Backport batch for 10.2.0 - #13485
Draft
cmcfarlen wants to merge 16 commits into
Draft
Conversation
Access log records for independent PROXY Protocol replay sessions can be finalized on different event threads. The test assumed replay order and failed intermittently when two otherwise correct records were reversed. This waits for all expected records and sorts them before comparing against the full gold output. It preserves content and count coverage without requiring transaction completion order. (cherry picked from commit df93dd7)
HTTP/2 extensions can add enough SETTINGS parameters to exceed the defaults, causing Traffic Server to close otherwise valid connections before a request. This occurs with Meta forward proxy traffic that advertises WebTransport-over-HTTP/2 settings. This raises the per-frame limit to 16 and the per-minute limit to 32, retaining abuse protections while allowing protocol growth. This also adds an AuTest that sends an extension-rich SETTINGS frame and verifies that the subsequent request succeeds. Fixes: apache#13443 (cherry picked from commit 89fdedb)
This does not cover the ENGINE support, because that is a complicated test and the support will be removed for OpenSSL 4. (cherry picked from commit 56ddbbb)
SSL_CTX_use_PrivateKey() takes its own reference on the key, so the reference from PEM_read_bio_PrivateKey() belongs to the caller. SSLPrivateKeyHandler() released it only when attaching the key failed, so a successful load leaked one EVP_PKEY per certificate. This repeats at startup, on every config reload, and on every secret or certificate update. Hold the key in a scoped_PKEY so every exit releases it. (cherry picked from commit 07aa06c)
Dedicated logging continuations remain allocated after their worker loops return during shutdown. Once shutdown reliably completes, LeakSanitizer can report the flush continuation as an 80-byte leak. Release both continuations after their loops finish. This matches the ownership model used by other dedicated event threads. (cherry picked from commit b080c83)
Some CI environments do not permit unprivileged processes to increase FIFO buffer sizes, even when the requested size is below the system maximum. The log_pipe AuTest treats this kernel policy as a product failure and cannot run in those environments. This makes the test accept only the corresponding `Operation not permitted` diagnostic when the FIFO remains unchanged, while continuing to reject other errors and fatal diagnostics. It also waits briefly for asynchronous diagnostic output before deciding whether the size check failed. (cherry picked from commit f063c0e)
Replaced file data was retired onto a freelist and freed after a timeout, but its deadline came from a timestamp taken before a blocking inotify read. That stale deadline let transactions retain references to data that was already freed. Files exactly 16 KiB long were also reported as empty because a final zero-byte read overwrote the saved length. This holds each immutable snapshot in an atomic shared_ptr. Every transaction pins its snapshot, so data lives exactly as long as it is referenced, without a freelist or request-path mutex. This also preserves the last successful file-read length and adds AuTest coverage for concurrent replacement and the 16 KiB boundary. Fixes: apache#8735 (cherry picked from commit 16bd59a)
This is for consistency since there is now OpenSSL 4, and we need to add a macro definition for OpenSSL 4 as well. (cherry picked from commit 80c01c2)
OpenSSL 3.5 provides the QUIC implementation ATS needs to accept HTTP/3 connections from downstream clients. This affects client-to-ATS traffic, not ATS-to-origin traffic. Requiring an extra opt-in leaves capable builds without client-facing HTTP/3, but merely compiling QUIC should not make deployments without QUIC listeners load every TLS certificate twice. This makes native OpenSSL QUIC an automatic CMake option. It activates only with upstream OpenSSL's native server API, remains disabled when quiche is selected, and preserves explicit ON and OFF overrides. This also starts the QUIC processor and maintains its certificate table only when a QUIC listener is configured, avoiding the duplicate load when HTTP/3 is unused. (cherry picked from commit 3ccfb19)
Exact URL entries in cache.config are dropped after successful parsing, so their cache actions never apply. Failed entries are inserted instead, which also defeats duplicate detection. Correct the success check and add unit and replay coverage for matching, nonmatching, invalid, and duplicate rules. Extend ATSReplayTest to accept cache.config entries with dynamic server ports. Fixes: apache#13421 (cherry picked from commit d05506e)
