wwbmmm opened a new pull request, #3408:
URL: https://github.com/apache/brpc/pull/3408
### What problem does this PR solve?
Issue Number: null
Problem Summary:
Client TLS verification validates the certificate chain, but callers cannot
configure the DNS name or IP address expected in the peer certificate. This
makes it possible for a trusted certificate issued for another endpoint to be
accepted when only chain verification is configured.
### What is changed and the side effects?
Changed:
- Add `VerifyOptions::expected_peer_name` for DNS name and IP SAN validation.
- Derive the expected peer name from the host in an HTTPS Channel URL when
certificate verification is enabled and no explicit peer name is
configured.
- Configure OpenSSL peer name verification as part of certificate
verification.
- Reject peer name verification when certificate verification is disabled or
the TLS backend cannot support it.
- Include the verification mode and expected peer name in the channel
signature
to prevent connections with different verification settings from being
shared.
- Add tests for matching DNS names, mismatched DNS names, IP SAN mismatches,
and
invalid verification configurations.
Side effects:
- Performance effects: one DNS name or IP SAN comparison is added during a
TLS
handshake when `expected_peer_name` is configured.
- Breaking backward compatibility: HTTPS Channels with certificate
verification
enabled now reject certificates that do not match the URL host. Callers
that
intentionally connect through an alias can set `expected_peer_name`
explicitly.
OpenSSL versions older than 1.0.2 and MesaLink reject configurations that
require peer name verification because they do not provide the required
API.
---
### Check List:
- [x] The project builds with `make -j6` in `build`.
- [x] `build/test/brpc_ssl_unittest` passes.
- [x] Related tests cover matching and mismatched peer identities.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
