[HBASE-28777] mTLS client hostname verification doesn't work with OptionalSslHandler

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0-beta-1
• Fix Version/s: 3.0.0-beta-2, 2.6.1
• Component/s: rpc
• Labels: pull-request-available
• Assignee: Andor Molnar
• Reporter: Andor Molnar
• Created: 12/Aug/24 16:48
• Updated: 30/Aug/24 07:03
• Resolved: 29/Aug/24 14:23

Description

Netty's OptionalSslHandler cannot carry hostport information to SslEngine, hence HBASE-27673 fixed the TLS-only case only. We need to have a custom handling for the plaintext-enabled TLS mode in order to support client hostname verification in that case too.

Issue Links

• is related to: HBASE-27673 Fix mTLS client hostname verification
• links to: GitHub Pull Request #6149
• links to: GitHub Pull Request #6181