You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by cm...@apache.org on 2026/10/19 22:33:56 UTC
(trafficserver) branch 10.1.x updated (629c96bd4f -> eb650aba3d)
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a change to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
from 629c96bd4f Fix JSONRPC server shutdown race (#13461)
add 00efe21e77 10.1.x: Throttle @ header strip logs
add 5c98ff4119 Fix use-after-free in wasm plugin TXN_CLOSE epilogue
add 980ad2fc4c Compare h2 Content-Length and payload at full width
add 0a3d53d73e wasm: Validate metric ID before making API call
add 259aff0b1e http: reject HEAD requests carrying Content-Length/Transfer-Encoding
add 160c3073bc tsmemcache: bind to loopback by default and add configurable bind address
add 64a4fa6aed Downgrade inbound H2 stream error log (#13316)
add 6e53bdccd1 Strip unauthorized x-amz- request headers in origin_server_auth
add db3a25d264 CVE-2025-55702 - Fix request with POST Expect: 100-continue
add 548d5a3bdc Require a matching client certificate for outbound session reuse
add de69ee89f4 magick: require signing key and allowlist convert operators
add 17678630a9 origin_server_auth: clarify x-amz- stripping scope in docs and comments
add df9967e629 10.1.x: autest stability bundle
add 7ba20a482d proxy: reject resumed TLS sessions missing a required client cert
add cc052f02e9 Drop the special case for badly formed 302 responses
add afda3d9e1a doc: correct the regex matching contract where sites enforce full match
add f4b529a9d7 Size chunked passthrough writes without dropped trailers
add d396dd818f chunked_encoding: add regression test for chunked responses with trailers
add 6af1e1b238 Fix mTLS for TLS resumption scenarios
add 9f76d89a71 Reuse an origin connection only after its request body is written
add a9b18f1610 doc: record the security release in the release notes
add 939a7819bd Count the Pad Length field in the h2 DATA padding check
add d94a9dbd2a Fix a SIGSEGV in UnixNetVConnection::net_write_io on dechunked POST responses
add 801b5e780a Fix TransformVConnection leak in abort_tunnel() (#13574)
add eb650aba3d Fix failed assertion in build_response for 1xx races (#12866)
No new revisions were added by this update.
Summary of changes:
.../configuration/regex-best-practices.en.rst | 28 +-
doc/admin-guide/files/records.yaml.en.rst | 46 ++-
doc/admin-guide/files/remap.config.en.rst | 15 +-
doc/admin-guide/files/sni.yaml.en.rst | 13 +
.../monitoring/statistics/core/ssl.en.rst | 14 +
doc/admin-guide/plugins/geoip_acl.en.rst | 8 +-
doc/admin-guide/plugins/maxmind_acl.en.rst | 4 +-
doc/admin-guide/plugins/memcache.en.rst | 42 +++
doc/admin-guide/plugins/origin_server_auth.en.rst | 15 +-
doc/admin-guide/security/mtls.en.rst | 66 ++++-
.../api/functions/TSHttpOverridableConfig.en.rst | 1 +
doc/developer-guide/api/functions/TSStat.en.rst | 6 +
.../api/types/TSOverridableConfigKey.en.rst | 1 +
doc/release-notes/upgrading.en.rst | 213 ++++++++++++++
doc/release-notes/whats-new.en.rst | 37 +++
include/iocore/net/TLSBasicSupport.h | 41 ++-
include/proxy/http/HttpConfig.h | 2 +
include/proxy/http/HttpSM.h | 13 +
