Repository navigation
Conversation
The custom HTTP/2 origin in h2_to_origin_safe_retry closed its socket as soon as it finished with a connection, and two races made retry scenarios fail with a 502 when the machine was busy. When the origin closed a connection that still held unread input, usually the SETTINGS ACK that ATS sends after the request, the kernel reset the connection and the response the origin had just written never reached ATS. The goaway, goaway-reserved, goaway-drain-above and early-rst retries failed this way. The origin now half-closes and reads until ATS closes before it closes the socket. The early-rst origin also closes its connection right after the reset. ATS can take that session back from the pool for the retry before it reads the close, and it then correctly declines to replay a POST written to a connection that closed without a response. That scenario now disables session sharing, so its retry always opens a new connection.
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
2 open findings
What changed in this PR
Stabilizes the h2_to_origin_safe_retry autest by updating the test origin’s connection teardown to avoid Linux RST-on-close behavior and by forcing the early-rst scenario to avoid reusing a just-closed origin session.
Changes:
- Add a “half-close + drain reads” connection-finisher in
safe_retry_origin.pyand run it on a background thread so the origin can accept retry connections promptly. - Update the early-rst test configuration to disable origin session reuse via
server_session_sharing.match = none.
| File | Description |
|---|---|
| tests/gold_tests/h2/safe_retry_origin.py | Drain/finish TLS connections safely and asynchronously to prevent spurious resets during retries. |
| tests/gold_tests/h2/h2_to_origin_safe_retry.test.py | Ensure early-rst retries always use a fresh origin connection to avoid “closed-before-read” reuse. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Copilot stopped reviewing on behalf of
bryancall due to an error
October 13, 2026 23:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
h2_to_origin_safe_retry, added in #13447, fails now and then in autest shard 1of4, usually with a 502 to the client. The failures come from how the test's Python origin,safe_retry_origin.py, ends its connections, not from ATS.The origin closed its socket as soon as it wrote its last frame. ATS often has a SETTINGS ACK in flight at that point, and closing a socket that still holds unread input makes Linux reset the connection, which can drop the response the origin just wrote. The goaway, goaway-reserved, goaway-drain-above and early-rst retries failed this way on a busy machine. The origin now shuts down its sending side and reads until ATS closes before it closes the socket. It does this on a background thread so it can still accept the new connection ATS opens for a retry.
The early-rst origin also closes its connection right after the reset. ATS can take that session back from the pool for the retry before it reads the close, and it then correctly declines to replay a POST written to a connection that closed without a response. That scenario now sets
server_session_sharing.matchtonone, so its retry always opens a new connection. The other scenarios keepipmatching and still cover a retry on a reused connection.Testing: in the
ci.trafficserver.apache.org/ats/fedora:44image, with 32 copies of the test running in parallel, master failed 39 of 640 runs on one machine, and 135 of 800 on a second machine with CPU load added. With this change it failed 0 of 640 and 0 of 800, although ATS admitted the early-rst retry before reading the origin's close in 596 and 437 of those runs. To check that the test still catches a broken retry, I built ATS so it never admits a not-processed retry. The changed test failed on that build in all 4 runs, on the same 12 checks as the original test.