Blame SOURCES/redhat-bugzilla-1947989.patch

8a537e
commit 2bad6aef10339f000f7cb578108db5ee80bd640c
8a537e
Author: Mark Goodwin <mgoodwin@redhat.com>
8a537e
Date:   Wed Jun 9 17:04:33 2021 +1000
8a537e
8a537e
    pmproxy: add mutex for client req lists, fix https/tls support, QA
8a537e
    
8a537e
    Add a new mutext to struct proxy and use it to protect parallel
8a537e
    multithreaded updates to the proxy->first client list.
8a537e
    
8a537e
    Also use the same mutext to protect updates to the pending_writes
8a537e
    client list and avoid the doubly linked list corruption that was
8a537e
    causing parallel https/tls requests to get stuck spinning in
8a537e
    flush_secure_module(), as reported in BZ#1947989.
8a537e
    
8a537e
    qa/1457 is extensively updated to test parallel http, https/tls
8a537e
    (and combinations of http and https/tls) RESTAPI calls. Previously
8a537e
    it only tested a single https/tls call.
8a537e
    
8a537e
    With these changes, parallel https/tls RESTAPI requests from the
8a537e
    grafana-pcp datasource to pmproxy now work correctly whereas previously
8a537e
    pmproxy would hang/spin.
8a537e
    
8a537e
    Resolves: RHBZ#1947989 - pmproxy hangs and consume 100% cpu if the
8a537e
    redis datasource is configured with TLS.
8a537e
    
8a537e
    Related: https://github.com/performancecopilot/pcp/issues/1311
8a537e
8a537e
diff --git a/qa/1457 b/qa/1457
8a537e
index 94969f6e0..8bf395944 100755
8a537e
--- a/qa/1457
8a537e
+++ b/qa/1457
8a537e
@@ -2,7 +2,7 @@
8a537e
 # PCP QA Test No. 1457
8a537e
 # Exercise HTTPS access to the PMWEBAPI(3).
8a537e
 #
8a537e
-# Copyright (c) 2019 Red Hat.
8a537e
+# Copyright (c) 2019,2021 Red Hat.
8a537e
 #
8a537e
 
8a537e
 seq=`basename $0`
8a537e
@@ -138,14 +138,59 @@ else
8a537e
 fi
8a537e
 
8a537e
 date >>$seq.full
8a537e
-echo "=== checking TLS operation ===" | tee -a $seq.full
8a537e
-# (-k) allows us to use self-signed (insecure) certificates, so for testing only
8a537e
-# (-v) provides very detailed TLS connection information, for debugging only
8a537e
-curl -k --get 2>$tmp.err \
8a537e
-	"https://localhost:$port/pmapi/metric?name=sample.long.ten" \
8a537e
-	| _filter_json
8a537e
-cat $tmp.err >>$seq.full
8a537e
+echo "=== checking serial http operation ===" | tee -a $seq.full
8a537e
+for i in 1 2 3 4; do
8a537e
+    curl -Gs "http://localhost:$port/pmapi/metric?name=sample.long.ten" 2>$tmp.err$i >$tmp.out$i
8a537e
+done
8a537e
+for i in 1 2 3 4; do
8a537e
+echo === out$i === | tee -a $seq.full
8a537e
+_filter_json < $tmp.out$i
8a537e
+done
8a537e
+
8a537e
+date >>$seq.full
8a537e
+echo "=== checking parallel http operation ===" | tee -a $seq.full
8a537e
+for i in 1 2 3 4; do
8a537e
+    curl -Gs "http://localhost:$port/pmapi/metric?name=sample.long.ten" 2>$tmp.err$i >$tmp.out$i & 2>/dev/null eval pid$i=$!
8a537e
+done
8a537e
+wait $pid1 $pid2 $pid3 $pid4
8a537e
+for i in 1 2 3 4; do
8a537e
+echo === out$i === | tee -a $seq.full
8a537e
+_filter_json < $tmp.out$i
8a537e
+done
8a537e
+
8a537e
+date >>$seq.full
8a537e
+echo "=== checking serial https/TLS operation ===" | tee -a $seq.full
8a537e
+for i in 1 2 3 4; do
8a537e
+    curl -k -Gs "https://localhost:$port/pmapi/metric?name=sample.long.ten" 2>$tmp.err$i >$tmp.out$i
8a537e
+done
8a537e
+for i in 1 2 3 4; do
8a537e
+echo === out$i === | tee -a $seq.full
8a537e
+_filter_json < $tmp.out$i
8a537e
+done
8a537e
+
8a537e
 date >>$seq.full
8a537e
+echo "=== checking parallel https/TLS operation ===" | tee -a $seq.full
8a537e
+for i in 1 2 3 4; do
8a537e
+    curl -k -Gs "https://localhost:$port/pmapi/metric?name=sample.long.ten" 2>$tmp.err$i >$tmp.out$i & 2>/dev/null eval pid$i=$!
8a537e
+done
8a537e
+wait $pid1 $pid2 $pid3 $pid4
8a537e
+for i in 1 2 3 4; do
8a537e
+echo === out$i === | tee -a $seq.full
8a537e
+_filter_json < $tmp.out$i
8a537e
+done
8a537e
+
8a537e
+date >>$seq.full
8a537e
+echo "=== checking parallel mixed http and https/TLS operations ===" | tee -a $seq.full
8a537e
+for i in 1 3 5 7; do
8a537e
+    j=`expr $i + 1`
8a537e
+    curl -k -Gs "http://localhost:$port/pmapi/metric?name=sample.long.ten" 2>$tmp.err$i >$tmp.out$i & 2>/dev/null eval pid$i=$!
8a537e
+    curl -k -Gs "https://localhost:$port/pmapi/metric?name=sample.long.ten" 2>$tmp.err$j >$tmp.out$j & 2>/dev/null eval pid$j=$!
8a537e
+done
8a537e
+wait $pid1 $pid2 $pid3 $pid4 $pid5 $pid6 $pid7 $pid8
8a537e
+for i in 1 2 3 4 5 6 7 8; do
8a537e
+echo === out$i === | tee -a $seq.full
8a537e
+_filter_json < $tmp.out$i
8a537e
+done
8a537e
 
8a537e
 echo "=== check pmproxy is running ==="
8a537e
 pminfo -v -h localhost@localhost:$port hinv.ncpu
8a537e
@@ -156,7 +201,7 @@ else
8a537e
 fi
8a537e
 
8a537e
 # valgrind takes awhile to shutdown too
8a537e
-pmsignal $pid
8a537e
+pmsignal $pid >/dev/null 2>&1
8a537e
 pmsleep 3.5
8a537e
 echo "=== valgrind stdout ===" | tee -a $seq.full
8a537e
 cat $tmp.valout | _filter_valgrind
8a537e
@@ -164,6 +209,9 @@ cat $tmp.valout | _filter_valgrind
8a537e
 echo "=== valgrind stderr ===" | tee -a $seq.full
8a537e
 cat $tmp.valerr | _filter_pmproxy_log | _filter_port
8a537e
 
8a537e
+# final kill if it's spinning
8a537e
+$sudo kill -9 $pid >/dev/null 2>&1
8a537e
+
8a537e
 # success, all done
8a537e
 status=0
8a537e
 exit
8a537e
diff --git a/qa/1457.out b/qa/1457.out
8a537e
index a7b64cdc5..422176db2 100644
8a537e
--- a/qa/1457.out
8a537e
+++ b/qa/1457.out
8a537e
@@ -1,5 +1,539 @@
8a537e
 QA output created by 1457
8a537e
-=== checking TLS operation ===
8a537e
+=== checking serial http operation ===
8a537e
+=== out1 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out2 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out3 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out4 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== checking parallel http operation ===
8a537e
+=== out1 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out2 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out3 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out4 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== checking serial https/TLS operation ===
8a537e
+=== out1 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out2 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out3 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out4 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== checking parallel https/TLS operation ===
8a537e
+=== out1 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out2 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out3 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out4 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== checking parallel mixed http and https/TLS operations ===
8a537e
+=== out1 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out2 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out3 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out4 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out5 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out6 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out7 ===
8a537e
+{
8a537e
+    "context": "CONTEXT"
8a537e
+    "metrics": [
8a537e
+        {
8a537e
+            "name": "sample.long.ten",
8a537e
+            "series": "SERIES"
8a537e
+            "pmid": "29.0.11",
8a537e
+            "type": "32",
8a537e
+            "sem": "instant",
8a537e
+            "units": "none",
8a537e
+            "labels": {
8a537e
+                "agent": "sample",
8a537e
+                "cluster": "zero",
8a537e
+                "domainname": "DOMAINNAME"
8a537e
+                "hostname": "HOSTNAME"
8a537e
+                "role": "testing"
8a537e
+            },
8a537e
+            "text-oneline": "10 as a 32-bit integer",
8a537e
+            "text-help": "10 as a 32-bit integer"
8a537e
+        }
8a537e
+    ]
8a537e
+}
8a537e
+=== out8 ===
8a537e
 {
8a537e
     "context": "CONTEXT"
8a537e
     "metrics": [
8a537e
diff --git a/qa/group b/qa/group
8a537e
index 462dffaaa..77cac788d 100644
8a537e
--- a/qa/group
8a537e
+++ b/qa/group
8a537e
@@ -1818,7 +1818,7 @@ x11
8a537e
 1436 pmda.postgresql local
8a537e
 1437 pmda.kvm local
8a537e
 1455 pmlogrewrite labels pmdumplog local
8a537e
-1457 pmproxy local
8a537e
+1457 pmproxy libpcp_web threads secure local
8a537e
 1480 pmda.lmsensors local
8a537e
 1489 python pmrep pmimport local
8a537e
 1490 python local labels
8a537e
diff --git a/src/pmproxy/src/secure.c b/src/pmproxy/src/secure.c
8a537e
index 77265894c..072e2a085 100644
8a537e
--- a/src/pmproxy/src/secure.c
8a537e
+++ b/src/pmproxy/src/secure.c
8a537e
@@ -16,13 +16,25 @@
8a537e
 #include <openssl/opensslv.h>
8a537e
 #include <openssl/ssl.h>
8a537e
 
