This is an automated email from the ASF dual-hosted git repository.
ezelkow1 pushed a change to branch 9.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
from 43c315c5d5 doc: fix Via decoder ring URL (/tools/via moved to
/via.html) (#13401)
new 2ac82304fb Fix SNI/hostname comparison to check full string length
(#146) Fix SNI/hostname comparison to check full string length
new 0fcc4074f7 Fix out-of-bounds write in MIME obs-fold handling
new a9ec41a359 Fix integer overflow in MIME header parsing
new bb575354f9 Reject oversized HPACK indexes
new a1370ca8c4 Replace VLA with heap allocation in cachekey appendEncoded
new e64eebf499 regex_remap: Overflow in url_len Leads to Stack Overflow
new 084de10a75 Fix inverted condition for nonstandard method matching in
ACL filtering
new fd60f1aa14 Limit CONNECT body preclusion to successful responses
new c90888db09 Enforce per-field size limit in HPACK/QPACK string decoding
new bdb8fcd7a4 tls_sni_host_policy.test.py: Fix MakeCurlCommand reference
new f401013e5e Enforce 16-bit hostdbinfo srv_offset invariant
new 71f0d0ea4b 9.2.x: Reject oversized HPACK indexes
new 7285a051e5 CVE-2026-33930: 9.2.x: Bound host header buffer (#143)
new f8ced87608 [9.2.x] Bound status code parsing to prevent integer
overflow
new 3995c7e2ff [9.2.x] Combo handler: Reject empty Content-Type when
allowlist is configured
new 152ac35cd1 URL: reject parsed ports outside uint16 range
new 437b52e0d0 ESI: cap HTTP request length to prevent size_t overflow
new f0ed03c6d6 Invoke Continuation operator bool, not pointer-to-bool
new ff303360b4 Fix an integer overflow in HdrHeap
new 8a0a972bf9 lua: Add checks on server request hdr
new d5b9bfac33 ESI: bound for nested esi html comment
new 659764e79a header_rewrite: Fix cookie key over-read
new 01a78fe4a2 Fix length check of MethodMod::check
new 7c8504c3d1 Avoid UB when URL scheme is absent in scheme_get
new 436e38e473 Add bounds checks to DNS answer parsing before NS_GET macros
new cb995ff140 compress: stop gzip transform after deflate() error
new 6e052c354e Fix leaks of POST failures
new 0908f5ed5a Add admin-guide reference for writing secure regex rules
new ac9a72e0b2 Reject Transfer-Encoding where chunked is not the final
coding
new ac3cd038b1 access_control: cap stack buffer for cookie base64 decode
new 4443cc89fa tscpp: hold intercept try-lock guard via shared mutex
new e18c6ccccb Reject overflowing XPACK integers
new 7ed60ef10e Avoid signed tolower for name bytes
new 801a48df9e Guard outbound server_name SNI policy
new 39d9ac4ae9 Reject oversized multiplexer chunks
new 2bf8060724 Keep OCSP map on init failure
new 4e35bfbd26 Set default value of
proxy.config.http2.default_buffer_water_mark to 32KB
new bd4e801a10 Fix FetchSM header block copying
new 05e888d18e SSLSNIConfig: fix SNI partial-match policy bypass
new 6d5d6fb866 Use ParseRules::is_digit on raw network bytes in HTTP parser
new 368525a8ae xdebug: Cap X-Remap header length to actual buffer content
new 720d7acbe5 HTTPHdr: fix use-after-free in destroy() leaving dangling
m_http (#222)
new 3fe625582a DNS: fix TCP length-prefix read under edge-triggered epoll
(#263)
new 5983412dab [9.2.x] Server Session: Make sure read_buffer is empty
before pooling a server session (#173) (#325)
new 97e238fc0e [9.2.x] CVE-2021-32564: Fix ChunkHandler Flow Control (#324)
