flink-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Eron Wright (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (FLINK-5030) Support hostname verification
Date Sat, 17 Dec 2016 02:05:58 GMT

    [ https://issues.apache.org/jira/browse/FLINK-5030?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15756075#comment-15756075
] 

Eron Wright  commented on FLINK-5030:
-------------------------------------

Note that the behavior of InetAddress.getLocalHost().getHostName() varies across JVMs; for
some, you get the FQDN, others the short name.   See JDK-7166687:
http://bugs.java.com/view_bug.do?bug_id=7166687







> Support hostname verification
> -----------------------------
>
>                 Key: FLINK-5030
>                 URL: https://issues.apache.org/jira/browse/FLINK-5030
>             Project: Flink
>          Issue Type: Sub-task
>          Components: Security
>            Reporter: Eron Wright 
>            Assignee: Eron Wright 
>             Fix For: 1.2.0
>
>
> _See [Dangerous Code|http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf] and [further commentary|https://tersesystems.com/2014/03/23/fixing-hostname-verification/]
for useful background._
> When hostname verification is performed, it should use the hostname (not IP address)
to match the certificate.   The current code is wrongly using the address.
> In technical terms, ensure that calls to `SSLContext::createSSLEngine` supply the expected
hostname, not host address.
> Please audit all SSL setup code as to whether hostname verification is enabled, and file
follow-ups where necessary.   For example, Akka 2.4 supports it but 2.3 doesn't ([ref|http://doc.akka.io/docs/akka/2.4.4/scala/http/client-side/https-support.html#Hostname_verification]).



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message