This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new b519ea1441d5 CAMEL-26328: camel-core - Failover load balancer: do not
fail over on a suppressed exception (#28751)
b519ea1441d5 is described below
commit b519ea1441d5c633b2bed48289041074a5a1aaf6
Author: allthingssecurity <[email protected]>
AuthorDate: Sat Oct 31 15:32:05 2026 +0530
CAMEL-26328: camel-core - Failover load balancer: do not fail over on a
suppressed exception (#28751)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
.../catalog/docs/failoverLoadBalancer-eip.adoc | 6 +
.../eips/pages/failoverLoadBalancer-eip.adoc | 6 +
.../loadbalancer/FailOverLoadBalancer.java | 24 +-
...FailOverLoadBalanceSuppressedExceptionTest.java | 256 +++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 31 +++
5 files changed, 316 insertions(+), 7 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/failoverLoadBalancer-eip.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/failoverLoadBalancer-eip.adoc
index 8ea913a93f67..85dfaf4b4e67 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/failoverLoadBalancer-eip.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/failoverLoadBalancer-eip.adoc
@@ -283,3 +283,9 @@ YAML::
uri: http:service3
----
====
+
+The exception the attempt fails with and its causes are matched against these
exceptions (the same as `onException`
+and `doCatch`). Suppressed exceptions are not matched. For example, an
exception thrown in a `doFinally` block is added
+as a suppressed exception to the exception from the `doTry` block, so it does
not cause a failover. And when an
+`onException` block or the `onWhen` of a `doCatch` fails with a new exception,
the original exception is added as a
+suppressed exception to the new exception, so the new exception decides
whether to fail over.
diff --git
a/core/camel-core-engine/src/main/docs/modules/eips/pages/failoverLoadBalancer-eip.adoc
b/core/camel-core-engine/src/main/docs/modules/eips/pages/failoverLoadBalancer-eip.adoc
index 8ea913a93f67..85dfaf4b4e67 100644
---
a/core/camel-core-engine/src/main/docs/modules/eips/pages/failoverLoadBalancer-eip.adoc
+++
b/core/camel-core-engine/src/main/docs/modules/eips/pages/failoverLoadBalancer-eip.adoc
@@ -283,3 +283,9 @@ YAML::
uri: http:service3
----
====
+
+The exception the attempt fails with and its causes are matched against these
exceptions (the same as `onException`
+and `doCatch`). Suppressed exceptions are not matched. For example, an
exception thrown in a `doFinally` block is added
+as a suppressed exception to the exception from the `doTry` block, so it does
not cause a failover. And when an
+`onException` block or the `onWhen` of a `doCatch` fails with a new exception,
the original exception is added as a
+suppressed exception to the new exception, so the new exception decides
whether to fail over.
diff --git
a/core/camel-core-processor/src/main/java/org/apache/camel/processor/loadbalancer/FailOverLoadBalancer.java
b/core/camel-core-processor/src/main/java/org/apache/camel/processor/loadbalancer/FailOverLoadBalancer.java
index 1e565805a8da..8300ea14c851 100644
---
a/core/camel-core-processor/src/main/java/org/apache/camel/processor/loadbalancer/FailOverLoadBalancer.java
+++
b/core/camel-core-processor/src/main/java/org/apache/camel/processor/loadbalancer/FailOverLoadBalancer.java
@@ -130,13 +130,7 @@ public class FailOverLoadBalancer extends
LoadBalancerSupport implements Traceab
// always failover if no exceptions defined
answer = true;
} else {
- for (Class<?> exception : exceptions) {
- // will look in exception hierarchy
- if (exchange.getException(exception) != null) {
- answer = true;
- break;
- }
- }
+ answer = matchesException(exchange.getException());
}
if (answer) {
@@ -152,6 +146,22 @@ public class FailOverLoadBalancer extends
LoadBalancerSupport implements Traceab
return answer;
}
+ /**
+ * Whether the exception, or one of its causes, is one of the exceptions
to failover on. Suppressed exceptions (such
+ * as an exception thrown in a doFinally block) are not matched, the same
as onException and doCatch.
