[JBoss JIRA] (ELY-1664) Trace logging in SSLUtils
by Martin Choma (JIRA)
Martin Choma created ELY-1664:
---------------------------------
Summary: Trace logging in SSLUtils
Key: ELY-1664
URL: https://issues.jboss.org/browse/ELY-1664
Project: WildFly Elytron
Issue Type: Bug
Components: SSL
Affects Versions: 1.6.0.Final
Reporter: Martin Choma
Check Trace logging of ssl context creation. How I read code logging should apply after throw expression. That wouldn never happen. Also there is another throw of exception with SSLUtils::throwIt.
{code:java|title=org.wildfly.security.ssl.SSLUtils}
// now return a factory that will return the best match is can create.
final String[] supportedProtocols = protocolSelector.evaluate(preferredProviderByAlgorithm.keySet().toArray(NO_STRINGS));
if (supportedProtocols.length > 0) {
return () -> {
for (String protocol : supportedProtocols) {
List<Provider> providerList = preferredProviderByAlgorithm.getOrDefault(protocol, Collections.emptyList());
for (Provider provider : providerList) {
try {
return SSLContext.getInstance(protocol, provider);
} catch (NoSuchAlgorithmException ignored) {}
}
}
throw ElytronMessages.log.noAlgorithmForSslProtocol();
};
}
if (log.isTraceEnabled()) {
log.tracef("No %s provided by providers in %s: %s", SERVICE_TYPE, SSLUtils.class.getSimpleName(), Arrays.toString(providerSupplier.get()));
}
return SSLUtils::throwIt;
{code}
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 10 months
[JBoss JIRA] (DROOLS-2985) Jenkins PR build of optaweb-employee-rostering should not build kie-server too
by Marek Novotny (JIRA)
[ https://issues.jboss.org/browse/DROOLS-2985?page=com.atlassian.jira.plugi... ]
Marek Novotny commented on DROOLS-2985:
---------------------------------------
I agree the downstream build is affecting our workflow significantly. But I can see your issue is not downstream build job. This should work without required needs to build it. The other issue I can see is that yesterday I merged PR which was not ready and I reverted it immediately when [~rsynek] and i noticed that. So here it is just an exception to our CI environment issues.
I launched the new build and if that passes I will close this jira
> Jenkins PR build of optaweb-employee-rostering should not build kie-server too
> ------------------------------------------------------------------------------
>
> Key: DROOLS-2985
> URL: https://issues.jboss.org/browse/DROOLS-2985
> Project: Drools
> Issue Type: Task
> Components: build
> Reporter: Geoffrey De Smet
> Assignee: Ant Stephenson
> Priority: Blocker
>
> When building this PR:
> https://github.com/kiegroup/optaweb-employee-rostering/pull/187
> It gave this error:
> {code}
> 13:44:42 [ERROR] [ERROR] Some problems were encountered while processing the POMs:
> 13:44:42 [ERROR] 'dependencies.dependency.version' for org.jboss.narayana.tomcat:tomcat-jta:jar is missing. @ org.kie.server:kie-server:[unknown-version], /home/jenkins/workspace/KIE/master/pullrequest/optaweb-employee-rostering-pullrequests/upstream-repos/droolsjbpm-integration/kie-server-parent/kie-server-wars/kie-server/pom.xml, line 264, column 17
> 13:44:42 @
> 13:44:42 [ERROR] The build could not read 1 project -> [Help 1]
> 13:44:42 org.apache.maven.project.ProjectBuildingException: Some problems were encountered while processing the POMs:
> 13:44:42 [ERROR] 'dependencies.dependency.version' for org.jboss.narayana.tomcat:tomcat-jta:jar is missing. @ org.kie.server:kie-server:[unknown-version], /home/jenkins/workspace/KIE/master/pullrequest/optaweb-employee-rostering-pullrequests/upstream-repos/droolsjbpm-integration/kie-server-parent/kie-server-wars/kie-server/pom.xml, line 264, column 17
> {code}
> but optaweb-employee-rostering doesn't rely on droolsjbpm-integration, so building that repo too is just delaying our ability to merge fast, as well as introducing false negatives.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 10 months
[JBoss JIRA] (ELY-1663) BC FIPS, Solaris 11 sparc ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/ELY-1663?page=com.atlassian.jira.plugin.s... ]
Martin Choma updated ELY-1663:
------------------------------
Description:
On Solaris 11 sparc http management interface secured with TLS fails with BC FIPS
{code}
