apache / apache/arrow-java

[JAVA] [ARROW-JDBC] Ssl Handler Exception - Swallowing a harmless 'connection reset by peer / broken pipe'

未关闭
#117 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Java
星标
94
派生
152
平均合并
3 天 16 小时
30 天内合并 PR
11

描述

### Describe the usage question you have. Please include as many useful details as possible.

I have implemented flight sql server in java with tls protocol. Below is my server build code. The server internally connects with trino to fetch iceberg data and send it to the client.

```
Location location = Location.forGrpcTls("localhost", 32222);
final ArrowFlightServer example = new ArrowFlightServer(location);
Location listenLocation = Location.forGrpcTls("0.0.0.0", 32222);
File certificate = new File(SSL_CERT_PATH + "/cert.crt");
File priveteKey = new File(SSL_CERT_PATH + "/cert.key");
try (final BufferAllocator allocator = example.rootAllocator; final FlightServer server
= FlightServer.builder(allocator, listenLocation, example)
.useTls(certificate, priveteKey)
.headerAuthenticator(example.callHeaderInfo)
.build()) {
server.start();
server.awaitTermination();
}
```
I am using _adbc_driver_flightsql 0.9.0_ to connect to server from python client. Using below code, I am able to fetch data. I am using custom call headers in this scenario.
```
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
db_kwargs={
"adbc.flight.sql.rpc.call_header.username": "username",
"adbc.flight.sql.rpc.call_header.password": "Password",
"adbc.flight.sql.client_option.tls_skip_verify": "true"
}
) as conn:

with conn.cursor() as cur:
cur.execute(
"SELECT * FROM postgresql.public.tesla limit 10"
)

x = cur.fetch_arrow_table()
num_rows = x.num_rows
print(x)
```

But I get one server side exception when I change log level to DEBUG. Even though I get data as expected but in server logs I get below exception. When log level is set to INFO, I don't get this exception. Additionally, If I disable TLS and use non-secure method, I don't get this server side exception with log level set to DEBUG.

`2024-03-19 15:42:32 DEBUG io.netty.handler.ssl.SslHandler - [id: 0xa6229d8a, L:/192.168.140.77:32222 - R:/192.168.140.77:65174] Swallowing a harmless 'connection reset by peer / broken pipe' error that occurred while writing close_notify in response to the peer's close_notify`

Secondly if I change my python code to use standard jdbc username/password parameters like below,
```
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
db_kwargs={
"username": "username",
"password": "Password",
"adbc.flight.sql.client_option.tls_skip_verify": "true"
}
) as conn:
```
My python client code throws an exception and it does get the data at all.
```
Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 314, in _bootstrap
self.run()
File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/multiprocessing/process.py", line 108, in run
self._target(*self._args, **self._kwargs)
File "/Users/a.bashir/Desktop/python_codes/newproj/venv/arrow_py_client.py", line 19, in execute_arrow_query
with flight_sql.connect(uri="grpc+tls://192.168.140.77:32222",
File "/Users/a.bashir/Desktop/python_codes/newproj/venv/lib/python3.10/site-packages/adbc_driver_flightsql/dbapi.py", line 120, in connect
conn = adbc_driver_manager.AdbcConnection(db, **(conn_kwargs or {}))
File "adbc_driver_manager/_lib.pyx", line 644, in adbc_driver_manager._lib.AdbcConnection.__init__
File "adbc_driver_manager/_lib.pyx", line 385, in adbc_driver_manager._lib.check_error
adbc_driver_manager._lib.OperationalError: ADBC_STATUS_UNKNOWN (1): [FlightSQL] [FlightSQL] flight: no authorization header on the response (Unknown; AuthenticateBasicToken)
```
Wonder what I am doing wrong.

### Component(s)

Java, Python

贡献指南

打开贡献指南

调研方向

先从 Java FlightServer 的 TLS 设置和 Python flight_sql.connect 示例开始,然后检查 Netty SslHandler 的 close_notify 日志以及 Flight SQL 的身份验证行为。将自定义调用标头与标准 username/password 参数进行比较。当预期的身份验证行为得到记录或纠正,并且无害的 TLS 关闭日志得到适当处理时,即视为完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
grpc, java, python
领域
authentication, backend-api-design, networking, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
需要澄清
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。