You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@ignite.apache.org by styriver <Sc...@mgic.com> on 2016/10/12 15:30:10 UTC
Random SSL unsupported record version
This is happening randomly but seeing this exception during cache updates
Caused by: javax.net.ssl.SSLException: Unsupported record version
Unknown-10.6
This is what the configuration looks like. Using default values for Key
algorithm and protocols. All apps running under Java 1.8. Verbose output
from keytool shows certificate fingerprints:
MD5
SHA1
SHA256
Signature Algorithm: SHA1withRSA
private SslContextFactory initializeSecurity ()
{
SslContextFactory sslFactory = new SslContextFactory();
EncryptionHelper helper = new EncryptionHelper(seed);
char[] decrypted = helper.decrypt(keystoreValue).toCharArray();
if (isClientMode()) {
sslFactory.setKeyStoreFilePath(getKeystorePath() + "/" +
"ignite-client.jks");
sslFactory.setKeyStorePassword(decrypted);
sslFactory.setTrustManagers(SslContextFactory.getDisabledTrustManager());
} else {
sslFactory.setKeyStoreFilePath(getKeystorePath() + "/" +
"ignite-server.jks");
sslFactory.setKeyStorePassword(decrypted);
sslFactory.setTrustStoreFilePath(getKeystorePath() + "/" +
"ignite-trust.jks");
sslFactory.setTrustStorePassword(decrypted);
}
return sslFactory;
}
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.
Re: Random SSL unsupported record version
Posted by styriver <Sc...@mgic.com>.
Hello late last week we went to git and built the 1.8 snapshot versions. We
are still seeing the same random exception.
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236p8674.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.
Re: Random SSL unsupported record version
Posted by vkulichenko <va...@gmail.com>.
Hi,
I think I found the reason for this error. Here is the ticket that you can
watch: https://issues.apache.org/jira/browse/IGNITE-4110
-Val
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236p8487.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.
Re: Random SSL unsupported record version
Posted by styriver <Sc...@mgic.com>.
I created new certificates with the 1024 key size. I still see the exception.
I am including the full stack trace this time. I am assuming that the issues
are noise related to the unsupported record version.
2016-10-18 09:06:46,047|ERROR|cm:r4:d60364751
|onversionStatusCacheServiceImpl| 128|updatePageCount
|Failed to update page count for document "60364751"
javax.cache.CacheException: Failed to send message (node may have left the
grid or TCP connection cannot be established due to firewall issues)
[node=TcpDiscoveryNode [id=5b963622-e822-4f96-a584-497852c9ef98,
addrs=[0:0:0:0:0:0:0:1%lo, 127.0.0.1, 172.22.189.21],
sockAddrs=[/0:0:0:0:0:0:0:1%lo:47500, /127.0.0.1:47500,
sheared.xxx.net/172.22.189.21:47500], discPort=47500, order=2, intOrder=2,
lastExchangeTime=1476729490112, loc=false, ver=1.7.0#20160801-sha1:383273e3,
isClient=false], topic=TOPIC_CACHE, msg=GridNearLockRequest
[topVer=AffinityTopologyVersion [topVer=7, minorTopVer=0],
miniId=63b84f3d751-9e2235c7-2789-4c6f-9ae3-8bdb32799dd8, implicitTx=false,
implicitSingleTx=false, onePhaseCommit=false, dhtVers=[null], subjId=null,
taskNameHash=0, hasTransforms=false, syncCommit=false, accessTtl=-1,
retVal=true, firstClientReq=true, filter=null,
super=GridDistributedLockRequest
[nodeId=02ba0cfc-b7d6-4c74-9a92-45bcb45c7ec9, nearXidVer=GridCacheVersion
[topVer=88199446, time=1476799601721, order=1476729625723, nodeOrder=5],
threadId=199, futId=53b84f3d751-9e2235c7-2789-4c6f-9ae3-8bdb32799dd8,
timeout=0, isInTx=false, isInvalidate=false, isRead=false, isolation=null,
retVals=[true], txSize=1, flags=0, keysCnt=1,
super=GridDistributedBaseMessage [ver=GridCacheVersion [topVer=88199446,
time=1476799601721, order=1476729625723, nodeOrder=5], committedVers=null,
rolledbackVers=null, cnt=1, super=GridCacheMessage [msgId=81, depInfo=null,
err=null, skipPrepare=false, cacheId=-486088806, cacheId=-486088806]]]],
policy=2]
at
org.apache.ignite.internal.processors.cache.CacheLockImpl.lock(CacheLockImpl.java:79)
at
