0.274.0

Changes

• 🐛 Bug Fix: This release fixes this known issue around multiple expect 100-continue responses.

✨ Built with go 1.20.5

Full Changelog: v0.273.0...v0.274.0

Resources

• Download release v0.274.0 from bosh.io.

0.273.0

Known Issue

⚠️ This release is vulnerable to this known issue around handling expect 100-continue responses. We recommend skipping this version and upgrading to 0.274.0 instead.

Changes

• Bug Fix: Set Gorouter's ExpectContinueTimeout to 1 sec. This fixes bug 1 of this known issue
• Dependency Bump: Bump the cf cli version in the acceptance test errand and the smoke test errand from v6 to v8.

Bosh Job Spec changes:

diff --git a/jobs/acceptance_tests/spec b/jobs/acceptance_tests/spec
index 6a73b9ae..db508ca3 100644
--- a/jobs/acceptance_tests/spec
+++ b/jobs/acceptance_tests/spec
@@ -10,7 +10,7 @@ packages:
  - golang-1.20-linux
  - acceptance_tests
  - rtr
- - cf-cli-6-linux
+ - cf-cli-8-linux
 
 properties:
   acceptance_tests.nodes:
diff --git a/jobs/smoke_tests/spec b/jobs/smoke_tests/spec
index 0426dc99..5776a9c8 100644
--- a/jobs/smoke_tests/spec
+++ b/jobs/smoke_tests/spec
@@ -9,7 +9,7 @@ templates:
 packages:
  - golang-1.20-linux
  - acceptance_tests
- - cf-cli-6-linux
+ - cf-cli-8-linux
 
 properties:
   acceptance_tests.verbose:

✨ Built with go 1.20.5

Full Changelog: v0.272.0...v0.273.0

Resources

• Download release v0.273.0 from bosh.io.

0.272.0

Known issue

⚠️ This release is vulnerable to this known issue around handling expect 100-continue responses. We recommend skipping this version and upgrading to 0.274.0 instead.

Changes

• ✨ route_registrar now emites route registration events immediately upon startup, rather than waiting for a full registration interval to pass. This will cut down on accidental TTL expiry incurred by restarting route-registrar.
• ✨ The router.enable_log_attempts_details property has been added to allow operators to configure Gorouter to log additional information about retried attempts to send requests to backends. Thanks @maxmoehl!
• 🐛Specifying multiple CA certs to route_registrar via route_registrar.routing_api.ca_certs will now render correctly as multiple certs in a single CA file.
• 🐛 Routing API clients now correctly refresh their UAA tokens prior to expiry. This should help prevent route_registrar from crashing whenever the token expires.
• Golang package dependency bumps

Bosh Job Spec changes:

diff --git a/jobs/gorouter/spec b/jobs/gorouter/spec
index 0f61e044..a14133ed 100644
--- a/jobs/gorouter/spec
+++ b/jobs/gorouter/spec
@@ -236,6 +236,9 @@ properties:
   router.logging_level:
     description: "Log level for router"
     default: "info"
+  router.enable_log_attempts_details:
+    description: "Log additional fields in the access log that provide more details on the specific timings and attempts performed towards endpoints."
+    default: false
   router.logging.format.timestamp:
     description: |
       Format for timestamp in component logs. Valid values are 'rfc3339', 'deprecated', and 'unix-epoch'."

✨ Built with go 1.20.5

Full Changelog: v0.271.0...v0.272.0

Resources

• Download release v0.272.0 from bosh.io.

0.271.0

Known Issue

⚠️ This release is vulnerable to this known issue around handling expect 100-continue responses. We recommend skipping this version and upgrading to 0.274.0 instead.

Changes

• Bumped to golang 1.20.5

✨ Built with go 1.20.5

Full Changelog: v0.270.0...v0.271.0

Resources

• Download release v0.271.0 from bosh.io.

0.270.0

Known Issue

⚠️ This release is vulnerable to this known issue around handling expect 100-continue responses. We recommend skipping this version and upgrading to 0.274.0 instead.

