GH-577: Use JVM proxy settings in Netty client by ennuite · Pull Request #1027 · apache/arrow-java

ennuite · 2026-02-23T02:57:09Z

What's Changed

The Flight SQL JDBC driver ignored JVM proxy settings (-Dhttps.proxyHost, -Dhttps.proxyPort). Connections would always go directly to the target host, bypassing any configured proxy.

Switched to NettyChannelBuilder.forAddress(host, port) for the TCP-based schemes. This causes gRPC to go through ProxySelector, which picks up the standard JVM proxy properties.

Are these changes tested?

Yes.

Added a test to ConnectionTest that installs a recording ProxySelector as the JVM default, opens a JDBC connection, and asserts that ProxySelector.select() was called. This directly validates that the driver participates in JVM proxy detection without requiring a real proxy server.

This change was created with AI assistance (Claude Code). All lines were manually reviewed by a human. The output is not copyrightable subject matter.

Closes #577.

jbonofre · 2026-02-23T06:09:47Z

As I'm close to release Arrow Java 19.0.0, I will consider this PR for 20.0.0.

ennuite · 2026-02-23T14:17:21Z

@jbonofre yeah that makes sense, this one is still a draft as I have not finished work on it, I will ping you once I finish the PR. Should be ready in the next couple of days.

ennuite · 2026-05-14T03:32:16Z

While the fix was in the NettyClientBuilder, the bug report concerned the JDBC driver. Because of that, I targeted the test at the driver, ensuring that the whole connection creation flow did not bypass proxies.

Let me know if it's worth it to expand the testing surface with a unit test closer to the place of the bug fix.

lidavidm · 2026-08-25T00:00:50Z

Can we rebase? It seems CI did not trigger

lidavidm · 2026-08-26T01:23:43Z

It seems all workflows time out here, even after a retry.

ennuite · 2026-08-27T11:13:08Z

@lidavidm Thanks for the ping. I rebased all PRs.

ennuite · 2026-08-27T11:14:10Z

@lidavidm

It seems all workflows time out here, even after a retry.

Do you guys need help with the CI? I was going to look into some CI stuff on Arrow Go, but given that we have a release here I can jump in before I move to that.

Edit- I synced with JB and I saw that he is already on it. I'll continue with the protocol change implementation in other languages to have feature parity.

lidavidm · 2026-08-27T11:58:41Z

Well, other PRs are passing fine. Perhaps something in this PR may be related?

jbonofre · 2026-08-27T11:58:43Z

@ennuite @lidavidm I'm doing a new review on this one.

ennuite · 2026-08-27T15:37:12Z

@lidavidm you are right. @jbonofre the problem is in my code, it changes port validation and has the side effect of a bug in testUnencryptedConnectionProvidingInvalidPort.

I'm looking to fix this now.

ennuite · 2026-08-27T19:15:16Z

I tracked this down all the way to grpc-java and IMO the root cause is there, my change in this PR surfaced the problem.

The situation looks a bit involved. I can create some PRs in Arrow Java to gain some robustness over these lower level errors in time for this release, or we can leave this PR for a later release. I have no strong opinion either way, but I do have bandwidth to tackle at least one of these right now. If you are interested @lidavidm and @jbonofre let me know and I'll start work on this.

Improvements we could have in the JDBC driver:

Port validation in the JDBC driver in the path of DriverManager.getConnection(): we could validate that the port is numeric and in the range [1, 65535]. This would fix the problem in the test and allow this PR to be merged. It is also quite easy to do.
Liveness hardening on JDBC connection establishment: could honor the limits of DriverManager.setLoginTimeout(int) and properly implement DataSource.setLoginTimeout(int) and DataSource.getLoginTimeout(). This would not fix the bug in this test, but would allow users of the driver to have a way to prevent being blocked in the future by bugs that cause connection establishment to hang indefinitely.

Details about the root cause (no need to read this unless you're interested in the gRPC internals):

1- I changed the NettyChannelBuilder call from forAddress(SocketAddress) to forAddress(String, int). This allows us to respect JVM proxy settings and is the overload gRPC recommends for normal TCP channels.
2-An unintended side effect is that port validation moved from synchronous SocketAddress construction to asynchronous DNS resolution in a separate thread owned by gRPC.
3-If that asynchronous validation fails because of an invalid port, gRPC does not propagate the exception through the resolver listener. This causes testUnencryptedConnectionProvidingInvalidPort to hang indefinitely and CI to time out.

I will take this up with the gRPC folks and see if they agree that we need to propagate the exception there. In any case that will be too slow for this release.

lidavidm · 2026-08-28T01:22:02Z

Thanks for digging into it. I think we should do the validation here, and implement the timeout and follow up with grpc-java separately.

ennuite · 2026-08-28T10:13:41Z

@lidavidm I'll add the port validation in this PR later today. I think that makes sense as it both unblocks the PR and it is my change here that removed the fail-fast validation.

I created a couple issues for the JDBC connection timeouts: #1267 #1268 I'll grab them once I finish here, I already familiarized myself with the relevant code yesterday. I think it's fine to leave them for a later release though.

I'll also follow-up with gRPC (and try to provide a PR there if they agree that the problem is on their side).

Thanks for the guidance!

Edit- I will finish this PR tomorrow, as I had a small health hiccup and can't look at screens for a long time for the rest of today.