new 488e001f59 Handle addressless PROXY headers (#334)
new d5b69430a8 Gate H2 reads during async hooks (#333)
new f5a8878921 Validate PROXY v1 port bounds (#332)
new f3358844f1 Constrain prefetch relative paths (#335)
new f30b19bf41 Verify H2 origin certs on session reuse (#336)
new a9aee837db CVE-2026-33267: 9.2.x: Strip external @ headers before
plugin hooks (#138)
new 84de3de427 HttpTunnel: Guard get_producer(VIO*) against dead producers
new 582f8018b4 ts_lua: clear rri pointer in http_ctx after remap returns
new eae8ce73c3 ts_lua: use sockaddr_storage for ts_lua_fetch client address
new 4423c26a6d slice: Check for Integer underflow in firstblockbytes
new f34d0d437d http2: Reject CONTINUATION accumulation that overflows
header_blocks_length
new 51c38ec4b8 header_rewrite: Fix IPv6 CIDR masking for non-aligned
prefixes
new c05c852591 cache_range_requests: use std::string spill buffer for
building override cachekey
new 2eab8d09e9 SSLNetVConnection: deregister async handshake eventfd on
connection teardown
new 7a3b8b96b1 certifier: Reject unsafe SNI names
new 487cd4507d PendingAction: Don't let CAS failure overwrite the caller's
action
new 1d4fcb4c60 compress: Wrap isspace so obs-text Content-Type bytes don't
trigger UB
new 409bcb6c0f doc: cover uri_signing cdniuc uri-regex in regex best
practices
new 50cf2dc56b Fix race in remap table refcount during reload
new d3a4992ad1 Guard remap against shutdown table teardown
new e44213f8ec http: reject chunked extension quoted-string values
containing CR or LF
new 9d13175862 Strip Connection-listed headers per RFC 9110 ยง7.6.1
new 8a7a963a29 Reject header fields exceeding the uint16 field-length limit
new 63c2147a04 http: reject a bare LF chunked trailer terminator under
strict parsing
new 63b3a11f0b Combo handler: Refactor Cache-Control parsing and update
gold test
new b0dd41ca68 uri_signing: replace stack arrays with heap buffers
new 33605d256b ESI: validate esi:include URLs to mitigate SSRF esi:include
src URLs were fetched without validation, allowing an attacker who can
influence include targets to drive requests at internal hosts (SSRF). Add
IncludeUrlValidator: scheme check, a private/loopback/ link-local/CGNAT/NAT64
host denylist (with non-canonical numeric IPv4 evasion rejection), and an
optional operator-supplied host allowlist. The post-expansion URL is validated
before fetch in EsiProcessor, and a V [...]
new 6f3e9bf244 DNS: Run HostEnt destructor on free to release SRV vector
heap
new a1dc27ae52 lua: Invalidate cached main_ctx when slot is outside
instance's range
new f463b26971 Honor number_of_redirections for plugin-initiated redirects
new f868c31b81 rate_limit: Fix ip-rep UB writes
new 7065e67cd1 ja3_fingerprint: bound client-hello extension parsing
new 788cfda329 rate_limit: Fix active counter underflow
new 3d0e0886c8 Guard parent mark-down on UNAVAILABLE_SERVER retry
new 152b9be86b ParentSelection: size mapWrapped array to MAX_GROUP_RINGS
new 54ae18f819 parent_selection: Cap retries to one per window via
failedAt CAS
new 55e60de989 Keep loop detection on outbound-transparent ports
new 5ea5752ae6 Prevent unbounded recursion in host-down Range fallback
new 76ed38d517 Avoid stack VLA in log filter wiping
new 76b1a1bdb1 http2: Defer HPACK dynamic-table updates until encoding
succeeds
new c3b0b98955 Cancel stale TLS accept timeouts across the session handoff
