This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a change to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
from 56b31e0847 Avoid JSONRPC client write spins (#13329)
add 8798d5fb01 Replace VLA with heap allocation in cachekey appendEncoded
add 1ae0b55b43 Fix SNI/hostname comparison to check full string length
add f240780d17 Close connection if unneccesary H2 SETTINGS frame arrives
add c11c21a429 Reject Transfer-Encoding in HTTP/2 and HTTP/3 headers
add 2efafacb19 Reject Transfer-Encoding where chunked is not the final
coding
add 5642692b88 Fix out-of-bounds write in MIME obs-fold handling
add 5f55a845ea Enforce per-field size limit in HPACK/QPACK string decoding
add 41c2a9f423 regex_remap: Overflow in url_len Leads to Stack Overflow
add ca81ad5fd2 Reject oversized HPACK indexes
add 5a8eaaede5 Fix integer overflow in MIME header parsing
add 7606f49b25 Fix inverted condition for nonstandard method matching in
ACL filtering
add 19b2c089ed Limit CONNECT body preclusion to successful responses
add f6c6ab3533 Fix inverted condition in SNI_IpAllow::TestClientSNIAction
add 9be6dc04a9 Update SNI_IpAllow::TestClientSNIAction autest
add 0e62150285 rate_limit: Fix queue bypass
add 12560ab232 compress: stop gzip transform after deflate() error
add 0639222626 Add nullptr check before calling SSL_shutdown
add 4406735603 Fix leaks of POST failures
add c5b9f8c7ad Server Session: Make sure read_buffer is empty before
pooling a server session
add 0c79954bcd Enforce 16-bit srv_offset invariant in HostDBInfo::assign
add fee925ab31 Replace VLAs with ts::LocalBuffer in HostDB SRV handling
add 097214327b Fix OOB read in H2 get_received_frame_count
add 371718e223 Add bounds checks to DNS answer parsing before NS_GET macros
add 961baec59e cripts: Fix UB array write in remap instance initialization
add d705d29ba8 cripts: Fix path traversal in File::Path::Rebase
add 000c067b56 Bound status code parsing to prevent integer overflow
add 6efd0e7cd1 Avoid stack VLA in log filter wiping
add 6bdf628fab Validate PROXY v1 port bounds
add dcd52cf1f5 Guard txn_box stack allocations
add d352bbcdc4 libswoc: Validate IPv6 hextet bounds
add 64508368a8 Reject overflowing XPACK integers
add 750eb2d3ee Bound outstanding HTTP/2 SETTINGS
add 94518fba59 Fix max_settings_per_minute condition
add e04d7fdf9e rate_limit: Fix ip-rep UB writes
add 956e6237ac Fix length check of MethodMod::check
add 578ea293cc iocore: tighten IOBuffer and AIO bounds checks
add bc536d7f8d stream_editor: allocate rules in contdata_t ctor
add bb83ee26d6 tscpp: hold intercept try-lock guard via shared mutex
add 86e3084d5e URL: reject parsed ports outside uint16 range
add d38b565ebc access_control: cap stack buffer for cookie base64 decode
add 17a61676ea rate_limit: Fix active counter underflow
add 8fcdebe10a Constrain prefetch relative paths
add a5a2c8a2e2 Keep OCSP map on init failure
add 0a24b3f92d Return evacuation bucket by reference not by value
add dc354abad6 Handle addressless PROXY headers in TLS
add 109cccce61 Guard outbound server_name SNI policy
add 1306020f61 Verify H2 origin certs on session reuse
add 763b2a0fcf TLSSNISupport: own outbound_sni_policy bytes across config
reload
add ef8ecaa555 Avoid signed tolower for name bytes
add 9d17c42826 Reject oversized multiplexer chunks
add 0821898f60 Keep loop detection on outbound-transparent ports
add ec7aff4943 Set default value of
proxy.config.http2.default_buffer_water_mark to 32KB
add b86722577c Avoid UB when URL scheme is absent in scheme_get
add 21194a3091 HTTPHdr: fix use-after-free in destroy() leaving dangling
m_http
add 869f11006a ESI: cap HTTP request length to prevent size_t overflow
add 69b963fec3 Invoke Continuation operator bool, not pointer-to-bool
add 8f28a21e08 Prevent unbounded recursion in host-down Range fallback
add 09b346acc2 Add uds-perm/uds-user/uds-group port options
add 9b28dd2f0d CVE-2021-32564: Fix ChunkHandler Flow Control
add 01c4b757ea Fix FetchSM header block copying
add 11076f475f Gate H2 reads during async hooks
add facd883e51 background_fetch: fix inverted size operator and broken
value wildcard
add 5b3e16a9d2 Fix an integer overflow in HdrHeap
add 9bcb090bef lua: Add checks on server request hdr
add 2c90be4b73 SSLSNIConfig: fix SNI partial-match policy bypass
add d4a09d6adf Combo handler: Reject empty Content-Type when allowlist is
configured
add 510eed9c7a ESI: bound for nested esi html comment
add 1aa63ddf8e ja3_fingerprint: tighten encode_word_buffer bounds
add fe5a87d520 Use ParseRules::is_digit on raw network bytes in HTTP parser
add b6d7ef8503 header_rewrite: Copy set-body-from response body with memcpy
