RE: performance issue with Tomcat 8.5.35 in org.apache.tomcat.util.net.NioBlockingSelector.write API

2020-01-07 Thread Rathore, Rajendra
Can someone please help me to find out the root cause for below issue.

Thanks and Regards,
Rajendra Rathore
9922701491

-Original Message-
From: Rathore, Rajendra 
Sent: Tuesday, January 7, 2020 4:16 PM
To: Tomcat Users List 
Subject: RE: performance issue with Tomcat 8.5.35 in 
org.apache.tomcat.util.net.NioBlockingSelector.write API

Hi Remy,

Thanks for the reply,

As you mention below points

"There's a problem only if things are blocked improperly, for example if the 
client is correctly reading the data and/or there's no network backlog.
Also the timeout configured on the connector must be respected by the 
operation."

1. how can we check the network backlog or data read/write not working 
properly, if any tool pls let us know 2. how can we set connector timeout.

Thanks and Regards,
Rajendra Rathore
9922701491

-Original Message-
From: Rémy Maucherat 
Sent: Tuesday, January 7, 2020 4:11 PM
To: Tomcat Users List 
Subject: Re: performance issue with Tomcat 8.5.35 in 
org.apache.tomcat.util.net.NioBlockingSelector.write API

External email from: users-return-269207-rarathore=ptc@tomcat.apache.org

On Tue, Jan 7, 2020 at 6:33 AM Rathore, Rajendra  wrote:

> Hi Rémy/ Christopher,
>
> It will stuck there for 10-15 minutes, so it will take time to load 
> simple Web UI, there is no WebSocket call. I am giving you one of the 
> sample where it will take 90% time in write operation, sometime it will reach 
> to 100%.
>
>
>  ||
>
> O-org.apache.coyote.ajp.AjpProcessor.writeData(AjpProcessor.java:1331)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.SocketWrapperBase.write(SocketWrapperBase
> .java:385)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.SocketWrapperBase.writeBlocking(SocketWra
> pperBase.java:462)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.SocketWrapperBase.doWrite(SocketWrapperBa
> se.java:726)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.doWrite(NioE
> ndpoint.java:1316)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.NioSelectorPool.write(NioSelectorPool.jav
> a:157)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.NioBlockingSelector.write(NioBlockingSele
> ctor.java:114)
> count=1667(%92.766)
>  ||
> |
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.awaitWriteLa
> tch(NioEndpoint.java:1160)
> count=1667(%92.766)
>  ||
> |
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.awaitLatch(NioEndpoint.java:1157)
> count=1667(%92.766)
>  ||
> |
> O-java.util.concurrent.CountDownLatch.await(CountDownLatch.java:277)
> count=1667(%92.766)
>
>
It's a normal blocking write, and the await does not consume CPU (it sits there 
however and a profiler will count that but it doesn't matter).
There's a problem only if things are blocked improperly, for example if the 
client is correctly reading the data and/or there's no network backlog.
Also the timeout configured on the connector must be respected by the operation.

Rémy


Re: [OT] Re: Maven Warning. Ubuntu Users

2020-01-07 Thread Zahid Rahman
  >A version of what?
 MAVEN
MAVEN
MAVEN

In light of this video https://youtu.be/idViw4anA6E
Of http.

You and your let's encrypt must be the longest troll on this line.

Take your wares and peddle them somewhere else carpet beggar.