new 4abdb2ef6c webp_transform: bound buffered body and ImageMagick decode
new 4b5c25caf9 tls_accept_timeout_hook_defer: use sequence protocol format
in replay
new 12cbe1bf7c ip_allow: deny CONNECT to private destinations by default
(9.2.x)
new 5a6f254c92 Fix chunked passthrough flow-control deadlock
(drop_chunked_trailers=0)
new d4b4973586 http: drain request body on internally generated cache
responses (9.2.x)
new 506b14c49f Fix FreeBSD build, clang-analyzer, and autest CI failures
for 9.2.x
The 92 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
configs/ip_allow.yaml.default | 28 +-
doc/admin-guide/configuration/index.en.rst | 1 +
.../configuration/regex-best-practices.en.rst | 423 ++++
doc/admin-guide/files/cache.config.en.rst | 12 +-
doc/admin-guide/files/ip_allow.yaml.en.rst | 64 +-
doc/admin-guide/files/parent.config.en.rst | 8 +-
doc/admin-guide/files/records.config.en.rst | 18 +-
doc/admin-guide/files/remap.config.en.rst | 14 +
doc/admin-guide/files/sni.yaml.en.rst | 12 +
doc/admin-guide/files/splitdns.config.en.rst | 9 +-
doc/admin-guide/layer-4-routing.en.rst | 9 +
doc/admin-guide/plugins/esi.en.rst | 35 +
doc/admin-guide/plugins/geoip_acl.en.rst | 7 +
doc/admin-guide/plugins/maxmind_acl.en.rst | 9 +-
doc/admin-guide/plugins/uri_signing.en.rst | 23 +-
doc/admin-guide/plugins/url_sig.en.rst | 8 +
doc/admin-guide/plugins/webp_transform.en.rst | 45 +-
.../api/functions/TSMimeHdrFieldCreate.en.rst | 6 +
.../api/functions/TSMimeHdrFieldNameSet.en.rst | 11 +
.../functions/TSMimeHdrFieldValueStringSet.en.rst | 4 +
.../plugins/http-headers/mime-headers.en.rst | 20 +
include/tscore/PendingAction.h | 8 +-
include/tscore/Regex.h | 13 +
include/tscore/X509HostnameValidator.h | 5 +-
include/tscpp/util/AtomicSharedPtr.h | 84 +
include/tscpp/util/Makefile.am | 1 +
iocore/dns/DNS.cc | 53 +-
iocore/dns/P_DNSConnection.h | 10 +-
iocore/hostdb/HostDB.cc | 4 +-
iocore/net/I_NetVConnection.h | 8 +-
iocore/net/OCSPStapling.cc | 57 +-
iocore/net/P_NetVConnection.h | 6 +-
iocore/net/P_SNIActionPerformer.h | 9 +-
iocore/net/P_SSLClientUtils.h | 4 +
iocore/net/P_SSLNetVConnection.h | 2 +
iocore/net/ProxyProtocol.cc | 40 +-
iocore/net/SSLCertLookup.cc | 5 +-
iocore/net/SSLClientUtils.cc | 57 +-
iocore/net/SSLNetVConnection.cc | 42 +-
iocore/net/SSLNextProtocolAccept.cc | 5 +
iocore/net/SSLSNIConfig.cc | 20 +-
iocore/net/SSLUtils.cc | 8 +-
iocore/net/unit_tests/test_ProxyProtocol.cc | 24 +
mgmt/RecordsConfig.cc | 6 +-
.../cache_range_requests/cache_range_requests.cc | 57 +-
plugins/cachekey/cachekey.cc | 10 +-
plugins/certifier/certifier.cc | 47 +-
plugins/compress/compress.cc | 3 +-
plugins/compress/configuration.cc | 18 +-
plugins/esi/Makefile.inc | 5 +-
plugins/esi/combo_handler.cc | 44 +-
plugins/esi/combo_handler_utils.cc | 141 ++
.../headers.h => esi/combo_handler_utils.h} | 25 +-
plugins/esi/esi.cc | 65 +-
plugins/esi/fetcher/HttpDataFetcherImpl.cc | 18 +-
plugins/esi/lib/EsiProcessor.cc | 112 +-
plugins/esi/lib/EsiProcessor.h | 10 +-
plugins/esi/lib/IncludeUrlValidator.cc | 441 ++++
plugins/esi/lib/IncludeUrlValidator.h | 85 +
plugins/experimental/access_control/plugin.cc | 22 +-
.../ja3_fingerprint/ja3_fingerprint.cc | 9 +-
plugins/experimental/rate_limit/ip_reputation.cc | 4 +-
plugins/experimental/rate_limit/sni_selector.cc | 5 +
plugins/experimental/slice/server.cc | 23 +-
