Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions CHANGELOG-9.0.0
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@ Changes with Apache Traffic Server 9.0.0
#4927 - Cleanup: Convert HTTPHdr::length_get to real method.
#4928 - Pull Age out of the gold test
#4931 - For tls tests look at logs until config has been reloaded
#4933 - Plugin Traffic Dump: new feature for setting limit on disk usage.
#4933 - Plugin Traffic Dump: new feature for setting limit on disk usage.
#4935 - Use the appropriate length field for uintmax_t
#4938 - Fix client_hello_cb to correctly check for sufficient server_name data
#4940 - ats_scoped_str: c++17 cleanup.
Expand Down Expand Up @@ -407,7 +407,7 @@ Changes with Apache Traffic Server 9.0.0
#5258 - Adds cache alternate update tests
#5259 - Fixed cache RWW test crash
#5261 - Fixed pthread mutex init issue with cache test
#5262 - JA3 fingerprint: Corrected usage of OpenSSL API for ec and ecpf list retrieval.
#5262 - JA3 fingerprint: Corrected usage of OpenSSL API for ec and ecpf list retrieval.
#5264 - Fix reason tag of traffic_ctl host
#5265 - Fix IntrusiveHashMap active bucket list corruption issue during expansion.
#5266 - Ignore unsupported HTTP/2 settings parameters
Expand Down Expand Up @@ -498,7 +498,7 @@ Changes with Apache Traffic Server 9.0.0
#5414 - Add API and fix logic for TS_SSL_VERIFY_*_HOOK.
#5415 - MemSpan: Update to templated style, fix gcc9 compile error.
#5416 - Move setsockopt from UnixNetProcessor to Server::setup_fd_for_listen
#5417 - Change HostStatus to use only one stat per host.
#5417 - Change HostStatus to use only one stat per host.
#5420 - Adds update header only test case
#5421 - Check nullptr before call netvc->do_io_close in SSLNextProtocolAccept::mainEvent
#5423 - This fixes parsing where the [ ] section gets merged into values
Expand Down Expand Up @@ -638,7 +638,7 @@ Changes with Apache Traffic Server 9.0.0
#5704 - Add dest addr information to incoming UDPPacket objects
#5705 - Make TSVConnInacitivityTimeoutCancel work as expected.
#5706 - Add optional normalization of scheme and host to lower case letters in effective URLs.
#5707 - JA3: append to the last dub if X-JA3-Sig/X-JA3-RAW exist
#5707 - JA3: append to the last dub if X-JA3-Sig/X-JA3-RAW exist
#5710 - Convert regression tests for XPACK into Catch based unit tests
#5711 - Fix client transaction stats
#5714 - Add a required library to "Getting Started" docs
Expand Down
2 changes: 1 addition & 1 deletion doc/admin-guide/configuration/proxy-protocol.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ TLS connections.

.. note::

The current version only supports transforming client IP from PROXY Version 1
The current version only supports transforming client IP from PROXY Version 1
header to the Forwarded: header.

In the current implementation, the client IP address in the PROXY protocol header
Expand Down
2 changes: 1 addition & 1 deletion doc/admin-guide/files/sni.yaml.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ client_key The file containing the client private key that corres
|TS| tries to use a private key in client_cert. Otherwise,
:ts:cv:`proxy.config.ssl.client.private_key.filename` is used.

http2 Indicates whether the H2 protocol should be added to or removed from the
http2 Indicates whether the H2 protocol should be added to or removed from the
protocol negotiation list. The valid values are :code:`on` or :code:`off`.

disable_h2 Deprecated for the more general h2 setting. Setting disable_h2
Expand Down
4 changes: 2 additions & 2 deletions doc/admin-guide/logging/formatting.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -205,9 +205,9 @@ ctid Client Request Client Transaction ID, a non-negative number for a transact
which is different for all currently-active transactions on the
same client connection. For client HTTP/2 transactions, this
value is the stream ID for the transaction.
ctpw Client Request Client Transaction Priority Weight, the priority weight for the
ctpw Client Request Client Transaction Priority Weight, the priority weight for the
underlying HTTP/2 protocol.
ctpd Client Request Client Transaction Priority Dependence, the transaction ID that
ctpd Client Request Client Transaction Priority Dependence, the transaction ID that
the current transaction depends on for HTTP/2 priority logic.
===== ============== ==================================================================

Expand Down
3 changes: 1 addition & 2 deletions doc/admin-guide/plugins/ja3_fingerprint.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ effective way to detect malicious clients even when superficial details are modi
JA3 is available `here <https://github.com/salesforce/ja3>`__.

