Edward Wang

This commit **fixes a bug** in the **HTTP/1.1 server protocol** within `pingora-core` by **correcting the `body_bytes_sent` metric**. Previously, this metric incorrectly included response header bytes, leading to an overestimation of actual body data sent. The change ensures that the `body_bytes_sent` count accurately **excludes response header bytes**, specifically impacting the `write_response_header` logic. A new test case has been added to validate this correction, improving the **accuracy of data transfer statistics** for v1 sessions.

This commit **enhances documentation** within the **HTTP/1 server protocol** implementation in `pingora-core`. Specifically, new comments are added to the `read_body_or_idle` function in `pingora-core/src/protocols/http/v1/server.rs` to clarify the intricate behavior of the `abort_on_close` mechanism. These explanations detail how the server handles half-closed connections and the associated 'pend' state, providing crucial context for connection management. This **maintenance** update improves code clarity and aids future developers in understanding complex connection termination logic.

This commit introduces a **new feature** by integrating the **proxy task API** into the **HTTP/2** (`proxy_h2.rs`) and **custom proxy handling** (`proxy_custom.rs`) modules within `pingora-proxy`. This integration specifically enables and improves the handling of **cache-served downstream writes**, allowing data retrieved from a cache to be efficiently sent to the client. The `pingora-core` module is updated to support this by modifying `has_pending_proxy_tasks` to check for active writers, ensuring proper task management across the system. This enhancement streamlines task processing for these critical proxy types, improving overall performance and functionality.

This commit introduces a **new feature** that enables the **cancel-safe proxy task API** to be toggled on a **per-session basis**. It adds a new function, `set_proxy_tasks_enabled`, to the `pingora-core` HTTP server and `pingora-proxy` session contexts, allowing granular control over this API's behavior for individual HTTP/1 sessions. This enhancement provides greater flexibility, enabling dynamic activation or deactivation of the proxy task API based on specific session requirements or request characteristics. The `supports_proxy_task_api` function in `pingora-core` was updated to respect this new per-session state, and testing utilities were modified to demonstrate conditional enabling via request headers.

This commit introduces a **new capability** by adding a cancel-safe proxy task API for **HTTP/1.x server sessions** within `pingora-core`. It provides core functions like `send_downstream_proxy_task` and `write_downstream_proxy_tasks` to manage these tasks efficiently, ensuring robust handling of downstream proxy operations. The new API is then exposed and integrated into the **`pingora-proxy`** crate, allowing proxy filters to leverage this enhanced task management. Additionally, the change includes **refactoring** to remove `dead_code` attributes and updates tests to verify flush behavior for cancel-safe body and header writing in HTTP/1.x.

This commit **fixes a hang issue** in the **`pingora-core` HTTP/1 client protocol** by adjusting the `init_body_reader` logic to prevent its initialization for **HEAD requests** that receive **1xx informational responses**. Previously, this incorrect initialization could prematurely end the stream, causing downstream services to hang while waiting for a body that would never arrive. New test cases have been added in `pingora-proxy` to validate the correct behavior for HEAD requests with `100 Continue` responses, ensuring **improved reliability** in HTTP communication.

This commit **fixes** a regression in the **Sentry error reporting** mechanism within `pingora-core/src/server` that occurred after daemonization. It **refactors** the Sentry initialization logic, primarily in `bootstrap_services.rs`, to correctly re-initialize Sentry post-fork by retaining the client guard and preserving options during the `Bootstrap::start_sentry` process. The change also removes the dedicated `SentryInitService` from `mod.rs`, integrating Sentry setup directly into the server's run method. This ensures that **Sentry error reporting** functions reliably for daemonized `pingora-core` instances, preventing lost error reports.

This commit introduces a **new feature** that enables configuration of Tokio's blocking thread pool within the Pingora server. It adds `max_blocking_threads` and `blocking_threads_ttl_seconds` to the `ServerConf` struct in `pingora-core`, allowing administrators to specify these parameters. The `pingora-runtime` module is updated to include `BlockingPoolOpts` and modify `RuntimeBuilder` to apply these new settings during runtime construction. This enhancement provides greater control over server resource management and performance for operations that require blocking threads.

This commit introduces a **new feature** to the **`pingora-proxy`** that allows for dynamic adjustment of **upstream processing modules** after receiving the upstream response headers. A new `adjust_upstream_modules` async method is added to the `ProxyHttp` trait, enabling custom logic to modify module behavior, such as compression, before they process the response body. This capability is integrated across HTTP/1.1, HTTP/2, and custom proxy implementations, and is **feature-gated** for optional use. The change enhances the proxy's request processing pipeline with greater flexibility for context-aware response handling, and is fully documented in the user guide.

This commit **refactors** the **`pingora-cache`** crate to make its tracing functionality an **optional feature**. By introducing a `trace` feature flag in `pingora-cache/Cargo.toml`, the tracing dependencies and code are now conditionally compiled, providing no-op shims when the feature is disabled. This **maintenance** change allows users to opt-out of tracing, reducing binary size and compilation overhead for applications that do not require detailed cache tracing. The optional `trace` feature is also propagated to the **`pingora-proxy`** and top-level **`pingora`** crates, enabling more granular control over dependencies across the project.

This commit **updates the development dependency** for `prometheus` in the `pingora` crate from version 0.13 to 0.14. This **maintenance** task ensures that the **build system** and **testing environment** leverage the latest features and fixes from the `prometheus` library. The `.bleep` file is also updated to reflect this dependency change. This update is confined to **development and testing environments** and does not affect the production runtime or core functionality of `pingora`.