plugins/experimental/uri_signing/normalize.c | 46 +-
.../uri_signing/unit_tests/uri_signing_test.cc | 45 +-
.../experimental/webp_transform/ImageTransform.cc | 309 ++-
plugins/header_rewrite/cidr.h | 68 +
plugins/header_rewrite/conditions.cc | 16 +-
plugins/header_rewrite/conditions.h | 2 +-
plugins/header_rewrite/header_rewrite_test.cc | 83 +-
plugins/header_rewrite/operators.cc | 18 +-
plugins/lua/ts_lua.c | 18 +-
plugins/lua/ts_lua_common.h | 1 +
plugins/lua/ts_lua_fetch.c | 15 +-
plugins/lua/ts_lua_server_request.c | 4 +
plugins/lua/ts_lua_util.c | 4 +-
plugins/multiplexer/chunk-decoder.cc | 79 +-
plugins/multiplexer/chunk-decoder.h | 12 +-
plugins/multiplexer/fetcher.h | 35 +-
plugins/prefetch/Makefile.inc | 6 +-
plugins/prefetch/fetch.cc | 25 +-
plugins/prefetch/fetch.h | 5 +-
plugins/prefetch/path.cc | 189 ++
plugins/prefetch/path.h | 63 +
plugins/prefetch/plugin.cc | 31 +-
plugins/prefetch/test/test_path.cc | 68 +
plugins/regex_remap/regex_remap.cc | 41 +-
plugins/xdebug/xdebug.cc | 9 +-
proxy/ControlBase.cc | 2 +-
proxy/ParentConsistentHash.cc | 10 +-
proxy/ParentRoundRobin.cc | 17 +-
proxy/ParentSelection.h | 11 +-
proxy/ProtocolProbeSessionAccept.cc | 4 +-
proxy/ProxySession.h | 7 +
proxy/ReverseProxy.cc | 78 +-
proxy/ReverseProxy.h | 9 +-
proxy/hdrs/HTTP.cc | 54 +-
proxy/hdrs/HTTP.h | 47 +-
proxy/hdrs/HdrHeap.cc | 14 +-
proxy/hdrs/MIME.cc | 269 ++-
proxy/hdrs/MIME.h | 32 +-
proxy/hdrs/URL.cc | 12 +-
proxy/hdrs/URL.h | 4 +
proxy/hdrs/XPACK.cc | 17 +-
proxy/hdrs/XPACK.h | 2 +-
proxy/hdrs/unit_tests/test_HdrHeap.cc | 41 +
proxy/hdrs/unit_tests/test_Hdrs.cc | 232 +-
proxy/hdrs/unit_tests/test_URL.cc | 106 +
proxy/hdrs/unit_tests/test_XPACK.cc | 93 +-
proxy/hdrs/unit_tests/test_mime.cc | 362 +++
proxy/http/Http1ClientSession.cc | 10 +
proxy/http/HttpConfig.cc | 20 +
proxy/http/HttpConfig.h | 3 +
proxy/http/HttpSM.cc | 78 +-
proxy/http/HttpSM.h | 8 +-
proxy/http/HttpSessionAccept.cc | 11 +-
proxy/http/HttpSessionManager.cc | 50 +-
proxy/http/HttpSessionManager.h | 5 +-
proxy/http/HttpTransact.cc | 180 +-
proxy/http/HttpTransact.h | 23 +-
proxy/http/HttpTransactHeaders.cc | 28 +
proxy/http/HttpTunnel.cc | 290 ++-
proxy/http/HttpTunnel.h | 30 +-
proxy/http/remap/NextHopConsistentHash.cc | 7 +-
proxy/http/remap/NextHopRoundRobin.cc | 19 +-
proxy/http/remap/RemapHitCount.cc | 11 +-
proxy/http/remap/RemapProcessor.cc | 16 +-
proxy/http/remap/UrlRewrite.cc | 7 +-
proxy/http/remap/UrlRewrite.h | 23 +-
proxy/http/unit_tests/test_HttpTransact.cc | 70 +
proxy/http2/HPACK.cc | 47 +-
proxy/http2/HPACK.h | 12 +-
proxy/http2/HTTP2.cc | 5 +-
proxy/http2/HTTP2.h | 15 +-
proxy/http2/Http2ClientSession.cc | 10 +-
proxy/http2/Http2ConnectionState.cc | 36 +-
proxy/http2/Http2ConnectionState.h | 1 +
proxy/http2/Http2SessionAccept.cc | 9 +-
proxy/http2/Http2Stream.cc | 51 +-
proxy/http2/Http2Stream.h | 3 +-
proxy/http2/test_HPACK.cc | 9 +-
proxy/http2/unit_tests/test_HTTP2.cc | 39 +
proxy/http2/unit_tests/test_HpackIndexingTable.cc | 263 ++-
proxy/http3/QPACK.cc | 20 +-
proxy/logging/LogFilter.h | 22 +-
src/traffic_cache_tool/CacheScan.cc | 8 +-
src/traffic_server/FetchSM.cc | 46 +-
src/traffic_server/InkAPI.cc | 30 +-
src/traffic_server/traffic_server.cc | 4 +
src/tscore/Regex.cc | 24 +-
src/tscore/X509HostnameValidator.cc | 17 +-
.../unit_tests/test_X509HostnameValidator.cc | 32 +-
