Merge remote-tracking branch 'origin/master' into simplify_lwd_projection_drop_logic

Author: jsc0218

.github/workflows/create_release.yml

@@ -135,9 +135,10 @@ jobs:
           ./utils/list-versions/update-docker-version.sh
           echo "Generate ChangeLog"
           export CI=1
+          docker pull clickhouse/style-test:latest
           docker run -u "${UID}:${GID}" -e PYTHONUNBUFFERED=1 -e CI=1 --network=host \
             --volume=".:/wd" --workdir="/wd" \
-            clickhouse/style-test \
+            clickhouse/style-test:latest \
             ./tests/ci/changelog.py -v --debug-helpers \
             --gh-user-or-token ${{ secrets.ROBOT_CLICKHOUSE_COMMIT_TOKEN }} \
             --jobs=5 \

CHANGELOG.md

@@ -47,15 +47,16 @@ Please feel free to reach out to tyler `<at>` clickhouse `<dot>` com.
 You can also peruse [ClickHouse Events](https://clickhouse.com/company/news-events) for a list of all upcoming trainings, meetups, speaking engagements, etc.
 
 Upcoming meetups
-* [Tokyo Meetup with Confluent](https://www.meetup.com/clickhouse-tokyo-user-group/events/306832118/) - April 15, 2025
-* [Kuala Lumper Meetup with CNCF](https://www.meetup.com/clickhouse-malaysia-meetup-group/events/306697678/) - April 16, 2025
 * [Jakarta Meetup with AWS](https://www.meetup.com/clickhouse-indonesia-user-group/events/306973747/) - April 22, 2025
 * [Denver Meetup](https://www.meetup.com/clickhouse-denver-user-group/events/306934991/) - April 23, 2025
 * [Austin Meetup](https://www.meetup.com/clickhouse-austin-user-group/events/307289908) - May 13, 2025
 * [London Meetup](https://www.meetup.com/clickhouse-london-user-group/events/306047172/) - May 14, 2025
 * [Istanbul Meetup](https://www.meetup.com/clickhouse-turkiye-meetup-group/events/306978337/) - May 15, 2025
+* [Shenzhen Meetup](hhttps://www.huodongxing.com/event/7803892350511) - May 17, 2025
 
 Recent meetups
+* [Kuala Lumper Meetup with CNCF](https://www.meetup.com/clickhouse-malaysia-meetup-group/events/306697678/) - April 16, 2025
+* [Tokyo Meetup with Confluent](https://www.meetup.com/clickhouse-tokyo-user-group/events/306832118/) - April 15, 2025
 * [Ho Chi Minh Meetup with AWS & Infinite Lambda](https://www.meetup.com/clickhouse-vietnam-meetup-group/events/306810105/) - April 12, 2025
 * [Oslo Meetup](https://www.meetup.com/open-source-real-time-data-warehouse-real-time-analytics/events/306414327/) - April 8, 2025
 * [Sydney Meetup](https://www.meetup.com/clickhouse-australia-user-group/events/306549810/) - April 1, 2025

README.md

@@ -236,16 +236,21 @@ namespace Net
         /// to be able to re-use it again.
 
     private:
+        using MutexT = Poco::FastMutex;
+        using LockT = MutexT::ScopedLock;
+        using UnLockT = Poco::ScopedLockWithUnlock<MutexT>;
+
         SecureSocketImpl(const SecureSocketImpl &);
         SecureSocketImpl & operator=(const SecureSocketImpl &);
 
         mutable std::recursive_mutex _mutex;
-        SSL * _pSSL; // GUARDED_BY _mutex
+        std::atomic<SSL *> _pSSL;
         Poco::AutoPtr<SocketImpl> _pSocket;
         Context::Ptr _pContext;
         bool _needHandshake;
         std::string _peerHostName;
         Session::Ptr _pSession;
+        mutable MutexT _ssl_mutex;
 
         friend class SecureStreamSocketImpl;
 

