fix: avoid cert validation on connection_set_config #4612
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- forgot to include s2n_map header
lrstewart
reviewed
Jun 26, 2024
- add unit test to guard against cert preferences in default sp
lrstewart
reviewed
Jul 2, 2024
maddeleine
reviewed
Jul 2, 2024
- add new unit test to ensure certs aren't checked in set_config - use FAILURE_WITH_ERRNO
maddeleine
approved these changes
Jul 9, 2024
- whitespace fix on the ec certs
- add missing newline
lrstewart
approved these changes
Jul 10, 2024
- switch to 1024 bit cert
lrstewart
approved these changes
Jul 16, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes:
Currently
s2n_connection_set_configisO(N)w.r.t the number of certificates loaded on a config. For customers with very large numbers of certificates, this performance penalty is relatively large.This PR adds a new invariant to
s2n_config: it always respects theconfig->security_policycert preferences.With this new invariant, we then relax the check in
s2n_connection_set_configto only apply if the connection has a security policy override. Otherwise we already know that the config is valid.Additionally, I added some "short circuits" to the checks to exit early when the security policy has no associated certificate preferences.
Testing:
New unit tests were added for the config invariant. Additionally a unit test was removed, because config validation no longer happens when
s2n_connection_set_configis called.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.