This is an automated email from the ASF dual-hosted git repository. weichiu pushed a commit to branch branch-3.2 in repository https://gitbox.apache.org/repos/asf/hadoop.git
The following commit(s) were added to refs/heads/branch-3.2 by this push: new ae8839e HADOOP-15813. Enable more reliable SSL connection reuse. Contributed by Daryn Sharp. ae8839e is described below commit ae8839e6e8cc3e8f8d5e50525d3302038ada484b Author: Daryn Sharp <da...@apache.org> AuthorDate: Wed Feb 20 18:13:53 2019 -0800 HADOOP-15813. Enable more reliable SSL connection reuse. Contributed by Daryn Sharp. Signed-off-by: Wei-Chiu Chuang <weic...@apache.org> (cherry picked from commit a87e458432609b7a35a2abd6410b02e8a2ffc974) --- .../src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java index f05274a..8e8421b 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java @@ -108,6 +108,10 @@ public class SSLFactory implements ConnectionConfigurator { private Mode mode; private boolean requireClientCert; private SSLContext context; + // the java keep-alive cache relies on instance equivalence of the SSL socket + // factory. in many java versions, SSLContext#getSocketFactory always + // returns a new instance which completely breaks the cache... + private SSLSocketFactory socketFactory; private HostnameVerifier hostnameVerifier; private KeyStoresFactory keystoresFactory; @@ -178,6 +182,9 @@ public class SSLFactory implements ConnectionConfigurator { context.init(keystoresFactory.getKeyManagers(), keystoresFactory.getTrustManagers(), null); context.getDefaultSSLParameters().setProtocols(enabledProtocols); + if (mode == Mode.CLIENT) { + socketFactory = context.getSocketFactory(); + } hostnameVerifier = getHostnameVerifier(conf); } @@ -298,7 +305,7 @@ public class SSLFactory implements ConnectionConfigurator { throw new IllegalStateException( "Factory is not in CLIENT mode. Actual mode is " + mode.toString()); } - return context.getSocketFactory(); + return socketFactory; } /** --------------------------------------------------------------------- To unsubscribe, e-mail: common-commits-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-commits-h...@hadoop.apache.org