Ankit Kumar

Add TLS pipeline for fast thrift server Summary: Adds a TLS pipeline for fast thrift server. Adds a TLS handler to the conneciton pipeline which owns the TLS pipeline. Adds PERMITTED mode for TLS. Reviewed By: robertroeser Differential Revision: D106108957 fbshipit-source-id: a2eed2115a251f60ea83bab304342d6802826d1e

Adds TLS support for Fast Thrift Server Summary: Adds TLS support for fast thrift server, which defaults to Required. Reviewed By: robertroeser Differential Revision: D103565194 fbshipit-source-id: 2375933a9ae9d7b1297af5794a321e54638d86df

TLS hot-reload via folly::Observer + mTLS/ticket-cipher parity Summary: Promote the `(fizzContext, thriftParams, handshakeTimeout)` triple into a single immutable `security::TLSParams` aggregate and distribute it pull-based through a `folly::observer::SimpleObservable` owned by `ConnectionManager`. `TLSDetectionHandler` and `FizzHandshakeHandler` store an `Observer<shared_ptr<const TLSParams>>` and snapshot it per accepted connection, so a single `setValue` on the observable replaces the previous per-EVB `setTLSParams` fan-out. In-flight handshakes still survive the swap via the inner `shared_ptr`s they captured at `start()`. `FizzServerCertConfig` gains the knobs needed for parity with classic `apache::thrift::ThriftServer` deployments: mTLS via `caPath` or a caller-supplied `fizz::CertificateVerifier`, a caller-supplied `fizz::Factory`, ALPN policing (`AlpnMode`), AEGIS cipher preference, and `TicketCipherSeeds` (old/current/new rotation, with `IdentityOnly` or `X509` cipher kind). `FizzServerContextBuilder` wires all of those into the produced `fizz::server::FizzServerContext`. `buildTLSParams` is the single entry point and throws synchronously on invalid configuration, so a bad reload leaves the running server untouched. `FastThriftServer::reloadTLSConfig(FizzServerCertConfig)` is the public hot-reload entry point: builds new `TLSParams` outside the lifecycle lock, then publishes via `ConnectionManager::setTLSParams`. Intended for cert / ticket-key rotation driven by an embedder-owned watcher. Reviewed By: robertroeser Differential Revision: D106117173 fbshipit-source-id: db3a42ac37d4e4202397e84e7c258793b4434abd

Integrate write completion tracking into rocket pipeline Summary: This integrates the event based write completion notification into the rocket client and server pipelines. Added tests and benchmarks for this. Reviewed By: robertroeser Differential Revision: D107293277 fbshipit-source-id: 7567f3b473f9b58dddb67f4c1a6733de56a4fcfb

Extend payload variants Summary: Extends payload variants for different types through C++20 concepts to add functions for getRequestRpcMetadata and getResponseRpcMetadata. This will be useful for composite app adapter. Also adds into stream payload struct to the finish the list of structs to be used. Reviewed By: robertroeser Differential Revision: D104758397 fbshipit-source-id: e306229aef432e0c1d312f8f3072ece8cf087522

Switch to a single composed frame Summary: Variant helped us reduce the size of the message to keep it within 120 bytes with some buffer. But as we added more APIs to it, the cost went up. A single ComposedFrame while contains more switch cases to roll through, is a bit more performant on average (with more APIs), and works better with Fragmentation/Defragmentation handlers. Reviewed By: robertroeser Differential Revision: D106331330 fbshipit-source-id: ee9701fc8a945697837d5bbe8dd06c4d6f1ab2a0

Make event dispatch based on event type Summary: This allows handlers to opt-in to certain event types. Events would only be dispatched to handlers that opt-in for them. Event registration is compile time. Reviewed By: robertroeser Differential Revision: D107343886 fbshipit-source-id: 27718994375a8a41715853db325f1e82109fbbd6

Add integration/E2E tests and integration benchmarks for composite Summary: TSIA Reviewed By: robertroeser Differential Revision: D105740990 fbshipit-source-id: bd745f80e37c818ecaa949bfd6dd1f1b100be7fa

Write completion tracking E2E Summary: How write completion works: 1. Transport handler spawns a transport side event 2. Batching handler spawns a batch complete event with number of frames 3. RocketClient handler spawns a per-write complete event with the request context This allows 3 different points of write completion: 1. Transport write done 2. Batch write done 3. Rocket write done One remaining level in this is fragmentation support, which would be added in the next diff. Reviewed By: evanjzou Differential Revision: D109460051 fbshipit-source-id: ad04b6ebfcca5d5bb70c5a08a5cec9e0a883e1f1

