Prepare 1.4.6 stream proxy release

eldryoth · eldryoth · commit b2b3861af61b · 2026-05-30T17:31:33.000+02:00
diff --git a/.cargo/audit.toml b/.cargo/audit.toml
@@ -8,6 +8,13 @@ ignore = [
     # moves to prometheus >=0.14 or otherwise drops vulnerable protobuf 2.x.
     # Next scheduled manual review before 2026-08-01.
     "RUSTSEC-2024-0437",
+    # Transitive through pingora-core and pingora-load-balancing via derivative
+    # 2.2.0. The crate is unmaintained and used as a compile-time derive macro
+    # dependency, not on Fluxheim's runtime request path.
+    # REVIEW: scripts/validate-release-metadata.sh fails if derivative leaves
+    # Cargo.lock while this suppression exists. Remove this when Pingora drops
+    # derivative. Next scheduled manual review before 2026-11-01.
+    "RUSTSEC-2024-0388",
 ]
 
 [database]
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,11 +7,19 @@ Fluxheim follows semantic versioning once `1.0.0` is released. Before `1.0.0`,
 minor versions may still change configuration shape, feature names, and runtime
 behavior when the change improves security or project direction.
 
-## 1.4.6-dev - Unreleased
+## 1.4.6 - 2026-05-30
 
 ### Changed
 
-- Start the TCP stream proxy foundation development release.
+- Release the TCP stream proxy foundation.
+- Add route-local downstream PROXY protocol receive for TCP stream routes with
+  mandatory route-local `trusted_proxies`; HTTP `server.proxy_protocol` no
+  longer applies to stream listeners.
+- Rename stream `idle_timeout_secs` to `max_connection_secs` to reflect the
+  wall-clock connection lifetime cap, and add optional
+  `max_connection_bytes` per-direction byte caps.
+- Track the transitive `RUSTSEC-2024-0388` `derivative` advisory with an
+  explicit review deadline while Pingora still pulls the unmaintained crate.
 
 ## 1.4.5 - 2026-05-29
 
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim"
-version = "1.4.6-dev"
+version = "1.4.6"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/README.md b/README.md
@@ -37,7 +37,7 @@ origin controls, gRPC pass-through policy, proxy-operations migration blockers,
 the `1.4.2` proxy module split, the `1.4.3` config module split, and Apple
 Silicon macOS Level 1 developer support. `1.4.5` adds bounded GeoIP/Geo-Context
 policy with local MMDB support for MaxMind GeoIP2/GeoLite2 and CIRCL Geo Open
-datasets. The current `1.4.6-dev` line starts the TCP stream proxy foundation.
+datasets. The current `1.4.6` line adds the TCP stream proxy foundation.
 
 Fluxheim is licensed under the European Union Public Licence 1.2.
 
@@ -97,7 +97,7 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 | WebSocket / HTTP upgrade | ✅ | `1.4.1`; explicit `proxy.websocket = true` on HTTP/1.1 upstream routes. |
 | External auth subrequests | ✅ | `1.4.1`; `[proxy.auth_request]` with bounded header/body forwarding. |
 | Traffic mirroring | ✅ | `1.4.1`; `traffic-mirror` feature with safe bodyless shadow requests. |
-| TCP stream proxying | ✅ | `1.4.6-dev`; optional `stream-proxy` feature with raw L4 TCP listeners, round-robin upstream selection, bounded connection/idle/connect controls, and upstream PROXY protocol send. |
+| TCP stream proxying | ✅ | `1.4.6`; optional `stream-proxy` feature with raw L4 TCP listeners, round-robin upstream selection, bounded lifetime/byte/connect controls, and route-local PROXY protocol receive/send. |
 
