Ankit Kumar

Add TLS pipeline for fast thrift server Summary: Adds a TLS pipeline for fast thrift server. Adds a TLS handler to the conneciton pipeline which owns the TLS pipeline. Adds PERMITTED mode for TLS. Reviewed By: robertroeser Differential Revision: D106108957 fbshipit-source-id: a2eed2115a251f60ea83bab304342d6802826d1e

Move transport component for fast_thrift to thrift Summary: 1. Moves transport component for fast_thrift to thrift. 2. Fixes includes 3. Fixes depencies 4. Verifies tests run and pass 5. Verifies benchmarks Reviewed By: islamismailov Differential Revision: D99003116 fbshipit-source-id: 24d2dc2714ae2aa8e39efbd138dde68f057f664a

Move tests and benchmarks for fast_thrift to thrift Summary: 1. Moves tests and benchmarks for fast_thrift to thrift. 2. Fixes includes 3. Fixes depencies 4. Verifies tests run and pass 5. Verifies benchmarks Reviewed By: islamismailov Differential Revision: D99007424 fbshipit-source-id: a9ab6eae15b5fd619bdaf494b31b6320cf24c440

Adds TLS support for Fast Thrift Server Summary: Adds TLS support for fast thrift server, which defaults to Required. Reviewed By: robertroeser Differential Revision: D103565194 fbshipit-source-id: 2375933a9ae9d7b1297af5794a321e54638d86df

TLS hot-reload via folly::Observer + mTLS/ticket-cipher parity Summary: Promote the `(fizzContext, thriftParams, handshakeTimeout)` triple into a single immutable `security::TLSParams` aggregate and distribute it pull-based through a `folly::observer::SimpleObservable` owned by `ConnectionManager`. `TLSDetectionHandler` and `FizzHandshakeHandler` store an `Observer<shared_ptr<const TLSParams>>` and snapshot it per accepted connection, so a single `setValue` on the observable replaces the previous per-EVB `setTLSParams` fan-out. In-flight handshakes still survive the swap via the inner `shared_ptr`s they captured at `start()`. `FizzServerCertConfig` gains the knobs needed for parity with classic `apache::thrift::ThriftServer` deployments: mTLS via `caPath` or a caller-supplied `fizz::CertificateVerifier`, a caller-supplied `fizz::Factory`, ALPN policing (`AlpnMode`), AEGIS cipher preference, and `TicketCipherSeeds` (old/current/new rotation, with `IdentityOnly` or `X509` cipher kind). `FizzServerContextBuilder` wires all of those into the produced `fizz::server::FizzServerContext`. `buildTLSParams` is the single entry point and throws synchronously on invalid configuration, so a bad reload leaves the running server untouched. `FastThriftServer::reloadTLSConfig(FizzServerCertConfig)` is the public hot-reload entry point: builds new `TLSParams` outside the lifecycle lock, then publishes via `ConnectionManager::setTLSParams`. Intended for cert / ticket-key rotation driven by an embedder-owned watcher. Reviewed By: robertroeser Differential Revision: D106117173 fbshipit-source-id: db3a42ac37d4e4202397e84e7c258793b4434abd

Fix client side error handling Summary: Fixes fast thrift client side error handing to handle overloaded, and other exception types, and have full parity with current Rocket client. Reviewed By: robertroeser Differential Revision: D101433516 fbshipit-source-id: 9b5578e2144f96d68f4257258032287c1d4044d2

Extend payload variants Summary: Extends payload variants for different types through C++20 concepts to add functions for getRequestRpcMetadata and getResponseRpcMetadata. This will be useful for composite app adapter. Also adds into stream payload struct to the finish the list of structs to be used. Reviewed By: robertroeser Differential Revision: D104758397 fbshipit-source-id: e306229aef432e0c1d312f8f3072ece8cf087522

Switch to a single composed frame Summary: Variant helped us reduce the size of the message to keep it within 120 bytes with some buffer. But as we added more APIs to it, the cost went up. A single ComposedFrame while contains more switch cases to roll through, is a bit more performant on average (with more APIs), and works better with Fragmentation/Defragmentation handlers. Reviewed By: robertroeser Differential Revision: D106331330 fbshipit-source-id: ee9701fc8a945697837d5bbe8dd06c4d6f1ab2a0

Add integration/E2E tests and integration benchmarks for composite Summary: TSIA Reviewed By: robertroeser Differential Revision: D105740990 fbshipit-source-id: bd745f80e37c818ecaa949bfd6dd1f1b100be7fa