The calculated JA3 fingerprints are then appended to upstream request in the field ``X-JA3-Sig``
(to be processed at upstream). If multiple duplicates exist for the field name, it will append to the last
(to be processed at upstream). If multiple duplicates exist for the field name, it will append to the last
occurrence; if none exists, it will add such a field to the headers. The signatures can also be logged locally.

Plugin Configuration
Expand Down Expand Up @@ -72,4 +72,3 @@ API changes with regard to opaque structures.
There is a potential issue with very old TLS clients which can cause a crash in the plugin. This is
due to a `bug in OpenSSL <https://github.com/openssl/openssl/pull/8756>`__ which should be fixed in
a future release.

4 changes: 2 additions & 2 deletions doc/admin-guide/plugins/slice.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
Expand Down
17 changes: 8 additions & 9 deletions doc/admin-guide/plugins/ssl_session_reuse.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
SSL Session Reuse Plugin
************************

This plugin coordinates session state data between ATS instances running in a group. This should
This plugin coordinates session state data between ATS instances running in a group. This should
improve TLS session reuse (both ticket and ID based) for a set of machines fronted by some form of
layer 4 connection load balancer.

Expand All @@ -31,14 +31,14 @@ How It Works

The plugin coordinates TLS session reuse for both Session ID based resumption and ticket based resumption.
For Session ID base resumption in uses the ATS SSL Session Cache for the local store of TLS sessions. It uses
Redis to communication new sessions with its peers. When a new session is seen by an ATS instances it
Redis to communication new sessions with its peers. When a new session is seen by an ATS instances it
publishes an encrypted copy of the session state to the local Redis channel. When a new session is received
on the Redis channel, the plugin stores that session state into its local ATS SSL session cache. Once the
session state is in the local ATS SSL session cache it is available to the openssl library for future TLS
session state is in the local ATS SSL session cache it is available to the openssl library for future TLS
handshakes.

For the ticket based session resumption, the plugin implements logic to decide on a Session Ticket Encryption Key (STEK)
master. The master will periodically create a new STEK key and use the Redis channel to publish the new STEK key
master. The master will periodically create a new STEK key and use the Redis channel to publish the new STEK key
to the other ATS boxes in the group. When the plugin starts up, it will publish a Redis message requesting the master to
resend the STEK key. The plugin uses the TSSslTicketKeyUpdate call to update ATS with the last two STEK's it has received.

Expand All @@ -48,7 +48,7 @@ reuse must have access to that preshared key.
Building
========

This plugin uses Redis for communication. The hiredis client development library must be installed
This plugin uses Redis for communication. The hiredis client development library must be installed
for this plugin to build. It can be installed in the standard system location or the install location
can be specified by the --with-hiredis argument to configure.

Expand All @@ -59,8 +59,8 @@ Deploying
=========

The SSL Session Reuse plugin relies on Redis for communication. To deploy build your own redis server or use a standard rpm
package. It must be installed on at least one box in the ATS group. We have it installed on two boxes in a failover
scenario. The SSL Session Reuse configuration file describes how to communicate with the redis servers.
package. It must be installed on at least one box in the ATS group. We have it installed on two boxes in a failover
scenario. The SSL Session Reuse configuration file describes how to communicate with the redis servers.