8a537e
+/* called with proxy->mutex locked */
8a537e
 static void
8a537e
 remove_connection_from_queue(struct client *client)
8a537e
 {
8a537e
+    struct proxy *proxy = client->proxy;
8a537e
+
8a537e
     if (client->secure.pending.writes_buffer != NULL)
8a537e
 	free(client->secure.pending.writes_buffer);
8a537e
-    if (client->secure.pending.prev != NULL)
8a537e
-	*client->secure.pending.prev = client->secure.pending.next;
8a537e
+    if (client->secure.pending.prev == NULL) {
8a537e
+	/* next (if any) becomes first in pending_writes list */
8a537e
+    	proxy->pending_writes = client->secure.pending.next;
8a537e
+	if (proxy->pending_writes)
8a537e
+	    proxy->pending_writes->secure.pending.prev = NULL;
8a537e
+    }
8a537e
+    else {
8a537e
+	/* link next and prev */
8a537e
+	client->secure.pending.prev->secure.pending.next = client->secure.pending.next;
8a537e
+	client->secure.pending.next->secure.pending.prev = client->secure.pending.prev;
8a537e
+    }
8a537e
     memset(&client->secure.pending, 0, sizeof(client->secure.pending));
8a537e
 }
8a537e
 
8a537e
@@ -32,7 +44,9 @@ on_secure_client_close(struct client *client)
8a537e
     if (pmDebugOptions.auth || pmDebugOptions.http)
8a537e
 	fprintf(stderr, "%s: client %p\n", "on_secure_client_close", client);
8a537e
 
8a537e
+    uv_mutex_lock(&client->proxy->mutex);
8a537e
     remove_connection_from_queue(client);
8a537e
+    uv_mutex_unlock(&client->proxy->mutex);
8a537e
     /* client->read and client->write freed by SSL_free */
8a537e
     SSL_free(client->secure.ssl);
8a537e
 }
8a537e
@@ -40,6 +54,8 @@ on_secure_client_close(struct client *client)
8a537e
 static void
8a537e
 maybe_flush_ssl(struct proxy *proxy, struct client *client)
8a537e
 {
8a537e
+    struct client *c;
8a537e
+
8a537e
     if (client->secure.pending.queued)
8a537e
 	return;
8a537e
 
8a537e
@@ -47,13 +63,19 @@ maybe_flush_ssl(struct proxy *proxy, struct client *client)
8a537e
 	client->secure.pending.writes_count > 0)
8a537e
 	return;
8a537e
 
8a537e
-    client->secure.pending.next = proxy->pending_writes;
8a537e
-    if (client->secure.pending.next != NULL)
8a537e
-	client->secure.pending.next->secure.pending.prev = &client->secure.pending.next;
8a537e
-    client->secure.pending.prev = &proxy->pending_writes;
8a537e
+    uv_mutex_lock(&proxy->mutex);
8a537e
+    if (proxy->pending_writes == NULL) {
8a537e
+    	proxy->pending_writes = client;
8a537e
+	client->secure.pending.prev = client->secure.pending.next = NULL;
8a537e
+    }
8a537e
+    else {
8a537e
+    	for (c=proxy->pending_writes; c->secure.pending.next; c = c->secure.pending.next)
8a537e
+	    ; /**/
8a537e
+	c->secure.pending.next = client;
8a537e
+	client->secure.pending.prev = c;
8a537e
+    }
8a537e
     client->secure.pending.queued = 1;
8a537e
-
8a537e
-    proxy->pending_writes = client;
8a537e
+    uv_mutex_unlock(&proxy->mutex);
8a537e
 }
8a537e
 
