[I] Classic Remoting: TLS hostname verification is not performed [pekko]

["He-Pin (via GitHub)" <gi...@apache.org>]

He-Pin opened a new issue, #3161:
URL: https://github.com/apache/pekko/issues/3161

   ### Description
   
   Classic remoting's `ConfigSSLEngineProvider.createSSLEngine()` never calls `setEndpointIdentificationAlgorithm`, meaning TLS certificate hostname verification is **not performed** on the remote peer's certificate — even when mutual authentication is enabled.
   
   An attacker with any certificate signed by a trusted CA could perform a man-in-the-middle attack, since the certificate's hostname/CN is never validated against the expected remote address.
   
   ### Location
   
   `remote/src/main/scala/org/apache/pekko/remote/transport/netty/SSLEngineProvider.scala` — `createSSLEngine()` method.
   
   ### Comparison with Artery
   
   Artery's `ConfigSSLEngineProvider` (`remote/src/main/scala/org/apache/pekko/remote/artery/tcp/ConfigSSLEngineProvider.scala`) correctly calls `setEndpointIdentificationAlgorithm("HTTPS")` when hostname verification is enabled, and provides a `hostname-verification` configuration option (default off).
   
   Classic remoting has no equivalent configuration option and no hostname verification at all.
   
   ### Suggested Fix
   
   Add a `hostname-verification` configuration option to classic remoting's SSL settings (similar to Artery), and call `engine.setEndpointIdentificationAlgorithm("HTTPS")` when enabled. Given classic remoting is deprecated, a documentation warning about this limitation may also be appropriate.
   
   ### Affected Versions
   
   All versions using classic remoting with TLS enabled.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org

Re: [I] Classic Remoting: improve TLS hostname verification [pekko]

["He-Pin (via GitHub)" <gi...@apache.org>]

He-Pin closed issue #3161: Classic Remoting: improve TLS hostname verification
URL: https://github.com/apache/pekko/issues/3161


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org