bneradt opened a new pull request, #13845: URL: https://github.com/apache/trafficserver/pull/13845
When abuse_shield blocked a TLS client, every later connection from that IP stayed open forever. The plugin rejected these connections at TS_VCONN_START_HOOK with TSVConnReenableEx(TS_EVENT_ERROR). At that hook the core marks the handshake finished without signaling anyone and cancels the inactivity timeout, so the socket sits in CLOSE-WAIT until ATS is restarted. A production fleet using the block action leaked sockets this way until the hosts ran out of memory. Adding the close action does not help, because it rejects the triggering connection the same way. This patch rejects blocked TLS connections the way plain HTTP sessions already were: the plugin shuts down the socket and reenables the hook normally, so the core sees the failure and closes the connection. The ClientHello fingerprint path keeps its error reenable, since the core fails the handshake correctly from that hook. The connection rate autest now checks that ATS closes a blocked TLS connection and that the open connection count drains to zero. Co-authored-by: Claude Opus 5.5 Medium <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