src/tscpp/api/InterceptPlugin.cc | 21 +-
src/tscpp/api/TransformationPlugin.cc | 2 +-
tests/Makefile.am | 1 +
tests/gold_tests/at_headers/at_headers.test.py | 70 +
.../gold_tests/at_headers/plugins}/Makefile.inc | 7 +-
.../at_headers/plugins/at_header_probe.cc | 261 +++
.../at_headers/replay/at_headers.replay.yaml | 94 +
tests/gold_tests/autest-site/ats_replay.test.ext | 218 ++
.../{cli_tools.test.ext => curl.test.ext} | 38 +-
tests/gold_tests/autest-site/min_cfg/ip_allow.yaml | 20 +
.../gold_tests/autest-site/trafficserver.test.ext | 41 +
.../chunked_encoding/chunk_extension_client.py | 106 +
.../chunk_extension_quoted_string.test.py | 85 +
.../chunked_encoding/chunk_trailer_bare_lf.test.py | 86 +
.../chunked_encoding/chunk_trailer_client.py | 104 +
.../chunked_flow_control.test.py} | 14 +-
.../chunked_not_last.test.py} | 15 +-
.../chunk_extension_quoted_string.replay.yaml} | 46 +-
.../replays/chunk_trailer_bare_lf.replay.yaml} | 47 +-
.../replays/chunked_h1_flow_control.replay.yaml | 138 ++
.../replays/chunked_h2_flow_control.replay.yaml | 150 ++
.../replays/chunked_not_last.replay.yaml | 206 ++
.../chunked_passthru_flow_control.replay.yaml | 162 ++
tests/gold_tests/connect/connect.test.py | 1 +
.../connect/connect_parent_error_body.test.py | 65 +
.../replays/connect_parent_error_body.replay.yaml} | 72 +-
.../gold_tests/continuations/openclose_h2.test.py | 44 +-
.../gold_tests/h2/h2_origin_cert_reverify.test.py | 71 +
.../h2/http2_txn_start_read_gate.test.py | 57 +
.../replay/http2_txn_start_read_gate.replay.yaml} | 38 +-
.../replay_h2_origin_cert_reverify.yaml} | 53 +-
.../headers/clients/oversized_field_h2_client.py | 151 ++
.../gold_tests/headers/hopbyhop_connection.test.py | 14 +-
.../oversized_field.test.py} | 15 +-
.../gold_tests/headers/oversized_field_h2.test.py | 136 ++
.../headers/replay/oversized_field.replay.yaml | 99 +
.../replay/oversized_field_h2.replay.yaml} | 83 +-
.../replays/hopbyhop_connection.replay.yaml | 121 ++
.../ip_allow/connect_destination_acl.test.py | 167 ++
tests/gold_tests/logging/sigusr2.test.py | 292 +--
.../logging/sigusr2_rotate_custom_log.sh | 100 +
tests/gold_tests/logging/sigusr2_rotate_diags.sh | 85 +
.../next_hop/strategies_ch5/strategies_ch5.test.py | 153 ++
.../gold_tests/next_hop/strategies_ch5/trace.gold | 192 ++
.../parent_retry_non_retryable_post.test.py} | 19 +-
.../parent_retry_non_retryable_post.replay.yaml | 90 +
.../cache_range_requests.test.py | 36 +
.../pluginTest/combo_handler/combo_handler.test.py | 53 +-
.../{tr2.gold => cache_control_aggregation.gold} | 7 +-
.../{tr2.gold => max_age_zero.gold} | 7 +-
.../combo_handler_files/{tr1.gold => tr3.gold} | 0
.../esi_nested_html_comment.replay.yaml} | 39 +-
.../pluginTest/esi/esi_nested_html_comment.test.py | 156 ++
.../esi_nested_html_comment_reject.replay.yaml} | 40 +-
.../pluginTest/esi/esi_request_size_cap.test.py | 91 +
.../pluginTest/esi/esi_ssrf_validate.replay.yaml | 164 ++
.../pluginTest/esi/esi_ssrf_validate.test.py | 111 +
.../header_rewrite_bundle.replay.yaml | 2296 ++++++++++++++++++++
.../rules/{rule_l_value.conf => rule_cidr.conf} | 10 +-
.../header_rewrite/rules/rule_cookie.conf | 68 +
.../pluginTest/lua/fetch_ipv6_cliaddr.lua | 37 +-
.../pluginTest/lua/lua_fetch_ipv6_cliaddr.test.py | 59 +
.../pluginTest/lua/lua_remap_after_hook.test.py | 55 +
.../gold_tests/pluginTest/lua/remap_after_hook.lua | 23 +-
.../pluginTest/multiplexer/multiplexer.test.py | 82 +
... => multiplexer_invalid_chunk_copy.replay.yaml} | 21 +-
...multiplexer_invalid_chunk_original.replay.yaml} | 21 +-
.../prefetch_query_path_traversal.replay.yaml | 130 ++
.../prefetch_query_path_traversal.test.py | 13 +-
.../redirect_limit/redirect_limit.test.py | 134 ++
tests/gold_tests/pluginTest/slice/shrink_origin.py | 134 ++
.../pluginTest/slice/slice_content_shrink.test.py | 94 +
.../pluginTest/traffic_dump/traffic_dump.test.py | 1 +
.../replay/webp_chunked_cap.replay.yaml} | 30 +-
.../webp_transform_cache_refused.test.py | 90 +
.../webp_transform_chunked_cap.test.py | 74 +
.../webp_transform_decode_limit.test.py | 95 +
.../webp_transform_max_buffer_size.test.py | 108 +
.../webp_transform/webp_transform_size_cap.test.py | 115 +
.../x_remap_long_url/x_remap_long_url.replay.yaml | 63 +
.../x_remap_long_url/x_remap_long_url.test.py} | 21 +-
tests/gold_tests/thread_config/check_threads.py | 209 +-
.../gold_tests/thread_config/thread_config.test.py | 1 +
tests/gold_tests/timeout/ssl-delay-server.cc | 13 +-
.../tls/proxy_protocol_addressless.test.py | 81 +
tests/gold_tests/tls/proxy_protocol_client.py | 158 ++
.../outbound_sni_server_name_plain.replay.yaml | 83 +
.../tls_accept_timeout_hook_defer.replay.yaml} | 38 +-
.../tls/tls_accept_timeout_hook_defer.test.py | 73 +
tests/gold_tests/tls/tls_engine_abort.py | 64 +
...tls_engine.test.py => tls_engine_abort.test.py} | 58 +-
tests/gold_tests/tls/tls_forward_nonhttp.test.py | 1 +
.../tls/tls_outbound_sni_server_name_plain.test.py | 25 +
.../tls/tls_partial_blind_tunnel.test.py | 1 +
tests/gold_tests/tls/tls_sni_host_policy.test.py | 56 +
tests/gold_tests/tls/tls_tunnel.test.py | 1 +
tests/gold_tests/tls/tls_tunnel_forward.test.py | 1 +
tests/tools/plugins/Makefile.inc | 7 +-
tests/tools/plugins/delay_txn_start.cc | 120 +
tests/tools/plugins/hook_add_plugin.cc | 15 +-
tests/tools/plugins/redirect_rearm.cc | 110 +
254 files changed, 14698 insertions(+), 1533 deletions(-)
create mode 100644 doc/admin-guide/configuration/regex-best-practices.en.rst
create mode 100644 include/tscpp/util/AtomicSharedPtr.h
create mode 100644 plugins/esi/combo_handler_utils.cc
copy plugins/{background_fetch/headers.h => esi/combo_handler_utils.h} (54%)
create mode 100644 plugins/esi/lib/IncludeUrlValidator.cc
create mode 100644 plugins/esi/lib/IncludeUrlValidator.h
create mode 100644 plugins/header_rewrite/cidr.h
create mode 100644 plugins/prefetch/path.cc
create mode 100644 plugins/prefetch/path.h
create mode 100644 plugins/prefetch/test/test_path.cc
create mode 100644 tests/gold_tests/at_headers/at_headers.test.py
copy {plugins/authproxy => tests/gold_tests/at_headers/plugins}/Makefile.inc
(81%)
create mode 100644 tests/gold_tests/at_headers/plugins/at_header_probe.cc
create mode 100644 tests/gold_tests/at_headers/replay/at_headers.replay.yaml
create mode 100644 tests/gold_tests/autest-site/ats_replay.test.ext
copy tests/gold_tests/autest-site/{cli_tools.test.ext => curl.test.ext} (51%)
create mode 100644 tests/gold_tests/chunked_encoding/chunk_extension_client.py
create mode 100644
tests/gold_tests/chunked_encoding/chunk_extension_quoted_string.test.py
create mode 100644
tests/gold_tests/chunked_encoding/chunk_trailer_bare_lf.test.py
create mode 100644 tests/gold_tests/chunked_encoding/chunk_trailer_client.py
