He-Pin opened a new pull request, #3323: URL: https://github.com/apache/pekko/pull/3323
### Motivation A failed post-handshake session verifier was handled as if the `SSLEngine` itself had failed. When the verifier returned an `SSLException`, the GraphStage TLS implementation caught it in the engine failure path and called `closeOutbound()`. Because the handshake had already succeeded and there was no pending fatal alert, this generated `close_notify` and completed the transport gracefully instead of aborting it. Engine-originated handshake failures are intentionally left unchanged: those paths must continue wrapping and flushing pending fatal alerts such as `certificate_unknown`. ### Modification - Handle a failed `verifySession` result as an explicit TLS stage failure. - Stop wrap/unwrap handshake processing immediately after the verifier rejects the session. - Add a directional regression test that observes the cipher-side transport termination and checks that the original verifier exception fails it. - Run the shared test for both the GraphStage and legacy actor implementations, covering TLS 1.2 and TLS 1.3. ### Result Post-handshake session verification failures now abort the transport with the original exception. The GraphStage behavior matches the legacy TLS actor, while engine-originated TLS failures continue to flush their fatal alerts. ### Tests - `stream-tests / Test / testOnly org.apache.pekko.stream.io.TlsGraphStageSpec` — 113 passed - `stream-tests / Test / testOnly org.apache.pekko.stream.io.TlsSpec` — 113 passed - `+headerCheckAll` — passed - `checkCodeStyle` — passed - `validatePullRequest` — environment failure: `leveldbjni-all 1.8` has no macOS ARM64 binary; remaining unrelated tests were stopped - Qoder blocker review — no must-fix findings ### References Fixes #3245 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
