[
https://issues.apache.org/jira/browse/CAMEL-10628?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joe Luo updated CAMEL-10628:
----------------------------
Description:
I have a camel route using Rest DSL with Jetty component:
{code}
<camelContext id="camel" trace="true" streamCache="true"
xmlns="http://camel.apache.org/schema/blueprint";>
<restConfiguration component="jetty" bindingMode="off" scheme="https"
host="localhost" port="9080" contextPath="/">
<endpointProperty key="sslContextParametersRef"
value="sslContextParameter"/>
<endpointProperty key="handlers" value="#securityHandler"/>
<endpointProperty key="matchOnUriPrefix" value="true"/>
</restConfiguration>
<rest path="/customerservice">
<get uri="/customers" >
<to uri="direct:processGet"/>
</get>
<get uri="/customers/{id}" >
<to uri="direct:processGet"/>
</get>
<post uri="/customers" consumes="application/json"
produces="application/json">
<to uri="direct:processPost"/>
</post>
</rest>
{code}
The underlying camel jetty component is configured with sslContextParametersRef
and a Jetty Handler org.eclipse.jetty.security.ConstraintSecurityHandler to
enforce SecurityConstraints on the Jetty endpoint.
If I remove the Jetty ConstraintSecurityHandler, it works fine, for instance:
{code}
<camelContext id="camel" trace="true" streamCache="true"
xmlns="http://camel.apache.org/schema/blueprint";>
<restConfiguration component="jetty" bindingMode="off" scheme="https"
host="localhost" port="9080" contextPath="/">
<endpointProperty key="sslContextParametersRef"
value="sslContextParameter"/>
<!--endpointProperty key="handlers" value="#securityHandler"/-->
<endpointProperty key="matchOnUriPrefix" value="true"/>
</restConfiguration>
{code}
But when I add the Jetty ConstraintSecurityHandler back to the camel Rest DSL,
I am getting following error:
{code}
***
%% Initialized: [Session-1, SSL_NULL_WITH_NULL_NULL]
qtp1424237190-118, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated: [Session-1, SSL_NULL_WITH_NULL_NULL]
qtp1424237190-118, SEND TLSv1 ALERT: fatal, description = handshake_failure
qtp1424237190-118, WRITE: TLSv1 Alert, length = 2
qtp1424237190-118, fatal: engine already closed. Rethrowing
javax.net.ssl.SSLHandshakeException: no cipher suites in common
{code}
The root cause is that if we want to add a Jetty hander, we need to stop Jetty
server. As part of Jetty server stop process, it's SslConnectionFactory also
needs to stop, as well as SslContextFactory. Here is doStop() method of
SslContextFactory in Jetty 9.2.x code base:
{code}
public class SslContextFactory extends AbstractLifeCycle
...
protected void doStop() throws Exception
{
_context = null;
super.doStop();
}
{code}
We can see that it resets SSLContext to null. When the jetty server restarts,
SslContextFactory creates a new SSLContext object instead, therefore, losing
all the SSL properties from the original <camel:sslContextParameters>
configuration.
We need to preserve the SSLContext before stopping the jetty server so we can
reset the SSLContext back after the jetty server is restarted.
was:
I have a camel route using Rest DSL with Jetty component:
{code}
<camelContext id="camel" trace="true" streamCache="true"
xmlns="http://camel.apache.org/schema/blueprint";>
<restConfiguration component="jetty" bindingMode="off" scheme="https"
host="localhost" port="9080" contextPath="/">
<endpointProperty key="sslContextParametersRef"
value="sslContextParameter"/>
<endpointProperty key="handlers" value="#securityHandler"/>
<endpointProperty key="matchOnUriPrefix" value="true"/>
</restConfiguration>
<rest path="/customerservice">
<get uri="/customers" >
<to uri="direct:processGet"/>
</get>
<get uri="/customers/{id}" >
<to uri="direct:processGet"/>
</get>
<post uri="/customers" consumes="application/json"
produces="application/json">
<to uri="direct:processPost"/>
</post>
</rest>
{code}
The underlying camel jetty component is configured with sslContextParametersRef
and a Jetty Handler org.eclipse.jetty.security.ConstraintSecurityHandler to
enforce SecurityConstraints on the Jetty endpoint.
