| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Add `VAR_DEPENDS` feature to auto options (#11729) * Add `VAR_DEPENDS` feature to auto options All the variables listed in `VAR_DEPENDS` need to be truthy for the feature to be enabled. This will be used for ja4_fingerprint to require vanilla OpenSSL. * Implement changes suggested by Chris McFarlen * Hint that the issue can be resolved by enabling the variable. The message is intentionally vague, because unfortunately, it may be an internal variable that should not/cannot be directly enabled. | 2 年前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
HTTP/3 support via OpenSSL 3.5 (#13186) * HTTP/3 via OpenSSL 3.5 + quiche Fedora now ships OpenSSL 3.5 with the third-party QUIC TLS callback API, but quiche still links against the older quictls/BoringSSL symbols. ATS therefore could not use the system OpenSSL library for downstream HTTP/3 without dragging in a different TLS stack. This adds CMake detection for the OpenSSL callback API and provides a private compatibility layer that maps quiche's legacy hooks onto SSL_set_quic_tls_cbs. This requires static quiche in that mode so ATS resolves the shim symbols locally and links the final binaries against the system OpenSSL libraries. This also relaxes verifier-only HTTP/3 AuTest gates that do not execute curl, so those tests can run when ATS has QUIC support but the installed curl lacks HTTP/3. Unknown unidirectional HTTP/3 stream types and aliased frame-type interests also exposed gaps in shared H3 handling. This discards ignored stream data and de-duplicates handler registration so buffered input does not grow indefinitely and MAX_PUSH_ID handlers run once. * HTTP/3 via OpenSSL QUIC OpenSSL 3.5 can terminate QUIC connections directly, but ATS only had a quiche-backed HTTP/3 listener. Operators who want to use the system OpenSSL QUIC stack needed a separate downstream backend without changing the existing quiche path or origin HTTP/3 scope. This adds an optional ENABLE_OPENSSL_QUIC backend that uses OpenSSL's native QUIC listener and stream APIs for downstream HTTP/3. This keeps the backend mutually exclusive with quiche, exposes TS_HAS_OPENSSL_QUIC, and shares ATS's existing HTTP/3 stream handling above the transport. This also installs native-QUIC TLS callbacks for ALPN and SNI certificate selection before ATS has a QUIC NetVC to bind. OpenSSL native QUIC does not make a selected SSL_CTX certificate active via SSL_set_SSL_CTX alone, so this applies the selected cert, key, and chain to the connection SSL. This also broadens client-side HTTP/3 tests to run with either backend, keeps H3 streams open across informational responses, and hardens transaction cleanup when OpenSSL closes stream state before ATS finishes teardown. This caches stream identifiers, declines listener-time QUIC tickets until a NetVC is bound, and adds focused H3 lifecycle and session-ticket coverage. | 1 个月前 | |
HTTP/3 support via OpenSSL 3.5 (#13186) * HTTP/3 via OpenSSL 3.5 + quiche Fedora now ships OpenSSL 3.5 with the third-party QUIC TLS callback API, but quiche still links against the older quictls/BoringSSL symbols. ATS therefore could not use the system OpenSSL library for downstream HTTP/3 without dragging in a different TLS stack. This adds CMake detection for the OpenSSL callback API and provides a private compatibility layer that maps quiche's legacy hooks onto SSL_set_quic_tls_cbs. This requires static quiche in that mode so ATS resolves the shim symbols locally and links the final binaries against the system OpenSSL libraries. This also relaxes verifier-only HTTP/3 AuTest gates that do not execute curl, so those tests can run when ATS has QUIC support but the installed curl lacks HTTP/3. Unknown unidirectional HTTP/3 stream types and aliased frame-type interests also exposed gaps in shared H3 handling. This discards ignored stream data and de-duplicates handler registration so buffered input does not grow indefinitely and MAX_PUSH_ID handlers run once. * HTTP/3 via OpenSSL QUIC OpenSSL 3.5 can terminate QUIC connections directly, but ATS only had a quiche-backed HTTP/3 listener. Operators who want to use the system OpenSSL QUIC stack needed a separate downstream backend without changing the existing quiche path or origin HTTP/3 scope. This adds an optional ENABLE_OPENSSL_QUIC backend that uses OpenSSL's native QUIC listener and stream APIs for downstream HTTP/3. This keeps the backend mutually exclusive with quiche, exposes TS_HAS_OPENSSL_QUIC, and shares ATS's existing HTTP/3 stream handling above the transport. This also installs native-QUIC TLS callbacks for ALPN and SNI certificate selection before ATS has a QUIC NetVC to bind. OpenSSL native QUIC does not make a selected SSL_CTX certificate active via SSL_set_SSL_CTX alone, so this applies the selected cert, key, and chain to the connection SSL. This also broadens client-side HTTP/3 tests to run with either backend, keeps H3 streams open across informational responses, and hardens transaction cleanup when OpenSSL closes stream state before ATS finishes teardown. This caches stream identifiers, declines listener-time QUIC tickets until a NetVC is bound, and adds focused H3 lifecycle and session-ticket coverage. | 1 个月前 | |
