bneradt opened a new pull request, #13949: URL: https://github.com/apache/trafficserver/pull/13949
When a `TS_SSL_CLIENT_HELLO_HOOK` reenables a TLS connection asynchronously, `SSLNetVConnection::reenable()` used to run the remaining ClientHello hooks itself, outside OpenSSL's ClientHello callback. At that point `TLSSNISupport::_ch` still pointed at the `ClientHello` stack object from `ssl_client_hello_callback`, which no longer existed. So any later hook that read the ClientHello (`TSVConnClientHelloGet()` / `TSClientHelloExtensionGet()`, as `jax_fingerprint`, `ja4_fingerprint` and `abuse_shield` do) read freed memory. For example, loading `ssl_hook_test.so -client_hello=1` ahead of `jax_fingerprint.so --method JA4 --standalone` crashes `traffic_server` in `TLSSNISupport::ClientHello::getExtension` on an HTTP/1.1-over-TLS request. This uses the same approach as the QUIC ClientHello hooks in apache/trafficserver#13919: * For the ClientHello stage, `reenable()` now only leaves the paused state and reschedules the handshake. OpenSSL calls the ClientHello callback again after `SSL_CLIENT_HELLO_RETRY` (and BoringSSL re-runs `select_certificate_cb`), and that callback, which has the live ClientHello, runs the remaining hooks. Hooks that reenable synchronously inside their invocation are run by a loop in the callback. The other hook stages behave as before. * On that re-entry the callback does not run the SNI actions again, and the handshake does not try to read more ClientHello bytes off the socket, because the TLS library already holds the whole message. * `_ch` is cleared when the callback returns, so a read outside the callback gets `nullptr` rather than a dangling pointer. Testing: the new Uranium test `tls_hooks/test_tls_client_hello_reader.py` loads one or two delayed ClientHello hooks ahead of `jax_fingerprint` (JA4) and checks that the request succeeds and carries a JA4 fingerprint. It crashes `traffic_server` without this change. The full Uranium suite passes with the `ci-fedora-urtest` preset (1444 passed, 39 skipped). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
