[JIRA] (JENKINS-54604) checkUpdatesServer fails to use SSL

4 views
Skip to first unread message

iurii.sergiichuk@gmail.com (JIRA)

unread,
Nov 13, 2018, 7:22:01 AM11/13/18
to jenkinsc...@googlegroups.com
Iurii Sergiichuk updated an issue
 
Jenkins / Bug JENKINS-54604
checkUpdatesServer fails to use SSL
Change By: Iurii Sergiichuk
Summary: checkUpdatesServer fails to use https SSL
Add Comment Add Comment
 
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

iurii.sergiichuk@gmail.com (JIRA)

unread,
Nov 13, 2018, 7:32:03 AM11/13/18
to jenkinsc...@googlegroups.com
Iurii Sergiichuk updated an issue
Update:

Downgrading Java version to 8u181 fixed the problem. So, it looks to me that only 8u191 is affected.

====================

 

 Jenkins is not able to connect to any outside resource that should work with SSL. It is not possible to obtain a list of plugins, connect to remote slaves using SSH, etc.

 

Here is what I can fish out when I try to update the list of plugins:

```

java.lang.NoSuchFieldError: state at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:198) at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) at sun.security.ssl.Handshaker.process_record(Handshaker.java:965) at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379) at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185) at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1564) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1492) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:263) at hudson.model.DownloadService.loadJSON(DownloadService.java:167) at hudson.model.UpdateSite.updateDirectlyNow(UpdateSite.java:185) at hudson.PluginManager.doCheckUpdatesServer(PluginManager.java:1648) at java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:627) at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:343) at org.kohsuke.stapler.interceptor.RequirePOST$Processor.invoke(RequirePOST.java:77) at org.kohsuke.stapler.PreInvokeInterceptedFunction.invoke(PreInvokeInterceptedFunction.java:26) at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:184) at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:117) at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:130) at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58) at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:739) Caused: javax.servlet.ServletException at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:789) at org.kohsuke.stapler.Stapler.invoke(Stapler.java:870) at org.kohsuke.stapler.MetaClass$2.doDispatch(MetaClass.java:188) at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58) at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:739) at org.kohsuke.stapler.Stapler.invoke(Stapler.java:870) at org.kohsuke.stapler.Stapler.invoke(Stapler.java:668) at org.kohsuke.stapler.Stapler.service(Stapler.java:238) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:865) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1655) at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:154) at org.jenkinsci.plugins.ssegateway.Endpoint$SSEListenChannelFilter.doFilter(Endpoint.java:243) at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151) at io.jenkins.blueocean.ResourceCacheControl.doFilter(ResourceCacheControl.java:134) at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151) at io.jenkins.blueocean.auth.jwt.impl.JwtAuthenticationFilter.doFilter(JwtAuthenticationFilter.java:61) at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151) at jenkins.metrics.impl.MetricsFilter.doFilter(MetricsFilter.java:125) at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151) at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:157) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642) at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:99) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84) at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:117) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249) at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:90) at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642) at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642) at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:82) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642) at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146) at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:524) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1317) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1219) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) at org.eclipse.jetty.server.Server.handle(Server.java:531) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:352) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:762) at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:680) at java.lang.Thread.run(Thread.java:748)

```

 

Here is the stacktrace shown from the console output whenever I try to start a new build:

```
java.lang.NullPointerException
at com.squareup.okhttp.internal.http.HttpEngine.readResponse(HttpEngine.java:593)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:460)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:399)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.getHeaders(HttpURLConnectionImpl.java:155)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.getHeaderField(HttpURLConnectionImpl.java:199)
at com.squareup.okhttp.internal.huc.DelegatingHttpsURLConnection.getHeaderField(DelegatingHttpsURLConnection.java:190)
at com.squareup.okhttp.internal.huc.HttpsURLConnectionImpl.getHeaderField(HttpsURLConnectionImpl.java:25)
at org.kohsuke.github.Requester.noteRateLimit(Requester.java:350)
at org.kohsuke.github.Requester._to(Requester.java:300)
at org.kohsuke.github.Requester.to(Requester.java:239)
at org.kohsuke.github.GitHub.checkApiUrlValidity(GitHub.java:734)
at org.jenkinsci.plugins.github_branch_source.Connector.checkApiUrlValidity(Connector.java:324)
at org.jenkinsci.plugins.github_branch_source.GitHubSCMSource.checkApiUrlValidity(GitHubSCMSource.java:1380)
at org.jenkinsci.plugins.github_branch_source.GitHubSCMSource.retrieve(GitHubSCMSource.java:1433)
at jenkins.scm.api.SCMSource.fetch(SCMSource.java:583)
at org.jenkinsci.plugins.workflow.multibranch.SCMBinder.create(SCMBinder.java:95)
at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:303)
at hudson.model.ResourceController.execute(ResourceController.java:97)
at hudson.model.Executor.run(Executor.java:429)
Finished: FAILURE
```

iurii.sergiichuk@gmail.com (JIRA)

unread,
Nov 13, 2018, 7:37:02 AM11/13/18
to jenkinsc...@googlegroups.com
Iurii Sergiichuk updated an issue
Change By: Iurii Sergiichuk
Priority: Blocker Critical

dbeck@cloudbees.com (JIRA)

unread,
Nov 14, 2018, 5:48:03 AM11/14/18
to jenkinsc...@googlegroups.com
Daniel Beck updated an issue
Change By: Daniel Beck
Update:

Downgrading Java version to 8u181 fixed the problem. So, it looks to me that only 8u191 is affected.
==================== ----

 

Jenkins is not able to connect to any outside resource that should work with SSL. It is not possible to obtain a list of plugins, connect to remote slaves using SSH, etc.

