Make BC TLS detection testable; refactor to FQCN walk

Author: nhachicha

driver-core/src/main/com/mongodb/internal/connection/BackpressureErrorLabeler.java

@@ -18,7 +18,6 @@
 
 import com.mongodb.MongoException;
 import com.mongodb.MongoSocketException;
-import com.mongodb.lang.Nullable;
 
 import javax.net.ssl.SSLHandshakeException;
 import javax.net.ssl.SSLPeerUnverifiedException;
@@ -30,12 +29,8 @@
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashSet;
-import java.util.List;
 import java.util.Locale;
-import java.util.Objects;
 import java.util.Set;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
 
 /**
  * Attaches {@link MongoException#SYSTEM_OVERLOADED_ERROR_LABEL} and
@@ -48,16 +43,13 @@
 final class BackpressureErrorLabeler {
 
     /**
-     * BouncyCastle TLS fatal-alert exception types resolved at class-load time. If BC isn't on the
-     * classpath the list is empty and {@link #isBouncyCastleTlsError(Throwable)} short-circuits to false.
+     * BouncyCastle TLS fatal-alert exception type names.
      */
-    private static final List<Class<?>> BOUNCY_CASTLE_TLS_FATAL_TYPES = Stream.of(
+    private static final Set<String> BOUNCY_CASTLE_TLS_FATAL_TYPE_NAMES = Collections.unmodifiableSet(
+            new HashSet<>(Arrays.asList(
                     "org.bouncycastle.tls.TlsFatalAlert",
                     "org.bouncycastle.tls.TlsFatalAlertReceived",
-                    "org.bouncycastle.tls.crypto.TlsCryptoException")
-            .map(BackpressureErrorLabeler::loadClassOrNull)
-            .filter(Objects::nonNull)
-            .collect(Collectors.toList());
+                    "org.bouncycastle.tls.crypto.TlsCryptoException")));
 
     /**
      * RFC 5246 / RFC 8446 alert descriptions that surface in BouncyCastle TLS exception messages.
@@ -90,7 +82,7 @@ static void applyLabelsIfEligible(final Throwable t) {
         if (isTlsConfigurationError(socketException)) {
             return;
         }
-        // TODO-BACKPRESSURE Nabil - SOCKS5 Revisit alongside JAVA-5205 (SOCKS5 in async) so both sync and
+        // TODO-BACKPRESSURE Nabil - Add SOCKS5 check once JAVA-6194 is introduced
         // async proxy error surfaces can be handled together — likely via a dedicated internal
         // exception thrown from the proxy code path.
         socketException.addLabel(MongoException.SYSTEM_OVERLOADED_ERROR_LABEL);
@@ -140,14 +132,7 @@ private static boolean isTlsConfigurationError(final MongoSocketException t) {
     }
 
     private static boolean isBouncyCastleTlsError(final Throwable cause) {
-        boolean isBcType = false;
-        for (Class<?> bcType : BOUNCY_CASTLE_TLS_FATAL_TYPES) {
-            if (bcType.isInstance(cause)) {
-                isBcType = true;
-                break;
-            }
-        }
-        if (!isBcType) {
+        if (!isBouncyCastleTlsFatalType(cause.getClass())) {
             return false;
         }
         String message = cause.getMessage();
@@ -163,12 +148,18 @@ private static boolean isBouncyCastleTlsError(final Throwable cause) {
         return false;
     }
 
-    @Nullable
-    private static Class<?> loadClassOrNull(final String fqn) {
-        try {
-            return Class.forName(fqn);
-        } catch (ClassNotFoundException e) {
-            return null;
+    /**
+     * Walks the class hierarchy comparing fully qualified names so a subclass of a known BC type
+     * still matches without requiring the BC classes to be loadable at static-init time.
+     */
+    private static boolean isBouncyCastleTlsFatalType(final Class<?> exceptionClass) {
+        Class<?> cls = exceptionClass;
+        while (cls != null) {
+            if (BOUNCY_CASTLE_TLS_FATAL_TYPE_NAMES.contains(cls.getName())) {
+                return true;
+            }
+            cls = cls.getSuperclass();
         }
+        return false;
     }
 }

driver-core/src/test/unit/com/mongodb/internal/connection/BackpressureErrorLabelerTest.java