com.xxx.documentviewer.imaging.cache.service.IgniteConversionStatusCacheServiceImpl.updatePageCount(IgniteConversionStatusCacheServiceImpl.java:117)
at
com.xxx.imageprocessor.service.impl.ClientResponderCacheImpl.sendPageCount(ClientResponderCacheImpl.java:24)
at
com.xxx.imageprocessor.service.impl.ConversionManagerHelper.tiffToRenderedImage(ConversionManagerHelper.java:125)
at
com.xxx.imageprocessor.service.impl.ConversionManagerImpl.processConversion(ConversionManagerImpl.java:52)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at
org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)
at
org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)
at
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
at
org.springframework.aop.interceptor.AsyncExecutionInterceptor$1.call(AsyncExecutionInterceptor.java:108)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: class org.apache.ignite.IgniteCheckedException: Failed to send
message (node may have left the grid or TCP connection cannot be established
due to firewall issues) [node=TcpDiscoveryNode
[id=5b963622-e822-4f96-a584-497852c9ef98, addrs=[0:0:0:0:0:0:0:1%lo,
127.0.0.1, 172.22.189.21], sockAddrs=[/0:0:0:0:0:0:0:1%lo:47500,
/127.0.0.1:47500, sheared.xxx.net/172.22.189.21:47500], discPort=47500,
order=2, intOrder=2, lastExchangeTime=1476729490112, loc=false,
ver=1.7.0#20160801-sha1:383273e3, isClient=false], topic=TOPIC_CACHE,
msg=GridNearLockRequest [topVer=AffinityTopologyVersion [topVer=7,
minorTopVer=0], miniId=63b84f3d751-9e2235c7-2789-4c6f-9ae3-8bdb32799dd8,
implicitTx=false, implicitSingleTx=false, onePhaseCommit=false,
dhtVers=[null], subjId=null, taskNameHash=0, hasTransforms=false,
syncCommit=false, accessTtl=-1, retVal=true, firstClientReq=true,
filter=null, super=GridDistributedLockRequest
[nodeId=02ba0cfc-b7d6-4c74-9a92-45bcb45c7ec9, nearXidVer=GridCacheVersion
[topVer=88199446, time=1476799601721, order=1476729625723, nodeOrder=5],
threadId=199, futId=53b84f3d751-9e2235c7-2789-4c6f-9ae3-8bdb32799dd8,
timeout=0, isInTx=false, isInvalidate=false, isRead=false, isolation=null,
retVals=[true], txSize=1, flags=0, keysCnt=1,
super=GridDistributedBaseMessage [ver=GridCacheVersion [topVer=88199446,
time=1476799601721, order=1476729625723, nodeOrder=5], committedVers=null,
rolledbackVers=null, cnt=1, super=GridCacheMessage [msgId=81, depInfo=null,
err=null, skipPrepare=false, cacheId=-486088806, cacheId=-486088806]]]],
policy=2]
at
org.apache.ignite.internal.managers.communication.GridIoManager.send(GridIoManager.java:1309)
at
org.apache.ignite.internal.managers.communication.GridIoManager.send(GridIoManager.java:1373)
at
org.apache.ignite.internal.processors.cache.GridCacheIoManager.send(GridCacheIoManager.java:831)
at
org.apache.ignite.internal.processors.cache.distributed.dht.colocated.GridDhtColocatedLockFuture.proceedMapping0(GridDhtColocatedLockFuture.java:1046)
at
org.apache.ignite.internal.processors.cache.distributed.dht.colocated.GridDhtColocatedLockFuture.proceedMapping(GridDhtColocatedLockFuture.java:997)
at
org.apache.ignite.internal.processors.cache.distributed.dht.colocated.GridDhtColocatedLockFuture.map0(GridDhtColocatedLockFuture.java:987)
at
org.apache.ignite.internal.processors.cache.distributed.dht.colocated.GridDhtColocatedLockFuture.map(GridDhtColocatedLockFuture.java:746)
at
org.apache.ignite.internal.processors.cache.distributed.dht.colocated.GridDhtColocatedLockFuture.mapOnTopology(GridDhtColocatedLockFuture.java:705)
at
org.apache.ignite.internal.processors.cache.distributed.dht.colocated.GridDhtColocatedLockFuture.map(GridDhtColocatedLockFuture.java:652)
at
org.apache.ignite.internal.processors.cache.distributed.dht.colocated.GridDhtColocatedCache.lockAllAsync(GridDhtColocatedCache.java:636)
at
org.apache.ignite.internal.processors.cache.distributed.GridDistributedCacheAdapter.lockAllAsync(GridDistributedCacheAdapter.java:117)
at
org.apache.ignite.internal.processors.cache.GridCacheAdapter.lockAll(GridCacheAdapter.java:3303)
at
org.apache.ignite.internal.processors.cache.CacheLockImpl.lock(CacheLockImpl.java:74)
... 16 more
Caused by: class org.apache.ignite.spi.IgniteSpiException: Failed to send
