[pulsar-client-go] branch master updated: [Issue 489] TLS fix for certificate that does not include IP SANS, save hostname before switching to physical addr (#812)

[zi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

zixuan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar-client-go.git


The following commit(s) were added to refs/heads/master by this push:
     new 44b64aa  [Issue 489] TLS fix for certificate that does not include IP SANS, save hostname before switching to physical addr (#812)
44b64aa is described below

commit 44b64aa712a0d85ce7562134c0f7cf3d21f17ac0
Author: Don Inghram <do...@gmail.com>
AuthorDate: Wed Nov 2 01:29:43 2022 -0600

    [Issue 489] TLS fix for certificate that does not include IP SANS, save hostname before switching to physical addr (#812)
    
    * Save hostname before switching to physical addr for TLS
    
    Resolved https://github.com/apache/pulsar-client-go/issues/489
    
    * merged master
    
    * Changed log level to Debug for TLS IP SANS fix
---
 pulsar/client_impl.go         | 1 +
 pulsar/internal/connection.go | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/pulsar/client_impl.go b/pulsar/client_impl.go
index 712e197..7cac097 100644
--- a/pulsar/client_impl.go
+++ b/pulsar/client_impl.go
@@ -75,6 +75,7 @@ func newClient(options ClientOptions) (Client, error) {
 			CertFile:                options.TLSCertificateFile,
 			TrustCertsFilePath:      options.TLSTrustCertsFilePath,
 			ValidateHostname:        options.TLSValidateHostname,
+			ServerName:              url.Hostname(),
 		}
 	default:
 		return nil, newError(InvalidConfiguration, fmt.Sprintf("Invalid URL scheme '%s'", url.Scheme))
diff --git a/pulsar/internal/connection.go b/pulsar/internal/connection.go
index 6ca462e..c34f25d 100644
--- a/pulsar/internal/connection.go
+++ b/pulsar/internal/connection.go
@@ -48,6 +48,7 @@ type TLSOptions struct {
 	TrustCertsFilePath      string
 	AllowInsecureConnection bool
 	ValidateHostname        bool
+	ServerName              string
 }
 
 var (
@@ -977,7 +978,12 @@ func (c *connection) getTLSConfig() (*tls.Config, error) {
 	}
 
 	if c.tlsOptions.ValidateHostname {
-		tlsConfig.ServerName = c.physicalAddr.Hostname()
+		if c.tlsOptions.ServerName != "" {
+			tlsConfig.ServerName = c.tlsOptions.ServerName
+		} else {
+			tlsConfig.ServerName = c.physicalAddr.Hostname()
+		}
+		c.log.Debugf("getTLSConfig(): setting tlsConfig.ServerName = %+v", tlsConfig.ServerName)
 	}
 
 	if c.tlsOptions.CertFile != "" || c.tlsOptions.KeyFile != "" {