base/poco/NetSSL_OpenSSL/include/Poco/Net/SecureSocketImpl.h

@@ -103,6 +103,8 @@ void SecureSocketImpl::acceptSSL()
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	poco_assert (!_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	BIO* pBIO = BIO_new(BIO_s_socket());
 	if (!pBIO) throw SSLException("Cannot create BIO object");
 	BIO_set_fd(pBIO, static_cast<int>(_pSocket->sockfd()), BIO_NOCLOSE);
@@ -169,6 +171,8 @@ void SecureSocketImpl::connectSSL(bool performHandshake)
 	poco_assert (!_pSSL);
 	poco_assert (_pSocket->initialized());
 
+	LockT l(_ssl_mutex);
+
 	BIO* pBIO = BIO_new(BIO_s_socket());
 	if (!pBIO) throw SSLException("Cannot create SSL BIO object");
 	BIO_set_fd(pBIO, static_cast<int>(_pSocket->sockfd()), BIO_NOCLOSE);
@@ -246,6 +250,8 @@ void SecureSocketImpl::shutdown()
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	if (_pSSL)
 	{
+        UnLockT l(_ssl_mutex);
+
         // Don't shut down the socket more than once.
         int shutdownState = SSL_get_shutdown(_pSSL);
         bool shutdownSent = (shutdownState & SSL_SENT_SHUTDOWN) == SSL_SENT_SHUTDOWN;
@@ -260,6 +266,7 @@ void SecureSocketImpl::shutdown()
 			// done with it.
 			int rc = SSL_shutdown(_pSSL);
 			if (rc < 0) handleError(rc);
+			l.unlock();
 			if (_pSocket->getBlocking())
 			{
 				_pSocket->shutdown();
@@ -290,6 +297,9 @@ int SecureSocketImpl::sendBytes(const void* buffer, int length, int flags)
 	poco_check_ptr (_pSSL);
 
 	int rc;
+
+	LockT l(_ssl_mutex);
+
 	if (_needHandshake)
 	{
 		rc = completeHandshake();
@@ -331,6 +341,8 @@ int SecureSocketImpl::receiveBytes(void* buffer, int length, int flags)
 	poco_assert (_pSocket->initialized());
 	poco_check_ptr (_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	/// Special case: just check that we can read from socket
 	if ((flags & MSG_DONTWAIT) && (flags & MSG_PEEK))
 		return _pSocket->receiveBytes(buffer, length, flags);
@@ -368,6 +380,8 @@ int SecureSocketImpl::available() const
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	poco_check_ptr (_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	return SSL_pending(_pSSL);
 }
 
@@ -464,10 +478,20 @@ bool SecureSocketImpl::isLocalHost(const std::string& hostName)
 X509* SecureSocketImpl::peerCertificate() const
 {
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
+    LockT l(_ssl_mutex);
+
+	X509* pCert = nullptr;
+
 	if (_pSSL)
-		return SSL_get1_peer_certificate(_pSSL);
-	else
-		return 0;
+	{
+		pCert = ::SSL_get_peer_certificate(_pSSL);
+
+		if (X509_V_OK != SSL_get_verify_result(_pSSL))
+			throw CertificateValidationException("SecureSocketImpl::peerCertificate(): "
+				"Certificate verification error " + Utility::getLastError());
+	}
+
+	return pCert;
 }
 
 Poco::Timespan SecureSocketImpl::getMaxTimeoutOrLimit()
@@ -608,6 +632,8 @@ void SecureSocketImpl::reset()
 	close();
 	if (_pSSL)
 	{
+		LockT l(_ssl_mutex);
+
 		SSL_free(_pSSL);
 		_pSSL = nullptr;
 	}
@@ -652,9 +678,12 @@ bool SecureSocketImpl::sessionWasReused()
 {
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	if (_pSSL)
-		return SSL_session_reused(_pSSL) != 0;
-	else
-		return false;
+	{
+		LockT l(_ssl_mutex);
+		return ::SSL_session_reused(_pSSL) != 0;
+	}
+
+	return false;
 }
 
