[JENKINS-49027] Better report JEP-200 violations in Remoting #247
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation. |
oleg-nenashev
previously requested changes
Jan 29, 2018
There was a problem hiding this comment.
Test failure is real.
2:33:55 [linux] [ERROR] testBlacklisting(hudson.remoting.ChannelFilterTest) Time elapsed: 0.009 s <<< ERROR!
22:33:55 [linux] java.io.IOException: Failed to deserialize response to UserRequest:hudson.remoting.ChannelFilterTest$GunImporter@21ffe51e: java.lang.SecurityException: Rejecting hudson.remoting.ChannelFilterTest$GunImporter
22:33:55 [linux] at hudson.remoting.Channel.call(Channel.java:916)
22:33:55 [linux] at hudson.remoting.ChannelFilterTest$ReverseGunImporter.call(ChannelFilterTest.java:89)
22:33:55 [linux] at hudson.remoting.ChannelFilterTest$ReverseGunImporter.call(ChannelFilterTest.java:87)
22:33:55 [linux] at hudson.remoting.UserRequest.perform(UserRequest.java:210)
22:33:55 [linux] at hudson.remoting.UserRequest.perform(UserRequest.java:53)
22:33:55 [linux] at hudson.remoting.Request$2.run(Request.java:358)
22:33:55 [linux] at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72)
22:33:55 [linux] at java.util.concurrent.FutureTask.run(FutureTask.java:266)
22:33:55 [linux] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
22:33:55 [linux] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
22:33:55 [linux] at java.lang.Thread.run(Thread.java:748)
22:33:55 [linux] Suppressed: hudson.remoting.Channel$CallSiteStackTrace: Remote call to north
22:33:55 [linux] at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1693)
22:33:55 [linux] at hudson.remoting.UserResponse.retrieve(UserRequest.java:313)
22:33:55 [linux] at hudson.remoting.Channel.call(Channel.java:908)
22:33:55 [linux] at hudson.remoting.ChannelFilterTest.testBlacklisting(ChannelFilterTest.java:63)
22:33:55 [linux] at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
22:33:55 [linux] at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
22:33:55 [linux] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
22:33:55 [linux] at java.lang.reflect.Method.invoke(Method.java:498)
22:33:55 [linux] at junit.framework.TestCase.runTest(TestCase.java:176)
22:33:55 [linux] at junit.framework.TestCase.runBare(TestCase.java:141)
22:33:55 [linux] at junit.framework.TestResult$1.protect(TestResult.java:122)
22:33:55 [linux] at junit.framework.TestResult.runProtected(TestResult.java:142)
22:33:55 [linux] at junit.framework.TestResult.run(TestResult.java:125)
22:33:55 [linux] at junit.framework.TestCase.run(TestCase.java:129)
22:33:55 [linux] at junit.framework.TestSuite.runTest(TestSuite.java:252)
22:33:55 [linux] at junit.framework.TestSuite.run(TestSuite.java:247)
22:33:55 [linux] at org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:86)
22:33:55 [linux] at org.apache.maven.surefire.junit4.JUnit4Provider.executeFailedMethod(JUnit4Provider.java:379)
22:33:55 [linux] at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:290)
22:33:55 [linux] at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:236)
22:33:55 [linux] at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:159)
22:33:55 [linux] at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:386)
22:33:55 [linux] at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:323)
22:33:55 [linux] at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:143)
22:33:55 [linux] Caused by: java.lang.SecurityException: Rejecting hudson.remoting.ChannelFilterTest$GunImporter
22:33:55 [linux] at hudson.remoting.ChannelFilterTest$3.userRequest(ChannelFilterTest.java:53)
22:33:55 [linux] at hudson.remoting.CallableDecoratorList.wrapUserRequest(CallableDecoratorList.java:30)
22:33:55 [linux] at hudson.remoting.UserRequest.perform(UserRequest.java:204)
22:33:55 [linux] at hudson.remoting.UserRequest.perform(UserRequest.java:53)
22:33:55 [linux] at hudson.remoting.Request$2.run(Request.java:358)
22:33:55 [linux] at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72)
22:33:55 [linux] at org.jenkinsci.remoting.CallableDecorator.call(CallableDecorator.java:19)
22:33:55 [linux] at hudson.remoting.CallableDecoratorList$1.call(CallableDecoratorList.java:21)
22:33:55 [linux] ... 4 more
22:33:55 [linux] Suppressed: hudson.remoting.Channel$CallSiteStackTrace: Remote call to south
22:33:55 [linux] at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1693)
22:33:55 [linux] at hudson.remoting.UserResponse.retrieve(UserRequest.java:313)
22:33:55 [linux] at hudson.remoting.Channel.call(Channel.java:908)
22:33:55 [linux] at hudson.remoting.ChannelFilterTest$ReverseGunImporter.call(ChannelFilterTest.java:89)
22:33:55 [linux] at hudson.remoting.ChannelFilterTest$ReverseGunImporter.call(ChannelFilterTest.java:87)
22:33:55 [linux] at hudson.remoting.UserRequest.perform(UserRequest.java:210)
22:33:55 [linux] at hudson.remoting.UserRequest.perform(UserRequest.java:53)
22:33:55 [linux] at hudson.remoting.Request$2.run(Request.java:358)
22:33:55 [linux] at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72)
22:33:55 [linux] ... 4 more
22:33:55 [linux]
|
I will take a look. |
|
Reproduced locally, investigating. |
|
Builds failing; see #249. |
ghost
reviewed
Jan 30, 2018
| @@ -71,8 +72,9 @@ public final String check(String name) { | |||
| * @throws SecurityException if it is blacklisted | |||
| */ | |||
| public final Class check(Class c) { | |||
| if (isBlacklisted(c)) | |||
| throw new SecurityException("Rejected: " +c.getName()); | |||
| if (isBlacklisted(c)) { | |||
There was a problem hiding this comment.
Just tabs vs. spaces. I can live with that
There was a problem hiding this comment.
Will refactor the entire class later
|
CI Says that Windows tests have passed at least... Not the level of confidence I would like to see, but I doubt we can achieve more right now |
oleg-nenashev
approved these changes
Jan 30, 2018
jglick
added a commit
to jglick/jenkins
that referenced
this pull request
Jan 31, 2018
oleg-nenashev
pushed a commit
to jenkinsci/jenkins
that referenced
this pull request
Feb 6, 2018
* Slave.JnlpJar.getURL did not work in some modes when core had a snapshot dependency on Remoting. * Starting to implement Channel.Listener.read/write. * Now obtaining response timing statistics. * For now, avoiding timestamped snapshots, as it caused problems for #3120 which I have asked for help from @stephenc diagnosing. * Simplified logging a bit. * onResponse * hudson.FilePath$Mkdirs is a lot more readable than hudson.FilePath$13. * Specific snapshot. * onJar * LoggingChannelListener * remoting.version=3.17 * Making a few test assertions more lenient to adapt to jenkinsci/remoting#247.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Partial improvement for JENKINS-49027. For example, update jenkinsci/pipeline-aws-plugin#37 to use a snapshot of
remotingand comment out the whitelist entry. Without this change, you getwhich is pretty opaque. With it, you get
which is somewhat better: the problem has been upgraded to a checked exception that code is likely to check; the JEP-200 permalink is visible; and you can see the
Callable.toString(though in this case jenkinsci/jenkins#3071 would be necessary to make that point you to the actual pluginMasterToSlaveFileCallable).I am also looking into whether we can get details on the actual field causing the problem, but I think this is mergeable as it stands.
@reviewbybees