 ### Operations And Packaging
 
@@ -234,7 +234,7 @@ Individual module features:
 | `web` | Yes | Static file resolver and static response handling. Runtime serving currently uses `proxy` sessions. |
 | `cache` | Yes | Cache module compiled in; runtime cache remains disabled until configured. |
 | `load-balancer` | No | Pingora load-balancing module and health checks. |
-| `stream-proxy` | No | Raw L4 TCP stream proxy service with separate stream semantics. Depends on the shared proxy runtime in `1.4.6-dev`. |
+| `stream-proxy` | No | Raw L4 TCP stream proxy service with separate stream semantics. Depends on the shared proxy runtime in `1.4.6`. |
 | `metrics` | No | Prometheus metrics listener. |
 | `acme` | No | ACME planning/renewal support. Requires TLS config and should be paired with one TLS backend for serving. |
 | `acme-client` | No | Live ACME account/order HTTP client and background renewal service for HTTP-01 and rustls TLS-ALPN-01 certificate issuance and renewal. |
diff --git a/SECURITY.md b/SECURITY.md
@@ -40,7 +40,8 @@ supply-chain changes. Review them before merging dependency updates.
 
 Reviewed advisory exceptions are allowed only when there is no compatible
 upgrade and the affected API is not reachable in Fluxheim. Each exception must
-be listed in both `deny.toml` and `.cargo/audit.toml`, with a removal condition.
+be listed in the tool that reports it (`deny.toml` or `.cargo/audit.toml`), with
+a removal condition.
 
 Current reviewed dependency warnings:
 
