Lift ssl-context coercion to connection-pool fn#746
Conversation
|
Hey @PawelStroinski, sorry for the delay! Responding to the main commit message:
Hmm I wonder how public that API is really - note how the
I agree. If anyone runs into it, they can easily fix it since such a combination of options doesn't make sense to begin with 😅
See above - we can get rid of this then, too.
Technically, ALPN can also be used for other purposes but in the context of Aleph's out-of-the-box support, this is true 😄 But as per above, we can get rid of this then, too. Thanks for your thoughtful notes as always! 🙏 |
Both testing contexts are failing. The serial one is to demonstrate that the InputStream cannot be read twice without resetting, which obviously is not done by Netty/Aleph. This is also the case in the concurrent context, which was intended to resemble the original report in clj-commons#728 and is a more likely scenario, since it doesn't disable keep-alive. IIUC, the concurrent scenario could fail in an even more unpleasant way, if the test certificate file was greater than the 8192-byte buffer used to read it, but ours is not (the fix would be the same). NB: `with-http-ssl-servers` already runs things twice, so `repeatedly` is not required to make it fail, but that would be harder to read and wouldn't cover (at some level, at least) both servers.
ee00a76 to
d9ae1de
Compare
|
Thank you for the feedback, @DerGuteMoritz. Certainly, |
d9ae1de to
ae12ffa
Compare
As suggested by @DerGuteMoritz in clj-commons#728. This fixes the issue and makes the test added in the previous commit pass. To avoid a repeated coercion *also* in `http-connection` fn (which is an internal fn called only from `connection-pool` fn indirectly), the coercion is being removed from it. As a result, we have to rely solely on `connection-pool` fn for the coercion, where we don't know whether SSL context will be required or not. This includes a situation when a user hasn't supplied any `ssl-context` options, and we are still building an `SslContext`, not knowing whether actual requests will require it or not. This might look like a bit of potentially unnecessary work, but this hopefully won't affect anyone performance-wise, as it would be unusual to run `connection-pool` fn in a tight loop. On the positive side, all users will profit from the elimination of repeated `SslContext` building, whether they supply `ssl-context` options or not. Above all, having consistent code paths in both situations is nice. Notes: - `http-connection` fn has now always some `ssl-context` available regardless of `ssl?` flag, but the only place where it matters (`client/make-pipeline-builder`) already checks `ssl?` flag before making use of `ssl-context`, so this makes no difference. - All rich comments exercising `http-connection` fn with `ssl?` flag were updated, as now the caller has to supply `ssl-context` in that case.
ae12ffa to
f5b1039
Compare
Addresses #728.