's window sizes
  * BUG/MEDIUM: mux-h2: unbreak receipt of large DATA frames
  * BUG/MINOR: stream-int: also update analysers timeouts on activity
  * BUG/MAJOR: http/sample: use a static buffer for raw -> htx conversion
  * BUG/MEDIUM: lb-chash: Ensure the tree integrity when server weight is increased
  * MINOR: wdt: also consider that waiting in the thread dumper is normal
  * BUG/MINOR: debug: fix a small race in the thread dumping code

- Update to version 2.0.3+git14.0ff395c1 (bsc#1142529) (CVE-2019-14241):
  * BUG/MAJOR: queue/threads: avoid an AB/BA locking issue in process_srv_queue()
  * BUG/MINOR: htx: Fix free space addresses calculation during a block expansion
  * BUG/MINOR: hlua: Only execute functions of HTTP class if the txn is HTTP ready
  * MINOR: hlua: Add a flag on the lua txn to know in which context it can be used
  * MINOR: hlua: Don't set request analyzers on response channel for lua actions
  * BUG/MEDIUM: hlua: Check the calling direction in lua functions of the HTTP class
  * BUG/MINOR: hlua/htx: Reset channels analyzers when txn:done() is called
  * DOC: improve the wording in CONTRIBUTING about how to document a bug fix
  * BUG/MINOR: log: make sure writev() is not interrupted on a file output
  * BUG/MEDIUM: streams: Don't switch the SI to SI_ST_DIS if we have data to send.
  * BUG/MEDIUM: lb-chash: Fix the realloc() when the number of nodes is increased
  * BUILD: threads: add the definition of PROTO_LOCK
  * BUG/MINOR: proxy: always lock stop_proxy()
  * BUG/MEDIUM: protocols: add a global lock for the init/deinit stuff
  * [RELEASE] Released version 2.0.3
  * BUG/CRITICAL: http_ana: Fix parsing of malformed cookies which start by a delimiter
  * BUG/MINOR: http_htx: Support empty errorfiles
  * BUG/MINOR: http_ana: Be sure to have an allocated buffer to generate an error
  * BUG/MEDIUM: tcp-checks: do not dereference inexisting conn_stream
  * BUG/MINOR: mux-h1: Close server connection if input data remains in h1_detach()
  * BUG/MEDIUM: mux-h1: Trim excess server data at the end of a transaction
  * BUG/MINOR: checks: do not exit tcp-checks from the middle of the loop
  * BUG/MINOR: session: Send a default HTTP error if accept fails for a H1 socket
  * BUG/MINOR: session: Emit an HTTP error if accept fails only for H1 connection
  * BUG/MINOR: debug: Remove flags CO_FL_SOCK_WR_ENA/CO_FL_SOCK_RD_ENA
  * DOC: htx: Update comments in HTX files
  * BUG/MINOR: hlua: Make the function txn:done() HTX aware
  * BUG/MINOR: cache/htx: Make maxage calculation HTX aware
  * BUG/MINOR: http_htx: Initialize HTX error messages for TCP proxies
  * BUG/MINOR: http_fetch: Fix http_auth/http_auth_group when called from TCP rules
  * BUG/MINOR: backend: do not try to install a mux when the connection failed
  * BUG/MEDIUM: http/htx: unbreak option http_proxy
  * BUG/MEDIUM: checks: Don't attempt to receive data if we already subscribed.
  * BUG/MINOR: dns: remove irrelevant dependency on a client connection
  * [RELEASE] Released version 2.0.2
  * BUG/MEDIUM: threads: cpu-map designating a single thread/process are ignored
  * BUG/MEDIUM: tcp-check: unbreak multiple connect rules again
  * BUG/MINOR: mux-pt: do not pretend there's more data after a read0
  * BUG/MEDIUM: streams: Don't redispatch with L7 retries if redispatch isn't set.
  * BUG/MEDIUM: streams: Don't give up if we couldn't send the request.
  * BUG/MINOR: mux-h1: Correctly report Ti timer when HTX and keepalives are used
  * BUG/MEDIUM: mux-h1: Don't release h1 connection if there is still data to send
  * BUG/MAJOR: listener: fix thread safety in resume_listener()
  * MINOR: task: introduce work lists
  * BUG/MEDIUM: servers: Fix a race condition with idle connections.
  * DOC: Fix typos and grammer in configuration.txt
  * BUG/MEDIUM: da: cast the chunk to string.
  * BUG/MEDIUM: checks: Don't attempt to read if we destroyed the connection.
  * BUG/MINOR: server: Be really able to keep "pool-max-conn" idle connections
  * BUG/MEDIUM: fd/threads: fix excessive CPU usage on multi-thread accept

