feat(aws-crt-client): add tlsNegotiationTimeout configuration (#7075)

* feat(aws-crt-client): add tlsNegotiationTimeout configuration

Add tlsNegotiationTimeout(Duration) to AwsCrtAsyncHttpClient.Builder
and AwsCrtHttpClient.Builder, mirroring the Netty client. Configures
the maximum TLS handshake duration (CLIENT HELLO through key
exchange). Defaults to 10 seconds, matching the underlying CRT
runtime's native default (AWS_DEFAULT_TLS_TIMEOUT_MS).

* Fix tests

* fix(aws-crt-client): set SNI server name on TLS conn options

All HTTPS requests via AwsCrtHttpClient and AwsCrtAsyncHttpClient on
Linux (s2n-tls) failed with AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE.
Switching the connection pool from withTlsContext(tlsContext) to
withTlsConnectionOptions(tlsConnectionOptions) dropped the SNI server
name: the native connection manager only auto-derives server_name from
the URI on the tls_ctx path, not on the tls_connection_options path.
s2n then validated the peer certificate against a null hostname and
rejected the handshake.

Build the TlsConnectionOptions per pool from the pool's URI host so
SNI and x509 hostname verification succeed.

Author: zoewangg

.changes/next-release/feature-AWSCommonRuntimeHTTPClient-a093e97.json

@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "AWS Common Runtime HTTP Client",
+    "contributor": "",
+    "description": "Added tlsNegotiationTimeout(Duration) configuration to AwsCrtAsyncHttpClient and AwsCrtHttpClient builders, mirroring the option on the Netty client. Configures the maximum amount of time a TLS handshake may take, from CLIENT HELLO through key exchange. Defaults to 10 seconds, matching the underlying CRT runtime's native default."
+}

http-clients/aws-crt-client/src/main/java/software/amazon/awssdk/http/crt/AwsCrtAsyncHttpClient.java

@@ -194,6 +194,17 @@ AwsCrtAsyncHttpClient.Builder connectionHealthConfiguration(Consumer<ConnectionH
          */
         AwsCrtAsyncHttpClient.Builder connectionAcquisitionTimeout(Duration connectionAcquisitionTimeout);
 
+        /**
+         * Configure the maximum amount of time that a TLS handshake is allowed to take from the time the CLIENT HELLO
+         * message is sent to the time the client and server have fully negotiated ciphers and exchanged keys.
+         *
+         * <p>By default, it's 10 seconds.
+         *
+         * @param tlsNegotiationTimeout the timeout duration; must be positive
+         * @return this builder for method chaining.
+         */
+        AwsCrtAsyncHttpClient.Builder tlsNegotiationTimeout(Duration tlsNegotiationTimeout);
+
         /**
          * Configure whether to enable {@code tcpKeepAlive} and relevant configuration for all connections established by this
          * client.
@@ -267,13 +278,15 @@ public Builder protocol(Protocol protocol) {
         @Override
         public SdkAsyncHttpClient build() {
             return new AwsCrtAsyncHttpClient(this, getAttributeMap().build()
+                                                                      .merge(AwsCrtHttpClientBase.AWS_CRT_HTTP_DEFAULTS)
                                                                       .merge(SdkHttpConfigurationOption.GLOBAL_HTTP_DEFAULTS));
         }
 
         @Override
         public SdkAsyncHttpClient buildWithDefaults(AttributeMap serviceDefaults) {
             return new AwsCrtAsyncHttpClient(this, getAttributeMap().build()
                                                                     .merge(serviceDefaults)
+                                                                    .merge(AwsCrtHttpClientBase.AWS_CRT_HTTP_DEFAULTS)
                                                                     .merge(SdkHttpConfigurationOption.GLOBAL_HTTP_DEFAULTS));
         }
 

http-clients/aws-crt-client/src/main/java/software/amazon/awssdk/http/crt/AwsCrtHttpClient.java

