10.2.0: final batch of For v10.2.0 picks

CMakeLists.txt

@@ -306,7 +306,10 @@ else()
 endif()
 check_openssl_is_quictls(SSLLIB_IS_QUICTLS "${OPENSSL_INCLUDE_DIR}")
 
-if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.0.0")
+if(NOT SSLLIB_IS_BORINGSSL
+   AND NOT SSLLIB_IS_AWSLC
+   AND OPENSSL_VERSION VERSION_GREATER_EQUAL "3.0.0"
+)
   set(SSLLIB_IS_OPENSSL3 TRUE)
   add_compile_definitions(OPENSSL_API_COMPAT=10002 OPENSSL_IS_OPENSSL3)
 endif()

CMakePresets.json

@@ -185,10 +185,12 @@
       "inherits": ["ci"],
       "cacheVariables": {
         "ENABLE_PROBES": "ON",
-        "OPENSSL_ROOT_DIR": "/opt/openssl-quic",
+        "OPENSSL_ROOT_DIR": "/usr",
         "opentelemetry_ROOT": "/opt",
-        "CURL_ROOT": "/opt",
+        "CURL_ROOT": "/usr",
         "wamr_ROOT": "/opt",
+        "ENABLE_OTEL_TRACER": "ON",
+        "ENABLE_WASM_WAMR": "ON",
         "ENABLE_CRIPTS": "ON"
       }
     },
@@ -210,15 +212,17 @@
         "OPENSSL_ROOT_DIR": "/opt/h3-tools-boringssl/boringssl",
         "quiche_ROOT": "/opt/h3-tools-boringssl/quiche",
         "opentelemetry_ROOT": "/opt",
-        "CURL_ROOT": "/opt",
+        "CURL_ROOT": "/opt/h3-tools-boringssl",
         "wamr_ROOT": "/opt",
+        "ENABLE_OTEL_TRACER": "ON",
+        "ENABLE_WASM_WAMR": "ON",
         "CMAKE_INSTALL_PREFIX": "/tmp/ats-quiche",
         "ENABLE_QUICHE": "ON"
       }
     },
     {
       "name": "ci-fedora-autest",
-      "displayName": "CI Fedora Quiche Autest",
+      "displayName": "CI Fedora Autest",
       "description": "CI Pipeline config for Fedora Linux (autest build)",
       "inherits": ["ci-fedora", "autest"]
     },

ci/rat-exclude.txt

@@ -24,6 +24,8 @@ blib/**
 **/*.default.in
 **/*.config
 **/*.gold
+**/go.mod
+**/go.sum
 **/*.hrw4u
 **/.gitignore
 **/.gitmodules

doc/admin-guide/files/records.yaml.en.rst

@@ -4306,8 +4306,9 @@ SSL Termination
   This configuration specifies the maximum number of bytes to write
   into a SSL record when replying over a SSL session. In some
   circumstances this setting can improve response latency by reducing
-  buffering at the SSL layer. This setting can have a value between 0
-  and 16383 (max TLS record size).
+  buffering at the SSL layer. This setting accepts ``-1`` for dynamic
+  sizing, ``0`` for the default behavior, or a fixed maximum between
+  ``1`` and ``16383`` bytes.
 
   The default of ``0`` means to always write all available data into
   a single SSL record.

doc/admin-guide/plugins/header_rewrite.en.rst

@@ -1171,6 +1171,12 @@ run-plugin
 This allows to run an existing remap plugin, conditionally, from within a
 header rewrite rule.
 
