oscerd opened a new pull request, #28154:
URL: https://github.com/apache/camel/pull/28154
This PR addresses three consumer issues of `camel-thrift`, which all touch
`ThriftConsumer`, so they are fixed together.
### CAMEL-25459 - fail at startup when `negotiationType` cannot be applied
`ThriftProducer` refuses `negotiationType=SSL` without `synchronous=true`,
but `ThriftConsumer.initializeServer()` built
the TLS server only for `SSL && synchronous`. With the default
`synchronous=false` the consumer fell through to the
`TNonblockingServerSocket` / `ThriftHsHaServer` branch, which does not use
`sslParameters`, and logged nothing. The
consumer now fails to start in that case, with a message like the
producer's. `negotiationType=SASL`, which is marked
as not implemented, now makes the producer and the consumer fail to start
instead of behaving as `PLAINTEXT`.
### CAMEL-25461 - apply the client authentication of `sslParameters`
The SSL consumer built `TSSLTransportFactory.TSSLTransportParameters` from
the protocol, the cipher suites and the key
store only, so the trust managers and `serverParameters` (such as
`clientAuthentication=REQUIRE`) had no effect. The
server socket is now created from
`sslParameters.createSSLContext(camelContext)`, as in other components, so all
of its
settings apply. As a consequence the key is read with the `keyPassword` of
the key managers, as everywhere else; the
error message says so when it is missing (the existing
`ThriftConsumerSecurityTest` now sets it).
### CAMEL-25460 - `muteException` consumer option
Like the other consumers that reply to their caller (CAMEL-23651 and
follow-ups, e.g. gRPC), the consumer gets a
`muteException` option, enabled by default. A failed exchange is answered
with
`TApplicationException(INTERNAL_ERROR, "Internal error processing
<method>")` instead of an exception that the Thrift
method does not declare. Before, the asynchronous server sent the message of
any exception, and the synchronous server
sent a `TApplicationException` as it was (for example one returned by
another Thrift service that the route called).
Exceptions declared in the IDL belong to the service contract and are still
sent as they are; for an asynchronous
method they are read from the method of the synchronous interface, as the
asynchronous one only declares `TException`.
### Docs
- `thrift-component.adoc`: new "SSL/TLS" (synchronous mode, SASL, supported
`sslParameters` settings, client
certificate example) and "Errors sent to the client" sections.
- Upgrade guide notes: 4.24, plus 4.22.3 and 4.18.6 on `main` for the
backports (on the maintenance branches the
synchronous server does not send errors, CAMEL-25247 being on `main` only,
so those notes only mention the
asynchronous one).
### Tests
- `ThriftNegotiationTypeStartupTest`: SSL consumer without synchronous mode,
SASL consumer and SASL producer fail to
start (all three pass without the fix, i.e. start).
- `ThriftConsumerClientAuthenticationTest`: with
`clientAuthentication=REQUIRE`, a client without certificate is
rejected (served without the fix) and a client with a trusted certificate
is served.
- `ThriftConsumerMuteExceptionTest`: the asynchronous and the synchronous
server send the generic error by default
(both sent the detail without the fix), the detail with
`muteException=false`, and declared exceptions as they are.
- `camel-thrift`: 55 tests, 0 failures.
- Full reactor `mvn clean install -DskipTests -DskipITs`: 706/706, only the
expected regenerated files (the new option in the
component metadata, the catalog and the endpoint DSL).
Backports to `camel-4.22.x` and `camel-4.18.x` will follow once this is
merged.
JIRA: https://issues.apache.org/jira/browse/CAMEL-25459,
https://issues.apache.org/jira/browse/CAMEL-25460,
https://issues.apache.org/jira/browse/CAMEL-25461
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
