maskit commented on PR #13548: URL: https://github.com/apache/trafficserver/pull/13548#issuecomment-6537657253
Addressed at `5dd4fa79b5`. ## DISABLED connections Fixed as you suggested (`ce74b892f0`), with the function renamed to `origin_presented_raw_public_key()`. With that change alone, a connection that resumed a session under DISABLED would still record the key, unlike a full handshake. It no longer does, and `test_rpk_hop_resumed_disabled_connection_not_reused_when_enforced` covers that. Your variant is the DISABLED parameter of `test_rpk_hop_unpinned_connection_not_reused_when_enforced`. Putting the condition back fails both DISABLED variants and the resumed test. The `sni.yaml` paragraph you cited now scopes the guarantee to connections from the session pool and HTTP/2 connections shared with waiting requests (`03a7b1b0dd`). Two other reuse paths, a server session kept with its client connection (such as a private session) and an HTTP/1.1 connection handed to a waiting request, never run the reuse check, for certificates either, so the paragraph now says such connections are reused as they are for a certificate. ## `match: host` `test_rpk_hop_replaced_pin_set_retires_pooled_connections` now runs under `both` and `host`. Removing the check from the host-only loop fails only the `host` run. ## Verify hook note I narrowed the note rather than pass the store context (`6fe13baf61`), so the hook still gets no context for a raw public key on either library. The note now says that with OpenSSL, a plugin can't see the client's key from `TS_SSL_VERIFY_CLIENT_HOOK`. ## Key below the security level The outbound path now logs a throttled warning, `Origin raw public key failed verification. Action=%s Error=%s server=%s(%s)` (`479936699a`), and the comments say the hook runs for every key that reaches the pin decision. The inbound path stays at debug level, like a failed inbound X.509 chain. ## Nit The three comments are fixed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
