Skip to content

Commit d2c780d

Browse files
authored
Future-proof HTTPS endpoint identification (#2104)
Netty 4.2 changes the default for hostname verification for TLS clients, so that it is now enabled by default. As a result, clients that rely on the default being _off_ will find themselves unable to disable it. Instead, clients should explicitly configure their desired endpoint identification algorithm in all cases. Since Netty 4.1.112 we also have a convenient method on the `SslContextBuilder` for doing this, so we don't need multiple round-trips through `SSLParameters`. This PR changes the `DefaultSslEngineFactory` to make use of this method, so it always configures the endpoint identification algorithm to match the desired setting of `AsyncHttpClientConfig..isDisableHttpsEndpointIdentificationAlgorithm()`.
1 parent 8daef69 commit d2c780d

File tree

2 files changed

+3
-6
lines changed

2 files changed

+3
-6
lines changed

client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ private SslContext buildSslContext(AsyncHttpClientConfig config) throws SSLExcep
5858
sslContextBuilder.trustManager(InsecureTrustManagerFactory.INSTANCE);
5959
}
6060

61+
sslContextBuilder.endpointIdentificationAlgorithm(
62+
config.isDisableHttpsEndpointIdentificationAlgorithm() ? "" : "HTTPS");
63+
6164
return configureSslContextBuilder(sslContextBuilder).build();
6265
}
6366

client/src/main/java/org/asynchttpclient/netty/ssl/SslEngineFactoryBase.java

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
import org.asynchttpclient.SslEngineFactory;
2020

2121
import javax.net.ssl.SSLEngine;
22-
import javax.net.ssl.SSLParameters;
2322

2423
public abstract class SslEngineFactoryBase implements SslEngineFactory {
2524

@@ -30,10 +29,5 @@ protected String domain(String hostname) {
3029

3130
protected void configureSslEngine(SSLEngine sslEngine, AsyncHttpClientConfig config) {
3231
sslEngine.setUseClientMode(true);
33-
if (!config.isDisableHttpsEndpointIdentificationAlgorithm()) {
34-
SSLParameters params = sslEngine.getSSLParameters();
35-
params.setEndpointIdentificationAlgorithm("HTTPS");
36-
sslEngine.setSSLParameters(params);
37-
}
3832
}
3933
}

0 commit comments

Comments
 (0)