add 63744a5f41 Cap stale_response SIE buffering
add 19c796be33 Guard parent mark-down on UNAVAILABLE_SERVER retry
add aa9c569aef xdebug: Cap X-Remap header length to actual buffer content
add 4268da1723 DNS: fix TCP length-prefix read under edge-triggered epoll
add f04180cbbd Add admin-guide reference for writing secure regex rules
add 7941b2a5fe cripts: Fix HRW bridge issues, add autests
add c3113b40ba cripts: fix use-after-free in TSRemapDoRemap
add 987f8fa9b1 cripts: Fix abort on duplicate query keys
add 41a78eefc0 header_rewrite: Fix cookie key over-read
add 1fc1430667 CVE-2026-33267: 10.1.x: Strip external @ headers before
plugin hooks
add 91c829f4ce doc: cover uri_signing cdniuc uri-regex in regex best
practices
add 9379a43105 Preserve dynamic-port flag across tunnel_route mapping ops
add 3f5bdd4191 HttpTunnel: Guard get_producer(VIO*) against dead producers
add ec93e0f29b ts_lua: clear rri pointer in http_ctx after remap returns
add c1f8f7d785 ts_lua: use sockaddr_storage for ts_lua_fetch client address
add 40457999a8 cripts: Fix global Client::URL MLoc leak
add fdf69ca1b2 cripts: Fix Bundle::Headers server-side header removal
add 3ef84614ba slice: Check for Integer underflow in firstblockbytes
add 30dcca07ef ParentSelection: increase size of mapWrapped array for
compat with strategies
add 22c37a549d lua: Invalidate cached main_ctx when slot is outside
instance's range
add 1a9174361e HttpSM: Stop tracking the fire-and-forget cache-delete
Action
add 8d845f9928 lua: Free transform context when client-hook VConn closes
add 94cde44214 NextHopRoundRobin: update ring size for wrapping when
switching rings
add 42051ca6f9 certifier: Reject unsafe SNI names
add 7fda96a380 Drop H2 origin trailers for H1 clients
add f168e0c728 http2: Reject CONTINUATION accumulation that overflows
header_blocks_length
add 4793de5d09 Honor number_of_redirections for plugin-initiated redirects
add 97cbb7c3fe cache_range_requests: use std::string spill buffer for
building override cachekey
add c2b40948d2 webp_transform: bound buffered body and ImageMagick decode
add 17b39ec9df header_rewrite: Fix IPv6 CIDR masking for non-aligned
prefixes
add e9f9df9234 SSLNetVConnection: deregister async handshake eventfd on
connection teardown
add 6ec473486b Strip Connection-listed headers per RFC 9110 ยง7.6.1
add 3c696a6e1b http2: Defer HPACK dynamic-table updates until encoding
succeeds
add d614e83d58 authproxy: Don't assert on auth response with no header
fields
add d73bd60a9d mgmt/rpc: create JSONRPC unix socket with intended mode
atomically
add 688adb8727 cache: Move openReadStartEarliest recursion counter off
CacheVC to fix UAF
add 20eba2d36e CVE-2026-33930: Bound host header buffer
add 07d4525235 uri_signing: replace stack arrays with LocalBuffer
add 4ed3b41056 ip_allow: add default CONNECT destination rules
add 35f9e04b0a Guard against missing delimiter in url_sig C= parameter
add 7e23f58bfd Fix: cancel stale TLS accept timeouts so session acceptors
don't abort
add b121cc6c2e CVE-2026-22068: regex_map: anchor host matching to the full
hostname
add 48de5a48fd Invalidate dns_info.addr when claiming resolved without DNS
add 535ff79156 PendingAction: Don't let CAS failure overwrite the caller's
action
add 0f36b3133e parent_selection: Cap retries to one per window via
failedAt CAS
add 8fc73b46f0 compress: Wrap isspace so obs-text Content-Type bytes don't
trigger UB
add 2694c217bf Reject header fields exceeding the uint16 field-length limit
add c324d369c7 ESI: Fix URL include validation in version 10.1.x
add bb7f7263df http: reject chunked extension quoted-string values
containing CR or LF
add 6a4db2d9d3 Fix race in remap table refcount during reload
add 75b6ce3808 Guard remap against shutdown table teardown
add 76eb461467 http: reject a bare LF chunked trailer terminator under
strict parsing
add 928a87459f Expand URI normalization test coverage for userinfo handling
add 7f58872861 Combo handler: Refactor Cache-Control parsing and update
gold test
add b01f9632e1 combo_handler.test.py: Fix empty type test output
add 0d67596dc9 combo_handler.test.py: realign gold-file TestRun indices
for 10.1.x
add f26e77bef3 http: drain request body on internally generated cache
responses
add a2bc011ea1 10.1.x: Fix chunked passthrough flow-control deadlock
(drop_chunked_trailers=0)
add edebf3f382 Regex: preserve RE_ENDANCHORED semantics on PCRE2 < 10.30
add beea5e4e76 esi: drop tsutil from esicore link deps to avoid plugin ODR
add ffba51c879 esi: add <sys/socket.h> for AF_INET/AF_INET6 in
IncludeUrlValidator
add a74a0fb2a8 esi: guard optarg null before setHostAllowRegex to satisfy
clang analyzer
No new revisions were added by this update.
