Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix cache config for https origins #6091

Merged
merged 1 commit into from
Aug 13, 2021

Conversation

rob05c
Copy link
Member

@rob05c rob05c commented Aug 6, 2021

Fixes cache config for https origins.

There was a bug, that https origins would result in edge remap targets of https://... and corresponding edge parent lines of port=443 and corresponding mid remap sources of https:// ... 443.

Except that Edge-Mid communication has always been HTTP, and the Mid parents are :80, and Mids are listening on 80, and Mids don't have the certificates necessary to serve HTTPS.

So that config resulted in Edges making TLS HTTPS requests to the Mid's port 80. Which should fail, but seems to sometimes succeed, possibly due to Keep-Alives from other requests.

This fixes HTTPS Origins to properly use http://...:80 remaps everywhere. We would like to add internal HTTPS support in the future, but that's a much larger feature. Today, ATC doesn't support that. Moreover, that shouldn't depend on whether the Origin is HTTPS.

The correct bug fix here is to use http and 80 for internal cache communication, regardless of the origin protocol.

Which this fix does.

Includes tests.
Includes changelog.
No docs, no interface change.

Which Traffic Control components are affected by this PR?

  • Traffic Control Cache Config (T3C, formerly ORT)

What is the best way to verify this PR?

Run tests. Generate config with an HTTPS Origin on a Delivery Service that uses mids, verify config is generated to properly use http and port 80 for all internal edge-mid communication.

If this is a bugfix, which Traffic Control versions contained the bug?

Probably all of them.

PR submission checklist

@rob05c rob05c added bug something isn't working as intended cache-config Cache config generation labels Aug 6, 2021
@rob05c rob05c added this to the 6.0.0 milestone Aug 13, 2021
Copy link
Contributor

@traeak traeak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This works for the simple delivery service case, although there remains a parent.config entry for https (in addition to http) on the edge.
Sadly this doesn't seem to work for the MSO case. There doesn't seem to be a way to mark a server as priority https and trying to change the dummy origin to https didn't seem to do anything.

Update: cleaned things out, rebuilt t3c package again and this time the parent.config for the edge looks good.

@rob05c
Copy link
Member Author

rob05c commented Aug 13, 2021

Sadly this doesn't seem to work for the MSO case. There doesn't seem to be a way to mark a server as priority https and trying to change the dummy origin to https didn't seem to do anything.

It doesn't add the ability to HTTPS MSO, no. That'll take more work (which is on our short list FWIW).

But it should make MSO correctly use http for edge--mid communication, even if the MSO DS OrgServerFQDN field is https (which I think is a bug regardless of MSO, and I think this fixes for both non-MSO and MSO).

This works for the simple delivery service case, although there remains a parent.config entry for https (in addition to http) on the edge.

I'm looking into this now. I don't think it breaks anything, but it's definitely not ideal. I'll try to find and fix.

@mitchell852 mitchell852 merged commit 9a96b60 into apache:master Aug 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug something isn't working as intended cache-config Cache config generation
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants