You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by cm...@apache.org on 2026/05/14 17:25:15 UTC
(trafficserver) branch 10.2.x updated (7a4294c335 -> ed11df09b8)
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a change to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
from 7a4294c335 Propagate PROXY-Protocol src to outbound surfaces (#13120)
new f4d07fe080 Fix XPACK relative index underflow (#13144)
new e3c61e8164 Fix combo paths with embedded colons (#13143)
new d822d8529d Remove cache alternate vector detach (#13138)
new f46aebb6dc Turn off ASAN leak detection running tscore/CompileParseRules during build (#13137)
new 2f8a34e66c Fix index issue with records in HostDBRecord::select_best_srv (#13132)
new ed11df09b8 Fix bg fill teardown crash in update_size_and_time_stats (#13114)
The 6 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
plugins/esi/combo_handler.cc | 2 +-
src/iocore/cache/CacheHttp.cc | 21 ----------
src/iocore/cache/P_CacheHttp.h | 1 -
src/iocore/hostdb/HostDB.cc | 16 ++++----
src/proxy/hdrs/XPACK.cc | 11 +++++-
src/proxy/hdrs/unit_tests/test_XPACK.cc | 19 +++++++++
src/proxy/http/HttpSM.cc | 46 ++++++++++++++++++++++
src/tscore/CMakeLists.txt | 2 +-
.../pluginTest/combo_handler/combo_handler.test.py | 12 ++++++
9 files changed, 97 insertions(+), 33 deletions(-)
(trafficserver) 01/06: Fix XPACK relative index underflow (#13144)
Posted by cm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a commit to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit f4d07fe0806c01f0f041c872b09d95c652db2334
Author: Brian Neradt <br...@gmail.com>
AuthorDate: Fri May 8 15:56:56 2026 -0500
Fix XPACK relative index underflow (#13144)
XPACK dynamic table lookups convert absolute matches into HPACK
relative indexes. If an impossible future absolute index reached that
conversion path, unsigned subtraction could wrap and report a bogus
relative index.
This guards the conversion by preserving unmatched lookup results and
rejecting absolute indexes beyond the current dynamic-table head before
subtracting. This also adds XPACK unit coverage for empty, missing, and
normal relative lookup results.
(cherry picked from commit e698e468fb2d6f9300c18fb86763177d73e49264)
---
src/proxy/hdrs/XPACK.cc | 11 ++++++++++-
src/proxy/hdrs/unit_tests/test_XPACK.cc | 19 +++++++++++++++++++
2 files changed, 29 insertions(+), 1 deletion(-)
diff --git a/src/proxy/hdrs/XPACK.cc b/src/proxy/hdrs/XPACK.cc
index 388618a14d..78acdf056d 100644
--- a/src/proxy/hdrs/XPACK.cc
+++ b/src/proxy/hdrs/XPACK.cc
@@ -328,7 +328,16 @@ const XpackLookupResult
XpackDynamicTable::lookup_relative(const char *name, size_t name_len, const char *value, size_t value_len) const
{
XpackLookupResult result = this->lookup(name, name_len, value, value_len);
- result.index = this->_entries[this->_entries_head].index - result.index;
+ if (result.match_type == XpackLookupResult::MatchType::NONE) {
+ return result;
+ }
+
+ uint32_t const head_index = this->_entries[this->_entries_head].index;
+ if (result.index > head_index) {
+ return {0, XpackLookupResult::MatchType::NONE};
+ }
+
+ result.index = head_index - result.index;
return result;
}
diff --git a/src/proxy/hdrs/unit_tests/test_XPACK.cc b/src/proxy/hdrs/unit_tests/test_XPACK.cc
index 4869509218..c0f9a40d63 100644
--- a/src/proxy/hdrs/unit_tests/test_XPACK.cc
+++ b/src/proxy/hdrs/unit_tests/test_XPACK.cc
@@ -146,6 +146,10 @@ TEST_CASE("XPACK_String", "[xpack]")
REQUIRE(dt.count() == 0);
result = dt.lookup("", "");
REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
+ REQUIRE(result.index == 0);
+ result = dt.lookup_relative("", "");
+ REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
+ REQUIRE(result.index == 0);
}
SECTION("Dynamic Table")
@@ -173,6 +177,9 @@ TEST_CASE("XPACK_String", "[xpack]")
REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
result = dt.lookup(MAX_SIZE + 1, &name, &name_len, &value, &value_len);
REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
+ result = dt.lookup_relative("missing", "value");
+ REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
+ REQUIRE(result.index == 0);
// Insert one entry
dt.insert_entry("name1", "value1");
@@ -188,6 +195,9 @@ TEST_CASE("XPACK_String", "[xpack]")
REQUIRE(memcmp(value, "value1", value_len) == 0);
result = dt.lookup(dt.largest_index() + 1, &name, &name_len, &value, &value_len);
REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
+ result = dt.lookup_relative("missing", "value1");
+ REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
+ REQUIRE(result.index == 0);
result = dt.lookup(MAX_SIZE - 1, &name, &name_len, &value, &value_len);
REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
@@ -228,6 +238,15 @@ TEST_CASE("XPACK_String", "[xpack]")
REQUIRE(memcmp(name, "name1", name_len) == 0);
REQUIRE(value_len == strlen("value1"));
REQUIRE(memcmp(value, "value1", value_len) == 0);
+ result = dt.lookup_relative("name2", "value2");
+ REQUIRE(result.match_type == XpackLookupResult::MatchType::EXACT);
+ REQUIRE(result.index == 0);
+ result = dt.lookup_relative("name1", "value1");
+ REQUIRE(result.match_type == XpackLookupResult::MatchType::EXACT);
+ REQUIRE(result.index == 1);
+ result = dt.lookup_relative("missing", "value2");
+ REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
+ REQUIRE(result.index == 0);
result = dt.lookup(MAX_SIZE - 1, &name, &name_len, &value, &value_len);
REQUIRE(result.match_type == XpackLookupResult::MatchType::NONE);
result = dt.lookup(MAX_SIZE, &name, &name_len, &value, &value_len);
(trafficserver) 06/06: Fix bg fill teardown crash in update_size_and_time_stats (#13114)
Posted by cm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a commit to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit ed11df09b8584839db225ff7840fe4f8fa46096e
Author: Brian Neradt <br...@gmail.com>
AuthorDate: Tue May 12 11:07:09 2026 -0500
Fix bg fill teardown crash in update_size_and_time_stats (#13114)
Production crash logs show ink_assert(0) firing in
HttpTransact::update_size_and_time_stats when an HTTP/2 stream close
re-enters HttpSM after the user-agent side was detached for background
fill. The server-to-cache tunnel should continue, but the stale
user-agent event misses the VC table and falls through to the default
tunnel handler, which tears down the SM with background_fill still
STARTED.
This ignores stale user-agent VIO and close events while a background
fill tunnel is active, so tunnel_handler_server remains responsible for
driving the fill to COMPLETED or ABORTED. This also keeps an
unconditional kill_this cleanup as a last-resort guard to balance
background_fill_current_count if any unexpected path still tears down
mid-fill.
(cherry picked from commit d366ab0feda439399bc32d8d3d2551492347fcb1)
---
src/proxy/http/HttpSM.cc | 46 ++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 46 insertions(+)
diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc
index 1f2e7b4b15..7f6e2f798c 100644
--- a/src/proxy/http/HttpSM.cc
+++ b/src/proxy/http/HttpSM.cc
@@ -2760,11 +2760,47 @@ HttpSM::main_handler(int event, void *data)
}
}
+ // Is there an active background-fill tunnel?
+ // Background fill detaches the user-agent VC and lets the server/cache side
+ // finish the response body. An Http2Stream can still deliver a scheduled UA
+ // close/error callback after that detach, but the UA VIO no longer has a VC
+ // table entry. This predicate recognizes only those detached UA-side events
+ // so they do not fall through to the default tunnel handler and tear down the
+ // HttpSM before the active background-fill tunnel completes.
