Copilot commented on code in PR #13342:
URL: https://github.com/apache/trafficserver/pull/13342#discussion_r3572167879
##########
src/iocore/net/SSLUtils.cc:
##########
@@ -1733,6 +1733,27 @@ SSLMultiCertConfigLoader::update_ssl_ctx(const
std::string &secret_name)
if (!ctx) {
retval = false;
} else {
+ if ((*policy_iter)->addr) {
+ SSLCertContext *cc = nullptr;
+ if (strcmp((*policy_iter)->addr, "*") == 0) {
+ this->_set_handshake_callbacks(ctx.get());
+ cc = lookup->find("*", loadingctx.ctx_type);
+ } else {
+ IpEndpoint ep;
+ if (ats_ip_pton((*policy_iter)->addr, &ep) == 0) {
+ cc = lookup->find(ep, loadingctx.ctx_type);
+ } else {
+ Error("'%s' is not a valid IPv4 or IPv6 address", (const char
*)(*policy_iter)->addr);
+ retval = false;
+ }
+ }
+ if (cc && cc->userconfig.get() == policy_iter->get()) {
+ cc->setCtx(ctx);
+ }
+ if (strcmp((*policy_iter)->addr, "*") == 0) {
+ lookup->setDefaultContext(ctx);
+ }
Review Comment:
`update_ssl_ctx()` updates the global default SSL context whenever the
updated policy has `addr == "*"`, even if the currently-installed `"*"` lookup
entry belongs to a different `ssl_multicert` policy. If multiple
wildcard-address policies exist, updating a non-default policy’s secret can
unintentionally switch the no-SNI/default certificate to the wrong SSL_CTX.
Gate `setDefaultContext()` on the same policy ownership check used for
`cc->setCtx()` so only the active `"*"` entry updates the default context.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
