This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 2fac5c64d6 Fix various edge cases for secure only configurations
2fac5c64d6 is described below
commit 2fac5c64d6483bbd1e1dade86ba069e9a6cc67bc
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Sep 24 11:04:54 2026 +0100
Fix various edge cases for secure only configurations
---
.../tribes/group/interceptors/TcpFailureDetector.java | 17 ++++++++++++++++-
.../apache/catalina/tribes/membership/MemberImpl.java | 2 +-
.../catalina/tribes/transport/nio/NioReceiver.java | 2 ++
3 files changed, 19 insertions(+), 2 deletions(-)
diff --git
a/java/org/apache/catalina/tribes/group/interceptors/TcpFailureDetector.java
b/java/org/apache/catalina/tribes/group/interceptors/TcpFailureDetector.java
index 5eb8f5ffae..ee10f0962e 100644
--- a/java/org/apache/catalina/tribes/group/interceptors/TcpFailureDetector.java
+++ b/java/org/apache/catalina/tribes/group/interceptors/TcpFailureDetector.java
@@ -35,6 +35,7 @@ import org.apache.catalina.tribes.ChannelMessage;
import org.apache.catalina.tribes.Member;
import org.apache.catalina.tribes.RemoteProcessException;
import org.apache.catalina.tribes.group.ChannelInterceptorBase;
+import org.apache.catalina.tribes.group.GroupChannel;
import org.apache.catalina.tribes.group.InterceptorPayload;
import org.apache.catalina.tribes.io.ChannelData;
import org.apache.catalina.tribes.io.XByteBuffer;
@@ -685,9 +686,23 @@ public class TcpFailureDetector extends
ChannelInterceptorBase implements TcpFai
return false;
}
+ boolean channelSecure = getChannel() instanceof GroupChannel
groupChannel && groupChannel.getSecure();
+ boolean useSecurePort = channelSecure || mbr.getSecurePort() >= 0 &&
mbr.getPort() < 0;
+ int port = useSecurePort ? mbr.getSecurePort() : mbr.getPort();
+ if (port < 0) {
+ // no usable port to connect to, so the member can't be checked
+ return false;
+ }
+ // the plaintext test message can't be spoken to a TLS-only listener,
so a secure port check is
+ // limited to a plain TCP connect
+ if (useSecurePort) {
+ sendTest = false;
+ readTest = false;
+ }
+
try (Socket socket = new Socket()) {
InetAddress ia = InetAddress.getByAddress(mbr.getHost());
- InetSocketAddress addr = new InetSocketAddress(ia, mbr.getPort());
+ InetSocketAddress addr = new InetSocketAddress(ia, port);
socket.setSoTimeout((int) readTimeout);
socket.connect(addr, (int) conTimeout);
if (sendTest) {
diff --git a/java/org/apache/catalina/tribes/membership/MemberImpl.java
b/java/org/apache/catalina/tribes/membership/MemberImpl.java
index 56e9319bbc..0fb3b8c6cb 100644
--- a/java/org/apache/catalina/tribes/membership/MemberImpl.java
+++ b/java/org/apache/catalina/tribes/membership/MemberImpl.java
@@ -56,7 +56,7 @@ public class MemberImpl implements Member,
java.io.Externalizable {
/**
* The tcp listen port for this member
*/
- protected volatile int port;
+ protected volatile int port = -1;
/**
* The udp listen port for this member
*/
diff --git a/java/org/apache/catalina/tribes/transport/nio/NioReceiver.java
b/java/org/apache/catalina/tribes/transport/nio/NioReceiver.java
index 3dc61760be..d443df1e12 100644
--- a/java/org/apache/catalina/tribes/transport/nio/NioReceiver.java
+++ b/java/org/apache/catalina/tribes/transport/nio/NioReceiver.java
@@ -235,6 +235,8 @@ public class NioReceiver extends ReceiverBase implements
Runnable, NioReceiverMB
}
startSecureListener();
if (tlsOnly) {
+ // Disable non-secure port
+ setPort(-1);
setListen(true);
return;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
