bneradt commented on code in PR #13342:
URL: https://github.com/apache/trafficserver/pull/13342#discussion_r3572045439
##########
src/iocore/net/SSLUtils.cc:
##########
@@ -1733,6 +1733,18 @@ SSLMultiCertConfigLoader::update_ssl_ctx(const
std::string &secret_name)
if (!ctx) {
retval = false;
} else {
+ // Address and default-context lookups are owned by the same policy,
but
+ // are not part of the certificate CN/SAN name sets below.
+ for (unsigned i = 0; i < lookup->count(loadingctx.ctx_type); ++i) {
+ SSLCertContext *cc = lookup->get(i, loadingctx.ctx_type);
+ if (cc && cc->ctx_type == loadingctx.ctx_type &&
cc->userconfig.get() == policy_iter->get()) {
+ cc->setCtx(ctx);
+ }
+ }
+ if ((*policy_iter)->addr && strcmp((*policy_iter)->addr, "*") == 0) {
+ lookup->setDefaultContext(ctx);
+ this->_set_handshake_callbacks(ctx.get());
Review Comment:
Fixed. For the wildcard/default context, the handshake callbacks are now
installed before the context is published through either
SSLCertContext::setCtx() or setDefaultContext(), closing the window where a net
thread could create an SSL without the certificate callback.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
