[jira] [Created] (HADOOP-19997) TestSSLHttpServerMTLS.testUntrustedClientIsRejected fails intermittently with SocketException instead of SSLHandshakeException

["Jose Luis López (Jira)" <ji...@apache.org>]

Jose Luis López created HADOOP-19997:
----------------------------------------

             Summary: TestSSLHttpServerMTLS.testUntrustedClientIsRejected fails intermittently with SocketException instead of SSLHandshakeException
                 Key: HADOOP-19997
                 URL: https://issues.apache.org/jira/browse/HADOOP-19997
             Project: Hadoop Common
          Issue Type: Bug
          Components: common, test
            Reporter: Jose Luis López


The test expects an {{SSLHandshakeException}}. The server rejects the client certificate and drops the connection right away. That close races the client's last handshake flight, and how the refusal reaches the client depends on which side wins and on the TLS version:

TLSv1.2: {{SSLHandshakeException}}.
The close wins: the client fails writing its flight and gets a {{SocketException}}.
TLSv1.3: the client finishes its side of the handshake before the server has verified the certificate. The failure then shows up on the request write as a bare {{IOException}}.
7 of 25 runs fail. The server guarantees only that the request is refused, not which exception the client sees. The fix calls {{getResponseCode()}} and asserts that it throws an {{IOException}} other than {{ConnectException}}. Unlike {{getInputStream()}}, {{getResponseCode()}} does not throw on an HTTP error status, so an HTTP 403 or 500 sent over a handshake that should have been refused still fails the test.

Test-only change. Verified 30/30 under TLSv1.2 and TLSv1.3.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-dev-help@hadoop.apache.org