Fix SNI not being set on SSLSocket when using connect timeout

Under BCJSSE (Bouncy Castle JSSE provider), creating an unconnected
SSLSocket via createSocket() and then calling connect(InetSocketAddress)
does not automatically propagate the hostname for SNI. This causes TLS
handshake failures against endpoints that require SNI for certificate
selection (e.g. AWS OpenSearch managed domains behind load balancers).

The fix explicitly sets SNI server names via SSLParameters before
connecting, which works correctly with both SunJSSE and BCJSSE.

Closes #765

Signed-off-by: Sotaro Hikita <bering1814@gmail.com>

Author: lawofcycles

mr/src/main/java/org/opensearch/hadoop/rest/commonshttp/SSLSocketFactory.java

@@ -41,10 +41,15 @@
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 
+import java.util.Collections;
+
 import javax.net.SocketFactory;
 import javax.net.ssl.KeyManager;
 import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SNIHostName;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLParameters;
+import javax.net.ssl.SSLSocket;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
@@ -142,6 +147,12 @@ public Socket createSocket(String host, int port, InetAddress localAddress, int
         }
         else {
             Socket socket = socketfactory.createSocket();
+            if (socket instanceof SSLSocket) {
+                SSLSocket sslSocket = (SSLSocket) socket;
+                SSLParameters sslParams = sslSocket.getSSLParameters();
+                sslParams.setServerNames(Collections.singletonList(new SNIHostName(host)));
+                sslSocket.setSSLParameters(sslParams);
+            }
             SocketAddress localaddr = new InetSocketAddress(localAddress, localPort);
             SocketAddress remoteaddr = new InetSocketAddress(host, port);
             socket.bind(localaddr);