[wasphin]

What problem does this PR solve?

Problem Summary:

Printing an SSL session obtains an owning peer-certificate reference, and printing a certificate allocates a BIO. Repeated diagnostic output retains both resources.

What is changed and the side effects?

Changed:

• Manage the peer certificate and diagnostic BIO with scoped owners.
• Add an in-memory TLS regression that verifies the peer certificate is released after repeated diagnostic output.

Side effects:

• Performance effects: Releases temporary resources after each diagnostic call.
• Breaking backward compatibility: None for valid inputs.

---

Check List:

• Changes compile locally.
• Added focused regression coverage.
• Please follow Contributor Covenant Code of Conduct.

[Copilot]

🟡 Changes recommended

The new regression needs a MesaLink guard because that backend does not emit the certificate fields it asserts.

1 open issue

• Guard certificate-output assertions for MesaLink builds · New

What changed in this PR

This PR fixes temporary resource leaks in bRPC’s SSL diagnostic output.

Changes:

• Adds scoped ownership for peer certificates and diagnostic BIO buffers.
• Adds an in-memory TLS regression checking certificate release after repeated diagnostic output.

File	Description
test/​brpc_ssl_unittest.cpp	Adds regression coverage for peer-certificate cleanup.
src/​brpc/​details/​ssl_helper.cpp	Automatically releases certificate references and BIO buffers.

_{Review effort: Balanced}

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

• SSLv23_method() has long been deprecated in OpenSSL (kept as a compatibility alias in many… · New
• X509_get_ex_new_index() allocates a new global ex-data index each time it’s called; doing this… · New
• This can be simplified by checking the owning pointer directly (e.g., if (!bio) return;) and then… · New

1 resolved since last review

• Guard certificate-output assertions for MesaLink builds

_{Review effort: Lite}

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

2 open issues

• SSL_get_peer_certificate() is deprecated in newer OpenSSL and its ownership semantics are less… · New
• SSLv23_method() is deprecated in modern OpenSSL (it historically enabled SSLv2/v3 and is now an… · New

3 resolved since last review

• X509_get_ex_new_index() allocates a new global ex-data index each time it’s called; doing this…
• SSLv23_method() has long been deprecated in OpenSSL (kept as a compatibility alias in many…
• This can be simplified by checking the owning pointer directly (e.g., if (!bio) return;) and then…

_{Review effort: Lite}