apache / apache/arrow-java

[JAVA] [ARROW-JDBC] Ssl Handler Exception - Swallowing a harmless 'connection reset by peer / broken pipe'

Aperta
#117 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Java
Stelle
94
Fork
152
Merge medio
3g 16h
PR unite (30g)
11

Descrizione

### Describe the usage question you have. Please include as many useful details as possible.

I have implemented flight sql server in java with tls protocol. Below is my server build code. The server internally connects with trino to fetch iceberg data and send it to the client.

```
Location location = Location.forGrpcTls("localhost", 32222);
final ArrowFlightServer example = new ArrowFlightServer(location);
Location listenLocation = Location.forGrpcTls("0.0.0.0", 32222);
File certificate = new File(SSL_CERT_PATH + "/cert.crt");
File priveteKey = new File(SSL_CERT_PATH + "/cert.key");
try (final BufferAllocator allocator = example.rootAllocator; final FlightServer server
= FlightServer.builder(allocator, listenLocation, example)
.useTls(certificate, priveteKey)
.headerAuthenticator(example.callHeaderInfo)
.build()) {
server.start();
server.awaitTermination();
}
```
I am using _adbc_driver_flightsql 0.9.0_ to connect to server from python client. Using below code, I am able to fetch data. I am using custom call headers in this scenario.
```
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
db_kwargs={
"adbc.flight.sql.rpc.call_header.username": "username",
"adbc.flight.sql.rpc.call_header.password": "Password",
"adbc.flight.sql.client_option.tls_skip_verify": "true"
}
) as conn:

with conn.cursor() as cur:
cur.execute(
"SELECT * FROM postgresql.public.tesla limit 10"
)

x = cur.fetch_arrow_table()
num_rows = x.num_rows
print(x)
```

But I get one server side exception when I change log level to DEBUG. Even though I get data as expected but in server logs I get below exception. When log level is set to INFO, I don't get this exception. Additionally, If I disable TLS and use non-secure method, I don't get this server side exception with log level set to DEBUG.

`2024-03-19 15:42:32 DEBUG io.netty.handler.ssl.SslHandler - [id: 0xa6229d8a, L:/192.168.140.77:32222 - R:/192.168.140.77:65174] Swallowing a harmless 'connection reset by peer / broken pipe' error that occurred while writing close_notify in response to the peer's close_notify`

Secondly if I change my python code to use standard jdbc username/password parameters like below,
```
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
db_kwargs={
"username": "username",
"password": "Password",
"adbc.flight.sql.client_option.tls_skip_verify": "true"
}
) as conn:
```
My python client code throws an exception and it does get the data at all.
```
Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 314, in _bootstrap
self.run()
File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 108, in run
self._target(*self._args, **self._kwargs)
File "/Users/a.bashir/Desktop/python_codes/newproj/venv/arrow_py_client.py", line 19, in execute_arrow_query
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
File "/Users/a.bashir/Desktop/python_codes/newproj/venv/lib/python3.10/site-packages/adbc_driver_flightsql/dbapi.py", line 120, in connect
conn = adbc_driver_manager.AdbcConnection(db, **(conn_kwargs or {}))
File "adbc_driver_manager/_lib.pyx", line 644, in adbc_driver_manager._lib.AdbcConnection.__init__
File "adbc_driver_manager/_lib.pyx", line 385, in adbc_driver_manager._lib.check_error
adbc_driver_manager._lib.OperationalError: ADBC_STATUS_UNKNOWN (1): [FlightSQL] [FlightSQL] flight: no authorization header on the response (Unknown; AuthenticateBasicToken)
```
Wonder what I am doing wrong.

### Component(s)

Java, Python

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Inizia con la configurazione TLS di Java FlightServer e gli esempi Python flight_sql.connect, quindi esamina il log close_notify di Netty SslHandler e il comportamento di autenticazione di Flight SQL. Confronta gli header delle chiamate personalizzati con i parametri standard username/password. Il lavoro è completato quando il comportamento di autenticazione previsto è documentato o corretto e il logging innocuo dello shutdown TLS è gestito adeguatamente.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
grpc, java, python
Ambito
authentication, backend-api-design, networking, security
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Da chiarire
Idoneità per principianti
25/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.