[DeagleGross]

DirectTls invoked user-supplied handshake callbacks — the certificate selector, the ClientHello bytes callback, and client-certificate validation — synchronously on the epoll pump thread. A slow callback stalled accept, handshakes and read/write readiness for every connection assigned to that pump.

The pump now suspends the handshake instead of calling user code inline: it de-arms the fd, copies what the callback needs off the session, and queues a pooled IThreadPoolWorkItem. When the callback finishes, the result goes on a lock-free queue and an eventfd registered in the pump's epoll set wakes it, so the handshake resumes on its owning thread. The TlsSocketSession / OpenSSL object is still only ever touched by the pump.

Details:

• Exactly-once resume via reference identity on the pending callback token; a suspended connection is not serviced while parked.
• Teardown: handshakes parked on a callback when the pump exits are deferred to a drained-shutdown path, so a session is never disposed under live user code. TlsSocketSession.Dispose remains the single point where the fd is closed.
• Callback exceptions drop that one handshake and are logged; they do not reach the pump loop.
• Fast path: when neither ServerCertificateSelector nor TlsClientHelloBytesCallback is configured, context resolution cannot reach user code, so it runs inline and skips the suspension, the thread-pool hop and the early DirectTlsConnection allocation.

Closes #68647

[Copilot]

Pull request overview

This PR updates Kestrel’s DirectTls transport so user-supplied TLS handshake callbacks (certificate selection, ClientHello inspection, and client-certificate validation) no longer run inline on the epoll pump thread. Instead, the pump suspends the handshake, queues the callback to the thread pool, and resumes the handshake on the owning pump thread via an eventfd wakeup and a completion queue—preventing a slow callback from stalling unrelated connections on the same pump.

Changes:

• Add a suspend/resume mechanism for handshake user callbacks using pooled IThreadPoolWorkItems, a completion queue, and an eventfd wakeup.
• Introduce a fast-path to resolve TLS context inline on the pump thread when resolution cannot reach user code.
• Add targeted tests for callback dispatch behavior and fast-path thread affinity.

Show a summary per file

File	Description
src/Servers/Kestrel/Transport.DirectTls/test/DirectTlsUserCallbackDispatchTests.cs	New tests ensuring blocking/throwing selector/ClientHello callbacks don’t stall other handshakes on the same pump.
src/Servers/Kestrel/Transport.DirectTls/test/DirectTlsContextResolverFastPathTests.cs	New tests verifying the context resolver runs inline on the pump thread only when it can’t reach user code.
src/Servers/Kestrel/Transport.DirectTls/src/TlsEventPumpPool.cs	Plumbs a flag down to pumps indicating whether a server certificate selector is configured.
src/Servers/Kestrel/Transport.DirectTls/src/TlsEventPump.UserCallbacks.cs	New pump half implementing callback suspension, wakeup, completion draining, and resume logic.
src/Servers/Kestrel/Transport.DirectTls/src/TlsEventPump.cs	Integrates callback suspension/resume into the pump loop and handshake state machine; adds inline resolver fast-path and shutdown draining changes.
src/Servers/Kestrel/Transport.DirectTls/src/Interop/NativeTls.cs	Adds eventfd, read, and write interop plus eventfd flags/constants.
src/Servers/Kestrel/Transport.DirectTls/src/HandshakeUserCallback.cs	New thread-pool work item base + concrete callback types for context resolution and client-cert validation.
src/Servers/Kestrel/Transport.DirectTls/src/DirectTlsTransportFactory.cs	Passes selector-configured flag into the listener/pump setup.
src/Servers/Kestrel/Transport.DirectTls/src/Connection/DirectTlsConnectionListener.cs	Stores/plumbs selector-configured flag into pump startup.
src/Servers/Kestrel/Transport.DirectTls/src/ClientCertificateValidator.cs	Updates remarks to reflect validation work now running off the pump thread.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

src/Servers/Kestrel/Transport.DirectTls/test/DirectTlsContextResolverFastPathTests.cs:129

• Similar to the handshake task, awaiting a no-op continuation on the drain task doesn't observe exceptions. If the drain loop faults, this can still become an unobserved task exception later.

            await listener.DisposeAsync();
            await drain.ContinueWith(static _ => { }, TaskScheduler.Default);

• Files reviewed: 10/10 changed files
• Comments generated: 5
• Review effort level: Lite