Skip to content

Commit

Permalink
StreamingConnectionFactory should set hostnameVerificationAlgorithm…
Browse files Browse the repository at this point in the history
… to an empty string (#2988)

Motivation:

There are cases when default algorithm `HTTPS` can be reset if there are no `sniHostname` and no `peerHost`. See
`GrpcSslAndNonSslConnectionsTest` as a reproducer. This flow works well with Netty 4.1, but breaks with Netty 4.2 because Netty uses `HTTPS` by default. If we set it back to `null`, `sun.security.ssl.SSLEngineImpl` ignores it. To disable it later, we should use an empty string.

Modifications:

- Update `StreamingConnectionFactory.withSslConfigPeerHost` to use an empty string instead of `null` when it needs to reset `hostnameVerificationAlgorithm`;

Result:

We can override the previously set endpoint identification algorithm.
  • Loading branch information
idelpivnitskiy authored Jun 26, 2024
1 parent f0a7bea commit 4ce7d2c
Showing 1 changed file with 4 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,8 @@ static ReadOnlyTcpClientConfig withSslConfigPeerHost(Object resolvedRemoteAddres
if (sniHostname == null) {
if (peerHost == null) {
newPeerHost = toHostAddress(inetAddress);
newSniHostname = hostnameVerificationAlgorithm = null;
newSniHostname = null;
hostnameVerificationAlgorithm = "";
} else {
newPeerHost = peerHost + '-' + toHostAddress(inetAddress);
// We are overriding the peerHost to make it qualified with the resolved address. If sniHostname is
Expand All @@ -105,7 +106,8 @@ static ReadOnlyTcpClientConfig withSslConfigPeerHost(Object resolvedRemoteAddres
newSniHostname = peerHost;
hostnameVerificationAlgorithm = sslConfig.hostnameVerificationAlgorithm();
} else {
newSniHostname = hostnameVerificationAlgorithm = null;
newSniHostname = null;
hostnameVerificationAlgorithm = "";
}
}
} else {
Expand Down

0 comments on commit 4ce7d2c

Please sign in to comment.