search

twitter / finagle

A fault tolerant, protocol-agnostic RPC system
https://twitter.github.io/finagle
Apache License 2.0
8.78k stars 1.45k forks source link

Unexpected Netty TLS 1.3 warnings #933

Closed andyrobinson closed 2 years ago

andyrobinson commented 2 years ago

Describe the bug When making an HTTP client request to an external service (Apple News), we see the following warning in the logs:

ReferenceCountedOpenSslContext BoringSSL doesn't allow to enable or disable TLSv1.3 ciphers explicitly. Provided TLSv1.3 ciphers: 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384', default TLSv1.3 ciphers that will be used: 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'. To Reproduce Steps to reproduce the behavior: We are using the Finagle Http client (com.twitter.finagle.Http) to make the request. We are using Http.client.withTransport.tls to build the client and specifying the requestTimeout and noFailFast.

Expected behavior We would not expect to see warnings in the logs

Screenshots Not applicable

Environment Finatra version 22.1.0 Finagle version 22.1.0

Additional context The error message originate from this Netty library class: https://github.com/netty/netty/blob/4.1/handler/src/main/java/io/netty/handler/ssl/OpenSsl.java

bryce-anderson commented 2 years ago

This should be fixed as of 9c6898efbc885629b0a6b073c9ab39910473ccf8 which is part of the 22.2.0 release. If it's still a problem please feel free to reopen.