SNOW-2866221: Retry transient SSLHandshakeException errors caused by EOFException (#2423)

Author: sfc-gh-wfateem

CHANGELOG.md

@@ -6,6 +6,7 @@
     - Bumped grpc-java to 1.77.0 to address CVE-2025-58057 from transient dep (snowflakedb/snowflake-jdbc#2415)
     - Fix Connection and socket timeout are now propagated to HTTP client.
     - Fix Azure 503 retries and configure it with the putGetMaxRetries parameter.
+    - Improved retries for SSLHandshakeException errors caused by transient EOFException
 
 - v3.27.1
     - Added platform detection on login to set PLATFORM metric in CLIENT_ENVIRONMENT

src/main/java/net/snowflake/client/jdbc/RestRequest.java

@@ -5,6 +5,7 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
+import java.io.EOFException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.PrintWriter;
@@ -651,6 +652,11 @@ private static Throwable getRootCause(Throwable ex) {
     return ex0;
   }
 
+  private static boolean isTransientHandshakeEOF(Exception ex) {
+    Throwable root = getRootCause(ex);
+    return root instanceof EOFException;
+  }
+
   private static void setRequestConfig(
       HttpRequestBase httpRequest,
       boolean withoutCookies,
@@ -979,6 +985,10 @@ public static HttpResponseContextDto executeWithRetries(
             httpClient = HttpUtil.getHttpClient(key, httpHeaderCustomizer);
           }
           continue;
+        } else if (ex instanceof SSLHandshakeException && isTransientHandshakeEOF(ex)) {
+          // Treat transient EOF during TLS handshake as retryable:
+          // set saved exception for logging/telemetry and allow the retry loop to proceed.
+          responseDto.setSavedEx(ex);
         } else {
           responseDto.setSavedEx(handlingNotRetryableException(ex, httpExecutingContext));
         }

src/test/java/net/snowflake/client/jdbc/RestRequestTest.java

@@ -20,6 +20,7 @@
 
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import java.io.ByteArrayInputStream;
+import java.io.EOFException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.SocketException;
@@ -397,6 +398,52 @@ class TestCase {
     }
   }
 
+  @Test
+  public void testRetryOnTransientSslHandshakeEof() throws Exception {
+    CloseableHttpClient client = mock(CloseableHttpClient.class);
+    // First attempt throws SSLHandshakeException with EOF root cause, second succeeds
+    SSLHandshakeException handshake = new SSLHandshakeException("handshake failed");
+    handshake.initCause(new EOFException("remote host closed connection during handshake"));
+    when(client.execute(any(HttpUriRequest.class)))
+        .thenThrow(handshake)
+        .thenReturn(successResponse());
+
+    // Use helper to execute with maxRetries >= 1 so the loop can retry
+    execute(
+        client,
+        "fakeurl.com/?requestId=abcd-1234",
+        /* retryTimeout */ 0,
+        /* authTimeout */ 0,
+        /* socketTimeout */ 0,
+        /* includeRetryParameters */ true,
+        /* noRetry */ false,
+        /* maxRetries */ 2);
+
+    // Verify two executions (first throws, second succeeds)
+    verify(client, times(2)).execute(any(HttpUriRequest.class));
+  }
+
+  @Test
+  public void testNoRetryOnSslHandshakeWithoutEof() throws Exception {
+    CloseableHttpClient client = mock(CloseableHttpClient.class);
+    // SSLHandshakeException without EOF root cause should be treated as non-retryable
+    SSLHandshakeException handshake = new SSLHandshakeException("handshake failed (non-EOF)");
+    when(client.execute(any(HttpUriRequest.class))).thenThrow(handshake);
+
+    assertThrows(
+        SnowflakeSQLException.class,
+        () ->
+            execute(
+                client,
+                "fakeurl.com/?requestId=abcd-1234",
+                /* retryTimeout */ 0,
+                /* authTimeout */ 0,
+                /* socketTimeout */ 0,
+                /* includeRetryParameters */ true,
+                /* noRetry */ false,
+                /* maxRetries */ 2));
+  }
+
   @Test
   public void testExceptionAuthBasedTimeout() throws IOException {
     CloseableHttpClient client = mock(CloseableHttpClient.class);