HTHou opened a new pull request, #1561: URL: https://github.com/apache/ratis/pull/1561
## What changes were proposed in this pull request? Add an optional server-side listener for initial TLS handshake failures on Ratis gRPC connections. The listener receives the original failure cause, local and remote socket addresses, and the connection direction. It is configured through `GrpcConfigKeys.Server.setTlsHandshakeFailureListener` and is applied to the server, admin, and client-facing inbound gRPC services. The implementation uses the shaded gRPC `ServerCredentials` and protocol-negotiator extension points, so no `ratis-thirdparty` change is required. It preserves the existing TLS offload executor, reports TLS and ALPN negotiation failures before an RPC exists, and isolates listener failures from transport failure handling. When no listener is configured, the existing server builder path remains unchanged. This pull request covers inbound gRPC server connections. Outbound client notification can be added separately. ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/RATIS-2638 ## How was this patch tested? Added `TestRaftServerWithGrpc#testTlsHandshakeFailureListener`, which verifies that a valid mTLS request succeeds without notification, failed handshakes report both endpoint addresses, and listener exceptions do not prevent later failures from being handled. Also ran: - `./mvnw -pl ratis-test -am -Dtest=TestRaftServerWithGrpc#testTlsHandshakeFailureListener test` - `./mvnw -pl ratis-grpc -am -DskipTests package` - `./dev-support/checks/checkstyle.sh` - `./dev-support/checks/rat.sh` - `./dev-support/checks/findbugs.sh -pl ratis-grpc -am` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