Make code buildable with AWS-LC (#11219) * Make code buildable with AWS-LC * Add CheckOpenSSLIsAwsLc.cmake * Add cmakedefine for HAVE_SSL_GET_SHARED_CURVE * Revert an unnecessary name change * Fix a build condition for HKDF | 2 年前 | |
cmake: Add a check for BoringSSL version (#10949) | 2 年前 | |
Don't make boringssl mandatory when QUIC & quiche is enabled/used. (#10672) * Don't make boringssl mandatory when QUIC is enabled. If selected lirbary is openssl and quiche is enabled, then we make sure that the openssl version passed supports quic. * Add warning to let users known that a special quictls version is needed to build with quictls. | 2 年前 | |
Add QMux support (HTTP/3 over TLS/TCP) (#13465) * Add QMux support (HTTP/3 over TLS/TCP) HTTP/3 requires UDP, which is blocked or degraded on many networks. QMux carries QUIC stream multiplexing over a TLS/TCP connection so HTTP/3 can be served where UDP is unavailable. Server side only. The transport is abstracted behind the existing QUICConnection and QUICStreamIO interfaces, so HTTP/3 session and application handling is reused unchanged. QMux is offered via ALPN "h3qx-01" on TLS ports. The two transports are now selected independently of the QUIC backend. ENABLE_QUIC carries QUIC over UDP and defaults to on whenever a backend is available; ENABLE_QMUX carries it over TLS/TCP and defaults to off. Either can be enabled without the other, and QMux requires quiche built with qmux support. * Report QMux build support AuTests need a stable feature flag to skip QMux coverage when ATS is built without the optional transport. This exposes TS_USE_QMUX through traffic_layout alongside the existing QUIC and TLS feature flags. * Add QMux Go client AuTest QMux needs an interoperable client test to prove that HTTP/3 can run over TLS/TCP and proxy multiple transactions with request and response bodies. This adds a class-based AuTest with a qmux-go client and Proxy Verifier origin. The client sends three transactions on one session, verifies forwarded headers and bodies, and checks a 300-kilobyte response byte for byte. Compatibility shims cover qmux-go v0.2.0 wire gaps. * Resume QMux reads across buffer blocks A partial QMux record at the end of the 32 KB input buffer prevents TLS from reading the rest of the record, stalling larger request bodies. Set the input watermark to the maximum QMux record size so the buffer can append a block and complete records that span block boundaries. * Address copilot comments * Reclaim QMux connection VIOs after Http3App construction Http3App's constructor runs the generic ProxySession start-up (HQSession::start()), which claims the netvc's read/write VIOs for itself. Moving qmux_con->start() before that construction, to address an earlier review comment about the app racing the transport bridge, let that claim win instead of QMuxConnection's, silently disabling QMux's connection-level I/O and crashing on the first subsequent write. Construct the app, reclaim the VIOs for QMuxConnection right after, then start the app. This keeps the app from generating stream I/O before the transport is wired up while ensuring QMuxConnection ends up owning the VIOs it depends on. * Flush qmux transport params before checking established streams is_established() for qmux mode is qmux_transport_params_sent && qmux_transport_params_received. _handle_write() checked it before _flush_quiche_output(), which is what can flip sent to true. On the call where establishment completes this way, a stream already queued (e.g. the HTTP/3 control stream) missed its flush window, and nothing else was guaranteed to trigger another one -- if the peer waits on that stream before sending anything further, both sides stall until idle timeout. Flush once before the streams check when not yet established, so a transition to established within this call is visible to it. * Default ENABLE_QMUX to AUTO when quiche has qmux support ENABLE_QUICHE is a plain ON/OFF option