bneradt opened a new pull request, #13838: URL: https://github.com/apache/trafficserver/pull/13838
Enabling jax_fingerprint --log-field for a connection-based method such as JA4 aborts traffic_server on a user arg sanity-check assertion. ATS closes the client connection before it logs a transaction when the client sends Connection: close or times out, and the log field callback then passes a null vconn to TSUserArgGet, which treats it as a global arg. Even without the crash, the field never logged a usable value: the plugin decoded the string as an integer, JA4H contexts are freed at TXN_CLOSE before logging, and TSLogStringUnmarshal under-reports the bytes consumed, which shifts every following custom field whenever a string's length is a multiple of eight. This patch keeps a session-scoped copy of each fingerprint for the log field, taken at session start for connection-based methods and at TXN_CLOSE (tagged with the transaction id) for request-based ones. The callback null-checks the session and vconn and falls back to that copy, so clients that complete the TLS handshake but never finish a request are logged with their JA3/JA4 fingerprints. This change also decodes the field as a string and fixes TSLogStringUnmarshal to count the terminating NUL. A new autest reproduces the crash with a Connection: close request and verifies the logged fingerprints for that case, a client that times out mid-header, and a handshake-only connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
