fix

docs/JDK17-build-report.md

@@ -0,0 +1,159 @@
+# Apache Synapse — JDK 17 iterative build report
+
+**Branch:** `dev-thisara`  
+**Goal:** Build the project with Java 17, skipping modules that fail due to Java version mismatch (without modifying failing source), and rebuild until a distribution is produced.
+
+**JDK used:** `JAVA_HOME=<JDK17_HOME>`
+
+---
+
+## Build iterations
+
+### Iteration 0 — Full reactor (`mvn clean install -DskipTests`)
+
+**Result:** FAILURE at `synapse-securevault` (compile).
+
+**Root cause:** Google ErrorProne is wired as a javac plugin (`-Xplugin:ErrorProne`) with ErrorProne 2.10.0. On JDK 9+, the compiler APIs live in the `jdk.compiler` module and are not accessible to the unnamed module where ErrorProne loads, causing:
+
+```text
+java.lang.IllegalAccessError: class com.google.errorprone.BaseErrorProneJavaCompiler ... cannot access class com.sun.tools.javac.api.BasicJavacTask (in module jdk.compiler) because module jdk.compiler does not export com.sun.tools.javac.api to unnamed module
+```
+
+This is a **toolchain / JDK encapsulation** issue, not application source.
+
+**How we proceed (without editing failing module source):** Retry with JVM `add-opens` for the compiler so ErrorProne can attach (see Iteration 1). Alternative would be disabling ErrorProne via POM/profile (not used here first).
+
+---
+
+### Iteration 1 — `mvn clean install -DskipTests` + `MAVEN_OPTS` (`--add-opens` for `jdk.compiler`)
+
+**Result:** Progressed past securevault; **FAILURE** at `synapse-amqp-transport`.
+
+**Workaround applied for ErrorProne:** Export `MAVEN_OPTS` with `--add-opens` for `jdk.compiler` packages (see **Final recommended command** at end). This is **not** a source change; it only relaxes JDK module boundaries for the forked javac/ErrorProne process.
+
+**New failure — AMQP transport (`synapse-amqp-transport`):**
+
+```text
+error: Source option 6 is no longer supported. Use 7 or later.
+error: Target option 6 is no longer supported. Use 7 or later.
+```
+
+**Why:** That module pins **Java 6** (`source`/`target` 1.6) and uses **maven-compiler-plugin 2.3.2**, which ignores the parent’s ErrorProne settings (warnings in log). JDK **17’s `javac` no longer accepts `-source 6`/`-target 6`**.
+
+**How we skip it:** Omit the module from the reactor so the rest of the tree still builds:  
+`-pl '!org.apache.synapse:synapse-amqp-transport'`  
+(Any downstream dependency on this JAR must be excluded or the distribution step adjusted—see later iterations.)
+
+---
+
+### Iteration 2 — Rebuild excluding AMQP module (`-pl '!org.apache.synapse:synapse-amqp-transport'`) + `MAVEN_OPTS`
+
+**Result:** FAILURE at `synapse-core` during **Felix `maven-bundle-plugin`** (`bundle` goal).
+
+**Root cause:** The embedded **bnd** in `maven-bundle-plugin` **2.3.6** cannot parse **Java 17 class files** (major version 61). The first class that tripped the parser was `org/apache/synapse/jmx/JmxSerializationFilterSupport.class` (compiled from Java 9+ APIs on this branch).
+
+```text
+java.lang.ArrayIndexOutOfBoundsException: Index 18 out of bounds for length 13
+  at aQute.lib.osgi.Clazz.parseClassFile(Clazz.java:448)
+...
+[ERROR] Invalid class file: org/apache/synapse/jmx/JmxSerializationFilterSupport.class
+```
+
+**How we addressed it:** Raised **`maven-bundle-plugin`** in the root `pom.xml` `pluginManagement` from **2.3.6 → 5.1.9** so OSGi manifest generation uses a **bnd** stack that understands JDK 17 bytecode. This is **build-tooling**, not a change to the failing transport sources.
+
+---
+
+### Iteration 3 — After bundle plugin bump; AMQP still excluded
+
+**Result:** FAILURE at **`synapse-war`** (`maven-war-plugin:2.1.1:war`).
+
