Skip to content

redo_cache_lookup: move to examples; fix fallback lifetime#13209

Open
bneradt wants to merge 1 commit into
apache:masterfrom
bneradt:fix-redo-cache-lookup-fallback-uaf-asf
Open

redo_cache_lookup: move to examples; fix fallback lifetime#13209
bneradt wants to merge 1 commit into
apache:masterfrom
bneradt:fix-redo-cache-lookup-fallback-uaf-asf

Conversation

@bneradt
Copy link
Copy Markdown
Contributor

@bneradt bneradt commented May 28, 2026

The redo_cache_lookup plugin kept the fallback URL as a pointer into the plugin.config argv storage. That storage can be released after plugin initialization, leaving cache-lookup-complete callbacks to dereference stale memory.

This copies the parsed fallback URL into plugin-owned storage and passes its owned bytes to TSHttpTxnRedoCacheLookup.

Also, while investigating this, it looks like this plugin was made simply to demonstrate the use of TSHttpTxnRedoCacheLookup rather than being a production-useful plugin. The initial commit says as much and there is no customer-facing documentation for this plugin. As such, I'm moving this to the examples plugin.

The redo_cache_lookup plugin kept the fallback URL as a pointer into
the plugin.config argv storage. That storage can be released after
plugin initialization, leaving cache-lookup-complete callbacks to
dereference stale memory.

This copies the parsed fallback URL into plugin-owned storage and
passes its owned bytes to TSHttpTxnRedoCacheLookup.

Also, while investigating this, it looks like this plugin was made
simply to demonstrate the use of TSHttpTxnRedoCacheLookup rather than
being a production-useful plugin. The initial commit says as much and
there is no customer-facing documentation for this plugin. As such, I'm
moving this to the examples plugin.
@bneradt bneradt added this to the 11.0.0 milestone May 28, 2026
@bneradt bneradt self-assigned this May 28, 2026
Copilot AI review requested due to automatic review settings May 28, 2026 21:43
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a lifetime bug in the redo_cache_lookup plugin by moving fallback URL storage into plugin-owned memory (avoiding pointers into plugin.config argv storage), and rehomes the plugin from plugins/experimental/ to example/plugins/c-api/ as an example of using TSHttpTxnRedoCacheLookup.

Changes:

  • Moved redo_cache_lookup from experimental plugins to the C-API examples and removed the experimental build option.
  • Copied the configured --fallback URL into owned storage and used it when calling TSHttpTxnRedoCacheLookup.
  • Added Catch2 unit tests for configuration parsing to ensure the fallback URL is copied.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
plugins/experimental/redo_cache_lookup/redo_cache_lookup.cc Removed the experimental plugin implementation (now moved to examples).
plugins/experimental/redo_cache_lookup/README.md Removed experimental plugin README (superseded by example readme).
plugins/experimental/redo_cache_lookup/CMakeLists.txt Removed experimental plugin build definition.
plugins/experimental/CMakeLists.txt Stopped including the removed experimental plugin directory.
cmake/ExperimentalPlugins.cmake Removed BUILD_REDO_CACHE_LOOKUP option.
example/plugins/c-api/redo_cache_lookup/redo_cache_lookup.cc New example plugin using C API and plugin-owned fallback storage.
example/plugins/c-api/redo_cache_lookup/redo_cache_lookup_config.h Added config parsing helper for --fallback / -f.
example/plugins/c-api/redo_cache_lookup/readme.txt Added example usage documentation.
example/plugins/c-api/redo_cache_lookup/unit_tests/test_redo_cache_lookup_config.cc Added unit tests verifying fallback URL parsing/copy semantics.
example/plugins/c-api/CMakeLists.txt Builds the new example plugin and its unit test under BUILD_TESTING.

Comment on lines +53 to +57
if (TSHttpTxnCacheLookupStatusGet(txnp, &status) != TS_SUCCESS || status == TS_CACHE_LOOKUP_MISS ||
status == TS_CACHE_LOOKUP_SKIPPED) {
Dbg(dbg_ctl, "rewinding to check for fallback url: %s", config->fallback.c_str());
TSHttpTxnRedoCacheLookup(txnp, config->fallback.c_str(), static_cast<int>(config->fallback.size()));
}
Comment on lines +88 to +89
TSCont contp = TSContCreate(handle_cache_lookup_complete, nullptr);
TSContDataSet(contp, new RedoCacheLookupConfig(*fallback));
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants