Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

spdyroundtripper: don't need to verify server hostname twice #109750

Merged
merged 2 commits into from
May 5, 2022
Merged

spdyroundtripper: don't need to verify server hostname twice #109750

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6d14c8e
spdyroundrippter: close the connection if tls handshake fails
aojea May 3, 2022
00a6042
spdyroundtripper: d tlson't verify hostname twice
aojea May 3, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
28 changes: 1 addition & 27 deletions staging/src/k8s.io/apimachinery/pkg/util/httpstream/spdy/roundtripper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,17 +264,8 @@ func (s *SpdyRoundTripper) tlsConn(ctx context.Context, rwc net.Conn, targetHost

tlsConn := tls.Client(rwc, tlsConfig)

// need to manually call Handshake() so we can call VerifyHostname() below
if err := tlsConn.HandshakeContext(ctx); err != nil {
return nil, err
}

// Return if we were configured to skip validation
if tlsConfig.InsecureSkipVerify {
return tlsConn, nil
}

if err := tlsConn.VerifyHostname(tlsConfig.ServerName); err != nil {
aojea marked this conversation as resolved.
Show resolved Hide resolved
tlsConn.Close()
aojea marked this conversation as resolved.
Show resolved Hide resolved
return nil, err
}

Expand Down Expand Up @@ -306,23 +297,6 @@ func (s *SpdyRoundTripper) dialWithoutProxy(ctx context.Context, url *url.URL) (
return nil, err
}

aojea marked this conversation as resolved.
Show resolved Hide resolved
// Return if we were configured to skip validation
if s.tlsConfig != nil && s.tlsConfig.InsecureSkipVerify {
return conn, nil
}

host, _, err := net.SplitHostPort(dialAddr)
if err != nil {
return nil, err
}
if s.tlsConfig != nil && len(s.tlsConfig.ServerName) > 0 {
host = s.tlsConfig.ServerName
}
err = conn.VerifyHostname(host)
liggitt marked this conversation as resolved.
Show resolved Hide resolved
if err != nil {
return nil, err
}

return conn, nil
}

Expand Down