+**Root cause:** **maven-war-plugin 2.1.1** is not compatible with running Maven on **JDK 17** (reflective access to `Properties` / `Hashtable` internals).
+
+```text
+Cannot access defaults field of Properties
+... WebappStructureSerializer
+```
+
+**How we addressed it:** Bumped **`maven-war-plugin`** in root `pluginManagement` from **2.1.1 → 3.4.0**.
+
+---
+
+### Iteration 4 — Distribution dependency + successful reactor
+
+**Distribution:** With `synapse-amqp-transport` **not** built, the **`synapse-amqp-transport`** dependency in `modules/distribution/pom.xml` would fail resolution. That dependency was **commented out** (with a pointer to this doc) so the binary/source assemblies can package without the skipped module.
+
+**Result:** **BUILD SUCCESS** (tests skipped).
+
+---
+
+## Final recommended command (JDK 17)
+
+Set Java 17, add compiler opens for ErrorProne, exclude AMQP from the reactor, skip tests:
+
+```bash
+export JAVA_HOME=<JDK17_HOME>
+export PATH="$JAVA_HOME/bin:$PATH"
+export MAVEN_OPTS="--add-opens jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED --add-opens jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED"
+
+cd <SYNAPSE_REPO_HOME>
+mvn clean install -DskipTests -pl '!org.apache.synapse:synapse-amqp-transport'
+```
+
+---
+
+## Distribution outputs (`target` directories)
+
+After a successful build, the main **binary and source distributions** are under **`modules/distribution/target/`**:
+
+| Artifact | Path |
+|----------|------|
+| Binary tarball | `modules/distribution/target/synapse-3.0.3-SNAPSHOT-bin.tar.gz` |
+| Binary zip | `modules/distribution/target/synapse-3.0.3-SNAPSHOT-bin.zip` |
+| Source tarball | `modules/distribution/target/synapse-3.0.3-SNAPSHOT-src.tar.gz` |
+| Source zip | `modules/distribution/target/synapse-3.0.3-SNAPSHOT-src.zip` |
+
+Other notable `target` outputs: e.g. `modules/war/target/synapse.war`, per-module JARs under each `modules/*/target/`.
+
+---
+
+## What was skipped vs changed
+
+| Item | Action |
+|------|--------|
+| **`synapse-amqp-transport`** | **Skipped** from reactor (Java 6 not supported by JDK 17 `javac`). **Source not modified.** |
+| **ErrorProne on JDK 17** | **Workaround:** `MAVEN_OPTS` `--add-opens` for `jdk.compiler` (no POM change). |
+| **`maven-bundle-plugin`** | **Version bump** in root POM (tooling). |
+| **`maven-war-plugin`** | **Version bump** in root POM (tooling). |
+| **`modules/distribution/pom.xml`** | **`synapse-amqp-transport` dependency commented out** so packaging resolves when that module is omitted. |
+
+To include AMQP again, the module would need its **compiler level** raised (at least 7+, typically 8+) and a **newer `maven-compiler-plugin`** in that module’s POM, then restore the distribution dependency and drop `-pl` exclusion.
+
+---
+
+## Post-build runtime launcher fix (`synapse.sh`)
+
+After extracting/using the built distribution with Java 17, startup initially failed before Synapse bootstrap with:
+
+```text
+-Djava.endorsed.dirs=... is not supported
+Error: Could not create the Java Virtual Machine.
+```
+
+**Why this happened:** `bin/synapse.sh` always passed `-Djava.endorsed.dirs`, but that JVM option was removed in Java 9+.
+
+**Fix applied:** updated launcher logic to pass endorsed dirs only for Java 8 and below.
+
+Files updated:
+
+- `modules/distribution/src/main/bin/synapse.sh` (source template for future distributions)
+- `<EXTRACTED_DIST_HOME>/bin/synapse.sh` (already built local runtime script)
+
+Implementation detail:
+
+- Added `ENDORSED_PROP` variable.
+- Set it only when detected Java is 1.6/1.7/1.8.
+- Replaced hardcoded `-Djava.endorsed.dirs=$SYNAPSE_ENDORSED` in the java command with `$ENDORSED_PROP`.
+
+**Validation:** reran `./synapse.sh` with Java 17; Synapse reached full startup (`Apache Synapse started successfully`).
+
+