with no AUTO state, so building with quiche never turned QMux on by itself -- ENABLE_QMUX had its own hardcoded OFF default regardless of whether the linked quiche was built with qmux support. This was the one auto_option() in the QUIC/QMux chain that didn't actually auto-detect anything, unlike ENABLE_OPENSSL_QUIC's AUTO default. quiche.h always declares quiche_config_enable_qmux() regardless of whether the library was actually built with the qmux feature, so detecting support requires a real compile-and-link check against quiche::quiche, not a header-only one -- CheckQuicheHasQmux.cmake mirrors CheckOpenSSLHasNativeQuic.cmake's shape for this reason. * Remove ENABLE_OPENSSL_QUIC; fix premature QUIC backend status message ENABLE_OPENSSL_QUIC gated a capability of the mandatory OpenSSL dependency behind its own ON/OFF/AUTO option, unlike every other OpenSSL capability check in this file (SSLLIB_IS_BORINGSSL, SSLLIB_HAS_QUIC_TLS_CBS, etc.), which are plain detected variables with no option of their own. Since OpenSSL is always linked regardless, and OpenSSL-native QUIC and quiche are mutually exclusive by TLS-library requirement (quiche needs BoringSSL or the TLS callback compat shim, neither of which implements the upstream-OpenSSL-3.5+ native QUIC API), the flag never actually selected between two live backends -- disabling it had the same effect as disabling the QUIC transport outright via ENABLE_QUIC, just through a separate, asymmetric path that left a misleading "Using OpenSSL native QUIC" status line and no warning when the backend was flagged available but nothing was configured to serve it. TS_HAS_OPENSSL_QUIC is now set directly from the same detection logic, folded into the other capability checks already living in this file. The "Using ... QUIC transport" status message moves to after auto_option(QUIC ...) decides TS_USE_QUIC, so it reflects what's actually enabled rather than what's merely detected. * Close QMux connections immediately on a fatal quiche_conn_recv() error quiche_conn_recv() returning anything other than QUICHE_ERR_DONE means quiche has already classified the received bytes as an unrecoverable per-connection protocol violation and started its own internal close/drain sequence internally (every non-Done error path in recv_qmux() calls self.close() before returning) -- it is never used to mean "incomplete record, wait for more bytes" in this quiche fork (both incomplete-header and incomplete-record cases are mapped to QUICHE_ERR_DONE explicitly). _handle_read() previously only logged this case and left the connection to be caught by the next scheduled quiche_conn_on_timeout() tick, which notices via quiche_conn_is_closed(). That works, but lingers for up to the connection's drain timeout doing nothing useful, and leaves the now-unparseable bytes sitting in the read buffer for that whole window. Calling close_quic_connection() immediately reaches the same end state without the wait: quiche_conn_close() is a safe no-op here since quiche already set its own close reason internally, and the pending CLOSE frame gets flushed to the peer right away instead of on the next natural write event. --------- Co-authored-by: bneradt <bneradt@yahooinc.com> | 1 个月前 | |
Add ENABLE_CLANG_TIDY option (#11077) * Add ENABLE_CLANG_TIDY option * Include from top CMakeLists.txt * Fix format * Trim semi-colon at the end | 2 年前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
redo_cache_lookup: move to examples; fix `fallback` lifetime (#13209) The redo_cache_lookup plugin kept the fallback URL as a pointer into the plugin.config argv storage. That storage can be released after plugin initialization, leaving cache-lookup-complete callbacks to dereference stale memory. This copies the parsed fallback URL into plugin-owned storage and passes its owned bytes to TSHttpTxnRedoCacheLookup. Also, while investigating this, it looks like this plugin was made simply to demonstrate the use of TSHttpTxnRedoCacheLookup rather than being a production-useful plugin. The initial commit says as much and there is no customer-facing documentation for this plugin. As such, I'm moving this to the examples plugin. | 2 个月前 | |
Add support for TLS Certificate Compression (RFC 8879) (#13088) New settings: proxy.config.ssl.server.cert_compression.algorithms proxy.config.ssl.client.cert_compression.algorithms proxy.config.ssl.server.cert_compression.cache is going to be added on next PR. New metrics: proxy.process.ssl.cert_compress.<alg> proxy.process.ssl.cert_compress.<alg>_failure proxy.process.ssl.cert_decompress.<alg> proxy.process.ssl.cert_decompress.<alg>_failure | 4 个月前 | |