Operation {"operation" => "add","address" => [("subsystem" => "elytron"),("server-ssl-context" => "test-server-ssl-context")],"key-manager" => "key-manager-name_test-server-ssl-context","cipher-suite-filter" => "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256","trust-manager" => "trust-manager-name_test-server-ssl-context","protocols" => ["TLSv1.2"],"need-client-auth" => true} failed: {"outcome" => "failed","failure-description" => {"WFLYCTL0080: Failed services" => {"org.wildfly.security.ssl-context.test-server-ssl-context" => "java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
Caused by: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria"}},"rolled-back" => true}
ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service org.wildfly.security.ssl-context.test-server-ssl-context: org.jboss.msc.service.StartException in service org.wildfly.security.ssl-context.test-server-ssl-context: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
at org.wildfly.extension.elytron.SSLDefinitions$6.lambda$getValueSupplier$1(SSLDefinitions.java:982)
at org.wildfly.extension.elytron.TrivialService.start(TrivialService.java:53)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1736)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1698)
at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1556)
at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
at org.wildfly.security.ssl.SSLUtils.lambda$createSslContextFactory$1(SSLUtils.java:130)
at org.wildfly.security.ssl.SSLContextBuilder.lambda$build$0(SSLContextBuilder.java:340)
at org.wildfly.security.OneTimeSecurityFactory.create(OneTimeSecurityFactory.java:53)
at org.wildfly.extension.elytron.SSLDefinitions$6.lambda$getValueSupplier$1(SSLDefinitions.java:980)
... 9 more
{code}
Some facts
* It happends only on BC FIPS management interface TLS tests and on Solaris 11 sparc
* BC FIPS Management interface TLS tests work on all other tested platforms
* TLSv1.2 protocol works with Undertow on Solaris 11 sparc
* Previously there was issue with similar error but that happened everywhere https://issues.jboss.org/browse/ELY-1618
was:
On Solaris 11 sparc http management interface secured with TLS fails with BC FIPS
{code}
Operation {"operation" => "add","address" => [("subsystem" => "elytron"),("server-ssl-context" => "test-server-ssl-context")],"key-manager" => "key-manager-name_test-server-ssl-context","cipher-suite-filter" => "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256","trust-manager" => "trust-manager-name_test-server-ssl-context","protocols" => ["TLSv1.2"],"need-client-auth" => true} failed: {"outcome" => "failed","failure-description" => {"WFLYCTL0080: Failed services" => {"org.wildfly.security.ssl-context.test-server-ssl-context" => "java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
Caused by: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria"}},"rolled-back" => true}
ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service org.wildfly.security.ssl-context.test-server-ssl-context: org.jboss.msc.service.StartException in service org.wildfly.security.ssl-context.test-server-ssl-context: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
at org.wildfly.extension.elytron.SSLDefinitions$6.lambda$getValueSupplier$1(SSLDefinitions.java:982)
at org.wildfly.extension.elytron.TrivialService.start(TrivialService.java:53)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1736)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1698)
at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1556)
at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
at org.wildfly.security.ssl.SSLUtils.lambda$createSslContextFactory$1(SSLUtils.java:130)
at org.wildfly.security.ssl.SSLContextBuilder.lambda$build$0(SSLContextBuilder.java:340)
at org.wildfly.security.OneTimeSecurityFactory.create(OneTimeSecurityFactory.java:53)
at org.wildfly.extension.elytron.SSLDefinitions$6.lambda$getValueSupplier$1(SSLDefinitions.java:980)
... 9 more
{code}
Some facts
* It happends only on BC FIPS management interface TLS tests and on Solaris 11 sparc
* BC FIPS Management interface TLS tests work on all other tested platforms
* TLSv1.2 protocol works with Undertow on Solaris 11 sparc
* Previously there was issue with similar error but that happened everywhere https://issues.jboss.org/browse/ELY-1618
On the subject, unfortunately, trace logging of affected code is probably not good. How I read code logging should apply after throw expression. That wouldn never happen. Also there is another throw of exception with SSLUtils::throwIt.
{code}
// now return a factory that will return the best match is can create.