message to remote node: TcpDiscoveryNode
[id=5b963622-e822-4f96-a584-497852c9ef98, addrs=[0:0:0:0:0:0:0:1%lo,
127.0.0.1, 172.22.189.21], sockAddrs=[/0:0:0:0:0:0:0:1%lo:47500,
/127.0.0.1:47500, sheared.xxx.net/172.22.189.21:47500], discPort=47500,
order=2, intOrder=2, lastExchangeTime=1476729490112, loc=false,
ver=1.7.0#20160801-sha1:383273e3, isClient=false]
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.sendMessage0(TcpCommunicationSpi.java:1996)
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.sendMessage(TcpCommunicationSpi.java:1936)
at
org.apache.ignite.internal.managers.communication.GridIoManager.send(GridIoManager.java:1304)
... 28 more
Caused by: class org.apache.ignite.IgniteCheckedException: Failed to connect
to node (is node still alive?). Make sure that each ComputeTask and cache
Transaction has a timeout set in order to prevent parties from waiting
forever in case of network issues
[nodeId=5b963622-e822-4f96-a584-497852c9ef98,
addrs=[sheared.xxx.net/172.22.189.21:47100, /0:0:0:0:0:0:0:1%lo:47100,
/127.0.0.1:47100]]
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.createTcpClient(TcpCommunicationSpi.java:2499)
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.createNioClient(TcpCommunicationSpi.java:2140)
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.reserveClient(TcpCommunicationSpi.java:2034)
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.sendMessage0(TcpCommunicationSpi.java:1970)
... 30 more
Suppressed: class org.apache.ignite.IgniteCheckedException: Failed to
connect to address: sheared.xxx.net/172.22.189.21:47100
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.createTcpClient(TcpCommunicationSpi.java:2504)
... 33 more
Caused by: class org.apache.ignite.IgniteCheckedException: Failed to read
from channel.
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.safeHandshake(TcpCommunicationSpi.java:2735)
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.createTcpClient(TcpCommunicationSpi.java:2371)
... 33 more
Caused by: javax.net.ssl.SSLException: Unsupported record version
Unknown-4.6
at sun.security.ssl.InputRecord.checkRecordVersion(InputRecord.java:552)
at
sun.security.ssl.EngineInputRecord.bytesInCompletePacket(EngineInputRecord.java:113)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:868)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at
org.apache.ignite.internal.util.nio.ssl.BlockingSslHandler.unwrap0(BlockingSslHandler.java:397)
at
org.apache.ignite.internal.util.nio.ssl.BlockingSslHandler.unwrapHandshake(BlockingSslHandler.java:363)
at
org.apache.ignite.internal.util.nio.ssl.BlockingSslHandler.handshake(BlockingSslHandler.java:149)
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.safeHandshake(TcpCommunicationSpi.java:2578)
... 34 more
Suppressed: class org.apache.ignite.IgniteCheckedException: Failed to
connect to address: /0:0:0:0:0:0:0:1%lo:47100
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.createTcpClient(TcpCommunicationSpi.java:2504)
... 33 more
Caused by: class org.apache.ignite.IgniteCheckedException: Remote node ID
is not as expected [expected=5b963622-e822-4f96-a584-497852c9ef98,
rcvd=02ba0cfc-b7d6-4c74-9a92-45bcb45c7ec9]
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.safeHandshake(TcpCommunicationSpi.java:2614)
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.createTcpClient(TcpCommunicationSpi.java:2371)
... 33 more
Suppressed: class org.apache.ignite.IgniteCheckedException: Failed to
connect to address: /127.0.0.1:47100
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.createTcpClient(TcpCommunicationSpi.java:2504)
... 33 more
Caused by: class org.apache.ignite.IgniteCheckedException: Remote node ID
is not as expected [expected=5b963622-e822-4f96-a584-497852c9ef98,
rcvd=02ba0cfc-b7d6-4c74-9a92-45bcb45c7ec9]
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.safeHandshake(TcpCommunicationSpi.java:2614)
at
org.apache.ignite.spi.communication.tcp.TcpCommunicationSpi.createTcpClient(TcpCommunicationSpi.java:2371)
... 33 more
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236p8349.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.
