moonchen commented on code in PR #13737: URL: https://github.com/apache/trafficserver/pull/13737#discussion_r4340556077
########## tests/uranium_tests/client_connection/throttle_client.py: ########## @@ -0,0 +1,159 @@ +"""Client connections for test_connections_throttle_exempt.py.""" +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +from collections.abc import Callable +import socket +import ssl +import time + +TIMEOUT = 10.0 +POLL_INTERVAL = 0.1 + + +def proxy_header(source: str, port: int) -> bytes: + """Return a PROXY protocol v1 header that claims the connection comes from @a source. + + :param source: The claimed source address. + :param port: The destination port. + """ + + if ":" in source: + return f"PROXY TCP6 {source} ::1 40000 {port}\r\n".encode() + return f"PROXY TCP4 {source} 127.0.0.1 40000 {port}\r\n".encode() + + +def connect(host: str, port: int, tls: bool = False, proxy_source: str = "") -> socket.socket: + """Open a connection to @a host, an IPv4 or IPv6 address. + + :param tls: Use TLS. + :param proxy_source: Start with a PROXY protocol header that claims this source address. + """ + + sock = socket.create_connection((host, port), timeout=TIMEOUT) + if proxy_source: + sock.sendall(proxy_header(proxy_source, port)) + if tls: + context = ssl.create_default_context() + context.check_hostname = False + context.verify_mode = ssl.CERT_NONE + sock = context.wrap_socket(sock, server_hostname="healthcheck") + return sock + + +def exchange(sock: socket.socket, close: bool) -> str: + """Send a health check request on @a sock and return the response status line. + + :param close: Ask the proxy to close the connection after the response. + :return: The status line, or an empty string if the proxy closed the connection first. + """ + + request = b"GET / HTTP/1.1\r\nHost: healthcheck\r\n" + if close: + request += b"Connection: close\r\n" + try: + sock.sendall(request + b"\r\n") + response = b"" + while b"\r\n\r\n" not in response: + data = sock.recv(4096) + if not data: + return "" + response += data + except (ConnectionResetError, BrokenPipeError, ssl.SSLError): + return "" + + header, _, body = response.partition(b"\r\n\r\n") + lines = header.decode().split("\r\n") + length = 0 + for line in lines[1:]: + name, _, value = line.partition(":") + if name.strip().lower() == "content-length": + length = int(value) + while len(body) < length: + data = sock.recv(4096) + if not data: + break + body += data + return lines[0] + + +def wait_for_close(sock: socket.socket) -> None: + """Return once the proxy has closed the TCP connection under @a sock.""" + + if isinstance(sock, ssl.SSLSocket): + # The TLS close_notify comes before the socket is closed, so read on to the TCP FIN. + try: + sock = sock.unwrap() + except (OSError, ssl.SSLError): + return + try: + while sock.recv(4096): + pass + except ConnectionResetError: + pass + + +def attempt(host: str, port: int, tls: bool = False, proxy_source: str = "", while_open: Callable[[], None] | None = None) -> str: + """Make one health check request and return whether it was served or refused. + + :param tls: Use TLS. + :param proxy_source: Start with a PROXY protocol header that claims this source address. + :param while_open: Call this once the request is served, then ask the proxy to close the connection and wait until it + does. + :return: 'served' or 'refused'. + """ + + try: + sock = connect(host, port, tls, proxy_source) + except (ConnectionResetError, BrokenPipeError, ssl.SSLError): + # A TLS handshake or the PROXY header fails if the proxy closes the connection at accept. Review Comment: These are narrow on purpose. When ATS refuses at accept, the kernel has already completed the TCP handshake, so the refusal arrives as an EOF or a reset, which this handler and `exchange()` cover. `ConnectionRefusedError` would mean no listener and a timeout would mean a hung connection, and both should fail the test. ########## src/iocore/net/SSLNetVConnection.cc: ########## @@ -2228,6 +2231,10 @@ SSLNetVConnection::_migrateFromSSL() // Create new VC: UnixNetVConnection *newvc = static_cast<UnixNetVConnection *>(unix_netProcessor.allocate_vc(t)); ink_assert(newvc != nullptr); + if (newvc != nullptr) { + // Before populate() gives the socket to the new VC, which updates the exempt gauge when it is freed. + newvc->set_client_exempt(is_client_exempt()); + } if (newvc != nullptr && newvc->populate(hold_con, this->read.vio.cont, nullptr) != EVENT_DONE) { Review Comment: `ink_assert` is compiled out of release builds, so these checks are what guard a null `newvc` there. The added block follows the pattern of the existing checks, and restructuring them is outside this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