modules/commons/src/main/java/org/apache/synapse/commons/jmx/JmxConfigurationConstants.java

@@ -40,5 +40,12 @@ public class JmxConfigurationConstants {
 
     /** Property to activate remote SSL support (same as com.sun.management.jmxremote.ssl) */
     public static final String PROP_REMOTE_SSL = "remote.ssl";
-
+
+    /** Property to configure JEP 290 serial filter for remote JMX RMI. */
+    public static final String PROP_REMOTE_SERIAL_FILTER_PATTERN = "remote.serial.filter.pattern";
+
+    /** Standard JMX connector environment key for the RMI deserialization filter pattern. */
+    public static final String JMX_REMOTE_SERIAL_FILTER_PATTERN =
+            "jmx.remote.rmi.server.serial.filter.pattern";
+
 }

modules/commons/src/main/java/org/apache/synapse/commons/jmx/JmxInformation.java

@@ -45,6 +45,9 @@ public class JmxInformation {
 
     /** Use remote SSL? */
     private boolean remoteSSL;
+
+    /** JEP 290 filter pattern used by remote JMX RMI deserialization. */
+    private String remoteSerialFilterPattern;
 
     /**
      * The jmxUrl to connect to.
@@ -114,6 +117,14 @@ public boolean isRemoteSSL() {
     public void setRemoteSSL(boolean remoteSSL) {
         this.remoteSSL = remoteSSL;
     }
+
+    public String getRemoteSerialFilterPattern() {
+        return remoteSerialFilterPattern;
+    }
+
+    public void setRemoteSerialFilterPattern(String remoteSerialFilterPattern) {
+        this.remoteSerialFilterPattern = remoteSerialFilterPattern;
+    }
 
     /**
      * Builds the JMX URL depending on the existence of RMI port.

modules/commons/src/main/java/org/apache/synapse/commons/jmx/JmxInformationFactory.java

@@ -117,6 +117,12 @@ public static JmxInformation createJmxInformation(Properties properties, String
         }
         jmxInformation.setRemoteSSL(remoteSSL);
 
+        value = MiscellaneousUtil.getProperty(properties,
+                prefix + JmxConfigurationConstants.PROP_REMOTE_SERIAL_FILTER_PATTERN, null);
+        if (value != null && value.trim().length() > 0) {
+            jmxInformation.setRemoteSerialFilterPattern(value);
+        }
+
         return jmxInformation;
     }
 

modules/commons/src/test/java/org/apache/synapse/commons/jmx/JmxInformationFactoryTest.java

@@ -0,0 +1,63 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.synapse.commons.jmx;
+
+import junit.framework.TestCase;
+
+import java.util.Properties;
+
+public class JmxInformationFactoryTest extends TestCase {
+
+    public void testSerialFilterPatternNotAppliedWhenUnset() {
+        Properties properties = new Properties();
+
+        JmxInformation info = JmxInformationFactory.createJmxInformation(properties, "localhost");
+
+        assertEquals(-1, info.getJndiPort());
+        assertNull(info.getRemoteSerialFilterPattern());
+    }
+
+    public void testConfiguredJndiPortIsKept() {
+        Properties properties = new Properties();
+        properties.setProperty("synapse.jmx.jndiPort", "0");
+
+        JmxInformation info = JmxInformationFactory.createJmxInformation(properties, "localhost");
+
+        assertEquals(0, info.getJndiPort());
+    }
+
+    public void testSynapseSerialFilterOverrideUsed() {
+        String customPattern = "maxdepth=10;java.lang.*;!*";
+        Properties properties = new Properties();
+        properties.setProperty("synapse.jmx.remote.serial.filter.pattern", customPattern);
+
+        JmxInformation info = JmxInformationFactory.createJmxInformation(properties, "localhost");
+
+        assertEquals(customPattern, info.getRemoteSerialFilterPattern());
+    }
+
+    public void testBlankSerialFilterPatternIsIgnored() {
+        Properties properties = new Properties();
+        properties.setProperty("synapse.jmx.remote.serial.filter.pattern", "   ");
+
+        JmxInformation info = JmxInformationFactory.createJmxInformation(properties, "localhost");
+
+        assertNull(info.getRemoteSerialFilterPattern());
+    }
+}

modules/core/src/main/java/org/apache/synapse/JmxAdapter.java

@@ -25,6 +25,7 @@
 import org.apache.synapse.commons.util.RMIRegistryController;
 import org.apache.synapse.commons.jmx.JmxInformation;
 import org.apache.synapse.commons.jmx.JmxSecretAuthenticator;
+import org.apache.synapse.jmx.JmxSerializationFilterSupport;
 
 import javax.management.MBeanServer;
 import javax.management.remote.JMXConnectorServer;
@@ -204,6 +205,17 @@ public void setJmxInformation(JmxInformation jmxInformation) {
     private Map<String, Object> createContextMap() {
         Map<String, Object> env = new HashMap<String, Object>();
 