Revert "cmake: detect FreeBSD's native cap with capsicum (#12859)" (#12915) This reverts commit cc9fa72965e61e6e81294f727237941087e79f0a. | 6 个月前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
Add logic to allow for external libswoc to be used (#10780) add alias | 2 年前 | |
cmake/Findluajit: don't require luajit_LIBRARY_DIRS for rockylinux builds (#10977) | 2 年前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
Add auto options for maxmind_acl, stek_share, and uri_signing plugins (#10741) This helps clean up the dependency management and gives fine grained control over whether these plugins are built. I am planning to add all the experimental plugins, but I want to get these changes in quickly because we are still in the middle of fixing the plugins, and other PRs can build on these changes. BUILD_EXPERIMENTAL_PLUGINS determines whether these plugins are OFF or AUTO on the first configuration. Changing the value of BUILD_EXPERIMENTAL_PLUGINS subsequently will not change whether those plugins are built, because their enabled/disabled state is cached separately. I have not come up with a good way to fix this. Suggestions welcome. | 2 年前 | |
otel build update for GCC 15 (#12180) When building the opentelemetry plugin against GCC 15, we get a warning from a deprecated use of ciso646 in the library. No version of opentelemetry-cpp currently addresses this. The `-Wno-cpp` silences that warning. Here is the warning, for reference: ``` In file included from /opt/include/opentelemetry/nostd/internal/absl/base/options.h:73, from /opt/include/opentelemetry/nostd/internal/absl/base/config.h:66, from /opt/include/opentelemetry/nostd/internal/absl/types/variant.h:45, from /opt/include/opentelemetry/nostd/variant.h:52, from /opt/include/opentelemetry/common/attribute_value.h:10, from /opt/include/opentelemetry/sdk/trace/recordable.h:6, from /opt/include/opentelemetry/sdk/trace/exporter.h:9, from /opt/include/opentelemetry/exporters/otlp/otlp_http_exporter.h:7, from /home/bneradt/src/ts_edge/plugins/experimental/otel_tracer/tracer_common.h:18, from /home/bneradt/src/ts_edge/plugins/experimental/otel_tracer/otel_tracer.cc:40: /usr/include/c++/15/ciso646:46:4: error: #warning "<ciso646> is deprecated in C++17, use <version> to detect implementation-specific macros" [-Werror=cpp] 46 | # warning "<ciso646> is deprecated in C++17, use <version> to detect implementation-specific macros" | ^~~~~~~ ``` | 1 年前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
HTTP/3 support via OpenSSL 3.5 (#13186) * HTTP/3 via OpenSSL 3.5 + quiche Fedora now ships OpenSSL 3.5 with the third-party QUIC TLS callback API, but quiche still links against the older quictls/BoringSSL symbols. ATS therefore could not use the system OpenSSL library for downstream HTTP/3 without dragging in a different TLS stack. This adds CMake detection for the OpenSSL callback API and provides a private compatibility layer that maps quiche's legacy hooks onto SSL_set_quic_tls_cbs. This requires static quiche in that mode so ATS resolves the shim symbols locally and links the final binaries against the system OpenSSL libraries. This also relaxes verifier-only HTTP/3 AuTest gates that do not execute curl, so those tests can run when ATS has QUIC support but the installed curl lacks HTTP/3. Unknown unidirectional HTTP/3 stream types and aliased frame-type interests also exposed gaps in shared H3 handling. This discards ignored stream data and de-duplicates handler registration so buffered input does not grow indefinitely and MAX_PUSH_ID handlers run once. * HTTP/3 via OpenSSL QUIC OpenSSL 3.5 can terminate QUIC connections directly, but ATS only had a quiche-backed HTTP/3 listener. Operators who want to use the system OpenSSL QUIC stack needed a separate downstream backend without changing the existing quiche path or origin HTTP/3 scope. This adds an optional ENABLE_OPENSSL_QUIC backend that uses OpenSSL's native QUIC listener and stream APIs for downstream HTTP/3. This keeps the backend mutually exclusive with quiche, exposes TS_HAS_OPENSSL_QUIC, and shares ATS's existing HTTP/3 stream handling above the transport. This also installs native-QUIC TLS callbacks for ALPN and SNI certificate selection before ATS has a QUIC NetVC to bind. OpenSSL native QUIC does not make a selected SSL_CTX certificate active via SSL_set_SSL_CTX alone, so this applies the selected cert, key, and chain to the connection SSL. This also broadens client-side HTTP/3 tests to run with either backend, keeps H3 streams open across informational responses, and hardens transaction cleanup when OpenSSL closes stream state before ATS finishes teardown. This caches stream identifiers, declines listener-time QUIC tickets until a NetVC is bound, and adds focused H3 lifecycle and session-ticket coverage. | 1 个月前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