- Update to version 2.0.1+git27.5db881ff:
  * BUG/MINOR: ssl: revert empty handshake detection in OpenSSL <= 1.0.2
  * BUG/MEDIUM: servers: Don't forget to set srv_cs to NULL if we can't reuse it.
  * BUG/MEDIUM: stream-int: Don't rely on CF_WRITE_PARTIAL to unblock opposite si
  * MINOR: stream-int: Factorize processing done after sending data in si_cs_send()
  * BUG/MINOR: mux-h1: Don't process input or ouput if an error occurred
  * BUG/MEDIUM: mux-h1: Handle TUNNEL state when outgoing messages are formatted
  * BUG/MEDIUM: lb_fas: Don't test the server's lb_tree from outside the lock
  * BUG/MEDIUM: http/applet: Finish request processing when a service is registered
  * MINOR: action: Add the return code ACT_RET_DONE for actions
  * BUG/MINOR: contrib/prometheus-exporter: Don't try to add empty data blocks
  * MINOR: server: Add "no-tfo" option.
  * BUG/MEDIUM: sessions: Don't keep an extra idle connection in sessions.
  * BUG/MEDIUM: servers: Authorize tfo in default-server.
  * BUG/MEDIUM: connections: Make sure we're unsubscribe before upgrading the mux.
  * BUG/MINOR: contrib/prometheus-exporter: Respect the reserve when data are sent
  * BUG/MINOR: hlua/htx: Respect the reserve when HTX data are sent
  * BUG/MEDIUM: channel/htx: Use the total HTX size in channel_htx_recv_limit()
  * BUG/MINOR: hlua: Don't use channel_htx_recv_max()
  * BUG/MINOR: contrib/prometheus-exporter: Don't use channel_htx_recv_max()
  * BUG/MEDIUM: checks: Make sure the tasklet won't run if the connection is closed.
  * BUG/MEDIUM: connections: Always call shutdown, with no linger.
  * BUG/MINOR: mux-h1: Don't return the empty chunk on HEAD responses
  * BUG/MINOR: mux-h1: Skip trailers for non-chunked outgoing messages
  * BUG/MEDIUM: checks: unblock signals in external checks
  * BUG/MEDIUM: mux-h1: Always release H1C if a shutdown for writes was reported
  * BUG/MEDIUM: ssl: Don't attempt to set alpn if we're not using SSL.
  * BUG/MINOR: mworker/cli: don't output a \n before the response
  * BUG/MINOR: mux-h1: Make format errors during output formatting fatal
  * BUG/MEDIUM: mux-h1: Use buf_room_for_htx_data() to detect too large messages
  * BUG/MEDIUM: proto_htx: Don't add EOM on 1xx informational messages
  * BUG/MINOR: log: Detect missing sampling ranges in config
  * BUG/MINOR: memory: Set objects size for pools in the per-thread cache
  * BUG/MAJOR: mux-h1: Don't crush trash chunk area when outgoing message is formatted
  * BUG/MINOR: htx: Save hdrs_bytes when the HTX start-line is replaced
  * BUG/MEDIUM: ssl: Don't do anything in ssl_subscribe if we have no ctx.
  * BUG/MEDIUM: connections: Always add the xprt handshake if needed.
  * BUG/MEDIUM: stream_interface: Don't add SI_FL_ERR the state is < SI_ST_CON.
  * BUG/MINOR: spoe: Fix memory leak if failing to allocate memory
  * BUG/MEDIUM: mworker/cli: command pipelining doesn't work anymore
  * BUG/MEDIUM: mworker: don't call the thread and fdtab deinit
  * BUG/MINOR: mworker-prog: Fix segmentation fault during cfgparse
  * BUG/MAJOR: sample: Wrong stick-table name parsing in "if/unless" ACL condition.
  * BUG/MEDIUM: lb_fwlc: Don't test the server's lb_tree from outside the lock
  * BUG/MEDIUM: mux-h2: Remove the padding length when a DATA frame size is checked
  * BUG/MEDIUM: mux-h2: Reset padlen when several frames are demux

- Correct version line, which should be 2.0.0+git6.

- allow the new master socket path in the apparmor profile

- Update to version 2.0.0~git6.41dc8432:
  * BUG/MEDIUM: htx: Fully update HTX message when the block value is changed
  * MINOR: htx: Add the function htx_change_blk_value_len()
  * BUG/MEDIUM: compression: Set Vary: Accept-Encoding for compressed responses
  * BUG/MINOR: mux-h1: Add the header connection in lower case in outgoing messages
  * BUG/MINOR: lua/htx: Make txn.req_req_* and txn.res_rep_* HTX aware
  * BUG/MEDIUM: h2/htx: Update data length of the HTX when the cookie list is built