Re: Random SSL unsupported record version
Posted by styriver <Sc...@mgic.com>.
Well like I said the certificates I am using were from the ignite
distribution. So if you used keytool to generate then I am assuming it is
1024. Are you saying I should try to create certificates that are less than
1024? Is this a bug in Ignite or java itself?
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236p8305.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.
Re: Random SSL unsupported record version
Posted by vkulichenko <va...@gmail.com>.
Hi,
I meant RSA (or other algorithm you use) key length in bytes. By default
keytool uses 1024, but in case of longer keys you can get such an exception.
-Val
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236p8300.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.
Re: Random SSL unsupported record version
Posted by styriver <Sc...@mgic.com>.
If you are referring the actual values being serialized they look like this.
The key for image page is the UUID
public abstract class ImagePage implements Serializable
{
private static final long serialVersionUID = 1L;
private UUID id;
/** Will be indexed on it's own and also participate in the group index
for page access. */
@QuerySqlField(index = true, orderedGroups = {@QuerySqlField.Group(name =
"doc_page_idx", order = 0, descending = true)})
private String documentId;
/** Will participate in the group index sorted in ascending order. */
@QuerySqlField(orderedGroups = {@QuerySqlField.Group(name =
"doc_page_idx", order = 1)})
private Integer pageNumber;
private String pageFormat;
private byte[] image;
public ImagePage (String documentId, byte[] image, String pageFormat,
Integer pageNumber)
{
this.id = UUID.randomUUID();
this.documentId = documentId;
this.image = image;
this.pageFormat = pageFormat;
this.pageNumber = pageNumber;
}
------------------------------------------------------
I do see this message when attempting to serialize the DateTime object
WARNING: Class "org.joda.time.chrono.ISOChronology$Stub" cannot be
serialized using BinaryMarshaller because it either implements
Externalizable interface or have writeObject/readObject methods.
OptimizedMarshaller will be used instead and class instances will be
deserialized on the server. Please ensure that all nodes have this class in
classpath. To enable binary serialization either implement Binarylizable
interface or set explicit serializer using
BinaryTypeConfiguration.setSerializer() method.
public class ConversionStatus implements Serializable
{
private static final long serialVersionUID = 2793398355157434057L;
private static final int TIMEOUT_MINUTES = 3;
private Integer pageCount = null;
private ConversionStatusEnum conversionStatusEnum =
ConversionStatusEnum.NOT_REQUESTED;
private DateTime timeoutTime = null;
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236p8289.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.
Re: Random SSL unsupported record version
Posted by styriver <Sc...@mgic.com>.
The certificates I am using are the ones that shipped with the distribution.
I changed the keystore password for client.jks server.jks and trust.jks. I
also changed the keypass as well. I am using a 12 character key.
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236p8288.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.
Re: Random SSL unsupported record version
Posted by vkulichenko <va...@gmail.com>.
Hi,
Looks like there is an issue with SSL support when long keys are used. I'm
investigating it right now. How long are the keys you're using?
-Val
--
View this message in context: http://apache-ignite-users.70518.x6.nabble.com/Random-SSL-unsupported-record-version-tp8236p8278.html
Sent from the Apache Ignite Users mailing list archive at Nabble.com.