rzo1 opened a new pull request, #8987: URL: https://github.com/apache/storm/pull/8987
`StormClientPipelineFactory` called `sslContext.newHandler(ch.alloc())`, the overload that supplies no peer host or port, so the client engine had no address to check the server certificate against. The peer host and port are now passed through from the `Client`, and a new `storm.messaging.netty.tls.hostnameVerification` key (default true) can turn the check off. This requires certificates carrying a SAN that matches the address workers connect to, host or IP SANs rather than DNS only. Only affects clusters with `storm.messaging.netty.tls.enable` set; TLS is off by default. Adds `StormClientPipelineFactoryTest`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
