anton-vinogradov opened a new pull request, #13795: URL: https://github.com/apache/ignite/pull/13795
[IGNITE-29256](https://issues.apache.org/jira/browse/IGNITE-29256) makes new TCP connections use the factory's current SSL context after reload. **Planning draft.** This branch currently contains only the prerequisite from #13751 at `0d8a872f`. The transport changes below are not implemented or verified yet. This PR depends on #13751; the reload command follows separately in #13785. ## Implementation plan - Pass the configured factory to the existing `U.sslFilter` and keep its startup `create()` call. For an `AbstractSslContextFactory`, `GridNioSslFilter` gets the context through `create()` for each new session. For other factories it keeps the startup context. Outgoing communication already calls `create()` for each new connection. - In discovery, get the current context for new outgoing sockets when the factory supports reload. Bind a plain server socket for that path and use the four-argument `createSocket` with the peer's numeric address to wrap each accepted socket. Set server mode and require client authentication, retaining handshake timeouts and configured protocols and cipher suites. Keep startup validation of protocol and cipher names. On a wrapping failure, close the accepted socket and continue accepting connections. - Keep setting `TcpDiscoverySpi.sslSockFactory` and `sslSrvSockFactory` at startup, remove discovery's reads of the fields and mark both `@Deprecated`. Document that they hold the startup socket factories and that assigning them no longer changes discovery connections. ## Verification plan Expose the protected `init()` through a test subclass. Verify key and trust rotation on all four transports, including both directions of discovery and communication. Check established-connection continuity and use of the old context during loading and after failure. Cover a factory shared by multiple transports and unchanged behavior of other factory types. Inject a failure wrapping one accepted discovery socket and verify that the next connection succeeds. Run the existing SSL tests covering transport startup and handshake settings. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