copy tests/gold_tests/{pluginTest/compress/compress_observer.py =>
chunked_encoding/chunked_flow_control.test.py} (70%)
mode change 100755 => 100644
copy tests/gold_tests/{pluginTest/compress/compress_observer.py =>
chunked_encoding/chunked_not_last.test.py} (72%)
mode change 100755 => 100644
copy tests/gold_tests/{redirect/redirect_to_same_origin_on_cache.replay.yaml
=> chunked_encoding/replays/chunk_extension_quoted_string.replay.yaml} (65%)
copy tests/gold_tests/{redirect/redirect_to_same_origin_on_cache.replay.yaml
=> chunked_encoding/replays/chunk_trailer_bare_lf.replay.yaml} (63%)
create mode 100644
tests/gold_tests/chunked_encoding/replays/chunked_h1_flow_control.replay.yaml
create mode 100644
tests/gold_tests/chunked_encoding/replays/chunked_h2_flow_control.replay.yaml
create mode 100644
tests/gold_tests/chunked_encoding/replays/chunked_not_last.replay.yaml
create mode 100644
tests/gold_tests/chunked_encoding/replays/chunked_passthru_flow_control.replay.yaml
create mode 100644 tests/gold_tests/connect/connect_parent_error_body.test.py
copy tests/gold_tests/{chunked_encoding/replays/chunked.replay.yaml =>
connect/replays/connect_parent_error_body.replay.yaml} (53%)
create mode 100644 tests/gold_tests/h2/h2_origin_cert_reverify.test.py
create mode 100644 tests/gold_tests/h2/http2_txn_start_read_gate.test.py
copy tests/gold_tests/{tls/tls_session_key_logging.replay.yaml =>
h2/replay/http2_txn_start_read_gate.replay.yaml} (61%)
copy tests/gold_tests/{post/replay/post-continue.replay.yaml =>
h2/replay_h2_origin_cert_reverify.yaml} (52%)
create mode 100644
tests/gold_tests/headers/clients/oversized_field_h2_client.py
copy plugins/multiplexer/remap.config =>
tests/gold_tests/headers/hopbyhop_connection.test.py (77%)
copy tests/gold_tests/{basic/basic.test.py => headers/oversized_field.test.py}
(69%)
create mode 100644 tests/gold_tests/headers/oversized_field_h2.test.py
create mode 100644 tests/gold_tests/headers/replay/oversized_field.replay.yaml
copy tests/gold_tests/{cache/replay/conditional-get-cache-hit.yaml =>
headers/replay/oversized_field_h2.replay.yaml} (50%)
create mode 100644
tests/gold_tests/headers/replays/hopbyhop_connection.replay.yaml
create mode 100644 tests/gold_tests/ip_allow/connect_destination_acl.test.py
create mode 100755 tests/gold_tests/logging/sigusr2_rotate_custom_log.sh
create mode 100755 tests/gold_tests/logging/sigusr2_rotate_diags.sh
create mode 100644
tests/gold_tests/next_hop/strategies_ch5/strategies_ch5.test.py
create mode 100644 tests/gold_tests/next_hop/strategies_ch5/trace.gold
copy tests/gold_tests/{pluginTest/compress/compress_observer.py =>
parent_proxy/parent_retry_non_retryable_post.test.py} (70%)
mode change 100755 => 100644
create mode 100644
tests/gold_tests/parent_proxy/replays/parent_retry_non_retryable_post.replay.yaml
copy tests/gold_tests/pluginTest/combo_handler/combo_handler_files/{tr2.gold
=> cache_control_aggregation.gold} (70%)
copy tests/gold_tests/pluginTest/combo_handler/combo_handler_files/{tr2.gold
=> max_age_zero.gold} (70%)
copy tests/gold_tests/pluginTest/combo_handler/combo_handler_files/{tr1.gold
=> tr3.gold} (100%)
copy tests/gold_tests/pluginTest/{lua/set_error_response.replay.yaml =>
esi/esi_nested_html_comment.replay.yaml} (62%)
create mode 100644
tests/gold_tests/pluginTest/esi/esi_nested_html_comment.test.py
