Skip to content

fix: Preserve error cause in CRT http client TLS and socket timeout failures#7157

Merged
joviegas merged 6 commits into
masterfrom
joviegas/tls-ssl-cause-preserve
Jul 18, 2026
Merged

fix: Preserve error cause in CRT http client TLS and socket timeout failures#7157
joviegas merged 6 commits into
masterfrom
joviegas/tls-ssl-cause-preserve

Conversation

@joviegas

Copy link
Copy Markdown
Contributor

Motivation and Context

The CRT HTTP client translates native TLS negotiation failures (CRT error code 1029)
into SSLHandshakeException and socket timeouts during connection acquisition
(CRT error code 1048) into ConnectException. Both translations build the new
exception from the message string alone and discard the underlying CRT
HttpException, so getCause() returns null and the CRT error code is lost.

Without a cause chain, callers cannot classify a TLS failure as transient
(connection interrupted during the handshake) or persistent (certificate
validation failure), and cannot write retry predicates that target one case
and not the other. The Apache, Netty, and UrlConnection clients preserve the
full cause chain for the same failure. This change fixes the CRT client to
match that behavior.

Modifications

  • CrtUtils.wrapCrtException: chain the original HttpException via
    initCause in the SSLHandshakeException branch (error code 1029) and the
    ConnectException branch (error code 1048). Exception types and messages
    are unchanged, so existing callers that match on type are unaffected.
  • CrtUtilsTest: add two tests asserting that each wrapped exception carries
    the HttpException as its cause.
  • CrtRequestExecutorTest and CrtAsyncRequestExecutorTest: extend
    execute_httpException_mapsToCorrectException with hasRootCause(exception)
    assertions.
  • SdkHttpClientSslHandshakeBehaviorTestSuite (new, in test/http-client-tests):
    shared suite that runs an HTTPS server with a self-signed certificate and
    asserts that the handshake failure surfaces as SSLHandshakeException with a
    non-null cause. Reusable by every SdkHttpClient implementation.
  • CrtSslHandshakeBehaviorTest (aws-crt-client) and
    ApacheSslHandshakeBehaviorTest (apache-client): wire the new suite into
    both clients. The CRT test fails without the CrtUtils fix and passes with it.

Testing

  • Added Test suite to tess all Http client

Screenshots (if appropriate)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)

License

  • I confirm that this pull request can be released under the Apache 2 license

@joviegas
joviegas requested a review from a team as a code owner July 16, 2026 19:31
@joviegas
joviegas force-pushed the joviegas/tls-ssl-cause-preserve branch from c5d7ec2 to 93ce8b0 Compare July 16, 2026 23:04
<!-- Shared HTTP client test suites live in src/main/java so client modules can consume them;
allow test-style underscore method names. -->
<suppress checks="MethodName"
files=".*[\\/]http-client-tests[\\/]src[\\/]main[\\/]java[\\/].*Test.*\.java$"/>

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tiny nit on the file name here - I think .*Test.* may be too permissive - I'd lean towards making it .*Test\.java$ to enforce the name ends with Test and we don't pick up a class name that just happens to have "Test" in it.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Edit: nvm, I see the files are TestSuite. I think we should still enforce the ending, but maybe must be either *Test.java or *TestSuite.java

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Valid point, will make it *TestSuite.java
I think we should not add it for generic *Test.java since these classes should go in tst/ folder and not in main src.

@joviegas
joviegas enabled auto-merge July 17, 2026 17:48
@joviegas
joviegas disabled auto-merge July 18, 2026 17:30
@joviegas
joviegas enabled auto-merge July 18, 2026 17:30
@joviegas
joviegas added this pull request to the merge queue Jul 18, 2026
Merged via the queue into master with commit d80e37d Jul 18, 2026
12 of 13 checks passed
@github-actions

Copy link
Copy Markdown

This pull request has been closed and the conversation has been locked. Comments on closed PRs are hard for our team to see. If you need more assistance, please open a new issue that references this one.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Jul 18, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants