You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by cm...@apache.org on 2026/10/19 22:36:23 UTC
(trafficserver) branch 10.2.x updated (0add6b7d98 -> 9cb900dcb3)
This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a change to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
from 0add6b7d98 hrw4u: report each sandbox warning at the use that triggers it (#13739)
add 04efd5cd98 Fix use-after-free in wasm plugin TXN_CLOSE epilogue
add 8591b564d0 Compare h2 Content-Length and payload at full width
add 61f9f1d812 wasm: Validate metric ID before making API call
add 2d0249698b http: reject HEAD requests carrying Content-Length/Transfer-Encoding
add 72044a076e Throttle @ header strip logs
add 7eebdc632d tsmemcache: bind to loopback by default and add configurable bind address
add 371bb9758f Regex: optionally require whole-subject matches for policy rules
add 1281b23f6c Strip unauthorized x-amz- request headers in origin_server_auth
add 446c433252 CVE-2025-55702 - Fix request with POST Expect: 100-continue
add a60d471243 Require a matching client certificate for outbound session reuse
add fb76f3f306 magick: require signing key and allowlist convert operators
add 0d01de4b58 origin_server_auth: clarify x-amz- stripping scope in docs and comments
add 06c8fbf645 proxy: reject resumed TLS sessions missing a required client cert
add 8af205c680 Fix mTLS for TLS resumption scenarios
add 96ec193869 Drop the special case for badly formed 302 responses
add e30a9be72b doc: correct the regex matching contract where sites enforce full match
add 86787028a7 Size chunked passthrough writes without dropped trailers
add 21a9c86fce chunked_encoding: add regression test for chunked responses with trailers
add a4b43405a0 Reuse an origin connection only after its request body is written
add 632c20d494 doc: record the security release in the release notes
add 6376e9eb63 Count the Pad Length field in the h2 DATA padding check
add 9cb900dcb3 Fix a SIGSEGV in UnixNetVConnection::net_write_io on dechunked POST responses
No new revisions were added by this update.
Summary of changes:
.../configuration/regex-best-practices.en.rst | 167 ++++++-
doc/admin-guide/files/records.yaml.en.rst | 82 +++-
doc/admin-guide/files/remap.config.en.rst | 15 +-
doc/admin-guide/files/sni.yaml.en.rst | 13 +
.../monitoring/statistics/core/ssl.en.rst | 14 +
doc/admin-guide/plugins/geoip_acl.en.rst | 8 +-
doc/admin-guide/plugins/maxmind_acl.en.rst | 4 +-
doc/admin-guide/plugins/memcache.en.rst | 42 ++
doc/admin-guide/plugins/origin_server_auth.en.rst | 15 +-
doc/admin-guide/security/mtls.en.rst | 66 ++-
.../api/functions/TSHttpOverridableConfig.en.rst | 1 +
doc/developer-guide/api/functions/TSStat.en.rst | 6 +
.../api/types/TSOverridableConfigKey.en.rst | 1 +
doc/release-notes/upgrading.en.rst | 215 +++++++++
doc/release-notes/whats-new.en.rst | 38 ++
include/iocore/net/TLSBasicSupport.h | 41 +-
include/proxy/http/HttpConfig.h | 2 +
include/proxy/http/HttpSM.h | 13 +
include/proxy/http/HttpTransact.h | 1 +
include/proxy/http/OverridableConfigDefs.h | 3 +-
include/proxy/http2/Http2Stream.h | 16 +-
include/ts/apidefs.h.in | 1 +
include/ts/ts.h | 7 +
include/tsutil/Regex.h | 78 +++-
plugins/experimental/access_control/pattern.cc | 2 +-
plugins/experimental/geoip_acl/acl.cc | 2 +-
plugins/experimental/magick/CMakeLists.txt | 6 +-
plugins/experimental/magick/README | 90 +++-
plugins/experimental/magick/magick.cc | 275 +++++++++---
plugins/experimental/magick/magick_args.cc | 307 +++++++++++++
plugins/experimental/magick/magick_args.h | 43 ++
.../unit_tests}/CMakeLists.txt | 8 +-
.../magick/unit_tests/test_magick_args.cc | 239 ++++++++++
plugins/experimental/maxmind_acl/mmdb.cc | 3 +-
plugins/experimental/memcache/README | 5 +
