apache · cmcfarlen · Aug 4, 2026 · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -214,7 +214,6 @@ set(ENABLE_TPROXY
         'X' where X is a number to use as the IP_TRANSPARENT sockopt,
         anything else to enable."
 )
-option(ENABLE_OPENSSL_QUIC "Use OpenSSL native QUIC (default OFF)")
 option(ENABLE_QUICHE "Use quiche (default OFF)")
 
 option(ENABLE_EXAMPLE "Build example directory (default OFF)")
@@ -313,8 +312,8 @@ if(NOT SSLLIB_IS_BORINGSSL
    AND NOT SSLLIB_IS_AWSLC
    AND OPENSSL_VERSION VERSION_GREATER_EQUAL "3.0.0"
 )
-  set(SSLLIB_IS_OPENSSL3 TRUE)
-  add_compile_definitions(OPENSSL_API_COMPAT=10002 OPENSSL_IS_OPENSSL3)
+  set(SSLLIB_IS_AT_LEAST_OPENSSL3 TRUE)
+  add_compile_definitions(OPENSSL_API_COMPAT=10002 OPENSSL_IS_AT_LEAST_OPENSSL3)
 endif()
 
 check_openssl_has_quic_tls_cbs(SSLLIB_HAS_QUIC_TLS_CBS "${OPENSSL_INCLUDE_DIR}")
@@ -329,6 +328,42 @@ endif()
 
 check_openssl_has_native_quic(SSLLIB_HAS_NATIVE_QUIC "${OPENSSL_INCLUDE_DIR}")
 
+if(DEFINED ENABLE_OPENSSL_QUIC
+   AND NOT ENABLE_OPENSSL_QUIC STREQUAL "AUTO"
+   AND ENABLE_OPENSSL_QUIC
+)
+  if(ENABLE_QUICHE)
+    message(FATAL_ERROR "ENABLE_OPENSSL_QUIC and ENABLE_QUICHE are mutually exclusive QUIC backends")
+  endif()
+  if(NOT SSLLIB_HAS_NATIVE_QUIC)
+    message(FATAL_ERROR "OpenSSL native QUIC support requires OpenSSL 3.5 or newer with OSSL_QUIC_server_method")
+  endif()
+  if(SSLLIB_IS_BORINGSSL
+     OR SSLLIB_IS_AWSLC
+     OR SSLLIB_IS_QUICTLS
+  )
+    message(FATAL_ERROR "OpenSSL native QUIC support requires upstream OpenSSL 3.5 or newer")
+  endif()
+endif()
+
+set(OPENSSL_QUIC_AVAILABLE ${SSLLIB_HAS_NATIVE_QUIC})
+if(SSLLIB_IS_BORINGSSL
+   OR SSLLIB_IS_AWSLC
+   OR SSLLIB_IS_QUICTLS
+   OR ENABLE_QUICHE
+)
+  set(OPENSSL_QUIC_AVAILABLE FALSE)
+endif()
+auto_option(
+  OPENSSL_QUIC
+  FEATURE_VAR
+  TS_HAS_OPENSSL_QUIC
+  DESCRIPTION
+  "Use OpenSSL native QUIC"
+  VAR_DEPENDS
+  OPENSSL_QUIC_AVAILABLE
+)
+
 if(ENABLE_PROFILER)
   find_package(profiler REQUIRED)
   set(TS_HAS_PROFILER ${profiler_FOUND})
@@ -344,21 +379,7 @@ elseif(TS_HAS_MIMALLOC)
   link_libraries(mimalloc)
 endif()
 
-if(ENABLE_OPENSSL_QUIC AND ENABLE_QUICHE)
-  message(FATAL_ERROR "ENABLE_OPENSSL_QUIC and ENABLE_QUICHE are mutually exclusive QUIC backends")
-endif()
-
-if(ENABLE_OPENSSL_QUIC)
-  if(NOT SSLLIB_HAS_NATIVE_QUIC)
-    message(FATAL_ERROR "OpenSSL native QUIC support requires OpenSSL 3.5 or newer with OSSL_QUIC_server_method")
-  endif()
-  if(SSLLIB_IS_BORINGSSL
-     OR SSLLIB_IS_AWSLC
-     OR SSLLIB_IS_QUICTLS
-  )
-    message(FATAL_ERROR "OpenSSL native QUIC support requires upstream OpenSSL 3.5 or newer")
-  endif()
-  set(TS_HAS_OPENSSL_QUIC TRUE)
+if(TS_HAS_OPENSSL_QUIC)
   set(TS_USE_QUIC TRUE)
   message(STATUS "Using OpenSSL native QUIC")
 endif()
@@ -625,12 +646,9 @@ check_symbol_exists(SSL_get_all_async_fds openssl/ssl.h TS_USE_TLS_ASYNC)
 check_symbol_exists(OSSL_PARAM_construct_end "openssl/params.h" HAVE_OSSL_PARAM_CONSTRUCT_END)
 check_symbol_exists(TLS1_3_VERSION "openssl/ssl.h" TS_USE_TLS13)
 check_symbol_exists(MD5_Init "openssl/md5.h" HAVE_MD5_INIT)
-check_symbol_exists(ENGINE_load_dynamic "openssl/engine.h" HAVE_ENGINE_LOAD_DYNAMIC)
-check_symbol_exists(ENGINE_get_default_RSA "openssl/engine.h" HAVE_ENGINE_GET_DEFAULT_RSA)
-check_symbol_exists(ENGINE_load_private_key "openssl/engine.h" HAVE_ENGINE_LOAD_PRIVATE_KEY)
 check_symbol_exists(sysctlbyname "sys/sysctl.h" HAVE_SYSCTLBYNAME)
 
