[
https://issues.apache.org/jira/browse/IGNITE-29208?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29208:
--------------------------------------
Description:
SSLContextWrapper.createSSLEngine(host, port) drops the supplied peer address.
Forward it to the matching delegate overload while retaining configured
protocols and cipher suites.
This affects applications that obtain a context from SslContextFactory with
custom protocols or cipher suites and create a client engine with a host and
port. Losing the address prevents automatic SNI and peer-based session reuse,
and breaks hostname verification when enabled. Ignite transports currently use
the no-argument engine overload. Jetty supplies an address for a server engine,
where the fix preserves peer information reported by the session.
IGNITE-29209 also wraps file-based contexts with default TLS settings, so it
needs the same fix to preserve existing client behavior.
Add a regression test through the existing public constructor that checks peer
host, port, configured protocols and cipher suites. Keep the no-argument
overload working. The test must fail on master and pass with the fix.
Split out of IGNITE-28867; it adds no reload behavior.
was:
SSLContextWrapper drops the peer host and port passed to createSSLEngine(host,
port). Forward them to the matching delegate overload while retaining the
configured SSLParameters.
Add a regression test through the existing public constructor that checks peer
host, port, and configured protocols and ciphers. Keep the no-argument overload
working. This fix must not depend on the reload implementation.
Land this independent fix first to keep the later SSL API change focused.
> Preserve SSLEngine peer address in SSLContextWrapper
> ----------------------------------------------------
>
> Key: IGNITE-29208
> URL: https://issues.apache.org/jira/browse/IGNITE-29208
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 40m
> Remaining Estimate: 0h
>
> SSLContextWrapper.createSSLEngine(host, port) drops the supplied peer
> address. Forward it to the matching delegate overload while retaining
> configured protocols and cipher suites.
> This affects applications that obtain a context from SslContextFactory with
> custom protocols or cipher suites and create a client engine with a host and
> port. Losing the address prevents automatic SNI and peer-based session reuse,
> and breaks hostname verification when enabled. Ignite transports currently
> use the no-argument engine overload. Jetty supplies an address for a server
> engine, where the fix preserves peer information reported by the session.
> IGNITE-29209 also wraps file-based contexts with default TLS settings, so it
> needs the same fix to preserve existing client behavior.
> Add a regression test through the existing public constructor that checks
> peer host, port, configured protocols and cipher suites. Keep the no-argument
> overload working. The test must fail on master and pass with the fix.
> Split out of IGNITE-28867; it adds no reload behavior.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