@@ -246,6 +246,17 @@ AwsCrtHttpClient.Builder connectionHealthConfiguration(Consumer<ConnectionHealth
          */
         AwsCrtHttpClient.Builder connectionAcquisitionTimeout(Duration connectionAcquisitionTimeout);
 
+        /**
+         * Configure the maximum amount of time that a TLS handshake is allowed to take from the time the CLIENT HELLO
+         * message is sent to the time the client and server have fully negotiated ciphers and exchanged keys.
+         *
+         * <p>By default, it's 10 seconds.
+         *
+         * @param tlsNegotiationTimeout the timeout duration; must be positive
+         * @return this builder for method chaining.
+         */
+        AwsCrtHttpClient.Builder tlsNegotiationTimeout(Duration tlsNegotiationTimeout);
+
         /**
          * Configure whether to enable {@code tcpKeepAlive} and relevant configuration for all connections established by this
          * client.
@@ -305,13 +316,15 @@ private static final class DefaultBuilder
         @Override
         public AwsCrtHttpClient build() {
             return new AwsCrtHttpClient(this, getAttributeMap().build()
+                                                         .merge(AwsCrtHttpClientBase.AWS_CRT_HTTP_DEFAULTS)
                                                          .merge(SdkHttpConfigurationOption.GLOBAL_HTTP_DEFAULTS));
         }
 
         @Override
         public AwsCrtHttpClient buildWithDefaults(AttributeMap serviceDefaults) {
             return new AwsCrtHttpClient(this, getAttributeMap().build()
                                                          .merge(serviceDefaults)
+                                                         .merge(AwsCrtHttpClientBase.AWS_CRT_HTTP_DEFAULTS)
                                                          .merge(SdkHttpConfigurationOption.GLOBAL_HTTP_DEFAULTS));
         }
     }

http-clients/aws-crt-client/src/main/java/software/amazon/awssdk/http/crt/AwsCrtHttpClientBase.java

@@ -19,14 +19,17 @@
 import static software.amazon.awssdk.crtcore.CrtConfigurationUtils.resolveProxy;
 import static software.amazon.awssdk.http.SdkHttpConfigurationOption.PROTOCOL;
 import static software.amazon.awssdk.http.crt.internal.AwsCrtConfigurationUtils.buildSocketOptions;
+import static software.amazon.awssdk.http.crt.internal.AwsCrtConfigurationUtils.buildTlsConnectionOptions;
 import static software.amazon.awssdk.http.crt.internal.AwsCrtConfigurationUtils.resolveCipherPreference;
 import static software.amazon.awssdk.utils.FunctionalUtils.invokeSafely;
 
 import java.net.URI;
+import java.time.Duration;
 import java.util.LinkedList;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import software.amazon.awssdk.annotations.SdkProtectedApi;
+import software.amazon.awssdk.annotations.SdkTestInternalApi;
 import software.amazon.awssdk.crt.CrtResource;
 import software.amazon.awssdk.crt.http.Http2StreamManagerOptions;
 import software.amazon.awssdk.crt.http.HttpClientConnectionManagerOptions;
@@ -37,6 +40,7 @@
 import software.amazon.awssdk.crt.http.HttpVersion;
 import software.amazon.awssdk.crt.io.ClientBootstrap;
 import software.amazon.awssdk.crt.io.SocketOptions;
+import software.amazon.awssdk.crt.io.TlsConnectionOptions;
 import software.amazon.awssdk.crt.io.TlsContext;
 import software.amazon.awssdk.crt.io.TlsContextOptions;
 import software.amazon.awssdk.http.Protocol;
@@ -54,6 +58,14 @@
  */
 @SdkProtectedApi
 abstract class AwsCrtHttpClientBase implements SdkAutoCloseable {
+    // TLS_NEGOTIATION_TIMEOUT diverges from the SDK global default (5s) for backwards compatibility:
+    // the underlying CRT has always applied a 10s handshake timeout, so adopting the 5s global would silently tighten the
+    // effective handshake timeout for existing CRT customers.
+    static final AttributeMap AWS_CRT_HTTP_DEFAULTS =
+        AttributeMap.builder()
+                    .put(SdkHttpConfigurationOption.TLS_NEGOTIATION_TIMEOUT, Duration.ofSeconds(10))
+                    .build();
+
     private static final Logger log = Logger.loggerFor(AwsCrtHttpClientBase.class);
 
