Copilot commented on code in PR #13799:
URL: https://github.com/apache/trafficserver/pull/13799#discussion_r4189494515
##########
src/iocore/net/SSLUtils.cc:
##########
@@ -284,21 +305,26 @@ ssl_cert_callback(SSL *ssl, [[maybe_unused]] void *arg)
if (tcss) {
if (tes) {
- // Do the common certificate lookup only once. If we pause
- // and restart processing, do not execute the common logic again
- if (!tes->calledHooks(TS_EVENT_SSL_CERT)) {
+ bool const hooks_finished = tes->finished_cert_hooks();
+
+ // On retry, keep a context selected by a completed cert hook. A new
handshake
+ // must retain the existing certificate lookup behavior.
+ if ((!hooks_finished || is_renegotiation) &&
!tes->calledHooks(TS_EVENT_SSL_CERT)) {
Review Comment:
Allowed renegotiation still skips certificate selection once a previous
verify-client hook has advanced the hook state to `HANDSHAKE_HOOKS_DONE`:
`calledHooks()` returns true for every event in that state, so the
`is_renegotiation` branch is neutralized by the trailing `&&`. A renegotiation
with changed SNI can therefore retain the old certificate. Make renegotiation
bypass the completed-hook check (and cover the DONE-state/SNI-change case).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
