From 04772f6641384613ace50ad6da830cd238cad420 Mon Sep 17 00:00:00 2001
From: agrawalabhi <reachabhishekag@gmail.com>
Date: Thu, 17 Sep 2026 10:29:02 +0000
Subject: [PATCH] okhttp: avoid sharing KeyManager/TrustManager across threads
 in mTLS test

In OkHttpChannelBuilderTest.sslSocketFactoryFrom_tls_mtls(), passing the same KeyManager[] and TrustManager[] instances to both the server SSLContext and client TlsChannelCredentials causes concurrent client and server TLS handshake threads to share underlying X509Certificate/X500Name instances. Under TSAN, this triggers a data race on DerValue.getDataBytes() inside X500Name.getRFC2253CanonicalName().

Create separate KeyManager[] and TrustManager[] instances for the server and client contexts.
---
 .../grpc/okhttp/OkHttpChannelBuilderTest.java | 25 +++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/okhttp/src/test/java/io/grpc/okhttp/OkHttpChannelBuilderTest.java b/okhttp/src/test/java/io/grpc/okhttp/OkHttpChannelBuilderTest.java
index 89d37536b70..e0d659178ad 100644
--- a/okhttp/src/test/java/io/grpc/okhttp/OkHttpChannelBuilderTest.java
+++ b/okhttp/src/test/java/io/grpc/okhttp/OkHttpChannelBuilderTest.java
@@ -201,19 +201,19 @@ public void sslSocketFactoryFrom_tls_customRoots() throws Exception {
 
   @Test
   public void sslSocketFactoryFrom_tls_mtls() throws Exception {
-    KeyManager[] keyManagers;
+    KeyManager[] serverKeyManagers;
     try (InputStream server1Chain = TlsTesting.loadCert("server1.pem");
          InputStream server1Key = TlsTesting.loadCert("server1.key")) {
-      keyManagers = OkHttpChannelBuilder.createKeyManager(server1Chain, server1Key);
+      serverKeyManagers = OkHttpChannelBuilder.createKeyManager(server1Chain, server1Key);
     }
 
-    TrustManager[] trustManagers;
+    TrustManager[] serverTrustManagers;
     try (InputStream ca = TlsTesting.loadCert("ca.pem")) {
-      trustManagers = CertificateUtils.createTrustManager(ca);
+      serverTrustManagers = CertificateUtils.createTrustManager(ca);
     }
 
     SSLContext serverContext = SSLContext.getInstance("TLS");
-    serverContext.init(keyManagers, trustManagers, null);
+    serverContext.init(serverKeyManagers, serverTrustManagers, null);
     final SSLServerSocket serverListenSocket =
         (SSLServerSocket) serverContext.getServerSocketFactory().createServerSocket(0);
     serverListenSocket.setNeedClientAuth(true);
@@ -231,9 +231,20 @@ public void sslSocketFactoryFrom_tls_mtls() throws Exception {
       }
     }).start();
 
+    KeyManager[] clientKeyManagers;
+    try (InputStream server1Chain = TlsTesting.loadCert("server1.pem");
+         InputStream server1Key = TlsTesting.loadCert("server1.key")) {
+      clientKeyManagers = OkHttpChannelBuilder.createKeyManager(server1Chain, server1Key);
+    }
+
+    TrustManager[] clientTrustManagers;
+    try (InputStream ca = TlsTesting.loadCert("ca.pem")) {
+      clientTrustManagers = CertificateUtils.createTrustManager(ca);
+    }
+
     ChannelCredentials creds = TlsChannelCredentials.newBuilder()
-        .keyManager(keyManagers)
-        .trustManager(trustManagers)
+        .keyManager(clientKeyManagers)
+        .trustManager(clientTrustManagers)
         .build();
     OkHttpChannelBuilder.SslSocketFactoryResult result =
         OkHttpChannelBuilder.sslSocketFactoryFrom(creds);