Package org.apache.zookeeper.server.quorum

Class UnifiedServerSocket.UnifiedSocket

  • All Implemented Interfaces:
    Closeable, AutoCloseable
    Enclosing class:
    UnifiedServerSocket
    public static class UnifiedServerSocket.UnifiedSocket
extends Socket
    The result of calling accept() on a UnifiedServerSocket. This is a Socket that doesn't know if it's using plaintext or SSL/TLS at the time when it is created. Calling a method that indicates a desire to read or write from the socket will cause the socket to detect if the connected client is attempting to establish a TLS or plaintext connection. This is done by doing a blocking read of 5 bytes off the socket and checking if the bytes look like the start of a TLS ClientHello message. If it looks like the client is attempting to connect with TLS, the internal socket is upgraded to a SSLSocket. If not, any bytes read from the socket are pushed back to the input stream, and the socket continues to be treated as a plaintext socket. The methods that trigger this behavior are: Calling other socket methods (i.e option setters such as Socket.setTcpNoDelay(boolean)) does not trigger mode detection. Because detecting the mode is a potentially blocking operation, it should not be done in the accepting thread. Attempting to read from or write to the socket in the accepting thread opens the caller up to a denial-of-service attack, in which a client connects and then does nothing. This would prevent any other clients from connecting. Passing the socket returned by accept() to a separate thread which handles all read and write operations protects against this DoS attack. Callers can check if the socket has been upgraded to TLS by calling isSecureSocket(), and can get the underlying SSLSocket by calling getSslSocket().