+ auto is_stale_bg_fill_ua_event = [&]() -> bool {
+ if (background_fill != BackgroundFill_t::STARTED || !tunnel.is_tunnel_alive() || _ua.get_txn() == nullptr) {
+ return false;
+ }
+
+ switch (event) {
+ case VC_EVENT_EOS:
+ case VC_EVENT_ERROR:
+ case VC_EVENT_INACTIVITY_TIMEOUT:
+ case VC_EVENT_ACTIVE_TIMEOUT:
+ case VC_EVENT_WRITE_READY:
+ case VC_EVENT_WRITE_COMPLETE:
+ case VC_EVENT_READ_READY:
+ case VC_EVENT_READ_COMPLETE:
+ break;
+ default:
+ return false;
+ }
+
+ if (data == nullptr) {
+ return true;
+ }
+
+ return static_cast<VIO *>(data)->vc_server == _ua.get_txn();
+ };
+
if (vc_entry) {
jump_point = (static_cast<VIO *>(data) == vc_entry->read_vio) ? vc_entry->vc_read_handler : vc_entry->vc_write_handler;
ink_assert(jump_point != (HttpSMHandler) nullptr);
ink_assert(vc_entry->vc != (VConnection *)nullptr);
(this->*jump_point)(event, data);
+ } else if (is_stale_bg_fill_ua_event()) {
+ SMDbg(dbg_ctl_http, "ignoring stale %s event for closed user agent while background fill is active",
+ HttpDebugNames::get_event_name(event));
} else {
ink_assert(default_handler != (HttpSMHandler) nullptr);
(this->*default_handler)(event, data);
@@ -7712,6 +7748,16 @@ HttpSM::kill_this()
// we must check it again
if (kill_this_async_done == true) {
pending_action = nullptr;
+
+ // This should only be a last-resort cleanup path. A background fill is
+ // normally driven to COMPLETED or ABORTED by tunnel_handler_server, but
+ // any unexpected teardown must still balance the active fill gauge before
+ // optional stats/logging run.
+ if (background_fill == BackgroundFill_t::STARTED) {
+ background_fill = BackgroundFill_t::ABORTED;
+ Metrics::Gauge::decrement(http_rsb.background_fill_current_count);
+ }
+
if (t_state.http_config_param->enable_http_stats) {
update_stats();
}
(trafficserver) 02/06: Fix combo paths with embedded colons (#13143)
Posted by cm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a commit to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit e3c61e8164f87e39a085ac59c800e6ef2d6be164
Author: Brian Neradt <br...@gmail.com>
AuthorDate: Mon May 11 08:44:45 2026 -0500
Fix combo paths with embedded colons (#13143)
Combo handler query parameters use a colon to select the bucket prefix,
but asset paths can also contain colons. Requests with an embedded path
colon were split at the last colon, producing the wrong internal fetch
URL and failing instead of fetching the requested object.
This keeps the first colon as the combo delimiter and leaves later
colons in the asset path. This also adds an AuTest case with a neutral
asset name so the parser regression is covered.
(cherry picked from commit a757a7b353b233e505dc889906ada910abc9631d)
---
plugins/esi/combo_handler.cc | 2 +-
.../pluginTest/combo_handler/combo_handler.test.py | 12 ++++++++++++
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/plugins/esi/combo_handler.cc b/plugins/esi/combo_handler.cc
index 276d1bcd13..9ff34ccecf 100644
--- a/plugins/esi/combo_handler.cc
+++ b/plugins/esi/combo_handler.cc
@@ -712,7 +712,7 @@ parseQueryParameters(const char *query, int query_len, ClientRequest &creq)
}
}
param_start_pos = i + 1;
- } else if (query[i] == ':') {
+ } else if ((query[i] == ':') && (colon_pos < param_start_pos)) {
colon_pos = i;
}
}
diff --git a/tests/gold_tests/pluginTest/combo_handler/combo_handler.test.py b/tests/gold_tests/pluginTest/combo_handler/combo_handler.test.py
index 6cdcc5be7f..711566a9b7 100644
--- a/tests/gold_tests/pluginTest/combo_handler/combo_handler.test.py
+++ b/tests/gold_tests/pluginTest/combo_handler/combo_handler.test.py
@@ -83,6 +83,7 @@ add_server_obj("text/css ; charset=utf-8", "/obj1")
add_server_obj("text/javascript", "/sub/obj2")
add_server_obj("text/argh", "/obj3")
add_server_obj("application/javascript", "/obj4")
+add_server_obj("application/javascript", "/s/assets/module:variant_v1.js")
ts = Test.MakeATSProcess("ts")
@@ -96,6 +97,7 @@ ts.Disk.plugin_config.AddLine("combo_handler.so - - - ctwl.txt")
ts.Disk.remap_config.AddLine('map http://xyz/ http://127.0.0.1/ @plugin=combo_handler.so')
ts.Disk.remap_config.AddLine(f'map http://localhost/127.0.0.1/ http://127.0.0.1:{server.Variables.Port}/')
ts.Disk.remap_config.AddLine(f'map http://localhost/sub/ http://127.0.0.1:{server.Variables.Port}/sub/')
+ts.Disk.remap_config.AddLine(f'map http://localhost/s/ http://127.0.0.1:{server.Variables.Port}/s/')
# Configure the combo_handler's configuration file.
ts.Setup.Copy("ctwl.txt", ts.Variables.CONFIGDIR)
@@ -122,4 +124,14 @@ tr.Processes.Default.ReturnCode = 0
f = tr.Disk.File("_output/2-tr-Default/stream.all.txt")
f.Content = "combo_handler_files/tr2.gold"
+tr = Test.AddTestRun()
+tr.Processes.Default.Command = tcp_client(
+ "127.0.0.1", ts.Variables.port,
+ "GET /admin/v1/combo?s:assets/module:variant_v1.js HTTP/1.1\n" + "Host: xyz\n" + "Connection: close\n" + "\n")
+tr.Processes.Default.ReturnCode = 0
+f = tr.Disk.File("_output/3-tr-Default/stream.all.txt")
+f.Content = Testers.ContainsExpression("HTTP/1.1 200 OK", "Should successfully combine an object with a colon in its path")
+f.Content += Testers.ContainsExpression(
+ "Content for /s/assets/module:variant_v1.js", "Should fetch the object path after the first colon")
+
ts.Disk.diags_log.Content = Testers.ContainsExpression("ERROR", "Some tests are failure tests")
(trafficserver) 05/06: Fix index issue with records in HostDBRecord::select_best_srv (#13132)
Posted by cm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a commit to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 2f8a34e66c4d393d108069bd118c6aa272c39cb7
Author: Chris McFarlen <ch...@mcfarlen.us>
AuthorDate: Mon May 4 17:14:19 2026 -0500
Fix index issue with records in HostDBRecord::select_best_srv (#13132)
* Fix index issue with records in HostDBRecord::select_best_srv
* review comments
(cherry picked from commit 79f8b31b2ac3420d1456bbb6f4ff6c1bcd6e0e1c)
---
src/iocore/hostdb/HostDB.cc | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/src/iocore/hostdb/HostDB.cc b/src/iocore/hostdb/HostDB.cc
index 12a8532be6..1c0289f149 100644
--- a/src/iocore/hostdb/HostDB.cc
+++ b/src/iocore/hostdb/HostDB.cc
@@ -1601,23 +1601,22 @@ HostDBRecord::select_best_srv(char *target, InkRand *rand, ts_time now, ts_secon
{
ink_assert(rr_count <= 0 || static_cast<unsigned int>(rr_count) < hostdb_round_robin_max_count);
- int i = 0;
int live_n = 0;
uint32_t weight = 0, p = INT32_MAX;
HostDBInfo *result = nullptr;
auto rr = this->rr_info();
// Array of live targets, sized by @a live_n
HostDBInfo *live[rr.count()];
- for (auto &target : rr) {
+ for (auto &rr_target : rr) {
// skip down targets.
