[
https://issues.apache.org/jira/browse/IGNITE-29208?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135709#comment-18135709
]
Ignite TC Bot commented on IGNITE-29208:
----------------------------------------
"SSL: Fixed SSLContextWrapper to preserve peer host and port when creating
addressed SSLEngines."
The Release Note field has been filled with the wording above. Please review it
and edit it if needed.
> Preserve SSLEngine peer address in SSLContextWrapper
> ----------------------------------------------------
>
> Key: IGNITE-29208
> URL: https://issues.apache.org/jira/browse/IGNITE-29208
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> Preserve the peer host and port when SSLContextWrapper creates an SSLEngine.
> The addressed overload currently calls the delegate without the supplied
> address. Forward host and port to the matching overload while retaining
> configured protocols and cipher suites.
> This affects external callers using the public wrapper constructor, or a
> context from SslContextFactory with custom protocols or cipher suites, to
> create an addressed client engine. Losing the address can prevent the TLS
> provider from sending SNI or reusing a session, and can make hostname
> verification fail when endpoint identification is enabled. The fix preserves
> the address; it does not enable hostname verification. Ignite's current Java
> transports use the overload without an address.
> IGNITE-29209 introduces wrappers for certificate metadata even without custom
> TLS parameters. It needs this fix so exposing metadata preserves the behavior
> of existing addressed client engines. Merge this fix first. Split out of
> IGNITE-28867; it adds no reload behavior.
> Verify through the existing public constructor that the addressed engine
> retains host, port, protocols and cipher suites, and that the no-argument
> overload keeps its existing behavior. The regression test must fail without
> the fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
