From eae7a2af09944c7423da0377a1c7cbdc9665a940 Mon Sep 17 00:00:00 2001
From: MaxSiominDev <maxsiomindev@gmail.com>
Date: Fri, 28 Aug 2026 04:11:02 +0300
Subject: [PATCH] feat: pass peer address to ssl engine

Closes TNTP-9891
---
 CHANGELOG.md                                        |  4 ++++
 .../connection/ConnectionChannelInitializer.java    | 13 +++++++++++--
 .../tarantool/core/connection/ConnectionImpl.java   |  6 +++---
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8713f02..f9884f8c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@
   Logback auto-discovered it as application-level config in consumer apps
   (e.g. Spring Boot with `logback-spring.xml`), overriding the host's logging
   configuration. [#109](https://github.com/tarantool/tarantool-java-sdk/issues/109)
+- Pass the peer address to the SSL engine, so that a TLS connection can verify the server
+  certificate against the host it was opened for. Endpoint identification is enabled by default
+  since netty 4.2, and without the address the JDK aborted every handshake with
+  `Hostname or IP address is undefined`, which made `withSslContext` unusable.
 
 ### Dependencies
 
diff --git a/tarantool-core/src/main/java/io/tarantool/core/connection/ConnectionChannelInitializer.java b/tarantool-core/src/main/java/io/tarantool/core/connection/ConnectionChannelInitializer.java
index 9e9de96c..2d8f9c75 100644
--- a/tarantool-core/src/main/java/io/tarantool/core/connection/ConnectionChannelInitializer.java
+++ b/tarantool-core/src/main/java/io/tarantool/core/connection/ConnectionChannelInitializer.java
@@ -5,6 +5,7 @@
 
 package io.tarantool.core.connection;
 
+import java.net.InetSocketAddress;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeUnit;
 import java.util.function.BiConsumer;
@@ -29,6 +30,7 @@ class ConnectionChannelInitializer extends ChannelInitializer<SocketChannel> {
   private final CompletableFuture<Greeting> promise;
   private final BiConsumer<IProtoResponse, Throwable> messageHandler;
   private final SslContext sslContext;
+  private final InetSocketAddress peerAddress;
   private final ChannelFutureListener closeHandler;
   private final FlushConsolidationHandler flushConsolidationHandler;
   private final int idleTimeout;
@@ -37,12 +39,14 @@ private ConnectionChannelInitializer(
       CompletableFuture<Greeting> promise,
       BiConsumer<IProtoResponse, Throwable> messageHandler,
       SslContext sslContext,
+      InetSocketAddress peerAddress,
       ChannelFutureListener closeHandler,
       FlushConsolidationHandler flushConsolidationHandler,
       int idleTimeout) {
     this.promise = promise;
     this.messageHandler = messageHandler;
     this.sslContext = sslContext;
+    this.peerAddress = peerAddress;
     this.closeHandler = closeHandler;
     this.flushConsolidationHandler = flushConsolidationHandler;
     this.idleTimeout = idleTimeout;
@@ -58,7 +62,9 @@ protected void initChannel(SocketChannel socketChannel) {
     }
 
     if (this.sslContext != null) {
-      pipeline.addLast(this.sslContext.newHandler(socketChannel.alloc()));
+      pipeline.addLast(
+          this.sslContext.newHandler(
+              socketChannel.alloc(), peerAddress.getHostString(), peerAddress.getPort()));
     }
 
     if (this.idleTimeout > 0) {
@@ -80,6 +86,7 @@ public static class Builder {
     private CompletableFuture<Greeting> promise;
     private BiConsumer<IProtoResponse, Throwable> messageHandler;
     private SslContext sslContext = null;
+    private InetSocketAddress peerAddress = null;
     private ChannelFutureListener closeHandler;
     private FlushConsolidationHandler flushConsolidationHandler = null;
     private int idleTimeout = -1;
@@ -96,8 +103,9 @@ public Builder withMessageHandler(BiConsumer<IProtoResponse, Throwable> handler)
       return this;
     }
 
-    public Builder withSSLContext(SslContext sslContext) {
+    public Builder withSSLContext(SslContext sslContext, InetSocketAddress peerAddress) {
       this.sslContext = sslContext;
+      this.peerAddress = peerAddress;
       return this;
     }
 
@@ -122,6 +130,7 @@ ConnectionChannelInitializer build() {
           this.promise,
           this.messageHandler,
           this.sslContext,
+          this.peerAddress,
           this.closeHandler,
           this.flushConsolidationHandler,
           this.idleTimeout);
diff --git a/tarantool-core/src/main/java/io/tarantool/core/connection/ConnectionImpl.java b/tarantool-core/src/main/java/io/tarantool/core/connection/ConnectionImpl.java
index daf3e4c5..892806c4 100644
--- a/tarantool-core/src/main/java/io/tarantool/core/connection/ConnectionImpl.java
+++ b/tarantool-core/src/main/java/io/tarantool/core/connection/ConnectionImpl.java
@@ -199,7 +199,7 @@ public synchronized CompletableFuture<Greeting> connect(InetSocketAddress addres
 
       channel =
           bootstrap
-              .handler(getInitializer(promise, sslContext))
+              .handler(getInitializer(promise, sslContext, address))
               .remoteAddress(address)
               .connect()
               .addListener(onChannelConnect(promise, address))
@@ -311,7 +311,7 @@ public boolean isPaused() {
   }
 
   private ConnectionChannelInitializer getInitializer(
-      CompletableFuture<Greeting> promise, SslContext sslContext) {
+      CompletableFuture<Greeting> promise, SslContext sslContext, InetSocketAddress peerAddress) {
     ConnectionChannelInitializer.Builder initializerBuilder =
         new ConnectionChannelInitializer.Builder()
             .withConnectPromise(promise)
@@ -324,7 +324,7 @@ private ConnectionChannelInitializer getInitializer(
       return initializerBuilder.build();
     }
 
-    return initializerBuilder.withSSLContext(sslContext).build();
+    return initializerBuilder.withSSLContext(sslContext, peerAddress).build();
   }
 
   /**