+ */
+ private boolean matchesException(Throwable exception) {
+ // walk the caused by hierarchy
+ for (Throwable throwable :
ObjectHelper.createExceptionIterable(exception)) {
+ for (Class<?> type : exceptions) {
+ if (type.isInstance(throwable)) {
+ return true;
+ }
+ }
+ }
+ return false;
+ }
+
@Override
public boolean isRunAllowed() {
// determine if we can still run, or the camel context is forcing a
shutdown
diff --git
a/core/camel-core/src/test/java/org/apache/camel/processor/FailOverLoadBalanceSuppressedExceptionTest.java
b/core/camel-core/src/test/java/org/apache/camel/processor/FailOverLoadBalanceSuppressedExceptionTest.java
new file mode 100644
index 000000000000..9236be24a982
--- /dev/null
+++
b/core/camel-core/src/test/java/org/apache/camel/processor/FailOverLoadBalanceSuppressedExceptionTest.java
@@ -0,0 +1,256 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.processor;
+
+import java.io.IOException;
+
+import org.apache.camel.ContextTestSupport;
+import org.apache.camel.Exchange;
+import org.apache.camel.builder.RouteBuilder;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * The failover load balancer fails over only on the exception the attempt
fails with and its causes, not on its
+ * suppressed exceptions (such as an exception thrown in a doFinally block, or
the original exception when an
+ * onException block or the onWhen of a doCatch fails), the same as
onException and doCatch.
+ */
+class FailOverLoadBalanceSuppressedExceptionTest extends ContextTestSupport {
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ failover("finally");
+ from("direct:finally-attempt")
+ .doTry()
+ .throwException(new IOException("original"))
+ .doFinally()
+ .throwException(new
IllegalArgumentException("cleanup"))
+ .end();
+
+ failover("finallyRoute");
+ from("direct:finallyRoute-attempt")
+ .doTry()
+ .throwException(new IOException("original"))
+ .doFinally()
+ .to("direct:cleanup")
+ .end();
+ from("direct:cleanup")
+ .throwException(new
IllegalArgumentException("cleanup"));
+
+ failover("suppressed");
+ from("direct:suppressed-attempt")
+ .process(e -> {
+ IOException original = new IOException("original");
+ original.addSuppressed(new
IllegalArgumentException("cleanup"));
+ throw original;
+ });
+
+ failover("cause");
+ from("direct:cause-attempt")
+ .process(e -> {
+ throw new IOException("original", new
IllegalArgumentException("cause"));
+ });
+
+ failover("monitored");
+ from("direct:monitored-attempt")
+ .throwException(new
IllegalArgumentException("original"));
+
+ failover("monitoredFinally");
+ from("direct:monitoredFinally-attempt")
+ .doTry()
+ .throwException(new
IllegalArgumentException("original"))
+ .doFinally()
+ .throwException(new IOException("cleanup"))
+ .end();
+
+ failover("notMonitored");
+ from("direct:notMonitored-attempt")
+ .throwException(new IOException("original"));
+
+ failover("errorHandlerFails");
+ from("direct:errorHandlerFails-attempt")
+
.onException(IllegalArgumentException.class).to("direct:audit").end()
+ .throwException(new
IllegalArgumentException("original"));
+ from("direct:audit")
+ .throwException(new IOException("audit"));
+
+ failover("onWhenFails");
+ from("direct:onWhenFails-attempt")
+ .doTry()
+ .throwException(new
IllegalArgumentException("original"))
+ .doCatch(IllegalArgumentException.class).onWhen(e -> {
+ throw new IllegalStateException("onWhen");
+ })
+ .to("mock:caught")
+ .end();
+
+ from("direct:inherit")
+
.errorHandler(defaultErrorHandler().maximumRedeliveries(2).redeliveryDelay(0))
+ .loadBalance().failover(2, true, true,
IllegalArgumentException.class)
+ .to("direct:inherit-attempt")
+ .to("mock:second")
+ .end()
+ .to("mock:after");
+ from("direct:inherit-attempt")
+ .to("mock:attempt")
+ // new exceptions on each redelivery (a shared
instance would collect a suppressed one per attempt)
+ .doTry()
+ .process(e -> {
+ throw new IOException("original");
+ })
+ .doFinally()
