[
https://issues.apache.org/jira/browse/IGNITE-29208?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18133133#comment-18133133
]
Ignite TC Bot commented on IGNITE-29208:
----------------------------------------
Docs Required has been cleared: PR #13750 only fixes DelegatingSSLContextSpi
internal forwarding of the existing SSLEngine peer host and port and adds
tests; it introduces no user-facing API, configuration, or behavior requiring
documentation.
> Preserve SSLEngine peer address in SSLContextWrapper
> ----------------------------------------------------
>
> Key: IGNITE-29208
> URL: https://issues.apache.org/jira/browse/IGNITE-29208
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> Preserve the peer host and port when SSLContextWrapper creates an SSLEngine.
> The addressed overload currently calls the delegate without the supplied
> address. Forward host and port to the matching overload while retaining
> configured protocols and cipher suites.
> This affects external callers using the public wrapper constructor, or a
> context from SslContextFactory with custom protocols or cipher suites, to
> create an addressed client engine. Losing the address can prevent the TLS
> provider from sending SNI or reusing a session, and can make hostname
> verification fail when endpoint identification is enabled. The fix preserves
> the address; it does not enable hostname verification. Ignite's current Java
> transports use the overload without an address.
> IGNITE-29209 introduces wrappers for certificate metadata even without custom
> TLS parameters. It needs this fix so exposing metadata preserves the behavior
> of existing addressed client engines. Merge this fix first. Split out of
> IGNITE-28867; it adds no reload behavior.
> Verify through the existing public constructor that the addressed engine
> retains host, port, protocols and cipher suites, and that the no-argument
> overload keeps its existing behavior. The regression test must fail without
> the fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