     private static final String AWS_COMMON_RUNTIME = "AwsCommonRuntime";
@@ -72,6 +84,7 @@ abstract class AwsCrtHttpClientBase implements SdkAutoCloseable {
     private final int maxStreamsPerEndpoint;
     private final long connectionAcquisitionTimeout;
     private final TlsContextOptions tlsContextOptions;
+    private final Duration tlsNegotiationTimeout;
     private boolean isClosed = false;
 
     AwsCrtHttpClientBase(AwsCrtClientBuilderBase builder, AttributeMap config) {
@@ -93,6 +106,7 @@ abstract class AwsCrtHttpClientBase implements SdkAutoCloseable {
         this.bootstrap = registerOwnedResource(clientBootstrap);
         this.socketOptions = registerOwnedResource(clientSocketOptions);
         this.tlsContext = registerOwnedResource(clientTlsContext);
+        this.tlsNegotiationTimeout = config.get(SdkHttpConfigurationOption.TLS_NEGOTIATION_TIMEOUT);
         this.readBufferSize = builder.getReadBufferSizeInBytes() == null ?
                               DEFAULT_STREAM_WINDOW_SIZE : builder.getReadBufferSizeInBytes();
         this.maxStreamsPerEndpoint = config.get(SdkHttpConfigurationOption.MAX_CONNECTIONS);
@@ -122,18 +136,27 @@ String clientName() {
         return AWS_COMMON_RUNTIME;
     }
 
+    @SdkTestInternalApi
+    Duration resolvedTlsNegotiationTimeout() {
+        return tlsNegotiationTimeout;
+    }
+
     private HttpStreamManager createConnectionPool(URI uri) {
         log.debug(() ->
                       String.format("Creating ConnectionPool for: URI:%s, MaxConns: %d, MaxStreams: %d",
                                     uri, maxStreamsPerEndpoint, maxStreamsPerEndpoint));
 
         boolean isHttps = "https".equalsIgnoreCase(uri.getScheme());
-        TlsContext poolTlsContext = isHttps ? tlsContext : null;
+        TlsConnectionOptions poolTlsConnectionOptions = null;
+        if (isHttps) {
+            poolTlsConnectionOptions = registerOwnedResource(
+                buildTlsConnectionOptions(tlsContext, tlsNegotiationTimeout, uri.getHost()));
+        }
 
         HttpClientConnectionManagerOptions h1Options = new HttpClientConnectionManagerOptions()
                 .withClientBootstrap(bootstrap)
                 .withSocketOptions(socketOptions)
-                .withTlsContext(poolTlsContext)
+                .withTlsConnectionOptions(poolTlsConnectionOptions)
                 .withUri(uri)
                 .withWindowSize(readBufferSize)
                 .withMaxConnections(maxStreamsPerEndpoint)

http-clients/aws-crt-client/src/main/java/software/amazon/awssdk/http/crt/internal/AwsCrtClientBuilderBase.java

@@ -106,6 +106,16 @@ public BuilderT connectionAcquisitionTimeout(Duration connectionAcquisitionTimeo
         return thisBuilder();
     }
 
