[
https://issues.apache.org/jira/browse/CAMEL-26630?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26630 started by shashank.
----------------------------------------
> camel-core - exchange sanitizer: dev-mode checks that each exchange's
> callback runs exactly once and each consumer commit runs once
> -----------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26630
> URL: https://issues.apache.org/jira/browse/CAMEL-26630
> Project: Camel
> Issue Type: New Feature
> Components: camel-core
> Reporter: shashank
> Assignee: shashank
> Priority: Major
>
> A dev-mode checker for exchanges, proposed on Zulip and asked for as a design
> proposal, a JIRA and a PR, as was done for camel-chaos (CAMEL-26330).
> *Motivation*
> Several concurrency bugs found this year broke the contracts of
> {{AsyncProcessor}} and of on completions without failing at the place of the
> bug:
> * an exchange completed twice: CAMEL-25095 (camel-jms) and CAMEL-25122
> (camel-sjms), InOut, where a send failure completes an exchange that the
> request timeout or the reply already completed; CAMEL-26446, a throw on the
> first delivery that could continue the exchange twice;
> * a processor that throws from {{process(exchange, callback)}} instead of
> calling the callback, so the exchange hangs: CAMEL-26430, CAMEL-26445,
> CAMEL-26461, CAMEL-26464, CAMEL-26601;
> * the consumer's commit with a shared unit of work: CAMEL-26569, CAMEL-26576.
> User code breaks the same contracts the same way: a custom {{AsyncProcessor}}
> with a timeout of its own that calls the callback from the timeout and again
> from the reply, a custom consumer whose commit runs twice, an
> {{AggregationStrategy}} that throws. The sanitizer checks Camel's code and
> the user's alike, in the tests the user already has.
> *Rules*
> * R1: the callback of each call of a step's processor is called exactly once.
> Reported: completed twice (logged at the second call, before it continues the
> exchange, with the stack of the first call kept), threw before calling the
> callback, a callback after the processor threw, and, as a warning that
> complements the inflight console, a call still pending.
> * R2: each consumer commit (an on completion the consumer adds before
> routing, which can be handed over to a seda copy or shared with
> shareUnitOfWork; not {{UnitOfWork.done}}) runs exactly once, in the unit of
> work that holds it, and is handed over only by the exchange its unit of work
> was created for.
> * R3: an exchange is never used by two threads at the same time, checked
> through the {{AsyncProcessor}} contract ({{doneSync}} equals what {{process}}
> returned) and sampled overlaps in time of the engine's accesses (as KCSAN
> does), with no dependency on a handover API.
> * R4: the tasks an executor drops at shutdown are listed.
> Pooled exchanges (deprecated in 4.23) are not supported.
> *SPI*
> Two small listener SPIs in camel-api, {{StepListener}} (the call of a step's
> processor, its return, its throw, each call of its callback) and
> {{OnCompletionListener}} (a unit of work set, an on completion added, handed
> over, taken and run). They only observe, and more than one can be installed,
> so the sanitizer runs together with chaos (which uses the one-per-context
> {{StepHook}}, CAMEL-26338), the debugger, the tracer and JMX. The step
> listener is a wrapper built by the channel around the step's processor only
> when a listener is installed, so with none a step costs nothing more; the on
> completion places check an empty list (measured with JMH).
> *Switch*
> A {{camel-sanitizer}} module with a {{ContextServicePlugin}}, as camel-chaos:
> on with profile {{dev}} or {{camel.sanitizer.enabled=true}}, never with
> profile {{prod}}. A JUnit extension ({{@CamelSanitizer}}) fails a test on the
> first violation; the test dependency and system properties run an existing
> suite with it in CI; a dev console and {{camel get sanitizer}} show the
> report.
> *Plan*
> R1 first, run on the commits before the fixes above to show each one is
> reported at the right step, and on the camel-core suite and the netty,
> netty-http, vertx-http and JMS request/reply suites to show it is quiet on
> main; JMH for the cost; then R2, R3, the console and CLI, and R4 last. Each
> step is its own PR.
> Design: design/exchange-sanitizer.adoc (PR to follow).
> _Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