 

Here is what I can fish out when I try to update the list of plugins:
{noformat}
at java.lang.Thread.run(Thread.java:748) {noformat}

```

  

Here is the stacktrace shown from the console output whenever I try to start a new build:
{noformat}
```
 java.lang.NullPointerException
at com.squareup.okhttp.internal.http.HttpEngine.readResponse(HttpEngine.java:593)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:460)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:399)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.getHeaders(HttpURLConnectionImpl.java:155)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.getHeaderField(HttpURLConnectionImpl.java:199)
at com.squareup.okhttp.internal.huc.DelegatingHttpsURLConnection.getHeaderField(DelegatingHttpsURLConnection.java:190)
at com.squareup.okhttp.internal.huc.HttpsURLConnectionImpl.getHeaderField(HttpsURLConnectionImpl.java:25)
at org.kohsuke.github.Requester.noteRateLimit(Requester.java:350)
at org.kohsuke.github.Requester._to(Requester.java:300)
at org.kohsuke.github.Requester.to(Requester.java:239)
at org.kohsuke.github.GitHub.checkApiUrlValidity(GitHub.java:734)
at org.jenkinsci.plugins.github_branch_source.Connector.checkApiUrlValidity(Connector.java:324)
at org.jenkinsci.plugins.github_branch_source.GitHubSCMSource.checkApiUrlValidity(GitHubSCMSource.java:1380)
at org.jenkinsci.plugins.github_branch_source.GitHubSCMSource.retrieve(GitHubSCMSource.java:1433)
at jenkins.scm.api.SCMSource.fetch(SCMSource.java:583)
at org.jenkinsci.plugins.workflow.multibranch.SCMBinder.create(SCMBinder.java:95)
at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:303)
at hudson.model.ResourceController.execute(ResourceController.java:97)
at hudson.model.Executor.run(Executor.java:429)
Finished: FAILURE

``` {noformat}

dbeck@cloudbees.com (JIRA)

unread,
Nov 14, 2018, 5:49:03 AM11/14/18
to jenkinsc...@googlegroups.com
Daniel Beck updated an issue
Change By: Daniel Beck
Labels: java

dbeck@cloudbees.com (JIRA)

unread,
Nov 14, 2018, 5:49:04 AM11/14/18
to jenkinsc...@googlegroups.com
Daniel Beck commented on Bug JENKINS-54604
 
Re: checkUpdatesServer fails to use SSL

TBH the first stack trace at least doesn't look like a Jenkins problem. It's deep in the JRE internals.

iurii.sergiichuk@gmail.com (JIRA)

unread,
Dec 11, 2018, 7:45:02 AM12/11/18
to jenkinsc...@googlegroups.com
Iurii Sergiichuk updated an issue
 
Change By: Iurii Sergiichuk
Environment: Jenkins 2.138.3, 2.150.1
CentOS 7,
Java 8u191

iurii.sergiichuk@gmail.com (JIRA)

unread,
Dec 11, 2018, 7:46:02 AM12/11/18
to jenkinsc...@googlegroups.com
Iurii Sergiichuk commented on Bug JENKINS-54604
 
Re: checkUpdatesServer fails to use SSL

Any updates on the issue? The problem also persists in the newer 2.150.1 Jenkins version.

jsoref+jenkins@gmail.com (JIRA)

unread,
Jan 25, 2019, 10:55:03 AM1/25/19
to jenkinsc...@googlegroups.com

jsoref+jenkins@gmail.com (JIRA)

unread,
Apr 9, 2019, 3:58:03 PM4/9/19
to jenkinsc...@googlegroups.com

We thought this was the right bug: https://bugs.launchpad.net/ubuntu/+source/openjdk-8/+bug/1800792

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=912333

https://issues.apache.org/jira/browse/SUREFIRE-1588

However, we just upgraded to 8u191-b12-2ubuntu0.18.04.1 and still hit what feels like this error.

jsoref+jenkins@gmail.com (JIRA)

unread,
Apr 9, 2019, 5:57:02 PM4/9/19
to jenkinsc...@googlegroups.com

So, we hit this problem.

Upgrading to 191 and friends didn't fix it.

But w/ Daniel Beck we realized that I had added alpn-boot-8.1.12.v20180117.jar to the -Xbootclasspath for jenkins to shut up a warning about ALPN in the jenkins logs.

Removing the alpn file fixed the problem for us. As did upgrading to alpn-boot-8.1.13.v20181017.jar – http://central.maven.org/maven2/org/mortbay/jetty/alpn/alpn-boot/8.1.13.v20181017/alpn-boot-8.1.13.v20181017.jar

This is actually reported as https://github.com/jetty-project/jetty-alpn/issues/22 and fixed in https://github.com/jetty-project/jetty-alpn/commit/961d15094d4110728ea842cb7b2146f34669334d 

iurii.sergiichuk@gmail.com (JIRA)

unread,
Jun 20, 2019, 4:10:03 AM6/20/19
to jenkinsc...@googlegroups.com

Josh Soref thanks a lot for your investigation!

 

You're actually right and the issue here is that we've had an old alpn-boon (`alpn-boot-8.1.12.v20180117.jar`) version installed while the JVM was updated. Upgrading the alpn-boon version to the correct one (in our case it is alpn-boot-8.1.13.v20181017.jar) regarding the docs fixed the issue.

iurii.sergiichuk@gmail.com (JIRA)

unread,
Jun 20, 2019, 4:11:02 AM6/20/19
to jenkinsc...@googlegroups.com
Iurii Sergiichuk closed an issue as Not A Defect
 
Change By: Iurii Sergiichuk
Status: Open Closed
Resolution: Not A Defect
Reply all
Reply to author
Forward
0 new messages