+.. note::
+    ``<plugin-argument>`` is fixed when the rule is loaded (or reloaded);
+    it behaves the same as a plugin argument in ``remap.config``. It is
+    not re-evaluated per request, so variable interpolation (e.g.
+    ``%{HEADER:bar}``) does not work here.
+
 set-body
 ~~~~~~~~
 ::

doc/admin-guide/plugins/stats_over_http.en.rst

@@ -105,21 +105,29 @@ if you wish to have it in CSV format you can do so by passing an ``Accept`` head
 
 .. option:: Accept: text/csv
 
-Prometheus formatted output is also supported via the ``Accept`` header:
+Prometheus formatted output is also supported via the ``Accept`` header. Version 0.0.4
+(flat metric names) and version 2.0.0 (labeled metrics for better aggregation)
+are supported:
 
 .. option:: Accept: text/plain; version=0.0.4
+.. option:: Accept: text/plain; version=2.0.0
 
 Alternatively, the output format can be specified as a suffix to the configured
 path in the HTTP request target.  The supported suffixes are ``/json``,
-``/csv``, and ``/prometheus``.  For example, if the path is set to ``/_stats``
-(the default), you can access the stats in CSV format by using the URL::
+``/csv``, ``/prometheus``, and ``/prometheus_v2``.  For example, if the path
+is set to ``/_stats`` (the default), you can access the stats in CSV format by
+using the URL::
 
     http://host:port/_stats/csv
 
-The Prometheus format can be requested by using the URL::
+The Prometheus version 0.0.4 format (flat) can be requested by using the URL::
 
     http://host:port/_stats/prometheus
 
+The Prometheus v2 labeled format can be requested by using the URL::
+
+    http://host:port/_stats/prometheus_v2
+
 The JSON format is the default, but you can also access it explicitly by using the URL::
 
     http://host:port/_stats/json
@@ -129,9 +137,11 @@ specify a path suffix, the plugin will return the data in that format regardless
 the ``Accept`` header.
 
 In either case the ``Content-Type`` header returned by ``stats_over_http.so`` will
-reflect the content that has been returned: ``text/json``, ``text/csv``, or
-``text/plain; version=0.0.4; charset=utf-8`` for JSON, CSV, and Prometheus
-formats respectively.
+reflect the content that has been returned: ``text/json``, ``text/csv``,
+``text/plain; version=0.0.4; charset=utf-8``, or
+``text/plain; version=2.0.0; charset=utf-8`` for JSON, CSV, Prometheus v1, and
+Prometheus v2 formats respectively.
+
 
 Stats over http also accepts returning data in gzip or br compressed format per the
 ``Accept-encoding`` header. If the header is present, the plugin will return the

include/iocore/net/quic/Mock.h

@@ -28,6 +28,8 @@
 #include "iocore/net/quic/QUICStreamAdapter.h"
 #include "iocore/net/quic/QUICStream.h"
 
+#include <algorithm>
+
 class MockQUICContext;
 
 using namespace std::literals;
@@ -191,6 +193,11 @@ class MockQUICConnectionInfoProvider : public QUICConnectionInfoProvider
   {
     return negotiated_application_name_sv;
   }
+
+  void
+  on_stream_updated() override
+  {
+  }
 };
 
 class MockQUICStreamManager : public QUICStreamManager
@@ -431,6 +438,11 @@ class MockQUICConnection : public QUICConnection
     return negotiated_application_name_sv;
   }
 
+  void
+  on_stream_updated() override
+  {
+  }
+
   int             _transmit_count   = 0;
   int             _retransmit_count = 0;
   Ptr<ProxyMutex> _mutex;
@@ -519,13 +531,19 @@ class MockQUICStreamAdapter : public QUICStreamAdapter
   Ptr<IOBufferBlock>
   _read(size_t len) override
   {
-    this->_sending_data_len  -= len;
-    Ptr<IOBufferBlock> block  = make_ptr<IOBufferBlock>(new_IOBufferBlock());
+    len                      = std::min(len, this->_sending_data_len);
+    Ptr<IOBufferBlock> block = make_ptr<IOBufferBlock>(new_IOBufferBlock());
     block->alloc(iobuffer_size_to_index(len, BUFFER_SIZE_INDEX_32K));
     block->fill(len);
     return block;
   }
 
+  void
+  _consume(size_t len) override
+  {
+    this->_sending_data_len -= std::min(len, this->_sending_data_len);
+  }
+
