Limit HostnameVerifier only for legacy ssl config

and document as JavaDoc in JedisClientConfig
redis · Nov 24, 2024 · f80ccbb · f80ccbb
1 parent f56aec3
commit f80ccbb
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 9 deletions.
diff --git a/src/main/java/redis/clients/jedis/DefaultJedisSocketFactory.java b/src/main/java/redis/clients/jedis/DefaultJedisSocketFactory.java
@@ -144,10 +144,13 @@ private Socket createSslSocket(HostAndPort _hostAndPort, Socket socket) throws I
       sslSocket.setSSLParameters(_sslParameters);
     }
 
-    if (hostnameVerifier != null && !hostnameVerifier.verify(_hostAndPort.getHost(), sslSocket.getSession())) {
-      String message = String.format("The connection to '%s' failed ssl/tls hostname verification.",
-          _hostAndPort.getHost());
-      throw new JedisConnectionException(message);
+    if (sslOptions != null) {
+      // limiting HostnameVerifier only for legacy ssl config
+      if (hostnameVerifier != null && !hostnameVerifier.verify(_hostAndPort.getHost(), sslSocket.getSession())) {
+        String message = String.format("The connection to '%s' failed ssl/tls hostname verification.",
+            _hostAndPort.getHost());
+        throw new JedisConnectionException(message);
+      }
     }
 
     return new SSLSocketWrapper(sslSocket, plainSocket);

diff --git a/src/main/java/redis/clients/jedis/JedisClientConfig.java b/src/main/java/redis/clients/jedis/JedisClientConfig.java
@@ -73,19 +73,20 @@ default SSLParameters getSslParameters() {
     return null;
   }
 
+  default HostnameVerifier getHostnameVerifier() {
+    return null;
+  }
+
   /**
-   * {@link JedisClientConfig#isSsl()} and {@link JedisClientConfig#getSslSocketFactory()} will be ignored if
+   * {@link JedisClientConfig#isSsl()}, {@link JedisClientConfig#getSslSocketFactory()} and
+   * {@link JedisClientConfig#getHostnameVerifier()} will be ignored if
    * {@link JedisClientConfig#getSslOptions() this} is set.
    * @return ssl options
    */
   default SslOptions getSslOptions() {
     return null;
   }
 
-  default HostnameVerifier getHostnameVerifier() {
-    return null;
-  }
-
   default HostAndPortMapper getHostAndPortMapper() {
     return null;
   }