+ .process(e -> {
+ throw new IllegalArgumentException("cleanup");
+ })
+ .end();
+
+ from("direct:onException")
+
.onException(IllegalArgumentException.class).handled(true).to("mock:onException").end()
+ .doTry()
+ .throwException(new IOException("original"))
+ .doFinally()
+ .throwException(new
IllegalArgumentException("cleanup"))
+ .end();
+ }
+
+ private void failover(String name) {
+ from("direct:" + name)
+ .loadBalance().failover(IllegalArgumentException.class)
+ .to("direct:" + name + "-attempt")
+ .to("mock:second")
+ .end()
+ .to("mock:after");
+ }
+ };
+ }
+
+ @Test
+ void doFinallyThrowsMonitoredException() throws Exception {
+ assertNoFailover("direct:finally");
+ }
+
+ @Test
+ void doFinallyCallsRouteThatThrowsMonitoredException() throws Exception {
+ assertNoFailover("direct:finallyRoute");
+ }
+
+ @Test
+ void processorAddsMonitoredExceptionAsSuppressed() throws Exception {
+ assertNoFailover("direct:suppressed");
+ }
+
+ @Test
+ void monitoredExceptionAsCause() throws Exception {
+ assertFailover("direct:cause");
+ }
+
+ @Test
+ void monitoredExceptionThrown() throws Exception {
+ assertFailover("direct:monitored");
+ }
+
+ @Test
+ void monitoredExceptionThrownWhenDoFinallyThrowsAnother() throws Exception
{
+ assertFailover("direct:monitoredFinally");
+ }
+
+ @Test
+ void errorHandlerFailsWhileHandlingMonitoredException() throws Exception {
+ // the onException block fails, so the attempt fails with the new
exception (the original is suppressed)
+ assertNoFailover("direct:errorHandlerFails", IOException.class,
"audit", IllegalArgumentException.class, "original");
+ }
+
+ @Test
+ void doCatchOnWhenFailsForMonitoredException() throws Exception {
+ getMockEndpoint("mock:caught").expectedMessageCount(0);
+
+ // the onWhen fails, so the attempt fails with the exception of the
predicate (the original is suppressed)
+ assertNoFailover("direct:onWhenFails", IllegalStateException.class,
"onWhen", IllegalArgumentException.class,
+ "original");
+ }
+
+ @Test
+ void
doFinallyThrowsMonitoredExceptionWithInheritErrorHandlerAndRoundRobin() throws
Exception {
+ // the inherited error handler redelivers the attempt twice, then the
load balancer does not fail over
+ getMockEndpoint("mock:attempt").expectedMessageCount(3);
+ // one suppressed exception only: each attempt throws from the same
line, so RedeliveryErrorHandler.isSame
+ // does not add the IOException of the previous attempt as suppressed
+
+ assertNoFailover("direct:inherit");
+ }
+
+ @Test
+ void notMonitoredException() throws Exception {
+ getMockEndpoint("mock:second").expectedMessageCount(0);
+ getMockEndpoint("mock:after").expectedMessageCount(0);
+
+ Exchange out = template.send("direct:notMonitored", e ->
e.getMessage().setBody("Hello"));
+
+ assertInstanceOf(IOException.class, out.getException());
+ assertEquals("original", out.getException().getMessage());
+ assertMockEndpointsSatisfied();
+ }
+
+ @Test
+ void onExceptionDoesNotMatchSuppressedException() throws Exception {
+ getMockEndpoint("mock:onException").expectedMessageCount(0);
+
+ Exchange out = template.send("direct:onException", e ->
e.getMessage().setBody("Hello"));
+
+ assertInstanceOf(IOException.class, out.getException());
+ assertEquals("original", out.getException().getMessage());
+ assertMockEndpointsSatisfied();
+ }
+
+ private void assertNoFailover(String uri) throws Exception {
+ assertNoFailover(uri, IOException.class, "original",
IllegalArgumentException.class, "cleanup");
+ }
+
+ private void assertNoFailover(
+ String uri, Class<? extends Exception> type, String message,
+ Class<? extends Exception> suppressedType, String
suppressedMessage)
+ throws Exception {
+ getMockEndpoint("mock:second").expectedMessageCount(0);
+ getMockEndpoint("mock:after").expectedMessageCount(0);
+
+ Exchange out = template.send(uri, e ->
e.getMessage().setBody("Hello"));
+
+ // the exchange fails with the exception the attempt failed with, and