 private:
   size_t _sending_data_len         = 0;
   size_t _total_sending_data_len   = 0;

include/iocore/net/quic/QUICConnection.h

@@ -60,6 +60,7 @@ class QUICConnectionInfoProvider
   virtual bool                    is_handshake_completed() const          = 0;
   virtual QUICVersion             negotiated_version() const              = 0;
   virtual std::string_view        negotiated_application_name() const     = 0;
+  virtual void                    on_stream_updated()                     = 0;
 };
 
 class QUICConnection : public QUICConnectionInfoProvider

include/iocore/net/quic/QUICStream.h

@@ -26,6 +26,7 @@
 #include "tscore/List.h"
 
 #include "iocore/eventsystem/Event.h"
+#include "iocore/eventsystem/IOBuffer.h"
 
 #include "iocore/net/quic/QUICConnection.h"
 #include "iocore/net/quic/QUICDebugNames.h"
@@ -53,6 +54,7 @@ class QUICStream
   QUICStreamDirection               direction() const;
   bool                              is_bidirectional() const;
   bool                              has_no_more_data() const;
+  bool                              has_data_to_send();
 
   QUICOffset final_offset() const;
 
@@ -66,6 +68,7 @@ class QUICStream
    * QUICApplication need to call one of these functions when it process VC_EVENT_*
    */
   void on_read();
+  void on_write();
   void on_eos();
 
   /**
@@ -85,6 +88,9 @@ class QUICStream
   uint64_t                    _received_bytes   = 0;
   uint64_t                    _sent_bytes       = 0;
   bool                        _has_no_more_data = false;
+  Ptr<IOBufferBlock>          _pending_send_block;
+  bool                        _pending_send_fin = false;
+  bool                        _sent_fin         = false;
 };
 
 class QUICStreamStateListener

include/iocore/net/quic/QUICStreamAdapter.h

@@ -39,6 +39,7 @@ class QUICStreamAdapter
 
   virtual int64_t    write(QUICOffset offset, const uint8_t *data, uint64_t data_length, bool fin) = 0;
   Ptr<IOBufferBlock> read(size_t len);
+  void               consume(size_t len);
   virtual bool       is_eos()     = 0;
   virtual uint64_t   unread_len() = 0;
   virtual uint64_t   read_len()   = 0;
@@ -60,6 +61,7 @@ class QUICStreamAdapter
   virtual void notify_eos() = 0;
 
 protected:
-  virtual Ptr<IOBufferBlock> _read(size_t len) = 0;
+  virtual Ptr<IOBufferBlock> _read(size_t len)    = 0;
+  virtual void               _consume(size_t len) = 0;
   QUICStream                &_stream;
 };

include/iocore/net/quic/QUICStreamVCAdapter.h

@@ -53,6 +53,8 @@ class QUICStreamVCAdapter : public VConnection, public QUICStreamAdapter
   // Helpers to check VIO states
   bool is_readable();
   bool is_writable();
+  void mark_stream_closed();
+  bool is_stream_closed() const;
 
   void clear_read_ready_event(Event *e);
   void clear_read_complete_event(Event *e);
@@ -65,6 +67,7 @@ class QUICStreamVCAdapter : public VConnection, public QUICStreamAdapter
 
 protected:
   Ptr<IOBufferBlock> _read(size_t len) override;
+  void               _consume(size_t len) override;
 
   VIO _read_vio;
   VIO _write_vio;

include/iocore/net/quic/QUICTypes.h

@@ -455,9 +455,9 @@ class QUICFiveTuple
   int        protocol() const;
 
 private:
-  IpEndpoint _source;
-  IpEndpoint _destination;
-  int        _protocol;
+  IpEndpoint _source{};
+  IpEndpoint _destination{};
+  int        _protocol  = 0;
   uint64_t   _hash_code = 0;
 };
 

include/mgmt/rpc/server/IPCSocketServer.h

@@ -144,7 +144,7 @@ class IPCSocketServer : public BaseCommInterface
   void close();
   void late_check_peer_credentials(int peedFd, TSRPCHandlerOptions const &options, swoc::Errata &errata) const;
 
-  std::atomic_bool _running;
+  std::atomic_bool _running{false};
 
   struct sockaddr_un _serverAddr;
   int                _socket{-1};

include/proxy/http2/Http2Stream.h

@@ -164,6 +164,7 @@ class Http2Stream : public ProxyTransaction
   void             increment_data_length(uint64_t length);
   bool             payload_length_is_valid() const;
   bool             is_write_vio_done() const;