8a537e
 static void
8a537e
@@ -135,10 +157,12 @@ flush_ssl_buffer(struct client *client)
8a537e
 void
8a537e
 flush_secure_module(struct proxy *proxy)
8a537e
 {
8a537e
-    struct client	*client, **head = &proxy->pending_writes;
8a537e
+    struct client	*client, **head;
8a537e
     size_t		i, used;
8a537e
     int			sts;
8a537e
 
8a537e
+    uv_mutex_lock(&proxy->mutex);
8a537e
+    head = &proxy->pending_writes;
8a537e
     while ((client = *head) != NULL) {
8a537e
 	flush_ssl_buffer(client);
8a537e
 
8a537e
@@ -188,6 +212,7 @@ flush_secure_module(struct proxy *proxy)
8a537e
 		    sizeof(uv_buf_t) * client->secure.pending.writes_count);
8a537e
 	}
8a537e
     }
8a537e
+    uv_mutex_unlock(&proxy->mutex);
8a537e
 }
8a537e
 
8a537e
 void
8a537e
diff --git a/src/pmproxy/src/server.c b/src/pmproxy/src/server.c
8a537e
index 612d3613b..b5c5d84de 100644
8a537e
--- a/src/pmproxy/src/server.c
8a537e
+++ b/src/pmproxy/src/server.c
8a537e
@@ -149,6 +149,7 @@ server_init(int portcount, const char *localpath)
8a537e
 			pmGetProgname());
8a537e
 	return NULL;
8a537e
     }
8a537e
+    uv_mutex_init(&proxy->mutex);
8a537e
 
8a537e
     count = portcount + (*localpath ? 1 : 0);
8a537e
     if (count) {
8a537e
@@ -251,6 +252,7 @@ void
8a537e
 client_put(struct client *client)
8a537e
 {
8a537e
     unsigned int	refcount;
8a537e
+    struct proxy	*proxy = client->proxy;
8a537e
 
8a537e
     uv_mutex_lock(&client->mutex);
8a537e
     assert(client->refcount);
8a537e
@@ -259,9 +261,11 @@ client_put(struct client *client)
8a537e
 
8a537e
     if (refcount == 0) {
8a537e
 	/* remove client from the doubly-linked list */
8a537e
+	uv_mutex_lock(&proxy->mutex);
8a537e
 	if (client->next != NULL)
8a537e
 	    client->next->prev = client->prev;
8a537e
 	*client->prev = client->next;
8a537e
+	uv_mutex_unlock(&proxy->mutex);
8a537e
 
8a537e
 	if (client->protocol & STREAM_PCP)
8a537e
 	    on_pcp_client_close(client);
8a537e
@@ -514,10 +518,12 @@ on_client_connection(uv_stream_t *stream, int status)
8a537e
     client->proxy = proxy;
8a537e
 
8a537e
     /* insert client into doubly-linked list at the head */
8a537e
+    uv_mutex_lock(&proxy->mutex);
8a537e
     if ((client->next = proxy->first) != NULL)
8a537e
 	proxy->first->prev = &client->next;
8a537e
     proxy->first = client;
8a537e
     client->prev = &proxy->first;
8a537e
+    uv_mutex_unlock(&proxy->mutex);
8a537e
 
8a537e
     status = uv_read_start((uv_stream_t *)&client->stream.u.tcp,
8a537e
 			    on_buffer_alloc, on_client_read);
8a537e
diff --git a/src/pmproxy/src/server.h b/src/pmproxy/src/server.h
8a537e
index f0b7a5f68..f93daeff4 100644
8a537e
--- a/src/pmproxy/src/server.h
8a537e
+++ b/src/pmproxy/src/server.h
8a537e
@@ -118,7 +118,7 @@ typedef struct secure_client {
8a537e
     BIO			*write;
8a537e
     struct {
8a537e
 	struct client	*next;
8a537e
-	struct client	**prev;
8a537e
+	struct client	*prev;
8a537e
 	unsigned int	queued;
8a537e
 	size_t		writes_count;
8a537e
 	uv_buf_t	*writes_buffer;
8a537e
@@ -166,6 +166,7 @@ typedef struct proxy {
8a537e
     struct dict		*config;	/* configuration dictionary */
8a537e
     uv_loop_t		*events;	/* global, async event loop */
8a537e
     uv_callback_t	write_callbacks;
8a537e
+    uv_mutex_t		mutex;		/* protects client lists and pending writes */
8a537e
 } proxy;
8a537e
 
8a537e
 extern void proxylog(pmLogLevel, sds, void *);