pjfanning opened a new pull request, #3734: URL: https://github.com/apache/pekko/pull/3734
### Motivation Sometimes peer ciphertext arrives while the `SSLEngine` is `NEED_WRAP` and the ciphertext output has no demand. In that case `unwrap` returns the record unread. Both TLS engines still treated the inbound side as ready, so they unwrapped the same bytes again and again until the stream failed with `IllegalStateException: Stuck in unwrap loop`. With TLS 1.3 this happens when the client's 6-byte middlebox-compatibility ChangeCipherSpec arrives before the server has sent its whole flight. Back-pressure on the ciphertext output is legitimate, so the stage should wait for demand rather than fail. The legacy `TLSActor` fails in the same way, so this is also a reproducer for #442. ### Modification - `TlsGraphStage`: `inboundReady` and `inboundHalfClosedReady` are now false while the engine needs to wrap and the ciphertext output has no demand and is not closed. `onPull` on the ciphertext output re-runs the pump. - `TLSActor`: the same condition (`engineNotBlockedOnWrap`) is added to `inbound` and `inboundHalfClosed`. The #442 comment now explains the remaining guard. - New `TlsTransportBackpressureSpec` / `TlsGraphStageTransportBackpressureSpec`. A plain client `SSLEngine` requests server ciphertext only when it needs to unwrap, then checks an echo after the handshake. It covers TLS 1.2 and 1.3. ### Result Back-pressure on the ciphertext output during a handshake no longer fails the TLS stream on either engine. ### Tests - `sbt "stream-tests/testOnly org.apache.pekko.stream.io.TlsTransportBackpressureSpec org.apache.pekko.stream.io.TlsGraphStageTransportBackpressureSpec org.apache.pekko.stream.io.TlsSpec org.apache.pekko.stream.io.TlsGraphStageSpec org.apache.pekko.stream.io.TlsGraphStage*"`: 281 passed. - Without the fix, the TLS 1.3 cases of the new spec fail on both engines with `Stuck in unwrap loop … NEED_WRAP, remaining=6`. The TLS 1.2 cases pass either way. - scalafmt and `headerCreate` run. Only internal classes changed. ### References Fixes #3732, Refs #442, #3731 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