include/proxy/http/HttpTransact.h | 1 +
include/proxy/http2/Http2Stream.h | 16 +-
include/ts/apidefs.h.in | 1 +
include/ts/ts.h | 7 +
plugins/experimental/magick/CMakeLists.txt | 2 +-
plugins/experimental/magick/README | 90 +++++-
plugins/experimental/magick/magick.cc | 275 ++++++++++++++----
plugins/experimental/magick/magick_args.cc | 307 +++++++++++++++++++++
plugins/experimental/magick/magick_args.h | 43 +++
plugins/experimental/memcache/README | 5 +
plugins/experimental/memcache/tsmemcache.cc | 53 +++-
plugins/experimental/memcache/tsmemcache.h | 3 +-
plugins/experimental/wasm/ats_context.cc | 9 +
plugins/experimental/wasm/wasm_main.cc | 1 +
plugins/lua/ts_lua_http_config.cc | 2 +
plugins/origin_server_auth/aws_auth_v4.cc | 2 +-
plugins/origin_server_auth/aws_auth_v4.h | 10 +
plugins/origin_server_auth/origin_server_auth.cc | 58 ++++
src/api/InkAPI.cc | 9 +
src/api/InkAPITest.cc | 8 +-
src/iocore/net/P_SSLConfig.h | 13 +
src/iocore/net/P_SSLUtils.h | 13 +-
src/iocore/net/SSLConfig.cc | 7 +
src/iocore/net/SSLNetVConnection.cc | 36 +++
src/iocore/net/SSLStats.cc | 1 +
src/iocore/net/SSLStats.h | 1 +
src/iocore/net/SSLUtils.cc | 234 ++++++++++++++++
src/iocore/net/TLSBasicSupport.cc | 32 ++-
src/iocore/net/UnixNetVConnection.cc | 11 +
src/proxy/http/HttpConfig.cc | 9 +-
src/proxy/http/HttpSM.cc | 127 ++++++---
src/proxy/http/HttpTransact.cc | 93 +++++--
src/proxy/http/HttpTunnel.cc | 9 +-
src/proxy/http/unit_tests/CMakeLists.txt | 1 +
src/proxy/http/unit_tests/test_HttpConfig.cc | 75 +++++
src/proxy/http/unit_tests/test_HttpTransact.cc | 4 +
src/proxy/http2/Http2ConnectionState.cc | 8 +-
src/records/RecordsConfig.cc | 2 +
src/shared/overridable_txn_vars.cc | 1 +
tests/gold_tests/at_headers/at_headers.test.py | 23 +-
.../at_headers/replay/at_headers.replay.yaml | 12 +-
tests/gold_tests/autest-site/ports.py | 49 ++--
.../chunked_encoding/chunked_encoding.test.py | 49 ++++
.../chunked_encoding/chunked_encoding_h2.test.py | 21 +-
.../chunked_encoding/chunked_encoding_h2_server.py | 115 ++++++++
.../dechunk_post_half_close.test.py | 106 +++++++
.../dechunk_post_half_close_client.py | 79 ++++++
.../dechunk_post_half_close_origin.py | 108 ++++++++
tests/gold_tests/chunked_encoding/delay-server.sh | 43 ---
...y.yaml => chunked_trailer_response.replay.yaml} | 46 ++-
tests/gold_tests/chunked_encoding/server2.sh | 41 ---
tests/gold_tests/chunked_encoding/server3.sh | 41 ---
tests/gold_tests/connect/connect.test.py | 12 +-
tests/gold_tests/dns/dns_host_down.test.py | 10 +-
.../h2/clients/h2_content_length_client.py | 211 ++++++++++++++
tests/gold_tests/h2/grpc/grpc_server.py | 6 +-
.../h2/http2_content_length_validation.test.py | 183 ++++++++++++
.../gold_tests/h2/http2_max_active_streams.test.py | 2 +-
tests/gold_tests/h2/httpbin.test.py | 11 +-
tests/gold_tests/h3/h3_sni_check.test.py | 2 +-
.../head-reject-content.test.py} | 14 +-
.../head/replay/head-reject-content.replay.yaml | 216 +++++++++++++++
.../malformed_redirect.test.py} | 19 +-
.../headers/malformed_redirect_truncated.test.py | 171 ++++++++++++
.../headers/malformed_redirect_truncated_server.py | 185 +++++++++++++
