Cherry-picks for 10.2.0 RC, round 2 (2026-08-06) - #13507
Merged
Merged
Conversation
Same gap caf9c87 fixed in tls_async_handshake.test.py: SkipUnless only registers conditions for later, it doesn't stop the script from running, so PrepareTestPlugin still ran at load time and raised a ValueError on non-OpenSSL builds where async_handshake.so is never built. tls_engine_abort.test.py was added afterward from the same template but didn't carry the guard over. Guard the call on file existence so it skips cleanly. (cherry picked from commit f00122e)
A parent that accepts connections but never sends a response was marked down and then restored to the pool by the very next retry probe, even when that probe also failed, so it kept receiving traffic indefinitely while healthy peers took none of the load. handle_response_from_parent() called markParentUp() on entry, before the switch on current.state, so a parent selected as a retry candidate was restored before ATS knew the retry's outcome. markParentUp() zeroes failedAt and failCount; the markParentDown() that follows a failed probe then takes its result->retry branch, which leaves new_fail_count at 0, so available is never re-cleared. The parent therefore returned to the pool with a cleared failure count after every retry_time window, no matter how long it stayed degraded. The CONNECTION_ALIVE branch already calls markParentUp() for a retry that actually succeeded, which is the correct restore point. Removing the entry call restores the behavior that predates apache#8546: that commit backed out the retry-limiting work and replaced a retryComplete() call -- which only decremented an in-flight retry counter and never touched availability -- with markParentUp(), silently turning "the retry finished" into "the parent is healthy". Two autests pin both outcomes of the retry path. A parent that is still silent when probed stays down; a parent that has recovered is restored. Each was negative-controlled against its own call site: reverting this change fails the first, and removing the CONNECTION_ALIVE call fails only the second. (cherry picked from commit 698cb9f)
The function has a `bool` return type, but returned `-1` to indicate an error on UTF-8 conversion failure. This patch corrects the return statement to return `false`. (cherry picked from commit d70bdb7)
* Resolve OpenSSL 4.0 build issues - accessors for ASN1_STRING and const-iness * Ran clang-format to fix formatting * Fix X509_NAME_get_index_by_NID const mismatch on OpenSSL 1.1.1 OpenSSL 1.1.1 declares the first argument as non-const while newer releases declare it const, so building against different versions failed depending on which signature was in effect. Add a const_cast at each call site to keep the const-qualified variables introduced by this PR buildable against both, matching the existing precedent in OCSPStapling.cc. * Drop const_cast in favor of auto for local X509_NAME variables X509_get_subject_name and X509_NAME_get_index_by_NID have their argument constness changed together across OpenSSL versions, so a local variable declared with auto tracks whatever type is correct for the OpenSSL version in use, without a cast. This applies only to the two purely local variables; ts_util.cc ssl_value_for keeps its const_cast since its parameter type is shared across multiple callers. * Fix const-cast style and X509_NAME leak flagged by Copilot review X509HostnameValidator.cc cast ASN1_STRING_get0_data return value to non-const before an ats_strndup call that only wants const char *; drop the const instead of adding it back needlessly. certifier.cc leaked the duplicated X509_NAME on the X509_NAME_add_entry_by_txt failure path, and never checked X509_NAME_dup for allocation failure. * Make Cripts X509 accessors OpenSSL-4-compatible CertBase::X509Value took hardcoded function pointer types for X509_get_subject_name, X509_get_issuer_name, X509_getm_notBefore, and X509_getm_notAfter, but those accessors change constness in different directions across OpenSSL versions, so no single hardcoded signature builds everywhere. Deduce the parameter type from the actual accessor via decltype instead. Signature::_load and _write_ip_address also read ASN1_STRING fields directly, which breaks once the struct is opaque; switch to the accessor functions used elsewhere in this codebase. * Fix lua plugin X509_NAME/ASN1_STRING OpenSSL 4 compatibility get_x509_name_string only reads through the name via X509_NAME_print_ex, so accept a const X509_NAME * to match callers that pass X509_get_subject_name/X509_get_issuer_name results directly. get_x509_signature_string read the ASN1_STRING struct fields directly, which breaks once the struct is opaque; use ASN1_STRING_get0_data/ASN1_STRING_length instead. * Fix self-signed test cert losing its CN under OpenSSL 4 make_cert_and_key mutated the X509_NAME returned by X509_get_subject_name in place, which stops compiling once that accessor can return const, and was already fragile since the returned name is only a view into the certificate internal state. Duplicate it, add the CN to the duplicate, and set it back as both subject and issuer name since this is a self-signed certificate. * Fix OpenSSL 4 X509_NAME const mismatches in example plugin and test tool client_context_dump.cc, verify_cert.cc, and ssl_client_verify_test.cc all held X509_get_subject_name/X509_NAME_get_entry/ X509_NAME_ENTRY_get_data results in hardcoded non-const locals or parameters, which stops compiling once those accessors return const. Switch to auto for the local variables and const for the debug_certificate parameter, matching the read-only usage in each case. * Drop last const_cast in txn_box ssl_value_for via a template ssl_value_for is