bneradt commented on PR #13586: URL: https://github.com/apache/trafficserver/pull/13586#issuecomment-5640889447
@bryancall Addressed the blocking findings and the related operational issues in 954208101e. - Token buckets now retain milli-token credit, clamp debt above the uninitialized sentinel, and expose whole-token balances with negative fractions rounded down. Burst validation now caps capacity at 2,147,483 tokens. Deterministic tests cover 30/60/75/100 rates, variable intervals, exact concurrent consumption, replenishment, and saturated debt. - Unknown keys are rejected at the root, global, nested global, rule, and filter levels. Invalid booleans fail parsing. Startup reports the trusted-range count, and slot capacity has an explicit upper bound. - Reload and periodic maintenance prune obsolete rule buckets, including buckets recreated by an in-flight old-config hook. `abuse_shield.clear` clears tracking and block state separately from metric reset. Table metrics synchronize every second. - Logging distinguishes unavailable tracking slots and failed writes; `actions.logged` increments only after a successful write or fallback submission. ENOTCONN does not inflate close/rejection failures, and enforcement failure details use debug logging. Missing fingerprint methods have a separate counter from unavailable registries. - Runtime enablement is atomic, boolean message payloads are validated, unknown plugin messages report errors, and ContextMap copying/moving is explicitly deleted. The table/predicate lock order is documented. The new pacing AuTest sends 300 requests at 30 requests/second: all receive HTTP 200, with zero matches, blocks, closes, or rejections. It also verifies a negative AND case, automatic occupancy updates, and state clearing without counter reset. Existing AuTests exercise positive combined-rule matching and first-match precedence; hook behavior remains covered through integration tests rather than a mock unit executable for abuse_shield.cc. Additional tests cover the extracted block table's capacity/expiry/extension behavior, obsolete debt, trusted-range boundaries, four-slot contest rotation, and independent invalid configuration values. Flood tests now require actual block and rejection counters, and the session-error and pacing suites are listed as serial tests. The documentation now explains quiet debt, reload/block persistence, bounded memory and probes, metric overlap, fingerprint scope and user-argument limits, and runtime fail-open cases. The shortened license grants and unused timestamps are corrected. Validation in asfats5: build/install/format, all four focused CTest suites, abuse_shield, abuse_shield_session_errors, abuse_shield_pacing, jax_fingerprint, and the documentation build passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
