You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "lzx404243 (via GitHub)" <gi...@apache.org> on 2023/08/14 18:01:00 UTC
[GitHub] [trafficserver] lzx404243 opened a new pull request, #10184: Check SNI in h3
lzx404243 opened a new pull request, #10184:
URL: https://github.com/apache/trafficserver/pull/10184
This closes #10089.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficserver] maskit commented on pull request #10184: Check SNI in h3
Posted by "maskit (via GitHub)" <gi...@apache.org>.
maskit commented on PR #10184:
URL: https://github.com/apache/trafficserver/pull/10184#issuecomment-1678001323
Sounds reasonable and I'm fine with it, however, I wonder how other implementations behave.
Also, I should have known this but what happens after we reject a connection at `accept()`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficserver] maskit commented on pull request #10184: Check SNI in h3
Posted by "maskit (via GitHub)" <gi...@apache.org>.
maskit commented on PR #10184:
URL: https://github.com/apache/trafficserver/pull/10184#issuecomment-1678154342
Ok, I think this PR is fine. I don't think I implemented a way to initiate connection close on H3 layer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficserver] maskit merged pull request #10184: Check SNI in h3
Posted by "maskit (via GitHub)" <gi...@apache.org>.
maskit merged PR #10184:
URL: https://github.com/apache/trafficserver/pull/10184
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficserver] lzx404243 commented on pull request #10184: Check SNI in h3
Posted by "lzx404243 (via GitHub)" <gi...@apache.org>.
lzx404243 commented on PR #10184:
URL: https://github.com/apache/trafficserver/pull/10184#issuecomment-1678122487
> what happens after ATS rejects a connection at `accept()`?
`netvc->do_io_close()` will be called which supposedly closes the quic connection.
However, I noticed in the Autest that the curl/proxy verifier client times out. And doing a packet capture on the rejection case, I don't see ATS closes the quic connection(no `CONNECTION_CLOSE ` frame etc). It seems there is some silent drop going on here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficserver] lzx404243 commented on pull request #10184: Check SNI in h3
Posted by "lzx404243 (via GitHub)" <gi...@apache.org>.
lzx404243 commented on PR #10184:
URL: https://github.com/apache/trafficserver/pull/10184#issuecomment-1677826093
@maskit What do you think about placing the SNI check in `Http3SessionAccept::accept()`? On one hand, it makes sense as this is right before the start of a H3 session and once we know that client didn't send a SNI we can reject it and don't need to start the session at all. The downside for this is we can't send a H3 response from here. We just rejects the session.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org