He-Pin opened a new pull request, #3323:
URL: https://github.com/apache/pekko/pull/3323

   ### Motivation
   A failed post-handshake session verifier was handled as if the `SSLEngine` 
itself had failed. When the verifier returned an `SSLException`, the GraphStage 
TLS implementation caught it in the engine failure path and called 
`closeOutbound()`. Because the handshake had already succeeded and there was no 
pending fatal alert, this generated `close_notify` and completed the transport 
gracefully instead of aborting it.
   
   Engine-originated handshake failures are intentionally left unchanged: those 
paths must continue wrapping and flushing pending fatal alerts such as 
`certificate_unknown`.
   
   ### Modification
   - Handle a failed `verifySession` result as an explicit TLS stage failure.
   - Stop wrap/unwrap handshake processing immediately after the verifier 
rejects the session.
   - Add a directional regression test that observes the cipher-side transport 
termination and checks that the original verifier exception fails it.
   - Run the shared test for both the GraphStage and legacy actor 
implementations, covering TLS 1.2 and TLS 1.3.
   
   ### Result
   Post-handshake session verification failures now abort the transport with 
the original exception. The GraphStage behavior matches the legacy TLS actor, 
while engine-originated TLS failures continue to flush their fatal alerts.
   
   ### Tests
   - `stream-tests / Test / testOnly 
org.apache.pekko.stream.io.TlsGraphStageSpec` — 113 passed
   - `stream-tests / Test / testOnly org.apache.pekko.stream.io.TlsSpec` — 113 
passed
   - `+headerCheckAll` — passed
   - `checkCodeStyle` — passed
   - `validatePullRequest` — environment failure: `leveldbjni-all 1.8` has no 
macOS ARM64 binary; remaining unrelated tests were stopped
   - Qoder blocker review — no must-fix findings
   
   ### References
   Fixes #3245
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to