Summary of changes:
configs/ip_allow.yaml.default | 28 +-
doc/admin-guide/configuration/index.en.rst | 1 +
.../configuration/regex-best-practices.en.rst | 423 ++++
doc/admin-guide/files/cache.config.en.rst | 12 +-
doc/admin-guide/files/ip_allow.yaml.en.rst | 64 +-
doc/admin-guide/files/parent.config.en.rst | 8 +-
doc/admin-guide/files/records.yaml.en.rst | 67 +-
doc/admin-guide/files/remap.config.en.rst | 14 +
doc/admin-guide/files/sni.yaml.en.rst | 10 +
doc/admin-guide/files/splitdns.config.en.rst | 9 +-
doc/admin-guide/layer-4-routing.en.rst | 9 +
doc/admin-guide/plugins/esi.en.rst | 35 +
doc/admin-guide/plugins/geoip_acl.en.rst | 7 +
doc/admin-guide/plugins/maxmind_acl.en.rst | 8 +-
doc/admin-guide/plugins/uri_signing.en.rst | 23 +-
doc/admin-guide/plugins/url_sig.en.rst | 8 +
doc/admin-guide/plugins/webp_transform.en.rst | 45 +-
.../api/functions/TSMimeHdrFieldCreate.en.rst | 6 +
.../api/functions/TSMimeHdrFieldNameSet.en.rst | 11 +
.../functions/TSMimeHdrFieldValueStringSet.en.rst | 4 +
doc/developer-guide/cripts/cripts-headers.en.rst | 7 +
.../plugins/http-headers/mime-headers.en.rst | 20 +
include/cripts/Bundles/Headers.hpp | 10 +-
include/cripts/Epilogue.hpp | 10 +-
include/cripts/Urls.hpp | 19 +-
include/iocore/eventsystem/IOBuffer.h | 9 +-
include/iocore/net/AcceptOptions.h | 6 +
include/iocore/net/NetVConnection.h | 22 +-
include/iocore/net/TLSSNISupport.h | 23 +-
include/proxy/ParentSelection.h | 11 +-
include/proxy/ProxySession.h | 7 +
include/proxy/ProxyTransaction.h | 4 +
include/proxy/ReverseProxy.h | 9 +-
include/proxy/hdrs/HTTP.h | 47 +-
include/proxy/hdrs/MIME.h | 32 +-
include/proxy/hdrs/URL.h | 4 +
include/proxy/hdrs/XPACK.h | 2 +-
include/proxy/http/HttpConfig.h | 3 +
include/proxy/http/HttpSM.h | 10 +-
include/proxy/http/HttpSessionManager.h | 5 +-
include/proxy/http/HttpTransact.h | 65 +-
include/proxy/http/HttpTunnel.h | 30 +-
include/proxy/http/remap/UrlRewrite.h | 25 +-
include/proxy/http2/HPACK.h | 12 +-
include/proxy/http2/HTTP2.h | 14 +-
include/proxy/http2/Http2ConnectionState.h | 64 +-
include/proxy/http2/Http2Stream.h | 14 +-
include/proxy/http3/QPACK.h | 4 +-
include/records/RecHttp.h | 8 +
include/tscore/PendingAction.h | 8 +-
include/tscore/X509HostnameValidator.h | 5 +-
include/tsutil/AtomicSharedPtr.h | 84 +
include/tsutil/Convert.h | 7 +-
include/tsutil/Regex.h | 63 +
lib/swoc/src/swoc_ip.cc | 5 +-
lib/swoc/unit_tests/test_ip.cc | 5 +
plugins/authproxy/authproxy.cc | 1 -
plugins/background_fetch/configs.cc | 6 +-
plugins/background_fetch/rules.cc | 8 +-
.../cache_range_requests/cache_range_requests.cc | 57 +-
plugins/cachekey/cachekey.cc | 12 +-
plugins/certifier/certifier.cc | 47 +-
plugins/compress/compress.cc | 3 +-
plugins/compress/configuration.cc | 18 +-
plugins/esi/CMakeLists.txt | 2 +-
plugins/esi/combo_handler.cc | 44 +-
plugins/esi/combo_handler_utils.cc | 141 ++
.../esi/combo_handler_utils.h | 29 +-
plugins/esi/esi.cc | 99 +-
plugins/esi/fetcher/HttpDataFetcherImpl.cc | 18 +-
plugins/esi/lib/CMakeLists.txt | 9 +
plugins/esi/lib/EsiProcessor.cc | 105 +-
plugins/esi/lib/EsiProcessor.h | 11 +-
plugins/esi/lib/IncludeUrlValidator.cc | 441 ++++
plugins/esi/lib/IncludeUrlValidator.h | 86 +
plugins/esi/test/CMakeLists.txt | 20 +-
plugins/esi/test/combo_handler_utils_test.cc | 198 ++
plugins/esi/test/include_url_validator_test.cc | 215 ++
plugins/experimental/access_control/plugin.cc | 22 +-
plugins/experimental/rate_limit/ip_reputation.cc | 4 +-
plugins/experimental/rate_limit/sni_selector.cc | 6 +-
plugins/experimental/rate_limit/txn_limiter.cc | 2 +-
plugins/experimental/stale_response/BodyData.h | 4 +
.../experimental/stale_response/ServerIntercept.cc | 1 +
.../experimental/stale_response/stale_response.cc | 202 +-
.../experimental/stale_response/stale_response.h | 2 +
.../experimental/stream_editor/stream_editor.cc | 2 +-
.../experimental/txn_box/plugin/src/Modifier.cc | 11 +-
plugins/experimental/txn_box/plugin/src/ts_util.cc | 20 +-
plugins/experimental/uri_signing/normalize.cc | 50 +-
.../uri_signing/unit_tests/uri_signing_test.cc | 223 +-
plugins/experimental/url_sig/url_sig.cc | 8 +
plugins/header_rewrite/cidr.h | 68 +
plugins/header_rewrite/conditions.cc | 16 +-
plugins/header_rewrite/conditions.h | 2 +-
plugins/header_rewrite/header_rewrite_test.cc | 86 +-
plugins/header_rewrite/operators.cc | 24 +-
plugins/ja3_fingerprint/ja3_fingerprint.cc | 4 +-
plugins/ja3_fingerprint/ja3_utils.cc | 12 +-
plugins/ja3_fingerprint/test_utils.cc | 55 +
plugins/lua/ts_lua.cc | 18 +-
plugins/lua/ts_lua_common.h | 1 +
plugins/lua/ts_lua_fetch.cc | 33 +-
plugins/lua/ts_lua_server_request.cc | 4 +
plugins/lua/ts_lua_transform.cc | 5 +
