[JAVA] [ARROW-JDBC] Ssl Handler Exception - Swallowing a harmless 'connection reset by peer / broken pipe'
- Dominant language
- Java
- Stars
- 94
- Forks
- 152
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 11
Description
### Describe the usage question you have. Please include as many useful details as possible.
I have implemented flight sql server in java with tls protocol. Below is my server build code. The server internally connects with trino to fetch iceberg data and send it to the client.
```
Location location = Location.forGrpcTls("localhost", 32222);
final ArrowFlightServer example = new ArrowFlightServer(location);
Location listenLocation = Location.forGrpcTls("0.0.0.0", 32222);
File certificate = new File(SSL_CERT_PATH + "/cert.crt");
File priveteKey = new File(SSL_CERT_PATH + "/cert.key");
try (final BufferAllocator allocator = example.rootAllocator; final FlightServer server
= FlightServer.builder(allocator, listenLocation, example)
.useTls(certificate, priveteKey)
.headerAuthenticator(example.callHeaderInfo)
.build()) {
server.start();
server.awaitTermination();
}
```
I am using _adbc_driver_flightsql 0.9.0_ to connect to server from python client. Using below code, I am able to fetch data. I am using custom call headers in this scenario.
```
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
db_kwargs={
"adbc.flight.sql.rpc.call_header.username": "username",
"adbc.flight.sql.rpc.call_header.password": "Password",
"adbc.flight.sql.client_option.tls_skip_verify": "true"
}
) as conn:
with conn.cursor() as cur:
cur.execute(
"SELECT * FROM postgresql.public.tesla limit 10"
)
x = cur.fetch_arrow_table()
num_rows = x.num_rows
print(x)
```
But I get one server side exception when I change log level to DEBUG. Even though I get data as expected but in server logs I get below exception. When log level is set to INFO, I don't get this exception. Additionally, If I disable TLS and use non-secure method, I don't get this server side exception with log level set to DEBUG.
`2024-03-19 15:42:32 DEBUG io.netty.handler.ssl.SslHandler - [id: 0xa6229d8a, L:/192.168.140.77:32222 - R:/192.168.140.77:65174] Swallowing a harmless 'connection reset by peer / broken pipe' error that occurred while writing close_notify in response to the peer's close_notify`
Secondly if I change my python code to use standard jdbc username/password parameters like below,
```
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
db_kwargs={
"username": "username",
"password": "Password",
"adbc.flight.sql.client_option.tls_skip_verify": "true"
}
) as conn:
```
My python client code throws an exception and it does get the data at all.
```
Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 314, in _bootstrap
self.run()
File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 108, in run
self._target(*self._args, **self._kwargs)
File "/Users/a.bashir/Desktop/python_codes/newproj/venv/arrow_py_client.py", line 19, in execute_arrow_query
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
File "/Users/a.bashir/Desktop/python_codes/newproj/venv/lib/python3.10/site-packages/adbc_driver_flightsql/dbapi.py", line 120, in connect
conn = adbc_driver_manager.AdbcConnection(db, **(conn_kwargs or {}))
File "adbc_driver_manager/_lib.pyx", line 644, in adbc_driver_manager._lib.AdbcConnection.__init__
File "adbc_driver_manager/_lib.pyx", line 385, in adbc_driver_manager._lib.check_error
adbc_driver_manager._lib.OperationalError: ADBC_STATUS_UNKNOWN (1): [FlightSQL] [FlightSQL] flight: no authorization header on the response (Unknown; AuthenticateBasicToken)
```
Wonder what I am doing wrong.
### Component(s)
Java, Python
Contributor guide
Research direction
Start with the Java FlightServer TLS setup and the Python flight_sql.connect examples, then inspect the Netty SslHandler close_notify log and Flight SQL authentication behavior. Compare custom call headers with the standard username/password parameters. Done means the expected authentication behavior is documented or corrected and harmless TLS shutdown logging is handled appropriately.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java, python
- Domain
- authentication, backend-api-design, networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100