bneradt opened a new pull request, #13854: URL: https://github.com/apache/trafficserver/pull/13854
The abuse_shield autest's connection-rate check is racy. On fast machines it reads `abuse_shield.actions.blocked 0` and `abuse_shield.connections.rejected 0`, even though `traffic.out` shows the plugin blocking and rejecting. ## Why `AbuseShieldConnRateTest` opens 30 idle TLS connections, holds them for one second, closes them, and then reads the counters with `traffic_ctl`. ATS calls `TS_VCONN_START` from `SSLNetVConnection::_sslStartHandShake()`, which `net_read_io()` reaches only once a new connection becomes readable. A connection that never sends anything therefore reaches the plugin only when the client's FIN arrives. In a local run: - client opened all 30 connections at :57.253 and closed them at :58.255 - the plugin logged its rejections at :58.321 - `traffic_ctl` read the counters at :58.352, 31 ms later On a 48-CPU CI runner the read reliably comes first and both counters read 0. The test never exercised enforcement on idle connections; it exercised enforcement on connections that close without sending anything. ## Fix `tls_connection_flood.py` replaces `idle_connections.py`. It opens the same burst of 30 connections and sends a ClientHello on each, so `TS_VCONN_START` runs while the connections are open. It then waits for each connection to be answered with handshake bytes, or refused: closed, sent an alert, or left silent until a deadline. It requires at least one of each outcome. After the burst it sends one more ClientHello from the now-blocked IP and requires that connection to be refused, so the block-table rejection counter is always exercised. The client exits only after ATS has acted on every connection, so the counters are settled when the next step reads them. Refused connections are allowed to stay open because ATS currently leaves TLS connections that a plugin rejects at `TS_VCONN_START` open (#13846 changes that). The test passes with and without #13846: 5/5 runs on master, and 3/3 runs with #13846 merged on top. This change is test-only. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