+    public BuilderT tlsNegotiationTimeout(Duration tlsNegotiationTimeout) {
+        Validate.isPositive(tlsNegotiationTimeout, "tlsNegotiationTimeout");
+        standardOptions.put(SdkHttpConfigurationOption.TLS_NEGOTIATION_TIMEOUT, tlsNegotiationTimeout);
+        return thisBuilder();
+    }
+
+    public void setTlsNegotiationTimeout(Duration tlsNegotiationTimeout) {
+        tlsNegotiationTimeout(tlsNegotiationTimeout);
+    }
+
     public BuilderT tcpKeepAliveConfiguration(TcpKeepAliveConfiguration tcpKeepAliveConfiguration) {
         this.tcpKeepAliveConfiguration = tcpKeepAliveConfiguration;
         return thisBuilder();

http-clients/aws-crt-client/src/main/java/software/amazon/awssdk/http/crt/internal/AwsCrtConfigurationUtils.java

@@ -20,6 +20,8 @@
 import software.amazon.awssdk.annotations.SdkInternalApi;
 import software.amazon.awssdk.crt.io.SocketOptions;
 import software.amazon.awssdk.crt.io.TlsCipherPreference;
+import software.amazon.awssdk.crt.io.TlsConnectionOptions;
+import software.amazon.awssdk.crt.io.TlsContext;
 import software.amazon.awssdk.http.crt.TcpKeepAliveConfiguration;
 import software.amazon.awssdk.utils.Logger;
 import software.amazon.awssdk.utils.NumericUtils;
@@ -53,6 +55,18 @@ public static SocketOptions buildSocketOptions(TcpKeepAliveConfiguration tcpKeep
         return clientSocketOptions;
     }
 
+    public static TlsConnectionOptions buildTlsConnectionOptions(TlsContext tlsContext, Duration tlsNegotiationTimeout,
+                                                                 String serverName) {
+        TlsConnectionOptions tlsConnectionOptions = new TlsConnectionOptions(tlsContext);
+        if (tlsNegotiationTimeout != null) {
+            tlsConnectionOptions.withTimeoutMs(NumericUtils.saturatedCast(tlsNegotiationTimeout.toMillis()));
+        }
+        if (serverName != null) {
+            tlsConnectionOptions.withServerName(serverName);
+        }
+        return tlsConnectionOptions;
+    }
+
     public static TlsCipherPreference resolveCipherPreference(Boolean postQuantumTlsEnabled) {
         // As of v0.39.3, aws-crt-java prefers PQ by default, so only return the non-PQ-default policy
         // below if the caller explicitly disables PQ by passing in false.

http-clients/aws-crt-client/src/test/java/software/amazon/awssdk/http/crt/AwsCrtAsyncHttpClientTest.java

@@ -0,0 +1,69 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+package software.amazon.awssdk.http.crt;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.time.Duration;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import software.amazon.awssdk.http.SdkHttpConfigurationOption;
+import software.amazon.awssdk.http.async.SdkAsyncHttpClient;
+import software.amazon.awssdk.utils.AttributeMap;
+
+class AwsCrtAsyncHttpClientTest extends AwsCrtHttpClientTestBase {
+
+    @ParameterizedTest(name = "{0}")
+    @MethodSource("invalidTlsNegotiationTimeouts")
+    void tlsNegotiationTimeout_invalidDuration_shouldThrowException(String description, Duration input,
+                                                                    String expectedMessageFragment) {
+        assertThatThrownBy(() -> AwsCrtAsyncHttpClient.builder().tlsNegotiationTimeout(input).build())
+            .isInstanceOf(IllegalArgumentException.class)
+            .hasMessageContaining(expectedMessageFragment);
+    }
+
+    @ParameterizedTest(name = "[async] {0}")
+    @MethodSource("resolutionMatrix")
+    void asyncBuilder_resolvedTlsNegotiationTimeout_matchesPathBPrecedence(String description, Duration customer,
+                                                                           Duration serviceDefault, Duration expected) {
+        AwsCrtAsyncHttpClient.Builder builder = AwsCrtAsyncHttpClient.builder();
+        if (customer != null) {
+            builder.tlsNegotiationTimeout(customer);
+        }
+
+        try (SdkAsyncHttpClient client = buildAsync(builder, serviceDefault)) {
+            assertThat(((AwsCrtAsyncHttpClient) client).resolvedTlsNegotiationTimeout()).isEqualTo(expected);
+        }
+    }
+
+    @Test
+    void asyncBuilder_buildWithDefaults_serviceDefaultsLacksTlsNegotiationTimeout_resolvesToCrtDefault10s() {
+        try (SdkAsyncHttpClient client = AwsCrtAsyncHttpClient.builder().buildWithDefaults(AttributeMap.empty())) {
+            assertThat(((AwsCrtAsyncHttpClient) client).resolvedTlsNegotiationTimeout()).isEqualTo(CRT_DEFAULT);
+        }
+    }
+
+    private static SdkAsyncHttpClient buildAsync(AwsCrtAsyncHttpClient.Builder builder, Duration serviceDefault) {
+        return serviceDefault == null
+               ? builder.build()
+               : builder.buildWithDefaults(serviceDefaultsMap(serviceDefault));
+    }
+
+}

