Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RA: Pass requested new-order profile through to SA #7608

Merged
merged 2 commits into from
Jul 19, 2024
Merged

Conversation

aarongable
Copy link
Contributor

@aarongable aarongable commented Jul 18, 2024

When receiving a NewOrder request from the WFE, pass the specified profile name (if any) through to the SA for storage. Also, when retrieving previous orders for potential re-use, don't reuse them unless they have the same profile name (including the empty/default profile name).

Fixes #7607

@aarongable aarongable requested a review from a team as a code owner July 18, 2024 00:04
@aarongable aarongable requested a review from jsha July 19, 2024 19:29
@jsha
Copy link
Contributor

jsha commented Jul 19, 2024

don't reuse them unless they have the same profile name or the new order doesn't request a specific profile.

(Please wait, DeMorganing...)

Reuse an order if the order request has the same profile name or the order request doesn't request a profile.

This seems like the wrong logic. The logic we have is that there's a default profile that gets assigned if the order request didn't request one. I think we need to do this defaulting first.

For instance, imagine dflt is the current default profile. A client requests a new order with the modern profile, then requests a new order with the same names and no profile specified. I would expect the second request to not reuse the first order. Because, standing alone, that request would generate a dflt order; but because there happened to be a modern order sitting around it received a modern order instead.

@aarongable
Copy link
Contributor Author

In the current implementation plan (which we can change), if they do not request a specific profile, then the defaulting only happens at issuance time, not at new-order time. The idea is that we don't store a profile name at all for orders that don't request one. So under the current plan, we can't do the defaulting "first".

Also, we won't be advertising (at least not at the API level, maybe in external documentation) which profile is the "default" profile. This is because we'll have different defaults for different orders (e.g. any order with an IP Address will default to the short-lived profile).

My logic was that, since order reuse is a thing that only happens before orders are finalized, receiving a request with no profile specified means "pick whichever profile you want", and therefore picking a profile which this client had previously requested for this set of names is a reasonable choice.

But the logic of "clearly they've changed something between then and now, we should respect that" also makes sense. I'm happy to change this to a strict equality check, only matching new-order requests that have no profile with previously-created orders that also have no profile.

@jsha
Copy link
Contributor

jsha commented Jul 19, 2024

Yeah, let's do a strict equality check. That also has the advantage of being simpler!

@aarongable aarongable merged commit 510996b into main Jul 19, 2024
12 checks passed
@aarongable aarongable deleted the new-order-profile branch July 19, 2024 21:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

The RA can plumb a requested new-order profile to the SA
3 participants