| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Fixes HRW bridge issues, adds autests to Cripts | 1 个月前 | |
Foundation laid for global Cripts (#11793) * Foundation laid for global Cripts * Try to fix the enumerated and non-enumerated type errors * Added documentation for the global hooks * Fix doc typos, thanks bcall | 1 年前 | |
Adds Cache Groups concepts to Cripts (#12743) * Adds Cache Groups concepts to Cripts - cleans up the notion around cached URLs and headers, and cache keys. - adds APIs to set the lookup status as well * Changes from code review * Address Bryan's review issues WriteToDisk previously updated last_sync and cleared the transaction log before confirming syncMap succeeded. On rename failure the log would be lost even though the map was never written to disk. syncMap now returns bool; WriteToDisk reverts last_sync on failure and only calls clearLog when all dirty slots have been successfully synced. Adds Catch2 unit tests covering basic insert/lookup, persist-and-reload, transaction log replay across restarts, corrupt/truncated/wrong-version map file handling, sync failure log preservation, and map rotation. More unit tests will be done in a future PR. * Address Copilot review comments Add missing standard headers in CacheGroup.cc. Use std::error_code overload for filesystem::remove in syncMap error paths. Add <filesystem> and <system_error> to CacheGroup.hpp. Use fixed-width types in _MapHeader for a stable on-disk format. Fix max_to_process calculation in the sync continuation to spread groups evenly across the sync window. * Address bryancall's review comments Fix sync retry logic: revert last_sync to its previous value on syncMap failure instead of setting it to last_write. The old code made the slot appear clean, preventing retries until a new Insert bumped last_write again. | 5 个月前 | |
Resolve OpenSSL 4.0 build issues (#13476) * Resolve OpenSSL 4.0 build issues - accessors for ASN1_STRING and const-iness * Ran clang-format to fix formatting * Fix X509_NAME_get_index_by_NID const mismatch on OpenSSL 1.1.1 OpenSSL 1.1.1 declares the first argument as non-const while newer releases declare it const, so building against different versions failed depending on which signature was in effect. Add a const_cast at each call site to keep the const-qualified variables introduced by this PR buildable against both, matching the existing precedent in OCSPStapling.cc. * Drop const_cast in favor of auto for local X509_NAME variables X509_get_subject_name and X509_NAME_get_index_by_NID have their argument constness changed together across OpenSSL versions, so a local variable declared with auto tracks whatever type is correct for the OpenSSL version in use, without a cast. This applies only to the two purely local variables; ts_util.cc ssl_value_for keeps its const_cast since its parameter type is shared across multiple callers. * Fix const-cast style and X509_NAME leak flagged by Copilot review X509HostnameValidator.cc cast ASN1_STRING_get0_data return value to non-const before an ats_strndup call that only wants const char *; drop the const instead of adding it back needlessly. certifier.cc leaked the duplicated X509_NAME on the X509_NAME_add_entry_by_txt failure path, and never checked X509_NAME_dup for allocation failure. * Make Cripts X509 accessors OpenSSL-4-compatible CertBase::X509Value took hardcoded function pointer types for X509_get_subject_name, X509_get_issuer_name, X509_getm_notBefore, and X509_getm_notAfter, but those accessors change constness in different directions across OpenSSL versions, so no single hardcoded signature builds everywhere. Deduce the parameter type from the actual accessor via decltype instead. Signature::_load and _write_ip_address also read ASN1_STRING fields directly, which breaks once the struct is opaque; switch to the accessor functions used elsewhere in this codebase. * Fix lua plugin X509_NAME/ASN1_STRING OpenSSL 4 compatibility get_x509_name_string only reads through the name via X509_NAME_print_ex, so accept a const X509_NAME * to match callers that pass X509_get_subject_name/X509_get_issuer_name results