ruanweihong-aaa commented on PR #14057: URL: https://github.com/apache/apisix/pull/14057#issuecomment-6307844726
Thanks for the fix and for adding a test. There are two CI issues to address first: the new test assigns to the read-only `ngx.var.scheme`, causing `variable "scheme" not changeable` before it reaches `http_access_phase()`. The lint job also requests running `reindex`. Please fix the test and rerun the checks. With an artificially constructed nil `matched_ssl`, the old code does fail and the guard prevents that failure. The remaining question is how a real HTTPS request completes the TLS handshake without `matched_ssl` being set. I tested base/head with OpenResty 1.25.3.1 and etcd 3.5.11, using both an unpatched TLS implementation and a build with the corresponding APISIX patches. Unknown SNI, direct-IP requests without SNI, and requests with no SSL objects were rejected during ClientHello. Valid requests and ordinary TLS session resumptions retained `matched_ssl`; I could not reproduce the reported nil dereference. These builds do not necessarily match your exact build, since the full build configuration was not provided. Could you share the complete relevant configuration, `nginx -V` output, reproduction commands, and original error logs? The guard is effective in the synthetic nil-state test, but I have not yet established the real request path described in the issue. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
