You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by zw...@apache.org on 2020/03/05 20:30:45 UTC
[trafficserver] 02/03: Move TestClientAction to SNIConfig class
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 7318ae5ad145a117b19dcfedf0c0cf28e68b33d7
Author: Susan Hinrichs <sh...@verizonmedia.com>
AuthorDate: Wed Feb 26 17:04:01 2020 +0000
Move TestClientAction to SNIConfig class
(cherry picked from commit 64e444029a8b7b9e45011b7abaec6adc67bc7b9f)
---
iocore/net/I_NetVConnection.h | 2 +-
iocore/net/P_SSLNetVConnection.h | 4 +---
iocore/net/P_SSLSNI.h | 2 ++
iocore/net/SSLNetVConnection.cc | 19 -------------------
iocore/net/SSLSNIConfig.cc | 19 +++++++++++++++++++
proxy/http/HttpSM.cc | 4 ++--
proxy/http3/Http3Session.cc | 2 +-
proxy/http3/Http3Session.h | 2 +-
8 files changed, 27 insertions(+), 27 deletions(-)
diff --git a/iocore/net/I_NetVConnection.h b/iocore/net/I_NetVConnection.h
index aca5d7f..1e3feba 100644
--- a/iocore/net/I_NetVConnection.h
+++ b/iocore/net/I_NetVConnection.h
@@ -642,7 +642,7 @@ public:
* supports a client provided SNI value
*/
virtual bool
- support_sni()
+ support_sni() const
{
return false;
}
diff --git a/iocore/net/P_SSLNetVConnection.h b/iocore/net/P_SSLNetVConnection.h
index e3d8451..8145ec5 100644
--- a/iocore/net/P_SSLNetVConnection.h
+++ b/iocore/net/P_SSLNetVConnection.h
@@ -409,7 +409,7 @@ public:
void set_server_name(std::string_view name);
bool
- support_sni() override
+ support_sni() const override
{
return true;
}
@@ -445,8 +445,6 @@ public:
verify_cert = ctx;
}
- static bool TestClientAction(const char *servername, const IpEndpoint &ep, int &enforcement_policy);
-
private:
std::string_view map_tls_protocol_to_tag(const char *proto_string) const;
bool update_rbio(bool move_to_socket);
diff --git a/iocore/net/P_SSLSNI.h b/iocore/net/P_SSLSNI.h
index 4cf71ff..2651e72 100644
--- a/iocore/net/P_SSLSNI.h
+++ b/iocore/net/P_SSLSNI.h
@@ -122,6 +122,8 @@ struct SNIConfig {
typedef ConfigProcessor::scoped_config<SNIConfig, SNIConfigParams> scoped_config;
+ static bool TestClientAction(const char *servername, const IpEndpoint &ep, int &enforcement_policy);
+
private:
static int configid;
};
diff --git a/iocore/net/SSLNetVConnection.cc b/iocore/net/SSLNetVConnection.cc
index 4f8a983..b3e842a 100644
--- a/iocore/net/SSLNetVConnection.cc
+++ b/iocore/net/SSLNetVConnection.cc
@@ -1934,22 +1934,3 @@ SSLNetVConnection::set_server_name(std::string_view name)
_serverName.reset(n);
}
}
-
-// See if any of the client-side actions would trigger for this combination of servername and
-// client IP
-// host_sni_policy is an in/out paramter. It starts with the global policy from the records.config
-// setting proxy.config.http.host_sni_policy and is possibly overridden if the sni policy
-// contains a host_sni_policy entry
-bool
-SSLNetVConnection::TestClientAction(const char *servername, const IpEndpoint &ep, int &host_sni_policy)
-{
- bool retval = false;
- SNIConfig::scoped_config params;
- const actionVector *actionvec = params->get(servername);
- if (actionvec) {
- for (auto &&item : *actionvec) {
- retval |= item->TestClientSNIAction(servername, ep, host_sni_policy);
- }
- }
- return retval;
-}
diff --git a/iocore/net/SSLSNIConfig.cc b/iocore/net/SSLSNIConfig.cc
index 66ce9e0..f09bba9 100644
--- a/iocore/net/SSLSNIConfig.cc
+++ b/iocore/net/SSLSNIConfig.cc
@@ -186,3 +186,22 @@ SNIConfig::release(SNIConfigParams *params)
{
configProcessor.release(configid, params);
}
+
+// See if any of the client-side actions would trigger for this combination of servername and
+// client IP
+// host_sni_policy is an in/out paramter. It starts with the global policy from the records.config
+// setting proxy.config.http.host_sni_policy and is possibly overridden if the sni policy
+// contains a host_sni_policy entry
+bool
+SNIConfig::TestClientAction(const char *servername, const IpEndpoint &ep, int &host_sni_policy)
+{
+ bool retval = false;
+ SNIConfig::scoped_config params;
+ const actionVector *actionvec = params->get(servername);
+ if (actionvec) {
+ for (auto &&item : *actionvec) {
+ retval |= item->TestClientSNIAction(servername, ep, host_sni_policy);
+ }
+ }
+ return retval;
+}
diff --git a/proxy/http/HttpSM.cc b/proxy/http/HttpSM.cc
index 79e11fa..7762d8e 100644
--- a/proxy/http/HttpSM.cc
+++ b/proxy/http/HttpSM.cc
@@ -40,6 +40,7 @@
#include "RemapProcessor.h"
#include "Transform.h"
#include "P_SSLConfig.h"
+#include "P_SSLSNI.h"
#include "HttpPages.h"
#include "IPAllow.h"
#include "tscore/I_Layout.h"
@@ -3970,8 +3971,7 @@ HttpSM::check_sni_host()
NetVConnection *netvc = ua_txn->get_netvc();
if (netvc) {
IpEndpoint ip = netvc->get_remote_endpoint();
- if (SSLNetVConnection::TestClientAction(std::string{host_name, static_cast<size_t>(host_len)}.c_str(), ip,
- host_sni_policy) &&
+ if (SNIConfig::TestClientAction(std::string{host_name, static_cast<size_t>(host_len)}.c_str(), ip, host_sni_policy) &&
host_sni_policy > 0) {
// In a SNI/Host mismatch where the Host would have triggered SNI policy, mark the transaction
// to be considered for rejection after the remap phase passes. Gives the opportunity to conf_remap
diff --git a/proxy/http3/Http3Session.cc b/proxy/http3/Http3Session.cc
index aad7eb1..c393c30 100644
--- a/proxy/http3/Http3Session.cc
+++ b/proxy/http3/Http3Session.cc
@@ -133,7 +133,7 @@ HQSession::get_transact_count() const
bool
HQSession::support_sni() const
{
- return this->_client_vc;
+ return this->_client_vc ? this->_client_vc->support_sni() : false;
}
//
diff --git a/proxy/http3/Http3Session.h b/proxy/http3/Http3Session.h
index e238ccf..f688f8c 100644
--- a/proxy/http3/Http3Session.h
+++ b/proxy/http3/Http3Session.h
@@ -49,7 +49,7 @@ public:
void release(ProxyTransaction *trans) override;
NetVConnection *get_netvc() const override;
int get_transact_count() const override;
- bool support_sni() override;
+ bool support_sni() const override;
// HQSession
void add_transaction(HQTransaction *);