+  int64_t          write_vio_ntodo() const;
   void             update_sent_count(unsigned num_bytes);
   Http2StreamId    get_id() const;
   Http2StreamState get_state() const;
@@ -175,6 +176,7 @@ class Http2Stream : public ProxyTransaction
   void             set_receive_headers(HTTPHdr &h2_headers);
   void             reset_receive_headers();
   void             reset_send_headers();
+  void             set_sent_request_method(int method);
   MIOBuffer       *read_vio_writer() const;
   int64_t          read_vio_read_avail();
   bool             is_read_enabled() const;
@@ -215,6 +217,7 @@ class Http2Stream : public ProxyTransaction
   Http2StreamId    _id         = -1;
   Http2StreamState _state      = Http2StreamState::HTTP2_STREAM_STATE_IDLE;
   int64_t          _http_sm_id = -1;
+  int              _sent_request_method{-1};
 
   HTTPHdr _receive_header;
 #if TS_USE_MALLOC_ALLOCATOR
@@ -316,6 +319,12 @@ Http2Stream::is_write_vio_done() const
   return this->write_vio.ntodo() == 0;
 }
 
+inline int64_t
+Http2Stream::write_vio_ntodo() const
+{
+  return this->write_vio.ntodo();
+}
+
 inline void
 Http2Stream::update_sent_count(unsigned num_bytes)
 {
@@ -391,6 +400,12 @@ Http2Stream::reset_send_headers()
   this->_send_header.create(HTTPType::RESPONSE);
 }
 
+inline void
+Http2Stream::set_sent_request_method(int method)
+{
+  _sent_request_method = method;
+}
+
 // Check entire DATA payload length if content-length: header exists
 inline void
 Http2Stream::increment_data_length(uint64_t length)
@@ -407,9 +422,9 @@ Http2Stream::payload_length_is_valid() const
 
   // Skip Content-Length check on [RFC 7230] 3.3.2 conditions
   bool is_payload_precluded =
-    this->is_outbound_connection() && (_send_header.method_get_wksidx() == HTTP_WKSIDX_HEAD ||
-                                       (_send_header.method_get_wksidx() == HTTP_WKSIDX_GET && _send_header.presence(mask) &&
-                                        _receive_header.status_get() == HTTPStatus::NOT_MODIFIED));
+    this->is_outbound_connection() &&
+    (_sent_request_method == HTTP_WKSIDX_HEAD || (_sent_request_method == HTTP_WKSIDX_GET && _send_header.presence(mask) &&
+                                                  _receive_header.status_get() == HTTPStatus::NOT_MODIFIED));
 
   if (content_length != 0 && !is_payload_precluded && content_length != data_length) {
     Warning("Bad payload length content_length=%d data_legnth=%d session_id=%" PRId64, content_length,

include/proxy/http3/Http3App.h

@@ -79,6 +79,7 @@ class Http3App : public QUICApplication
   void _handle_bidi_stream_on_write_complete(int event, VIO *vio);
   void _handle_bidi_stream_on_eos(int event, VIO *vio);
 
+  void _handle_error(const Http3Error &error);
   void _set_qpack_stream(Http3StreamType type, QUICStreamVCAdapter *adapter);
 
   QUICStreamVCAdapter::IOInfo &_get_stream_info(QUICStreamId stream_id);

include/proxy/http3/Http3ProtocolEnforcer.h

@@ -37,4 +37,5 @@ class Http3ProtocolEnforcer : public Http3FrameHandler
 
 private:
   bool _is_first_frame_received_on_control = false;
+  bool _is_headers_frame_received          = false;
 };

include/proxy/http3/Http3Session.h

@@ -56,6 +56,9 @@ class HQSession : public ProxySession
   void           remove_transaction(HQTransaction *trans);
   HQTransaction *get_transaction(QUICStreamId);
 
+protected:
+  void _close_transactions();
+
 private:
   // this should be unordered map?
   Queue<HQTransaction> _transaction_list;

include/proxy/http3/Http3StreamDataVIOAdaptor.h

@@ -42,7 +42,9 @@ class Http3StreamDataVIOAdaptor : public Http3FrameHandler
   bool has_data();
 
 private:
-  VIO       *_sink_vio          = nullptr;
-  int64_t    _total_data_length = 0;
-  MIOBuffer *_buffer;
+  VIO            *_sink_vio          = nullptr;
+  int64_t         _total_data_length = 0;
+  MIOBuffer      *_buffer            = nullptr;
+  IOBufferReader *_reader            = nullptr;
+  bool            _finalized         = false;
 };