Repository navigation
GH-1319: [JDBC] Add hostnameOverride connection property for TLS certificate verification and SNI - #1363
Open
fredjoonpark wants to merge 2 commits into
Open
GH-1319: [JDBC] Add hostnameOverride connection property for TLS certificate verification and SNI#1363fredjoonpark wants to merge 2 commits into
fredjoonpark wants to merge 2 commits into
Conversation
…S certificate verification and SNI
fredjoonpark
requested review from
jbonofre,
laurentgo,
lidavidm and
wgtmac
as code owners
October 15, 2026 23:37
|
Thank you for opening a pull request! Please label the PR with one or more of:
Also, add the 'breaking-change' label if appropriate. See CONTRIBUTING.md for details. |
jbonofre
requested changes
Oct 16, 2026
| buildTimeMiddlewareFactories.forEach(clientBuilder::intercept); | ||
| if (useEncryption) { | ||
| clientBuilder.useTls(); | ||
| if (hostnameOverride != null) { |
Member
There was a problem hiding this comment.
hostnameOverride is only checked for != null, so an empty value (e.g. ...&hostnameOverride= from a templated URL) calls overrideAuthority(""). That fails with an invalid-authority error instead of falling back to the connection host.
Could we treat empty or blank as unset?
Suggested change
| if (hostnameOverride != null) { | |
| if (hostnameOverride != null && !hostnameOverride.trim().isEmpty()) { |
Author
There was a problem hiding this comment.
withHostnameOverride now trims the value and treats blank as unset, so endpoint connections fall back to the host too.
Normalize hostnameOverride in the builder so an empty or blank value (e.g. from a templated URL) falls back to the connection host instead of failing with an invalid authority. Also skip the override for endpoints when encryption is disabled, and document that it is sent as the gRPC :authority.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's Changed
Adds an optional
hostnameOverrideconnection property to the Flight SQL JDBC driver. When TLS is enabled, the driver verifies the server certificate against this hostname and sends it for SNI and as the gRPC:authority, instead of using the host in the JDBC URL. This lets the driver connect with full certificate verification through SSH tunnels, port-forwarding, private endpoints, or IP addresses that don't match the server certificate. Today the only option in those cases isdisableCertificateVerification=true.hostnameOverride(string, default unset) inArrowFlightConnectionProperty, passed fromArrowFlightConnectiontoArrowFlightSqlClientHandler.Builder.Builder.build()callsNettyClientBuilder.overrideHostname(...)when encryption is on. The property is ignored whenuseEncryption=false, and a blank value is treated as unset.getStreams(): the override is applied only when the endpoint host matches the original connection host (case-insensitive; the port isn't compared). Endpoints on any other host, or any endpoint when the original connection isn't encrypted, are verified against their own hostname, as they are today. This logic is inBuilder.getHostnameOverrideForEndpoint(URI)so it can be unit-tested.docs/source/flight_sql_jdbc_driver.rstnext totlsRootCerts.Example:
Tests
ConnectionTlsHostnameOverrideTest. It uses the existing test certificate, which is issued forlocalhostand has no IP SAN. Its servers bind to127.0.0.1and the tests connect there, so they don't depend on howlocalhostresolves. Failure cases assert that the cause is aCertificateException, not just anySQLException:No subject alternative names present);hostnameOverride=localhost, set in the URL or inProperties, it succeeds with full verification;hostnameOverride=behaves as unset;ArrowFlightSqlClientHandlerBuilderTest: the default is unset and the builder copy keeps the value. The endpoint rule is covered for same host, different port, different case, IPv6, different host, unencrypted connection, blank value, and no override set.ArrowFlightConnectionConfigImplTest: the property is parsed.This change is additive and has no breaking changes.
Closes #1319.