Repository navigation
[bugfix] apply the configured timeout to SSL certificate collection - #4492
Open
SiriusTL666 wants to merge 1 commit into
Open
SiriusTL666 wants to merge 1 commit into
SiriusTL666 wants to merge 1 commit into
Conversation
SslCertificateCollectImpl called HttpsURLConnection.connect() without setting connect or read timeouts, so collecting a certificate from a blackholed or silently dropping peer blocked until the OS-level TCP timeout. In the test below that is 21 seconds, and in the field it can be minutes; meanwhile the collection task occupies a worker and the monitor shows NO DATA. - Apply HttpProtocol.timeout (default 10s) to both setConnectTimeout and setReadTimeout. - Expose an optional timeout parameter in app-ssl_cert.yml. - Add collectHonoursConfiguredTimeout, which points at TEST-NET-1 (RFC 5737) and asserts the call returns well inside the timeout. Verified to fail without the fix (21086ms) and pass with it (~1.7s).
3 of 4 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's changed?
SslCertificateCollectImplopened anHttpsURLConnectionand calledconnect()without setting any connect or read timeout. When the peer blackholes the TLS handshake — a firewalled host, a dead load balancer, a silently dropping middlebox — the call blocks until the OS-level TCP timeout, which is minutes rather than seconds. The collection task holds its worker for that whole time while the monitor shows NO DATA, and this is one of the ways a "no data" state stays stuck far longer than the configured collection interval.Changes
HttpProtocol.timeouttosetConnectTimeoutandsetReadTimeout, defaulting to 10s when unset.app-ssl_cert.ymlpreviously exposed host, port, verify and uri only. It now has an optionaltimeoutparameter (range 1000–120000 ms, default 10000), wired into thessl_certprotocol block.collectHonoursConfiguredTimeoutpoints the collector at TEST-NET-1 (192.0.2.1, reserved by RFC 5737 and unroutable) with an 800ms timeout and asserts the call returns well inside it and reports a failure rather than rows.Verification
The new test is a genuine regression test — I confirmed both directions:
setConnectTimeout/setReadTimeoutmvn -pl hertzbeat-collector/hertzbeat-collector-basic test -Dtest=SslCertificateCollectImplTest— 3/3 pass.checkstyle:checkon the module — 0 violations.The two pre-existing tests in this class (self-signed cert with a mismatched SAN, both verify on and off) still pass, so the change does not alter certificate parsing.
Checklist
No related issue exists for this one — I found it while auditing the collector modules for unbounded network waits. Happy to file an issue first if the project prefers that; let me know.
Add or update API
No HTTP API change. The
timeoutmonitor parameter is optional and defaults to 10s.