Copilot commented on code in PR #13342:
URL: https://github.com/apache/trafficserver/pull/13342#discussion_r3572009165
##########
src/iocore/net/P_SSLCertLookup.h:
##########
@@ -154,10 +155,18 @@ struct SSLCertLookup : public ConfigInfo {
SSLCertContext *find(const std::string &name, SSLCertContextType ctxType =
SSLCertContextType::GENERIC) const;
// Return the last-resort default TLS context if there is no name or address
match.
- SSL_CTX *
+ shared_SSL_CTX
defaultContext() const
{
- return ssl_default.get();
+ std::lock_guard<std::mutex> lock(default_ctx_mutex);
+ return ssl_default;
+ }
Review Comment:
`defaultContext()` is used on the server-handshake hot path, but it
currently takes an exclusive `std::mutex` lock even for read-only access. That
can serialize handshakes across threads during normal operation and makes
contention worse when secrets are refreshed. Consider switching to
`std::shared_mutex` (shared lock for readers, unique lock for writers) to keep
secret refresh thread-safe without penalizing read-mostly access.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