* :ts:cv:`proxy.config.ssl.session_cache` should be set to 2 to enable the ATS implementation of session cache
* :ts:cv:`proxy.config.ssl.session_cache.size` and :ts:cv:`proxy.config.ssl.session_cache.num_buckets` may need to be adjusted to ensure good hash table performance for your workload. For example, we needed to increase the number of buckets to avoid long hash chains.
Expand All @@ -70,7 +70,7 @@ scenario. The SSL Session Reuse configuration file describes how to communicate
Config File
===========

SSL Session Reuse is a global plugin. Its configuration file is given as a argument to the plugin.
SSL Session Reuse is a global plugin. Its configuration file is given as a argument to the plugin.

* redis.RedisEndpoints - This is a comma separated list of Redis servers to connect to. The description of the redis server may include a port
* redis.RedisConnectTimeout - Timeout on the redis connect attempt in milliseconds.
Expand All @@ -91,4 +91,3 @@ Example Config File
===================

.. literalinclude:: ../../../plugins/experimental/ssl_session_reuse/example_config.config

5 changes: 2 additions & 3 deletions doc/developer-guide/api/functions/TSContCall.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -51,11 +51,11 @@ If there is a mutex associated with :arg:`contp`, :func:`TSContCall` assumes tha
value returned by the handler in :arg:`contp`.

If :arg:`contp` has a mutex, the plugin must acquire the lock on the mutex for :arg:`contp` before calling
:func:`TSContCall`. See :func:`TSContMutexGet` and :func:`TSMutexLockTry` for mechanisms for doing this.
:func:`TSContCall`. See :func:`TSContMutexGet` and :func:`TSMutexLockTry` for mechanisms for doing this.

The most common case is the code called by :func:`TSContCall` must complete before further code is executed
at the call site. An alternative approach to handling the locking directly would be to split the call site
into two continuations, one of which is signalled (possibly via :func:`TSContCall`) from the original
into two continuations, one of which is signalled (possibly via :func:`TSContCall`) from the original
:func:`TSContCall` target.

Note mutexes returned by :func:`TSMutexCreate` are recursive mutexes, therefore if the lock is
Expand All @@ -69,4 +69,3 @@ shareable so that the same mutex can be used for multiple continuations.::
In this example case, :code:`cont1` can assume the lock for :code:`cont2` is held. This should be
considered carefully because for the same reason any thread protection between the continuations is
removed. This works well for tightly coupled continuations that always operate in a fixed sequence.

6 changes: 2 additions & 4 deletions doc/developer-guide/api/functions/TSVConnReenable.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -68,8 +68,6 @@ An extended version of TSVConnEnable that allows the plugin to return a status t
the core logic. If all goes well this is TS_EVENT_CONTINUE. However, if
the plugin wants to stop the processing it can set the event to TS_EVENT_ERROR.

For example, in the case of the TS_SSL_VERIFY_SERVER_HOOK, the plugin make decide the
origin certificate is bad. By calling TSVonnReenable with TS_EVENT_ERROR, the
For example, in the case of the TS_SSL_VERIFY_SERVER_HOOK, the plugin make decide the
origin certificate is bad. By calling TSVonnReenable with TS_EVENT_ERROR, the
certificate check will error and the TLS handshake will fail.


Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ Synopsis
Description
===========

Get the TSSslVerifyCTX object that corresponds to the certificates being verified for the SSL connection
Get the TSSslVerifyCTX object that corresponds to the certificates being verified for the SSL connection
corresponding to :arg:`svc`.

This value is only meaningful during the peer certificate verification callbacks, specifically during callbacks
Expand Down
2 changes: 1 addition & 1 deletion doc/developer-guide/layout/runroot.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ Work flow:
#. Look in current directory and look up N (default 4) directories for ``runroot.yaml``
#. Look in executable directory and look up N directories for ``runroot.yaml``.
#. ``$TS_ROOT`` Environment Variable
#. Compiler defaults in layout class
#. Compiler defaults in layout class

Right now, the following programs are integrated with the runroot logic:
**traffic_server**, **traffic_manager**, **traffic_ctl**, **traffic_layout**, **traffic_crashlog**, **traffic_logcat**, **traffic_logstat**.
Expand Down
2 changes: 1 addition & 1 deletion doc/developer-guide/plugins/remap-plugins.en.rst
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ notifications like :func:`TSRemapPreConfigReload` and :func:`TSRemapPostConfigRe

Instead of trying to foresee the needs or the expectations of each use-case, a more "open-ended"
and straight-forward design was chosen for the configuration reload notifications.
The notifications are broadcast to all loaded plugins at the moments before and after
The notifications are broadcast to all loaded plugins at the moments before and after
the reload attempt, regardless of whether a plugin is part of the new configuration or not.

