[HADOOP-18245] Extend KMS related exceptions that get mapped to ConnectException

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Component/s: kms
• Labels: pull-request-available
• Target Version/s: 3.4.0
• Hadoop Flags: Reviewed
• Assignee: Ritesh Shukla
• Reporter: Ritesh Shukla
• Created: 18/May/22 21:41
• Updated: 28/Jan/24 02:21
• Resolved: 19/May/22 20:25

Description

Based on production workload, we found that it is not enough to map just SSLHandshakeException to ConnectException in Loadbalancing KMS Client but that needs to be extended to SSLExceptions and SocketExceptions.

Sample JDK code that can raise these exceptions: https://github.com/openjdk/jdk/blob/jdk-18%2B32/src/java.base/share/classes/sun/security/ssl/SSLSocketImpl.java#L1409-L1428

Sample Exception backtrace:
22/04/13 16:25:53 WARN kms.LoadBalancingKMSClientProvider: KMS provider at https://bdgtr041x10h5.nam.nsroot.net:16001/kms/v1/ threw an IOException:
javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake
at sun.security.ssl.SSLSocketImpl.handleEOF(SSLSocketImpl.java:1470)
at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1298)
at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1199)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:373)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:587)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDe
Caused by: java.io.EOFException: SSL peer shut down incorrectly
at sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:480)
at sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:469)
... 59 more

Issue Links

• links to: GitHub Pull Request #4329