-if(SSLLIB_IS_OPENSSL3)
+if(SSLLIB_IS_AT_LEAST_OPENSSL3)
   check_symbol_exists(SSL_CTX_set_tlsext_ticket_key_evp_cb "openssl/ssl.h" TS_HAS_TLS_SESSION_TICKET)
 else()
   check_symbol_exists(SSL_CTX_set_tlsext_ticket_key_cb "openssl/ssl.h" TS_HAS_TLS_SESSION_TICKET)

diff --git a/CMakePresets.json b/CMakePresets.json
@@ -201,7 +201,9 @@
       "description": "CI Pipeline config for Fedora Linux compiled with c++20",
       "inherits": ["ci-fedora"],
       "cacheVariables": {
-        "CMAKE_CXX_STANDARD": "20"
+        "CMAKE_CXX_STANDARD": "20",
+        "CMAKE_C_COMPILER": "clang",
+        "CMAKE_CXX_COMPILER": "clang++"
       }
     },
     {

diff --git a/doc/admin-guide/files/records.yaml.en.rst b/doc/admin-guide/files/records.yaml.en.rst
@@ -5125,15 +5125,15 @@ HTTP/2 Configuration
 
    This is the threshold of sampling stream number to start checking the stream error rate.
 
-.. ts:cv:: CONFIG proxy.config.http2.max_settings_per_frame INT 7
+.. ts:cv:: CONFIG proxy.config.http2.max_settings_per_frame INT 16
    :reloadable:
 
    Specifies how many settings in an HTTP/2 SETTINGS frame |TS| accepts.
    Clients exceeded this limit will be immediately disconnected with an error
    code of ENHANCE_YOUR_CALM.
    Any negative value configures no limit to the number of settings received.
 
-.. ts:cv:: CONFIG proxy.config.http2.max_settings_per_minute INT 14
+.. ts:cv:: CONFIG proxy.config.http2.max_settings_per_minute INT 32
    :reloadable:
 
    Specifies how many settings in HTTP/2 SETTINGS frames |TS| accept for a minute.
@@ -5267,8 +5267,8 @@ removed in the future without prior notice.
 .. ts:cv:: CONFIG proxy.config.quic.instance_id INT 0
    :reloadable:
 
-   A static key used for calculating Stateless Reset Token. All instances in a
-   cluster need to share the same value.
+   An instance identifier mixed into Stateless Reset Tokens. All instances in a
+   cluster that share token keys need to use the same value.
 
 .. ts:cv:: CONFIG proxy.config.quic.connection_table.size INT 65521
 
@@ -5283,6 +5283,20 @@ removed in the future without prior notice.
 
    Enables Stateless Retry.
 
+.. ts:cv:: CONFIG proxy.config.quic.server.token_key.filename STRING NULL
+   :reloadable:
+
+   The file containing the secret keys used to generate QUIC address-validation
+   and stateless-reset tokens. Relative paths are resolved from the |TS|
+   configuration directory. The file must contain one or more raw 32-byte keys.
+   The first key generates new tokens, while all keys validate address-validation
+   tokens to support key rotation. For example, generate a key with
+   ``head -c32 /dev/urandom > quic_token.key``.
+
+   When this is not set, |TS| generates a random per-process key at startup. Set
+   the same key file on each server that must validate tokens generated by other
+   servers. Reload configuration after changing the key file.
+
 .. ts:cv:: CONFIG proxy.config.quic.client.vn_exercise_enabled INT 0
    :reloadable:
 

diff --git a/doc/developer-guide/testing/autests.en.rst b/doc/developer-guide/testing/autests.en.rst
@@ -356,6 +356,7 @@ The ``autest`` section configures the test environment:
   - **process_config**: Parameters passed to ``MakeATSProcess`` (e.g., ``enable_cache``)
   - **records_config**: Dictionary of records.config settings
   - **remap_config**: List of remap rules (string or dict format)
+  - **cache_config**: List of cache.config rules
   - **copy_to_config_dir**: List of files/directories to copy to ATS config directory
   - **log_validation**: Log validation rules for ``traffic_out`` and ``diags_log``
   - **metric_checks**: List of metric name/value pairs to verify after traffic completes