+        String remoteSerialFilterPattern = jmxInformation.getRemoteSerialFilterPattern();
+        if (remoteSerialFilterPattern != null && remoteSerialFilterPattern.trim().length() > 0) {
+            // Deserialization limits are applied via JmxSerializationFilterSupport (JEP 415 factory),
+            // not via jmx.remote.rmi.server.serial.filter.pattern in the connector env.
+            JmxSerializationFilterSupport.configureForJmxPattern(remoteSerialFilterPattern, log);
+            if (log.isDebugEnabled()) {
+                log.debug("Configured JEP 290 deserialization filter for remote JMX: "
+                        + remoteSerialFilterPattern);
+            }
+        }
+
         if (jmxInformation.isAuthenticate()) {
 
             if (jmxInformation.getRemotePasswordFile() != null) {

modules/core/src/main/java/org/apache/synapse/jmx/JmxSerializationFilterSupport.java

@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.synapse.jmx;
+
+import org.apache.commons.logging.Log;
+
+import java.io.ObjectInputFilter;
+import java.util.function.BinaryOperator;
+
+/**
+ * Installs JEP 415 context-specific deserialization control for remote JMX without using
+ * {@code ObjectInputFilter.Config.setSerialFilter} for the entire JVM.
+ * <p>
+ * Synapse targets Java 17+; the configured JMX pattern is merged with the stream filter only when
+ * the stack indicates deserialization for {@code javax.management.remote} / {@code com.sun.jmx.remote}.
+ */
+public final class JmxSerializationFilterSupport {
+
+    private JmxSerializationFilterSupport() {
+    }
+
+    /**
+     * Installs a {@link ObjectInputFilter.Config#setSerialFilterFactory serial filter factory}
+     * that merges the given pattern for JMX/RMI deserialization stacks.
+     *
+     * @param pattern non-empty filter pattern (same string as {@code synapse.jmx.remote.serial.filter.pattern})
+     * @param log     logger (typically {@link org.apache.synapse.JmxAdapter})
+     */
+    public static void configureForJmxPattern(String pattern, Log log) {
+        if (pattern == null || pattern.trim().isEmpty()) {
+            return;
+        }
+        try {
+            ObjectInputFilter jmxFilter = ObjectInputFilter.Config.createFilter(pattern);
+            BinaryOperator<ObjectInputFilter> factory = (curr, next) -> {
+                ObjectInputFilter base = next != null ? next : curr;
+                if (base == null) {
+                    base = ObjectInputFilter.Config.getSerialFilter();
+                }
+                if (!isJmxRemoteDeserializationStack()) {
+                    return base;
+                }
+                return ObjectInputFilter.merge(jmxFilter, base);
+            };
+            ObjectInputFilter.Config.setSerialFilterFactory(factory);
+            log.info("Installed JEP 415 serial filter factory for JMX deserialization");
+            if (log.isDebugEnabled()) {
+                log.debug("JEP 415 serial filter factory installed for JMX/RMI stacks");
+            }
+        } catch (IllegalStateException e) {
+            log.warn("Serial filter factory already set; leaving existing factory in place: "
+                    + e.getMessage());
+        } catch (RuntimeException e) {
+            if (log.isDebugEnabled()) {
+                log.debug("JEP 415 serial filter factory failed: " + e.getMessage(), e);
+            }
+            log.warn("Could not install JEP 415 serial filter factory; check JDK configuration.");
+        }
+    }
+
+    /**
+     * Detect JMX-over-RMI deserialization by stack frames.
+     */
+    static boolean isJmxRemoteDeserializationStack() {
+        StackTraceElement[] trace = Thread.currentThread().getStackTrace();
+        for (int i = 0; i < trace.length && i < 40; i++) {
+            String name = trace[i].getClassName();
+            if (name.startsWith("javax.management.remote.")
+                    || name.startsWith("com.sun.jmx.remote")) {
+                return true;
+            }
+        }
+        return false;
+    }
+}