topic Re: NullPointerException in Java SDK in Integration and Testing

NullPointerException in Java SDK

eran — Sun, 11 Dec 2011 06:53:54 GMT

In our testing environment I see a NullPointerException that is originated from the Java SDK.

Looking deeper, this is triggered by a SSLPeerUnverifiedException that is not handled properly, returning a non initialized result object.

Here's the relevant log:

10:52:55,073 ERROR HttpClient:268 - HttpClient execution failed
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
    at com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:352)
    at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:397)
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
    at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)
    at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:573)
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:754)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:732)
    at net.authorize.util.HttpClient.executeXML(HttpClient.java:211)
    at net.authorize.Merchant.executeTransaction(Merchant.java:305)
    at net.authorize.Merchant.postTransaction(Merchant.java:294)
    at com.outbrain.paymentgateway.facade.chase.ChasePaymentGatewayFacade.createCustomerProfile(ChasePaymentGatewayFacade.java:81)

Followed by the NullPointerException:

java.lang.NullPointerException
    at net.authorize.cim.Result.importRefId(Result.java:105)
    at net.authorize.cim.Result.createResult(Result.java:46)
    at net.authorize.Merchant.p...

I opened a ticket for this, but customer support have developers on their team...

My questions are:

How come I get this exception? The tests normally pass, and about 1-3 times a day there's a random failure like this, in 1 or 2 of my tests - all using the same Merchant instance.
Is anyone developing the Java SDK at all, or is this just a community library? I attempted to suggest a patch to another bug I found, but got no update on this, and the latest version doesn't contain my fix.
Is there a way to contribute code fixes, or do I have to maintain a private version in my code base?

Re: NullPointerException in Java SDK

eran — Sun, 08 Jan 2012 07:34:21 GMT

Isn't there anybody who can at least answer parts of this post?

Re: NullPointerException in Java SDK

TJPride — Sun, 08 Jan 2012 08:31:36 GMT

Well, it's not one of the commonly-used libraries. Most people seem to be using PHP or C#. So you're not going to get feedback as promptly. Judging by past experience, they'll have someone come by every now and then and pass along bugs / bug fixes people have posted, but it may be some time before they make it into the official code base. You could try sending Michelle a PM and see if she can hurry things along, however:

http://community.developer.authorize.net/t5/user/viewprofilepage/user-id/2

She seems to be the most common mod posting in here.

Re: NullPointerException in Java SDK

jgathings — Wed, 22 Feb 2012 21:15:07 GMT

Hi,

Were you able to resolve this issue? I have code that has been stable for months and all of a sudden seeing this error. Comments would be greatly appreciated.

Thanks

Re: NullPointerException in Java SDK

missbossy — Wed, 22 Feb 2012 22:12:52 GMT

I'm having the same 'peer not authenticated' error all of a sudden. Please help.

Thanks,

Monique

Re: NullPointerException in Java SDK

eran — Thu, 23 Feb 2012 07:40:23 GMT

@jgathings, @missbossy

I haven't resolved the issue, and I was told in support to ask for help here.

What I did manage to acheive, is to modify the source code so that at least I won't be getting a NPE, instead I get a failure response, which works better for me. There's no where to place my patches here so I keep a private version...

It kind of saddens me, that there's no where to contribute code here, and that the Java API development looks dead.

I'm seriously considering migrating to another payment gateway provider.

Re: NullPointerException in Java SDK

missbossy — Thu, 23 Feb 2012 18:22:29 GMT

Is the 'peer not authenticated' error only a problem in test environments? Or is it also happening in production environments?

Re: NullPointerException in Java SDK

jgathings — Thu, 23 Feb 2012 21:32:19 GMT

It appears to only occur in testing environments. As a consultant I don't have access to production credentials, nor do I want them. The solution we used to solve the problem was to modify net.authorize.util.HttpClient. We added an inner class:

class WebClientDevWrapper {

    public static DefaultHttpClient wrapClient(DefaultHttpClient base) {
        try {
            SSLContext ctx = SSLContext.getInstance("TLS");
            X509TrustManager tm = new X509TrustManager() {

                public void checkClientTrusted(X509Certificate[] xcs, String string) throws CertificateException {
                }

                public void checkServerTrusted(X509Certificate[] xcs, String string) throws CertificateException {
                }

                public X509Certificate[] getAcceptedIssuers() {
                    return null;
                }
            };
            X509HostnameVerifier verifier = new X509HostnameVerifier() {

                @Override
                public void verify(String string, SSLSocket ssls) throws IOException {
                }

                @Override
                public void verify(String string, X509Certificate xc) throws SSLException {
                }

                @Override
                public void verify(String string, String[] strings, String[] strings1) throws SSLException {
                }

                @Override
                public boolean verify(String string, SSLSession ssls) {
                    return true;
                }
            };
            ctx.init(null, new TrustManager[]{tm}, null);
            SSLSocketFactory ssf = new SSLSocketFactory(ctx);
            ssf.setHostnameVerifier(verifier);
            ClientConnectionManager ccm = base.getConnectionManager();
            SchemeRegistry sr = ccm.getSchemeRegistry();
            sr.register(new Scheme("https", ssf, 443));
            return new DefaultHttpClient(ccm, base.getParams());
        } catch (Exception ex) {
            ex.printStackTrace();
            return null;
        }
    }
}

And an additional modification:

                if(Environment.SANDBOX.equals(environment) ||
                       Environment.SANDBOX_TESTMODE.equals(environment)) {
                   InputStream outstream = (InputStream)httpPost.getEntity().getContent();
                   String requestData = convertStreamToString(outstream);
                    httpClient = WebClientDevWrapper.wrapClient(httpClient);
                   logger.debug("SANDBOX MODES ONLY>> Url-encoded request data: " + requestData);
               }

Check this url for a discussion of the technique: http://javaskeleton.blogspot.com/2010/07/avoiding-peer-not-authenticated-with.html.

I hope this post saves someone a lot of stress!