- Update to version 2.0.0~git0.ba23630a:
  - new internal native HTTP representation called HTX, was already in 1.9
    and is now enabled by default in 2.0 ;
  - end-to-end HTTP/2 support including trailers and continuation frames,
    as needed for gRPC ; HTTP/2 may also be upgraded from HTTP/1.1 using
    the H2 preface;
  - server connection pooling and more advanced reuse, with ALPN protocol
    negotiation (already in 1.9) ;
  - layer 7 retries, allowing to use 0-RTT and TCP Fast Open to the servers
    as well as on the frontend ;
  - much more scalable multi-threading, which is even enabled by default on
    platforms where it was successfully tested ; by default, as many threads
    are started as the number of CPUs haproxy is allowed to run on. This
    removes a lot of configuration burden in VMs and containers ;
  - automatic maxconn setting for the process and the frontends, directly
    based on the number of available FDs (easier configuration in containers
    and with systemd) ;
  - logging to stdout for use in containers and systemd (already in 1.9).
    Logs can now provide micro-second resolution for some events ;
  - peers now support SSL, declaration of multiple stick-tables directly in
    the peers section, and synchronization of server names, not just IDs ;
  - In master-worker mode, the master process now exposes its own CLI and
    can communicate with all other processes (including the stopping ones),
    even allowing to connect to their CLI and check their state. It is also
    possible to start some sidecar programs and monitor them from the master,
    and the master can automatically kill old processes that survived too
    many reloads ;
  - the incoming connections are load-balanced between all threads depending
    on their load to minimize the processing time and maximize the capacity
    (already in 1.9) ;
  - the SPOE connection load-balancing was significantly improved in order
    to reduce high percentiles of SPOA response time (already in 1.9) ;
  - the "random" load balancing algorithm and a power-of-two-choices variant
    were introduced ;
  - statistics improvements with per-thread counters for certain things, and
    a prometheus exporter for all our statistics;
  - lots of debugging help, it's easier to produce a core dump, there are
    new commands on the CLI to control various things, there is a watchdog
    to fail cleanly when a thread deadlock or a spinning task are detected,
    so overall it should provide a better experience in field and less
    round trips between users and developers (hence less stress during an
    incident).
  - all 3 device detection engines are now compatible with multi-threading
    and can be build-tested without any external dependencies ;
  - "do-resolve" http-request action to perform a DNS resolution on any,
    sample, and resolvers now support relying on /etc/resolv.conf to match
    the local resolver ;
  - log sampling and balancing : it's now possible to send 1 log every 10
    to a server, or to spread the logging load over multiple log servers;
  - a new SPOA agent (spoa_server) allows to interface haproxy with Python
    and Lua programs ;
  - support for Solaris' event ports (equivalent of kqueue or epoll) which
    will significantly improve the performance there when dealing with
    numerous connections ;
  - some warnings are now reported for some deprecated options that will
    be removed in 2.1. Since 2.0 is long term supported, there's no
    emergency to convert them, however if you see these warnings, you
    need to understand that you're among their extremely rare users and
    just because of this you may be taking risks by keeping them ;
  - A new SOCKS4 server-side layer was provided ; it allows outgoing
    connections to be forwarded through a SOCKS4 proxy (such as ssh -D).
  - priority- and latency- aware server queues : it is possible now to
    assign priorities to certain requests and/or to give them a time
    bonus or penalty to refine control of the traffic and be able to
    engage on SLAs.
  - internally the architecture was significantly redesigned to allow to
    further improve performance and make it easier to implement protocols
    that span over multiple layers (such as QUIC). This work started in
    1.9 and will continue with 2.1.
  - the I/O, applets and tasks now share the same multi-threaded scheduler,
    giving a much better responsiveness and fairness between all tasks as
    is visible with the CLI which always responds instantly even under
    extreme loads (started in 1.9) ;
  - the internal buffers were redesigned to ease zero-copy operations, so
    that it is possible to sustain a high bandwidth even when forwarding
    HTTP/1 to/from HTTP/2 (already in 1.9) ;

- Update to version 1.8.20~git0.6fb9fadc:
  * [RELEASE] Released version 1.8.20
  * BUG/MINOR: spoe: Don't systematically wakeup SPOE stream in the applet handler
  * BUG/MINOR: da: Get the request channel to call CHECK_HTTP_MESSAGE_FIRST()
  * BUG/MINOR: 51d: Get the request channel to call CHECK_HTTP_MESSAGE_FIRST()
  * BUG/MEDIUM: thread/http: Add missing locks in set-map and add-acl HTTP rules
  * BUG/MINOR: acl: properly detect pattern type SMP_T_ADDR
  * BUG/MEDIUM: maps: only try to parse the default value when it's present
  * BUG/MAJOR: http_fetch: Get the channel depending on the keyword used
  * MINOR: skip get_gmtime where tm is unused
  * BUILD/MINOR: listener: Silent a few signedness warnings.
  * BUG/MEDIUM: listener: make sure the listener never accepts too many conns
  * BUG/MEDIUM: listener: use a self-locked list for the dequeue lists
  * MAJOR: listener: do not hold the listener lock in listener_accept()
  * BUG/MEDIUM: list: fix incorrect pointer unlocking in LIST_DEL_LOCKED()
  * BUG/MEDIUM: list: fix again LIST_ADDQ_LOCKED
  * BUG/MEDIUM: list: correct fix for LIST_POP_LOCKED's removal of last element
  * MINOR: list: make the delete and pop operations idempotent
  * BUG/MEDIUM: list: add missing store barriers when updating elements and head
  * BUG/MEDIUM: list: fix LIST_POP_LOCKED's removal of the last pointer
  * BUG/MEDIUM: list: fix the rollback on addq in the locked liss
  * BUG/MEDIUM: lists: Properly handle the case we're removing the first elt.
  * MINOR: lists: Implement locked variations.
  * BUG/MINOR: threads: fix the process range of thread masks
  * BUG/MEDIUM: spoe: Return an error if nothing is encoded for fragmented messages
  * BUG/MEDIUM: spoe: Queue message only if no SPOE applet is attached to the stream
  * BUG/MEDIUM: pattern: assign pattern IDs after checking the config validity
  * BUILD: connection: fix naming of ip_v field
  * BUILD: use inttypes.h instead of stdint.h
  * BUG/MEDIUM: peers: fix a case where peer session is not cleanly reset on release.
  * MINOR: cli: start addresses by a prefix in 'show cli sockets'
  * BUG/MINOR: cli: correctly handle abns in 'show cli sockets'
  * BUILD: Makefile: disable shared cache on AIX 5.1
  * BUILD: makefile: add _LINUX_SOURCE_COMPAT to build on AIX-51
  * BUILD: makefile: fix build of IPv6 header on aix51
  * MINOR: tools: make memvprintf() never pass a NULL target to vsnprintf()
  * BUILD: makefile: work around an old bug in GNU make-3.80
  * BUG/MAJOR: checks: segfault during tcpcheck_main
  * DOC: The option httplog is no longer valid in a backend.
  * BUG/MEDIUM: ssl: ability to set TLS 1.3 ciphers using ssl-default-server-ciphersuites
  * BUG/MINOR: http/counters: fix missing increment of fe->srv_aborts
  * BUG/MAJOR: stats: Fix how huge POST data are read from the channel
  * BUG/MAJOR: spoe: Fix initialization of thread-dependent fields
  * BUG/MEDIUM: threads/fd: do not forget to take into account epoll_fd/pipes
  * MEDIUM: threads: Use __ATOMIC_SEQ_CST when using the newer atomic API.
  * BUG/MINOR: ssl: fix warning about ssl-min/max-ver support
  * BUG/MEDIUM: 51d: fix possible segfault on deinit_51degrees()
  * BUG/MEDIUM: logs: Only attempt to free startup_logs once.
  * BUG/MINOR: listener: keep accept rate counters accurate under saturation
  * BUG/MAJOR: listener: Make sure the listener exist before using it.

