[
https://issues.apache.org/jira/browse/IGNITE-29208?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29208:
--------------------------------------
Description:
Preserve the peer host and port when SSLContextWrapper creates an SSLEngine.
The addressed overload currently calls the delegate without the supplied
address. Forward host and port to the matching overload while retaining
configured protocols and cipher suites.
This affects external callers using the public wrapper constructor, or a
context from SslContextFactory with custom protocols or cipher suites, to
create an addressed client engine. Losing the address can prevent the TLS
provider from sending SNI or reusing a session, and can make hostname
verification fail when endpoint identification is enabled. The fix preserves
the address; it does not enable hostname verification. Ignite's current Java
transports use the overload without an address.
Split out of IGNITE-28867; it adds no reload behavior.
Verify through the existing public constructor that the addressed engine
retains host, port, protocols and cipher suites, and that the no-argument
overload keeps its existing behavior. The regression test must fail without the
fix.
was:
Preserve the peer host and port when SSLContextWrapper creates an SSLEngine.
The addressed overload currently calls the delegate without the supplied
address. Forward host and port to the matching overload while retaining
configured protocols and cipher suites.
This affects external callers using the public wrapper constructor, or a
context from SslContextFactory with custom protocols or cipher suites, to
create an addressed client engine. Losing the address can prevent the TLS
provider from sending SNI or reusing a session, and can make hostname
verification fail when endpoint identification is enabled. The fix preserves
the address; it does not enable hostname verification. Ignite's current Java
transports use the overload without an address.
IGNITE-29209 introduces wrappers for certificate metadata even without custom
TLS parameters. It needs this fix so exposing metadata preserves the behavior
of existing addressed client engines. Merge this fix first. Split out of
IGNITE-28867; it adds no reload behavior.
Verify through the existing public constructor that the addressed engine
retains host, port, protocols and cipher suites, and that the no-argument
overload keeps its existing behavior. The regression test must fail without the
fix.
> Preserve SSLEngine peer address in SSLContextWrapper
> ----------------------------------------------------
>
> Key: IGNITE-29208
> URL: https://issues.apache.org/jira/browse/IGNITE-29208
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> Preserve the peer host and port when SSLContextWrapper creates an SSLEngine.
> The addressed overload currently calls the delegate without the supplied
> address. Forward host and port to the matching overload while retaining
> configured protocols and cipher suites.
> This affects external callers using the public wrapper constructor, or a
> context from SslContextFactory with custom protocols or cipher suites, to
> create an addressed client engine. Losing the address can prevent the TLS
> provider from sending SNI or reusing a session, and can make hostname
> verification fail when endpoint identification is enabled. The fix preserves
> the address; it does not enable hostname verification. Ignite's current Java
> transports use the overload without an address.
> Split out of IGNITE-28867; it adds no reload behavior.
> Verify through the existing public constructor that the addressed engine
> retains host, port, protocols and cipher suites, and that the no-argument
> overload keeps its existing behavior. The regression test must fail without
> the fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