Native OpenSSL QUIC builds do not use the connection table or quiche timeout event stored by QUICNetVConnection. Clang diagnoses those quiche-only private fields as unused, causing warnings-as-errors builds to fail. This guards the members with TS_HAS_QUICHE so native OpenSSL builds do not declare them while quiche builds retain the required state. (cherry picked from commit 5d878a4)
Plugins can fill a text log buffer during TSPluginInit before logging preprocessing threads and their notification objects exist. This causes a null dereference that crashes traffic_server during startup. This problem is addressed in this patch by queuing those buffers without signaling until the logging workers exist. Their initial queue scan then flushes the pending data. A regression test forces a rollover during plugin initialization and verifies ATS stays up and preserves the log entry. With the production fix removed, the regression test caused traffic_server to crash with SIGSEGV at address zero while signaling the preprocessing notification. With the fix applied, the identical test passes. (cherry picked from commit b279b9f)
* Fix some copy instead of move Coverity CIDs CIDs fixed in this patch: 1664317 1664316 1664286 1664284 1663965 1660036 1658876 1658839 1658837 1658799 1654583 1654213 1654211 1654210 1654207 1654206 1645817 1645816 1645814 1645813 1645811 1645809 1645808 1645806 1645804 1645802 1645801 1645799 1645798 1645796 1645795 1644303 1644300 1644293 1644255 1644242 1644227 1644207 (cherry picked from commit 6201686) Partial cherry-pick: the hunks for src/config/ssl_multicert.cc, src/config/unit_tests/test_ssl_multicert.cc and src/records/unit_tests/test_ReloadDirectives.cc are omitted because those files do not exist on 10.2.x, as is the src/proxy/Plugin.cc hunk, which depends on the master-only plugin load summary.
* Remove OpenSSL ENGINE code Commit a966bc4 (apache#11219) accidentally disabled OpenSSL ENGINE support entirely. Although it was unintentional, it seems clear no one is using that API by this point (no one has reported it was broken), and the API is gone in recent OpenSSL versions. This patch removes the dead logic. (cherry picked from commit e7eb77a)
Our autest fedora run exercises g++, let's get some recent clang coverage via the fedora CI run. (cherry picked from commit 6d36c38)
QUIC address-validation and stateless-reset tokens use fixed compile-time secrets, allowing anyone with the source to reproduce valid token MACs. This replaces the fixed values with reloadable 32-byte keys and a random per-process fallback. Multiple file keys allow rotation without immediately invalidating address-validation tokens, and HMAC-SHA256 protects all token types. This also rejects malformed tokens before parsing and adds coverage for file loading, key rotation, invalid files, and fallback-key stability. (cherry picked from commit db21b1b)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport batch for the 10.2.0 release. All commits were cherry-picked with
-xfrom master in
mergedAtorder, taken from theATS v10.2.xproject at statusFor v10.2.0.Draft on purpose: this is here for the CI gate and lands by fast-forward, so no
merge commit is created.
Picked (16)
OPENSSL_IS_X->OPENSSL_IS_AT_LEAST_XConflict resolutions
ConfigContext::add_dependent_ctx()takes one argument;master added a second (
ts::filename::SSL_MULTICERT). Applied theHttpProxyPort::hasQUIC()guard, kept the branch's one-argument form.test_PluginYAML.cctosrc/proxy/unit_tests/CMakeLists.txt; that file does not exist on 10.2.x. Addedonly
test_ControlMatcher.cc, which is what the commit actually introduces.src/config/ssl_multicert.cc,src/config/unit_tests/test_ssl_multicert.ccandsrc/records/unit_tests/test_ReloadDirectives.cc(files absent on 10.2.x), andthe
src/proxy/Plugin.cchunk, which depends on the master-only plugin loadsummary. With that hunk gone the
<utility>include it added is unused, soPlugin.ccis unchanged from the branch. The omissions are recorded in thecommit message.
Not picked
present via 10.2.x: HTTP/3 via OpenSSL QUIC #13463, whose files are byte-identical to master.
939915e; it was merged directly to 10.2.x.
For v10.2.0pending an RM scopedecision; it is a ~1800-line new feature.
Local verification
macOS arm64,
build-autest(Debug). Build clean, andctest162/162 pass.test_jsonrpcserveris excluded from that count: it fails intermittently, but italso fails on unmodified
upstream/10.2.xunder--repeat until-fail:5, so it ispre-existing macOS-local flakiness (unix-socket connect timing) and not caused by
these picks. Linux CI is the arbiter.