- Update to version 1.8.17~git0.e89d25b2 (bsc#1121283) (CVE-2018-20615):
  * BUG/CRITICAL: mux-h2: re-check the frame length when PRIORITY is used
  * BUG/MEDIUM: lua: dead lock when Lua tasks are trigerred
  * BUG/MINOR: lua: bad args are returned for Lua actions
  * BUG/MINOR: lua: Return an error if a legacy HTTP applet doesn't send anything
  * BUG/MEDIUM: cli: make "show sess" really thread-safe
  * MINOR: stream/cli: report more info about the HTTP messages on "show sess all"
  * MINOR: stream/cli: fix the location of the waiting flag in "show sess all"
  * MINOR: lb: allow redispatch when using consistent hash
  * BUG/MEDIUM: server: Also copy "check-sni" for server templates.
  * BUG/MEDIUM: mux-h2: mark that we have too many CS once we have more than the max
  * MINOR: mux-h2: only increase the connection window with the first update
  * BUG/MAJOR: stream-int: Update the stream expiration date in stream_int_notify()
  * BUG/MEDIUM: dns: overflowed dns name start position causing invalid dns error
  * BUG/MEDIUM: dns: Don't prevent reading the last byte of the payload in dns_validate_response()
  * BUG/MINOR: logs: leave startup-logs global and not per-thread

- Update to version 1.8.15~git0.6b6a350a: (bsc#1119419) (CVE-2018-20103) (VUL-0) (bsc#1119368) (CVE-2018-20102)
  * DOC: Update configuration doc about the maximum number of stick counters.
  * BUG: dns: Fix off-by-one write in dns_validate_dns_response()
  * BUG: dns: Fix out-of-bounds read via signedness error in dns_validate_dns_response()
  * BUG: dns: Prevent out-of-bounds read in dns_validate_dns_response()
  * BUG: dns: Prevent out-of-bounds read in dns_read_name()
  * BUG: dns: Prevent stack-exhaustion via recursion loop in dns_read_name
  * DOC: refer to check-sni in the documentation of sni
  * DOC: clarify that check-sni needs an argument.
  * MINOR: servers: Free [idle|safe|priv]_conns on exit.
  * MINOR: stats: report the number of active jobs and listeners in "show info"
  * BUG/MINOR: mux-h2: advertise a larger connection window size
  * BUG/MINOR: mux-h2: refrain from muxing during the preface
  * BUG/MINOR: hpack: fix off-by-one in header name encoding length calculation
  * BUG/MEDIUM: sample: Don't treat SMP_T_METH as SMP_T_STR.
  * BUG/MINOR: lb-map: fix unprotected update to server's score
  * BUG/MINOR: cfgparse: Fix the call to post parser of the last sections parsed
  * BUG/MINOR: cfgparse: Fix transition between 2 sections with the same name
  * BUG/MINOR: ssl: ssl_sock_parse_clienthello ignores session id
  * BUG/MEDIUM: hpack: fix encoding of "accept-ranges" field
  * BUG/MINOR: config: Copy default error messages when parsing of a backend starts
  * BUG/MEDIUM: Make sure stksess is properly aligned.
  * BUG/MINOR: config: better detect the presence of the h2 pattern in npn/alpn
  * BUG/MEDIUM: auth/threads: use of crypt() is not thread-safe
  * BUG/MAJOR: http: http_txn_get_path() may deference an inexisting buffer
  * BUG/MINOR: only auto-prefer last server if lb-alg is non-deterministic
  * BUG/MINOR: only mark connections private if NTLM is detected
  * DOC: cache: Missing information about "total-max-size"
  * BUG/MINOR: ssl: Wrong usage of shctx_init().
  * BUG/MINOR: cache: Wrong usage of shctx_init().
  * BUG/MINOR: cache: Crashes with "total-max-size" > 2047(MB).
  * BUG/MEDIUM: h2: Close connection if no stream is left an GOAWAY was sent.
  * BUG/MEDIUM: pools: Fix the usage of mmap()) with DEBUG_UAF.
  * DOC: fix reference to map files in MAINTAINERS
  * MINOR: peers: use defines instead of enums to appease clang.
  * MINOR: cfgparse: Write 130 as 128 as 0x82 and 0x80.
  * MINOR: server: Use memcpy() instead of strncpy().
  * CLEANUP: stick-tables: Remove unneeded double (()) around conditional clause
  * MINOR: lua: all functions calling lua_yieldk() may return
  * BUG/MEDIUM: threads: make sure threads_want_sync is marked volatile
  * BUG/MEDIUM: threads: fix thread_release() at the end of the rendez-vous point
  * BUG/MEDIUM: stream: don't crash on out-of-memory
  * BUG/MEDIUM: mworker: segfault receiving SIGUSR1 followed by SIGTERM.
  * BUG/MINOR: checks: queues null-deref
  * BUG/MEDIUM: Cur/CumSslConns counters not threadsafe.
  * MEDIUM: ssl: add support for ciphersuites option for TLSv1.3
  * BUG/MEDIUM: buffers: Make sure we don't wrap in buffer_insert_line2/replace2.
  * BUG/MINOR: backend: check that the mux installed properly
  * BUG/MINOR: connection: avoid null pointer dereference in send-proxy-v2
  * DOC: clarify force-private-cache is an option
  * MINOR: threads: Make sure threads_sync_pipe is initialized before using it.