@@ -51,8 +52,14 @@ Current reviewed dependency warnings:
   exception remains present.
 - `RUSTSEC-2025-0069` for `daemonize 0.5.0`: warning-only unmaintained
   transitive through Pingora. Recheck on every Pingora upgrade.
-- `RUSTSEC-2024-0388` for `derivative 2.2.0`: warning-only unmaintained
-  transitive through Pingora. Recheck on every Pingora upgrade.
+- `RUSTSEC-2024-0388` for `derivative 2.2.0`: transitive through Pingora's
+  dependency stack. It is an unmaintained compile-time derive macro dependency,
+  not a Fluxheim runtime request parser. Remove the exception when Pingora no
+  longer pulls `derivative`. The release metadata gate also fails after the
+  scheduled manual review date `2026-11-01` while the exception remains
+  present. This warning is tracked in `.cargo/audit.toml`; cargo-deny currently
+  rejects the ignore as unused because it does not classify the advisory for
+  this graph.
 - `RUSTSEC-2025-0134` for `rustls-pemfile 2.2.0`: warning-only unmaintained
   transitive through Pingora's Rustls stack and `rustls-native-certs`.
   Fluxheim no longer depends on it directly and uses
diff --git a/docs/config-reference.md b/docs/config-reference.md
@@ -161,21 +161,29 @@ name = "postgres"
 listen = ["127.0.0.1:15432"]
 upstreams = ["10.0.0.11:5432", "10.0.0.12:5432"]
 connect_timeout_secs = 5
-idle_timeout_secs = 300
+max_connection_secs = 300
+max_connection_bytes = 1073741824
 max_connections = 1024
+downstream_proxy_protocol = "off" # "off", "v1", or "v2"
+trusted_proxies = []
 upstream_proxy_protocol = "off" # "off", "v1", or "v2"
 ```
 
 - `listen` entries are `ip:port` TCP listeners. Each listener may appear on
   only one stream route.
 - Configure either `upstream = "host:port"` or `upstreams = ["host:port", ...]`.
-  Multiple upstreams use round-robin selection in the initial `1.4.6-dev`
+  Multiple upstreams use round-robin selection in the initial `1.4.6`
   foundation.
 - `connect_timeout_secs` bounds DNS/connect setup and defaults to `5`.
-- `idle_timeout_secs` bounds the bidirectional copy window and defaults to
-  `300`.
+- `max_connection_secs` bounds total accepted stream lifetime and defaults to
+  `300`. It is a wall-clock lifetime cap, not a per-read idle timer.
+- `max_connection_bytes` is optional and caps copied bytes per direction for a
+  single stream connection.
 - `max_connections = 0` means unlimited for that stream route. Non-zero values
   cap concurrent accepted connections before connecting upstream.
+- `downstream_proxy_protocol` enables PROXY protocol receive for this stream
+  route only. It defaults to `off` and requires route-local `trusted_proxies`.
+  The HTTP `server.proxy_protocol` setting does not apply to stream listeners.
 - `upstream_proxy_protocol` writes a HAProxy PROXY protocol header to the
   selected upstream before forwarding stream bytes. Use it only when the
   upstream explicitly expects PROXY protocol.
diff --git a/docs/features.md b/docs/features.md
@@ -44,7 +44,7 @@ before Cargo starts compiling Pingora.
 | `compression-gzip` | No | gzip response compression for eligible known-length responses. |
 | `compression-zstd` | No | Zstandard response compression for eligible known-length responses. |
 | `geoip` | No | Local MMDB Geo-Context lookup for MaxMind GeoIP2/GeoLite2 and CIRCL Geo Open datasets, exposed to bounded access policy and structured logs. |
-| `stream-proxy` | No | Raw L4 TCP stream proxy service with separate stream routes, bounded connection/timeouts, and optional upstream PROXY protocol send. Depends on the shared proxy runtime in `1.4.6-dev`. |
+| `stream-proxy` | No | Raw L4 TCP stream proxy service with separate stream routes, bounded connection lifetime/byte caps, and route-local PROXY protocol receive/send. Depends on the shared proxy runtime in `1.4.6`. |
 | `privacy-mode` | No | Zero-retention static/proxy build profile. |
 | `tls` | No | Internal marker for TLS-aware code; select a concrete backend for serving. |
 
diff --git a/docs/versioning-plan.md b/docs/versioning-plan.md
@@ -1435,11 +1435,11 @@ Release shape:
   - port/listener-based stream routing to one or more upstreams, reusing the
     load-balancer selection and health primitives only where they are transport
     neutral and do not pull HTTP policy into stream routes;
-  - bidirectional Tokio byte copy with half-close handling, idle/connect
-    timeout controls, per-direction byte accounting, max connection limits, and
-    graceful drain behavior;
-  - upstream PROXY protocol send where configured, and listener-side PROXY
-    protocol receive only behind trusted peer rules;
+  - bidirectional Tokio byte copy with half-close handling, connect timeout,
+    max connection lifetime, per-direction byte caps/accounting, max connection
+    limits, and graceful drain behavior;
+  - upstream PROXY protocol send where configured, and route-local
+    listener-side PROXY protocol receive only behind trusted peer rules;
