[FLINK-5030] Support hostname verification

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Component/s: Runtime / Coordination
• Assignee: Eron Wright
• Reporter: Eron Wright
• Created: 07/Nov/16 19:42
• Updated: 28/Feb/19 11:31
• Resolved: 10/May/18 00:24

Description

See Dangerous Code and further commentary for useful background.

When hostname verification is performed, it should use the hostname (not IP address) to match the certificate. The current code is wrongly using the address.

In technical terms, ensure that calls to `SSLContext::createSSLEngine` supply the expected hostname, not host address.

Please audit all SSL setup code as to whether hostname verification is enabled, and file follow-ups where necessary. For example, Akka 2.4 supports it but 2.3 doesn't (ref).

Issue Links

• relates to: FLINK-1559 Normalize all Akka URLs to use IP addresses, not hostnames
• links to: GitHub Pull Request #3023
• links to: GitHub Pull Request #3061