[ https://issues.apache.org/jira/browse/FELIX-5204?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15175719#comment-15175719 ]
Guillaume Nodet commented on FELIX-5204: ---------------------------------------- We use the Mina SSHD server in Karaf. The problem happens when we restart the framework without restarting the JVM. The reason is that the javax.crypto package has some internal cache about Cipher providers. The providers are cached by the protection domain source code url. See http://hg.openjdk.java.net/jdk7/jdk7/jdk/file/9b8c96f96a0f/src/share/classes/javax/crypto/JceSecurityManager.java#l79 Here's what happens: * the JVM starts, the OSGi framework starts, the SSH bundle is installed with a {{mvn:org.apache.sshd/sshd-core/1.0.0}} url (the url handler is an OSGi url handler, so provided by a pax-url bundle) * when the SSH server starts, the JceSecurityManager caches the Cipher provider with this url * the framework is restarted * when the SSH server starts again, the JceSecurityManager calls {{get}} on the cache indexed by the URL, but the URL in the cache is no longer valid and the {{URLHandlersStreamHandlerProxy.equals}} throws the exception indicated This obviously only happen when the bundle is installed with a {{mvn:org.apache.sshd/sshd-core/1.0.0}} and not a {{file:system/org/apache/sshd/sshd-core/1.0.0/sshd-core-1.0.0.jar}} url. I think it's a bad idea that the BundleProtectionDomain uses a URL which may not be valid after the framework is shutdown. My initial thinking was to use the jar bundle revision path instead, something like {{file:data/cache/bundle32/11.0/bundle.jar}}. It seems that's the way Equinox works fwiw. Especially, if the bundle is updated, I think the 2 code source should be different, and using the original location used to install / update the url does not bring this guarantee. Using the bundle revision instead seems cleaner to me. > IllegalStateException when using custom URL handlers for bundles > ---------------------------------------------------------------- > > Key: FELIX-5204 > URL: https://issues.apache.org/jira/browse/FELIX-5204 > Project: Felix > Issue Type: Bug > Components: Framework > Affects Versions: framework-5.4.0 > Reporter: Guillaume Nodet > Assignee: Guillaume Nodet > Fix For: framework-5.6.0 > > > The following exception can happen after having restarted the whole framework. > {code} > java.lang.IllegalStateException: Stream handler unavailable. > at > org.apache.felix.framework.URLHandlersStreamHandlerProxy.getDefaultPort(URLHandlersStreamHandlerProxy.java:180) > at java.net.URLStreamHandler.sameFile(URLStreamHandler.java:407) > at > org.osgi.service.url.AbstractURLStreamHandlerService.sameFile(AbstractURLStreamHandlerService.java:131) > at java.net.URLStreamHandler.equals(URLStreamHandler.java:333) > at > org.osgi.service.url.AbstractURLStreamHandlerService.equals(AbstractURLStreamHandlerService.java:81) > at > org.apache.felix.framework.URLHandlersStreamHandlerProxy.equals(URLHandlersStreamHandlerProxy.java:163) > at java.net.URL.equals(URL.java:870) > at > java.util.concurrent.ConcurrentHashMap.get(ConcurrentHashMap.java:940) > at > javax.crypto.JceSecurityManager.getCryptoPermission(JceSecurityManager.java:124) > at javax.crypto.Cipher.getConfiguredPermission(Cipher.java:2587) > at javax.crypto.Cipher.initCryptoPermission(Cipher.java:700) > at javax.crypto.Cipher.chooseProvider(Cipher.java:863) > at javax.crypto.Cipher.init(Cipher.java:1396) > at javax.crypto.Cipher.init(Cipher.java:1327) > at org.apache.sshd.common.cipher.BaseCipher.init(BaseCipher.java:60) > at org.apache.karaf.shell.ssh.SshUtils.buildCiphers(SshUtils.java:89) > at > org.apache.karaf.shell.ssh.Activator.createSshServer(Activator.java:183) > at org.apache.karaf.shell.ssh.Activator.doStart(Activator.java:111) > at > org.apache.karaf.util.tracker.BaseActivator.run(BaseActivator.java:233) > at > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > at java.util.concurrent.FutureTask.run(FutureTask.java:266) > at > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > at > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > at java.lang.Thread.run(Thread.java:745) > {code} > The problems seems to be that the ProtectionDomain of the classes loaded from > bundles do use the URL handler as their code source. This means that any > access to those URL will throw IllegalStateException after the framework has > been shutdown. > The protection domain should use the url the jar from the filesystem for the > code source url instead. -- This message was sent by Atlassian JIRA (v6.3.4#6332)