Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Do not lookup IP addresses of X509 certificate subject CNs (#1967)
A true-vs-false `nodns` parameter value bug in a recent commit 22b2a7a caused, in some environments, significant startup delays and/or runtime stalls because getaddrinfo(3) performed blocking DNS lookups when parsing common names of X509 certificate subjects. Squid parses CNs when loading configured and validating received certificates. Other side effects may have included Squid-generated certificates having wrong alternative subject names and/or wrong certificate validation results. Negative names and context-disassociated boolean constants strike again! Fortunately, associated problematic Ip::Address::lookupHostIP() will be replaced when the existing Ip::Address::Parse() TODO is addressed.
- Loading branch information