JosiahWI commented on code in PR #13677:
URL: https://github.com/apache/trafficserver/pull/13677#discussion_r4017600753
##########
src/iocore/net/SSLUtils.cc:
##########
@@ -578,33 +578,21 @@ ssl_apply_sni_session_ticket_properties(SSL *ssl)
}
#endif
-static ssl_ticket_key_block *
-ssl_context_enable_tickets(SSL_CTX *ctx, const char *ticket_key_path)
+static bool
+ssl_context_enable_tickets(SSL_CTX *ctx)
{
#if TS_HAS_TLS_SESSION_TICKET
- ssl_ticket_key_block *keyblock = nullptr;
-
- keyblock = ssl_create_ticket_keyblock(ticket_key_path);
-
- // On the "first run" the metrics have not been initialized, so this has to
check it.
- if (ssl_rsb.total_ticket_keys_renewed) {
- Metrics::Counter::increment(ssl_rsb.total_ticket_keys_renewed);
- }
-
// Setting the callback can only fail if OpenSSL does not recognize the
// SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB constant. we set the callback first
- // so that we don't leave a ticket_key pointer attached if it fails.
+ // so that we don't leave a ticket-key callback attached if it fails.
if (!ssl_context_enable_ticket_callback(ctx)) {
- ticket_block_free(keyblock);
- return nullptr;
+ return false;
}
-
SSL_CTX_clear_options(ctx, SSL_OP_NO_TICKET);
- return keyblock;
-
+ return true;
#else /* !TS_HAS_TLS_SESSION_TICKET */
- (void)ticket_key_path;
- return nullptr;
+ (void)ctx;
+ return true;
Review Comment:
Thank you, this is a great description. I understand now that this patch is
affecting the default configuration on context initialization, but the behavior
of configuration applied to each context at a later stage retains integrity.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