@@ -23,8 +23,11 @@
 import com.mongodb.MongoSocketOpenException;
 import com.mongodb.MongoSocketReadTimeoutException;
 import com.mongodb.ServerAddress;
+import net.bytebuddy.ByteBuddy;
 import org.junit.jupiter.api.Named;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.junit.jupiter.params.provider.ValueSource;
 
@@ -166,6 +169,72 @@ void nonSocketErrorShouldNotBeLabeled(final Throwable e) {
         }
     }
 
+    /**
+     * BouncyCastle isn't on the test classpath, so we use ByteBuddy to synthesise classes with the
+     * exact FQCNs the labeler matches against. This exercises the FQCN-walk in
+     * {@code isBouncyCastleTlsFatalType} without taking a compile- or runtime dependency on BC.
+     */
+    @ParameterizedTest(name = "{0} with alert {1}")
+    @MethodSource
+    void bouncyCastleTlsFatalAlertShouldNotBeLabeled(final String bcFqcn, final String alertMessage) throws Exception {
+        Throwable bcCause = newBouncyCastleStub(bcFqcn, alertMessage);
+        MongoSocketException e = new MongoSocketException("tls", ADDRESS, bcCause);
+        BackpressureErrorLabeler.applyLabelsIfEligible(e);
+        assertLacksBackpressureLabels(e);
+    }
+
+    static Stream<Arguments> bouncyCastleTlsFatalAlertShouldNotBeLabeled() {
+        return Stream.of(
+                Arguments.of("org.bouncycastle.tls.TlsFatalAlert", "handshake_failure(40)"),
+                Arguments.of("org.bouncycastle.tls.TlsFatalAlertReceived", "unknown_ca(48)"),
+                Arguments.of("org.bouncycastle.tls.crypto.TlsCryptoException", "bad_certificate(42)"));
+    }
+
+    /**
+     * Subclasses of known BC types must still match — the labeler walks the superclass chain.
+     */
+    @Test
+    void bouncyCastleSubclassWithAlertShouldNotBeLabeled() throws Exception {
+        Class<?> bcParent = new ByteBuddy()
+                .subclass(Exception.class)
+                .name("org.bouncycastle.tls.TlsFatalAlert")
+                .make()
+                .load(BackpressureErrorLabelerTest.class.getClassLoader())
+                .getLoaded();
+        Class<?> bcSubclass = new ByteBuddy()
+                .subclass(bcParent)
+                .name("com.example.CustomBcSubclass")
+                .make()
+                .load(bcParent.getClassLoader())
+                .getLoaded();
+        Throwable cause = (Throwable) bcSubclass.getConstructor(String.class).newInstance("handshake_failure(40)");
+        MongoSocketException e = new MongoSocketException("tls", ADDRESS, cause);
+        BackpressureErrorLabeler.applyLabelsIfEligible(e);
+        assertLacksBackpressureLabels(e);
+    }
+
+    /**
+     * BC type but the message has no recognised alert description — the alert-keyword filter
+     * rejects it, so the labeler falls through and applies backpressure labels.
+     */
+    @Test
+    void bouncyCastleTypeWithoutAlertKeywordShouldBeLabeled() throws Exception {
+        Throwable bcCause = newBouncyCastleStub("org.bouncycastle.tls.TlsFatalAlert", "something unrelated");
+        MongoSocketException e = new MongoSocketException("tls", ADDRESS, bcCause);
+        BackpressureErrorLabeler.applyLabelsIfEligible(e);
+        assertHasBackpressureLabels(e);
+    }
+
+    private static Throwable newBouncyCastleStub(final String fqcn, final String message) throws Exception {
+        Class<?> cls = new ByteBuddy()
+                .subclass(Exception.class)
+                .name(fqcn)
+                .make()
+                .load(BackpressureErrorLabelerTest.class.getClassLoader())
+                .getLoaded();
+        return (Throwable) cls.getConstructor(String.class).newInstance(message);
+    }
+
     private static <T extends Throwable> Named<T> named(final T e) {
         return Named.of(e.getClass().getSimpleName(), e);
     }