Drain in-flight callbacks and notify peer on server stop Summary: `ThriftServerAppAdapter` now gates `Closed` + `closeCallback` on a 1:1 `inFlight_` counter (`++` in `handleRequestResponse`, `--` in `fireResponse`); new `sendConnectionCloseErr()` pushes a stream-0 ERROR(`CONNECTION_CLOSE`) through the pipeline so the client stops sending new requests on graceful shutdown. `FastThriftServer::stop()` EVB-hops `sendConnectionCloseErr()` per connection and blocks on `connectionsDrainedBaton_` until the last in-flight handler completes — no more UAF when an async handler fires after `stop()`. Reviewed By: robertroeser Differential Revision: D105898813 fbshipit-source-id: f9714f360cf20718d6c565e5604a8332a1240a98

Implement ComposedFrame Summary: Adds a ComposedFrame concept and a variant for it, that uses the concept to support restricted set of APIs without indirections. Helps remove unnecessary visit indirections (vtable, etc.) and branches, when all payloads share the same APIs. Uses fold expression with if/else branching. Given the different frame types we would be supporting (fewer than 8) this is more optimal than a jump table (switch) and also better than a std::visit (indirection + vtable). If things change in future, we can revisit if we need jump table approach. Also only uses 1 extra byte for the discriminator (frame type), compared to 8 bytes of std::variant. Reviewed By: robertroeser Differential Revision: D102554159 fbshipit-source-id: c3e9fe16aa6f1da81d905233aa9a3466ae12bfe9

Fix lifecycle for thrift client pipelines. Summary: Critical changes: 1. App and transport adapters hold dtor guards on the pipeline to prevent destruction until resetPipeline() is called. 2. Fixed owners to treat client as an extension of app adapter itelf for lifecycle management. 3. Separated connection/disconnection from pipeline destruction. i.e. pipeline->close() is only trigerred when the connection is no longer needed (destruction). activate/deactivate is connection management to signal connect/disconnect. Reviewed By: robertroeser Differential Revision: D104598289 fbshipit-source-id: ef5a0369f5004a99dd6c99655f71a69e78817464

Support compact for metadata serialization Summary: uCache uses compact for metadata serialization, so we need to support it. Reviewed By: robertroeser Differential Revision: D104258970 fbshipit-source-id: cf065a8f131f4b5aed9b17b779767ca175efd77a

Decouple thrift client pipeline from rocket frame Summary: Converts rocket frame into a thrift side payload on the inbound side of transport adapter. We'll extend checksum handler on the response side use this for checksum validation. Reviewed By: robertroeser Differential Revision: D104300060 fbshipit-source-id: a9b67313c27d34010d9f211f0db834d38a9b9257

Create app adapters for rocket Summary: This will allow rocket to be used as transport by anyone, without having to construct a thrift pipeline for it. The goal is to decouple rocket pipeline as it's own, and we'll create thrift pipeline as a standalone. Rocket pipeline becomes: Rocket{Client/Server}AppAdapter <-> Rocket handlers <-> TransportAdapter Users interact with rocket pipeline by implementing the Rocket{Client/Server}AppInterface concept. For ex: Thrift will implement a tail handler in its pipeline that will implement this concept and then this would be passed to rocket's app adapter (separately for both client and server). The thrift handler would also include rocket's app adapter and write to it. This will enable thrift to send/receive messages to and from rocket. Rocket becomes a black box transport that Thrift uses. Reviewed By: robertroeser Differential Revision: D100079521 fbshipit-source-id: a9af70e03a30df4da8c5181d441e51c00cf25d58

Harden fast_thrift server error handling Summary: Different types of exceptions, like declared ones, or overloads, should be sent correctly. Reviewed By: robertroeser Differential Revision: D101552094 fbshipit-source-id: c71dfbd2635b1277d617fd3453ef6437d501f23f

Implement write buffering backpressure handler Summary: After backpressure is returned it moves into backpressure mode. Until backpressure is released it buffers writes. At this point it would start returning backpressure on reads. Once write backpressure is released and all buffered writes are flushed, it would release read backpressure. Overall this will lead to end to end backpressure support. Reviewed By: robertroeser Differential Revision: D106258439 fbshipit-source-id: 0d0fb1da0a5db916d39dee8fab5f0924d0442caa

Implement fast thrift client integration bench Summary: This is another layer of benchmark that includes the generated handler code. Reviewed By: robertroeser Differential Revision: D101688506 fbshipit-source-id: abd2086d617be456cf26719662ff6e9b068210c6

Clean up transport handler lifecycle Summary: 1. Added resetPipeline() which releases the dtor guard on the pipeline prior to destruction. 2. Added DCHECKs in places where the pipeline is being accessed to catch call sites that don't set the pipeline. Reviewed By: robertroeser Differential Revision: D104598273 fbshipit-source-id: 261fdcaa7b70d0c8604cad26535f9311f1c5084d

Implement integration test and bench for new generated handler Summary: TSIA Reviewed By: robertroeser Differential Revision: D103624912 fbshipit-source-id: b82c92f98a7d419502212a038fc36efb65b764fb