[appendix]
== Migrating from Gun 1.3 to 2.0
Gun 2.0 includes state of the art tunnel support. With
Gun 2.0 it is possible to make requests or data go through
any number of proxy endpoints using any combination of
TCP or TLS transports and HTTP/1.1, HTTP/2 or SOCKS5
protocols. All combinations of the scenario Proxy1 ->
Proxy2 -> Origin are tested and known to work.
Gun 2.0 adds many more features such as Websocket over
HTTP/2, a built-in cookie store, graceful shutdown, flow
control for data messages, event handlers and more.
Gun 2.0 also introduces an experimental pool module that
automatically maintains connections and routes requests
to the right process, in a similar way as browsers do.
Gun 2.0 greatly improves the HTTP/2 performance when it
comes to receiving large response bodies; and when receiving
response bodies from many separate requests concurrently.
Gun now shares much of its HTTP/2 code with Cowboy,
including the HTTP/2 state machine. Numerous issues were
fixed as a result because the Cowboy implementation was
much more advanced.
The Gun connection process is now implemented using `gen_statem`.
Gun 2.0 requires Erlang/OTP 22.0 or greater.
=== Features added
* Cookie store support has been added. The `cookie_store`
option allows configuring the cookie store backend.
The `gun_cookies` module provides functions to help
implementing such a backend. Gun comes with the backend
`gun_cookies_list` which provides a per-connection,
non-persistent cookie store. The cookie store engine
implements the entire RFC6265bis draft algorithms except
the parts about non-HTTP cookies as no such interface is
provided; and the parts about SameSite as Gun has no
concept of "browsing context".
* Graceful shutdown has been implemented. Graceful shutdown
can be initiated on the client side by calling the new
function `gun:shutdown/1` or when the owner process goes
away; or on the peer side via the connection: close HTTP/1.1
header, the HTTP/2 GOAWAY frame or the Websocket close frame.
Gun will try to complete existing streams when possible;
other streams get canceled immediately. The `closing_timeout`
option controls how long we are willing to wait at most
before closing the connection.
* Gun will better detect connection failures by checking the
return value from sending data to the socket. This applies
to all supported protocols. In addition, Gun now enables
`send_timeout_close` with a `send_timeout` value defaulting
to 15s.
* Flow control has been added. It allows limiting the number
of data/Websocket messages Gun sends to the calling process.
Gun will stop reading from the socket or stop updating the
protocol's flow control window when applicable as well, to
apply some backpressure to the remote endpoint(s). It is
disabled by default and can be applied on a per-request
basis if necessary.
* An event handler interface has been added providing access
to many internal Gun events. This can be used for a variety
of purposes including logging, tracing or otherwise
instrumenting a Gun connection.
* In order to get separate events when connecting, the domain
lookup, connection and TLS handshakes are now performed
separately by Gun. As a result, there exists three separate
timeout options for each of the steps, and the transport
options had to be split into `tcp_opts` and `tls_opts`.
* Gun now supports connecting through SOCKS proxies,
including secure SOCKS proxies. Both unauthenticated
and username/password authentication are supported.
* Gun can connect through any number of HTTP, HTTPS, SOCKS
or secure SOCKS proxies, including SOCKS proxies
located after HTTP(S) proxies. The ultimate endpoint
may be using any protocol, including plain TCP, TLS,
HTTP/1.1 or HTTP/2.
* When specifying which protocols to use, options can
now be provided specific to those protocols. It is
now possible to have separate HTTP options for an
HTTP proxy and the origin HTTP server, for example.
See the new `gun:protocols()` type for details.
* Gun can now be used to send and receive raw data,
as if it was just a normal socket. This can be
useful when needing to connect through a number
of HTTP/Socks proxies, allowing the use of Gun's
great proxying capabilities (including TLS over TLS)
for any sort of protocols. This can also be useful
when performing HTTP/1.1 Upgrade to custom protocols.
* Headers can now be provided as a map.
* Header names may now be provided as binary, string or atom.
* Gun now automatically lowercases provided header names.
* Many HTTP/2 options have been added, allowing great
control over how Gun and the remote endpoint are
using the HTTP/2 connection. They can be used to
improve performance or lower the memory usage, for
example.
* A new `keepalive_tolerance` option for HTTP/2 enables
closing the connection automatically when ping acks
are not received in a timely manner. It nicely
complements the `keepalive` option that makes Gun
send pings.
* Gun now supports Websocket subprotocol negotiation
and the feature is fully documented and tested.
This can be used to create handlers that will
implement a protocol from within the Gun process itself.
The negotiation is enabled by setting the `protocols`
setting. The `default_protocol` and `user_opts`
settings are also useful.
* It is now possible to send many Websocket frames in
a single `gun:ws_send/3` call.
* Gun may now send Websocket ping frames automatically
at intervals determined by the `keepalive` option. It
is disabled by default.
* A new `silence_pings` option can be set to `false` to
receive all ping and pong frames when using Websocket.
They are typically not needed and therefore silent by
default.
* The `reply_to` option has been added to `gun:ws_upgrade/4`.
The option applies to both the response and subsequent
Websocket frames.
* The `reply_to` option is also propagated to messages
following a CONNECT request when the protocol requested
is not HTTP.
* A new option `retry_fun` can be used to implement
different backoff strategies when reconnecting.
