AlinsRan opened a new pull request, #14118: URL: https://github.com/apache/apisix/pull/14118
### Description The consul discovery client sends its queries through `resty.consul`, which connects with `httpc:connect(host, port)`. That form uses the default `host:port` connection pool, and `ssl_handshake` returns immediately on a reused connection. When two consul registries point at the same https server, one with `ssl_verify: false` and one with `ssl_verify: true`, the verifying registry can pick up a pooled connection the other one set up without certificate verification, and fetch nodes from a server whose certificate it would reject. This PR replaces the `resty.consul` client in `apisix/discovery/consul/client.lua` with a small GET helper built on the table form of `resty.http` `connect`. That form puts the scheme, SNI and `ssl_verify` into the pool name, so a connection is reused only by a client with the same TLS options. The query building (token header, `wait`/`index` blocking query timeouts, JSON body decoding, keepalive) is the same as before. `consul_kv` discovery still uses `resty.consul`, but it only accepts `http://` servers, so no TLS verification setting is involved. Test: `t/discovery/consul-tls.t` TEST 7 runs the default registry with `ssl_verify: false` and a second registry with `ssl_verify: true` against the same https endpoint, whose certificate is not trusted. Before this change the second registry resolves the service; with the change it fails certificate verification. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change (no user-facing configuration change) - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
