Skip to content

redo_cache_lookup: move to examples; fix fallback lifetime - #13209

Merged
bneradt merged 1 commit into
apache:masterfrom
bneradt:fix-redo-cache-lookup-fallback-uaf-asf
Jun 23, 2026
Merged

redo_cache_lookup: move to examples; fix fallback lifetime#13209
bneradt merged 1 commit into
apache:masterfrom
bneradt:fix-redo-cache-lookup-fallback-uaf-asf

Conversation

@bneradt

@bneradt bneradt commented May 28, 2026

Copy link
Copy Markdown
Contributor

The redo_cache_lookup plugin kept the fallback URL as a pointer into the plugin.config argv storage. That storage can be released after plugin initialization, leaving cache-lookup-complete callbacks to dereference stale memory.

This copies the parsed fallback URL into plugin-owned storage and passes its owned bytes to TSHttpTxnRedoCacheLookup.

Also, while investigating this, it looks like this plugin was made simply to demonstrate the use of TSHttpTxnRedoCacheLookup rather than being a production-useful plugin. The initial commit says as much and there is no customer-facing documentation for this plugin. As such, I'm moving this to the examples plugin.

The redo_cache_lookup plugin kept the fallback URL as a pointer into
the plugin.config argv storage. That storage can be released after
plugin initialization, leaving cache-lookup-complete callbacks to
dereference stale memory.

This copies the parsed fallback URL into plugin-owned storage and
passes its owned bytes to TSHttpTxnRedoCacheLookup.

Also, while investigating this, it looks like this plugin was made
simply to demonstrate the use of TSHttpTxnRedoCacheLookup rather than
being a production-useful plugin. The initial commit says as much and
there is no customer-facing documentation for this plugin. As such, I'm
moving this to the examples plugin.
@bneradt bneradt added this to the 11.0.0 milestone May 28, 2026
@bneradt bneradt self-assigned this May 28, 2026
Copilot AI review requested due to automatic review settings May 28, 2026 21:43

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a lifetime bug in the redo_cache_lookup plugin by moving fallback URL storage into plugin-owned memory (avoiding pointers into plugin.config argv storage), and rehomes the plugin from plugins/experimental/ to example/plugins/c-api/ as an example of using TSHttpTxnRedoCacheLookup.

Changes:

  • Moved redo_cache_lookup from experimental plugins to the C-API examples and removed the experimental build option.
  • Copied the configured --fallback URL into owned storage and used it when calling TSHttpTxnRedoCacheLookup.
  • Added Catch2 unit tests for configuration parsing to ensure the fallback URL is copied.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
plugins/experimental/redo_cache_lookup/redo_cache_lookup.cc Removed the experimental plugin implementation (now moved to examples).
plugins/experimental/redo_cache_lookup/README.md Removed experimental plugin README (superseded by example readme).
plugins/experimental/redo_cache_lookup/CMakeLists.txt Removed experimental plugin build definition.
plugins/experimental/CMakeLists.txt Stopped including the removed experimental plugin directory.
cmake/ExperimentalPlugins.cmake Removed BUILD_REDO_CACHE_LOOKUP option.
example/plugins/c-api/redo_cache_lookup/redo_cache_lookup.cc New example plugin using C API and plugin-owned fallback storage.
example/plugins/c-api/redo_cache_lookup/redo_cache_lookup_config.h Added config parsing helper for --fallback / -f.
example/plugins/c-api/redo_cache_lookup/readme.txt Added example usage documentation.
example/plugins/c-api/redo_cache_lookup/unit_tests/test_redo_cache_lookup_config.cc Added unit tests verifying fallback URL parsing/copy semantics.
example/plugins/c-api/CMakeLists.txt Builds the new example plugin and its unit test under BUILD_TESTING.

Comment on lines +53 to +57
if (TSHttpTxnCacheLookupStatusGet(txnp, &status) != TS_SUCCESS || status == TS_CACHE_LOOKUP_MISS ||
status == TS_CACHE_LOOKUP_SKIPPED) {
Dbg(dbg_ctl, "rewinding to check for fallback url: %s", config->fallback.c_str());
TSHttpTxnRedoCacheLookup(txnp, config->fallback.c_str(), static_cast<int>(config->fallback.size()));
}
Comment on lines +88 to +89
TSCont contp = TSContCreate(handle_cache_lookup_complete, nullptr);
TSContDataSet(contp, new RedoCacheLookupConfig(*fallback));
@zwoop
zwoop self-requested a review May 29, 2026 17:12
@bneradt

bneradt commented Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

[approve ci autest]

@apache apache deleted a comment from bneradt Jun 5, 2026
@bryancall
bryancall requested a review from cmcfarlen June 8, 2026 22:50
@bneradt
bneradt merged commit 468e764 into apache:master Jun 23, 2026
15 checks passed
@bneradt
bneradt deleted the fix-redo-cache-lookup-fallback-uaf-asf branch June 23, 2026 17:58
cmcfarlen pushed a commit to cmcfarlen/trafficserver that referenced this pull request Jul 29, 2026
…13209)

The redo_cache_lookup plugin kept the fallback URL as a pointer into
the plugin.config argv storage. That storage can be released after
plugin initialization, leaving cache-lookup-complete callbacks to
dereference stale memory.

This copies the parsed fallback URL into plugin-owned storage and
passes its owned bytes to TSHttpTxnRedoCacheLookup.

Also, while investigating this, it looks like this plugin was made
simply to demonstrate the use of TSHttpTxnRedoCacheLookup rather than
being a production-useful plugin. The initial commit says as much and
there is no customer-facing documentation for this plugin. As such, I'm
moving this to the examples plugin.
cmcfarlen pushed a commit to cmcfarlen/trafficserver that referenced this pull request Jul 29, 2026
…13209)

The redo_cache_lookup plugin kept the fallback URL as a pointer into
the plugin.config argv storage. That storage can be released after
plugin initialization, leaving cache-lookup-complete callbacks to
dereference stale memory.

This copies the parsed fallback URL into plugin-owned storage and
passes its owned bytes to TSHttpTxnRedoCacheLookup.

Also, while investigating this, it looks like this plugin was made
simply to demonstrate the use of TSHttpTxnRedoCacheLookup rather than
being a production-useful plugin. The initial commit says as much and
there is no customer-facing documentation for this plugin. As such, I'm
moving this to the examples plugin.

(cherry picked from commit 468e764)
@cmcfarlen cmcfarlen moved this to Picked v10.2.0 in ATS v10.2.x Jul 29, 2026
@cmcfarlen cmcfarlen modified the milestones: 11.0.0, 10.2.0 Jul 29, 2026
@github-project-automation github-project-automation Bot moved this from Picked v10.2.0 to For v10.2.0 in ATS v10.2.x Jul 29, 2026
@cmcfarlen cmcfarlen moved this from For v10.2.0 to Picked v10.2.0 in ATS v10.2.x Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Picked v10.2.0

Development

Successfully merging this pull request may close these issues.

3 participants