diff --git a/example/plugins/c-api/verify_cert/verify_cert.cc b/example/plugins/c-api/verify_cert/verify_cert.cc
@@ -66,7 +66,7 @@ CB_clientcert(TSCont /* contp */, TSEvent /* event */, void *edata)
   TSVConn         ssl_vc = reinterpret_cast<TSVConn>(edata);
   TSSslConnection sslobj = TSVConnSslConnectionGet(ssl_vc);
   SSL            *ssl    = reinterpret_cast<SSL *>(sslobj);
-#ifdef OPENSSL_IS_OPENSSL3
+#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
   X509 *cert = SSL_get1_peer_certificate(ssl);
 #else
   X509 *cert = SSL_get_peer_certificate(ssl);

diff --git a/include/cripts/Connections.hpp b/include/cripts/Connections.hpp
@@ -365,7 +365,7 @@ class ConnBase
       auto conn = Connection();
 
       if (mTLS) {
-#ifdef OPENSSL_IS_OPENSSL3
+#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
         return SSL_get1_peer_certificate(reinterpret_cast<::SSL *>(conn));
 #else
         return SSL_get_peer_certificate(reinterpret_cast<::SSL *>(conn));

diff --git a/include/iocore/net/ConnectionTracker.h b/include/iocore/net/ConnectionTracker.h
@@ -32,6 +32,7 @@
 #include <mutex>
 #include <sstream>
 #include <tuple>
+#include <utility>
 #include "records/RecCore.h"
 #include "tscore/ink_platform.h"
 #include "tscore/ink_config.h"
@@ -429,7 +430,7 @@ ConnectionTracker::Group::metric_name(const Key &key, std::string_view fqdn, std
   default:
     Warning("Invalid matching type to add to per_server.connections metrics");
   }
-  return metric_prefix.empty() ? metric_name : metric_prefix + "." + metric_name;
+  return metric_prefix.empty() ? std::move(metric_name) : metric_prefix + "." + metric_name;
 }
 
 inline bool

diff --git a/include/iocore/net/quic/QUICConfig.h b/include/iocore/net/quic/QUICConfig.h
@@ -34,6 +34,47 @@
 #include "iocore/net/SSLTypes.h"
 #include "mgmt/config/ConfigContext.h"
 
+#include <array>
+#include <string>
+#include <vector>
+
+class QUICTokenKeyConfigParams : public ConfigInfo
+{
+public:
+  static constexpr size_t KEY_LENGTH = 32;
+  using Key                          = std::array<uint8_t, KEY_LENGTH>;
+
+  ~QUICTokenKeyConfigParams() override;
+
+  /** Load one or more raw token keys from @a path. */
+  bool load(const char *path, ConfigContext ctx = {});
+
+  /** Generate a random primary token key. */
+  bool generate(ConfigContext ctx = {});
+
+  const std::vector<Key> &keys() const;
+  const std::string      &filename() const;
+
+private:
+  std::vector<Key> m_keys;
+  std::string      m_filename;
+};
+
+class QUICTokenKeyConfig
+{
+public:
+  static void startup();
+  static bool reconfigure(ConfigContext ctx = {});
+
+  static QUICTokenKeyConfigParams *acquire();
+  static void                      release(QUICTokenKeyConfigParams *params);
+
+  using scoped_config = ConfigProcessor::scoped_config<QUICTokenKeyConfig, QUICTokenKeyConfigParams>;
+
+private:
+  static int _config_id;
+};
+
 class QUICConfigParams : public ConfigInfo
 {
 public:

diff --git a/include/iocore/net/quic/QUICTypes.h b/include/iocore/net/quic/QUICTypes.h
@@ -321,13 +321,20 @@ class QUICStatelessResetToken
 class QUICAddressValidationToken
 {
 public:
+  static constexpr size_t MAC_LENGTH = 32;
+
   enum class Type : uint8_t {
     RESUMPTION,
     RETRY,
   };
 
-  // FIXME Check token length
-  QUICAddressValidationToken(const uint8_t *buf, size_t len) : _token_len(len) { memcpy(this->_token, buf, len); }
+  QUICAddressValidationToken(const uint8_t *buf, size_t len)
+  {
+    if (buf != nullptr && len <= sizeof(_token)) {
+      memcpy(_token, buf, len);
+      _token_len = len;
+    }
+  }
   virtual ~QUICAddressValidationToken(){};
 
   static Type
@@ -354,7 +361,7 @@ class QUICAddressValidationToken
 
   // The size should be smaller than maximum size of Retry packet
   uint8_t      _token[1200] = {0};
-  unsigned int _token_len;
+  unsigned int _token_len   = 0;
 };
 
 class QUICResumptionToken : public QUICAddressValidationToken

diff --git a/include/mgmt/config/ConfigReloadTrace.h b/include/mgmt/config/ConfigReloadTrace.h
@@ -25,11 +25,12 @@
 
