Don't leak open connections when the TLS handshake fails

[coekie]

Context: Our client is setup to keep retrying to connect to our neo4j server. When the client could not validate the certificate of the server, this leak caused it to take up all available tcp connections.

Example stacktrace of an exception where the connection was leaked:

Caused by: org.neo4j.driver.v1.exceptions.SecurityException: Failed to establish secured connection with the server: General SSLEngine problem
	at org.neo4j.driver.internal.security.TLSSocketChannel.create(TLSSocketChannel.java:85)
	at org.neo4j.driver.internal.security.TLSSocketChannel.create(TLSSocketChannel.java:73)
	at org.neo4j.driver.internal.net.ChannelFactory.create(ChannelFactory.java:47)
	at org.neo4j.driver.internal.net.SocketClient.start(SocketClient.java:124)
	at org.neo4j.driver.internal.net.SocketConnection.startSocketClient(SocketConnection.java:89)
	at org.neo4j.driver.internal.net.SocketConnection.<init>(SocketConnection.java:64)
	at org.neo4j.driver.internal.net.SocketConnector.createConnection(SocketConnector.java:77)
	at org.neo4j.driver.internal.net.SocketConnector.connect(SocketConnector.java:50)
       ...
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
	at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1478)
	at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
	at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1214)
	at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1186)
	at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469)
	at org.neo4j.driver.internal.security.TLSSocketChannel.wrap(TLSSocketChannel.java:319)
	at org.neo4j.driver.internal.security.TLSSocketChannel.runHandshake(TLSSocketChannel.java:136)
	at org.neo4j.driver.internal.security.TLSSocketChannel.create(TLSSocketChannel.java:81)
        ...

[lutovich]

Hi @coekie,

Thanks for this fix! Changes look good to me.

To be able to merge them we will need a signed CLA from you.
See http://neo4j.com/developer/cla/ for further information.
Additional information on contributing code is found at
http://neo4j.com/developer/contributing-code/

Build is red because of missing CLA.

[zhenlineo]

@coekie I did not find any CLA from you. Would you update us when you have sent a signed CLA?

[coekie]

@zhenlineo sorry that took a bit, had to get it checked by the legal team here first. I just sent the CLA acceptance email.

[lutovich]

@coekie thanks a lot for this fix!

[lutovich]

@coekie your fix has been released in version 1.4.2 which should now be available on maven central. Thanks again.