trozet I was easily able to reproduce this "hang" in a local development environment like this:

curl -i -X HEAD http://localhost:8181/diagstatus
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
Content-Length: 1188

which just sit there, not returning. However my curl on Fedora 28 with curl --version (just to be sure):

curl 7.59.0 (x86_64-redhat-linux-gnu) libcurl/7.59.0 OpenSSL/1.1.0h zlib/1.2.11 libidn2/2.0.5 libpsl/0.20.2 (+libidn2/2.0.4) libssh/0.8.1/openssl/zlib nghttp2/1.32.0
Release-Date: 2018-03-14
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy PSL Metalink

also prints this interesting beauty when I issue a curl -i -X HEAD :

Warning: Setting custom HTTP method to HEAD with -X/--request may not work the 
Warning: way you want. Consider using -I/--head instead.

and indeed with using --head instead of -X HEAD, it works for me without hanging:

curl -i --head http://localhost:8181/diagstatus    
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
Content-Length: 1188

So that part of the problem (what you are showing as curl: (28) Operation timed out after 5001 milliseconds with 0 out of 132 bytes received above) is not an ODL bug, but simply a misuse of curl, it seems.

BUT it gave me a 200 not a 418.. that's very curious - and I cannot explain yet how you can get two different replies, yet. It seems impossible from the code. I'll keep digging into the code, but in the mean time please try using --head instead of -X HEAD. If that solves this problem for you, please do comment and close this issue?

trozet OMG you're totally right, this /diagstatus/ is totally broken! The GET indeed always returns 200 and never 418 (or 503 following INFRAUTILS-46, whatever). This can also be seen if one tries it out (fast enough) just as it's still coming up... this is obviously completely wrong as well, it can't report 200 while still BOOTING and in isOperational: false :

curl -i -X GET http://localhost:8181/diagstatus
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
Content-Length: 133

{
 "timeStamp": "Thu Aug 23 00:09:29 CEST 2018",
 "isOperational": false,
 "systemReadyState": "BOOTING",
 "statusSummary": []
}

looks like either some misunderstanding (on my part) re. the response.setStatus() in the Java Servlet API, or a bug in the (Jetty) implementation; I'm digging into it.

Figured out the problem (must use setStatus() before response.getWriter()) - solution in code review.