Fix Findunwind.cmake on RHEL (#11001) Fix change in #10811 intended for Ubuntu that caused build issues on RHEL. | 2 年前 | |
Fix compilation problem with wasm plugin + Update the use of proxy-wasm library (#12222) * Fix compilation problem with wasm plugin * Fix format error * Fix format error * Fix format error in cmake files * Fix engine requirement problem * Remove wamr fro fedora build for now * Fix fedora compile requirements * Turn off wamr engine support for experimental plugin * Fix typo * Fix another missing line * Enable wamr * Disable wamr because the fedora has an older version * wasmtime and wamr cannot be used together | 1 年前 | |
Fix compilation problem with wasm plugin + Update the use of proxy-wasm library (#12222) * Fix compilation problem with wasm plugin * Fix format error * Fix format error * Fix format error in cmake files * Fix engine requirement problem * Remove wamr fro fedora build for now * Fix fedora compile requirements * Turn off wamr engine support for experimental plugin * Fix typo * Fix another missing line * Enable wamr * Disable wamr because the fedora has an older version * wasmtime and wamr cannot be used together | 1 年前 | |
Fix compilation problem with wasm plugin + Update the use of proxy-wasm library (#12222) * Fix compilation problem with wasm plugin * Fix format error * Fix format error * Fix format error in cmake files * Fix engine requirement problem * Remove wamr fro fedora build for now * Fix fedora compile requirements * Turn off wamr engine support for experimental plugin * Fix typo * Fix another missing line * Enable wamr * Disable wamr because the fedora has an older version * wasmtime and wamr cannot be used together | 1 年前 | |
Updates to allow verify plugin tests to run without install (#11889) * Updates to allow verify plugin tests to run without install - Add option to skip verify tests - Add `preinit` flag option to `-C` command to run the command before TS fully initializes * Fix autest since diags.log isnt created now --------- Co-authored-by: Chris McFarlen <cmcfarlen@apple.com> | 1 年前 | |
Add a per client connection max exempt list cript (#12476) This updates our build system to be able to make pre-compiled cripts. Thus, adding a cript is now as easy as adding a plugin. Simply use add_cript instead of add_atsplugin in CMakeLists.txt, and it will build your cript for you. As a part of this, this adds connection_exempt_list.cript, our first cript plugin that sets the per client exempt list. | 8 个月前 | |
Add optional way to extend the build (#11487) * Add ext dir and option to extend the build to add plugins or cripts bundles * cleanup * Check for CMakeLists.txt and warn if not found --------- Co-authored-by: Chris McFarlen <cmcfarlen@apple.com> | 2 年前 | |
Add automatic detection of ccache for cmake (#9720) | 3 年前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 | |
Cleanup rc/trafficserver to use layout (#12118) Co-authored-by: Chris McFarlen <cmcfarlen@apple.com> | 1 年前 | |
magick.so: explicitly reference wand/core libraries (#11183) | 2 年前 | |
cmake: small fixes to install (#10945) * cmake: small fixes to install * fix post install command * Install yaml-cpp if the build uses the internal version --------- Co-authored-by: Chris McFarlen <cmcfarlen@apple.com> | 2 年前 | |
Fall back to the build directory when GIT_COMMON_DIR is unset (#13497) Requiring GIT_COMMON_DIR made configure fatal in trees where git cannot resolve a common directory, such as a source export without .git or a worktree mapped into a container without the paths its .git file points at. Nothing about proxy-verifier needs that directory specifically; it is only a convenient cache shared across worktrees of one clone. Introduce PV_DEST_DIR, set from GIT_COMMON_DIR when available and the build directory otherwise, and use it for the download and extraction. | 1 个月前 | |
Run cmake-format on .cmake files (#10764) I updated our format scripts earlier to run cmake-format on CMakeLists.txt files, but forgot to add in our .cmake files. This fixes that oversight. | 2 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 2 年前 | ||
| 2 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 个月前 | ||
| 4 个月前 | ||
| 6 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 3 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 个月前 | ||
| 2 年前 |