plugins/lua/ts_lua_util.cc | 4 +-
plugins/multiplexer/chunk-decoder.cc | 81 +-
plugins/multiplexer/chunk-decoder.h | 16 +-
plugins/multiplexer/fetcher.h | 35 +-
plugins/prefetch/CMakeLists.txt | 1 +
plugins/prefetch/fetch.cc | 15 +-
plugins/prefetch/fetch.h | 4 +-
plugins/prefetch/path.cc | 190 ++
plugins/prefetch/path.h | 63 +
plugins/prefetch/plugin.cc | 47 +-
plugins/regex_remap/regex_remap.cc | 37 +-
plugins/slice/server.cc | 23 +-
plugins/webp_transform/ImageTransform.cc | 307 ++-
plugins/xdebug/xdebug.cc | 9 +-
src/api/InkAPI.cc | 28 +-
src/cripts/Bundles/HRWBridge.cc | 85 +-
src/cripts/Bundles/Headers.cc | 16 +-
src/cripts/Context.cc | 6 +-
src/cripts/Files.cc | 11 +-
src/cripts/Instance.cc | 2 +-
src/cripts/Urls.cc | 25 +-
src/iocore/aio/AIO.cc | 5 +-
src/iocore/cache/CacheRead.cc | 31 +-
src/iocore/cache/CacheVC.h | 1 -
src/iocore/cache/StripeSM.h | 4 +-
src/iocore/cache/unit_tests/test_Stripe.cc | 30 +
src/iocore/dns/DNS.cc | 62 +-
src/iocore/dns/P_DNSConnection.h | 16 +-
src/iocore/eventsystem/P_IOBuffer.h | 16 +-
src/iocore/eventsystem/unit_tests/test_IOBuffer.cc | 90 +
src/iocore/hostdb/HostDB.cc | 11 +-
src/iocore/hostdb/HostDBInfo.cc | 4 +-
src/iocore/net/CMakeLists.txt | 10 +-
src/iocore/net/OCSPStapling.cc | 57 +-
src/iocore/net/P_SSLClientUtils.h | 6 +-
src/iocore/net/P_SSLNetVConnection.h | 2 +
src/iocore/net/ProxyProtocol.cc | 38 +-
src/iocore/net/SNIActionPerformer.cc | 19 +-
src/iocore/net/SSLClientUtils.cc | 67 +-
src/iocore/net/SSLNetVConnection.cc | 48 +-
src/iocore/net/SSLNextProtocolAccept.cc | 2 +
src/iocore/net/SSLSNIConfig.cc | 20 +-
src/iocore/net/Server.cc | 7 +-
src/iocore/net/unit_tests/sni_conf_test.yaml | 8 +
src/iocore/net/unit_tests/test_ProxyProtocol.cc | 24 +
.../unit_tests/test_SSLNetVConnectionAsyncEp.cc | 132 ++
src/iocore/net/unit_tests/test_SSLSNIConfig.cc | 134 ++
src/iocore/net/unit_tests/test_YamlSNIConfig.cc | 2 +-
src/mgmt/rpc/server/IPCSocketServer.cc | 34 +-
src/mgmt/rpc/server/unit_tests/test_rpcserver.cc | 40 +
src/proxy/ControlBase.cc | 2 +-
src/proxy/FetchSM.cc | 42 +-
src/proxy/ParentConsistentHash.cc | 13 +-
src/proxy/ParentRoundRobin.cc | 18 +-
src/proxy/ProxyTransaction.cc | 6 +
src/proxy/ReverseProxy.cc | 74 +-
src/proxy/hdrs/HTTP.cc | 54 +-
src/proxy/hdrs/HdrHeap.cc | 14 +-
src/proxy/hdrs/HeaderValidator.cc | 3 +-
src/proxy/hdrs/MIME.cc | 269 ++-
src/proxy/hdrs/URL.cc | 12 +-
src/proxy/hdrs/XPACK.cc | 17 +-
src/proxy/hdrs/unit_tests/test_HdrHeap.cc | 45 +-
src/proxy/hdrs/unit_tests/test_Hdrs.cc | 284 ++-
src/proxy/hdrs/unit_tests/test_HeaderValidator.cc | 13 +
src/proxy/hdrs/unit_tests/test_URL.cc | 106 +
src/proxy/hdrs/unit_tests/test_XPACK.cc | 105 +-
src/proxy/hdrs/unit_tests/test_mime.cc | 367 ++++
src/proxy/http/ConnectingEntry.cc | 25 +-
src/proxy/http/Http1ClientSession.cc | 7 +
src/proxy/http/HttpConfig.cc | 52 +-
src/proxy/http/HttpProxyServerMain.cc | 3 +
src/proxy/http/HttpSM.cc | 154 +-
src/proxy/http/HttpSessionAccept.cc | 6 +-
src/proxy/http/HttpSessionManager.cc | 48 +-
src/proxy/http/HttpTransact.cc | 180 +-
src/proxy/http/HttpTransactHeaders.cc | 28 +
src/proxy/http/HttpTunnel.cc | 267 ++-
src/proxy/http/remap/NextHopConsistentHash.cc | 6 +-
src/proxy/http/remap/NextHopRoundRobin.cc | 18 +-
src/proxy/http/remap/RemapConfig.cc | 9 +-
src/proxy/http/remap/RemapProcessor.cc | 16 +-
src/proxy/http/remap/UrlRewrite.cc | 6 +-
src/proxy/http/unit_tests/CMakeLists.txt | 1 +
src/proxy/http/unit_tests/test_ChunkedHandler.cc | 509 +++++
src/proxy/http/unit_tests/test_HttpTransact.cc | 64 +
src/proxy/http2/HPACK.cc | 51 +-
src/proxy/http2/HTTP2.cc | 5 +-
src/proxy/http2/Http2ClientSession.cc | 17 +-
src/proxy/http2/Http2ConnectionState.cc | 196 +-
src/proxy/http2/Http2ServerSession.cc | 17 +-
src/proxy/http2/Http2SessionAccept.cc | 9 +-
src/proxy/http2/Http2Stream.cc | 56 +-
src/proxy/http2/test_HPACK.cc | 9 +-
src/proxy/http2/unit_tests/test_HTTP2.cc | 42 +
.../http2/unit_tests/test_HpackIndexingTable.cc | 273 ++-
src/proxy/http3/Http3Session.cc | 19 +-
src/proxy/http3/QPACK.cc | 20 +-
src/proxy/http3/test/test_QPACK.cc | 7 +-
src/proxy/logging/LogFilter.cc | 45 +-
src/records/RecHttp.cc | 62 +
src/records/RecordsConfig.cc | 6 +-
src/traffic_cache_tool/CacheScan.cc | 8 +-
src/traffic_server/traffic_server.cc | 3 +
src/tscore/CMakeLists.txt | 1 +
src/tscore/X509HostnameValidator.cc | 16 +-
src/tscore/unit_tests/test_PendingAction.cc | 91 +
.../unit_tests/test_X509HostnameValidator.cc | 32 +-
src/tscpp/api/InterceptPlugin.cc | 21 +-
src/tscpp/api/TransformationPlugin.cc | 2 +-
src/tsutil/Regex.cc | 170 +-
src/tsutil/unit_tests/test_Regex.cc | 20 +
tests/CMakeLists.txt | 1 +
tests/fuzzing/fuzz_hpack.cc | 4 +-
