This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 3b67f3c6cb Don't count NIO TLS handshake processing time towards the
timeout
3b67f3c6cb is described below
commit 3b67f3c6cb72d8d11a85e7d00d899764d6689872
Author: Mark Thomas <[email protected]>
AuthorDate: Sun Nov 8 12:04:13 2026 +0000
Don't count NIO TLS handshake processing time towards the timeout
The TLS handshake reads and writes the channel directly, so it does not
update the last read/write times. When a handshake step was slow (e.g. an
OCSP check of the client certificate) the Poller could time out the
connection as soon as read/write interest was registered.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
java/org/apache/tomcat/util/net/NioEndpoint.java | 9 +++++++++
webapps/docs/changelog.xml | 7 +++++++
2 files changed, 16 insertions(+)
diff --git a/java/org/apache/tomcat/util/net/NioEndpoint.java
b/java/org/apache/tomcat/util/net/NioEndpoint.java
index b5b876b317..c1ea38284e 100644
--- a/java/org/apache/tomcat/util/net/NioEndpoint.java
+++ b/java/org/apache/tomcat/util/net/NioEndpoint.java
@@ -2205,8 +2205,17 @@ public class NioEndpoint extends
AbstractJsseEndpoint<NioChannel,SocketChannel>
getHandler().process(socketWrapper,
SocketEvent.CONNECT_FAIL);
socketWrapper.close();
} else if (handshake == SelectionKey.OP_READ) {
+ /*
+ * The handshake reads from the channel directly so does
not update the last read time. Time spent
+ * processing the handshake (e.g. OCSP checks of the
client certificate) must not count towards
+ * the time spent waiting for the client else the Poller
may time out the connection as soon as
+ * read interest is registered.
+ */
+ ((NioSocketWrapper) socketWrapper).updateLastRead();
socketWrapper.registerReadInterest();
} else if (handshake == SelectionKey.OP_WRITE) {
+ // Same as for read above
+ ((NioSocketWrapper) socketWrapper).updateLastWrite();
socketWrapper.registerWriteInterest();
}
} catch (CancelledKeyException cx) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 5473421bf7..64c500b75b 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -589,6 +589,13 @@
connection, so the client saw a connection reset rather than the end of
the stream and could lose response data it had not yet read. (markt)
</fix>
+ <fix>
+ Ensure that time spent processing the TLS handshake with NIO, such as
+ OCSP checks of client certificates, is not counted towards the
+ connection timeout. Previously, a slow handshake could cause the
+ connection to be closed as soon as the server started waiting for the
+ client. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
