nic-6443 commented on code in PR #14047:
URL: https://github.com/apache/apisix/pull/14047#discussion_r4291342662
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -243,8 +243,11 @@ function _M.set(matched_ssl, sni)
end
ngx_ssl.clear_certs()
- local new_ssl_value = secret.fetch_secrets(matched_ssl.value, true)
- or matched_ssl.value
+ local new_ssl_value
+ new_ssl_value, err = secret.fetch_ssl_secrets(matched_ssl.value)
+ if not new_ssl_value then
+ return false, err
Review Comment:
This isn't a regression: the old `fetch_secrets(matched_ssl.value, true)`
call deep-copied the ssl object on every handshake as well. Skipping it is
cheap and safe, though, because the resolved value is only read afterwards. So
in 7f3ff8ad7 `fetch_ssl_secrets()` now returns the object as-is when it holds
no secret refs. I put the check inside the function rather than at the call
site, so the upstream client cert path gets it too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
