Merge branch 'master' into insertion-table

Author: GrigoryPervakov

.github/workflows/create_release.yml

@@ -135,9 +135,10 @@ jobs:
           ./utils/list-versions/update-docker-version.sh
           echo "Generate ChangeLog"
           export CI=1
+          docker pull clickhouse/style-test:latest
           docker run -u "${UID}:${GID}" -e PYTHONUNBUFFERED=1 -e CI=1 --network=host \
             --volume=".:/wd" --workdir="/wd" \
-            clickhouse/style-test \
+            clickhouse/style-test:latest \
             ./tests/ci/changelog.py -v --debug-helpers \
             --gh-user-or-token ${{ secrets.ROBOT_CLICKHOUSE_COMMIT_TOKEN }} \
             --jobs=5 \

CHANGELOG.md

@@ -204,11 +204,6 @@ option(OMIT_HEAVY_DEBUG_SYMBOLS
     ${OMIT_HEAVY_DEBUG_SYMBOLS_DEFAULT})
 
 option(BUILD_STANDALONE_KEEPER "Build keeper as small standalone binary" OFF)
-if (NOT BUILD_STANDALONE_KEEPER)
-    option(CREATE_KEEPER_SYMLINK "Create symlink for clickhouse-keeper to main server binary" ON)
-else ()
-    option(CREATE_KEEPER_SYMLINK "Create symlink for clickhouse-keeper to main server binary" OFF)
-endif ()
 
 # Create BuildID when using lld. For other linkers it is created by default.
 # (NOTE: LINKER_NAME can be either path or name, and in different variants)

CMakeLists.txt

@@ -47,15 +47,16 @@ Please feel free to reach out to tyler `<at>` clickhouse `<dot>` com.
 You can also peruse [ClickHouse Events](https://clickhouse.com/company/news-events) for a list of all upcoming trainings, meetups, speaking engagements, etc.
 
 Upcoming meetups
-* [Tokyo Meetup with Confluent](https://www.meetup.com/clickhouse-tokyo-user-group/events/306832118/) - April 15, 2025
-* [Kuala Lumper Meetup with CNCF](https://www.meetup.com/clickhouse-malaysia-meetup-group/events/306697678/) - April 16, 2025
 * [Jakarta Meetup with AWS](https://www.meetup.com/clickhouse-indonesia-user-group/events/306973747/) - April 22, 2025
 * [Denver Meetup](https://www.meetup.com/clickhouse-denver-user-group/events/306934991/) - April 23, 2025
 * [Austin Meetup](https://www.meetup.com/clickhouse-austin-user-group/events/307289908) - May 13, 2025
 * [London Meetup](https://www.meetup.com/clickhouse-london-user-group/events/306047172/) - May 14, 2025
 * [Istanbul Meetup](https://www.meetup.com/clickhouse-turkiye-meetup-group/events/306978337/) - May 15, 2025
+* [Shenzhen Meetup](hhttps://www.huodongxing.com/event/7803892350511) - May 17, 2025
 
 Recent meetups
+* [Kuala Lumper Meetup with CNCF](https://www.meetup.com/clickhouse-malaysia-meetup-group/events/306697678/) - April 16, 2025
+* [Tokyo Meetup with Confluent](https://www.meetup.com/clickhouse-tokyo-user-group/events/306832118/) - April 15, 2025
 * [Ho Chi Minh Meetup with AWS & Infinite Lambda](https://www.meetup.com/clickhouse-vietnam-meetup-group/events/306810105/) - April 12, 2025
 * [Oslo Meetup](https://www.meetup.com/open-source-real-time-data-warehouse-real-time-analytics/events/306414327/) - April 8, 2025
 * [Sydney Meetup](https://www.meetup.com/clickhouse-australia-user-group/events/306549810/) - April 1, 2025

README.md

@@ -236,16 +236,21 @@ namespace Net
         /// to be able to re-use it again.
 
     private:
+        using MutexT = Poco::FastMutex;
+        using LockT = MutexT::ScopedLock;
+        using UnLockT = Poco::ScopedLockWithUnlock<MutexT>;
+
         SecureSocketImpl(const SecureSocketImpl &);
         SecureSocketImpl & operator=(const SecureSocketImpl &);
 
         mutable std::recursive_mutex _mutex;
-        SSL * _pSSL; // GUARDED_BY _mutex
+        std::atomic<SSL *> _pSSL;
         Poco::AutoPtr<SocketImpl> _pSocket;
         Context::Ptr _pContext;
         bool _needHandshake;
         std::string _peerHostName;
         Session::Ptr _pSession;
+        mutable MutexT _ssl_mutex;
 
         friend class SecureStreamSocketImpl;
 

base/poco/NetSSL_OpenSSL/include/Poco/Net/SecureSocketImpl.h

@@ -103,6 +103,8 @@ void SecureSocketImpl::acceptSSL()
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	poco_assert (!_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	BIO* pBIO = BIO_new(BIO_s_socket());
 	if (!pBIO) throw SSLException("Cannot create BIO object");
 	BIO_set_fd(pBIO, static_cast<int>(_pSocket->sockfd()), BIO_NOCLOSE);
@@ -169,6 +171,8 @@ void SecureSocketImpl::connectSSL(bool performHandshake)
 	poco_assert (!_pSSL);
 	poco_assert (_pSocket->initialized());
 