This commit **refactors** the **`pingora-proxy`** to leverage a **new proxy task API** for **cache-served H1 downstream writes**, enabling **concurrent upstream polling** while serving the downstream. This **feature implementation** in `proxy_h1.rs` significantly **improves performance** by allowing upstream cache writes to continue even if the downstream connection is slow or stalled. Concurrently, `proxy_common.rs` receives a **bug fix** to refine `DownstreamStateMachine` transitions, ensuring the `Errored` state is terminal and cannot be overwritten, enhancing the proxy's robustness. New tests in `pingora-proxy/tests` validate the improved caching behavior, specifically for stalled downstream connections, while `proxy_h2.rs` is updated with TODOs indicating future integration for H2.

This commit introduces **new cancel-safe writing primitives** for the **HTTP/1.x protocol** within `pingora-core`, enhancing its robustness for asynchronous operations. It adds a `BodyWriter` API, including tasks like `send_body_task` and `write_current_body_task`, for resilient body data transmission, and a `HeaderWriter` for similar cancel-safe header writes. These new capabilities are specifically designed to work reliably within `tokio::select!` loops, preventing issues from task cancellation or interleaving. Additionally, new stream writing primitives `poll_write_vec_all_buf` and `poll_write_all_buf` are added to `pingora-core/src/protocols/l4/stream.rs` to support these new writers. This significantly improves the resilience and flexibility of HTTP/1.x communication within the core library.

This commit **fixes a bug** where **peer-specific options** were not consistently applied during **ALPN fallbacks** from HTTP/2 to HTTP/1, or when initializing HTTP/1 sessions directly. It ensures that options like `allow_h1_response_invalid_content_length` are correctly honored by **HTTP/1 client sessions** within the `pingora-core` connectors. The change introduces a `new_with_options` function for HTTP/1 session creation and refactors existing HTTP/1 and HTTP/2 connectors to utilize it, thereby improving the reliability and predictability of **HTTP connection behavior** when dealing with protocol downgrades. Additionally, documentation for the `allow_h1_response_invalid_content_length` option is updated to clarify its legacy nature and potential future removal.

This commit implements a **bug fix** within the **Pingora core** to address an issue where **HTTP/1.1** and **subrequest upgrade handling** could fail if the request body was not initialized. Previously, this could lead to premature connection closure; the fix ensures the body reader is correctly initialized in `pingora-core/src/protocols/http/v1/server.rs` and `pingora-core/src/protocols/http/subrequest/server.rs`. This prevents improper early termination of upgraded connections, improving the reliability of protocols like **WebSockets**, and includes a new test case for WebSocket data during upgrades.

This commit introduces a **critical fix** to the **HTTP/2 connector** in `pingora-core` by adding robust file descriptor (FD) and socket mismatch checks to its **session reuse logic**. Specifically, it ensures that a `reused_http_session` is only utilized if its underlying socket matches the expected file descriptor, preventing potential data corruption or misrouting due to incorrect connection reuse. This **enhances the reliability and security** of HTTP/2 connections by preventing accidental session hijacking or data leakage. Additionally, a new test case was added to `pingora-core/src/connectors/http/v1.rs` to confirm that HTTP/1.1 session reuse correctly handles FD mismatches.

This commit introduces a **behavioral change** to the `pingora-proxy` module by **disabling `CONNECT` method proxying by default**. A new `allow_connect_method_proxying` field has been added to `HttpServerOptions` in `pingora-core`, providing an explicit option to re-enable this functionality. Consequently, the `handle_request` function in `pingora-proxy` will now automatically reject `CONNECT` requests unless explicitly allowed via server options, enhancing default security. New tests have been added to `pingora-proxy` to verify both the default rejection and the explicit allowance of `CONNECT` proxying for HTTP/1 and HTTP/2.

This commit introduces a **fix** to the **`pingora-core` HTTP/1 server** by implementing stricter validation for incoming requests. It **rejects HTTP requests** that declare a `Transfer-Encoding` header but do not use the `chunked` mechanism, preventing potential protocol ambiguities or vulnerabilities. This **security hardening measure**, primarily affecting the `read_request` function in `pingora-core/src/protocols/http/v1/server.rs`, ensures better adherence to HTTP/1 specifications and improves the overall **robustness and security** of the server's request parsing.

This commit **updates the CI/CD configuration** to enhance the reliability of security audits. It modifies the `cargo generate-lockfile` command in both the `.github/workflows/audit.yml` and `.github/workflows/build.yml` files to include the `--ignore-rust-version` flag. This **maintenance chore** prevents audit failures caused by discrepancies between the CI's Rust toolchain and the project's Minimum Supported Rust Version (MSRV). By ignoring the Rust version during lockfile generation, the **security audit process** can proceed without interruption, ensuring continuous vulnerability scanning.

This commit **fixes a critical bug** in the **Pingora proxy module** where `UpgradedBody` was incorrectly bypassed by upstream response body filters and downstream modules, ensuring proper processing of all response types. Concurrently, it **introduces a new feature** enabling the **caching of `UpgradedBody` responses**, such as WebSocket 101 upgraded connections. This enhancement affects the core **proxy logic**, **HTTP/1 and HTTP/2 protocol handling**, and the **proxy caching subsystem**, improving both the correctness of filter application and the performance of upgraded connections by allowing them to be served from cache.