TS-4619: intermediate chain loading can miss certificates. #853
Conversation
|
FreeBSD build successful! See https://ci.trafficserver.apache.org/job/Github-FreeBSD/521/ for details. |
|
Linux build successful! See https://ci.trafficserver.apache.org/job/Github-Linux/418/ for details. |
|
Is This looks good to me 👍 |
|
The add1 version increments the reference count of the certificate, The add0 version doesn't, so it effectively takes ownership of the reference you pass in. From the man page "All these functions are implemented as macros. Those containing a 1 increment the reference count of the supplied certificate or chain so it must be freed at some point after the operation. Those containing a 0 do not increment reference counts and the supplied certificate or chain MUST NOT be freed after the operation." |
Revert "libswoc: Update IntrusiveHashMap in HTTP session manager. (apache#9872)" apache#9872 This reverts commit ca4f8cd. I'm reverting this IntrusiveHashMap switch to libswoc because it introduces a spike in our origin side connections. The following is also reverted to add back the IntrusiveHashMap and IntrusiveDList implementations: Revert "libswoc: Remove legacy IntrusiveHashMap (apache#10104)" This reverts commit 5706e3b. Revert "libswoc: Remove legacy IntrusiveDList. (apache#10106)" This reverts commit 5d0a549. Co-authored-by: bneradt <bneradt@yahooinc.com>
This reverts commit 8e1053c. We no longer need this since Comcast and I fixed IntrusiveHashMap for HttpSessionManager. Conflicts: doc/developer-guide/internal-libraries/intrusive-list.en.rst include/proxy/http/HttpSessionManager.h include/proxy/http/remap/PluginDso.h include/proxy/http/remap/PluginFactory.h include/proxy/http3/QPACK.h include/tscore/IntrusiveHashMap.h include/tsutil/IntrusiveDList.h plugins/experimental/txn_box/Pipfile plugins/experimental/txn_box/plugin/CMakeLists.txt src/tscore/CMakeLists.txt src/tscore/Makefile.am src/tscore/unit_tests/test_IntrusiveHashMap.cc src/tsutil/unit_tests/test_IntrusiveDList.cc
4 participants
Made the changes @jpeach suggested in the bug. Tested with three deep chains for rsa and ec (cert and two signers). Tested with both signers in the ssl_ca_name files. Tested with all three certs in the ssl_cert_name file.