You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "cmcfarlen (via GitHub)" <gi...@apache.org> on 2026/10/01 21:45:07 UTC
[PR] Cherry-pick #13725 for 10.2.1: JA4 signature algorithms [trafficserver]
cmcfarlen opened a new pull request, #13781:
URL: https://github.com/apache/trafficserver/pull/13781
Final cherry-pick for the 10.2.1 release: **#13725** (`738cd651`), *Include signature
algorithms in JA4 fingerprints*, from the `For v10.2.1` column of the
[ATS v10.2.x project](https://github.com/orgs/apache/projects/573).
This one was held back from the 2026-10-01 batch (#13775) while its `Incompatible` label was
discussed. The label has since been removed, so it lands now, timed with the rest of 10.2.1.
### Operator impact — please note in the release notes
This changes the `c` section of nearly every JA4 fingerprint these plugins emit, bringing it
in line with the [JA4 spec](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md)
and with FoxIO's reference implementations. Stored fingerprints, and any abuse_shield rules or
allow/deny lists built from ATS-generated JA4 values, need to be regenerated.
### Out-of-order pick, verified by composition
On master the JA4 changes merged #13725 → #13728 → #13719, but #13728 and #13719 already
landed on 10.2.x in #13775, so this pick applies the *earliest* of the three onto a branch that
already has the later two. It applied with no conflicts, and rather than trust that, the result
was checked by composition: every file the three PRs touch was compared against master at
`a2416f28` (the state right after all three), and only those three commits touch these files in
that range.
9 of 11 files are now **identical to master**. The two that differ are pre-existing 10.2.x
drift, unrelated to JA4 and confirmed present before this pick:
- `ja4_fingerprint/plugin.cc` — master's `JA4_data` struct comes from #13013 (ASAN plugin
fixes), not on this branch, so 10.2.x keeps the older `std::string *` user-arg form. #13725's
additions compile against it unchanged.
- `jax_fingerprint/ja4/tls_client_hello_summary.cc` — the local `DbgCtl` and include reshuffle
come from #13586 (abuse_shield plugin), not on this branch.
### AuTest harness adaptation
The new `jax_fingerprint_sigalgs.test.py` used master's `ts.Disk.ssl_multicert_yaml`; converted
to 10.2.x's flat `ssl_multicert_config` form and folded into the commit via `--fixup` +
`--autosquash`. The test self-guards with `Condition.PluginExists('jax_fingerprint.so')`, and
the branch's jax plugin already accepts the `--standalone` / `--method` / `--log-filename`
options it passes. The doc hunk is plain prose and adds no cross-reference targets.
### Local verification (macOS, `dev` preset, JA4/JAX enabled)
- `cmake --build build-dev -- -k 0` — clean.
- `ctest -j4` — 128/129; only `test_jsonrpcserver` fails, the known macOS-local
unix-socket/restart timing flake.
- `test_ja4` and `test_jax` pass, including the spec's worked example now asserting the
published `t13d1516h2_8daaf6152771_e5627efa2ab1`.
- The new AuTest is not run by this preset on macOS — this CI run is its gate.
Draft on purpose: to be landed by fast-forward once CI is green, not merged via the UI.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cherry-pick #13725 for 10.2.1: JA4 signature algorithms [trafficserver]
Posted by "cmcfarlen (via GitHub)" <gi...@apache.org>.
cmcfarlen merged PR #13781:
URL: https://github.com/apache/trafficserver/pull/13781
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org