 void SecureSocketImpl::setBlocking(bool flag)

base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp

@@ -3,3 +3,8 @@ yamllint==1.26.3
 codespell==2.2.1
 mypy==1.15.0
 pylint==3.1.0
+# required for change log generation:
+tqdm==4.67.1
+thefuzz==0.22.1
+PyGitHub==2.6.1
+boto3==1.37.38

ci/docker/style-test/requirements.txt

@@ -1728,6 +1728,7 @@ distinctdynamictypes
 distinctjsonpaths
 distro
 divideDecimal
+divideOrNull
 dmesg
 doesnt
 domainRFC
@@ -1887,8 +1888,10 @@ geospatial
 getClientHTTPHeader
 getMacro
 getMaxTableNameLengthForDatabase
+getMergeTreeSetting
 getOSKernelVersion
 getServerPort
+getServerSetting
 getSetting
 getSettingOrDefault
 getSizeOfEnumType
@@ -2036,6 +2039,7 @@ inodes
 instantiation
 instantiations
 intDiv
+intDivOrNull
 intDivOrZero
 intExp
 intHash
@@ -2233,6 +2237,7 @@ mebibytes
 memtable
 memtables
 mergeTreeIndex
+mergeTreeProjection
 mergeable
 mergetree
 messageID
@@ -2261,6 +2266,7 @@ mmap
 mmapped
 modularization
 moduli
+moduloOrNull
 moduloOrZero
 mongoc
 mongocxx
@@ -2473,6 +2479,7 @@ positionCaseInsensitive
 positionCaseInsensitiveUTF
 positionUTF
 positiveModulo
+positiveModuloOrNull
 postfix
 postfixes
 postgres

ci/jobs/scripts/check_style/aspell-ignore/en/aspell-dict.txt

@@ -55,7 +55,8 @@ function add_setting_declaration_file()
     fi
     filename=$(basename -- "$1")
     filename="${filename%.*}"
-    grep "DECLARE(" "$1" | awk -vfilename="${filename}" '{print substr($2, 0, length($2) - 1) " " filename substr($1, 9, length($1) - 9) " SettingsDeclaration" }' >> "${SETTINGS_FILE}"
+    grep -e "DECLARE(" "$1" | awk -vfilename="${filename}" '{print substr($2, 0, length($2) - 1) " " filename substr($1, 9, length($1) - 9) " SettingsDeclaration" }' >> "${SETTINGS_FILE}"
+    grep -e "DECLARE_WITH_ALIAS(" "$1" | awk -vfilename="${filename}" '{print substr($2, 0, length($2) - 1) " " filename substr($1, 20, length($1) - 20) " SettingsDeclaration" }' >> "${SETTINGS_FILE}"
 }
 
 for settings_file in ${ALL_DECLARATION_FILES};

ci/jobs/scripts/check_style/check-settings-style

@@ -83,17 +83,18 @@ def should_skip_job(job_name):
             f"Skipped, labeled with '{Labels.CI_FUNCTIONAL_FLAKY}' - run stateless test jobs only",
         )
 
-    if Labels.CI_INTEGRATION in _info_cache.pr_labels and (
+    if Labels.CI_INTEGRATION in _info_cache.pr_labels and not (
         job_name.startswith(JobNames.INTEGRATION) or job_name in JobConfigs.builds_for_tests
     ):
         return (
             True,
             f"Skipped, labeled with '{Labels.CI_INTEGRATION}' - run integration test jobs only",
         )
 
-    if Labels.CI_FUNCTIONAL in _info_cache.pr_labels and (
+    if Labels.CI_FUNCTIONAL in _info_cache.pr_labels and not (
         job_name.startswith(JobNames.STATELESS)
-        or job_name.startswith(JobNames.STATEFUL or job_name in JobConfigs.builds_for_tests)
+        or job_name.startswith(JobNames.STATEFUL)
+        or job_name in JobConfigs.builds_for_tests
     ):
         return (
             True,