[jira] [Resolved] (CAMEL-25314) camel-cxf, camel-cxfrs - a suspended consumer keeps accepting and routing new requests (graceful shutdown, suspendRoute, route policies)

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25314?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen resolved CAMEL-25314.
---------------------------------
    Resolution: Fixed

Merged in https://github.com/apache/camel/pull/27390 (commit 8e4d1c2a0e84) for 4.23.0.

_Claude Code on behalf of davsclaus_

> camel-cxf, camel-cxfrs - a suspended consumer keeps accepting and routing new requests (graceful shutdown, suspendRoute, route policies)
> ----------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-25314
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25314
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-cxf, camel-cxfrs
>            Reporter: shashank
>            Assignee: shashank
>            Priority: Minor
>             Fix For: 4.23.0
>
>
> Since CAMEL-12870 {{CxfConsumer}} and {{CxfRsConsumer}} implement {{Suspendable}}: {{DefaultShutdownStrategy}} suspends them instead of stopping them, defers their shutdown until no exchange is inflight, and the CXF server stays up so the requests in flight can still send their responses. But neither consumer has suspend logic, and their invokers ({{CxfConsumer.CxfConsumerInvoker.invoke}}, {{CxfRsInvoker.performInvocation}}) never check the status, so a suspended consumer keeps accepting and routing *new* requests:
> * graceful shutdown: with a steady flow of requests the number of inflight exchanges does not drop to 0, so the route (or the CamelContext) is only stopped at the shutdown timeout, and the requests in flight at that moment are forced; the requests accepted during the shutdown are processed by a stopping application;
> * {{suspendRoute}} (route controller, JMX) and the route policies that suspend the consumer ({{ThrottlingInflightRoutePolicy}}, {{ThrottlingExceptionRoutePolicy}}): nothing is held back.
> The HTTP consumers (servlet, jetty, undertow, netty-http, platform-http) answer 503 (Service Unavailable) while they are suspended.
> h3. Reproduction
> {{CxfConsumerSuspendTest}} (camel-cxf-soap) and {{CxfRsConsumerSuspendTest}} (camel-cxf-rest), on main:
> {noformat}
> CxfConsumerSuspendTest.testSuspendedRouteRejectsRequests: suspendRoute, then a request
>   A suspended route must not accept a request ==> Expected java.lang.Exception to be thrown, but nothing was thrown.
> CxfConsumerSuspendTest.testGracefulStopCompletesInflightAndRejectsNewRequests: request A blocks in the route,
>   stopRoute (graceful) suspends the consumer, request B is sent
>   A request received while stopping must be rejected ==> Expected java.lang.Exception to be thrown, but nothing was thrown.
> CxfRsConsumerSuspendTest.testSuspendedRouteRejectsRequests:
>   A suspended route must answer 503 ==> expected: <503> but was: <200>
> CxfRsConsumerSuspendTest.testGracefulStopCompletesInflightAndRejectsNewRequests (asynchronous request in flight):
>   A request received while stopping must be rejected ==> expected: <503> but was: <200>
> {noformat}
> With the fix the rejected requests get HTTP 503, request A (asynchronous, its continuation resumes after the suspend) still gets its response, and the route stops. No sleeps: latches, Awaitility.
> The defect was found with a TLA+ model of the consumer under a graceful shutdown / route suspend, with synchronous and asynchronous (continuation) requests: "a suspended consumer takes no new work" is violated in 3 steps (suspend, a request arrives, it is admitted). The property of CAMEL-12870, "the consumer is only stopped when nothing is inflight", holds on the current code and with the fix. A fix that also rejected resumed continuations would lose the responses of the requests in flight (shown by the model: "an admitted request gets its response" violated), so the fix only rejects new invocations.
> h3. Proposed fix
> In both invokers, reject a new invocation (synchronous, or a continuation that {{isNew()}}) while the consumer {{isSuspendingOrSuspended()}}: {{CxfConsumer}} throws a {{Fault}} with status code 503 (CXF's {{PhaseInterceptorChain}} logs it at WARN with the stack trace, as it does for any undeclared fault, e.g. a route failure; making it quieter would need {{FaultMode.CHECKED_APPLICATION_FAULT}}, which also drives WS-Addressing, WS-RM and the management counters, so it is left as is), {{CxfRsInvoker}} returns a 503 {{Response}} (a {{WebApplicationException}} is logged at WARN with its stack trace by CXF's {{WebApplicationExceptionMapper}}, once per rejected request). {{CxfRsInvoker}} still skips the continuation lookup for a sub resource locator invocation (its sub resource method is checked next). A resumed continuation is always completed. CAMEL-12870 only added {{implements Suspendable}} (no discussion on the ticket); its purpose, completing the requests in flight, is kept.
> Upgrade guide note, as a {{====}} subsection of the existing {{=== camel-cxf}} section (a suspended CXF consumer answers 503 to new requests).
> With the fix the new tests and the camel-cxf-soap (168, 2 skipped), camel-cxf-rest (51), camel-cxf-spring-soap (161, 3 skipped) and camel-cxf-spring-rest (111) suites pass.
> Affected: 4.14.x, 4.18.x and main (same code, GitHub contents API), since 2.21.3 / 2.22.2 / 2.23.0.
> Duplicate check (2026-10-04): JIRA "cxf" with 503 / "graceful shutdown" / suspended (CAMEL-12870 above; CAMEL-18528 SpringBus shutdown order; CAMEL-24179 continuation timeout race; none about new requests while suspended). GitHub pull requests "cxf suspend", "CxfRsInvoker": none about this; the open draft #22358 (CAMEL-20009, getOut replacement) changes other lines of {{CxfRsInvoker}} (imports, {{prepareExchange}}).
> _Filed with Claude Code on behalf of allthingssecurity._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)