shared by four callers, each already deducing its X509_NAME pointer type with auto from X509_get_subject_name or X509_get_issuer_name, so unlike the other three call sites fixed earlier in this series, a single hardcoded parameter type cannot track the underlying accessor across OpenSSL versions. Templating the parameter on the callers deduced type removes the cast entirely. * Alias the Cripts X509 getter decltypes for readability Bare decltype(&X509_get_subject_name) in a parameter list reads poorly at each of the four call sites; name each getter type once via using so the declarations and out-of-line definitions just say what kind of accessor they take. * Adopt RAII and decltype(func(nullptr)) patterns from PR apache#13482 certifier.cc freed the duplicated X509_NAME manually on every path; switch to a scoped_X509_NAME unique_ptr matching the file existing scoped_X509/scoped_EVP_PKEY/scoped_SSL_CTX aliases so no path can forget to free it. ts_util.cc templated ssl_value_for just to defer the parameter type to the caller; decltype(X509_get_subject_name(nullptr)) deduces the same pointer type directly without turning it into a template. Also drop the last C-style cast this series introduced in X509HostnameValidator.cc in favor of reinterpret_cast. --------- Co-authored-by: Jered Floyd <jered@redhat.com> (cherry picked from commit bdefaf9)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.50.0 to 0.52.0. - [Commits](golang/crypto@v0.50.0...v0.52.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit c340299)
…#13497) Requiring GIT_COMMON_DIR made configure fatal in trees where git cannot resolve a common directory, such as a source export without .git or a worktree mapped into a container without the paths its .git file points at. Nothing about proxy-verifier needs that directory specifically; it is only a convenient cache shared across worktrees of one clone. Introduce PV_DEST_DIR, set from GIT_COMMON_DIR when available and the build directory otherwise, and use it for the download and extraction. (cherry picked from commit b8440f0)
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.54.0 to 0.55.0. - [Commits](golang/net@v0.54.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 190a07c)
Two AuTests can fail depending on process scheduling and response framing. The HTTP/2 chunked clients can reach their origins before the listeners are ready, while the capped stale-response fetch can stop at a body-block boundary and time out instead of exercising its memory fallback. This patch uses a deterministic raw origin that ignores readiness probes, serves one real request, and exits. It also sizes and documents the stale-response header at the cap-plus-sentinel read boundary so memory-limit rejection is independent of body segmentation. (cherry picked from commit 80452f0)
A run-plugin whose target plugin failed to load left a null instance that tripped a release assert and aborted the server on the first request. Propagate the load failure as an exception so the rule is rejected at config load time (a reload simply keeps the running config), and guard exec() so a stray bad rule can never abort the process. Co-authored-by: Leif Hedstrom <zwoop@apache.org> (cherry picked from commit 14bcf29)
OCSP stapling serializes TLS handshake readers with refresh scans on a per-certificate mutex. Busy certificates therefore pay unnecessary lock contention on the handshake hot path. This patch uses the annotated Bravo reader-writer lock so handshake and refresh readers can proceed concurrently while cache updates remain exclusive. It keeps prefetched state immutable and allocates the OpenSSL destination outside the shared lock. The cached response is copied once after its size is revalidated. Co-authored-by: Craig Taylor <cmtaylor@apple.com> (cherry picked from commit 14ce04d)
Contributor
Author
|
[approve ci autest 3] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second round of cherry-picks for the 10.2.0 release candidate, covering the PRs at "For v10.2.0" in the ATS v10.2.x project.
All picked with
git cherry-pick -xin master merge order. Every pick applied cleanly with no conflicts, and each commit's diffstat matches its master commit exactly.validate_hostnameMerge order was preserved deliberately, since three file overlaps make it load-bearing:
src/iocore/net/OCSPStapling.cc— Resolve OpenSSL 4.0 build issues #13476 before ocsp: use Bravo lock for cached responses #13490, as the Bravo change was written against post-Resolve OpenSSL 4.0 build issues #13476 master.src/tscore/X509HostnameValidator.cc— Fix bad return invalidate_hostname#13498 before Resolve OpenSSL 4.0 build issues #13476.tests/gold_tests/qmux/go_qmux_client/go.{mod,sum}— build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /tests/gold_tests/qmux/go_qmux_client #13479 before build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in /tests/gold_tests/qmux/go_qmux_client #13500.Prerequisites verified present on the branch:
Test.AddConfigReload(), available via 10.2.x: AddTest.AddConfigReload()autest extension (#13075) #13502.include/tsutil/Bravo.h, already on 10.2.x.Also checked that no picked test reaches for a master-only autest API: the
Disk.*attributes used are all present on this branch, notably the flatssl_multicert_configrather than master'sssl_multicert_yaml, and all 11proxy.config.*records referenced by the new tests exist inRecordsConfig.cc.Local build is clean and
ctestpasses 164/165; the one failure is the known macOS-localtest_jsonrpcserverunix-socket/restart timing flake, not a regression.cmake --build ... --target formatmakes no changes.Draft so the full CI matrix runs against the picked set before the release branch moves; it will be landed by fast-forward.