shellfish007 opened a new pull request, #3764: URL: https://github.com/apache/celeborn/pull/3764
### What changes were proposed in this pull request? Thread peer hostname/port from `TransportClientFactory.internalCreateClient()` through `TransportContext.initializePipeline()` to `SSLFactory.createSSLEngine()`. `SSLFactory.createEngine()` now calls `jdkSslContext.createSSLEngine(peerHost, peerPort)` for client connections, which makes the JDK include the SNI extension in the TLS ClientHello. Existing server-side and no-arg callers use backward-compatible overloads. ### Why are the changes needed? `SSLFactory.createEngine()` called `jdkSslContext.createSSLEngine()` with no arguments. The JDK only includes the SNI extension in the TLS ClientHello when a peer hostname is provided via `createSSLEngine(host, port)`. Without SNI, TLS termination/routing that depends on server name (e.g. an SNI-based ingress/gateway such as Istio TLS PASSTHROUGH or SIMPLE mode) cannot route or differentiate connections by hostname. This fix is a prerequisite for shared-port multi-tenant routing through an SNI-based ingress gateway. ### Does this PR introduce _any_ user-facing change? No. Client `SSLEngine` creation now includes SNI; server-side and existing no-arg callers are unaffected. ### How was this patch tested? Follows the existing `SSLFactory`/`TransportContext` call patterns with additive, backward-compatible overloads — no new config surface. Relies on CI for build/test verification. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