the listed one is only suppressed
+ assertInstanceOf(type, out.getException());
+ assertEquals(message, out.getException().getMessage());
+ assertEquals(1, out.getException().getSuppressed().length);
+ assertInstanceOf(suppressedType,
out.getException().getSuppressed()[0]);
+ assertEquals(suppressedMessage,
out.getException().getSuppressed()[0].getMessage());
+ assertMockEndpointsSatisfied();
+ }
+
+ private void assertFailover(String uri) throws Exception {
+ getMockEndpoint("mock:second").expectedBodiesReceived("Hello");
+ getMockEndpoint("mock:after").expectedBodiesReceived("Hello");
+
+ Exchange out = template.send(uri, e ->
e.getMessage().setBody("Hello"));
+
+ assertNull(out.getException());
+ assertMockEndpointsSatisfied();
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index 5e1a0e08c1cc..ee38141b1a57 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -155,6 +155,37 @@ successful exchange opened the circuit again as long as
the failures that opened
the defaults (a window of 60 seconds, a half open check after 30 seconds) a
success in the first 30 seconds after the
half open check therefore kept the circuit open. A `halfOpenHandler` decides
as before.
+=== camel-core - the failover load balancer does not fail over on a suppressed
exception
+
+The failover load balancer with a list of exceptions now matches only the
exception the attempt fails with and its
+causes, as `onException` and `doCatch` do. Before, it also matched the
suppressed exceptions of that exception. Since
+4.23, an exception thrown in a `doFinally` block is added as a suppressed
exception to the exception from the `doTry`
+block, so a `doFinally` that threw one of the exceptions to fail over on made
the load balancer fail over, and the
+exception from the `doTry` block was lost when the next processor succeeded.
Now the exchange fails with that
+exception. The same applies to a failing `onCompletion` that runs before the
consumer (`modeBeforeConsumer`) and a
+failing saga compensation, whose exceptions are also added as suppressed
exceptions.
+
+The load balancer also no longer fails over when one of the exceptions to fail
over on is only the suppressed exception
+of the exception the attempt fails with in these cases:
+
+* An `onException` block (or another error handler) fails while it handles the
exception: the exchange fails with the
+ new exception, and the original exception is added to it as a suppressed
exception (by the
+ `FatalFallbackErrorHandler`). Unlike the `doFinally` case, this is not a
4.23 regression: it changes behaviour that
+ dates back to Camel 2.16, intentionally, so that the load balancer matches
exceptions as `onException` and `doCatch`
+ do.
+* The error handler redelivers the attempt (with `inheritErrorHandler`
enabled, or the error handler of the route the
+ attempt calls) and the last redelivery fails with a different exception than
the first attempt: the exchange fails
+ with the exception of the last redelivery, and the exception of the first
attempt is added to it as a suppressed
+ exception. For example, with only `java.io.IOException` in the list, when
the first attempt fails with a
+ `java.net.ConnectException` and the redelivery with an
`HttpOperationFailedException`, the load balancer used to
+ fail over and now does not.
+* The `onWhen` predicate of a `doCatch` throws an exception: the exchange
fails with the exception of the predicate, and
+ the original exception is added to it as a suppressed exception.
+* A processor or component adds a suppressed exception itself (such as Java's
try-with-resources when closing a
+ resource fails).
+
+To fail over in these cases, add the type of the exception the attempt fails
with to the list.
+
=== camel-core - JsonObject and JsonArray convert to their JSON text
The camel-util-json types `org.apache.camel.util.json.JsonObject` and
`JsonArray` (given by `convertBodyTo: JsonObject`,