http-clients/aws-crt-client/src/test/java/software/amazon/awssdk/http/crt/AwsCrtAsyncHttpClientWireMockTest.java

@@ -29,6 +29,7 @@
 
 import com.github.tomakehurst.wiremock.junit.WireMockRule;
 import java.net.URI;
+import java.time.Duration;
 import java.util.concurrent.TimeUnit;
 import org.junit.AfterClass;
 import org.junit.BeforeClass;
@@ -39,6 +40,7 @@
 import software.amazon.awssdk.http.HttpMetric;
 import software.amazon.awssdk.http.Protocol;
 import software.amazon.awssdk.http.RecordingResponseHandler;
+import software.amazon.awssdk.http.SdkHttpConfigurationOption;
 import software.amazon.awssdk.http.SdkHttpRequest;
 import software.amazon.awssdk.http.async.AsyncExecuteRequest;
 import software.amazon.awssdk.http.async.SdkAsyncHttpClient;
@@ -48,7 +50,8 @@
 public class AwsCrtAsyncHttpClientWireMockTest {
     @Rule
     public WireMockRule mockServer = new WireMockRule(wireMockConfig()
-                                                          .dynamicPort());
+                                                          .dynamicPort()
+                                                          .dynamicHttpsPort());
 
     @BeforeClass
     public static void setup() {
@@ -90,6 +93,31 @@ public void sharedEventLoopGroup_closeOneClient_shouldNotAffectOtherClients() th
         }
     }
 
+    @Test
+    public void tlsNegotiationTimeout_customValue_clientStartsSuccessfully() throws Exception {
+        AttributeMap defaults = AttributeMap.builder().put(SdkHttpConfigurationOption.TRUST_ALL_CERTIFICATES, true).build();
+        try (SdkAsyncHttpClient client = AwsCrtAsyncHttpClient.builder()
+                                                              .tlsNegotiationTimeout(Duration.ofSeconds(3))
+                                                              .buildWithDefaults(defaults)) {
+            makeSimpleHttpsRequest(client);
+        }
+    }
+
+    private RecordingResponseHandler makeSimpleHttpsRequest(SdkAsyncHttpClient client) throws Exception {
+        String body = randomAlphabetic(10);
+        URI uri = URI.create("https://localhost:" + mockServer.httpsPort());
+        stubFor(any(urlPathEqualTo("/")).willReturn(aResponse().withBody(body)));
+        SdkHttpRequest request = createRequest(uri);
+        RecordingResponseHandler recorder = new RecordingResponseHandler();
+        client.execute(AsyncExecuteRequest.builder()
+                                          .request(request)
+                                          .requestContentPublisher(createProvider(""))
+                                          .responseHandler(recorder)
+                                          .build());
+        recorder.completeFuture().get(5, TimeUnit.SECONDS);
+        return recorder;
+    }
+
     /**
      * Make a simple async request and wait for it to finish.
      *