Skip to content

Commit ed5552b

Browse files
committed
Don't set peer domain and port in SSLEngine when HttpsEndpointIdentificationAlgorithm is disabled, close AsyncHttpClient#1535
Motivation: Some broken TLS implementations crash on SSL handshakes that have host and port. Browers handle this by retrying without those parameters, but that’s definitively not something we’ll implement. Disabling HttpsEndpointIdentificationAlgorithm should suffice to be able to connect to such broken server. Modifications: When HttpsEndpointIdentificationAlgorithm is disabled (that disables SNI and hostname verification), we want to not set peer domain and port on the SSLEngine so those are not sent in the SSL handshake and make broken servers crash. Result: It’s now possible to connect to broken servers that don’t support hostname and port in SSL handshake.
1 parent 12b49e9 commit ed5552b

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

client/src/main/java/org/asynchttpclient/netty/ssl/DefaultSslEngineFactory.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,10 @@ private SslContext buildSslContext(AsyncHttpClientConfig config) throws SSLExcep
6060

6161
@Override
6262
public SSLEngine newSslEngine(AsyncHttpClientConfig config, String peerHost, int peerPort) {
63-
// FIXME should be using ctx allocator
64-
SSLEngine sslEngine = sslContext.newEngine(ByteBufAllocator.DEFAULT, domain(peerHost), peerPort);
63+
SSLEngine sslEngine =
64+
config.isDisableHttpsEndpointIdentificationAlgorithm() ?
65+
sslContext.newEngine(ByteBufAllocator.DEFAULT) :
66+
sslContext.newEngine(ByteBufAllocator.DEFAULT, domain(peerHost), peerPort);
6567
configureSslEngine(sslEngine, config);
6668
return sslEngine;
6769
}

0 commit comments

Comments
 (0)