Slack integration with JIRA breaking (Slack TLSv1.3 change?)

[Jeff Turner]

I am a consultant who manages companies' Atlassian apps.

Over the past 24h, two companies have reported that Jira's integration with Slack has suddenly broken. Restarting Jira lets a few Slack webhook calls through before it gets stuck again. Once stuck, no webhooks (even non-Slack) will go through.

To cut a long story short, this is due to a bug in Java 11's TLSv1.3 support. Jira is failing to close the TLS connection, which blocks the webhook thread queue:

https://jira.atlassian.com/browse/JRASERVER-70780
https://jira.atlassian.com/browse/JRASERVER-70189

This can be diagnosed by taking a thread dump (jstack -l <pid>) and looking for a BLOCKED thread named Web-Hook-Publisher-n, e.g.:

"Web-Hook-Publisher-2" #480 daemon prio=5 os_prio=0 cpu=2725.90ms elapsed=116091.79s tid=0x00007f6a6c794800 nid=0x2201 waiting for monitor entry [0x00007f68a43fa000]
java.lang.Thread.State: BLOCKED (on object monitor)
at org.apache.http.nio.reactor.ssl.SSLIOSession.close(SSLIOSession.java:605)
- waiting to lock <0x0000000724634b18> (a org.apache.http.nio.reactor.ssl.SSLIOSession)

There is a workaround in the JRASERVER reports. The bug is fixed in Java 12, and should be backported to the forthcoming Java 11.0.8.

Two instances hitting the same problem could be a coincidence, but it could be that Slack recently updated TLS somehow in their https://hooks.slack.com endpoint. They did remove TLSv1.0 and v1.1 support last month.

Has anyone else running Java 11 with Slack integration noticed this problem?