This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 62fd9adeda Don't count NIO TLS handshake processing time towards the
timeout
62fd9adeda is described below
commit 62fd9adedac478a1b1e303ef1a1f3ee21d1a706a
Author: Mark Thomas <[email protected]>
AuthorDate: Sun Nov 8 12:04:13 2026 +0000
Don't count NIO TLS handshake processing time towards the timeout
The TLS handshake reads and writes the channel directly, so it does not
update the last read/write times. When a handshake step was slow (e.g.
an
OCSP check of the client certificate) the Poller could time out the
connection as soon as read/write interest was registered.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
java/org/apache/tomcat/util/net/NioEndpoint.java | 9 +++++++++
webapps/docs/changelog.xml | 7 +++++++
2 files changed, 16 insertions(+)
diff --git a/java/org/apache/tomcat/util/net/NioEndpoint.java
b/java/org/apache/tomcat/util/net/NioEndpoint.java
index 7cc2e9a4e4..f1f069e5e6 100644
--- a/java/org/apache/tomcat/util/net/NioEndpoint.java
+++ b/java/org/apache/tomcat/util/net/NioEndpoint.java
@@ -2224,8 +2224,17 @@ public class NioEndpoint extends
AbstractNetworkChannelEndpoint<NioChannel,Socke
getHandler().process(socketWrapper,
SocketEvent.CONNECT_FAIL);
socketWrapper.close();
} else if (handshake == SelectionKey.OP_READ) {
+ /*
+ * The handshake reads from the channel directly so does
not update the last read time. Time spent
+ * processing the handshake (e.g. OCSP checks of the
client certificate) must not count towards
+ * the time spent waiting for the client else the Poller
may time out the connection as soon as
+ * read interest is registered.
+ */
+ ((NioSocketWrapper) socketWrapper).updateLastRead();
socketWrapper.registerReadInterest();
} else if (handshake == SelectionKey.OP_WRITE) {
+ // Same as for read above
+ ((NioSocketWrapper) socketWrapper).updateLastWrite();
socketWrapper.registerWriteInterest();
}
} catch (CancelledKeyException cx) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 5effd42f29..83279322fd 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -780,6 +780,13 @@
When validating HTTP/2 frames, make sure more serious errors take
priority over less serious errors. (markt)
</fix>
+ <fix>
+ Ensure that time spent processing the TLS handshake with NIO, such as
+ OCSP checks of client certificates, is not counted towards the
+ connection timeout. Previously, a slow handshake could cause the
+ connection to be closed as soon as the server started waiting for the
+ client. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
