NotSslRecordException with Java 11 JDK SSLProvider

Expected behavior

SSL handshake succeeds.

Actual behavior

When using Java 11+ with TLS 1.3, SSL negotiation fails with:

io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 8ec407d00e000000
		at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472)
		at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278)
		at io.r2dbc.mssql.client.ssl.TdsSslHandler.channelRead(TdsSslHandler.java:363)
		at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374)
		... 18 more
	Caused by: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: db34cbdf0e000000
		at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1206)
		at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1274)
		at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502)
		at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441)
		... 21 more

The reported byte sequence is always different, but always the last 8 byte of the first received SSL handshake packet.

Full traffic (LoggingHandler): https://gist.github.com/mp911de/33e9d19332ac77b5b73e7d7d3f56c5f8

Full traffic (Wireshark): r2dbc-mssql-tls.pcapng.zip

Steps to reproduce

Connect to Azure SQL server via R2DBC MSSQL using Java 11:

SQL Server driver: https://github.com/r2dbc/r2dbc-mssql

MssqlConnectionConfiguration config = MssqlConnectionConfiguration.builder()
    .host("abcbookstore.database.windows.net")
    .database("foo")
    .username("foo")
    .password("foo")
    .build();
MssqlConnectionFactory cf = new MssqlConnectionFactory(config);

cf.create().block();

Minimal yet complete reproducer code (or URL to code)

https://gist.github.com/mp911de/3421fa37f71f2032239b3fa60507ebeb

Netty version

4.1.36.Final

JVM version (e.g. java -version)

Oracle JDK 11.0.1

OS version (e.g. uname -a)

18.6.0 Darwin Kernel Version 18.6.0: Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/RELEASE_X86_64 x86_64

Related issue: r2dbc/r2dbc-mssql#77

[mp911de]

Thanks @normanmaurer for your help and your time.

[mp911de]

The problem happens entirely in the library, not an netty issue. The actual cause is packet fragmentation and improper packet aggregation.

For some reason, it kept working in most Java 8 scenarios, therefore, I was blinded by a relation to the used Java runtime version.