Jan Høydahl created SOLR-18646:
----------------------------------
Summary: bin/solr.cmd builds javax.net.ssl.keyStoreParentPath from
the keystore type, not its path
Key: SOLR-18646
URL: https://issues.apache.org/jira/browse/SOLR-18646
Project: Solr
Issue Type: Bug
Components: cli
Reporter: Jan Høydahl
*Found by CATS*, the cross-platform CLI test framework proposed in SOLR-18642 —
see [PR #5323|https://github.com/apache/solr/pull/5323]. Two tests there expose
this, and will be marked {{@AwaitsFix}} against this issue so the suite stays
green. A fix can land before CATS is merged or after; nothing in that PR
depends on it. If it lands first, please also drop the {{@AwaitsFix}}
annotation from those two tests on that PR.
h3. The bug
{{bin/solr.cmd}} line 159 builds the security-manager grant for the *client*
keystore from the keystore's type rather than its path:
{code}
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS!
-Djavax.net.ssl.keyStoreParentPath=%SOLR_SSL_CLIENT_KEY_STORE_TYPE%/.."
{code}
{{SOLR_SSL_CLIENT_KEY_STORE_TYPE}} holds a format name such as {{PKCS12}}, so
the property resolves to {{PKCS12/..}} — a relative path unrelated to where the
keystore lives.
Two places in the tree show what was meant. {{bin/solr}} line 265 uses the path:
{code}
SOLR_SSL_OPTS+="
-Djavax.net.ssl.keyStoreParentPath=$SOLR_SSL_CLIENT_KEY_STORE/.."
{code}
and {{solr.cmd}} itself gets the *server* keystore right, forty lines earlier
at line 121:
{code}
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS!
-Dsolr.jetty.keystoreParentPath=%SOLR_SSL_KEY_STORE%/.."
{code}
h3. Effect: SSL plus the security manager cannot work on Windows
The grant exists so Jetty can read the directory holding the keystore, for the
reload added in SOLR-16743. Pointed at the wrong directory, the node dies
during startup:
{code}
ERROR (main) o.a.s.s.CoreContainerProvider Could not start Solr. Check
solr/home property and the logs
org.apache.solr.common.SolrException: Error instantiating shardHandlerFactory
class
[HttpShardHandlerFactory]: access denied ("java.io.FilePermission"
"...\work\SslTest\startSolrWithMtlsNeeded\ssl\client" "read")
Caused by: java.security.AccessControlException: access denied (...)
{code}
The directory named in the exception is exactly the one holding the client
keystore. {{solr start}} then reports failure once its wait expires, and the
node never serves. Reproduced on Windows 11 ARM64 with a JDK 21; note both
scripts disable the security manager outright on JDK 24 and later, so this
affects JDK 21 to 23.
Not covered by a test on either platform today.
🤖 AI Assisted
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
