maskit opened a new pull request, #13953: URL: https://github.com/apache/trafficserver/pull/13953
## Why `HttpSM::state_raw_http_server_open` waits for write readiness on a new raw origin connection before reporting the tunnel to the client, and issues only a one-byte `do_io_write()` to get it. For a `partial_blind_route` in `sni.yaml`, the origin connection is TLS, and that write starts the handshake: `SSL_connect()` sends the ClientHello and returns WANT_READ. No read was ever requested on the connection, so when the origin's ServerHello arrives, `read.enabled` is false and `NetHandler::process_ready_list()` drops the connection from the read list without calling `net_read_io()`. Nothing reports the socket writable again either, so the handshake stalls until the inactivity timeout and the client gets a 502. On Linux, edge-triggered epoll reports the socket writable together with the incoming data, so the write path happens to drive the handshake to completion. kqueue reports the read and write filters separately, so on macOS `test_tls_partial_blind_tunnel` times out on every run. During the stall, the ServerHello and certificate sit unread in ATS's receive queue. ## Change Issue a zero-byte `do_io_read()` together with the write, as `ConnectingEntry` already does for other origin connections. On a TLS connection the read side drives the handshake and signals `VC_EVENT_READ_COMPLETE` when it completes, which `state_raw_http_server_open` already treats as success. On a plain connection a zero-byte read does not signal anything, so CONNECT still waits for write readiness. The read is cancelled alongside the write on both the success and error paths, before the buffer it points to is freed. ## Validation On macOS with a BoringSSL build: - `test_tls_partial_blind_tunnel` passes; it failed on every run before this change. - `test_connect`, `test_connect_destination_acl`, `test_tls_tunnel`, `test_tls_tunnel_forward`, `test_tls_sni_ip_allow`, `test_tunnel_active_timeout`, `test_tunnel_transform`, `test_txn_type`, `test_connections_throttle_exempt` and the `proxy_protocol_out` cases pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
