cmcfarlen opened a new pull request, #13775: URL: https://github.com/apache/trafficserver/pull/13775
Cherry-picks for the 10.2.1 release, taken from the items at **For v10.2.1** in the [ATS v10.2.x project](https://github.com/orgs/apache/projects/573). Picked in master merge order: | PR | master SHA | Title | |---|---|---| | #13560 | `6de0aca4` | Honor allow_half_open when a client aborts early | | #13455 | `c6ea03da` | Reuse deleted MIME field slots | | #13677 | `40253538` | Fix global TLS ticket key use for certificate contexts | | #13717 | `e32c31f8` | tests: cover the global TLSv1.3 session ticket count | | #13740 | `01cbbc51` | Coverity: avoid unsigned wrap in AIO cache_op loop | | #13728 | `c5ae69c8` | Fix SSL 2.0 version code in JA4 fingerprints | | #13736 | `ee427dbc` | Bind session ticket keys to the dest_ip certificate | | #13719 | `a2416f28` | Hex-encode non-alphanumeric ALPN bytes in JA4 fingerprints | All eight are `MERGED` single-parent squash merges and none were already present on 10.2.x (checked by both `(#NNN)` subject and the `cherry picked from` trailer). Every pick applied with no conflicts, and each commit's `--stat` matches its master original exactly. ### AuTest harness adaptation 10.2.x registers `ssl_multicert.config` (`ts.Disk.ssl_multicert_config`) where master registers `ssl_multicert.yaml` (`ts.Disk.ssl_multicert_yaml`). Three picks add autests that use master's YAML form, so each was converted to the branch's flat form and **folded into its own commit** via `--fixup` + `--autosquash` rather than added as a follow-up: - #13560 `client_abort_before_response.test.py` — single wildcard cert. - #13717 `tls_ticket_number.test.py` — single wildcard cert. - #13736 `tls_resume_cert_partition.test.py` — seven `dest_ip` entries, brackets kept on exactly the IPv6 ones (`::1`, `2001:db8::1`, `2001:db8::2`), matching the YAML original. No pick waits on an `'ssl_multicert.yaml finished loading'` diags string, so that hang-to-timeout trap does not apply here. ### Not picked - **#13725** (Include signature algorithms in JA4 fingerprints) is at `For v10.2.1` but carries `Incompatible`, and on reading it the label is substantively right: it is a real JA4 spec-conformance fix, but it changes the `c` section of nearly every fingerprint, so stored values and abuse_shield rules built from ATS output would need regenerating. Held pending the author's input; it is **independent** of the two JA4 picks here, which were verified to apply cleanly and pass `test_ja4`/`test_jax` without it. - **#12825, #13086, #13196** are still OPEN on master. ### Local verification (macOS, `dev` preset, experimental + JA4/JAX plugins enabled) - `cmake --build build-dev -- -k 0` — clean. - `ctest -j4` — 128/129. The only failure is `test_jsonrpcserver`, a known macOS-local unix-socket/restart timing issue unrelated to these picks. - Directly affected suites all pass: `test_ja4`, `test_jax`, `test_proxy_hdrs`, `test_proxy_hdrs_xpack`, `test_AIO`. - The three converted autests are not run by this preset on macOS — this CI run is their gate. Draft on purpose: to be landed by fast-forward once CI is green, not merged via the UI. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
