Stable 26.8 - Bump to latest

.github/workflows/regression-reusable-suite.yml

@@ -93,6 +93,7 @@ jobs:
       build_sha: ${{ inputs.build_sha }}
       pr_number: ${{ github.event.number }}
       artifacts: builds
+      regression_args: ${{ inputs.regression_args }}
       # Args
       args: --test-to-end
         --no-colors

.github/workflows/regression.yml

@@ -126,7 +126,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        SUITE: [aes_encryption, atomic_insert, attach, base_58, clickhouse_keeper_failover,data_types, datetime64_extended_range, disk_level_encryption, dns, engines, example, extended_precision_data_types, functions, jwt_authentication, kafka, kerberos, key_value, lightweight_delete, memory, part_moves_between_shards, selects, session_timezone, settings, version, window_functions]
+        SUITE: [aes_encryption, atomic_insert, attach, base_58, clickhouse_keeper_failover,data_types, datetime64_extended_range, disk_level_encryption, dns, engines, example, extended_precision_data_types, functions, jwt_authentication, kafka, kerberos, key_value, memory, part_moves_between_shards, selects, session_timezone, settings, version, window_functions]
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -143,6 +143,40 @@ jobs:
       job_name: ${{ matrix.SUITE }}
     secrets: inherit
 
+  LightweightDelete:
+    if: |
+      fromJson(inputs.workflow_config).workflow_config.custom_data.ci_regression_jobs[0] == null ||
+      contains(fromJson(inputs.workflow_config).workflow_config.custom_data.ci_regression_jobs, 'common')
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - PART: 1
+            FILTER: --only "/lightweight delete/disk space/*"
+          - PART: 2
+            FILTER: --only "/lightweight delete/hard restart/*"
+          - PART: 3
+            FILTER: --skip "/lightweight delete/disk space/*" "/lightweight delete/hard restart/*" "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
+          - PART: 4
+            FILTER: --only "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      workflow_config: ${{ inputs.workflow_config }}
+      suite_name: lightweight_delete
+      suite_executable: regression.py
+      output_format: new-fails
+      flags: --with-analyzer
+      timeout_minutes: 300
+      runner_arch: ${{ inputs.arch }}
+      runner_type: ${{ inputs.runner_type }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      set_commit_status: true
+      job_name: lightweight_delete
+      extra_args: ${{ matrix.FILTER }}
+    secrets: inherit
+
   AggregateFunctions:
     if: |
       fromJson(inputs.workflow_config).workflow_config.custom_data.ci_regression_jobs[0] == null ||
@@ -181,6 +215,8 @@ jobs:
             PART: 1
           - ONLY: attach
             PART: 2
+          - ONLY: attach
+            PART: 3
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -189,7 +225,7 @@ jobs:
       suite_executable: regression.py
       output_format: new-fails
       flags: --with-analyzer
-      timeout_minutes: ${{ inputs.timeout_minutes }}
+      timeout_minutes: 300
       runner_arch: ${{ inputs.arch }}
       runner_type: ${{ inputs.runner_type }}
       storage_path: /${{ matrix.ONLY }}_partition
@@ -534,10 +570,56 @@ jobs:
     secrets: inherit
 
