GEODE-10556: Fix SSL handshake failure in PulseSecurityWithSSLTest when JmxManagerBindAddress is empty#7984
Open
JinwooHwang wants to merge 1 commit intoapache:developfrom
Open
Conversation
209deba to
3e92b5c
Compare
f993be5 to
0b2beea
Compare
0b2beea to
3b21ac6
Compare
c1e3008 to
b0b2dab
Compare
ae2abd6 to
52fe473
Compare
52fe473 to
affba70
Compare
2dd8907 to
295cd4c
Compare
…ess is empty When JmxManagerBindAddress is not configured (empty string, meaning bind all interfaces), ManagementAgent was setting the pulse.host system property to the empty string. On Linux/Docker, an empty host in the JMX service URL resolves to InetAddress.getLocalHost(), which returns the container bridge IP (e.g. 172.17.0.2) rather than 127.0.0.1. The embedded test keystore (trusted.keystore) only contains IPAddress:127.0.0.1 as a Subject Alternative Name. The SSL handshake between Pulse JMXDataUpdater and the JMX connector server therefore failed: SSLHandshakeException: No subject alternative names matching IP address 172.17.0.2 found This caused PulseSecurityWithSSLTest to consistently fail on CI (Ubuntu, Liberica JDK 17, Docker) with BAD_CREDS while passing locally on macOS with Zulu JDK 17 (where getLocalHost() returns 127.0.0.1). Fix: when JmxManagerBindAddress is empty, pass localhost as the pulse.host property so JMXDataUpdater connects to 127.0.0.1, which is always covered by the certificate SAN.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
PulseSecurityWithSSLTestfailed on GitHub Actions with authentication errors (BAD_CREDS) despite using correct credentials. Tests consistently passed locally but failed in CI:SSLHandshakeException: No subject alternative names matching IP address 172.17.0.2 found
Root Cause: When JmxManagerBindAddress is not configured (empty string), ManagementAgent was setting pulse.host to an empty string:
System.setProperty(PULSE_HOST_PROP, "" + config.getJmxManagerBindAddress());
An empty host in the JMX service URL (service:jmx:rmi:///jndi/rmi://:PORT/jmxrmi) causes the JRE to resolve the host via InetAddress.getLocalHost(). On Linux, this returns the container's bridge IP address (e.g. 172.17.0.2) rather than 127.0.0.1.
The embedded trusted.keystore certificate has CN=localhost and a single SAN of IPAddress:127.0.0.1. When Pulse attempts the JMX-over-SSL connection to 172.17.0.2, the SSL handshake fails because that IP is not covered by the certificate.
This issue does not reproduce on macOS, where InetAddress.getLocalHost() typically returns 127.0.0.1.
Solution
In ManagementAgent.java, fall back to "localhost" when JmxManagerBindAddress is empty:
String jmxBindAddress = config.getJmxManagerBindAddress();
System.setProperty(PULSE_HOST_PROP,
jmxBindAddress.isEmpty() ? "localhost" : jmxBindAddress);
localhost resolves to 127.0.0.1, which matches the certificate's SAN, so the SSL handshake succeeds.
Testing
Impact
For all changes, please confirm:
develop)?gradlew buildrun cleanly?