+	LockT l(_ssl_mutex);
+
 	BIO* pBIO = BIO_new(BIO_s_socket());
 	if (!pBIO) throw SSLException("Cannot create SSL BIO object");
 	BIO_set_fd(pBIO, static_cast<int>(_pSocket->sockfd()), BIO_NOCLOSE);
@@ -246,6 +250,8 @@ void SecureSocketImpl::shutdown()
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	if (_pSSL)
 	{
+        UnLockT l(_ssl_mutex);
+
         // Don't shut down the socket more than once.
         int shutdownState = SSL_get_shutdown(_pSSL);
         bool shutdownSent = (shutdownState & SSL_SENT_SHUTDOWN) == SSL_SENT_SHUTDOWN;
@@ -260,6 +266,7 @@ void SecureSocketImpl::shutdown()
 			// done with it.
 			int rc = SSL_shutdown(_pSSL);
 			if (rc < 0) handleError(rc);
+			l.unlock();
 			if (_pSocket->getBlocking())
 			{
 				_pSocket->shutdown();
@@ -290,6 +297,9 @@ int SecureSocketImpl::sendBytes(const void* buffer, int length, int flags)
 	poco_check_ptr (_pSSL);
 
 	int rc;
+
+	LockT l(_ssl_mutex);
+
 	if (_needHandshake)
 	{
 		rc = completeHandshake();
@@ -331,6 +341,8 @@ int SecureSocketImpl::receiveBytes(void* buffer, int length, int flags)
 	poco_assert (_pSocket->initialized());
 	poco_check_ptr (_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	/// Special case: just check that we can read from socket
 	if ((flags & MSG_DONTWAIT) && (flags & MSG_PEEK))
 		return _pSocket->receiveBytes(buffer, length, flags);
@@ -368,6 +380,8 @@ int SecureSocketImpl::available() const
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	poco_check_ptr (_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	return SSL_pending(_pSSL);
 }
 
@@ -464,10 +478,20 @@ bool SecureSocketImpl::isLocalHost(const std::string& hostName)
 X509* SecureSocketImpl::peerCertificate() const
 {
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
+    LockT l(_ssl_mutex);
+
+	X509* pCert = nullptr;
+
 	if (_pSSL)
-		return SSL_get1_peer_certificate(_pSSL);
-	else
-		return 0;
+	{
+		pCert = ::SSL_get_peer_certificate(_pSSL);
+
+		if (X509_V_OK != SSL_get_verify_result(_pSSL))
+			throw CertificateValidationException("SecureSocketImpl::peerCertificate(): "
+				"Certificate verification error " + Utility::getLastError());
+	}
+
+	return pCert;
 }
 
 Poco::Timespan SecureSocketImpl::getMaxTimeoutOrLimit()
@@ -608,6 +632,8 @@ void SecureSocketImpl::reset()
 	close();
 	if (_pSSL)
 	{
+		LockT l(_ssl_mutex);
+
 		SSL_free(_pSSL);
 		_pSSL = nullptr;
 	}
@@ -652,9 +678,12 @@ bool SecureSocketImpl::sessionWasReused()
 {
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	if (_pSSL)
-		return SSL_session_reused(_pSSL) != 0;
-	else
-		return false;
+	{
+		LockT l(_ssl_mutex);
+		return ::SSL_session_reused(_pSSL) != 0;
+	}
+
+	return false;
 }
 
 void SecureSocketImpl::setBlocking(bool flag)

base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp

@@ -281,6 +281,7 @@ class JobConfigs:
             RunnerLabels.BUILDER_ARM,  # fuzzers
         ],
     )
+    builds_for_tests = [b.name for b in build_jobs] + [tidy_build_jobs[0]]
     install_check_jobs = Job.Config(
         name=JobNames.INSTALL_TEST,
         runs_on=["..."],

ci/defs/job_configs.py

@@ -3,3 +3,8 @@ yamllint==1.26.3
 codespell==2.2.1
 mypy==1.15.0
 pylint==3.1.0
+# required for change log generation:
+tqdm==4.67.1
+thefuzz==0.22.1
+PyGitHub==2.6.1
+boto3==1.37.38

ci/docker/style-test/requirements.txt

@@ -156,6 +156,7 @@ def main():
                 name="Cmake configuration",
                 command=cmake_cmd,
                 workdir=build_dir,
+                with_log=True,
             )
         )
         res = results[-1].is_ok()
@@ -176,6 +177,7 @@ def main():
                 name="Build ClickHouse",
                 command=f"ninja {targets}",
                 workdir=build_dir,
+                with_log=True,
             )
         )
         run_shell("sccache stats", "sccache --show-stats")
@@ -206,6 +208,7 @@ def main():
                     f"cd {Utils.cwd()}/packages/ && OUTPUT_DIR={temp_dir} BUILD_TYPE={BUILD_TYPE_TO_DEB_PACKAGE_TYPE[build_type]} VERSION_STRING={version_dict['string']} DEB_ARCH={deb_arch} ./build --deb {'--rpm --tgz' if 'release' in build_type else ''}",
                 ],
                 workdir=build_dir,
+                with_log=True,
             )
         )
         res = results[-1].is_ok()

ci/jobs/build_clickhouse.py

@@ -36,6 +36,7 @@ def start():
             Result.from_commands_run(
                 name="Start ClickHouse",
                 command=[start, log_export_config, setup_logs_replication],
+                with_log=True,
             )
         )
         res = results[-1].is_ok()