He-Pin opened a new pull request, #3728: URL: https://github.com/apache/pekko/pull/3728
### Motivation The TLS GraphStage obtains transport buffers from the fixed-size TCP pool. An 8 KiB `pekko.io.tcp.direct-buffer-size` makes TLS fail at startup when the engine needs 16,709 bytes. The `BUFFER_OVERFLOW` path also requests twice the current capacity from the same pool and always fails. This also occurs after a successful handshake: with real JDK 21 TLS 1.2 engines and a 17,000-byte pool, a deferred small ciphertext write leaves insufficient room for the next wrap. Legacy TLS delivers all 5,120 application bytes; GraphStage fails while requesting 34,000 bytes from the pool. ### Modification - Keep pooled direct buffers when they satisfy the required capacity; allocate a stage-owned heap buffer otherwise. - Return only pooled direct buffers to the TCP pool. - Add three necessary regressions in the existing isolated-spec file: real TLS 1.2/1.3 with an 8 KiB pool, pool ownership after stage termination, and growth preserving previously buffered ciphertext. - Document how TLS buffer sizing relates to the TCP pool setting. ### Result Small TCP buffers no longer prevent TLS initialization, and output growth preserves deferred ciphertext. The normal pooled allocation path and TLS closing semantics are retained. ### Tests - Before the fix: all 3 new cases failed at the expected allocation/growth errors; the 3 existing deferred-close cases passed. - JDK 21: 260 TLS-related tests passed (`TlsSpec`, `TlsGraphStageSpec`, edge/isolated/deferred/small-buffer specs, engine selection and TLS utilities). - The 8 existing `TlsGraphStageSpec -- -z SingleBytes` communication cases with an 8 KiB pool changed from 8 failures to 8 passes, including TCP and both TLS versions. - JDK 17 and 25: all 6 small-buffer/deferred-close cases passed via ScalaTest against the compiled classes. - Explicit `graph-stage` selection: 6 Artery TLS tests passed (default configuration, rotating keys and hostname verification). - The real 17,000-byte overflow probe now delivers all 5,120 bytes on both engines. - Native scalafmt, `headerCreateAll`, `+headerCheckAll`, and `git diff --check` passed. - `sortImports` partially failed with `NoSuchMethodError: scala.meta.package$.Input()`; unrelated edits were removed and final formatting was checked with native scalafmt. - The existing public TCP TLS case exposed a separate closing-policy assumption on both unmodified main and this branch; #3727 corrects that test without changing production semantics. - Full local `validatePullRequest`/MiMa are deferred to remote CI as requested. The local `docs/paradox` run was stopped before completion when full validation was delegated to CI. ### References Refs #2860 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