….getPort() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Validate the port synchronously in NettyClientBuilder.build() before calling forAddress(String, int), restoring the fail-fast behaviour that was lost when switching away from forAddress(SocketAddress). Placing the check here protects all callers (not just JDBC), and the resulting IllegalArgumentException is already caught and wrapped as SQLException by ArrowFlightSqlClientHandler.Builder.build(). Reverts the validation that was previously added to ArrowFlightConnectionConfigImpl.getPort() and the associated throws-SQLException ripple across FlightServerTestExtension, OAuthIntegrationTest, and ArrowFlightConnectionConfigImplTest. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…eAndPasswordAuth Missed in the previous cleanup commit; this was a ripple from the now- removed throws-SQLException on ArrowFlightConnectionConfigImpl.getPort(). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Port 0 is used in several existing tests as a placeholder. It does not cause the async-hang issue this validation was introduced to prevent (that affects truly out-of-range values). Tightening the lower bound to 1 and fixing those tests is left for a follow-up PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ennuite · 2026-08-30T03:09:11Z

Validation done, all tests pass locally.

For the validation, I allowed port 0 to be used for compatibility with a few existing tests that used it. I don't think we should allow it though: this is a client code path, it is meaningless to try to connect to port 0.

If you agree with this assessment @lidavidm I'll go ahead and create a separate issue+PR for removing 0 from the valid range (we can leave it for a next release).

jbonofre · 2026-08-30T06:13:54Z

@ennuite I'm doing a review as well. By the way, we pushed a fix on main regarding the CI, a rebase would be welcome.

….getPort() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Validate the port synchronously in NettyClientBuilder.build() before calling forAddress(String, int), restoring the fail-fast behaviour that was lost when switching away from forAddress(SocketAddress). Placing the check here protects all callers (not just JDBC), and the resulting IllegalArgumentException is already caught and wrapped as SQLException by ArrowFlightSqlClientHandler.Builder.build(). Reverts the validation that was previously added to ArrowFlightConnectionConfigImpl.getPort() and the associated throws-SQLException ripple across FlightServerTestExtension, OAuthIntegrationTest, and ArrowFlightConnectionConfigImplTest. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…eAndPasswordAuth Missed in the previous cleanup commit; this was a ripple from the now- removed throws-SQLException on ArrowFlightConnectionConfigImpl.getPort(). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Port 0 is used in several existing tests as a placeholder. It does not cause the async-hang issue this validation was introduced to prevent (that affects truly out-of-range values). Tightening the lower bound to 1 and fixing those tests is left for a follow-up PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ennuite · 2026-08-30T16:02:45Z

@jbonofre thank you for reviewing! I rebased, let me know of anything else you need and if you have a different opinion on anything that is being discussed.

jbonofre · 2026-08-30T16:58:11Z

@ennuite we will probably need to rebase again once #1270 is merged (I'm on it).

This comment has been minimized.

Sign in to view

jbonofre added the enhancement PRs that add or improve features. label Feb 23, 2026

jbonofre added this to the 20.0.0 milestone Feb 23, 2026

ennuite force-pushed the fix-jvm-proxy-settings branch from ef9e0c5 to 1e44df0 Compare May 14, 2026 03:04

ennuite marked this pull request as ready for review May 14, 2026 03:22

ennuite requested review from jbonofre, laurentgo, lidavidm and wgtmac as code owners May 14, 2026 03:22

ennuite force-pushed the fix-jvm-proxy-settings branch from 1e44df0 to dcfa5ef Compare August 25, 2026 11:13

ennuite force-pushed the fix-jvm-proxy-settings branch from dcfa5ef to 18b30dd Compare August 27, 2026 16:26

This was referenced Aug 28, 2026

[JDBC] Implement DataSource login timeout #1267

Open

[JDBC] Honor DriverManager login timeout #1268

Open

ennuite added a commit to ennuite/arrow-java that referenced this pull request Aug 30, 2026

apacheGH-1027: Validate port range in ArrowFlightConnectionConfigImpl…

e895aa4

….getPort() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ennuite and others added 6 commits August 30, 2026 16:59

Intermediate commit

787a7b5

Test using ProxySelector spy

d44b9fb

apacheGH-1027: Validate port range in ArrowFlightConnectionConfigImpl…

3be8c36

….getPort() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ennuite force-pushed the fix-jvm-proxy-settings branch from dc80adc to 0ee3503 Compare August 30, 2026 16:01

Uh oh!

Conversation

ennuite commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's Changed

Are these changes tested?

Uh oh!

This comment has been minimized.

jbonofre commented Feb 23, 2026

Uh oh!

ennuite commented Feb 23, 2026

Uh oh!

ennuite commented May 14, 2026

Uh oh!

lidavidm commented Aug 25, 2026

Uh oh!

lidavidm commented Aug 26, 2026

Uh oh!

ennuite commented Aug 27, 2026

Uh oh!

ennuite commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lidavidm commented Aug 27, 2026

Uh oh!

jbonofre commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ennuite commented Aug 27, 2026

Uh oh!

ennuite commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lidavidm commented Aug 28, 2026

Uh oh!

ennuite commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ennuite commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jbonofre commented Aug 30, 2026

Uh oh!

ennuite commented Aug 30, 2026

Uh oh!

jbonofre commented Aug 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ennuite commented Feb 23, 2026 •

edited

Loading

ennuite commented Aug 27, 2026 •

edited

Loading

jbonofre commented Aug 27, 2026 •

edited

Loading

ennuite commented Aug 27, 2026 •

edited

Loading

ennuite commented Aug 28, 2026 •

edited

Loading

ennuite commented Aug 30, 2026 •

edited

Loading