Skip to content

Create QuicSslEngine for client with parameter peer host to meet hostname checker requirements #16200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zrlw wants to merge 2 commits into
base: 3.3
Choose a base branch
from
+14 −13
Open

Create QuicSslEngine for client with parameter peer host to meet hostname checker requirements #16200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
077e853
Create QuicSslEngine for client with parameter peer host to support h…
zrlw Apr 9, 2026
c99e00f
Reformat NettyHttp3ConnectionClient.java
zrlw Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .../dubbo-remoting-http3/src/main/java/org/apache/dubbo/remoting/http3/Http3SslContexts.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,6 @@ public static QuicSslContext buildClientSslContext(URL url) {
} catch (Throwable t) {
throw new IllegalArgumentException("Could not find certificate file or the certificate is invalid.", t);
}
builder.endpointIdentificationAlgorithm(null);
try {
return builder.applicationProtocols(Http3.supportedApplicationProtocols())
.build();
Expand Down
5 changes: 4 additions & 1 deletion .../src/main/java/org/apache/dubbo/remoting/transport/netty4/NettyHttp3ConnectionClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
import io.netty.handler.codec.http3.Http3ClientConnectionHandler;
import io.netty.handler.codec.quic.QuicChannel;
import io.netty.handler.codec.quic.QuicChannelBootstrap;
import io.netty.handler.codec.quic.QuicSslContext;
import io.netty.util.concurrent.Future;
import io.netty.util.concurrent.GenericFutureListener;

Expand All @@ -64,8 +65,10 @@ protected void initConnectionClient() {

@Override
protected void initBootstrap() throws Exception {
URL url = getUrl();
QuicSslContext quicSslContext = Http3SslContexts.buildClientSslContext(url);
io.netty.channel.ChannelHandler codec = Http3Helper.configCodec(Http3.newQuicClientCodecBuilder(), getUrl())
.sslContext(Http3SslContexts.buildClientSslContext(getUrl()))
.sslEngineProvider(q -> quicSslContext.newEngine(q.alloc(), url.getHost(), url.getPort()))
.build();
Comment on lines +68 to 72
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The hostname passed to the QUIC SSLEngine is taken from url.getHost()/getPort(), but the actual remote endpoint is getConnectAddress() (which applies NetUtils.filterLocalHost(...) in AbstractClient#getConnectAddress). These can diverge for values like 127.x, 0.0.0.0, or localhost, causing hostname verification to validate against a different name than the one actually connected to (false failures or, worse, validating the wrong peer). Consider using the host/port from getConnectAddress() (or applying the same filterLocalHost logic) when creating the engine.

Copilot uses AI. Check for mistakes.
io.netty.channel.Channel nettyDatagramChannel = new Bootstrap()
.option(ChannelOption.CONNECT_TIMEOUT_MILLIS, getConnectTimeout())
Expand Down
21 changes: 10 additions & 11 deletions dubbo-rpc/dubbo-rpc-triple/src/test/resources/certs/server.pem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,17 @@
-----BEGIN CERTIFICATE-----
MIIC+jCCAeKgAwIBAgIUFrQFPMAmmmGTMmlyK4+r3aaCRwwwDQYJKoZIhvcNAQEL
BQAwEjEQMA4GA1UEAwwHcXVpYy1jYTAgFw0yNDA4MjEwNjM4MDdaGA8yMDc0MDgw
OTA2MzgwN1owFjEUMBIGA1UEAwwLcXVpYy1zZXJ2ZXIwggEiMA0GCSqGSIb3DQEB
MIICyzCCAbOgAwIBAgIUdPJpD5OcSrtKFT3tDXbKUAhk9ywwDQYJKoZIhvcNAQEL
BQAwEjEQMA4GA1UEAwwHcXVpYy1jYTAgFw0yNjA0MDkwOTE2MTdaGA8yMDc2MDQw
OTA5MTYxN1owFjEUMBIGA1UEAwwLcXVpYy1zZXJ2ZXIwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQC/wX9dQdJmAA1bGCaLV09Fve9gLJc8/o9ERCpQyV2f
CEJmWXYEzS1n8z0k3MAGxLF8pw98K6A8J7/6lWB0f4edsgMu05zUco/fu9nMIHnn
VSEXVcEDxh1E9LcPCWKLyukPSJy1eW8VJtxAR/sTyZUK6u7fWLQW/yp9KPdOvicv
4ynHDv/S1BCUjH/N/bv8Lwc4a0U/QArlOSZ8CJfNWNV2gCtJtQLJZWK27qrLLMYO
/A4ZgnJ79ssCaaO6KxXKmETW5y+Q3+aawLdT0jrIcjwhmWAok7RgLeIYT1fK8QM2
ON5y4efJIH116XK1B//Mcyx8ymunNcPpPPrxMeT/ibmbAgMBAAGjQjBAMB0GA1Ud
DgQWBBTGNCm9e2SitiqMincY+d3xjexS9zAfBgNVHSMEGDAWgBQEK/HUx2bnjBMN
3iBMjAWK0xY6bTANBgkqhkiG9w0BAQsFAAOCAQEAUuPFchVrD/zTsww7voBwBm9f
Jv3Ix87feArTof0hQ3YVPhPhDwPVxSHOp2SGZ2HiqrFPyAsFDgUn7VFjdeVZxEr5
E090UsoWCEikHp49aw9jN8IIKEvguP2AiIdBfl4wa/We5y9CtiLvcEHWk+MdB7dX
leX1HPFyWgCqm2JIknITV1ZYpmeovAzMz3Qh+IJWAub+6ANYA9F1CkKoRVy9Guio
g35+8my2PZtS8dP60Ef4YmoSQ0D/WMgwscrpUScdKzcnybsWk3OCKS2MY+joUQp+
6AhkeB8Jafgmb7Zh8PINdJEM7Ab/Mc8pf11ghYUeWYM+1jEgOI0BzPijMCx6bQ==
ON5y4efJIH116XK1B//Mcyx8ymunNcPpPPrxMeT/ibmbAgMBAAGjEzARMA8GA1Ud
EQQIMAaHBH8AAAEwDQYJKoZIhvcNAQELBQADggEBAFm1PDjUKjIIr/9OkKGQ8e69
qO7HMm4K3n84Utu/BaRewQTGXK8NqE9C4yBPvZsC3aAVRwVy0L4askXh1P5u8sa+
HFt/Mc4bUc4cAU7lyocK8zZh5fbwZnojecWN+XZayzGrVyIhoEOep25P6s7/C4Bn
/o+pD3ufMyTkBsVAUxPPx0O+cUtCr7g/LUIE7OTqaok/yWYlHxDrLwEPeCawrbkM
Y8YDRDjjgD+yZN0YlRiB4cCN+W6feuWNZsOGiirXc+pLMp6pySbcCqhjM/uCzmoX
dzI7mzGyCi4YPHI3R9EgMfasFkSrAQOivWtQi0XpXoG2zLYmKLFVwF8YwpGA1b4=
-----END CERTIFICATE-----
Loading