-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix TLS resume with client certificates #79898
Conversation
Tagging subscribers to this area: @dotnet/ncl, @vcsjones Issue DetailsThis is 7.0 regression caused by combination of #64369 #63200 #63945. To make it simple, this change will also disable TLS resume if there are client certificate candidates e.g. the selection was not made yet. With guard for the callback, this hopefully should be complete. I added few more tests to guard various combinations of how client certs can be selected. fixes #79869
|
This is getting more complicated. The real fix for #79869 is still one line in Changes around contributes to #65563 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
It might be worth checking if this does not cause perf regression, there have been some sneaky ones in the past in this area.
We did not have any benchmarks so I opened dotnet/performance#2814 For Windows, the extra work is done only when somebody access |
WASM & OS X failures seems unrelated. Strangely, the consoles look like success but it is still reported as failure. |
* fix TLS resume with client certificates * fix windows * fix unused warning * undo dotnet#79128 test change * remove dead code * fix resolve
This is 7.0 regression caused by combination of #64369 #63200 #63945.
The intention always was to disable TLS resume with client certificates.
However we also changed how client certificates are selected so the
CertificateContext
may not be set when the handle is created and it is updated later when server asks for it viaUpdateClientCertiticate
.To make it simple, this change will also disable TLS resume if there are client certificate candidates e.g. the selection was not made yet. With guard for the callback, this hopefully should be complete.
I added few more tests to guard various combinations of how client certs can be selected.
fixes #79869
contributes to #75545