If I remove the Jetty ConstraintSecurityHandler, it works fine, for instance:
{code}
<camelContext id="camel" trace="true" streamCache="true"
xmlns="http://camel.apache.org/schema/blueprint";>
<restConfiguration component="jetty" bindingMode="off" scheme="https"
host="localhost" port="9080" contextPath="/">
<endpointProperty key="sslContextParametersRef"
value="sslContextParameter"/>
<!--endpointProperty key="handlers" value="#securityHandler"/-->
<endpointProperty key="matchOnUriPrefix" value="true"/>
</restConfiguration>
{code}
But when I add the Jetty ConstraintSecurityHandler back to the camel Rest DSL,
I am getting following error:
{code}
***
%% Initialized: [Session-1, SSL_NULL_WITH_NULL_NULL]
qtp1424237190-118, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated: [Session-1, SSL_NULL_WITH_NULL_NULL]
qtp1424237190-118, SEND TLSv1 ALERT: fatal, description = handshake_failure
qtp1424237190-118, WRITE: TLSv1 Alert, length = 2
qtp1424237190-118, fatal: engine already closed. Rethrowing
javax.net.ssl.SSLHandshakeException: no cipher suites in common
{code}
The root cause is that if we want to add a Jetty hander, we need to stop Jetty
server. As part of Jetty server stop process, it's SslConnectionFactory also
needs to stop, as well as SslContextFactory. Here is doStop() method of
SslContextFactory in Jetty 9.2.x code base:
{code}
public class SslContextFactory extends AbstractLifeCycle
...
protected void doStop() throws Exception
{
_context = null;
super.doStop();
}
{code}
We can see that it resets SSLContext to null. When the jetty server restarts,
SslConnectionFactory creates a new SSLContext object instead, therefore, losing
all the SSL properties from the original <camel:sslContextParameters>
configuration.
So we need to preserve the SSLContext before stopping the jetty server and
reset the SSLContext back and then restart it.
> camel jetty9 endpoint configured with sslContextParametersRef and jetty
> handlers causes SSL handshake failure
> -------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-10628
> URL: https://issues.apache.org/jira/browse/CAMEL-10628
> Project: Camel
> Issue Type: Bug
> Components: camel-jetty
> Affects Versions: 2.17.0
> Reporter: Joe Luo
> Attachments: patch.txt
>
>
> I have a camel route using Rest DSL with Jetty component:
> {code}
> <camelContext id="camel" trace="true" streamCache="true"
> xmlns="http://camel.apache.org/schema/blueprint";>
> <restConfiguration component="jetty" bindingMode="off" scheme="https"
> host="localhost" port="9080" contextPath="/">
> <endpointProperty key="sslContextParametersRef"
> value="sslContextParameter"/>
> <endpointProperty key="handlers" value="#securityHandler"/>
> <endpointProperty key="matchOnUriPrefix" value="true"/>
> </restConfiguration>
> <rest path="/customerservice">
> <get uri="/customers" >
> <to uri="direct:processGet"/>
> </get>
> <get uri="/customers/{id}" >
> <to uri="direct:processGet"/>
> </get>
> <post uri="/customers" consumes="application/json"
> produces="application/json">
> <to uri="direct:processPost"/>
> </post>
> </rest>
> {code}
> The underlying camel jetty component is configured with
> sslContextParametersRef and a Jetty Handler
> org.eclipse.jetty.security.ConstraintSecurityHandler to enforce
> SecurityConstraints on the Jetty endpoint.
> If I remove the Jetty ConstraintSecurityHandler, it works fine, for instance:
> {code}
> <camelContext id="camel" trace="true" streamCache="true"
> xmlns="http://camel.apache.org/schema/blueprint";>
> <restConfiguration component="jetty" bindingMode="off" scheme="https"
> host="localhost" port="9080" contextPath="/">
> <endpointProperty key="sslContextParametersRef"
> value="sslContextParameter"/>
> <!--endpointProperty key="handlers" value="#securityHandler"/-->
> <endpointProperty key="matchOnUriPrefix" value="true"/>
> </restConfiguration>
> {code}
> But when I add the Jetty ConstraintSecurityHandler back to the camel Rest
> DSL, I am getting following error:
> {code}
> ***
> %% Initialized: [Session-1, SSL_NULL_WITH_NULL_NULL]
> qtp1424237190-118, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated: [Session-1, SSL_NULL_WITH_NULL_NULL]
> qtp1424237190-118, SEND TLSv1 ALERT: fatal, description = handshake_failure
> qtp1424237190-118, WRITE: TLSv1 Alert, length = 2
> qtp1424237190-118, fatal: engine already closed. Rethrowing
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> {code}
> The root cause is that if we want to add a Jetty hander, we need to stop
> Jetty server. As part of Jetty server stop process, it's SslConnectionFactory
> also needs to stop, as well as SslContextFactory. Here is doStop() method of
> SslContextFactory in Jetty 9.2.x code base:
> {code}
> public class SslContextFactory extends AbstractLifeCycle
> ...
> protected void doStop() throws Exception
> {
> _context = null;
> super.doStop();
> }
> {code}
> We can see that it resets SSLContext to null. When the jetty server restarts,
> SslContextFactory creates a new SSLContext object instead, therefore, losing
> all the SSL properties from the original <camel:sslContextParameters>
> configuration.
> We need to preserve the SSLContext before stopping the jetty server so we can
> reset the SSLContext back after the jetty server is restarted.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