* A new option `supervise` can be used to start a Gun
connection without using Gun's supervisor. It defaults
to `true`.
* Many improvements have been done to postpone or reject
requests and other operations while in the wrong state
(for example during state transitions when switching
protocols or connecting to proxies).
* Update Cowlib to 2.12.0.
=== Experimental features added
* The `gun_pool` module was introduced. Its interface
is very similar to the `gun` module, but as it is an
experimental feature, it has not been documented yet.
The intent is to obtain feedback and document it in
an upcoming minor release. Pools are created for each
authority (host/port) and scope (user-defined value)
pairs and are resolved accordingly using the information
provided in the request and request options. Connections
may concurrently handle multiple requests/responses
from as many different processes as required.
=== Features removed
* Gun used to reject operations by processes that were not
the owner of the connection. This behavior has been removed.
In general the caller of a request or other operation will
receive the relevant messages unless the `reply_to` option
is used.
* The `connect_destination()` option `protocol` has been
removed. It was previously deprecated in favor of `protocols`.
* The `keepalive` timeout is now disabled by default
for HTTP/1.1 and HTTP/2. To be perfectly clear, this
is unrelated to the HTTP/1.1 keep-alive mechanism.
=== Functions added
* The function `gun:set_owner/2` has been added. It allows
changing the owner of a connection process. Only the current
owner can do this operation.
* The function `gun:shutdown/1` has been added. It initiates
the graceful shutdown of the connection, followed by the
termination of the Gun process.
* The function `gun:stream_info/2` has been added. It provides
information about a specific HTTP stream.
=== Functions modified
* The function `gun:info/1` now returns the owner of the
connection as well as the cookie store.
* The functions `gun:await/2,3,4`, `gun:await_body/2,3,4` and
`gun:await_up/1,2,3` now distinguish the error types. They
can be a timeout, a connection error, a stream error or a
down error (when the Gun process exited while waiting).
* The functions `gun:await/2,3,4` will now receive upgrades,
tunnel up and Websocket messages and return them.
* Requests may now include the `tunnel` option to send the
request on a specific tunnel.
* The functions `gun:request/4,5,6` have been replaced with
`gun:headers/4,5` and `gun:request/5,6`. This provides a
cleaner separation between requests that are followed by
a body and those that aren't.
* The function `gun:ws_send/2` has been replaced with the
function `gun:ws_send/3`. The stream reference for the
corresponding Websocket upgrade request must now be given.
=== Messages added
* The `gun_tunnel_up` message has been added.
=== Messages modified
* The `gun_down` message no longer has its final element
documented as `UnprocessedStreams`. It never worked and
was always an empty list.
=== Bugs fixed
* *POTENTIAL SECURITY VULNERABILITY*: Fix transfer-encoding
precedence over content-length in responses. This bug may
contribute to a response smuggling security vulnerability
when Gun is used inside a proxy.
* Gun will now better detect connection closes in some cases.
* Gun will no longer send duplicate connection-wide `gun_error`
messages to the same process.
* Gun no longer crashes when trying to upgrade to Websocket
over a connection restricted to HTTP/1.0.
* The default value for the preferred protocols when using
CONNECT over TLS has been corrected. It was mistakenly not
enabling HTTP/2.
* Protocol options provided for a tunnel destination were
sometimes ignored. This should no longer be the case.
* Gun will no longer send an empty HTTP/2 DATA frame when
there is no request body. It was not necessary.
* Gun will no longer error out when the owner process exits.
The error reason will now be a `shutdown` tuple instead.
* The host header was set incorrectly during Websocket upgrades
when the host was configured with an IP address, resulting
in a crash. This has been corrected.
* A completed stream could be found in the `gun_down` message when
the response contained a connection: close header. This is no
longer the case.
* Hostnames can now be provided as atom as stated by the
documentation.
* Gun will no longer attempt to send empty data chunks. When
using HTTP/1.1 chunked transfer-encoding this caused the
request body to end, even when `nofin` was given.
* Gun now always retries connecting immediately when the
connection goes down.
* The default port number for the HTTP and HTTPS schemes is
no longer sent in the host header.
* An invalid stream reference was sent on failed Websocket
upgrade responses. This has been corrected.
* HTTP/2 connection preface errors are now properly detected
and propagated in the `gun_down` message to the connection
owner as well as the exit reason of the Gun process.
* HTTP/2 connection preface errors now provide a different
human readable error when the data received looks like an
HTTP/1.x response.
* HTTP/2 connection errors were missing the human readable
reason in the `gun_error` message. This has been corrected.
* Fix the host and :authority (pseudo-)headers when connecting
to an IPv6 address given as a tuple. They were lacking the
surrounding brackets.
* Fix a crash in gun:info/1 when the socket was closed before
we call Transport:sockname/1.
* Fix flushing by stream reference. When the `gun_inform`
message was flushed the function would switch to flushing
all messages from the pid instead of only messages from
the given stream.
* Allow setting a custom SNI value.
* Fix double sending of last chunk in HTTP/1.1 when Gun is
asked to send empty data before closing the stream.
* Gun will now properly ignore parameters when the media
type is text/event-stream.
* Avoid noisy crashes in the TLS over TLS code.
* Gun will now include the StreamRef of Websocket streams
when sending `gun_down` messages.
* Gun will no longer reject HTTP proxies that use HTTP/1.0
for the version in their response.