.../headers/replay/malformed_redirect.replay.yaml | 306 ++++++++++++++++++++
tests/gold_tests/ip_allow/ip_allow.test.py | 2 +-
tests/gold_tests/logging/custom-log.test.py | 13 +-
tests/gold_tests/logging/gold/pqsi-pqsp.gold | 2 +-
tests/gold_tests/logging/log-field-json.test.py | 13 +-
tests/gold_tests/logging/log-field.test.py | 12 +-
tests/gold_tests/logging/log-filenames.test.py | 13 +-
tests/gold_tests/logging/log-filter.test.py | 12 +-
tests/gold_tests/logging/new_log_flds.test.py | 12 +-
tests/gold_tests/logging/pqsi-pqsp.test.py | 10 +-
.../zzz_strategies_peer.test.py | 4 +-
.../zzz_strategies_peer2.test.py | 4 +-
.../pluginTest/money_trace/money_trace.test.py | 11 +-
.../money_trace/money_trace_global.test.py | 12 +-
.../origin_server_auth/amz_strip.replay.yaml | 79 ++++++
.../origin_server_auth/amz_strip.test.py} | 9 +-
.../rules/v4-strip-test.test_input} | 14 +-
.../pluginTest/prefetch/prefetch_cmcd.test.py | 2 -
.../stale_response_max_memory.replay.yaml | 5 +
tests/gold_tests/post/early_response_client.py | 224 +++++++++++++++
tests/gold_tests/post/early_response_origin.py | 203 ++++++++++++++
tests/gold_tests/post/expect_client.py | 114 +++++++-
.../post/post-early-response-100-continue.test.py | 183 ++++++++++++
.../post/post-expect-body-framing.test.py | 86 ++++++
.../gold_tests/proxy_protocol/gold/access-cp.gold | 4 +-
.../proxy_protocol/gold/access-nocp.gold | 4 +-
.../proxy_protocol/proxy_protocol.test.py | 22 +-
.../gold/{200.gold => 200_two.gold} | 6 -
.../session_sharing_client_cert.test.py | 164 +++++++++++
tests/gold_tests/slow_post/partial_post_client.py | 74 +++++
tests/gold_tests/slow_post/quick_server.test.py | 60 ++--
.../timeout/default_inactivity_timeout.test.py | 2 +-
.../gold/client_default_inactivity_timeout.gold | 2 +-
.../timeout/quic_no_activity_timeout.test.py | 2 +-
tests/gold_tests/tls/allow-plain.test.py | 6 +-
.../tls/ssl/gen_intermediate_ca_certs.sh | 55 ++++
tests/gold_tests/tls/ssl/intca-root.key | 28 ++
tests/gold_tests/tls/ssl/intca-root.pem | 18 ++
tests/gold_tests/tls/ssl/intca-sub.key | 28 ++
tests/gold_tests/tls/ssl/intca-sub.pem | 19 ++
tests/gold_tests/tls/ssl/intclient.key | 28 ++
tests/gold_tests/tls/ssl/intclient.pem | 19 ++
.../gold_tests/tls/tls_hooks_client_verify.test.py | 8 +-
.../tls/tls_resume_ca_bundle_reload.test.py | 234 ++++++++++++++++
.../tls/tls_resume_cert_partition.test.py | 155 +++++++++++
tests/gold_tests/tls/tls_resume_cross_sni.test.py | 189 +++++++++++++
.../tls/tls_resume_intermediate_ca.test.py | 265 ++++++++++++++++++
.../gold_tests/tls/tls_resume_verify_level.test.py | 180 ++++++++++++
tests/gold_tests/tls/tls_sni_groups.test.py | 4 +-
tests/gold_tests/tls/tls_sni_host_policy.test.py | 10 +-
.../tls/tls_ticket_verify_client_ca_scope.test.py | 205 ++++++++++++++
.../tls/tls_ticket_verify_client_scope.test.py | 203 ++++++++++++++
tests/serial_tests.txt | 9 +-
tests/tools/plugins/tunnel_transform.cc | 48 +++-
137 files changed, 6793 insertions(+), 522 deletions(-)
create mode 100644 plugins/experimental/magick/magick_args.cc
create mode 100644 plugins/experimental/magick/magick_args.h
create mode 100644 src/proxy/http/unit_tests/test_HttpConfig.cc
