Wait for CONNECT origin handshakes - #13512
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes an explicit proxy CONNECT edge case where ATS could respond 200 before the nonblocking origin TCP handshake completed, causing refused ports to appear as a successful tunnel followed by client-side write failures. The change makes ATS wait for origin write-readiness before confirming CONNECT success, and adds an AuTest to prevent regressions.
Changes:
- Delay CONNECT success signaling until the raw origin connection reports write readiness (handshake complete).
- Propagate raw origin connection failures (including timeouts / refused ports) back to the client as an error response.
- Add a new Proxy Verifier replay + AuTest for “refused origin port” CONNECT behavior.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src/proxy/http/HttpSM.cc |
Wait for write readiness on raw origin connections before reporting CONNECT success; close/clean up properly on failures. |
tests/gold_tests/connect/connect_handshake.test.py |
Adds an AuTest that exercises CONNECT to a deliberately-unavailable origin port and expects 502. |
tests/gold_tests/connect/replays/connect_handshake.replay.yaml |
Proxy Verifier replay asserting ATS returns 502 for refused origin connections. |
Explicit proxy CONNECT requests can return 200 before the nonblocking origin connection finishes. A refused origin port then looks like a successful tunnel followed by a client-side write failure. This patch waits for write readiness on raw origin connections before sending the CONNECT response. It reports connection failures to the client and adds an AuTest covering a refused origin port. Fixes: apache#7677
bneradt
force-pushed
the
wait-for-connect-handshake
branch
from
August 10, 2026 23:10
b7e566b to
9620c09
Compare
serrislew
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explicit proxy CONNECT requests can return 200 before the
nonblocking origin connection finishes. A refused origin port then
looks like a successful tunnel followed by a client-side write failure.
This patch waits for write readiness on raw origin connections before
sending the CONNECT response. It reports connection failures to the
client and adds an AuTest covering a refused origin port.
Fixes: #7677
Verification
The new
connect_handshakeAuTest reserves an origin-server port butdeliberately does not start the server. A standalone Proxy Verifier client
then sends a CONNECT request through ATS and expects ATS to report the
refused origin connection with a
502.Before this fix, the test reproduced the issue with:
After the fix,
connect_handshakepasses. The fullconnect*AuTest set(7 tests) and
tls_tunnelalso pass in theasfats5container.