cmcfarlen opened a new pull request, #13452:
URL: https://github.com/apache/trafficserver/pull/13452
## Draft — CI verification only
Backports the **#13442 "[master] Release 2"** coordinated security/hardening
bundle to
`10.2.x` (these fixes are what the 10.2.0 release is waiting on).
Cherry-picked with `-x`
from the range `f910eed635^..e7051e1583` — **149 of 150 commits**.
Security changes are documented in the separate security document (not the
milestone-driven changelog), so there is no per-PR milestone/project
bookkeeping here.
### Deferred (NOT in this PR)
- **`709443e870` "Fix race in remap table refcount during reload"** — a
9-file
`std::atomic<UrlRewrite*>` → `AtomicSharedPtr<UrlRewrite>` refactor. Being
handled as a
separate focused change (build + concurrency test). Nothing else in the
bundle depends on it.
### Commits that required manual conflict resolution
Master SHA → on-branch SHA. The first two are code-logic and worth review;
the rest are
new-unit-test registration / test-file merges (10.2.x lacked master-only
tests
`test_PluginYAML.cc` / `benchmark_TLSCertCompression.cc`, which were
excluded).
- `2ce51ba62c` → `94f2069783` — **SSLNetVConnection**: applied the
proxy-protocol
src/dst-addr null-guard onto 10.2.x's existing control flow (did not take
master's
refactored parse-failure branch).
- `e8d92a51f2` → `0a9b3a3dd5` — **test_Hdrs.cc**: appended only the new
`http_parse_status`
TEST_CASE; excluded the master-only `unmarshal_v24_1` block.
- `8102a6b6e3` → `e6f8b84551` — proxy unit_tests CMakeLists: added
`test_ControlBase.cc`.
- `6a4ecdad19` → `21b786a1ec` — net unit_tests CMakeLists: added
`test_OCSPStapling.cc`.
- `6a8c575f3f` → `de964687af` — proxy unit_tests CMakeLists: added
`test_FetchSM.cc`.
- `6916a91bde` → `63d5c95765` — test_proxy: the macOS link-duplicates fix
(drop
libinknet_stub.cc, add `appVersionInfo`).
- `b5510fb26d` → `93657ab769` and `43a5d7dec7` → `c17b724772` —
http2_crlf_header_validation.test.py (records_config format interplay with
the ssl fixup).
### AuTest fixups (10.2.x harness adaptation)
16 tests used the `ssl_multicert.yaml` Disk API, which 10.2.x's autest
harness/ATS don't
provide; converted each to the flat `ssl_multicert.config` form (same as
#13448) and folded
the conversion into its originating commit. Files:
h2/{h2_origin_cert_reverify,
h2_origin_trailers_h1, http2_crlf_header_validation, http2_flow_control,
http2_txn_start_read_gate, http2}, headers/oversized_field_h2,
ip_allow/connect_destination_acl, pluginTest/{certifier, multiplexer,
rate_limit/rate_limit_iprep, rate_limit/rate_limit_sni,
webp_transform/webp_transform_size_cap}, tls/{proxy_protocol_addressless,
tls_accept_timeout_crash, tls_engine_abort}.
Local: full build clean (macOS); ctest 162/163 (only the pre-existing macOS
`test_jsonrpcserver` unix-socket flake fails).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
