Skip to content

Fix PU plaintext detection when AuthPolicy.NONE is configured#16374

Merged
zrlw merged 1 commit into
apache:3.3from
uuuyuqi:agent/fix-pu-auth-policy-none-plaintext
Jul 10, 2026
Merged

Fix PU plaintext detection when AuthPolicy.NONE is configured#16374
zrlw merged 1 commit into
apache:3.3from
uuuyuqi:agent/fix-pu-auth-policy-none-plaintext

Conversation

@uuuyuqi

@uuuyuqi uuuyuqi commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

What is the purpose of the change?

GitHub_issue: #16373

Fixes #16373

This pull request fixes port-unification protocol detection when provider TLS is configured with AuthPolicy.NONE.

AuthPolicy.NONE means TLS is optional. If a client sends a non-TLS first packet to the port-unification port, the server should continue with plaintext protocol detection. The current 3.3 branch enters the TLS-detection branch, sees that the packet is not TLS, and then does nothing when the auth policy is NONE. As a result, plaintext Dubbo detection is skipped and the connection waits until the caller times out.

The fix keeps the existing strict-TLS behavior unchanged:

  • TLS first packet: enable SSL and return.
  • Non-TLS first packet with required TLS: log, discard data, close the channel, and return.
  • Non-TLS first packet with AuthPolicy.NONE: fall through to plaintext detectProtocol(...).

This PR also adds a regression test that provides an optional-TLS test CertProvider, sends a Dubbo plaintext first packet, and verifies that the plaintext protocol detector is invoked.

Verification:

  • Before the production fix, the new regression test failed because the detector count was 0 instead of 1.
  • mvn -q -pl dubbo-remoting/dubbo-remoting-netty4 -am -Dtest=NettyPortUnificationServerHandlerTest,PortUnificationServerTest,SslServerTlsHandlerTest -Dsurefire.failIfNoSpecifiedTests=false -DskipITs -DskipIntegrationTests=true -Djacoco.skip=true test
  • mvn -q -pl dubbo-remoting/dubbo-remoting-netty4 -am -DskipTests -DskipIntegrationTests=true -Djacoco.skip=true -Dcheckstyle.skip=false -Dcheckstyle_unix.skip=false -Drat.skip=false verify
  • mvn -q -pl dubbo-remoting/dubbo-remoting-netty4 -am spotless:check

Checklist

  • Make sure there is a GitHub_issue field for the change (usually before the description, using GitHub_issue: #123456).
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Write necessary unit-test to verify your logic correction, more mock a little better when cross module dependency exists. If the new feature or significant change is added, please remember to add integration-test in dubbo-samples project.
  • Make sure gitHub actions can pass, only after CI passed will we review it.

Change-Id: Ic201a42623151d99369a2692b8e8206a2b281007
@uuuyuqi uuuyuqi marked this pull request as ready for review July 9, 2026 03:08
@codecov-commenter

codecov-commenter commented Jul 9, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 9.09091% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.86%. Comparing base (316df8e) to head (a4ffa53).
⚠️ Report is 1 commits behind head on 3.3.

Files with missing lines Patch % Lines
...port/netty4/NettyPortUnificationServerHandler.java 9.09% 9 Missing and 1 partial ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##                3.3   #16374      +/-   ##
============================================
- Coverage     60.87%   60.86%   -0.01%     
+ Complexity    11767    11763       -4     
============================================
  Files          1953     1953              
  Lines         89260    89262       +2     
  Branches      13471    13471              
============================================
- Hits          54334    54333       -1     
+ Misses        29342    29337       -5     
- Partials       5584     5592       +8     
Flag Coverage Δ
integration-tests-java21 32.09% <9.09%> (+<0.01%) ⬆️
integration-tests-java8 32.19% <9.09%> (-0.02%) ⬇️
samples-tests-java21 32.11% <0.00%> (-0.09%) ⬇️
samples-tests-java8 29.81% <0.00%> (+0.07%) ⬆️
unit-tests-java11 59.14% <9.09%> (+0.04%) ⬆️
unit-tests-java17 58.58% <9.09%> (-0.01%) ⬇️
unit-tests-java21 58.61% <9.09%> (+0.01%) ⬆️
unit-tests-java25 58.54% <9.09%> (+0.02%) ⬆️
unit-tests-java8 59.16% <9.09%> (+0.05%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@CrazyHZM CrazyHZM left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@zrlw zrlw left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@zrlw zrlw merged commit c91027d into apache:3.3 Jul 10, 2026
32 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Port unification skips plaintext detection when AuthPolicy.NONE is configured

4 participants