Copilot commented on code in PR #3408:
URL: https://github.com/apache/brpc/pull/3408#discussion_r3651836107
##########
src/brpc/channel.cpp:
##########
@@ -324,6 +328,20 @@ static int CreateSocketSSLContext(const ChannelOptions&
options,
return 0;
}
+static void SetHttpsPeerName(const std::string& host,
+ ChannelOptions* options) {
+ ChannelSSLOptions* ssl = options->mutable_ssl_options();
+ if (ssl->sni_name.empty()) {
+ ssl->sni_name = host;
+ }
+ VerifyOptions& verify = ssl->verify;
+ if (verify.verify_depth > 0 &&
+ verify.verify_mode != VerifyMode::VERIFY_NONE &&
+ verify.expected_peer_name.empty()) {
+ verify.expected_peer_name = host;
+ }
+}
Review Comment:
SetHttpsPeerName() uses the host string returned by ParseURL() verbatim. For
IPv6 literal URLs, ParseURL() keeps the square brackets (e.g. "[::1]") and
SplitHostAndPort() does not strip them, so the derived `sni_name` /
`verify.expected_peer_name` will include brackets and fail IP parsing +
certificate verification (and may send an invalid SNI). Consider normalizing
bracketed IPv6 hosts before assigning these fields.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
