[PR] Guard the BoringSSL '*' certificate fallback [trafficserver]

["moonchen (via GitHub)" <gi...@apache.org>]

moonchen opened a new pull request, #13795:
URL: https://github.com/apache/trafficserver/pull/13795

   Makes the BoringSSL `*` certificate fallback from #13712 skip a connection that an earlier name lookup has already turned into a blind tunnel, as the address lookup already does, so the three lookups agree once a connection is tunneled. It also logs the key type when the fallback selects a context, and documents that on BoringSSL a `*` entry with `action: tunnel` tunnels clients on a transparent port that match no other entry, where OpenSSL fails their handshake. The library difference is otherwise invisible until it shows up in production.
   
   The dual-certificate test now runs both certificate orders when one fails, and notes why its second entry sets an empty `dest_ip`: an entry without one defaults to `*`, which would make it a second default entry.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Guard the BoringSSL '*' certificate fallback [trafficserver]

["Copilot (via GitHub)" <gi...@apache.org>]

Copilot commented on code in PR #13795:
URL: https://github.com/apache/trafficserver/pull/13795#discussion_r4189064656


##########
src/iocore/net/SSLNetVConnection.cc:
##########
@@ -2016,6 +2016,11 @@ SSLNetVConnection::_isTryingRenegotiation() const
 shared_SSL_CTX
 SSLNetVConnection::_lookupContextByName(const std::string &servername, SSLCertContextType ctxType)
 {
+  // Return null if this vc is already configured as a tunnel
+  if (this->attributes == HttpProxyPort::TRANSPORT_BLIND_TUNNEL) {
+    return nullptr;

Review Comment:
   Add an AuTest that configures a transparent TLS port with a name-specific `action: tunnel` entry plus a `dest_ip: "*"` fallback, and verify under BoringSSL that an unmatched fallback cannot replace the tunnel decision. The updated dual-certificate test never enables transparent mode or `action: tunnel`, so it does not exercise this guard and the production regression could return unnoticed.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org