create mode 100644 tests/gold_tests/chunked_encoding/chunked_encoding_h2_server.py
create mode 100644 tests/gold_tests/chunked_encoding/dechunk_post_half_close.test.py
create mode 100644 tests/gold_tests/chunked_encoding/dechunk_post_half_close_client.py
create mode 100644 tests/gold_tests/chunked_encoding/dechunk_post_half_close_origin.py
delete mode 100755 tests/gold_tests/chunked_encoding/delay-server.sh
copy tests/gold_tests/chunked_encoding/replays/{chunked.replay.yaml => chunked_trailer_response.replay.yaml} (54%)
delete mode 100755 tests/gold_tests/chunked_encoding/server2.sh
delete mode 100755 tests/gold_tests/chunked_encoding/server3.sh
create mode 100644 tests/gold_tests/h2/clients/h2_content_length_client.py
create mode 100644 tests/gold_tests/h2/http2_content_length_validation.test.py
copy tests/gold_tests/{headers/normalized_ae_match_vary_cache.test.py => head/head-reject-content.test.py} (59%)
create mode 100644 tests/gold_tests/head/replay/head-reject-content.replay.yaml
copy tests/gold_tests/{basic/basic.test.py => headers/malformed_redirect.test.py} (63%)
create mode 100644 tests/gold_tests/headers/malformed_redirect_truncated.test.py
create mode 100644 tests/gold_tests/headers/malformed_redirect_truncated_server.py
create mode 100644 tests/gold_tests/headers/replay/malformed_redirect.replay.yaml
create mode 100644 tests/gold_tests/pluginTest/origin_server_auth/amz_strip.replay.yaml
copy tests/gold_tests/{cache/conditional-get-hit.test.py => pluginTest/origin_server_auth/amz_strip.test.py} (72%)
copy tests/gold_tests/{autest-site/.editorconfig => pluginTest/origin_server_auth/rules/v4-strip-test.test_input} (73%)
create mode 100644 tests/gold_tests/post/early_response_client.py
create mode 100644 tests/gold_tests/post/early_response_origin.py
create mode 100644 tests/gold_tests/post/post-early-response-100-continue.test.py
create mode 100644 tests/gold_tests/post/post-expect-body-framing.test.py
copy tests/gold_tests/session_sharing/gold/{200.gold => 200_two.gold} (67%)
create mode 100644 tests/gold_tests/session_sharing/session_sharing_client_cert.test.py
create mode 100644 tests/gold_tests/slow_post/partial_post_client.py
create mode 100755 tests/gold_tests/tls/ssl/gen_intermediate_ca_certs.sh
create mode 100644 tests/gold_tests/tls/ssl/intca-root.key
create mode 100644 tests/gold_tests/tls/ssl/intca-root.pem
create mode 100644 tests/gold_tests/tls/ssl/intca-sub.key
create mode 100644 tests/gold_tests/tls/ssl/intca-sub.pem
create mode 100644 tests/gold_tests/tls/ssl/intclient.key
create mode 100644 tests/gold_tests/tls/ssl/intclient.pem
create mode 100644 tests/gold_tests/tls/tls_resume_ca_bundle_reload.test.py
create mode 100644 tests/gold_tests/tls/tls_resume_cert_partition.test.py
create mode 100644 tests/gold_tests/tls/tls_resume_cross_sni.test.py
create mode 100644 tests/gold_tests/tls/tls_resume_intermediate_ca.test.py
create mode 100644 tests/gold_tests/tls/tls_resume_verify_level.test.py
create mode 100644 tests/gold_tests/tls/tls_ticket_verify_client_ca_scope.test.py
create mode 100644 tests/gold_tests/tls/tls_ticket_verify_client_scope.test.py