   # CAS (content-addressed storage) is only available in Antalya builds >= 26.6.
-  # These jobs run the suites that support the `--cas` or `--cas-s3-cache` flag with
-  # a content-addressed disk as the default MergeTree storage. Gated on the Antalya
-  # version so they are never scheduled on upstream release builds where the `cas`
-  # metadata type does not exist.
+  # The dedicated `cas` suite, plus other suites run with `--cas` or `--cas-s3-cache`.
+  # Gated on the Antalya version so they are never scheduled on upstream release
+  # builds where the `cas` metadata type does not exist.
+  CASSuite:
+    if: |
+      contains(fromJson(inputs.workflow_config).workflow_config.custom_data.version.string, 'antalya') &&
+      (
+        fromJson(inputs.workflow_config).workflow_config.custom_data.ci_regression_jobs[0] == null ||
+        contains(fromJson(inputs.workflow_config).workflow_config.custom_data.ci_regression_jobs, 'cas')
+      )
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      workflow_config: ${{ inputs.workflow_config }}
+      suite_name: cas
+      suite_executable: regression.py
+      output_format: new-fails
+      flags: --with-analyzer
+      timeout_minutes: 180
+      runner_arch: ${{ inputs.arch }}
+      runner_type: ${{ inputs.runner_type }}
+      build_sha: ${{ inputs.build_sha }}
+      set_commit_status: true
+      job_name: cas
+    secrets: inherit
+
+  CASS3CacheSuite:
+    if: |
+      contains(fromJson(inputs.workflow_config).workflow_config.custom_data.version.string, 'antalya') &&
+      (
+        fromJson(inputs.workflow_config).workflow_config.custom_data.ci_regression_jobs[0] == null ||
+        contains(fromJson(inputs.workflow_config).workflow_config.custom_data.ci_regression_jobs, 'cas')
+      )
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      workflow_config: ${{ inputs.workflow_config }}
+      suite_name: cas
+      suite_executable: regression.py
+      output_format: new-fails
+      flags: --with-analyzer
+      timeout_minutes: 180
+      runner_arch: ${{ inputs.arch }}
+      runner_type: ${{ inputs.runner_type }}
+      build_sha: ${{ inputs.build_sha }}
+      set_commit_status: true
+      job_name: cas_s3_cache
+      regression_args: --cas-s3-cache
+    secrets: inherit
+
   CAS:
     if: |
       contains(fromJson(inputs.workflow_config).workflow_config.custom_data.version.string, 'antalya') &&
@@ -668,7 +750,11 @@ jobs:
           - PART: 1
             FILTER: --only "/lightweight delete/disk space/*"
           - PART: 2
-            FILTER: --skip "/lightweight delete/disk space/*"
+            FILTER: --only "/lightweight delete/hard restart/*"
+          - PART: 3
+            FILTER: --skip "/lightweight delete/disk space/*" "/lightweight delete/hard restart/*" "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
+          - PART: 4
+            FILTER: --only "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -702,7 +788,11 @@ jobs:
           - PART: 1
             FILTER: --only "/lightweight delete/disk space/*"
           - PART: 2
-            FILTER: --skip "/lightweight delete/disk space/*"
+            FILTER: --only "/lightweight delete/hard restart/*"
+          - PART: 3
+            FILTER: --skip "/lightweight delete/disk space/*" "/lightweight delete/hard restart/*" "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
+          - PART: 4
+            FILTER: --only "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -738,6 +828,8 @@ jobs:
             PART: 1
           - ONLY: attach
             PART: 2
+          - ONLY: attach
+            PART: 3
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -750,6 +842,7 @@ jobs:
       runner_arch: ${{ inputs.arch }}
       runner_type: ${{ inputs.runner_type }}
       part: ${{ matrix.PART }}
+      storage_path: /${{ matrix.ONLY }}_partition
       build_sha: ${{ inputs.build_sha }}
       set_commit_status: true
       job_name: cas_alter_${{ matrix.ONLY }}
@@ -773,6 +866,8 @@ jobs:
             PART: 1
           - ONLY: attach
             PART: 2
+          - ONLY: attach
+            PART: 3
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -785,6 +880,7 @@ jobs:
       runner_arch: ${{ inputs.arch }}
       runner_type: ${{ inputs.runner_type }}
       part: ${{ matrix.PART }}
+      storage_path: /${{ matrix.ONLY }}_partition
       build_sha: ${{ inputs.build_sha }}
       set_commit_status: true
       job_name: cas_s3_cache_alter_${{ matrix.ONLY }}

