brbzull0 opened a new pull request, #13908:
URL: https://github.com/apache/trafficserver/pull/13908
`SNI_IpAllow`, `VerifyClient` and `TunnelDestination` get the connection
from `SSLNetVCAccess()`, which only knows `SSLNetVConnection`.
`QUICNetVConnection` binds `TLSSNISupport` but not that ex_data slot, so
on a QUIC handshake `SSLNetVCAccess()` fails its `ink_assert` in Debug
builds. In Release builds it returns nullptr: `SNI_IpAllow` then
dereferences it, and the other two return without doing anything.
This reaches the connection through `TLSSNISupport::getInstance()`,
which TLS and QUIC connections both bind:
- `SNI_IpAllow` takes the `NetVConnection` and checks its peer or PROXY
address as before. It only uses `NetVConnection` methods, so a QUIC
connection is checked the same way. With no connection it refuses the
handshake.
- `VerifyClient` can only check a client certificate on an
`SSLNetVConnection`: the CA override is stored there for the
certificate callback, and `ssl_verify_client_callback()` looks the
connection up with `SSLNetVCAccess()`.
On any other connection it refuses the handshake when the level is
`MODERATE` or `STRICT`, instead of letting the default verification
stand in. `NONE` is applied to the `SSL` object as it is on TCP, so
on QUIC too it overrides a stricter global level.
- `TunnelDestination` refuses a connection that isn't an
`SSLNetVConnection`, because only those can be tunnelled. Before, it
returned without setting the route, and the name was served locally.
TLS over TCP is unchanged: the `TLSSNISupport` and the ex_data slot point
at the same `SSLNetVConnection`.
The OpenSSL QUIC backend doesn't run sni.yaml actions yet, and the
quiche backend looks them up with local port 0, so this has no visible
effect on HTTP/3 until that is fixed. The new unit tests bind a
connection that has `TLSSNISupport` but isn't an `SSLNetVConnection`,
the way `QUICNetVConnection` does, and call the actions directly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
