maskit commented on PR #13548: URL: https://github.com/apache/trafficserver/pull/13548#issuecomment-6515177106
Rebased onto current master, which also moved the test to Uranium. Addressed at `24a1e8c589`. The Uranium suite passes on BoringSSL and on OpenSSL 3.6. ## Pool reuse Reuse now checks the key that authenticated the connection, not the set's digest (`e8edfabcf6`). Comparing digests let a connection accepted under PERMISSIVE carry a request verified under ENFORCED, and it dropped every pooled connection when a key was added for rotation. A request verified under ENFORCED now reuses a connection only while the key it was authenticated with is in the set the request would pin. The check also runs for HTTP/1.1 sessions, which were reused without one. ## Resumption test `test_rpk_hop_replaced_pin_set_retires_origin_sessions` establishes a session, resumes it, then replaces the pin file, reloads, and requires a full handshake with a different digest in the key. Two corrections came out of writing it: - Replacing the pin file and reloading did nothing, because the file was not watched. It is now (`1f51afc824`). - I was wrong that replacing `server_rpk_ca` leaves the context pointer alone. Any SSL reload rebuilds the client contexts. The digest is still needed, since a new context can reuse the old address, so the test asserts the digest change directly. ## AuTest 3of4 The likely cause is two assertions on a log line only the BoringSSL fallback wrote, added in `0fcb674b13`, which failed on any OpenSSL build with raw public key support. OpenSSL now logs the same line (`312556d2d6`). ## A regression this PR introduced On OpenSSL 3.2+, selecting the certificate in the ClientHello callback (`0335f8865d`) moved connections to a context with no certificate callback. On non-default entries that skipped `TS_EVENT_SSL_CERT` hooks and lost a `verify_client` CA override. The callbacks are now on every context, and the early selection only happens where some entry uses raw public keys (`011e54fc96`). The non-blocking items are done as well. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
