DSP-24887: Enable SAN-aware peer identity lookup for Endpoint verifications on hostname - #42
DSP-24887: Enable SAN-aware peer identity lookup for Endpoint verifications on hostname#42piyushk010 wants to merge 2 commits into
Conversation
Enable SAN-aware peer identity lookup for Netty client endpoint verification based on hostname. Added a new opt-in SAN-aware peer identity feature via `SAN_PEER_IDENTITY_LOOKUP` in Netty SSL context configuration. Implemented `SanPeerIdentityTrustManager` to dynamically select the verification identity based on certificate SAN types, including optional reverse-DNS lookup for IP-based peers with DNS SAN certs. Integrated the feature into both JDK and OpenSSL client TLS paths by wrapping `X509ExtendedTrustManager` during SSL context/session creation. Updated `SslContextBuilder`, `OpenSslClientContext`, `ReferenceCountedOpenSslClientContext`, and `JdkSslClientContext` so the SAN-aware verification behavior is propagated consistently across providers.
ef52e6a to
4f11eaa
Compare
piyushk010
changed the title
emerkle826
left a comment
emerkle826
left a comment
There was a problem hiding this comment.
I'm requesting changes because I think we need one more thing here.
Normally, when we update Netty, we merge some 4.1.X.Final upstream branch into our most recent forked branch, change all the POM versions to be 4.1.x.1.dse and name that branch dse-netty-4.1.X. You have created a dse-netty-4.1.135.2branch based off Tiago'sdse-netty-4.1.135` branch, so that's fine.
But what needs to happen is all of the pom.xml files need to be updated to have:
<version>4.1.135.2.dse</version>
(see #41 where Tiago updates all the poms)
Once that is done, this branch I think is fine as is, and we just have to
- Building this branch in GitHub Actions
- Publish the artifacts to our Datastax JFrog
- Update our DSE branches to use version 4.1.135.2.dse here
So I think all you are missing is the updated pom.xml files. Basically, finad all the poms that have
<version>4.1.135.1.dse</version>
And update them to
<version>4.1.135.2.dse</version>
then We should be able to trigger the GitHub Action that builds and published all this stuff and then you should be able to just bump the version in the BDP branches.
2 participants
This patch is a rebase of #40 on top of dse-netty-4.1.135