[
https://issues.apache.org/jira/browse/FLINK-5030?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15756080#comment-15756080
]
ASF GitHub Bot commented on FLINK-5030:
---------------------------------------
GitHub user EronWright opened a pull request:
https://github.com/apache/flink/pull/3023
[FLINK-5030] Support hostname verification
- updated SSL documentation
- use canonical hostname for (netty/blob) client-to-server connections
- ensure that a valid address is advertised for webui (not the bind
address which might be 0.0.0.0)
- improved configuration validation for keystore/truststore
- advertise the FQDN of the AppMaster to Mesos
- improved handling of SSL exceptions due to handshake failure
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/EronWright/flink feature-FLINK-5030-new
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/flink/pull/3023.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #3023
----
commit a7c2ac8251d7208a888e143f4a6abd1d15a2b5bf
Author: wrighe3 <[email protected]>
Date: 2016-12-17T02:05:38Z
[FLINK-5030] Support hostname verification
- updated SSL documentation
- use canonical hostname for (netty/blob) client-to-server connections
- ensure that a valid address is advertised for webui (not the bind
address which might be 0.0.0.0)
- improved configuration validation for keystore/truststore
- advertise the FQDN of the AppMaster to Mesos
- improved handling of SSL exceptions due to handshake failure
----
> Support hostname verification
> -----------------------------
>
> Key: FLINK-5030
> URL: https://issues.apache.org/jira/browse/FLINK-5030
> Project: Flink
> Issue Type: Sub-task
> Components: Security
> Reporter: Eron Wright
> Assignee: Eron Wright
> Fix For: 1.2.0
>
>
> _See [Dangerous Code|http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf] and
> [further
> commentary|https://tersesystems.com/2014/03/23/fixing-hostname-verification/]
> for useful background._
> When hostname verification is performed, it should use the hostname (not IP
> address) to match the certificate. The current code is wrongly using the
> address.
> In technical terms, ensure that calls to `SSLContext::createSSLEngine` supply
> the expected hostname, not host address.
> Please audit all SSL setup code as to whether hostname verification is
> enabled, and file follow-ups where necessary. For example, Akka 2.4
> supports it but 2.3 doesn't
> ([ref|http://doc.akka.io/docs/akka/2.4.4/scala/http/client-side/https-support.html#Hostname_verification]).
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