:func:`TSRemapPreConfigReload` is called *before* the parsing of a new remap configuration starts
Expand Down
13 changes: 6 additions & 7 deletions example/plugins/lua-api/connect_geoip.lua
Original file line number Diff line number Diff line change
Expand Up @@ -14,23 +14,22 @@
-- See the License for the specific language governing permissions and
-- limitations under the License.


-- This example depends on "luajit-geoip".
-- It illustrates how to connect to GeoIP and use it to look up country of an IP address.
-- It can be used in plugin.config with the lua plugin.

-- Setup Instructions
-- 1) install GeoIP - 1.6.12
-- 2) install GeoIP legacy country database - https://dev.maxmind.com/geoip/legacy/install/country/
-- 3) install luajit-geoip (https://github.com/leafo/luajit-geoip)
-- or just copy geoip/init.lua from the repo to /usr/local/share/lua/5.1/geoip/init.lua
-- 4) You may need to make change so luajit-geoip does ffi.load() on /usr/local/lib/libGeoIP.so
-- 3) install luajit-geoip (https://github.com/leafo/luajit-geoip)
-- or just copy geoip/init.lua from the repo to /usr/local/share/lua/5.1/geoip/init.lua
-- 4) You may need to make change so luajit-geoip does ffi.load() on /usr/local/lib/libGeoIP.so

ts.add_package_path('/usr/local/share/lua/5.1/?.lua')
ts.add_package_path("/usr/local/share/lua/5.1/?.lua")

local geoip = require 'geoip'
local geoip = require "geoip"

function do_global_send_response()
local res = geoip.lookup_addr("8.8.8.8")
ts.client_response.header['X-Country'] = res.country_code
ts.client_response.header["X-Country"] = res.country_code
end
17 changes: 8 additions & 9 deletions example/plugins/lua-api/connect_redis.lua
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,9 @@
-- See the License for the specific language governing permissions and
-- limitations under the License.


-- This example depends on "redis-lua" 2.0.4 - https://github.com/nrk/redis-lua
-- And redis-lua depends on LuaSocket v3.0-rc1 - https://github.com/diegonehab/luasocket
-- It illustrates how to connect to redis and retrieve a key value.
-- It illustrates how to connect to redis and retrieve a key value.
-- It can be used in plugin.config with the lua plugin.

-- unix domain socket has better performance and so we should set up local redis to use that
Expand All @@ -31,19 +30,19 @@
-- 6. sudo -u nobody redis-server /etc/redis/redis.conf
-- 7. sudo -u nobody redis-cli -s /var/run/redis/redis.sock set mykey helloworld

ts.add_package_cpath('/usr/local/lib/lua/5.1/socket/?.so;/usr/local/lib/lua/5.1/mime/?.so')
ts.add_package_path('/usr/local/share/lua/5.1/?.lua;/usr/local/share/lua/5.1/socket/?.lua')
ts.add_package_cpath("/usr/local/lib/lua/5.1/socket/?.so;/usr/local/lib/lua/5.1/mime/?.so")
ts.add_package_path("/usr/local/share/lua/5.1/?.lua;/usr/local/share/lua/5.1/socket/?.lua")

local redis = require 'redis'
local redis = require "redis"
-- not connecting to redis default port
-- local client = redis.connect('127.0.0.1', 6379)

-- connecting to unix domain socket
local client = redis.connect('unix:///var/run/redis/redis.sock')
local client = redis.connect("unix:///var/run/redis/redis.sock")

function do_global_send_response()
local response = client:ping()
local value = client:get('mykey')
ts.client_response.header['X-Redis-Ping'] = tostring(response)
ts.client_response.header['X-Redis-MyKey'] = value
local value = client:get("mykey")
ts.client_response.header["X-Redis-Ping"] = tostring(response)
ts.client_response.header["X-Redis-MyKey"] = value
end
30 changes: 17 additions & 13 deletions example/plugins/lua-api/sorted_query_params.lua
Original file line number Diff line number Diff line change
Expand Up @@ -14,40 +14,44 @@
-- See the License for the specific language governing permissions and
-- limitations under the License.


