[fix][client] Fixed an issue where a cert chain could not be used in TLS authentication #23644
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@equanz Do we need tests for validating the behavior? |
equanz
force-pushed
the
fix_to_add_certs_to_key_store
branch
from
adc5eab to
3492aab
Compare
|
@lhotari I have added a simple unit tests to check if KeyManagerProxy can load a cert chain. |
equanz
force-pushed
the
fix_to_add_certs_to_key_store
branch
from
3492aab to
8a8a373
Compare
lhotari
reviewed
Nov 27, 2024
pulsar-common/src/test/java/org/apache/pulsar/common/util/KeyManagerProxyTest.java
Show resolved
Hide resolved
equanz
force-pushed
the
fix_to_add_certs_to_key_store
branch
from
8a8a373 to
7591041
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #23644 +/- ##
============================================
+ Coverage 73.57% 74.34% +0.77%
- Complexity 32624 35003 +2379
============================================
Files 1877 1944 +67
Lines 139502 147201 +7699
Branches 15299 16240 +941
============================================
+ Hits 102638 109439 +6801
- Misses 28908 29307 +399
- Partials 7956 8455 +499
Flags with carried forward coverage won't be shown. Click here to find out more.
|
lhotari
added
release/3.3.3
release/3.0.8
release/4.0.1
and removed
release/3.0.9
release/3.3.4
release/4.0.2
labels
nikhil-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Nov 28, 2024
…TLS authentication (apache#23644) (cherry picked from commit e236d61) (cherry picked from commit e0e1956)
srinath-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
Nov 28, 2024
…TLS authentication (apache#23644) (cherry picked from commit e236d61) (cherry picked from commit e0e1956)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
From v2.8.0( #8831 ) , SecurityUtility#createAutoRefreshSslContextForClient was introduced. This method loads a single certification rather than a certification chain from cert file.
Therefore, the PulsarAdmin does not send cert chain in TLS authentication.
(From v4.0.0 ( #23110 ), this issue was fixed because the PulsarAdmin does not use this method by default.)
Modifications
Verifying this change
This change added tests and can be verified as follows:
Does this pull request potentially affect one of the following parts:
If the box was checked, please highlight the changes
Documentation
docdoc-requireddoc-not-neededdoc-completeMatching PR in forked repository
PR in forked repository: equanz#11