Changes

• CI now tests CATS + RATS against cflinuxfs4
• 🐛Gorouter's request_timeout_in_seconds now only affects request timeout and is not used for idle timeout, which is set by frontend_idle_timeout
• routing-utils now passes go vet
• Dependency Bumps:
  • The vendored healthchecker boshrelease is now v0.8.0
  • go.step.sm/crypto v0.31.0
  • Go dependency bumps for the routing-utils package:
    • code.cloudfoundry.org/tlsconfig 8f91c367795b
    • github.com/nats-io/nats.go v1.26.0

Bosh Job Spec changes:

diff --git a/jobs/gorouter/spec b/jobs/gorouter/spec
index 4fa13ae3..0f61e044 100644
--- a/jobs/gorouter/spec
+++ b/jobs/gorouter/spec
@@ -380,11 +380,9 @@ properties:
     default: 22
   request_timeout_in_seconds:
     description: |
-      This configures a "request timeout" and a "backend idle timeout".
+      This configures an entire request timeout.
       Requests from router to backend endpoints that are longer than this duration will be canceled and logged as
-      `backend-request-timeout` errors. In addition, TCP connections between router and backend endpoints that
-      are idle for longer than this duration will be closed. Related properties: `router.max_idle_connections`
-      and `router.keep_alive_probe_interval`.
+      `backend-request-timeout` errors. If set to 0 this timeout is disabled.
     default: 900
   endpoint_dial_timeout_in_seconds:
     description: |

✨ Built with go 1.20.4

Full Changelog: v0.269.0...v0.270.0

Resources

• Download release v0.270.0 from bosh.io.

0.269.0

Known Issue

⚠️ This release is vulnerable to this known issue around handling expect 100-continue responses. We recommend skipping this version and upgrading to 0.274.0 instead.

Changes

• Update sync-package-specs to install gosub
• Remove trace-logger update in sync-submodule-config
• Remove unused files

✨ Built with go 1.20.4

Full Changelog: v0.268.0...v0.269.0

Resources

• Download release v0.269.0 from bosh.io.

0.268.0

Known Issue

⚠️ This release is vulnerable to this known issue around handling expect 100-continue responses. We recommend skipping this version and upgrading to 0.274.0 instead.

Changes

• Adds support for route_registrar to advertise HTTP2 based routes to gorouter. If not specified on a route, http1 is used by default. Thanks @peanball @plowin and @b1tamara!!

Bosh Job Spec changes:

diff --git a/jobs/route_registrar/spec b/jobs/route_registrar/spec
index 595f2075..bf3d9a03 100644
--- a/jobs/route_registrar/spec
+++ b/jobs/route_registrar/spec
@@ -101,6 +101,7 @@ properties:
         tls_port (required, integer, for http routes): Either `port` or `tls_port` are required; if both are provided, Gorouter will prefer tls_port.
           Requests for associated URIs will be forwarded over TLS by the router to this port.
           The IP is determined automatically from the host on which route-registrar is run.
+        protocol (optional, string): 'http1' or 'http2'. If not provided, Gorouter uses 'http1' as default.
         route_service_url (optional, string, for http routes): When valid route service URL is provided, Gorouter will proxy requests received for the uris above to the specified route service URL.
         server_cert_domain_san (conditional, string, for http routes): Required if tls_port is present.
           Gorouter will validate that the TLS certificate presented by the destination host contains this as a Subject Alternative Name (SAN).

✨ Built with go 1.20.4

Full Changelog: v0.267.0...v0.268.0

Resources

• Download release v0.268.0 from bosh.io.

0.267.0

Known Issue

⚠️ This release is vulnerable to this known issue around handling expect 100-continue responses. We recommend skipping this version and upgrading to 0.274.0 instead.

Changes

• The veresion of HAProxy used in tcp-router was bumped from 2.7.6 to 2.7.8.

✨ Built with go 1.20.4

Full Changelog: v0.266.0...v0.267.0

Resources

• Download release v0.267.0 from bosh.io.

0.266.0

Known Issue

⚠️ This release is vulnerable to this known issue around handling expect 100-continue responses. We recommend skipping this version and upgrading to 0.274.0 instead.

Change

• 🐛Resolves CVE-2023-20882 introduced in v0.262.0 by fixing a bug that may cause routing failures to apps. Thanks @maxmoehl and @domdom82!!
• Many go dependency updates across all routing packages. Thanks @winkingturtle-vmw!!

✨ Built with go 1.20.4

Full Changelog: v0.265.1...v0.266.0

Resources

• Download release v0.266.0 from bosh.io.

0.265.1

⚠️⚠️⚠️
This release is susceptible to the issue described in CVE-2023-20882. It is advised to use routing-release 0.266.0 or later instead of this release.

Changes

• Bump healthchecker

✨ Built with go 1.20.4

Full Changelog: v0.265.0...v0.265.1

Resources

• Download release v0.265.1 from bosh.io.