[
https://issues.apache.org/jira/browse/IGNITE-29208?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29208:
--------------------------------------
Description:
Preserve the peer host and port when SSLContextWrapper creates an SSLEngine.
The addressed overload currently calls the delegate without the supplied
address. Forward host and port to the matching overload while retaining
configured protocols and cipher suites.
This affects external callers using the public wrapper constructor, or a
context from SslContextFactory with custom protocols or cipher suites, to
create an addressed client engine. Losing the address can prevent the TLS
provider from sending SNI or reusing a session, and can make hostname
verification fail when endpoint identification is enabled. The fix preserves
the address; it does not enable hostname verification. Ignite's current Java
transports use the overload without an address.
IGNITE-29209 introduces wrappers for certificate metadata even without custom
TLS parameters. It needs this fix so exposing metadata preserves the behavior
of existing addressed client engines. Merge this fix first. Split out of
IGNITE-28867; it adds no reload behavior.
Verify through the existing public constructor that the addressed engine
retains host, port, protocols and cipher suites, and that the no-argument
overload keeps its existing behavior. The regression test must fail without the
fix.
was:
SSLContextWrapper.createSSLEngine(host, port) drops the supplied peer address.
Forward it to the matching delegate overload while retaining configured
protocols and cipher suites.
This affects applications that obtain a context from SslContextFactory with
custom protocols or cipher suites and create a client engine with a host and
port. Losing the address prevents automatic SNI and peer-based session reuse,
and breaks hostname verification when enabled. Ignite transports currently use
the no-argument engine overload. Jetty supplies an address for a server engine,
where the fix preserves peer information reported by the session.
IGNITE-29209 also wraps file-based contexts with default TLS settings, so it
needs the same fix to preserve existing client behavior.
Add a regression test through the existing public constructor that checks peer
host, port, configured protocols and cipher suites. Keep the no-argument
overload working. The test must fail on master and pass with the fix.
Split out of IGNITE-28867; it adds no reload behavior.
> Preserve SSLEngine peer address in SSLContextWrapper
> ----------------------------------------------------
>
> Key: IGNITE-29208
> URL: https://issues.apache.org/jira/browse/IGNITE-29208
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h
> Remaining Estimate: 0h
>
> Preserve the peer host and port when SSLContextWrapper creates an SSLEngine.
> The addressed overload currently calls the delegate without the supplied
> address. Forward host and port to the matching overload while retaining
> configured protocols and cipher suites.
> This affects external callers using the public wrapper constructor, or a
> context from SslContextFactory with custom protocols or cipher suites, to
> create an addressed client engine. Losing the address can prevent the TLS
> provider from sending SNI or reusing a session, and can make hostname
> verification fail when endpoint identification is enabled. The fix preserves
> the address; it does not enable hostname verification. Ignite's current Java
> transports use the overload without an address.
> IGNITE-29209 introduces wrappers for certificate metadata even without custom
> TLS parameters. It needs this fix so exposing metadata preserves the behavior
> of existing addressed client engines. Merge this fix first. Split out of
> IGNITE-28867; it adds no reload behavior.
> Verify through the existing public constructor that the addressed engine
> retains host, port, protocols and cipher suites, and that the no-argument
> overload keeps its existing behavior. The regression test must fail without
> the fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
