maskit commented on code in PR #13548:
URL: https://github.com/apache/trafficserver/pull/13548#discussion_r4420644100
##########
src/proxy/http/HttpSessionManager.cc:
##########
@@ -163,18 +174,36 @@ ServerSessionPool::validate_sni(HttpSM *sm,
NetVConnection *netvc)
std::string_view proposed_sni = sm->get_outbound_sni();
Dbg(dbg_ctl_http_ss, "validate_sni proposed_sni=%.*s, sni=%s",
static_cast<int>(proposed_sni.length()), proposed_sni.data(),
session_sni);
- if (!session_sni || session_sni[0] == '\0' || proposed_sni.length() ==
0) {
- retval = session_sni == nullptr && proposed_sni.length() == 0;
- } else {
- retval = proposed_sni.compare(session_sni) == 0;
- }
+ retval = sni_matches(proposed_sni, session_sni);
Review Comment:
Right, it applies to X.509 sessions too. The description covers it under
"Changes outside raw public keys", but the IP-literal example was wrong, and it
came from our own comments, now fixed in `2cf61a19df`. An IP-literal origin's
outbound SNI is the literal, which isn't sent, so `sni_matches("10.0.0.1", "")`
is still false. The sessions it affects are the ones whose outbound SNI is
empty, such as under the `server_name` policy when the client sent none, and
only when `server_session_sharing.match` includes `sni`. For those it restores
the 10.0 behavior: until `2d34cd33e0` the session's name came from
`SSL_get_servername()`, which returns null when no SNI was sent, so two empty
names matched. I'd keep it for X.509.
##########
include/config/ssl_multicert.h:
##########
@@ -37,16 +37,18 @@ namespace config
* Represents a single certificate entry in ssl_multicert configuration.
*/
struct SSLMultiCertEntry {
- std::string ssl_cert_name; ///< Certificate file name (required
unless action is tunnel).
- std::string dest_ip; ///< IP address to match (empty means
no binding). Only "*" sets default.
- std::string ssl_key_name; ///< Private key file name (optional).
- std::string ssl_ca_name; ///< CA certificate file name
(optional).
- std::string ssl_ocsp_name; ///< OCSP response file name
(optional).
- std::string ssl_key_dialog; ///< Passphrase dialog method
(optional).
- std::string dest_fqdn; ///< Destination FQDN (optional).
- std::string action; ///< Action (e.g., "tunnel").
- std::optional<int> ssl_ticket_enabled; ///< Session ticket enabled
(optional).
- std::optional<int> ssl_ticket_number; ///< Number of session tickets
(optional).
+ std::string ssl_cert_name; ///< Certificate file name
(required unless action is tunnel).
+ std::string dest_ip; ///< IP address to match (empty
means no binding). Only "*" sets default.
+ std::string ssl_key_name; ///< Private key file name
(optional).
+ std::string ssl_ca_name; ///< CA certificate file name
(optional).
+ std::string ssl_ocsp_name; ///< OCSP response file name
(optional).
+ std::string ssl_key_dialog; ///< Passphrase dialog method
(optional).
+ std::string dest_fqdn; ///< Destination FQDN (optional).
+ std::string action; ///< Action (e.g., "tunnel").
+ std::optional<int> ssl_ticket_enabled; ///< Session ticket enabled
(optional).
+ std::optional<int> ssl_ticket_number; ///< Number of session tickets
(optional).
+ std::optional<int> ssl_rpk_enabled; ///< Offer a RFC 7250 raw public
key alongside X.509 (optional).
Review Comment:
Fixed in `a7da65f691`, along with the one in `SSLSNIConfig.h`.
##########
include/iocore/net/SSLSNIConfig.h:
##########
@@ -42,15 +42,24 @@
#include "iocore/eventsystem/ConfigProcessor.h"
#include "iocore/net/SNIActionItem.h"
+#include "iocore/net/SSLTypes.h"
#include "iocore/net/YamlSNIConfig.h"
#include "mgmt/config/ConfigContext.h"
#include <functional>
// Properties for the next hop server
struct NextHopProperty {
- std::string client_cert_file;
// full path to client cert file for lookup
- std::string client_key_file;
// full path to client key file for lookup
+ std::string client_cert_file; // full path to client cert file for
lookup
+ std::string client_key_file; // full path to client key file for
lookup
+ bool client_rpk_enabled = false; // offer a RFC 7250 raw public key
(derived from the configured client
Review Comment:
Fixed in `a7da65f691`, along with the one in `ssl_multicert.h`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
