由于SolrJ,HttpClient,JVM或我的应用程序中的SSL证书无效,Classloader会泄漏？

Question

我在一个大型应用程序中分析了过去几天的类加载器泄漏,并且我已经解决了这个问题.

我的应用程序使用SolrJ,它将通过@Bean-Method 初始化:

@Bean(destroyMethod = "close")
public SolrClient solrClient() {
    return new HttpSolrClient(SOLR_URL);
}

SolrJ(org.apache.solr:solr-solrj:5.4.1)使用Apache HttpClient(org.apache.httpcomponents:httpclient:4.4.1).HttpClient通过使用普通的java类来初始化SSL上下文javax.net.ssl.SSLSocketFactory.通过这种方式,java加载trustManager并分析所有可信证书.如果存在错误,则证书(实例sun.security.x509.X509CertImpl)存储在列表中,并由抛出的异常进行丰富.吞下这个异常,我的应用程序仍然没有意识到.

据我所看到的,SSL上下文是在System /根类加载器,我的应用程序是在专用WebappClassLoader和因为现在有一个这样的问题,IOException它包含在堆栈跟踪,参考文献回溯等等SSL环境内到我的应用程序中的类.

但现在我不知道这是从哪里来的.它是SolrJ客户端,Apache HttpClient,Java本身(JVM)还是我的应用程序？

我做了一个小的应用程序重现,你可以在这里找到问题:https://github.com/CptS/solrj-classloader-leak 这也包含了解决方法(关闭挂钩从而消除导致类加载器泄漏的引用).

如果你禁用了关闭钩子(例如通过注释掉它)并启动一个干净的Tomcat(参见下面的"重现环境"),你可以按照以下步骤重现它:

1. 部署演示项目的战争(A)
2. 重装(B)
3. 重新加载它(C)
4. 触发GC(D)
5. 取消部署
6. 触发GC(E)
7. 看到元空间没有完全清理(F)

我创建了一个堆转储,GC的最短路径如下所示:

这与我的大型应用程序中的相同.所提到的解决方法(一点点启发https://github.com/mjiderhamn/classloader-leak-prevention,但遗憾的是没有解决我的问题)通过使用反射针对这些搜索unparseableExtensions并删除存储在例外why通过现场这样: SSLContextImpl.DefaultSSLContext#defaultImpl- > SSLContextImpl#trustManager- > X509TrustManager#trustedCerts- > X509CertImpl#info- > X509CertInfo#extensions- > CertificateExtensions#unparseableExtensions- >UnparseableExtension#why

通过这样做,我得到了异常的堆栈跟踪,如果它可以帮助某人:

