| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Fix AIO callback from_api completion lifetime (#13151) The AIOCallback io_complete handler used a member variable, from_api, to determine whether to delete itself. The problem is that in the situation where in the course of processing the function `this` was already deleted, the use of the from_api variable was, by definition, a use after free. If built under ASan, this resulted in a use-after-free assertion. Concretely, we were seeing this in docs during cache stripe initialization after an unclean shutdown. If the on-disk cache directory was dirty, startup recovery scanned the data area, cleared directory entries for the uncertain range, and wrote the repaired directory back out. The temporary AIO callbacks for that recovery wrote live in StripeInitInfo. When the recovery write completion was delivered, StripeSM::handle_recover_write_dir() deleted StripeInitInfo, which destroyed the AIOCallback object whose AIOCallback::io_complete() frame was still returning. At that point, the use of from_api was a use after free. This snapshots the API-owned callback flag before dispatching the completion and uses that local value for the post-callback cleanup. This also adds a focused regression test for completion handlers that release the callback owner before AIOCallback::io_complete() returns. Introduced in #13027 | 3 个月前 | |
Add S3-FIFO RAM cache eviction algorithm (ram_cache.algorithm = 2) (#13255) * Add S3-FIFO RAM cache eviction algorithm (ram_cache.algorithm = 2) S3-FIFO (Yang et al., SOSP 2023) is a FIFO-based eviction policy: a small admission queue and a main queue (a 2-bit clock), plus a ghost queue of recently evicted keys. The small queue and ghost filter one-hit-wonders, giving scan resistance and strong hit rates on CDN and key-value workloads at low cost -- a hit needs no list reordering. Selectable as ram_cache.algorithm = 2 alongside CLFUS (0) and LRU (1). The policy is byte-budgeted; its eviction metadata (the ghost included, bounded by object size and an entry-count cap) is accounted within ram_cache.size so total memory stays within the configured budget. Like LRU and CLFUS it enforces one resident copy per key (a put with a new aux key discards the stale one) and allocates entries from a per-thread ProxyAllocator (Thread.h). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fix ghost capacity calculation truncation order Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Make S3-FIFO RAM cache tunables configurable via records.yaml The S3-FIFO queue split, ghost bounds, and promotion threshold were compile-time constants. Expose them as proxy.config.cache.ram_cache.s3fifo.{main_percent,ghost_size_percent, ghost_mem_percent,promote_threshold} so operators can tune the policy without a rebuild; the defaults match the paper and the prior behavior. Each setting carries a RECC_INT range in RecordsConfig.cc, so an out-of-range value is rejected at config load with a warning and the documented default is used in its place -- the same guard every other RAM cache record relies on, rather than a bespoke clamp. The admin guide and the ram_cache regression test (a non-default "tuned" pass) are updated to cover the new settings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add entry for S3-FIFO into NOTICE --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> | 2 个月前 | |
ATS Configuration Reload with observability/tracing - Token model (#12892) ATS Configuration Reload with observability/tracing — Token model Replace the fire-and-forget configuration reload mechanism with a new token-based, observable reload framework. Every reload operation is now assigned a unique token, tracked through a task tree, and queryable via CLI or JSONRPC at any point after submission. Core components introduced: - ConfigRegistry: centralized singleton for config file registration, filename records, trigger records, and reload handlers. Replaces the scattered registration across AddConfigFilesHere.cc and individual modules. - ReloadCoordinator: manages reload session lifecycle including token generation, concurrency control (--force to override), timeout detection, and rolling history. - ConfigReloadTask: tracks a single reload as a tree of sub-tasks with per-handler status, timings, and logs. - ConfigContext: lightweight context passed to handlers providing in_progress(), complete(), fail(), log(), supplied_yaml(), and add_dependent_ctx(). Safe no-op at startup when no reload is active. - ConfigReloadProgress: periodic checker that detects stuck tasks and marks them as TIMEOUT. New traffic_ctl commands: - config reload [-m] [-t <token>] [-d @file] [--force] - config status [-t <token>] [-c all] All commands support --format json for automation and CI pipelines. New JSONRPC APIs: - admin_config_reload: unified file-based or inline reload with token, force, and configs parameters. - get_reload_config_status: query reload status by token or get the last N reloads. Migrated config handlers to ConfigRegistry: ip_allow, cache_control, cache_hosting, parent_proxy, split_dns, remap, logging, ssl_client_coordinator (with sni.yaml and ssl_multicert.config as dependencies), ssl_ticket_key, records, and pre-warm. Static configs (storage, volume, plugin, socks, jsonrpc) registered as inventory-only. Removed legacy ConfigUpdateHandler/ConfigUpdateContinuation from ConfigProcessor.h. Removed AddConfigFilesHere.cc in favor of per-module self-registration. Fixed duplicate handler execution for configs with multiple trigger records (e.g. ssl_client_coordinator) by deduplicating against the ConfigReloadTask subtask tree. Added RecFlushConfigUpdateCbs() to synchronously fire pending record callbacks after rereadConfig(), ensuring all subtasks are registered before the first status poll. New configuration records: - proxy.config.admin.reload.timeout (default: 1h) - proxy.config.admin.reload.check_interval (default: 2s) Backward compatible: existing `traffic_ctl config reload` works as before; internally it now uses the new framework with automatic token assignment and tracking. | 5 个月前 | |
Fix intermittent cache unit test segfault in Fedora CI (#13527) The Fedora CI job fails every so often with a SIGSEGV in one of the cache unit tests, always with the same stack: strrchr() called from SourceLocation::str(), from lock_waiting(), from Mutex_trylock(). In DEBUG builds a thread that fails to acquire a mutex reports the holder's srcloc and handler, but those fields belong to whichever thread holds the mutex, and a waiter that just failed to acquire it holds nothing. That read races with the holder publishing the fields on acquire and clearing them in Mutex_unlock(). Because SourceLocation::str() loads file once for valid() and again for strrchr(), and because the clear happens before the mutex is released, a waiter can pass the validity check and then dereference a null file. The cache unit tests are the only ones that enable the locks debug tag, so they are the only ones that reach this code at all. This patch addresses this by reporting the waiting site rather than the holder's. That SourceLocation is a MakeSourceLocation() temporary owned by the caller, so nothing else can mutate it, and a holder snapshot is stale the instant it is taken in any case. The holder is still reported by lock_holding(), which runs from Mutex_unlock() where the caller owns those fields. Fixes: #13524 Co-authored-by: Claude Opus 5 <noreply@anthropic.com> | 26 天前 | |
Fix connect attempt retries (#13102) * Fix connect attempt retries * Fix table format | 2 个月前 | |
clang-format v18 + modified configs (#11285) | 2 年前 | |
Make QUIC connection ID creation explicit (#13519) Default-constructing a QUIC connection ID generates random bytes, even when the value is only a placeholder that will be overwritten. Several generation paths also randomize the same ID a second time. This patch makes empty, decoded, and newly generated IDs explicit. It deletes default construction, adds a checked CSPRNG-backed factory, and adds coverage for the connection ID representation and initialization contract. Fixes: #5504 | 12 天前 | |
Require and call destructors on ClassAllocated objects (#12676) * Update ClassAllocator to require and call destructors on ClassAllocated objects * Cleanup and add HttpSM destructor * The two classes that are now destructed that were previously cleaned up manually are cripts::Context and HttpSM | 9 个月前 |