tests/gold_tests/at_headers/at_headers.test.py | 70 +
.../gold_tests/at_headers}/plugins/CMakeLists.txt | 2 +-
.../gold_tests/at_headers/plugins/Makefile.inc | 3 +-
.../at_headers/plugins/at_header_probe.cc | 247 +++
.../at_headers/replay/at_headers.replay.yaml | 94 +
tests/gold_tests/autest-site/ats_replay.test.ext | 21 +
tests/gold_tests/autest-site/min_cfg/ip_allow.yaml | 20 +
.../gold_tests/autest-site/trafficserver.test.ext | 54 +-
.../cache/cache_corrupt_recursive_uaf.test.py | 127 ++
.../cache/host_down_range_recursion.test.py | 81 +
.../host_down_range_recursion_prime.replay.yaml} | 31 +-
.../host_down_range_recursion_range.replay.yaml | 52 +
.../chunked_encoding/chunk_extension_client.py | 106 +
.../chunk_extension_quoted_string.test.py | 84 +
.../chunked_encoding/chunk_trailer_bare_lf.test.py | 86 +
.../chunked_encoding/chunk_trailer_client.py | 104 +
.../chunked_flow_control.test.py} | 11 +-
.../chunked_not_last.test.py} | 8 +-
.../chunk_extension_quoted_string.replay.yaml} | 43 +-
.../replays/chunk_trailer_bare_lf.replay.yaml} | 44 +-
.../replays/chunked_h1_flow_control.replay.yaml | 138 ++
.../replays/chunked_h2_flow_control.replay.yaml | 148 ++
.../replays/chunked_not_last.replay.yaml | 206 ++
.../chunked_passthru_flow_control.replay.yaml | 161 ++
tests/gold_tests/connect/connect.test.py | 3 +
.../connect/connect_parent_error_body.test.py | 72 +
.../replays/connect_parent_error_body.replay.yaml | 115 +
tests/gold_tests/cripts/cripts_bundle.replay.yaml | 325 +++
tests/gold_tests/cripts/cripts_bundle.test.py | 49 +
tests/gold_tests/cripts/files/bundle_headers.cript | 60 +
tests/gold_tests/cripts/files/direct_headers.cript | 65 +
.../cripts/files/server_bundle_headers.cript | 45 +
.../h2/clients/h2_max_settings_per_minute.py | 133 ++
.../gold_tests/h2/clients/h2_settings_ack_stall.py | 184 ++
tests/gold_tests/h2/h1_trailer_client.py | 86 +
.../gold_tests/h2/h2_origin_cert_reverify.test.py | 72 +
.../h2_origin_trailers_h1.replay.yaml} | 34 +-
tests/gold_tests/h2/h2_origin_trailers_h1.test.py | 88 +
tests/gold_tests/h2/http2.test.py | 24 +
tests/gold_tests/h2/http2_flow_control.test.py | 42 +
.../h2/http2_txn_start_read_gate.test.py | 57 +
.../replay/http2_settings_ack_stall.replay.yaml} | 44 +-
.../http2_txn_start_read_gate.replay.yaml} | 49 +-
...ue.yaml => replay_h2_origin_cert_reverify.yaml} | 42 +-
.../headers/clients/oversized_field_h2_client.py | 151 ++
.../gold_tests/headers/hopbyhop_connection.test.py | 14 +-
.../oversized_field.test.py} | 15 +-
.../gold_tests/headers/oversized_field_h2.test.py | 136 ++
.../headers/replay/oversized_field.replay.yaml | 90 +
.../replay/oversized_field_h2.replay.yaml} | 71 +-
...replay.yaml => hopbyhop_connection.replay.yaml} | 108 +-
.../ip_allow/connect_destination_acl.test.py | 168 ++
.../strategies_ch5.test.py} | 141 +-
.../gold_tests/next_hop/strategies_ch5/trace.gold | 192 ++
.../per_server_connection_max.test.py | 1 +
.../parent_retry_non_retryable_post.test.py} | 12 +-
.../parent_retry_non_retryable_post.replay.yaml | 90 +
.../delete_maxforwards_body_desync.test.py | 89 +
.../pipeline/delete_maxfwd_noop_drain.test.py | 89 +
tests/gold_tests/pipeline/desync_client.py | 112 +
tests/gold_tests/pipeline/desync_client_miss.py | 45 +
tests/gold_tests/pipeline/desync_server.py | 97 +
tests/gold_tests/pipeline/noop_keepalive.test.py | 92 +
tests/gold_tests/pipeline/noop_keepalive_client.py | 57 +
.../cache_range_requests.test.py | 36 +
.../pluginTest/certifier/certifier.test.py | 107 +
...{https.replay.yaml => https-no-sni.replay.yaml} | 4 +-
...eplay.yaml => https-path-traversal.replay.yaml} | 6 +-
.../pluginTest/combo_handler/combo_handler.test.py | 53 +-
.../{tr2.gold => cache_control_aggregation.gold} | 7 +-
.../{tr2.gold => max_age_zero.gold} | 7 +-
.../combo_handler_files/{tr1.gold => tr3.gold} | 0
.../esi/esi_nested_html_comment.replay.yaml} | 36 +-
.../pluginTest/esi/esi_nested_html_comment.test.py | 156 ++
.../esi_nested_html_comment_reject.replay.yaml} | 40 +-
.../pluginTest/esi/esi_request_size_cap.test.py | 91 +
.../pluginTest/esi/esi_ssrf_validate.replay.yaml | 164 ++
.../pluginTest/esi/esi_ssrf_validate.test.py | 111 +
.../header_rewrite_bundle.replay.yaml | 2296 ++++++++++++++++++++
.../header_rewrite_set_body_from.test.py | 44 +
.../rules/{rule_l_value.conf => rule_cidr.conf} | 10 +-
.../header_rewrite/rules/rule_cookie.conf | 68 +
.../rules/rule_set_body_from_remap.conf | 4 +
.../pluginTest/lua/fetch_ipv6_cliaddr.lua | 37 +-
...hook.test.py => lua_fetch_ipv6_cliaddr.test.py} | 42 +-
.../pluginTest/lua/lua_remap_after_hook.test.py | 55 +
.../gold_tests/pluginTest/lua/remap_after_hook.lua | 25 +-
.../pluginTest/multiplexer/multiplexer.test.py | 81 +
.../multiplexer_invalid_chunk_copy.replay.yaml} | 22 +-
...multiplexer_invalid_chunk_original.replay.yaml} | 37 +-
.../prefetch_query_path_traversal.replay.yaml | 165 ++
.../prefetch_query_path_traversal.test.py} | 8 +-
.../pluginTest/rate_limit/concurrent_reject.sh | 28 +-
.../pluginTest/rate_limit/independent_limiters.sh | 29 +-
.../rate_limit/queue_bypass_regression.sh | 77 +
.../pluginTest/rate_limit/queue_drain.sh | 44 +
.../pluginTest/rate_limit/rate_limit.test.py | 132 ++
.../pluginTest/rate_limit/rate_limit_iprep.test.py | 114 +
.../pluginTest/rate_limit/rate_limit_sni.test.py | 115 +
.../pluginTest/rate_limit/retry_after.sh | 26 +-
.../pluginTest/rate_limit/sequential_pass.sh | 27 +-
.../redirect_limit/redirect_limit.test.py | 134 ++
tests/gold_tests/pluginTest/slice/shrink_origin.py | 134 ++
.../pluginTest/slice/slice_content_shrink.test.py | 94 +
.../stale_response/stale_response.test.py | 20 +-
....yaml => stale_response_max_memory.replay.yaml} | 51 +-
.../pluginTest/traffic_dump/traffic_dump.test.py | 1 +
.../pluginTest/tsapi/test_TSHttpSsnInfo.cc | 7 +
.../pluginTest/tsapi/test_TSHttpSsnInfo.test.py | 2 +
tests/gold_tests/pluginTest/url_sig/url_sig.gold | 3 +
.../gold_tests/pluginTest/url_sig/url_sig.test.py | 30 +
.../replay/webp_chunked_cap.replay.yaml} | 27 +-
.../webp_transform_cache_refused.test.py | 90 +
.../webp_transform_chunked_cap.test.py | 74 +
.../webp_transform_decode_limit.test.py | 95 +
.../webp_transform_max_buffer_size.test.py | 108 +
.../webp_transform/webp_transform_size_cap.test.py | 115 +
.../x_remap_long_url/x_remap_long_url.replay.yaml | 63 +
.../x_remap_long_url/x_remap_long_url.test.py} | 20 +-
.../proxy_protocol/proxy_protocol.test.py | 1 +
tests/gold_tests/remap/regex_map_anchor.test.py | 35 +
.../remap/replay/regex_map_anchor.replay.yaml | 204 ++
tests/gold_tests/tls/gold/tls-tunnel-metrics.gold | 6 +-
.../tls/proxy_protocol_addressless.test.py | 81 +
tests/gold_tests/tls/proxy_protocol_client.py | 31 +-
.../outbound_sni_server_name_plain.replay.yaml | 79 +
.../tls_accept_timeout_crash.replay.yaml} | 32 +-
.../tls/tls_accept_timeout_crash.test.py | 75 +
tests/gold_tests/tls/tls_engine_abort.py | 64 +
tests/gold_tests/tls/tls_engine_abort.test.py | 111 +
tests/gold_tests/tls/tls_forward_nonhttp.test.py | 1 +
.../tls/tls_outbound_sni_server_name_plain.test.py | 25 +
.../tls/tls_partial_blind_tunnel.test.py | 1 +
tests/gold_tests/tls/tls_sni_host_policy.test.py | 99 +
tests/gold_tests/tls/tls_sni_ip_allow.test.py | 1 +
tests/gold_tests/tls/tls_sni_with_port.test.py | 1 +
tests/gold_tests/tls/tls_tunnel.test.py | 20 +
tests/gold_tests/tls/tls_tunnel_forward.test.py | 1 +
tests/gold_tests/tunnel/tunnel_transform.test.py | 2 +
tests/gold_tests/tunnel/txn_type.test.py | 2 +
tests/gold_tests/uds/uds_socket_perm.test.py | 57 +
tests/tools/plugins/CMakeLists.txt | 2 +
tests/tools/plugins/delay_txn_start.cc | 122 ++
tests/tools/plugins/hook_add_plugin.cc | 24 +-
tests/tools/plugins/redirect_rearm.cc | 112 +
364 files changed, 19834 insertions(+), 1918 deletions(-)
create mode 100644 doc/admin-guide/configuration/regex-best-practices.en.rst
create mode 100644 include/tsutil/AtomicSharedPtr.h
create mode 100644 plugins/esi/combo_handler_utils.cc
copy src/tsutil/unit_tests/test_Strerror.cc =>
plugins/esi/combo_handler_utils.h (56%)
create mode 100644 plugins/esi/lib/IncludeUrlValidator.cc
create mode 100644 plugins/esi/lib/IncludeUrlValidator.h
create mode 100644 plugins/esi/test/combo_handler_utils_test.cc
create mode 100644 plugins/esi/test/include_url_validator_test.cc
create mode 100644 plugins/header_rewrite/cidr.h
create mode 100644 plugins/prefetch/path.cc
create mode 100644 plugins/prefetch/path.h
create mode 100644 src/iocore/net/unit_tests/test_SSLNetVConnectionAsyncEp.cc
create mode 100644 src/proxy/http/unit_tests/test_ChunkedHandler.cc
create mode 100644 src/tscore/unit_tests/test_PendingAction.cc
create mode 100644 tests/gold_tests/at_headers/at_headers.test.py
copy {example => tests/gold_tests/at_headers}/plugins/CMakeLists.txt (93%)
copy example/plugins/c-api/remap_header_add/build.txt =>
tests/gold_tests/at_headers/plugins/Makefile.inc (81%)
mode change 100755 => 100644
create mode 100644 tests/gold_tests/at_headers/plugins/at_header_probe.cc
create mode 100644 tests/gold_tests/at_headers/replay/at_headers.replay.yaml
create mode 100644 tests/gold_tests/cache/cache_corrupt_recursive_uaf.test.py
create mode 100644 tests/gold_tests/cache/host_down_range_recursion.test.py
copy tests/gold_tests/{dns/replay/single_transaction.replay.yaml =>
cache/replay/host_down_range_recursion_prime.replay.yaml} (72%)
create mode 100644
