From 1835490093a5aea9ab59873e4b5dc23f0b534ed2 Mon Sep 17 00:00:00 2001 From: Marcin Date: Tue, 22 Sep 2026 08:33:13 +0200 Subject: [PATCH 1/2] do not resolve DNS when creating SSLEngine for SNI hostnames --- .../ssl/SslIdentificationAlgorithmTest.java | 28 +++++++++++++------ 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/mina-core/src/test/java/org/apache/mina/filter/ssl/SslIdentificationAlgorithmTest.java b/mina-core/src/test/java/org/apache/mina/filter/ssl/SslIdentificationAlgorithmTest.java index 5f240614a..d97ea8eac 100644 --- a/mina-core/src/test/java/org/apache/mina/filter/ssl/SslIdentificationAlgorithmTest.java +++ b/mina-core/src/test/java/org/apache/mina/filter/ssl/SslIdentificationAlgorithmTest.java @@ -33,6 +33,7 @@ import org.junit.Test; import javax.net.ssl.KeyManagerFactory; +import javax.net.ssl.SNIHostName; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLEngine; import javax.net.ssl.SSLParameters; @@ -40,6 +41,7 @@ import java.net.InetSocketAddress; import java.security.KeyStore; import java.security.Security; +import java.util.Collections; import java.util.concurrent.CountDownLatch; import java.util.concurrent.TimeUnit; @@ -74,21 +76,24 @@ public class SslIdentificationAlgorithmTest { private int port; private CountDownLatch handshakeDone; - private class CustomSslFilter extends SslFilter { + private static class CustomSslFilter extends SslFilter { public CustomSslFilter(SSLContext sslContext) { super(sslContext); } protected SSLEngine createEngine(IoSession session, InetSocketAddress addr) { //Add your SNI host name and port in the IOSession - String sniHostNames = (String)session.getAttribute( "SNIHostNames" ); + String sniHostName = (String)session.getAttribute( "SNIHostNames" ); int portNumber = (int)session.getAttribute( "PortNumber"); - InetSocketAddress peer = new InetSocketAddress( sniHostNames, portNumber); - + SSLEngine sslEngine; - - if (addr != null) { + + if (addr != null && sniHostName != null) { + // Use createUnresolved to avoid blocking DNS lookup on the I/O thread + InetSocketAddress peer = InetSocketAddress.createUnresolved(sniHostName, portNumber); sslEngine = sslContext.createSSLEngine(peer.getHostName(), peer.getPort()); + } else if (addr != null) { + sslEngine = sslContext.createSSLEngine(addr.getHostString(), addr.getPort()); } else { sslEngine = sslContext.createSSLEngine(); } @@ -120,6 +125,13 @@ protected SSLEngine createEngine(IoSession session, InetSocketAddress addr) { } sslEngine.setUseClientMode(!session.isServer()); + + // Explicitly set the SNI extension so the server receives the correct hostname + if (sniHostName != null && !session.isServer()) { + SSLParameters sslParameters = sslEngine.getSSLParameters(); + sslParameters.setServerNames(Collections.singletonList(new SNIHostName(sniHostName))); + sslEngine.setSSLParameters(sslParameters); + } return sslEngine; } @@ -229,7 +241,7 @@ private void startAcceptor(SSLContext sslContext) throws Exception { acceptor.setReuseAddress(true); SslFilter sslFilter = new SslFilter(sslContext); - sslFilter.setEnabledProtocols(new String[] {"TLSv1.2"}); + sslFilter.setEnabledProtocols("TLSv1.2"); DefaultIoFilterChainBuilder filters = acceptor.getFilterChain(); filters.addLast("ssl", sslFilter); @@ -271,7 +283,7 @@ public void onPreAdd(IoFilterChain parent, String name, NextFilter nextFilter) t }; sslFilter.setEndpointIdentificationAlgorithm("HTTPS"); - sslFilter.setEnabledProtocols(new String[] {"TLSv1.2"}); + sslFilter.setEnabledProtocols("TLSv1.2"); DefaultIoFilterChainBuilder filters = connector.getFilterChain(); filters.addLast("ssl", sslFilter); From 7adcd4800704b6e76a96f9e430e8f48e66920975 Mon Sep 17 00:00:00 2001 From: Marcin Date: Tue, 22 Sep 2026 12:38:06 +0200 Subject: [PATCH 2/2] parametrize test for TLS 1.2 / 1.3 separately --- .../ssl/SslIdentificationAlgorithmTest.java | 23 +++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/mina-core/src/test/java/org/apache/mina/filter/ssl/SslIdentificationAlgorithmTest.java b/mina-core/src/test/java/org/apache/mina/filter/ssl/SslIdentificationAlgorithmTest.java index d97ea8eac..03f03d6cc 100644 --- a/mina-core/src/test/java/org/apache/mina/filter/ssl/SslIdentificationAlgorithmTest.java +++ b/mina-core/src/test/java/org/apache/mina/filter/ssl/SslIdentificationAlgorithmTest.java @@ -31,6 +31,8 @@ import org.apache.mina.util.AvailablePortFinder; import org.junit.Before; import org.junit.Test; +import org.junit.runner.RunWith; +import org.junit.runners.Parameterized; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SNIHostName; @@ -41,7 +43,9 @@ import java.net.InetSocketAddress; import java.security.KeyStore; import java.security.Security; +import java.util.Arrays; import java.util.Collections; +import java.util.List; import java.util.concurrent.CountDownLatch; import java.util.concurrent.TimeUnit; @@ -59,6 +63,7 @@ * client-san-ext.truststore - keystore with trusted certificate * */ +@RunWith(Parameterized.class) public class SslIdentificationAlgorithmTest { private static final String KEY_MANAGER_FACTORY_ALGORITHM; @@ -73,9 +78,19 @@ public class SslIdentificationAlgorithmTest { KEY_MANAGER_FACTORY_ALGORITHM = algorithm; } + @Parameterized.Parameters(name = "{0}") + public static List getParameters() { + return Arrays.asList(new Object[][]{{"TLSv1.2"}, {"TLSv1.3"}}); + } + + private final String enabledProtocol; private int port; private CountDownLatch handshakeDone; - + + public SslIdentificationAlgorithmTest(String enabledProtocol) { + this.enabledProtocol = enabledProtocol; + } + private static class CustomSslFilter extends SslFilter { public CustomSslFilter(SSLContext sslContext) { super(sslContext); @@ -241,7 +256,7 @@ private void startAcceptor(SSLContext sslContext) throws Exception { acceptor.setReuseAddress(true); SslFilter sslFilter = new SslFilter(sslContext); - sslFilter.setEnabledProtocols("TLSv1.2"); + sslFilter.setEnabledProtocols(enabledProtocol); DefaultIoFilterChainBuilder filters = acceptor.getFilterChain(); filters.addLast("ssl", sslFilter); @@ -283,7 +298,7 @@ public void onPreAdd(IoFilterChain parent, String name, NextFilter nextFilter) t }; sslFilter.setEndpointIdentificationAlgorithm("HTTPS"); - sslFilter.setEnabledProtocols("TLSv1.2"); + sslFilter.setEnabledProtocols(enabledProtocol); DefaultIoFilterChainBuilder filters = connector.getFilterChain(); filters.addLast("ssl", sslFilter); @@ -322,7 +337,7 @@ private SSLContext createSSLContext(String keyStorePath, String trustStorePath) TrustManagerFactory tmf = TrustManagerFactory.getInstance(KEY_MANAGER_FACTORY_ALGORITHM); tmf.init(trustStore); - SSLContext ctx = SSLContext.getInstance("TLSv1.2"); + SSLContext ctx = SSLContext.getInstance(enabledProtocol); ctx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null); return ctx;