moonchen commented on code in PR #13799:
URL: https://github.com/apache/trafficserver/pull/13799#discussion_r4252612082
##########
src/iocore/net/SSLUtils.cc:
##########
@@ -219,6 +219,18 @@ ssl_client_hello_callback(const SSL_CLIENT_HELLO
*client_hello)
TLSSNISupport::ClientHello ch = {client_hello};
#endif
+ TLSEventSupport *es = TLSEventSupport::getInstance(s);
+ // The TLS library calls back again once a paused ClientHello hook
reenables, by which time the
+ // ClientHello work and its hooks have run and the hook state has moved on.
Dispatching from
+ // that state would hand the next stage's hooks TS_EVENT_SSL_CLIENT_HELLO.
+ if (es != nullptr && es->finished_client_hello_hooks()) {
+ // Renegotiation carries a new ClientHello, whose SNI actions must still
run.
+ auto *ssl_vc = SSLNetVCAccess(s);
Review Comment:
Done in 0e1053289f. `TLSBasicSupport` now has
`is_tls_handshake_complete()`, backed by a pure virtual that
`SSLNetVConnection` implements with `getSSLHandShakeComplete()` and
`QUICNetVConnection` with `_handshake_completed`. The ClientHello guard and
the `is_renegotiation` check in `ssl_cert_callback` both use it, so neither
depends on `SSLNetVConnection` anymore.
I didn't reuse `TLSCertSwitchSupport::_isTryingRenegotiation()`, because on
TCP it is true only when renegotiation is disallowed, and this guard must let
an allowed renegotiation reach the SNI actions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