.gitmodules

@@ -208,7 +208,7 @@
 	url = https://github.com/ClickHouse/nats.c
 [submodule "contrib/vectorscan"]
 	path = contrib/vectorscan
-	url = https://github.com/ClickHouse/vectorscan.git
+	url = https://github.com/ClickHouse/vectorscan
 [submodule "contrib/llvm-project"]
 	path = contrib/llvm-project
 	url = https://github.com/ClickHouse/llvm-project
@@ -332,7 +332,7 @@
 	url = https://github.com/ClickHouse/mongo-cxx-driver.git
 [submodule "contrib/mongo-c-driver"]
 	path = contrib/mongo-c-driver
-	url = https://github.com/ClickHouse/mongo-c-driver.git
+	url = https://github.com/ClickHouse/mongo-c-driver
 [submodule "contrib/sz3"]
 	path = contrib/sz3
 	url = https://github.com/ClickHouse/SZ3.git
@@ -365,7 +365,7 @@
 	url = https://github.com/ClickHouse/ai-sdk-cpp
 [submodule "contrib/nlohmann-json"]
 	path = contrib/nlohmann-json
-	url = https://github.com/nlohmann/json.git
+	url = https://github.com/ClickHouse/json
 [submodule "contrib/crc32c"]
 	path = contrib/crc32c
 	url = https://github.com/ClickHouse/crc32c
@@ -416,7 +416,7 @@
 	url = https://github.com/ClickHouse/geometry.hpp
 [submodule "contrib/zxc"]
 	path = contrib/zxc
-	url = https://github.com/ClickHouse/zxc
+	url = https://github.com/hellobertrand/zxc
 [submodule "contrib/libucontext"]
 	path = contrib/libucontext
 	url = https://github.com/kaniini/libucontext

CMakeLists.txt

@@ -173,7 +173,8 @@ if (OS_LINUX)
 
     if (LINKER_NAME MATCHES "lld" AND NOT SANITIZE AND NOT SANITIZE_COVERAGE AND NOT WITH_COVERAGE)
         # Fold identical code and data sections to reduce binary size.
-        set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--icf=all")
+        # `safe` keeps address-taken functions distinct, as C and C++ require.
+        set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--icf=safe")
     endif ()
 
     # In Release builds, strip residual debug sections that may come from contrib
@@ -345,7 +346,7 @@ if (NOT SANITIZE AND NOT SANITIZE_COVERAGE AND NOT WITH_COVERAGE)
     set(COMPILER_FLAGS "${COMPILER_FLAGS} -ffunction-sections -fdata-sections")
     # -faddrsig emits an address-significance table that lets lld's ICF
     # distinguish address-taken symbols from non-address-taken ones.
-    # Only useful on Linux where we use lld with --icf=all; Darwin's ld64
+    # Only useful on Linux where we use lld with --icf=safe; Darwin's ld64
     # does not consume these sections.
     if (OS_LINUX)
         set(COMPILER_FLAGS "${COMPILER_FLAGS} -faddrsig")

base/poco/Net/src/HTTPRequest.cpp

@@ -18,6 +18,7 @@
 #include "Poco/NumberFormatter.h"
 #include "Poco/Ascii.h"
 #include "Poco/String.h"
+#include "Poco/Exception.h"
 
 
 using Poco::NumberFormatter;
@@ -190,8 +191,31 @@ void HTTPRequest::setProxyCredentials(const std::string& scheme, const std::stri
 }
 