java.io.IOException: No data available in passed DER encoded value.
    at sun.security.x509.GeneralNames.<init>(GeneralNames.java:61)
    at sun.security.x509.IssuerAlternativeNameExtension.<init>(IssuerAlternativeNameExtension.java:136)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at sun.security.x509.CertificateExtensions.parseExtension(CertificateExtensions.java:113)
    at sun.security.x509.CertificateExtensions.init(CertificateExtensions.java:88)
    at sun.security.x509.CertificateExtensions.<init>(CertificateExtensions.java:78)
    at sun.security.x509.X509CertInfo.parse(X509CertInfo.java:702)
    at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:167)
    at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1804)
    at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195)
    at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:100)
    at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:755)
    at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:56)
    at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224)
    at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70)
    at java.security.KeyStore.load(KeyStore.java:1445)
    at sun.security.ssl.TrustManagerFactoryImpl.getCacertsKeyStore(TrustManagerFactoryImpl.java:226)
    at sun.security.ssl.SSLContextImpl$DefaultSSLContext.getDefaultTrustManager(SSLContextImpl.java:767)
    at sun.security.ssl.SSLContextImpl$DefaultSSLContext.<init>(SSLContextImpl.java:733)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at java.security.Provider$Service.newInstance(Provider.java:1595)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
    at javax.net.ssl.SSLContext.getInstance(SSLContext.java:156)
    at javax.net.ssl.SSLContext.getDefault(SSLContext.java:96)
    at javax.net.ssl.SSLSocketFactory.getDefault(SSLSocketFactory.java:122)
    at org.apache.http.conn.ssl.SSLSocketFactory.getSystemSocketFactory(SSLSocketFactory.java:190)
    at org.apache.http.impl.conn.SchemeRegistryFactory.createSystemDefault(SchemeRegistryFactory.java:85)
    at org.apache.http.impl.client.SystemDefaultHttpClient.createClientConnectionManager(SystemDefaultHttpClient.java:121)
    at org.apache.http.impl.client.AbstractHttpClient.getConnectionManager(AbstractHttpClient.java:484)
    at org.apache.solr.client.solrj.impl.HttpClientUtil.setMaxConnections(HttpClientUtil.java:234)
    at org.apache.solr.client.solrj.impl.HttpClientConfigurer.configure(HttpClientConfigurer.java:40)
    at org.apache.solr.client.solrj.impl.HttpClientUtil.configureClient(HttpClientUtil.java:149)
    at org.apache.solr.client.solrj.impl.HttpClientUtil.createClient(HttpClientUtil.java:125)
    at org.apache.solr.client.solrj.impl.HttpSolrClient.<init>(HttpSolrClient.java:189)
    at org.apache.solr.client.solrj.impl.HttpSolrClient.<init>(HttpSolrClient.java:162)
    at de.test.spring.SolrJConfig.solrClient(SolrJConfig.java:20)
    at de.test.spring.SolrJConfig$$EnhancerBySpringCGLIB$$dbd4362f.CGLIB$solrClient$0(<generated>)
    at de.test.spring.SolrJConfig$$EnhancerBySpringCGLIB$$dbd4362f$$FastClassBySpringCGLIB$$8e7566a6.invoke(<generated>)
    at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:309)
    at de.test.spring.SolrJConfig$$EnhancerBySpringCGLIB$$dbd4362f.solrClient(<generated>)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:588)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1119)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1014)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
    at de.test.WicketApplication.init(WicketApplication.java:32)
    at org.apache.wicket.Application.initApplication(Application.java:950)
    at org.apache.wicket.protocol.http.WicketFilter.init(WicketFilter.java:429)
    at org.apache.wicket.protocol.http.WicketFilter.init(WicketFilter.java:353)
    at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:279)
    at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:260)
    at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:105)
    at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4640)
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5247)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
    at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:724)
    at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:700)
    at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:714)
    at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:919)
    at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1703)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)

我的解决方法现在解决了这个问题,但当然这只是一种解决方法.

我想知道,也许有人可以回答我的一个或多个问题:

1. 这是SolrJ,HttpClient,Java或我的应用程序中的"错误"吗？
2. 如果是我的申请,我做错了什么？
3. 如果不是我的申请,这是一个已知的问题吗？我找不到任何关于此的信息.(哪里)我应该创建一个错误票？
4. 为什么会出现"无效"证书？(顺便说一句:如果我从信任存储区删除此证书,也许泄漏也会解决...我没有测试但我认为无效或损坏的证书永远不会导致类加载器泄漏......)
5. 有谁有关于此的更多信息？我不能相信我是唯一一个发现这种行为的人(除了这是我的申请......见我的问题2).

最后但并非最不重要的是,我的环境重现:

• Tomcat版本:Apache Tomcat/8.0.14(Debian)
• JVM版本:1.8.0_91-b14
• JVM供应商:Oracle Corporation
• 操作系统名称:Linux
• 操作系统版本:3.16.0-4-amd64
• 架构:amd64

Answer 1

这是java中的一个错误，错误票在这里：http://bugs.java.com/bugdatabase/view_bug.do ?bug_id=8168069

非常感谢mjiderhamn（在 GitHub 上）。他是伟大的classloader-leak-prevention库的开发者，现在已经包含了针对此问题的预防器（版本 2.1.0）。