plugins/experimental/memcache/tsmemcache.cc | 53 ++-
plugins/experimental/memcache/tsmemcache.h | 3 +-
plugins/experimental/tls_bridge/tls_bridge.cc | 4 +-
plugins/experimental/url_sig/url_sig.cc | 2 +-
plugins/experimental/wasm/ats_context.cc | 9 +
plugins/experimental/wasm/wasm_main.cc | 1 +
plugins/origin_server_auth/aws_auth_v4.cc | 2 +-
plugins/origin_server_auth/aws_auth_v4.h | 10 +
plugins/origin_server_auth/origin_server_auth.cc | 58 +++
src/api/InkAPI.cc | 6 +
src/api/InkAPITest.cc | 5 +
src/iocore/net/P_SSLConfig.h | 13 +
src/iocore/net/P_SSLUtils.h | 13 +-
src/iocore/net/SSLConfig.cc | 6 +
src/iocore/net/SSLNetVConnection.cc | 36 ++
src/iocore/net/SSLStats.cc | 1 +
src/iocore/net/SSLStats.h | 1 +
src/iocore/net/SSLUtils.cc | 233 ++++++++++
src/iocore/net/TLSBasicSupport.cc | 28 ++
src/iocore/net/UnixNetVConnection.cc | 11 +
src/proxy/ControlMatcher.cc | 13 +-
src/proxy/http/HttpConfig.cc | 9 +-
src/proxy/http/HttpSM.cc | 114 +++--
src/proxy/http/HttpTransact.cc | 86 +++-
src/proxy/http/HttpTunnel.cc | 9 +-
src/proxy/http/remap/UrlMapping.cc | 2 +-
src/proxy/http/unit_tests/CMakeLists.txt | 1 +
src/proxy/http/unit_tests/test_HttpConfig.cc | 75 ++++
src/proxy/http/unit_tests/test_HttpTransact.cc | 4 +
src/proxy/http2/Http2ConnectionState.cc | 4 +-
src/records/RecordsConfig.cc | 17 +
src/traffic_server/traffic_server.cc | 13 +
src/tsutil/Regex.cc | 174 ++++++-
src/tsutil/unit_tests/test_Regex.cc | 499 +++++++++++++++++++++
.../at_headers/replay/at_headers.replay.yaml | 36 +-
...e.test.py => regex_anchor_cache_config.test.py} | 19 +-
.../regex_anchor_cache_config_off.replay.yaml | 108 +++++
.../regex_anchor_cache_config_on.replay.yaml | 109 +++++
.../chunked_encoding/chunked_encoding.test.py | 49 ++
.../dechunk_post_half_close.test.py | 106 +++++
.../dechunk_post_half_close_client.py | 79 ++++
.../dechunk_post_half_close_origin.py | 108 +++++
...y.yaml => chunked_trailer_response.replay.yaml} | 46 +-
.../h2/clients/h2_content_length_client.py | 211 +++++++++
.../h2/http2_content_length_validation.test.py | 183 ++++++++
.../head-reject-content.test.py} | 14 +-
.../head/replay/head-reject-content.replay.yaml | 216 +++++++++
.../malformed_redirect.test.py} | 17 +-
.../headers/malformed_redirect_truncated.test.py | 171 +++++++
.../headers/malformed_redirect_truncated_server.py | 185 ++++++++
.../headers/replay/malformed_redirect.replay.yaml | 306 +++++++++++++
.../origin_server_auth/amz_strip.replay.yaml | 79 ++++
.../origin_server_auth/amz_strip.test.py} | 9 +-
...ncoding.test_input => v4-strip-test.test_input} | 5 +-
tests/gold_tests/post/early_response_client.py | 224 +++++++++
tests/gold_tests/post/early_response_origin.py | 203 +++++++++
tests/gold_tests/post/expect_client.py | 114 ++++-
.../post/post-early-response-100-continue.test.py | 183 ++++++++
.../post/post-expect-body-framing.test.py | 86 ++++
.../regex_anchor_policy.test.py} | 11 +-
.../replay/regex_anchor_policy_off.replay.yaml | 149 ++++++
.../replay/regex_anchor_policy_on.replay.yaml | 186 ++++++++
.../gold/{200.gold => 200_two.gold} | 6 -
.../session_sharing_client_cert.test.py | 164 +++++++
.../tls/ssl/gen_intermediate_ca_certs.sh | 55 +++
tests/gold_tests/tls/ssl/intca-root.key | 28 ++
tests/gold_tests/tls/ssl/intca-root.pem | 18 +
tests/gold_tests/tls/ssl/intca-sub.key | 28 ++
tests/gold_tests/tls/ssl/intca-sub.pem | 19 +
tests/gold_tests/tls/ssl/intclient.key | 28 ++
tests/gold_tests/tls/ssl/intclient.pem | 19 +
.../tls/tls_resume_ca_bundle_reload.test.py | 222 +++++++++
tests/gold_tests/tls/tls_resume_cross_sni.test.py | 189 ++++++++
.../tls/tls_resume_intermediate_ca.test.py | 265 +++++++++++
.../gold_tests/tls/tls_resume_verify_level.test.py | 169 +++++++
.../tls/tls_ticket_verify_client_ca_scope.test.py | 205 +++++++++
