Apigee OPDK 4.19.06 - OpenJDK 1.8.0.252 Issues

[imesh]

This is to let you know about an issue caused in OpenJDK 8: 1.8.0.252 build. In Apigee OPDK 4.19.06 deployments, if OpenJDK 8: 1.8.0.252 release is used two known issues will occur:

1) API requests sent by Apigee Message Processors to Target Endpoints using TLS will fail with the following exception:

java.lang.NoSuchFieldError: nullSession
at sun.security.ssl.ClientHandshaker.getKickstartMessage(ClientHandshaker.java:1350)
at sun.security.ssl.Handshaker.kickstart(Handshaker.java:1117)
at sun.security.ssl.SSLEngineImpl.kickstartHandshake(SSLEngineImpl.java:736)
at sun.security.ssl.SSLEngineImpl.beginHandshake(SSLEngineImpl.java:758)
at com.apigee.nio.SSLTransport.start(SSLTransport.java:103)
at com.apigee.nio.ClientChannel.enableSSL(ClientChannel.java:182)
at com.apigee.protocol.http.HTTPClient$Context.onConnect2(HTTPClient.java:833)
at com.apigee.protocol.http.HTTPClient$Context.onConnect(HTTPClient.java:807)
at com.apigee.nio.handlers.NIOThread.run(NIOThread.java:206)

2) If TLS is enabled in the Management Server, Management Server will fail to start with the following error:

java.lang.NoClassDefFoundError: org/eclipse/jetty/alpn/ALPN$ServerProvider
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:756)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:468)
at java.net.URLClassLoader.access$100(URLClassLoader.java:74)
at java.net.URLClassLoader$1.run(URLClassLoader.java:369)
at java.net.URLClassLoader$1.run(URLClassLoader.java:363)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:362)
at java.lang.ClassLoader.loadClass(ClassLoader.java:418)

[imesh · Accepted solution]

The first issue has been fixed by Apigee in OPDK v4.19.06.07 patch release. The second issue with the Management Server is still being investigated at the time this post is being written on 1st July 2020 (and as of updated on 7th July 2020).

Therefore, one of the following options could be followed to overcome above issues for the moment:

1. Upgrade OPDK v4.19.06 to OPDK v4.19.06.07 patch release and use previous stable GA release of OpenJDK 8: 1.8.0.242 in all Apigee components.
2. Upgrade OPDK v4.19.06 to OPDK v4.19.06.07 patch release and use OpenJDK 8: 1.8.0.252 in all Apigee components except Management Server if TLS is enabled in the Management Server. The Management Server will need to use OpenJDK 8: 1.8.0.242 until above issue (2) is fixed if TLS is enabled.

Background Information

Apigee Message Processor and Management Server use Eclipse Jetty HTTP library [1] and ALPN (Application-Layer Protocol Negotiation Extension for TLS) [2]. The way Jetty initializes ALPN has changed in OpenJDK 1.8.0_252 release [3]. As a result, Apigee Message Processor and Management Server encountered above issues with OpenJDK 1.8.0_252 release.

• [1] https://www.eclipse.org/jetty/
• [2] https://tools.ietf.org/html/rfc7301
• [3] https://webtide.com/jetty-alpn-java-8u252/

References

• How to Enable TLS in the Management Server: https://docs.apigee.com/private-cloud/v4.19.06/configuring-ssl-management-api
• OpenJDK 8 Releases: https://wiki.openjdk.java.net/display/jdk8u/Main
• Security Issues found in 1.8.0.242: https://snyk.io/vuln/linux:java-1.8.0-openjdk-devel
• Security Fixes done in OpenJDK 1.8.0.252: https://mail.openjdk.java.net/pipermail/jdk8u-dev/2020-April/011566.html

[dchiesa1]

An update.

The "second issue" Imesh described, the one relating to the Management server and compatibility with 1.8.0_252, has been fixed. The reference number is b/159108299 .

release	first patch level containing the fix	date available	link to release notes
4.50.00	4.50.00.01	August 6, 2020	link
4.19.06	4.19.06.08	August 4, 2020	link

Any patch level after these, will also contain the fix.