Copilot commented on code in PR #13919:
URL: https://github.com/apache/trafficserver/pull/13919#discussion_r4387507220
##########
src/iocore/net/OpenSSLQUICNetVConnection.cc:
##########
@@ -250,7 +252,7 @@ QUICNetVConnection::state_handshake(int event, Event *data)
break;
}
- if (this->closed != 1 && SSL_is_init_finished(this->_ssl)) {
+ if (this->closed != 1 && SSL_is_init_finished(this->_ssl) &&
this->_run_client_hello_hooks()) {
Review Comment:
This gates every native-QUIC `TS_SSL_CLIENT_HELLO_HOOK` invocation on
`SSL_is_init_finished`, so the hooks run only after the TLS handshake
(including ServerHello and key exchange) has completed. That changes the
documented/established hook semantics: hooks that return `TS_EVENT_ERROR` (for
example abuse-shield's client-hello rejection) can no longer reject before
handshake work, and hooks that configure TLS state are too late. Dispatch the
hook while the handshake is still paused, or explicitly provide a separate
post-handshake hook/contract instead of silently reusing the ClientHello hook.
This issue also appears on line 255 of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