copy tests/gold_tests/pluginTest/{lua/set_error_response.replay.yaml =>
esi/esi_nested_html_comment_reject.replay.yaml} (55%)
create mode 100644 tests/gold_tests/pluginTest/esi/esi_request_size_cap.test.py
create mode 100644
tests/gold_tests/pluginTest/esi/esi_ssrf_validate.replay.yaml
create mode 100644 tests/gold_tests/pluginTest/esi/esi_ssrf_validate.test.py
create mode 100644
tests/gold_tests/pluginTest/header_rewrite/header_rewrite_bundle.replay.yaml
copy tests/gold_tests/pluginTest/header_rewrite/rules/{rule_l_value.conf =>
rule_cidr.conf} (71%)
create mode 100644
tests/gold_tests/pluginTest/header_rewrite/rules/rule_cookie.conf
copy plugins/lua/example/test_fetch.lua =>
tests/gold_tests/pluginTest/lua/fetch_ipv6_cliaddr.lua (60%)
create mode 100644
tests/gold_tests/pluginTest/lua/lua_fetch_ipv6_cliaddr.test.py
create mode 100644 tests/gold_tests/pluginTest/lua/lua_remap_after_hook.test.py
copy plugins/lua/example/test_ret_403.lua =>
tests/gold_tests/pluginTest/lua/remap_after_hook.lua (71%)
copy
tests/gold_tests/pluginTest/multiplexer/replays/{multiplexer_copy_skip_post.replay.yaml
=> multiplexer_invalid_chunk_copy.replay.yaml} (73%)
copy
tests/gold_tests/pluginTest/multiplexer/replays/{multiplexer_copy_skip_post.replay.yaml
=> multiplexer_invalid_chunk_original.replay.yaml} (74%)
create mode 100644
tests/gold_tests/pluginTest/prefetch_simple/prefetch_query_path_traversal.replay.yaml
copy example/plugins/c-api/thread_pool/include/Makefile.am =>
tests/gold_tests/pluginTest/prefetch_simple/prefetch_query_path_traversal.test.py
(78%)
create mode 100644
tests/gold_tests/pluginTest/redirect_limit/redirect_limit.test.py
create mode 100644 tests/gold_tests/pluginTest/slice/shrink_origin.py
create mode 100644
tests/gold_tests/pluginTest/slice/slice_content_shrink.test.py
copy tests/gold_tests/{dns/replay/single_transaction.replay.yaml =>
pluginTest/webp_transform/replay/webp_chunked_cap.replay.yaml} (66%)
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_cache_refused.test.py
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_chunked_cap.test.py
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_decode_limit.test.py
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_max_buffer_size.test.py
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_size_cap.test.py
create mode 100644
tests/gold_tests/pluginTest/xdebug/x_remap_long_url/x_remap_long_url.replay.yaml
copy tests/gold_tests/{basic/basic-manager.test.py =>
pluginTest/xdebug/x_remap_long_url/x_remap_long_url.test.py} (61%)
create mode 100644 tests/gold_tests/tls/proxy_protocol_addressless.test.py
create mode 100644 tests/gold_tests/tls/proxy_protocol_client.py
create mode 100644
tests/gold_tests/tls/replay/outbound_sni_server_name_plain.replay.yaml
copy tests/gold_tests/{redirect/redirect_to_same_origin_on_cache.replay.yaml
=> tls/tls_accept_timeout_hook_defer.replay.yaml} (77%)
create mode 100644 tests/gold_tests/tls/tls_accept_timeout_hook_defer.test.py
create mode 100644 tests/gold_tests/tls/tls_engine_abort.py
copy tests/gold_tests/tls/{tls_engine.test.py => tls_engine_abort.test.py}
(52%)
create mode 100644
tests/gold_tests/tls/tls_outbound_sni_server_name_plain.test.py
create mode 100644 tests/tools/plugins/delay_txn_start.cc
create mode 100644 tests/tools/plugins/redirect_rearm.cc