   - upstream TLS and upstream mTLS are allowed only if they reuse the same safe
     certificate/key loading model as HTTP upstream TLS without expanding the
     stop line; otherwise keep them for a later stream hardening release;
diff --git a/examples/stream-tcp.toml b/examples/stream-tcp.toml
@@ -9,6 +9,9 @@ name = "postgres"
 listen = ["127.0.0.1:15432"]
 upstreams = ["10.0.0.11:5432", "10.0.0.12:5432"]
 connect_timeout_secs = 5
-idle_timeout_secs = 300
+max_connection_secs = 300
+max_connection_bytes = 1073741824
 max_connections = 1024
+downstream_proxy_protocol = "off"
+trusted_proxies = []
 upstream_proxy_protocol = "off"
diff --git a/packaging/rpm/fluxheim.spec b/packaging/rpm/fluxheim.spec
@@ -153,8 +153,11 @@ fi
 %config(noreplace) %attr(0644,fluxheim,fluxheim) /srv/fluxheim/index.html
 
 %changelog
-* Sat May 30 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.4.6-0.dev
-- Start the 1.4.6 TCP stream proxy foundation development line.
+* Sat May 30 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.4.6-1
+- Release 1.4.6 TCP stream proxy foundation.
+- Add raw L4 TCP stream routes, round-robin stream upstream selection, bounded
+  connect/lifetime/byte/concurrency controls, route-local PROXY protocol
+  receive, upstream PROXY protocol send, stream metrics, and graceful drain.
 
 * Fri May 29 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.4.5-1
 - Release 1.4.5 bounded GeoIP/Geo-Context policy.
diff --git a/release-notes/RELEASE_NOTES_1.4.6.md b/release-notes/RELEASE_NOTES_1.4.6.md
@@ -8,15 +8,19 @@ Fluxheim 1.4.6 is the TCP stream proxy foundation release.
 - New `[stream]` config domain with `[[stream.routes]]` raw TCP services.
 - Port/listener-based stream routing to one or more `host:port` upstreams.
 - Round-robin upstream selection for multi-upstream stream routes.
-- Bounded bidirectional Tokio byte copy with connect timeout, idle timeout, and
-  per-route concurrent connection limits.
+- Bounded bidirectional Tokio byte copy with connect timeout, wall-clock
+  `max_connection_secs`, optional `max_connection_bytes` per-direction caps,
+  and per-route concurrent connection limits.
 - Per-connection debug logging with downstream/upstream byte counts and
   duration.
 - Optional Prometheus metrics for stream connection outcomes and per-direction
   byte totals when `metrics` is compiled.
 - Upstream PROXY protocol v1/v2 send where configured.
-- Trusted listener-side PROXY protocol v1/v2 receive on stream services through
-  the existing `server.proxy_protocol` and `server.trusted_proxies` policy.
+- Route-local listener-side PROXY protocol v1/v2 receive on stream services
+  through `stream.routes.downstream_proxy_protocol` and route-local
+  `stream.routes.trusted_proxies`.
+- Dependency evidence tracking for transitive `RUSTSEC-2024-0388`
+  (`derivative`) with a scheduled release-metadata review gate.
 
 ## Out Of Scope
 
@@ -27,5 +31,6 @@ Fluxheim 1.4.6 is the TCP stream proxy foundation release.
 - Generic HTTP load-balancer policy on stream routes.
 - Stream upstream TLS/mTLS.
 - TLS passthrough SNI routing.
+- True per-read idle timeout; `max_connection_secs` is a lifetime cap.
 - xDS/Kubernetes/Consul service discovery.
 - Wasm/Lua stream filters.
diff --git a/scripts/validate-release-metadata.sh b/scripts/validate-release-metadata.sh
@@ -82,6 +82,35 @@ if grep -q 'RUSTSEC-2024-0437' deny.toml .cargo/audit.toml; then
     fi
 fi
 
+derivative_version="$(
+    awk '
+        /^\[\[package\]\]$/ { in_package = 1; name = ""; version = ""; next }
+        in_package && /^name = "derivative"$/ { name = "derivative"; next }
+        in_package && /^version = / { version = $3; gsub(/"/, "", version); next }
+        in_package && /^dependencies = \[/ {
+            if (name == "derivative") {
+                print version;
+                exit
+            }
+            in_package = 0
+        }
+    ' Cargo.lock
+)"
+
+if grep -q 'RUSTSEC-2024-0388' deny.toml .cargo/audit.toml \
+    && [ "$derivative_version" != "2.2.0" ]; then
+    echo "release metadata: RUSTSEC-2024-0388 suppression must be reviewed because derivative is ${derivative_version:-absent}, expected 2.2.0" >&2
+    exit 1
+fi
+
+if grep -q 'RUSTSEC-2024-0388' deny.toml .cargo/audit.toml; then
+    current_utc_date="$(date -u +%Y%m%d)"
+    if [ "$current_utc_date" -ge 20261101 ]; then
+        echo "release metadata: RUSTSEC-2024-0388 suppression passed its scheduled manual review date 2026-11-01" >&2
+        exit 1
+    fi
+fi
+
 if grep -q 'RUSTSEC-2025-0134' deny.toml .cargo/audit.toml \
     && ! grep -q '^name = "rustls-pemfile"$' Cargo.lock; then
     echo "release metadata: RUSTSEC-2025-0134 suppression must be removed because rustls-pemfile is no longer in Cargo.lock" >&2
diff --git a/src/config_stream.rs b/src/config_stream.rs
diff --git a/src/runtime.rs b/src/runtime.rs
diff --git a/src/stream_proxy.rs b/src/stream_proxy.rs
