[
https://issues.apache.org/jira/browse/HADOOP-20023?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18128040#comment-18128040
]
ASF GitHub Bot commented on HADOOP-20023:
-----------------------------------------
slfan1989 opened a new pull request, #8831:
URL: https://github.com/apache/hadoop/pull/8831
### Description of PR
Fix an overly strict exception assertion in
TestSSLHttpServerMTLS.testUntrustedClientIsRejected.
The test expects SSLHandshakeException when the server rejects an untrusted
client certificate. However, the client can receive SocketException ("Broken
pipe") if the connection closes before it reads the TLS alert.
This caused the GitHub Actions common test job for #8821 to fail on all
three attempts.
This patch:
- Accepts SSLHandshakeException or an exact SocketException, while
excluding connection-refused, routing and timeout exceptions.
- Verifies that a trusted client can connect before and after the
rejected request, independently of test execution order.
- Adds 10-second connect and read timeouts.
- Disconnects connections in finally blocks.
This is a test-only change; production TLS behavior is unchanged.
Failing CI job:
https://github.com/smengcl/hadoop/actions/runs/38543349319/job/115787957238
### How was this patch tested?
- Ran the targeted test on JDK 17:
`mvn -pl hadoop-common-project/hadoop-common -Dtest=TestSSLHttpServerMTLS
-Dmaven.test.failure.ignore=false -Dcheckstyle.skip -Drat.skip=true test`
Result: 2 tests passed, 0 failures, 0 errors, 0 skipped.
- CI
### For code changes:
- [ ] Does the title of this PR start with the corresponding JIRA issue id
(e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: Have the integration tests been executed and the
endpoint
declared according to the connector-specific documentation? *Note:
Automated CI
testing doesn't cover all cases so manual testing with cloud storage
is still
required.*
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`,
`NOTICE-binary` files?
### AI Tooling
If an AI tool was used:
- [ ] The PR includes the phrase "Contains content generated by <tool>"
where <tool> is the name of the AI tool used.
- [ ] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
> Fix overly strict exception assertion in TestSSLHttpServerMTLS
> --------------------------------------------------------------
>
> Key: HADOOP-20023
> URL: https://issues.apache.org/jira/browse/HADOOP-20023
> Project: Hadoop Common
> Issue Type: Bug
> Components: test
> Affects Versions: 3.6.0
> Reporter: Shilun Fan
> Assignee: Shilun Fan
> Priority: Major
>
> TestSSLHttpServerMTLS.testUntrustedClientIsRejected expects
> SSLHandshakeException when an HTTPS client presents a certificate that the
> server does not trust.
> However, the client can receive SocketException ("Broken pipe") if the server
> closes the connection before the client reads the TLS alert.
>
> The test then fails even though the connection was rejected.
> This occurred in the Java 17 / Ubuntu 24 GitHub Actions job for PR #8821.
> All three attempts failed with:
>
> {code:java}
> Unexpected exception type thrown,
> expected: <javax.net.ssl.SSLHandshakeException>
> but was: <java.net.SocketException>
> Caused by: java.net.SocketException: Broken pipe
> at sun.security.ssl.SSLSocketOutputRecord.flush(...)
> at sun.security.ssl.HandshakeOutStream.flush(...)
> at sun.security.ssl.Finished$T12FinishedProducer.onProduceFinished(...) {code}
>
> Failing job:
> [https://github.com/smengcl/hadoop/actions/runs/38543349319/job/115787957238]
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