- also fix the systemd case for the apparmor_reload change

- only reload the apparmor profile on newer distros, seems older
  distros do not have apparmor-rpm-macros yet

- only use network namespaces on 12.x and newer, failed to build on
  sle11

- guard all parts referring to systemd to fix build on sle 11

- Update to version 1.8.14~git0.52e4d43b: (bsc#1108683) (CVE-2018-14645)
  * [RELEASE] Released version 1.8.14
  * BUG/CRITICAL: hpack: fix improper sign check on the header index value
  * BUG/MINOR: cli: make sure the "getsock" command is only called on connections
  * BUG/MINOR: tools: fix set_net_port() / set_host_port() on IPv4
  * BUG/MEDIUM: patterns: fix possible double free when reloading a pattern list
  * DOC: Fix typos in lua documentation
  * BUG/MINOR: server: Crash when setting FQDN via CLI.
  * BUG/MAJOR: kqueue: Don't reset the changes number by accident.
  * BUG/MEDIUM: snapshot: take the proxy's lock while dumping errors
  * BUG/MINOR: http/threads: atomically increment the error snapshot ID
  * BUG/MINOR: dns: check and link servers' resolvers right after config parsing
  * BUG/MEDIUM: h2: fix risk of memory leak on malformated wrapped frames
  * BUG/MEDIUM: session: fix reporting of handshake processing time in the logs
  * BUG/MINOR: stream: use atomic increments for the request counter
  * MINOR: thread: implement HA_ATOMIC_XADD()
  * BUG/MEDIUM: ECC cert should work with TLS < v1.2 and openssl >= 1.1.1
  * BUG/MEDIUM: dns/server: fix incomatibility between SRV resolution and server state file
  * BUG/MEDIUM: hlua: Don't call RESET_SAFE_LJMP if SET_SAFE_LJMP returns 0.
  * BUG/MAJOR: thread: lua: Wrong SSL context initialization.
  * BUG/MEDIUM: hlua: Make sure we drain the output buffer when done.
  * BUG/MEDIUM: lua: reset lua transaction between http requests
  * BUG/MEDIUM: mux_pt: dereference the connection with care in mux_pt_wake()
  * BUG/MINOR: lua: Bad HTTP client request duration.
  * BUG/MEDIUM: unix: provide a ->drain() function
  * DOC: Fix spelling error in configuration doc
  * BUG/MEDIUM: cli/threads: protect some server commands against concurrent operations
  * BUG/MEDIUM: cli/threads: protect all "proxy" commands against concurrent updates
  * BUG/MEDIUM: lua: socket timeouts are not applied
  * DOC: ssl: Use consistent naming for TLS protocols
  * DOC: dns: explain set server ... fqdn requires resolver
  * BUG/MINOR: map: fix map_regm with backref
  * BUG/MEDIUM: ssl: loading dh param from certifile causes unpredictable error.
  * BUG/MEDIUM: ssl: fix missing error loading a keytype cert from a bundle.
  * BUG/MINOR: ssl: empty connections reported as errors.
  * BUG/MEDIUM: cli: make "show fd" thread-safe
  * MEDIUM: hathreads: implement a more flexible rendez-vous point
  * BUG/MEDIUM: threads: fix the no-thread case after the change to the sync point
  * MINOR: threads: add more consistency between certain variables in no-thread case
  * BUG/MEDIUM: threads: fix the double CAS implementation for ARMv7
  * MINOR: threads: Introduce double-width CAS on x86_64 and arm.
  * BUG/MEDIUM: lua: possible CLOSE-WAIT state with '\n' headers

- Require apparmor-abstractions to reduce dependencies (bsc#1100787)

- Update to version 1.8.13~git4.c1bfcd00:
  * MINOR: dns: new DNS options to allow/prevent IP address duplication
  * MINOR: dns: fix wrong score computation in dns_get_ip_from_response
  * BUG/MEDIUM: queue: prevent a backup server from draining the proxy's connections
  * BUG/MEDIUM: servers: check the queues once enabling a server
  * MEDIUM: proxy_protocol: Convert IPs to v6 when protocols are mixed
  * BUG/MEDIUM: threads: unbreak "bind" referencing an incorrect thread number
  * MINOR: threads: move "nbthread" parsing to hathreads.c
  * BUG/MEDIUM: threads: properly fix nbthreads == MAX_THREADS
  * BUG/MINOR: threads: Handle nbthread == MAX_THREADS.
  * BUG/MINOR: config: stick-table is not supported in defaults section
  * BUG/MEDIUM: h2: prevent orphaned streams from blocking a connection forever
  * BUG/MEDIUM: threads/sync: use sched_yield when available
  * BUG/MINOR: servers: Don't make "server" in a frontend fatal.
  * BUG/MEDIUM: stats: don't ask for more data as long as we're responding
  * BUG/MEDIUM: stream-int: don't immediately enable reading when the buffer was reportedly full
  * MINOR: h2: add the error code and the max/last stream IDs to "show fd"
  * BUG/MEDIUM: threads: Fix the exit condition of the thread barrier
  * MINOR: debug: Add checks for conn_stream flags
  * MINOR: debug: Add check for CO_FL_WILL_UPDATE
  * BUG/MINOR: http: Set brackets for the unlikely macro at the right place
  * BUG/MEDIUM: h2: make sure the last stream closes the connection after a timeout
  * BUG/MEDIUM: h2: never leave pending data in the output buffer on close
  * BUG/MEDIUM: h2: don't accept new streams if conn_streams are still in excess
  * MINOR: h2: add the mux and demux buffer lengths on "show fd"
  * MINOR: h2: keep a count of the number of conn_streams attached to the mux
  * BUG/MINOR: h2: remove accidental debug code introduced with show_fd function
  * MINOR: h2: implement a basic "show_fd" function
  * MINOR: mux: add a "show_fd" function to dump debugging information for "show fd"
  * BUG/MINOR: ssl: properly ref-count the tls_keys entries
  * MINOR: systemd: consider exit status 143 as successful