directly. get_x509_signature_string read the ASN1_STRING struct fields directly, which breaks once the struct is opaque; use ASN1_STRING_get0_data/ASN1_STRING_length instead. * Fix self-signed test cert losing its CN under OpenSSL 4 make_cert_and_key mutated the X509_NAME returned by X509_get_subject_name in place, which stops compiling once that accessor can return const, and was already fragile since the returned name is only a view into the certificate internal state. Duplicate it, add the CN to the duplicate, and set it back as both subject and issuer name since this is a self-signed certificate. * Fix OpenSSL 4 X509_NAME const mismatches in example plugin and test tool client_context_dump.cc, verify_cert.cc, and ssl_client_verify_test.cc all held X509_get_subject_name/X509_NAME_get_entry/ X509_NAME_ENTRY_get_data results in hardcoded non-const locals or parameters, which stops compiling once those accessors return const. Switch to auto for the local variables and const for the debug_certificate parameter, matching the read-only usage in each case. * Drop last const_cast in txn_box ssl_value_for via a template ssl_value_for is shared by four callers, each already deducing its X509_NAME pointer type with auto from X509_get_subject_name or X509_get_issuer_name, so unlike the other three call sites fixed earlier in this series, a single hardcoded parameter type cannot track the underlying accessor across OpenSSL versions. Templating the parameter on the callers deduced type removes the cast entirely. * Alias the Cripts X509 getter decltypes for readability Bare decltype(&X509_get_subject_name) in a parameter list reads poorly at each of the four call sites; name each getter type once via using so the declarations and out-of-line definitions just say what kind of accessor they take. * Adopt RAII and decltype(func(nullptr)) patterns from PR #13482 certifier.cc freed the duplicated X509_NAME manually on every path; switch to a scoped_X509_NAME unique_ptr matching the file existing scoped_X509/scoped_EVP_PKEY/scoped_SSL_CTX aliases so no path can forget to free it. ts_util.cc templated ssl_value_for just to defer the parameter type to the caller; decltype(X509_get_subject_name(nullptr)) deduces the same pointer type directly without turning it into a template. Also drop the last C-style cast this series introduced in X509HostnameValidator.cc in favor of reinterpret_cast. --------- Co-authored-by: Jered Floyd <jered@redhat.com> | 1 个月前 | |
Add percentage limit for stale cache age (#13547) A fixed stale-age window can let short-lived cached responses remain usable for many times their original freshness lifetime. This makes serving stale content disproportionately risky for responses with a short max-age. This adds an optional percentage limit and applies the smaller of the percentage-based and absolute stale-age windows. The default keeps the existing behavior, while transaction overrides and supported scripting interfaces can opt in per use case. Fixes: #12252 | 23 天前 | |
Cripts: Adds some certificate introspection (#12320) * Cripts: Adds some certificate introspection * Use the Cripts mixin string_view type * Fixes autest for Cripts, and adds some more tests | 1 年前 | |
Rename `OPENSSL_IS_X` -> `OPENSSL_IS_AT_LEAST_X` (#13469) This is for consistency since there is now OpenSSL 4, and we need to add a macro definition for OpenSSL 4 as well. | 1 个月前 | |
cripts: shrink Context from 3408 to 1920 bytes, expand data[] to 16 (#13195) * cripts: shrink Context from 3408 to 1920 bytes, expand data[] to 16 Pimpl Url::Path and Url::Query state behind unique_ptr so the heavy vector/unordered_map/cripts::string members only allocate when a script actually decomposes the path or query. Lazy-allocate Pristine, Parent, and Remap From/To URLs in _UrlBlock — they're rarely all touched, and the embedded 384-byte Url objects dominated the per-txn cost. Pimpl Error::Reason for the same reason. Drop the unused INET6_ADDRSTRLEN buffer in detail::ConnBase. Make cripts::Url's destructor virtual now that we delete via unique_ptr. Bump CONTEXT_DATA_SLOTS from 4 to 16 so scripts have room to stash more per-txn state — the 384-byte cost sits inside the budget freed by the URL/Connection cuts. * Address Copilot's review comments Bounds-check Path::Erase to avoid dereferencing a null _owner when ix is out of range — operator[] returns a default-constructed String in that case, and the subsequent p.operator=("") would then crash inside String::operator=. | 3 个月前 | |