tests/gold_tests/cache/replay/host_down_range_recursion_range.replay.yaml
create mode 100644 tests/gold_tests/chunked_encoding/chunk_extension_client.py
create mode 100644
tests/gold_tests/chunked_encoding/chunk_extension_quoted_string.test.py
create mode 100644
tests/gold_tests/chunked_encoding/chunk_trailer_bare_lf.test.py
create mode 100644 tests/gold_tests/chunked_encoding/chunk_trailer_client.py
copy tests/gold_tests/{cache/alternate-caching.test.py =>
chunked_encoding/chunked_flow_control.test.py} (70%)
copy tests/gold_tests/{cache/alternate-caching.test.py =>
chunked_encoding/chunked_not_last.test.py} (74%)
copy tests/gold_tests/{tls/tls_sni_with_port.replay.yaml =>
chunked_encoding/replays/chunk_extension_quoted_string.replay.yaml} (66%)
copy tests/gold_tests/{tls/tls_sni_with_port.replay.yaml =>
chunked_encoding/replays/chunk_trailer_bare_lf.replay.yaml} (64%)
create mode 100644
tests/gold_tests/chunked_encoding/replays/chunked_h1_flow_control.replay.yaml
create mode 100644
tests/gold_tests/chunked_encoding/replays/chunked_h2_flow_control.replay.yaml
create mode 100644
tests/gold_tests/chunked_encoding/replays/chunked_not_last.replay.yaml
create mode 100644
tests/gold_tests/chunked_encoding/replays/chunked_passthru_flow_control.replay.yaml
create mode 100644 tests/gold_tests/connect/connect_parent_error_body.test.py
create mode 100644
tests/gold_tests/connect/replays/connect_parent_error_body.replay.yaml
create mode 100644 tests/gold_tests/cripts/cripts_bundle.replay.yaml
create mode 100644 tests/gold_tests/cripts/cripts_bundle.test.py
create mode 100644 tests/gold_tests/cripts/files/bundle_headers.cript
create mode 100644 tests/gold_tests/cripts/files/direct_headers.cript
create mode 100644 tests/gold_tests/cripts/files/server_bundle_headers.cript
create mode 100644 tests/gold_tests/h2/clients/h2_max_settings_per_minute.py
create mode 100644 tests/gold_tests/h2/clients/h2_settings_ack_stall.py
create mode 100644 tests/gold_tests/h2/h1_trailer_client.py
create mode 100644 tests/gold_tests/h2/h2_origin_cert_reverify.test.py
copy tests/gold_tests/{ip_allow/replays/h3.replay.yaml =>
h2/h2_origin_trailers_h1.replay.yaml} (66%)
create mode 100644 tests/gold_tests/h2/h2_origin_trailers_h1.test.py
create mode 100644 tests/gold_tests/h2/http2_txn_start_read_gate.test.py
copy tests/gold_tests/{remap/base.replay.yaml =>
h2/replay/http2_settings_ack_stall.replay.yaml} (68%)
copy tests/gold_tests/h2/{h2get_with_body.yaml =>
replay/http2_txn_start_read_gate.replay.yaml} (61%)
copy tests/gold_tests/h2/{expect_100_continue.yaml =>
replay_h2_origin_cert_reverify.yaml} (66%)
create mode 100644
tests/gold_tests/headers/clients/oversized_field_h2_client.py
copy plugins/multiplexer/remap.config =>
tests/gold_tests/headers/hopbyhop_connection.test.py (77%)
copy tests/gold_tests/{basic/basic.test.py => headers/oversized_field.test.py}
(69%)
create mode 100644 tests/gold_tests/headers/oversized_field_h2.test.py
create mode 100644 tests/gold_tests/headers/replay/oversized_field.replay.yaml
copy tests/gold_tests/{dns/replay/multiple_host_requests.replay.yaml =>
headers/replay/oversized_field_h2.replay.yaml} (50%)
copy tests/gold_tests/headers/replays/{hsts.replay.yaml =>
hopbyhop_connection.replay.yaml} (51%)
create mode 100644 tests/gold_tests/ip_allow/connect_destination_acl.test.py
copy tests/gold_tests/next_hop/{strategies_ch2/strategies_ch2.test.py =>
strategies_ch5/strategies_ch5.test.py} (50%)
create mode 100644 tests/gold_tests/next_hop/strategies_ch5/trace.gold
copy tests/gold_tests/{cache/alternate-caching.test.py =>
parent_proxy/parent_retry_non_retryable_post.test.py} (72%)
create mode 100644
tests/gold_tests/parent_proxy/replays/parent_retry_non_retryable_post.replay.yaml
create mode 100644
tests/gold_tests/pipeline/delete_maxforwards_body_desync.test.py
create mode 100644 tests/gold_tests/pipeline/delete_maxfwd_noop_drain.test.py
create mode 100644 tests/gold_tests/pipeline/desync_client.py
create mode 100644 tests/gold_tests/pipeline/desync_client_miss.py
create mode 100644 tests/gold_tests/pipeline/desync_server.py
create mode 100644 tests/gold_tests/pipeline/noop_keepalive.test.py
create mode 100644 tests/gold_tests/pipeline/noop_keepalive_client.py
copy tests/gold_tests/pluginTest/certifier/replays/{https.replay.yaml =>
https-no-sni.replay.yaml} (95%)
copy tests/gold_tests/pluginTest/certifier/replays/{https.replay.yaml =>
https-path-traversal.replay.yaml} (93%)
copy tests/gold_tests/pluginTest/combo_handler/combo_handler_files/{tr2.gold
=> cache_control_aggregation.gold} (70%)
copy tests/gold_tests/pluginTest/combo_handler/combo_handler_files/{tr2.gold
=> max_age_zero.gold} (70%)
