gian/incus-mirror
1
0
Fork 0
mirror of https://github.com/lxc/incus synced 2026-08-02 05:26:46 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

client: Only retry TLS dial on certificate verification errors

Browse Source 
Closes #3642

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
This commit is contained in:
Stéphane Graber 2026-07-16 11:39:15 -04:00
parent d55af0889c
commit bd77bb04ab
No known key found for this signature in database
GPG Key ID: C638974D64792D67
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
client/util.go
View File

@ -118,8 +118,19 @@ func tlsHTTPClient(client *http.Client, tlsClientCert string, tlsClientKey strin
conn, err := tlsDial(network, addr, transport.TLSClientConfig, false)
if err != nil {
// We may have gotten redirected to a non-Incus machine
return tlsDial(network, addr, transport.TLSClientConfig, true)
// On certificate verification failure, we may have gotten redirected to a
// non-Incus machine, retry with the dialed address as the server name.
var certVerifyErr *tls.CertificateVerificationError
hostnameErr := x509.HostnameError{}
if errors.As(err, &certVerifyErr) || errors.As(err, &hostnameErr) {
conn, retryErr := tlsDial(network, addr, transport.TLSClientConfig, true)
if retryErr == nil {
return conn, nil
}
}
// Return the initial error as the retry error may be misleading.
return nil, err
}
return conn, nil