bneradt opened a new pull request, #13846: URL: https://github.com/apache/trafficserver/pull/13846
A plugin that rejects a TLS connection at TS_VCONN_START_HOOK with TSVConnReenableEx(TS_EVENT_ERROR) never gets that connection closed. The error marks the handshake as failed, but getSSLHandShakeComplete() treats any non-ongoing state as complete, so the read path skips the handshake, disables the read, and cancels the inactivity timeout. The socket then sits in CLOSE-WAIT until ATS restarts. abuse_shield rejects blocked IPs this way, and a production fleet using its block action leaked sockets until the hosts ran out of memory. Rejections from the later TLS hooks only worked because the certificate callback mistook the error state for a client renegotiation attempt. This patch makes the SSL read path check for the rejected handshake state and signal a read error, so the connection is closed through the usual error path wherever a plugin rejects it. A new autest with a small test plugin rejects connections at TS_VCONN_START_HOOK, both from within the hook and asynchronously, and the abuse_shield connection rate test now checks that blocked TLS connections are closed and the open connection count drains to zero. Co-authored-by: Claude Opus 5.5 Medium <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
