Repository navigation
HADOOP-19997. TestSSLHttpServerMTLS.testUntrustedClientIsRejected fails intermittently - #8783
Open
joseluisll wants to merge 2 commits into
Open
joseluisll wants to merge 2 commits into
joseluisll wants to merge 2 commits into
Conversation
|
💔 -1 overall
This message was automatically generated. |
joseluisll
changed the title
Contributor
Author
|
The Yetus -1 comes from an unrelated error in trunk handled by HADOOP-19993. @cnauroth @slfan1989 would you mind reviewing this PR?. |
|
💔 -1 overall
This message was automatically generated. |
joseluisll
force-pushed
the
HADOOP-19997
branch
from
October 5, 2026 17:07
754157f to
6dc1fbd
Compare
|
💔 -1 overall
This message was automatically generated. |
Contributor
Author
|
@Hexiaoqiao Please review this small test-only fix for the flaky mTLS test added in HADOOP-19927 . The yetus failure is a spotbug fixed by HADOOP-19993. |
…ls intermittently with SocketException instead of SSLHandshakeException. The server rejects the untrusted client certificate and drops the connection at once, racing the client's last handshake flight. How the refusal reaches the client depends on who wins and on the TLS version: SSLHandshakeException under TLSv1.2, SocketException when the close wins, and a bare IOException on the request write under TLSv1.3. Assert that getResponseCode() fails below HTTP with anything but a ConnectException, rather than which exception carries the refusal. Split out of HADOOP-19979. Contains content generated by Claude Code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
joseluisll
force-pushed
the
HADOOP-19997
branch
from
October 7, 2026 10:09
6dc1fbd to
f516736
Compare
|
🎊 +1 overall
This message was automatically generated. |
…se, and add a timeout. Shorten the explanation of why the refusal's exception type varies. Report an unexpected ConnectException through fail(message, cause) so the stack trace is kept. Add @timeout so a server that hangs instead of closing fails the test; a read timeout would not work, since the resulting SocketTimeoutException would pass the IOException check. Contains content generated by Claude Code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LNT3vjd7ZYnb1b5x8U2a7h
|
🎊 +1 overall
This message was automatically generated. |
Contributor
Author
|
@cnauroth @slfan1989 @pan3793 This PR is ready to be reviewed. CI green, Yetus green. |
This was referenced Oct 15, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on (has to be merged first):
clears a CI failure: it changes McpHttpServlet, which carries the trunk spotbugs warning SE_BAD_FIELD that turns this PR red, still red in the latest run
Description of PR
https://issues.apache.org/jira/browse/HADOOP-19997
testUntrustedClientIsRejectedexpects anSSLHandshakeException. When the server rejects the client certificate, it closes the connection while the client is still sending its last handshake message. Depending on timing and TLS version, the client sees anSSLHandshakeException, aSocketException, or a plainIOException. The test only accepts the first, so it fails intermittently.The test now checks that the request is refused, whatever the exception:
getResponseCode()must throw anIOException. It returns HTTP error codes instead of throwing, so a 403 or 500 would still fail the test.ConnectException, which would mean the server was never reached.Test-only change, one file.
How was this patch tested?
OpenJDK 21.0.12, trunk
bedcf384, onlytestUntrustedClientIsRejected, 50 runs each in a fresh JVM:SocketException)SocketException: Broken pipe, 6 ×IOException: Error writing to server)By default the server enables only TLSv1.2 (
hadoop.ssl.enabled.protocols=TLSv1.2), so a JDK-default client negotiates TLSv1.2 as well. For the TLSv1.3 runs, the server hadhadoop.ssl.enabled.protocols=TLSv1.3and the client-Djdk.tls.client.protocols=TLSv1.3, with the negotiated version confirmed in the handshake debug log. Under TLSv1.3 the client finishes its side of the handshake before the server checks the certificate, so the refusal can also surface as a bareIOExceptionwhen the request is written.TestSSLHttpServerMTLSpasses undermvn test. Checkstyle is clean.For code changes:
declared according to the connector-specific documentation? (N/A)
LICENSE,LICENSE-binary,NOTICE-binaryfiles? (N/A)AI Tooling
If an AI tool was used:
where is the name of the AI tool used.
https://www.apache.org/legal/generative-tooling.html
Contains content generated by Claude Code.