HADOOP-19876. SSL protocol config is not applied to Jetty when set to default value#8465
Merged
jojochuang merged 2 commits intoapache:trunkfrom May 5, 2026
Merged
HADOOP-19876. SSL protocol config is not applied to Jetty when set to default value#8465jojochuang merged 2 commits intoapache:trunkfrom
jojochuang merged 2 commits intoapache:trunkfrom
Conversation
|
💔 -1 overall
This message was automatically generated. |
Contributor
|
Thanks for the PR. Can we please add a unit/integration test for this? I think we at least need a sequence of commands that I could follow to test this patch--but it really should be automated to prevent regressions. |
Contributor
|
Thanks @dombizita for fixing this bug! LGTM! |
Contributor
Author
|
Thank you for the review @ajfabbri and @K0K0V0K! In the latest commit I fixed an already existing test that started failing, which reproduced the reported bug ( |
Contributor
Author
|
@jojochuang could you please also check this? As you worked on this before, thanks! |
|
🎊 +1 overall
This message was automatically generated. |
There was a problem hiding this comment.
Pull request overview
Fixes a bug in HttpServer2 where SSL enabled-protocol configuration was not applied to Jetty when the resolved value matched the default (SSLFactory.SSL_ENABLED_PROTOCOLS_DEFAULT, currently TLSv1.2). By always applying the configured (or defaulted) protocol list, Jetty’s SslContextFactory consistently reflects the intended protocol restrictions.
Changes:
- Always apply enabled-protocol configuration to Jetty’s
SslContextFactory(remove the “only if non-default” gate). - Update SSL HTTP server functional test setup to include TLSv1.3 on Java 11+ (since the server will now strictly honor the configured protocol list).
- Add focused unit tests verifying that the enabled-protocol configuration is applied even when unset or explicitly set to the default.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java | Removes the conditional gate so SslContextFactory include/exclude protocol lists are always updated from config (including default). |
| hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestSSLHttpServer.java | Adjusts test server protocol configuration to include TLSv1.3 on Java 11+ to align with stricter protocol enforcement. |
| hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestSSLHttpServerConfigs.java | Adds tests asserting Jetty’s SslContextFactory reflects enabled-protocol config for unset/default/explicit/default and non-default cases. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jojochuang
approved these changes
May 5, 2026
Contributor
jojochuang
left a comment
jojochuang
left a comment
There was a problem hiding this comment.
Yeah looks good to me. I don't recall why I made it so convoluted even reading the comments in HADOOP-19876.
Incidentally, now that Hadoop defaults to JDK17, we should update SSLFfactory.SSL_ENABLED_PROTOCOLS_DEFAULT = "TLSv1.2,TLSv1.3"
(Jetty supports TLSv1.3 since JDK11)
ajfabbri
approved these changes
May 5, 2026
Contributor
ajfabbri
left a comment
ajfabbri
left a comment
There was a problem hiding this comment.
+1. Thanks for adding a test.
Contributor
|
Opened https://issues.apache.org/jira/browse/HADOOP-19879 to add TLSv1.3 to the default supported protocols. |
Contributor
|
Merged. Thanks @dombizita @ajfabbri @K0K0V0K |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of PR
In
HttpServer2.setEnabledProtocols(), the logic that applies SSL protocol restrictions to the Jetty SslContextFactory is gated behind a check that compares the resolved configuration value againstSSLFactory.SSL_ENABLED_PROTOCOLS_DEFAULT("TLSv1.2"). This means that Jetty is not respecting the configuration, the condition check should be removed.How was this patch tested?
Tested the changes manually with
openssl s_client -connectcommands.For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?AI Tooling
No AI tool was used.
If an AI tool was used:
where is the name of the AI tool used.
https://www.apache.org/legal/generative-tooling.html