- if (rr[i].is_down(now, fail_window)) {
+ if (rr_target.is_down(now, fail_window)) {
continue;
}
- if (target.data.srv.srv_priority <= p) {
- p = target.data.srv.srv_priority;
- weight += target.data.srv.srv_weight;
- live[live_n++] = ⌖
+ if (rr_target.data.srv.srv_priority <= p) {
+ p = rr_target.data.srv.srv_priority;
+ weight += rr_target.data.srv.srv_weight;
+ live[live_n++] = &rr_target;
} else {
break;
}
@@ -1627,7 +1626,8 @@ HostDBRecord::select_best_srv(char *target, InkRand *rand, ts_time now, ts_secon
result = this->select_next_rr(now, fail_window);
} else {
uint32_t xx = rand->random() % weight;
- for (i = 0; i < live_n - 1 && xx >= live[i]->data.srv.srv_weight; ++i) {
+ int i = 0;
+ for (; i < live_n - 1 && xx >= live[i]->data.srv.srv_weight; ++i) {
xx -= live[i]->data.srv.srv_weight;
}
(trafficserver) 03/06: Remove cache alternate vector detach (#13138)
Posted by cm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a commit to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit d822d8529dfca84ccece15bfaf864b3d01b54306
Author: Brian Neradt <br...@gmail.com>
AuthorDate: Tue May 12 10:54:45 2026 -0500
Remove cache alternate vector detach (#13138)
Cache alternate detach is a private helper with no current callers, and
its compaction loop contains a latent out-of-bounds read if the helper is
ever used. Keeping the dead path around preserves a future cache metadata
hazard without providing any current behavior.
This removes the unused helper and its declaration instead of repairing
the unreachable implementation. Existing alternate removal continues to
use the live remove path.
(cherry picked from commit 5f6a83d1b9adfc647af966960179c143ecbba234)
---
src/iocore/cache/CacheHttp.cc | 21 ---------------------
src/iocore/cache/P_CacheHttp.h | 1 -
2 files changed, 22 deletions(-)
diff --git a/src/iocore/cache/CacheHttp.cc b/src/iocore/cache/CacheHttp.cc
index b1d7b57f34..4c48db5adb 100644
--- a/src/iocore/cache/CacheHttp.cc
+++ b/src/iocore/cache/CacheHttp.cc
@@ -63,27 +63,6 @@ CacheHTTPInfoVector::insert(CacheHTTPInfo *info, int index)
return index;
}
-/*-------------------------------------------------------------------------
- -------------------------------------------------------------------------*/
-
-void
-CacheHTTPInfoVector::detach(int idx, CacheHTTPInfo *r)
-{
- int i;
-
- ink_assert(idx >= 0);
- ink_assert(idx < xcount);
-
- r->copy_shallow(&data[idx].alternate);
- data[idx].alternate.destroy();
-
- for (i = idx; i < (xcount - 1); i++) {
- data[i] = data[i + i];
- }
-
- xcount -= 1;
-}
-
/*-------------------------------------------------------------------------
-------------------------------------------------------------------------*/
diff --git a/src/iocore/cache/P_CacheHttp.h b/src/iocore/cache/P_CacheHttp.h
index 6a30b15b5e..77f8471320 100644
--- a/src/iocore/cache/P_CacheHttp.h
+++ b/src/iocore/cache/P_CacheHttp.h
@@ -50,7 +50,6 @@ struct CacheHTTPInfoVector {
}
int insert(CacheHTTPInfo *info, int id = -1);
CacheHTTPInfo *get(int idx);
- void detach(int idx, CacheHTTPInfo *r);
void remove(int idx, bool destroy);
void clear(bool destroy = true);
void
(trafficserver) 04/06: Turn off ASAN leak detection running tscore/CompileParseRules during build (#13137)
Posted by cm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a commit to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit f46aebb6dc7689691189f4a22eac342d79b19be4
Author: Chris McFarlen <ch...@mcfarlen.us>
AuthorDate: Mon May 11 17:36:40 2026 -0500
Turn off ASAN leak detection running tscore/CompileParseRules during build (#13137)
(cherry picked from commit 4bba67846c05ddb78163a4143deddd7245cb6865)
---
src/tscore/CMakeLists.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/tscore/CMakeLists.txt b/src/tscore/CMakeLists.txt
index 9b2382e1c4..7790adc87d 100644
--- a/src/tscore/CMakeLists.txt
+++ b/src/tscore/CMakeLists.txt
@@ -21,7 +21,7 @@ add_executable(CompileParseRules CompileParseRules.cc)
add_custom_command(
OUTPUT ParseRulesCType ParseRulesCTypeToUpper ParseRulesCTypeToLower
- COMMAND CompileParseRules
+ COMMAND ${CMAKE_COMMAND} -E env ASAN_OPTIONS=detect_leaks=0 $<TARGET_FILE:CompileParseRules>
COMMENT "Generating compile parse rules"
)