copy tests/gold_tests/pluginTest/combo_handler/combo_handler_files/{tr1.gold
=> tr3.gold} (100%)
copy tests/gold_tests/{ats_probe/ats_probe.replay.yaml =>
pluginTest/esi/esi_nested_html_comment.replay.yaml} (62%)
create mode 100644
tests/gold_tests/pluginTest/esi/esi_nested_html_comment.test.py
copy tests/gold_tests/pluginTest/{lua/set_error_response.replay.yaml =>
esi/esi_nested_html_comment_reject.replay.yaml} (55%)
create mode 100644 tests/gold_tests/pluginTest/esi/esi_request_size_cap.test.py
create mode 100644
tests/gold_tests/pluginTest/esi/esi_ssrf_validate.replay.yaml
create mode 100644 tests/gold_tests/pluginTest/esi/esi_ssrf_validate.test.py
create mode 100644
tests/gold_tests/pluginTest/header_rewrite/header_rewrite_bundle.replay.yaml
copy tests/gold_tests/pluginTest/header_rewrite/rules/{rule_l_value.conf =>
rule_cidr.conf} (71%)
create mode 100644
tests/gold_tests/pluginTest/header_rewrite/rules/rule_cookie.conf
copy plugins/lua/example/test_fetch.lua =>
tests/gold_tests/pluginTest/lua/fetch_ipv6_cliaddr.lua (60%)
copy tests/gold_tests/pluginTest/lua/{lua_client_hook.test.py =>
lua_fetch_ipv6_cliaddr.test.py} (50%)
create mode 100644 tests/gold_tests/pluginTest/lua/lua_remap_after_hook.test.py
copy plugins/lua/example/test_creq_method.lua =>
tests/gold_tests/pluginTest/lua/remap_after_hook.lua (71%)
copy tests/gold_tests/pluginTest/{ja4_fingerprint/ja4_fingerprint.replay.yaml
=> multiplexer/replays/multiplexer_invalid_chunk_copy.replay.yaml} (64%)
copy tests/gold_tests/{tls/tls_sni_with_port.replay.yaml =>
pluginTest/multiplexer/replays/multiplexer_invalid_chunk_original.replay.yaml}
(69%)
create mode 100644
tests/gold_tests/pluginTest/prefetch/prefetch_query_path_traversal.replay.yaml
copy tests/gold_tests/{headers/invalid_range_header.test.py =>
pluginTest/prefetch/prefetch_query_path_traversal.test.py} (82%)
copy ci/jenkins/bin/rat.sh =>
tests/gold_tests/pluginTest/rate_limit/concurrent_reject.sh (62%)
copy ci/jenkins/bin/rat.sh =>
tests/gold_tests/pluginTest/rate_limit/independent_limiters.sh (60%)
create mode 100755
tests/gold_tests/pluginTest/rate_limit/queue_bypass_regression.sh
create mode 100755 tests/gold_tests/pluginTest/rate_limit/queue_drain.sh
create mode 100644 tests/gold_tests/pluginTest/rate_limit/rate_limit.test.py
create mode 100644
tests/gold_tests/pluginTest/rate_limit/rate_limit_iprep.test.py
create mode 100644
tests/gold_tests/pluginTest/rate_limit/rate_limit_sni.test.py
copy ci/jenkins/bin/in_tree.sh =>
tests/gold_tests/pluginTest/rate_limit/retry_after.sh (70%)
copy ci/jenkins/bin/rat.sh =>
tests/gold_tests/pluginTest/rate_limit/sequential_pass.sh (62%)
create mode 100644
tests/gold_tests/pluginTest/redirect_limit/redirect_limit.test.py
create mode 100644 tests/gold_tests/pluginTest/slice/shrink_origin.py
create mode 100644
tests/gold_tests/pluginTest/slice/slice_content_shrink.test.py
copy
tests/gold_tests/pluginTest/stale_response/{stale_response_with_force_swr.replay.yaml
=> stale_response_max_memory.replay.yaml} (60%)
copy
tests/gold_tests/pluginTest/{ja4_fingerprint/ja4_fingerprint_basic_server.replay.yaml
=> webp_transform/replay/webp_chunked_cap.replay.yaml} (67%)
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_cache_refused.test.py
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_chunked_cap.test.py
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_decode_limit.test.py
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_max_buffer_size.test.py
create mode 100644
tests/gold_tests/pluginTest/webp_transform/webp_transform_size_cap.test.py
create mode 100644
tests/gold_tests/pluginTest/xdebug/x_remap_long_url/x_remap_long_url.replay.yaml
copy tests/gold_tests/{basic/basic.test.py =>
pluginTest/xdebug/x_remap_long_url/x_remap_long_url.test.py} (61%)
create mode 100644 tests/gold_tests/remap/regex_map_anchor.test.py
create mode 100644 tests/gold_tests/remap/replay/regex_map_anchor.replay.yaml
create mode 100644 tests/gold_tests/tls/proxy_protocol_addressless.test.py
create mode 100644
tests/gold_tests/tls/replay/outbound_sni_server_name_plain.replay.yaml
copy tests/gold_tests/{dns/replay/reverse_lookup.replay.yaml =>
tls/tls_accept_timeout_crash.replay.yaml} (74%)
create mode 100644 tests/gold_tests/tls/tls_accept_timeout_crash.test.py
create mode 100644 tests/gold_tests/tls/tls_engine_abort.py
create mode 100644 tests/gold_tests/tls/tls_engine_abort.test.py
create mode 100644
tests/gold_tests/tls/tls_outbound_sni_server_name_plain.test.py
create mode 100644 tests/gold_tests/uds/uds_socket_perm.test.py
create mode 100644 tests/tools/plugins/delay_txn_start.cc
create mode 100644 tests/tools/plugins/redirect_rearm.cc
