fredjoonpark commented on code in PR #1363:
URL: https://github.com/apache/arrow-java/pull/1363#discussion_r4427528020
##########
flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java:
##########
@@ -840,6 +844,42 @@ public Builder withDisableCertificateVerification(
return this;
}
+ /**
+ * Sets the hostname to use for TLS certificate verification and SNI
instead of the host this
+ * handler connects to. It is also sent as the gRPC authority ({@code
:authority} header).
+ * Ignored when encryption is disabled.
+ *
+ * @param hostnameOverride the hostname to verify the server certificate
against, or null or
+ * blank to use the host.
+ * @return this instance.
+ */
+ public Builder withHostnameOverride(@Nullable final String
hostnameOverride) {
+ final String trimmed = hostnameOverride == null ? null :
hostnameOverride.trim();
+ this.hostnameOverride = trimmed == null || trimmed.isEmpty() ? null :
trimmed;
+ return this;
+ }
+
+ /**
+ * Gets the hostname override to use when connecting to an endpoint
location. The override is
+ * only valid for the host it was configured for, so endpoints on any
other host are verified
+ * against their own hostname. Like the override itself, it is ignored
when the original
+ * connection does not use encryption.
+ *
+ * @param endpointUri the endpoint location.
+ * @return the hostname override if the endpoint is on the original host,
otherwise null.
+ */
+ @VisibleForTesting
+ @Nullable String getHostnameOverrideForEndpoint(final URI endpointUri) {
+ final String endpointHost = endpointUri.getHost();
+ if (!useEncryption
+ || hostnameOverride == null
+ || endpointHost == null
+ || !endpointHost.equalsIgnoreCase(host)) {
Review Comment:
OK we can go with your suggestion. I'd originally left the port out for
servers that hand out endpoints on other ports of the same host, but we can add
this as an opt-in flag later if anyone asks for it.
The builder test now expects no override on a different port, and the
endpoint integration test is split- an endpoint at the connection's host and
port uses the override, and one on a different port fails verification.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