-- This script is for sorting query parameters on incoming requests before doing cache lookup
-- so we can get better cache hit ratio
-- It can be used in remap.config for a remap rule with the lua plugin.

function pairsByKeys (t, f)
function pairsByKeys(t, f)
local a = {}
for n in pairs(t) do table.insert(a, n) end
for n in pairs(t) do
table.insert(a, n)
end
table.sort(a, f)
local i = 0 -- iterator variable
local iter = function () -- iterator function
local i = 0 -- iterator variable
local iter = function()
-- iterator function
i = i + 1
if a[i] == nil then return nil
else return a[i], t[a[i]]
if a[i] == nil then
return nil
else
return a[i], t[a[i]]
end
end
return iter
end

function do_remap()
t = {}
s = ts.client_request.get_uri_args() or ''
t = {}
s = ts.client_request.get_uri_args() or ""
-- Original String
i = 1
for k, v in string.gmatch(s, "([0-9a-zA-Z-_]+)=([0-9a-zA-Z-_]+)") do
t[k] = v
end

output = ''
output = ""
for name, line in pairsByKeys(t) do
output = output .. '&' .. name .. '=' .. line
output = output .. "&" .. name .. "=" .. line
end
output = string.sub(output, 2)
-- Modified String
-- Modified String
ts.client_request.set_uri_args(output)
return 0
end
end
41 changes: 20 additions & 21 deletions example/plugins/lua-api/uncompress.lua
Original file line number Diff line number Diff line change
Expand Up @@ -14,39 +14,38 @@
-- See the License for the specific language governing permissions and
-- limitations under the License.


-- This example depends on "lua-zlib".
-- This example depends on "lua-zlib".
-- It uncompresses a gzipped content body and prints it out in debug log.
-- It can be added in remap.config for a remap rule with the lua plugin.

-- Setup Instructions
-- 1) install lua-zlib - v1.2

ts.add_package_cpath('/usr/lib/lua/5.1/?.so')
ts.add_package_cpath("/usr/lib/lua/5.1/?.so")

local zlib = require "zlib"

function upper_transform(data, eos)
ts.ctx['text'] = ts.ctx['text'] .. data

if eos ==1 then
local stream = zlib.inflate()
local inflated, eof, bytes_in, bytes_out = stream(ts.ctx['text'])
if (eof == true) then
ts.debug("==== eof ====")
end
ts.debug("==== bytes_in: "..(bytes_in or ''))
ts.debug("==== bytes_out:"..(bytes_out or ''))
ts.debug("==== uncompressed data begin ===")
ts.debug(inflated or 'no data')
ts.debug("==== uncompressed data end ===")
end
ts.ctx["text"] = ts.ctx["text"] .. data

return string.upper(data), eos
if eos == 1 then
local stream = zlib.inflate()
local inflated, eof, bytes_in, bytes_out = stream(ts.ctx["text"])
if (eof == true) then
ts.debug("==== eof ====")
end
ts.debug("==== bytes_in: " .. (bytes_in or ""))
ts.debug("==== bytes_out:" .. (bytes_out or ""))
ts.debug("==== uncompressed data begin ===")
ts.debug(inflated or "no data")
ts.debug("==== uncompressed data end ===")
end

return string.upper(data), eos
end

function do_remap()
ts.hook(TS_LUA_RESPONSE_TRANSFORM, upper_transform)
ts.ctx['text'] = ''
return 0
ts.hook(TS_LUA_RESPONSE_TRANSFORM, upper_transform)
ts.ctx["text"] = ""
return 0
end
Loading