final String[] supportedProtocols = protocolSelector.evaluate(preferredProviderByAlgorithm.keySet().toArray(NO_STRINGS));
if (supportedProtocols.length > 0) {
return () -> {
for (String protocol : supportedProtocols) {
List<Provider> providerList = preferredProviderByAlgorithm.getOrDefault(protocol, Collections.emptyList());
for (Provider provider : providerList) {
try {
return SSLContext.getInstance(protocol, provider);
} catch (NoSuchAlgorithmException ignored) {}
}
}
throw ElytronMessages.log.noAlgorithmForSslProtocol();
};
}
if (log.isTraceEnabled()) {
log.tracef("No %s provided by providers in %s: %s", SERVICE_TYPE, SSLUtils.class.getSimpleName(), Arrays.toString(providerSupplier.get()));
}
return SSLUtils::throwIt;
{code}
> BC FIPS, Solaris 11 sparc ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
> ---------------------------------------------------------------------------------------------------
>
> Key: ELY-1663
> URL: https://issues.jboss.org/browse/ELY-1663
> Project: WildFly Elytron
> Issue Type: Bug
> Components: SSL
> Affects Versions: 1.6.0.Final
> Reporter: Martin Choma
> Priority: Critical
>
> On Solaris 11 sparc http management interface secured with TLS fails with BC FIPS
> {code}
> Operation {"operation" => "add","address" => [("subsystem" => "elytron"),("server-ssl-context" => "test-server-ssl-context")],"key-manager" => "key-manager-name_test-server-ssl-context","cipher-suite-filter" => "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256","trust-manager" => "trust-manager-name_test-server-ssl-context","protocols" => ["TLSv1.2"],"need-client-auth" => true} failed: {"outcome" => "failed","failure-description" => {"WFLYCTL0080: Failed services" => {"org.wildfly.security.ssl-context.test-server-ssl-context" => "java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
> Caused by: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria"}},"rolled-back" => true}
> ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service org.wildfly.security.ssl-context.test-server-ssl-context: org.jboss.msc.service.StartException in service org.wildfly.security.ssl-context.test-server-ssl-context: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
> at org.wildfly.extension.elytron.SSLDefinitions$6.lambda$getValueSupplier$1(SSLDefinitions.java:982)
> at org.wildfly.extension.elytron.TrivialService.start(TrivialService.java:53)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1736)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1698)
> at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1556)
> at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
> at org.wildfly.security.ssl.SSLUtils.lambda$createSslContextFactory$1(SSLUtils.java:130)
> at org.wildfly.security.ssl.SSLContextBuilder.lambda$build$0(SSLContextBuilder.java:340)
> at org.wildfly.security.OneTimeSecurityFactory.create(OneTimeSecurityFactory.java:53)
> at org.wildfly.extension.elytron.SSLDefinitions$6.lambda$getValueSupplier$1(SSLDefinitions.java:980)
> ... 9 more
> {code}
> Some facts
> * It happends only on BC FIPS management interface TLS tests and on Solaris 11 sparc
> * BC FIPS Management interface TLS tests work on all other tested platforms
> * TLSv1.2 protocol works with Undertow on Solaris 11 sparc
> * Previously there was issue with similar error but that happened everywhere https://issues.jboss.org/browse/ELY-1618
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 10 months
[JBoss JIRA] (WFLY-10986) Concurrent Modification Exception when starting server with external JMS broker
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFLY-10986?page=com.atlassian.jira.plugin... ]
Kabir Khan reassigned WFLY-10986:
---------------------------------
Assignee: Kabir Khan (was: Stefano Maestri)
> Concurrent Modification Exception when starting server with external JMS broker
> -------------------------------------------------------------------------------
>
> Key: WFLY-10986
> URL: https://issues.jboss.org/browse/WFLY-10986
> Project: WildFly
> Issue Type: Bug
> Components: JCA, JMS
> Affects Versions: 14.0.1.Final
> Reporter: Martin Styk
> Assignee: Kabir Khan
> Priority: Blocker
> Fix For: 15.0.0.Alpha1
>
>
> Start of a WildFly with resource adapter configured to remote messaging broker sometimes fails with following error.
> {code}
> ERROR [org.jboss.msc.service.fail] (MSC service thread 1-4) MSC000001: Failed to start service jboss.resourceadapters.ra."wmq.jmsra".CF: org.jboss.msc.service.StartException in service jboss.resourceadapters.ra."wmq.jmsra".CF: Failed to start service
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1728)
> at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1556)
> at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1364)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.util.ConcurrentModificationException
> at java.util.ArrayList$Itr.checkForComodification(ArrayList.java:909)
> at java.util.ArrayList$Itr.next(ArrayList.java:859)
> at java.util.Collections$UnmodifiableCollection$1.next(Collections.java:1042)
> at org.jboss.as.connector.metadata.api.resourceadapter.ActivationSecurityUtil.isLegacySecurityRequired(ActivationSecurityUtil.java:41)
> at org.jboss.as.connector.subsystems.resourceadapters.ConnectionDefinitionService.start(ConnectionDefinitionService.java:68)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1736)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1698)
> ... 6 more
> {code}
> This issue was introduced in fix for WFLY-9978 in [this commit |https://github.com/ehsavoie/wildfly/commit/8d35c77130c8ba8c47008e1de1225971fa5d8c2e]
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 10 months