 
+namespace
+{
+	bool hasLineBreak(const std::string& value)
+	{
+		return value.find_first_of("\r\n") != std::string::npos;
+	}
+
+	/// CR or LF in the request line or in a header would let the value inject headers or a whole second request.
+	void checkNoLineBreaks(const HTTPRequest& request)
+	{
+		if (hasLineBreak(request.getMethod()) || hasLineBreak(request.getURI()) || hasLineBreak(request.getVersion()))
+			throw InvalidArgumentException("HTTP request line contains CR or LF");
+		for (const auto& header : request)
+		{
+			if (hasLineBreak(header.first) || hasLineBreak(header.second))
+				throw InvalidArgumentException("HTTP request header contains CR or LF", header.first);
+		}
+	}
+}
+
+
 void HTTPRequest::write(std::ostream& ostr) const
 {
+	checkNoLineBreaks(*this);
+
 	ostr << _method << " " << _uri << " " << getVersion() << "\r\n";
 	HTTPMessage::write(ostr);
 	ostr << "\r\n";

base/poco/NetSSL_OpenSSL/include/Poco/Net/SecureSocketImpl.h

@@ -149,6 +149,10 @@ namespace Net
         /// The object is normally guarded by the socket's mutex; a caller that uses it
         /// directly must ensure the socket is not accessed concurrently.
 
+        void markFatalError();
+        /// Records that an external operation on the underlying `SSL` object failed fatally.
+        /// An orderly SSL shutdown must not be attempted afterwards.
+
         X509 * peerCertificate() const;
         /// Returns the peer's certificate.
 
@@ -233,7 +237,7 @@ namespace Net
         /// Returns true iff the given host name is the local host
         /// (either "localhost" or "127.0.0.1").
 
-        bool mustRetry(int rc, Poco::Timespan & remaining_time);
+        bool mustRetry(int rc, int sslError, int socketError, Poco::Timespan & remaining_time);
         /// Returns true if the last operation should be retried,
         /// otherwise false.
         ///
@@ -247,7 +251,7 @@ namespace Net
         /// not become readable or writable within the sockets
         /// receive or send timeout.
 
-        int handleError(int rc);
+        int handleError(int rc, int sslError, int socketError, unsigned long errorCode);
         /// Handles an SSL error by throwing an appropriate exception.
 
         void reset();
@@ -281,6 +285,10 @@ namespace Net
         Poco::AutoPtr<SocketImpl> _pSocket;
         Context::Ptr _pContext;
         bool _needHandshake;
+        bool _fatalError;
+        bool _pendingWrite = false;
+        /// Whether the last `SSL_write` returned `SSL_ERROR_WANT_WRITE`. OpenSSL keeps that record pending
+        /// until `SSL_write` is retried, even after other operations change what `SSL_get_error` reports.
         std::string _peerHostName;
         Session::Ptr _pSession;
         const BIO_METHOD * _bioMethod = nullptr;

base/poco/NetSSL_OpenSSL/include/Poco/Net/SecureStreamSocketImpl.h

@@ -183,6 +183,9 @@ namespace Net
         /// Returns the underlying OpenSSL SSL object, or null if the SSL handshake
         /// has not been performed yet.
 
+        void markFatalError();
+        /// Records that an external operation on the underlying `SSL` object failed fatally.
+
         void setLazyHandshake(bool flag = true);
         /// Enable lazy SSL handshake. If enabled, the SSL handshake
         /// will be performed the first time date is sent or
@@ -301,6 +304,12 @@ namespace Net
     }
 
 
+    inline void SecureStreamSocketImpl::markFatalError()
+    {
+        _impl.markFatalError();
+    }
+
+
     inline Session::Ptr SecureStreamSocketImpl::currentSession()
     {
         return _impl.currentSession();

base/poco/NetSSL_OpenSSL/src/SSLManager.cpp

@@ -340,9 +340,7 @@ void SSLManager::initDefaultContext(bool server)
 	{
 		_ptrDefaultClientContext->enableSessionCache(cacheSessions);
 	}
-	/// Only an outbound connection has a requested host name to check: on an accepted socket this
-	/// would run against the client's address, which a client certificate does not name.
-	bool extendedVerification = config.getBool(prefix + CFG_EXTENDED_VERIFICATION, !server);
+	bool extendedVerification = config.getBool(prefix + CFG_EXTENDED_VERIFICATION, false);
 	if (server)
 		_ptrDefaultServerContext->enableExtendedCertificateVerification(extendedVerification);
 	else