jax_fingerprint: Address user arg slot exhaustion#13082
Merged
bneradt merged 1 commit intoapache:masterfrom Apr 10, 2026
Merged
jax_fingerprint: Address user arg slot exhaustion#13082bneradt merged 1 commit intoapache:masterfrom
bneradt merged 1 commit intoapache:masterfrom
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes ATS user-arg slot exhaustion when loading multiple jax_fingerprint.so instances by sharing a single user-arg slot per container type (vconn / txn) and storing per-method JAxContext objects in a shared ContextMap.
Changes:
- Rework user-arg handling to reserve one shared slot per type and multiplex contexts by method name via
ContextMap. - Update close-hook cleanup to remove per-method context and delete the shared map when empty.
- Add a gold test + replay YAML that loads JA3/JA4/JA4H simultaneously and verifies all fingerprint headers are produced.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/gold_tests/pluginTest/jax_fingerprint/jax_fingerprint.test.py | Adds an “all methods loaded” integration test run. |
| tests/gold_tests/pluginTest/jax_fingerprint/jax_fingerprint_all_methods.replay.yaml | New replay verifying all method headers are present on a TLS request. |
| plugins/experimental/jax_fingerprint/userarg.h | Adds cleanup API declaration (currently duplicated). |
| plugins/experimental/jax_fingerprint/userarg.cc | Implements shared-slot reservation and ContextMap-backed set/get/cleanup. |
| plugins/experimental/jax_fingerprint/plugin.cc | Switches close handlers to the new cleanup function. |
| plugins/experimental/jax_fingerprint/context_map.h | New shared map container keyed by method name. |
bneradt
force-pushed
the
jax-user-arg-exhaustion-fix-asf
branch
from
0002ae0 to
ff9dd8e
Compare
When multiple jax_fingerprint.so instances are loaded (e.g., one per fingerprinting method), each instance was reserving its own user arg slot. ATS has a limited number of slots (~4 per type), causing methods like JA3 and JA4 to fail silently when slots were exhausted. Solution: Share a single user arg slot per type (TS_USER_ARGS_VCONN or TS_USER_ARGS_TXN) across all jax_fingerprint instances. A ContextMap stores JAxContext instances keyed by method name.
bneradt
force-pushed
the
jax-user-arg-exhaustion-fix-asf
branch
from
ff9dd8e to
1483538
Compare
maskit
approved these changes
Apr 10, 2026
Contributor
|
Cherry-picked to 10.2.x |
cmcfarlen
pushed a commit
that referenced
this pull request
Apr 15, 2026
When multiple jax_fingerprint.so instances are loaded (e.g., one per fingerprinting method), each instance was reserving its own user arg slot. ATS has a limited number of slots (~4 per type), causing methods like JA3 and JA4 to fail silently when slots were exhausted. Solution: Share a single user arg slot per type (TS_USER_ARGS_VCONN or TS_USER_ARGS_TXN) across all jax_fingerprint instances. A ContextMap stores JAxContext instances keyed by method name. (cherry picked from commit 1541fb2)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When multiple jax_fingerprint.so instances are loaded (e.g., one per fingerprinting method), each instance was reserving its own user arg slot. ATS has a limited number of slots (~4 per type), causing methods like JA3 and JA4 to fail silently when slots were exhausted.
Solution: Share a single user arg slot per type (TS_USER_ARGS_VCONN or TS_USER_ARGS_TXN) across all jax_fingerprint instances. A ContextMap stores JAxContext instances keyed by method name.