moonchen opened a new pull request, #13795: URL: https://github.com/apache/trafficserver/pull/13795
Makes the BoringSSL `*` certificate fallback from #13712 skip a connection that an earlier name lookup has already turned into a blind tunnel, as the address lookup already does, so the three lookups agree once a connection is tunneled. It also logs the key type when the fallback selects a context, and documents that on BoringSSL a `*` entry with `action: tunnel` tunnels clients on a transparent port that match no other entry, where OpenSSL fails their handshake. The library difference is otherwise invisible until it shows up in production. The dual-certificate test now runs both certificate orders when one fails, and notes why its second entry sets an empty `dest_ip`: an entry without one defaults to `*`, which would make it a second default entry. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
