Implement a fast lookup for wildcard certificates

[arontsang]

No description provided.

[gfoidl]

Nit: there are quite a few blank lines that could be removed too.

[gfoidl]

You compare it backwards?
Is it better then, to write the loop backwards and have normal index access?

[gfoidl]

So the JIT can't elide the bound-check for indexing into the spans.
I think it's better to slice the spans to the common (= min) length and use one span in the loop, in order to elide at least one bound check (the JIT should handle the downward loop (see other comment) in a recent version).

Roughly:

Suggested change

	var length = Math.Min(x.Length, y.Length);
	for (var i = 1; i <= length; i++)
	if (x.Length < y.Length)
	{
	y = y.Slice(0, x.Length);
	}
	else if (y.Length < x.Length)
	{
	x = x.Slice(0, y.Length);
	}
	for (var i = x.Length; i >= 1; --i)

[KLuuKer]

domainName CAN BE NULL!
when SNI is not available.

https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.server.kestrel.https.httpsconnectionadapteroptions.servercertificateselector?view=aspnetcore-9.0

[arontsang]

Well poop, forgot about SNI. I would expect that everything supports SNI by now. But yes, get your point...sigh...

[KLuuKer]

i would suggest skipping certificate lookups and immediately fallback to the default cert when string.IsNullOrEmpty
you WILL get this traffic anytime someone runs ssllabs server test, or some other kind of auditing tool
or for the handful of people running this on their own internal network and connecting with some kind of weird legacy system

[arontsang]

Updated to handle non SNI TLS hand shake.

[KLuuKer]

LGTM

[KLuuKer]

If this pull also needs to work for the Kubernetes.Controller the following needs to be modified also

https://github.com/dotnet/yarp/blob/785e5fc80540baf3f34db17686d90cad595000a3/src/Kubernetes.Controller/Caching/IngressCache.cs#L100C9-L103C10

note: i don't work for MS but i have this code running right now with those lines patched out.
and from my limited testing (cloudflare strict certificate check) it seems to work.

[arontsang]

If this pull also needs to work for the Kubernetes.Controller the following needs to be modified also

https://github.com/dotnet/yarp/blob/785e5fc80540baf3f34db17686d90cad595000a3/src/Kubernetes.Controller/Caching/IngressCache.cs#L100C9-L103C10

note: i don't work for MS but i have this code running right now with those lines patched out. and from my limited testing (cloudflare strict certificate check) it seems to work.

Thanks for that