(thrift) 07/09: Enable TLS hostname verification in TNonblockingSSLSocket Client: java

[je...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jensg pushed a commit to branch 0.23.0
in repository https://gitbox.apache.org/repos/asf/thrift.git

commit 68ac8e935ef440c3e22d0e1a30e7211b9bf1d441
Author: Jens Geyer <je...@apache.org>
AuthorDate: Tue Apr 14 19:00:00 2026 +0200

    Enable TLS hostname verification in TNonblockingSSLSocket
    Client: java
    
    Set EndpointIdentificationAlgorithm to HTTPS on the SSLEngine parameters
    in the TNonblockingSSLSocket constructor so that the server certificate
    CN/SAN is validated against the target hostname during the TLS handshake.
    This mirrors the behavior of TSSLTransportFactory.createClient() and
    aligns the async SSL client with the sync client.
    
    Co-Authored-By: Claude Opus 4.6 <no...@anthropic.com>
---
 .../main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java  | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/java/src/main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java b/lib/java/src/main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java
index a6db23ee9..71204f69e 100644
--- a/lib/java/src/main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java
+++ b/lib/java/src/main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java
@@ -30,6 +30,7 @@ import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLEngineResult;
 import javax.net.ssl.SSLEngineResult.HandshakeStatus;
 import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLParameters;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -57,6 +58,9 @@ public class TNonblockingSSLSocket extends TNonblockingSocket implements SocketA
     super(host, port, timeout);
     sslEngine_ = sslContext.createSSLEngine(host, port);
     sslEngine_.setUseClientMode(true);
+    SSLParameters sslParams = sslEngine_.getSSLParameters();
+    sslParams.setEndpointIdentificationAlgorithm("HTTPS");
+    sslEngine_.setSSLParameters(sslParams);
 
     int appBufferSize = sslEngine_.getSession().getApplicationBufferSize();
     int netBufferSize = sslEngine_.getSession().getPacketBufferSize();