bneradt commented on PR #13846: URL: https://github.com/apache/trafficserver/pull/13846#issuecomment-6204211301
@bryancall thanks for the thorough review and the repro. All four points are addressed in the force-pushed f8786999f1. **Outbound connections.** The `net_read_io` check is now limited to `NET_VCONNECTION_IN`, as you suggested. I added `tls/tls_hooks_verify_tls12.test.py`, which runs your case: a TLS 1.2 origin with the origin session cache off and a PERMISSIVE verify-server failure. It asserts a 200 and a single origin handshake. It fails with the previous revision of this PR and passes now. **Deferred rejection at the later hooks.** The test plugin is now `tls_hook_reject.cc` with `--hook=vconn_start|client_hello|cert` and `--async`, and `tls_hooks/tls_hooks_reject.test.py` covers all six combinations. On master, five of the six fail: | Hook | In the hook | Async | |---|---|---| | vconn_start | left open | left open | | client_hello | closed | left open | | cert | **handshake completes** | left open | The synchronous cert case turned up a separate bug: `ssl_cert_callback` ignored the error and the handshake finished normally. The synchronous ClientHello case only worked because the certificate callback took the error state for a renegotiation attempt. Both callbacks now check a new `getSSLHandShakeRejected()` and fail the handshake explicitly. I updated the PR title and description to match. **Async assertion nit.** The async runs now require `Rejecting connection .* asynchronously`, and the sync runs require the plain line without that suffix. **reject_probe.py nit.** The probe now does a real handshake with Python's `ssl` module, which the ClientHello and cert hooks need anyway. A TLS alert and a close both count as a rejection; only a completed handshake or a timeout fail it. The truncated ClientHello payload is gone. The new tests and the related TLS hook, verify, rate_limit and abuse_shield autests (51 total) pass locally. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
