twitter/finagle — Issue #49: HTTPS keepalive broken for finagle http client?
Author: jluxenberg
Created: 2011-11-30 03:28:46+00:00
State: open

I'm trying to use the finagle-http client to connect to a HTTPS service that supports HTTP 1.1 keep-alive for persistent connections. The server I'm connecting to will terminate the connection after 60 seconds of inactivity. When it does this, I get the following error in my client's log:

DEB [20111130-02:14:19.999] ssl: Failed to clean up SSLEngine.
DEB [20111130-02:14:19.999] ssl: javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
DEB [20111130-02:14:19.999] ssl: at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:190)
DEB [20111130-02:14:19.999] ssl: at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1429)
DEB [20111130-02:14:19.999] ssl: at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1397)
DEB [20111130-02:14:19.999] ssl: at com.sun.net.ssl.internal.ssl.SSLEngineImpl.closeInbound(SSLEngineImpl.java:1336)
DEB [20111130-02:14:19.999] ssl: at org.jboss.netty.handler.ssl.SslHandler.channelDisconnected(SslHandler.java:468)
DEB [20111130-02:14:19.999] ssl: at org.jboss.netty.channel.Channels.fireChannelDisconnected(Channels.java:360)
DEB [20111130-02:14:19.999] ssl: at org.jboss.netty.channel.socket.nio.NioWorker.close(NioWorker.java:593)
DEB [20111130-02:14:19.999] ssl: at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:356)
DEB [20111130-02:14:19.999] ssl: at org.jboss.netty.channel.socket.nio.NioWorker.processSelectedKeys(NioWorker.java:280)
DEB [20111130-02:14:19.999] ssl: at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:200)
DEB [20111130-02:14:19.999] ssl: at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
DEB [20111130-02:14:19.999] ssl: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
DEB [20111130-02:14:19.999] ssl: at java.lang.Thread.run(Thread.java:662)

then, subsequent attempts to use the Service to make requests fail with the following error:

ERR [20111130-02:14:37.455] frontdoor: Error processing request
ERR [20111130-02:14:37.455] frontdoor: java.lang.IllegalArgumentException: Cannot change mode after SSL traffic has started
ERR [20111130-02:14:37.455] frontdoor: at com.sun.net.ssl.internal.ssl.SSLEngineImpl.setUseClientMode(SSLEngineImpl.java:1728)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.builder.ClientBuilder$$anon$3$$anonfun$getPipeline$5.apply(ClientBuilder.scala:557)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.builder.ClientBuilder$$anon$3$$anonfun$getPipeline$5.apply(ClientBuilder.scala:556)
ERR [20111130-02:14:37.455] frontdoor: at scala.Option.foreach(Option.scala:185)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.builder.ClientBuilder$$anon$3.getPipeline(ClientBuilder.scala:556)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.channel.ChannelServiceFactory$$anonfun$make$1.apply(ChannelService.scala:171)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.channel.ChannelServiceFactory$$anonfun$make$1.apply(ChannelService.scala:165)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.util.Try$.apply(Try.scala:13)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.util.Future$.apply(Future.scala:33)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.channel.ChannelServiceFactory.make(ChannelService.scala:165)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.pool.CachingPool.make(CachingPool.scala:55)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.pool.WatermarkPool.make(WatermarkPool.scala:100)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.service.FailureAccrualFactory.make(FailureAccrualFactory.scala:34)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.Filter$$anon$6.make(Service.scala:186)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.loadbalancer.HeapBalancer.make(HeapBalancer.scala:122)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.ServiceFactoryProxy.make(Service.scala:104)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.factory.RefcountedFactory.make(RefcountedFactory.scala:9)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.ServiceFactoryProxy.make(Service.scala:104)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.factory.StatsFactoryWrapper.make(StatsFactoryWrapper.scala:18)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.Filter$$anon$6.make(Service.scala:186)
ERR [20111130-02:14:37.455] frontdoor: at com.twitter.finagle.FactoryToService.apply(Service.scala:113)
ERR [20111130-02:14:37.455] frontdoor: (...more...)

This worked in Finagle 1.7.1, but we'd like to upgrade. I'm trying to write a test case but having difficultly setting up a server that closes the connection after a timeout.