 #include <atomic>
 #include <chrono>
+#include <iostream>
 #include <string_view>
 #include <string>
 #include <mutex>
 #include <shared_mutex>
-#include <iostream>
+#include <utility>
 
 #include <swoc/Errata.h>
 #include <tscore/ink_platform.h>
@@ -207,7 +208,7 @@ class ConfigReloadTask : public std::enable_shared_from_this<ConfigReloadTask>
   using self_type    = ConfigReloadTask;
   ConfigReloadTask() = default;
   ConfigReloadTask(std::string_view token, std::string_view description, bool main_task, ConfigReloadTaskPtr parent)
-    : _info(State::CREATED, token, description, main_task), _parent{parent}
+    : _info(State::CREATED, token, description, main_task), _parent{std::move(parent)}
   {
     if (_info.main_task) {
       _info.state = State::IN_PROGRESS;

diff --git a/plugins/experimental/access_control/unit_tests/test_utils.cc b/plugins/experimental/access_control/unit_tests/test_utils.cc
@@ -252,7 +252,7 @@ TEST_CASE("HMAC Digest: test various supported/unsupported types", "[MAC][access
   digests.push_back("ccf3230972bcf229fb3b16741495c74a72bbdd14");
 #endif
 
-#ifdef OPENSSL_IS_OPENSSL3 // MD4, RIPEMD160 are deprecated in OpenSSL 3
+#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3 // MD4, RIPEMD160 are deprecated in OpenSSL 3
   types.pop_front();
   digests.pop_front();
   types.pop_back();

diff --git a/plugins/experimental/filter_body/filter_body.cc b/plugins/experimental/filter_body/filter_body.cc
@@ -27,6 +27,7 @@
 
 #include <cstring>
 #include <string>
+#include <utility>
 #include <vector>
 #include <algorithm>
 #include <cctype>
@@ -901,7 +902,7 @@ parse_config(const char *filename)
               AddHeader add_hdr;
               add_hdr.name  = hdr.first.as<std::string>();
               add_hdr.value = hdr.second.as<std::string>();
-              rule.add_headers.push_back(add_hdr);
+              rule.add_headers.push_back(std::move(add_hdr));
             }
           }
         }
@@ -953,7 +954,7 @@ parse_config(const char *filename)
               cond.patterns.push_back(pattern_node.as<std::string>());
             }
           }
-          rule.headers.push_back(cond);
+          rule.headers.push_back(std::move(cond));
         }
       }
 

diff --git a/plugins/experimental/jax_fingerprint/ja4/test.cc b/plugins/experimental/jax_fingerprint/ja4/test.cc
@@ -34,6 +34,7 @@
 #include <string>
 #include <string_view>
 #include <unordered_map>
+#include <utility>
 #include <vector>
 
 namespace
@@ -127,7 +128,7 @@ class MockDatasource : public ja4::Datasource
   void
   set_first_alpn(std::string first_alpn)
   {
-    this->_first_alpn = first_alpn;
+    this->_first_alpn = std::move(first_alpn);
   }
   void
   add_cipher(std::uint16_t cipher)

diff --git a/plugins/experimental/jax_fingerprint/ja4h/test.cc b/plugins/experimental/jax_fingerprint/ja4h/test.cc
@@ -27,6 +27,7 @@
 
 #include <string>
 #include <map>
+#include <utility>
 
 namespace
 {
@@ -89,7 +90,7 @@ class MockDatasource : public Datasource
   void
   set_method(std::string method)
   {
-    this->_method = method;
+    this->_method = std::move(method);
   }
   void
   set_version(int version)
@@ -99,7 +100,7 @@ class MockDatasource : public Datasource
   void
   set_fields(std::map<std::string, std::string> fields)
   {
-    this->_fields = fields;
+    this->_fields = std::move(fields);
   }
 
 private:

diff --git a/plugins/experimental/sslheaders/sslheaders.cc b/plugins/experimental/sslheaders/sslheaders.cc
@@ -159,7 +159,7 @@ template <bool IsClient> class WrapX509
   void
   _set()
   {
-#ifdef OPENSSL_IS_OPENSSL3
+#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
     _x509 = (IsClient ? SSL_get1_peer_certificate : SSL_get_certificate)(_ssl);
 #else
     _x509 = (IsClient ? SSL_get_peer_certificate : SSL_get_certificate)(_ssl);