Skip to content

GH-1271: [Flight] Reject port 0 in NettyClientBuilder #1282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ennuite wants to merge 4 commits into
base: main
Choose a base branch
from
Open

GH-1271: [Flight] Reject port 0 in NettyClientBuilder #1282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f1d0735
GH-1027: Reject port 0 in NettyClientBuilder and fix tests that omitt…
ennuite Aug 30, 2026
c28a347
GH-1027: Parameterize invalid port test to cover port 0
ennuite Aug 31, 2026
97ab8b2
Improve comment
ennuite Aug 31, 2026
cf52bd8
Update Javadoc and exception message as per review comment
ennuite Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion flight/flight-core/src/main/java/org/apache/arrow/flight/FlightClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -822,7 +822,13 @@ public Builder verifyServer(boolean verifyServer) {
return this;
}

/** Create the client from this builder. */
/**
* Create the client from this builder.
*
* @throws IllegalArgumentException if the location uses a TCP-based scheme ({@code grpc},
* {@code grpc+tcp}, {@code grpc+tls}) and the location contains no port, or a port outside
* the range [1, 65535].
*/
public FlightClient build() {
final NettyChannelBuilder channelBuilder = builder.build();
return new FlightClient(builder.allocator(), channelBuilder.build(), builder.middleware());
Expand Down
16 changes: 13 additions & 3 deletions flight/flight-core/src/main/java/org/apache/arrow/flight/grpc/NettyClientBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,13 @@ public NettyClientBuilder verifyServer(boolean verifyServer) {
return this;
}

/** Create the client from this builder. */
/**
* Create the client from this builder.
*
* @throws IllegalArgumentException if the URI uses a TCP-based scheme ({@code grpc}, {@code
* grpc+tcp}, {@code grpc+tls}) and the URI contains no port, or a port outside the range [1,
* 65535].
*/
public NettyChannelBuilder build() {
final NettyChannelBuilder builder;

Expand All @@ -140,9 +146,13 @@ public NettyChannelBuilder build() {
case LocationSchemes.GRPC_TLS:
{
final int port = location.getUri().getPort();
if (port < 0 || port > 65535) {
if (port == -1) {
throw new IllegalArgumentException(
"No port specified in location URI: " + location.getUri());
}
if (port < 1 || port > 65535) {

@jbonofre jbonofre Sep 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

URI.getPort() returns -1 to mean "no port present in the URI", not "the user asked for port -1".
Folding it into this range check produces Invalid port -1: must be between 1 and 65535 (a number that the user never defined).

That path is reachable: a Location like grpc+tls://myhost with no port, and also ArrowFlightSqlClientHandler.getStreams(), which does withPort(endpointUri.getPort()) on an endpoint URI that may carry no port.

Since this PR is rewriting the message anyway, this seems like the moment to split
the two cases:

if (port == -1) {
  throw new IllegalArgumentException(
      "No port specified in location URI: " + location.getUri());
}
if (port < 1 || port > 65535) {
  throw new IllegalArgumentException(
      "Invalid port " + port + ": must be between 1 and 65535.");
}

@ennuite ennuite Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

throw new IllegalArgumentException(
"Invalid port " + port + ": must be between 0 and 65535.");
"Invalid port " + port + ": must be between 1 and 65535.");

@jbonofre jbonofre Sep 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This narrows the accepted input range of published public API: NettyClientBuilder,
and transitively FlightClient.Builder. Third-party code that today calls FlightClient.builder(allocator, someLocation).build() with a port-0 location
(a server location captured before start(), or a placeholder resolved later) gets a lazily-failing channel today and an immediate IllegalArgumentException after this.

The change itself is right, but neither NettyClientBuilder.build() nor
FlightClient.Builder.build() documents the precondition.

Could we add an @throws IllegalArgumentException javadoc stating the accepted range, so callers can
discover it without hitting it in production?

@ennuite ennuite Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated the Javadoc for both methods: NettyClientBuilder.build() and FlightClient.Builder.build()

Thanks for the review!