Add const to cripts formatter format functions (#11777) | 1 年前 | |
cripts: fix use-after-free in TSRemapDoRemap | 1 个月前 | |
cripts: shrink Context from 3408 to 1920 bytes, expand data[] to 16 (#13195) * cripts: shrink Context from 3408 to 1920 bytes, expand data[] to 16 Pimpl Url::Path and Url::Query state behind unique_ptr so the heavy vector/unordered_map/cripts::string members only allocate when a script actually decomposes the path or query. Lazy-allocate Pristine, Parent, and Remap From/To URLs in _UrlBlock — they're rarely all touched, and the embedded 384-byte Url objects dominated the per-txn cost. Pimpl Error::Reason for the same reason. Drop the unused INET6_ADDRSTRLEN buffer in detail::ConnBase. Make cripts::Url's destructor virtual now that we delete via unique_ptr. Bump CONTEXT_DATA_SLOTS from 4 to 16 so scripts have room to stash more per-txn state — the 384-byte cost sits inside the budget freed by the URL/Connection cuts. * Address Copilot's review comments Bounds-check Path::Erase to avoid dereferencing a null _owner when ix is out of range — operator[] returns a default-constructed String in that case, and the subsequent p.operator=("") would then crash inside String::operator=. | 3 个月前 | |
Changes all of Cripts to be in cripts:: namespace (#11734) * Changes all of Cripts to be in Cript:: namespace * Changes the namespace to cripts:: | 2 年前 | |
Cripts: Refactor the cache key / URL APIs (#12377) * Cripts: Refactor the cache key / URL APIs - cleans up the notion around cached URLs and headers, and cache keys. - adds APIs to set the lookup status as well * Address review comments | 1 年前 | |
cripts: build against fmt 11+ (incl. 12.x) (#13375) fmt 11 dropped fmt::format/vformat from fmt/core.h; include fmt/format.h instead, and use fmt::format directly to avoid a deprecated format_string conversion. Still builds on fmt 8.1+. | 1 个月前 | |
cripts: build against fmt 11+ (incl. 12.x) (#13375) fmt 11 dropped fmt::format/vformat from fmt/core.h; include fmt/format.h instead, and use fmt::format directly to avoid a deprecated format_string conversion. Still builds on fmt 8.1+. | 1 个月前 | |
Cripts: Refactor the cache key / URL APIs (#12377) * Cripts: Refactor the cache key / URL APIs - cleans up the notion around cached URLs and headers, and cache keys. - adds APIs to set the lookup status as well * Address review comments | 1 年前 | |
Changes all of Cripts to be in cripts:: namespace (#11734) * Changes all of Cripts to be in Cript:: namespace * Changes the namespace to cripts:: | 2 年前 | |
Changes all of Cripts to be in cripts:: namespace (#11734) * Changes all of Cripts to be in Cript:: namespace * Changes the namespace to cripts:: | 2 年前 | |
cripts: build against fmt 11+ (incl. 12.x) (#13375) fmt 11 dropped fmt::format/vformat from fmt/core.h; include fmt/format.h instead, and use fmt::format directly to avoid a deprecated format_string conversion. Still builds on fmt 8.1+. | 1 个月前 | |
Cripts: Refactor the cache key / URL APIs (#12377) * Cripts: Refactor the cache key / URL APIs - cleans up the notion around cached URLs and headers, and cache keys. - adds APIs to set the lookup status as well * Address review comments | 1 年前 | |
HRW: Adds %{INBOUND:SERVER-CERT} and %{INBOUND:CLIENT-CERT} conds (#12363) * Adds a %{CERT} and %{CLIENT-CERT} cond * Moved certificates to INBOUND: condition | 1 年前 | |
Changes all of Cripts to be in cripts:: namespace (#11734) * Changes all of Cripts to be in Cript:: namespace * Changes the namespace to cripts:: | 2 年前 | |
cripts: Fix global Client::URL MLoc leak | 1 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 个月前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 1 个月前 | ||
| 23 天前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 3 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 个月前 |