.../tls/tls_ticket_verify_client_scope.test.py | 192 ++++++++
tests/serial_tests.txt | 4 +
113 files changed, 7912 insertions(+), 255 deletions(-)
create mode 100644 plugins/experimental/magick/magick_args.cc
create mode 100644 plugins/experimental/magick/magick_args.h
copy plugins/experimental/{cert_reporting_tool => magick/unit_tests}/CMakeLists.txt (72%)
create mode 100644 plugins/experimental/magick/unit_tests/test_magick_args.cc
create mode 100644 src/proxy/http/unit_tests/test_HttpConfig.cc
copy tests/gold_tests/cache/{cache-read-retry-mode.test.py => regex_anchor_cache_config.test.py} (55%)
create mode 100644 tests/gold_tests/cache/replay/regex_anchor_cache_config_off.replay.yaml
create mode 100644 tests/gold_tests/cache/replay/regex_anchor_cache_config_on.replay.yaml
create mode 100644 tests/gold_tests/chunked_encoding/dechunk_post_half_close.test.py
create mode 100644 tests/gold_tests/chunked_encoding/dechunk_post_half_close_client.py
create mode 100644 tests/gold_tests/chunked_encoding/dechunk_post_half_close_origin.py
copy tests/gold_tests/chunked_encoding/replays/{chunked.replay.yaml => chunked_trailer_response.replay.yaml} (54%)
create mode 100644 tests/gold_tests/h2/clients/h2_content_length_client.py
create mode 100644 tests/gold_tests/h2/http2_content_length_validation.test.py
copy tests/gold_tests/{headers/normalized_ae_match_vary_cache.test.py => head/head-reject-content.test.py} (59%)
create mode 100644 tests/gold_tests/head/replay/head-reject-content.replay.yaml
copy tests/gold_tests/{cache/cache-heuristic-status.test.py => headers/malformed_redirect.test.py} (63%)
create mode 100644 tests/gold_tests/headers/malformed_redirect_truncated.test.py
create mode 100644 tests/gold_tests/headers/malformed_redirect_truncated_server.py
create mode 100644 tests/gold_tests/headers/replay/malformed_redirect.replay.yaml
create mode 100644 tests/gold_tests/pluginTest/origin_server_auth/amz_strip.replay.yaml
copy tests/gold_tests/{cache/conditional-get-hit.test.py => pluginTest/origin_server_auth/amz_strip.test.py} (72%)
copy tests/gold_tests/pluginTest/origin_server_auth/rules/{s3_url_encoding.test_input => v4-strip-test.test_input} (83%)
create mode 100644 tests/gold_tests/post/early_response_client.py
create mode 100644 tests/gold_tests/post/early_response_origin.py
create mode 100644 tests/gold_tests/post/post-early-response-100-continue.test.py
create mode 100644 tests/gold_tests/post/post-expect-body-framing.test.py
copy tests/gold_tests/{headers/invalid_range_header.test.py => remap/regex_anchor_policy.test.py} (71%)
create mode 100644 tests/gold_tests/remap/replay/regex_anchor_policy_off.replay.yaml
create mode 100644 tests/gold_tests/remap/replay/regex_anchor_policy_on.replay.yaml
copy tests/gold_tests/session_sharing/gold/{200.gold => 200_two.gold} (67%)
create mode 100644 tests/gold_tests/session_sharing/session_sharing_client_cert.test.py
create mode 100755 tests/gold_tests/tls/ssl/gen_intermediate_ca_certs.sh
create mode 100644 tests/gold_tests/tls/ssl/intca-root.key
create mode 100644 tests/gold_tests/tls/ssl/intca-root.pem
create mode 100644 tests/gold_tests/tls/ssl/intca-sub.key
create mode 100644 tests/gold_tests/tls/ssl/intca-sub.pem
create mode 100644 tests/gold_tests/tls/ssl/intclient.key
create mode 100644 tests/gold_tests/tls/ssl/intclient.pem
create mode 100644 tests/gold_tests/tls/tls_resume_ca_bundle_reload.test.py
create mode 100644 tests/gold_tests/tls/tls_resume_cross_sni.test.py
create mode 100644 tests/gold_tests/tls/tls_resume_intermediate_ca.test.py
create mode 100644 tests/gold_tests/tls/tls_resume_verify_level.test.py
create mode 100644 tests/gold_tests/tls/tls_ticket_verify_client_ca_scope.test.py
create mode 100644 tests/gold_tests/tls/tls_ticket_verify_client_scope.test.py