}
builder = NettyChannelBuilder.forAddress(location.getUri().getHost(), port);
break;
Expand Down
1 change: 1 addition & 0 deletions ...ght-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ConnectionMutualTlsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,7 @@ public void testGetNonAuthenticatedEncryptedClientNoAuth() throws Exception {
try (ArrowFlightSqlClientHandler client =
new ArrowFlightSqlClientHandler.Builder()
.withHost(FLIGHT_SERVER_TEST_EXTENSION.getHost())
.withPort(FLIGHT_SERVER_TEST_EXTENSION.getPort())
.withTlsRootCertificates(tlsRootCertsPath)
.withClientCertificate(clientMTlsCertPath)
.withClientKey(clientMTlsKeyPath)
Expand Down
16 changes: 9 additions & 7 deletions flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ConnectionTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,8 @@
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.RegisterExtension;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.ValueSource;

/** Tests for {@link Connection}. */
public class ConnectionTest {
Expand Down Expand Up @@ -204,21 +206,20 @@ public void testGetBasicClientAuthenticatedShouldOpenConnection() throws Excepti
}

/**
* Checks if the exception IllegalArgumentException is thrown when trying to establish an
* unencrypted connection providing with an invalid port.
*
* @throws SQLException on error.
* Checks if a SQLException is thrown when trying to establish an unencrypted connection with an
* invalid port.
*/
@Test
public void testUnencryptedConnectionProvidingInvalidPort() throws Exception {
@ParameterizedTest
@ValueSource(ints = {0, -1, 65536, 65537})
public void testUnencryptedConnectionProvidingInvalidPort(int invalidPort) {
final Properties properties = new Properties();

properties.put(ArrowFlightConnectionProperty.HOST.camelName(), "localhost");
properties.put(ArrowFlightConnectionProperty.USER.camelName(), userTest);
properties.put(ArrowFlightConnectionProperty.PASSWORD.camelName(), passTest);
properties.put(ArrowFlightConnectionProperty.USE_ENCRYPTION.camelName(), false);
final String invalidUrl =
"jdbc:arrow-flight-sql://" + FLIGHT_SERVER_TEST_EXTENSION.getHost() + ":" + 65537;
"jdbc:arrow-flight-sql://" + FLIGHT_SERVER_TEST_EXTENSION.getHost() + ":" + invalidPort;

assertThrows(
SQLException.class,
Expand All @@ -240,6 +241,7 @@ public void testGetBasicClientNoAuthShouldOpenConnection() throws Exception {
try (ArrowFlightSqlClientHandler client =
new ArrowFlightSqlClientHandler.Builder()
.withHost(FLIGHT_SERVER_TEST_EXTENSION.getHost())
.withPort(FLIGHT_SERVER_TEST_EXTENSION.getPort())
.withBufferAllocator(allocator)
.withEncryption(false)
.build()) {
Expand Down
1 change: 1 addition & 0 deletions ...-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ConnectionTlsRootCertsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,7 @@ public void testGetNonAuthenticatedEncryptedClientNoAuth() throws Exception {
try (ArrowFlightSqlClientHandler client =
new ArrowFlightSqlClientHandler.Builder()
.withHost(FLIGHT_SERVER_TEST_EXTENSION.getHost())
.withPort(FLIGHT_SERVER_TEST_EXTENSION.getPort())
.withTlsRootCertificates(tlsRootCertsPath)
.withBufferAllocator(allocator)
.withEncryption(true)
Expand Down
1 change: 1 addition & 0 deletions ...ht/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ConnectionTlsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,6 +172,7 @@ public void testGetNonAuthenticatedEncryptedClientNoAuth() throws Exception {
try (ArrowFlightSqlClientHandler client =
new ArrowFlightSqlClientHandler.Builder()
.withHost(FLIGHT_SERVER_TEST_EXTENSION.getHost())
.withPort(FLIGHT_SERVER_TEST_EXTENSION.getPort())
.withSystemTrustStore(false)
.withTrustStorePath(trustStorePath)
.withTrustStorePassword(trustStorePass)
Expand Down