Commit 53393e0
authored
xds: use UNKNOWN for auth algorithm type during per-rpc authority verification (#12421)
While we can get the cipher suite name with
`sslEngine.getHandshakeSession().getCipherSuite()`, for the `authType`
to use in `X509ExtendedTrustManager.checkServerTrusted` it needs to go
through a mapping, for example, for the cipher suite name
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" the `authType` to use is
actually `ECDHE_RSA`. (JDK code maintains such a
[mapping](https://github.com/openjdk/jdk/blob/844118a9d854459778f88d299b148c2288131344/src/java.base/share/classes/sun/security/ssl/CipherSuite.java#L113)).
Since we don't have all this information handy to use, and UNKNOWN for
`authType` works and has actually been observed being used during Tls
handshake, we are using the same during the per-rpc authority
verification check as the Tls connection has already been established by
then.1 parent f0a6067 commit 53393e0
1 file changed
+1
-1
lines changedLines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
103 | 103 | | |
104 | 104 | | |
105 | 105 | | |
106 | | - | |
| 106 | + | |
107 | 107 | | |
108 | 108 | | |
0 commit comments