- Update to version 1.8.12~git0.8a200c71:
  * MINOR: stick-tables: make stktable_release() do nothing on NULL
  * BUG/MAJOR: stick_table: Complete incomplete SEGV fix

- Update to version 1.8.11~git0.1d6ef58d:
  * BUG/BUILD: threads: unbreak build without threads
  * BUG/MAJOR: Stick-tables crash with segfault when the key is not in the stick-table

- Update to version 1.8.10~git0.ec17d7a9:
  * MINOR: threads: Be sure to remove threads from all_threads_mask on exit
  * BUG/MEDIUM: threads: Use the sync point to check active jobs and exit
  * BUG/MEDIUM: fd: Don't modify the update_mask in fd_dodelete().
  * BUG/MAJOR: ssl: OpenSSL context is stored in non-reserved memory slot
  * BUG/MAJOR: ssl: Random crash with cipherlist capture
  * BUG/MINOR: lua: Segfaults with wrong usage of types.
  * BUG/MAJOR: map: fix a segfault when using http-request set-map
  * MINOR: lua: Increase debug information
  * BUG/MINOR: signals: ha_sigmask macro for multithreading
  * BUG/MINOR: don't ignore SIG{BUS,FPE,ILL,SEGV} during signal processing
  * BUG/MEDIUM: threads: handle signal queue only in thread 0
  * BUG/MINOR: unix: Make sure we can transfer abns sockets on seamless reload.
  * BUG/MINOR: contrib/modsecurity: update pointer on the end of the frame
  * BUG/MINOR: contrib/mod_defender: update pointer on the end of the frame
  * BUG/MINOR: contrib/modsecurity: Don't reset the status code during disconnect
  * BUG/MINOR: contrib/mod_defender: Don't reset the status code during disconnect
  * BUG/MINOR: contrib/spoa_example: Don't reset the status code during disconnect
  * MAJOR: spoe: upgrade the SPOP version to 2.0 and remove the support for 1.0
  * BUG/MEDIUM: lua/socket: Buffer error, may segfault
  * BUG/MEDIUM: lua/socket: Sheduling error on write: may dead-lock
  * BUG/MEDIUM: lua/socket: Notification error
  * BUG/MAJOR: lua: Dead lock with sockets
  * BUG/MEDIUM: lua/socket: wrong scheduling for sockets
  * MINOR: task/notification: Is notifications registered ?
  * BUG/MEDIUM: spoe: Return an error when the wrong ACK is received in sync mode
  * BUG/MEDIUM: stick-tables: Decrement ref_cnt in table_* converters
  * BUG/MEDIUM: lua/socket: Length required read doesn't work
  * BUG/MEDIUM: servers: Add srv_addr default placeholder to the state file
  * BUG/MEDIUM: fd: Only check update_mask against all_threads_mask.

- Update to version 1.8.9~git9.6d82e611:
  * BUG/MEDIUM: cache: don't cache when an Authorization header is present (VUL-1) (bsc#1094846) (CVE-2018-11469)
  * BUG/MEDIUM: dns: Delay the attempt to run a DNS resolution on check failure.
  * BUG/MINOR: ssl/lua: prevent lua from affecting automatic maxconn computation
  * BUG/MEDIUM: contrib/modsecurity: Use network order to encode/decode flags
  * BUG/MEDIUM: contrib/mod_defender: Use network order to encode/decode flags
  * BUG/MEDIUM: spoe: Flags are not encoded in network order
  * BUG/MINOR: lua: Socket.send threw runtime error: 'close' needs 1 arguments.
  * BUG/MINOR: spoe: Mistake in error message about SPOE configuration
  * BUG/MEDIUM: ssl: properly protect SSL cert generation
  * BUG/MEDIUM: pollers: Use a global list for fd shared between threads.
  * BUG/MEDIUM: http: don't always abort transfers on CF_SHUTR
  * BUG/MINOR: lua: ensure large proxy IDs can be represented
  * BUG/MINOR: lua: schedule socket task upon lua connect()
  * BUG/MEDIUM: task: Don't free a task that is about to be run.
  * BUG/MINOR: map: correctly track reference to the last ref_elt being dumped
  * DOC/MINOR: clean up LUA documentation re: servers & array/table.
  * BUG/MINOR: lua: Put tasks to sleep when waiting for data
  * BUG/MEDIUM: threads: Fix the sync point for more than 32 threads
  * BUG/MINOR: checks: Fix check->health computation for flapping servers
  * BUG/MINOR: config: disable http-reuse on TCP proxies
  * BUG/MINOR: lua/threads: Make lua's tasks sticky to the current thread
  * BUG/MEDIUM: h2: implement missing support for chunked encoded uploads
  * MINOR: h2: detect presence of CONNECT and/or content-length
  * BUG/MEDIUM: lua: Fix segmentation fault if a Lua task exits
  * BUG/MINOR: log: t_idle (%Ti) is not set for some requests
  * BUG/MAJOR: channel: Fix crash when trying to read from a closed socket
  * BUG/MINOR: pattern: Add a missing HA_SPIN_INIT() in pat_ref_newid()