Drain in-flight callbacks and notify peer on server stop Summary: `ThriftServerAppAdapter` now gates `Closed` + `closeCallback` on a 1:1 `inFlight_` counter (`++` in `handleRequestResponse`, `--` in `fireResponse`); new `sendConnectionCloseErr()` pushes a stream-0 ERROR(`CONNECTION_CLOSE`) through the pipeline so the client stops sending new requests on graceful shutdown. `FastThriftServer::stop()` EVB-hops `sendConnectionCloseErr()` per connection and blocks on `connectionsDrainedBaton_` until the last in-flight handler completes — no more UAF when an async handler fires after `stop()`. Reviewed By: robertroeser Differential Revision: D105898813 fbshipit-source-id: f9714f360cf20718d6c565e5604a8332a1240a98

Fix lifecycle for thrift client pipelines. Summary: Critical changes: 1. App and transport adapters hold dtor guards on the pipeline to prevent destruction until resetPipeline() is called. 2. Fixed owners to treat client as an extension of app adapter itelf for lifecycle management. 3. Separated connection/disconnection from pipeline destruction. i.e. pipeline->close() is only trigerred when the connection is no longer needed (destruction). activate/deactivate is connection management to signal connect/disconnect. Reviewed By: robertroeser Differential Revision: D104598289 fbshipit-source-id: ef5a0369f5004a99dd6c99655f71a69e78817464

Support compact for metadata serialization Summary: uCache uses compact for metadata serialization, so we need to support it. Reviewed By: robertroeser Differential Revision: D104258970 fbshipit-source-id: cf065a8f131f4b5aed9b17b779767ca175efd77a

Decouple thrift client pipeline from rocket frame Summary: Converts rocket frame into a thrift side payload on the inbound side of transport adapter. We'll extend checksum handler on the response side use this for checksum validation. Reviewed By: robertroeser Differential Revision: D104300060 fbshipit-source-id: a9b67313c27d34010d9f211f0db834d38a9b9257

Implement setup response handling Summary: Adds setup response handling for fast_thrift server Reviewed By: robertroeser Differential Revision: D113420893 fbshipit-source-id: 0c73829faddcd88fb2a1b2120f081a02c7018222

Implement write buffering backpressure handler Summary: After backpressure is returned it moves into backpressure mode. Until backpressure is released it buffers writes. At this point it would start returning backpressure on reads. Once write backpressure is released and all buffered writes are flushed, it would release read backpressure. Overall this will lead to end to end backpressure support. Reviewed By: robertroeser Differential Revision: D106258439 fbshipit-source-id: 0d0fb1da0a5db916d39dee8fab5f0924d0442caa

Fix fragmentation/defragmentation handlers Summary: Since our messages have evolved over time, the handlers were a bit stale and needed to adapt to new messages. Reviewed By: robertroeser Differential Revision: D106331461 fbshipit-source-id: 3a7a3644acf3050e2cfc6b41f2be0fa4bfa3830e

Clean up transport handler lifecycle Summary: 1. Added resetPipeline() which releases the dtor guard on the pipeline prior to destruction. 2. Added DCHECKs in places where the pipeline is being accessed to catch call sites that don't set the pipeline. Reviewed By: robertroeser Differential Revision: D104598273 fbshipit-source-id: 261fdcaa7b70d0c8604cad26535f9311f1c5084d

Add flush list to batching handlers Summary: Allows users to set flush list to control flushing. Reviewed By: robertroeser Differential Revision: D113116710 fbshipit-source-id: f1c3aca931e30babeee14b33c355eeba5b71fb79

Move connection close handling to a handler Summary: Adds a new server side connection close handler Adds a CloseConnection and a ConnectionClosed event. This removes the additional graceful drain and connection closing responsibility from the adapter. Also removes all the drain logic from connection manager, it's simple now: Calls close() which gets passed to the adapter. The adapter then sends a CloseConnection event, once the drain is done the handler waits for pending requests to be reaped (so there is no SEGFAULT when the adapter goes away), and then fires a ConnectionClosed event. If it hits a timeout for draining it just starts reaping, If it hits a timeout for reaping, it does a LOG(FATAL) to core and prevent a hang. closeCallback is now only called when the ConnectionClosed event is fired to the app adapter. Reviewed By: robertroeser Differential Revision: D106248198 fbshipit-source-id: 3e0611b94e2eaa2172fff512e81e8f0c953bd3e8

Propagate lifecycle events between thrift and rocket server pipelines Summary: Similar to the client side lifecycle events need to propagate between the pipelines. Reviewed By: robertroeser Differential Revision: D105991315 fbshipit-source-id: a21972235659e9e846394843f62189b19e6ec369