- Update to version 1.8.8:
  * BUG/CRITICAL: h2: fix incorrect frame length check (VUL-0) (bsc#1089837)
  * MINOR: cli: Ensure the CLI always outputs an error when it should
  * BUG/MINOR: cli: Guard against NULL messages when using CLI_ST_PRINT_FREE
  * BUG/MEDIUM: kqueue: When adding new events, provide an output to get errors.
  * BUG/MINOR: http: Return an error in proxy mode when url2sa fails
  * BUG/MEDIUM: connection: Make sure we have a mux before calling detach().
  * BUG/MEDIUM: threads: Fix the max/min calculation because of name clashes

- Update to version 1.8.7:
  * [RELEASE] Released version 1.8.7
  * MINOR: servers: Support alphanumeric characters for the server templates names
  * BUG/MAJOR: cache: always initialize newly created objects
  * [RELEASE] Released version 1.8.6
  * BUG/MINOR: spoe: Don't release the context buffer in .check_timeouts callbaclk
  * BUG/MINOR: spoe: Initialize variables used during conf parsing before any check
  * BUG/MAJOR: cache: fix random crashes caused by incorrect delete() on non-first blocks
  * BUG/MINOR: fd: Don't clear the update_mask in fd_insert.
  * BUG/MINOR: cache: fix "show cache" output
  * BUG/MINOR: email-alert: Set the mailer port during alert initialization
  * BUG/MINOR: checks: check the conn_stream's readiness and not the connection
  * BUG/MEDIUM: h2: always add a stream to the send or fctl list when blocked
  * BUILD/MINOR: threads: always export thread_sync_io_handler()
  * BUG/MEDIUM: h2: don't consider pending data on detach if connection is in error
  * BUG/MEDIUM: h2/threads: never release the task outside of the task handler
  * MINOR: h2: fuse h2s_detach() and h2s_free() into h2s_destroy()
  * MINOR: h2: always call h2s_detach() in h2_detach()
  * BUG/MAJOR: h2: remove orphaned streams from the send list before closing
  * MINOR: h2: provide and use h2s_detach() and h2s_free()
  * CLEANUP: h2: rename misleading h2c_stream_close() to h2s_close()
  * BUG/MINOR: hpack: fix harmless use of uninitialized value in hpack_dht_insert
  * BUILD/MINOR: cli: fix a build warning introduced by last commit
  * MINOR: cli: make "show fd" report the mux and mux_ctx pointers when available
  * MINOR: cli/threads: make "show fd" report thread_sync_io_handler instead of "unknown"
  * BUILD/MINOR: fix build when USE_THREAD is not defined
  * BUG/MINOR: lua funtion hlua_socket_settimeout don't check negative values
  * BUG/MINOR: lua: the function returns anything

- Update to version 1.8.5:
  * BUG/MINOR: listener: Don't decrease actconn twice when a new session is rejected
  * BUG/MINOR: h2: ensure we can never send an RST_STREAM in response to an RST_STREAM
  * BUG/MEDIUM: h2: properly account for DATA padding in flow control
  * DOC: don't suggest using http-server-close
  * DOC: log: more than 2 log servers are allowed
  * BUILD/BUG: enable -fno-strict-overflow by default
  * MINOR: log: stop emitting alerts when it's not possible to write on the socket
  * BUG/MEDIUM: threads/queue: wake up other threads upon dequeue
  * BUG/MINOR: tcp-check: use the server's service port as a fallback
  * BUG/MEDIUM: tcp-check: single connect rule can't detect DOWN servers
  * BUG/MINOR: lua: return bad error messages
  * BUG/MINOR: spoa-example: unexpected behavior for more than 127 args
  * BUG/MINOR: cli: Fix a crash when sending a command with too many arguments
  * BUG/MINOR: seemless reload: Fix crash when an interface is specified.
  * BUG/MINOR: dns: don't downgrade DNS accepted payload size automatically
  * BUG/MAJOR: threads/queue: Fix thread-safety issues on the queues management
  * BUG/MEDIUM: threads/unix: Fix a deadlock when a listener is temporarily disabled
  * BUG/MEDIUM: spoe: Remove idle applets from idle list when HAProxy is stopping
  * BUG/MINOR: force-persist and ignore-persist only apply to backends
  * BUG/MEDIUM: fix a 100% cpu usage with cpu-map and nbthread/nbproc
  * BUG/MINOR: cli: Fix a typo in the 'set rate-limit' usage
  * BUG/MINOR: cli: Fix a crash when passing a negative or too large value to "show fd"
  * BUG/MEDIUM: h2: also arm the h2 timeout when sending
  * BUG/MINOR: unix: Don't mess up when removing the socket from the xfer_sock_list.
  * BUG/MINOR: session: Fix tcp-request session failure if handshake.
  * MINOR: systemd: Add SystemD's SystemCallFilter option to the unit file
  * MINOR: systemd: Add SystemD's Protect*= options to the unit file
  * MINOR: systemd: Add section for SystemD sandboxing to unit file
  * BUG/MEDIUM: buffer: Fix the wrapping case in bi_putblk
  * BUG/MEDIUM: buffer: Fix the wrapping case in bo_putblk
  * BUG/MEDIUM: h2: always consume any trailing data after end of output buffers
  * MINOR: stats: display the number of threads in the statistics.
  * BUG/MINOR: h2: Set the target of dbuf_wait to h2c
  * MINOR: debug/pools: make DEBUG_UAF also detect underflows
  * BUG/MINOR: debug/pools: properly handle out-of-memory when building with DEBUG_UAF
  * DOC: cfgparse: Warn on option (tcp|http)log in backend
  * DOC: lua: new prototype for function "register_action()"
  * BUG/MEDIUM: ssl/sample: ssl_bc_* fetch keywords are broken.
  * BUG/MEDIUM: http: Switch the HTTP response in tunnel mode as earlier as possible
  * BUG/MINOR: ssl/threads: Make management of the TLS ticket keys files thread-safe
  * BUG/MINOR: init: Add missing brackets in the code parsing -sf/-st
  * BUG/MEDIUM: ssl: Shutdown the connection for reading on SSL_ERROR_SYSCALL
  * BUG/MEDIUM: ssl: Don't always treat SSL_ERROR_SYSCALL as unrecovarable.
  * BUG/MINOR: threads: fix missing thread lock labels for 1.8

- if we lock down the permissions the home directory has to be
  owned by haproxy (bsc#1077716)

- Avoid %__-type macro indirections. Remove redundant %clean
  section. Do not ignore errors from useradd.

- Ensure haproxy home directory is not world readable (bsc#1077716)

- Update to version 1.8.4 (bsc#1080069):
  * BUG/MINOR: config: don't emit a warning when global stats is incompletely configured
  * DOC: Mention -Ws in the list of available options
  * DOC: Describe routing impact of using interface keyword on bind lines
  * MINOR: init: emit warning when -sf/-sd cannot parse argument
  * BUG/MEDIUM: standard: Fix memory leak in str2ip2()
  * BUG/MINOR: time/threads: ensure the adjusted time is always correct
  * BUG/MEDIUM: spoe: Allow producer to read and to forward shutdown on request side
  * BUG/MEDIUM: spoe: Always try to receive or send the frame to detect shutdowns
  * BUG/MINOR: epoll/threads: only call epoll_ctl(DEL) on polled FDs
  * BUG/MINOR: threads: Update labels array because of changes in lock_label enum
  * BUG/MINOR: cli: use global.maxsock and not maxfd to list all FDs
  * CLEANUP: Fix typo in ARGT_MSK6 comment
  * BUG/MINOR: sample: Fix output type of c_ipv62ip
  * CLEANUP: sample: Fix outdated comment about sample casts functions
  * CLEANUP: sample: Fix comment encoding of sample.c
  * BUILD: kqueue/threads: Add test on MAX_THREADS to avoid warnings when complied without threads
  * BUILD: epoll/threads: Add test on MAX_THREADS to avoid warnings when complied without threads
  * MINOR: threads: Use __decl_hathreads instead of #ifdef/#endif
  * BUG/MINOR: kqueue/threads: Don't forget to close kqueue_fd[tid] on each thread
  * BUG/MEDIUM: checks: Don't try to release undefined conn_stream when a check is freed
  * BUG/MEDIUM: threads/server: Fix deadlock in srv_set_stopping/srv_set_admin_flag
  * BUG/MINOR: threads: always set an owner to the thread_sync pipe
  * MINOR: threads: Fix build when we're not compiling with threads.
  * BUG/MINOR: mworker: only write to pidfile if it exists
  * BUG/MEDIUM: threads/mworker: fix a race on startup
  * BUG/MEDIUM: kqueue/threads: use one kqueue_fd per thread
  * BUG/MEDIUM: epoll/threads: use one epoll_fd per thread
  * MINOR: fd: add a bitmask to indicate that an FD is known by the poller
  * BUG/MEDIUM: fd: maintain a per-thread update mask
  * BUG/MEDIUM: threads/polling: Use fd_cache_mask instead of fd_cache_num
  * MINOR: threads/fd: Use a bitfield to know if there are FDs for a thread in the FD cache
  * MINOR: global: add some global activity counters to help debugging
  * MINOR: threads: add a MAX_THREADS define instead of LONGBITS
  * MINOR: global/threads: move cpu_map at the end of the global struct
  * MINOR: servers: Don't report duplicate dyncookies for disabled servers.
  * BUG/MEDIUM: peers: fix expire date wasn't updated if entry is modified remotely.
  * BUG/MINOR: poll: too large size allocation for FD events
  * CONTRIB: debug: fix a few flags definitions
  * DOC: clarify the scope of ssl_fc_is_resumed
  * BUG/MEDIUM: stream: properly handle client aborts during redispatch
  * BUILD/MINOR: ancient gcc versions atomic fix
  * BUG/MEDIUM: mworker: execvp failure depending on argv[0]
  * MINOR: dns: Handle SRV record weight correctly.
  * BUG/MINOR: lua: Fix return value of Socket.settimeout
  * BUG/MEDIUM: lua: Fix IPv6 with separate port support for Socket.connect
  * DOC: lua: Fix typos in comments of hlua_socket_receive
  * BUG/MINOR: lua: Fix default value for pattern in Socket.receive
  * BUG/MEDIUM: ssl: cache doesn't release shctx blocks
  * BUG/MEDIUM: h2: properly handle the END_STREAM flag on empty DATA frames