On Wed, 8 Jan 2020, 01:12 Christopher Schultz, 
wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Zahid,
>
> On 1/6/20 3:13 PM, Zahid Rahman wrote:
> > That must be the reason why Apache Netbeans is using a version from
> >  2015
>
> A version of what?
>
> > and Apache Struts is recommending to use jdk 8.
> Apache Struts 2.5.x supports Java 7 and later. I see no official
> documentation recommending a specific Java version over any others.
>
> > Because there is somebody like you keeps telling people it is off
> > topic and Giant IT companies are not releasing jdk further than JDK
> > 8.
>
> Maybe just not for free.
>
> https://www.oracle.com/technetwork/java/javase/downloads/jdk13-downloads
> - -5672538.html
> https://www.azul.com/category/java13/
>
> Admittedly, Oracle's JDK/JRE is based upon
> https://openjdk.java.net/projects/jdk/13/ so maybe that doesn't count
> as a separate release.
>
> But no, IBM doesn't appear to have a new version beyond Java 11.
>
> > The issue is a miserable and disgraceful failure in coordination by
> > Apache Foundation.
>
> So you found a problem with a package provided by Ubuntu/Debian, and
> your solution was to install the official Maven package from the
> Apache Software Foundation. And your conclusion is that the ASF is the
> miserable and disgraceful party, here?
>
> I'm so confused.
>
> It's worth pointing-out that there is no enforced coordination between
> ASF projects. Some of them work together in almost lock-step, like APR
> and httpd. Others are completely de-coupled. Some ignore each other
> (e.g. Apache Maven and Apache Tomcat). It's up to the individual
> projects to determine if/how they will work together.
>
> You may wish to read a little more about the ASF before you make
> blanket statements about it.
> https://community.apache.org/projectIndependence.html
>
> If you are dissatisfied with the ASF communities (or maybe just a few
> in particular), may I suggest that you take one of these two courses
> of action:
>
> 1. Volunteer to improve the situation. Usually in the form of
> patches/PRs to that project.
>
> 2. Take your complaints elsewhere.
>
> - -chris
>
> > On Mon, 6 Jan 2020, 19:45 Mark Thomas,  wrote:
> >
> >> On 06/01/2020 18:37, Zahid Rahman wrote:
> >>> To all ubuntu Maven  users.
> >>
> >> This is off-topic for this mailing list.
> >>
> >> Please keep posts on this list on topic.
> >>
> >> Thanks,
> >>
> >> Mark
> >>
> >>
> >>>
> >>> Do NOT  install maven using sudo apt install maven
> >>>
> >>> Install by  direct download  only  from
> >>> https://maven.apache.org/download.cgi
> >>>
> >>> BECAUSE:
> >>>
> >>> "I seem to remember they [ubuntu] have their own build of Maven
> >>> which differs from the Apache source.
> >>>
> >>> ( https://bugs.launchpad.net/ubuntu/+source/maven/+bug/1754602
> >>> suggests it's a known bug in their packaging/build? )
> >>>
> >>> If you download Maven from http://maven.apache.org/download.cgi
> >>> and
> >> follow
> >>> the instructions in http://maven.apache.org/install.html then
> >>> you
> >> shouldn't
> >>> see those warnings. " ‐---
> >>>
> >>> The Java 11 warning mentions that
> >>> "/usr/share/maven/lib/guice.jar" has a class named
> >>> "com.google.inject.internal.cglib.core.$ReflectUtils$1"
> >>>
> >>> This looks suspect because the official Maven distribution uses
> >>> the "no-AOP" version of Guice which doesn't contain any CGLIB
> >>> classes. It suggests that whoever provided that copy of Maven
> >>> has replaced the
> >> "no-AOP"
> >>> version with the "AOP" version, and this will cause warnings on
> >>> Java 11. (The "AOP" version uses CGLIB which currently relies
> >>> on certain
> >> reflective
> >>> access that Java 11 warns about - whereas the "no-AOP" version
> >>> doesn't.)
> >>>
> >>
> >>
> >> -
> >>
> >>
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >> For additional commands, e-mail: users-h...@tomcat.apache.org
> >>
> >>
> >>
> >
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VLGgACgkQHPApP6U8
> pFjmuw//cXWmOfcRCt/2FqHwWZwuB23fIXrzEdOJ3RPdJEfwDUxtVcz/rXGI9TB6
> ae64Vr1+8Znh8xX+wGvoScITo3L/qUPWDkWf5W3rAhhQNWCqsvJvCM4Sw7YE4ytE
> pv9gT9seDOx+wiGq+FQ5gdy1T7adgTwgYAVLCeuG/bvk4niz9vtYxXBXdfeTIb5e
> fjYY7sRzyhC9TQy8wq35JGXtlabxgXOPYqtlSRaZGX4m3wiLjOCyN5O+zXtmYfFk
> pnQ9exU5fez4RHgMt2ys9WFXYH8ZHVqIEkCwaFMrufOKGI+P6PVhtuj3c1mnHa0H
> RjSXHnd+hnUhwO3TWN7ClDH50KOHJCoT6kfXPh/RYxBC6yoY71DsFtP+l27xkVaV
> xh5nGkMcbBBLEpifhGBFd2tmjpRCMZqDU2433ROJJx7bqpNrLuAzRYcb8DISclSE
> ylqWL+s46ws251dp9RNBXJ1IYCI4fSxw/jiQUtjk7JCM1d8K6EyXK3NYC8IMLl9P
> Vw9OJdOhPvWHYISe

Re: Dates on Linux vs. Windows - Resolved

2020-01-07 Thread Jerry Malcolm
First of all, a big thank you to everyone who responded to this one.  I 
doubt I'd have figured it out for days without your guidance and help.


And the winner is the JVM timezone.  But the problem was NOT that 
the JVM wasn't set to US Central time.  The problem was that it WAS set 
to US Central, apparently inherited from the Linux OS TZ.  There was no 
parameter on the tomcat java command that set the timezone.  So I added 
one and set it to America/Chicago.  No change.  But since it appeared we 
were already double-dipping and converting from GMT to central twice 
(i.e. subtracting an additional 6 hours), I figured ok tell the JVM 
to stay in GMT and not do any conversions.  So now, the database returns 
Central time dates and times, but JVM no longer thinks it needs to 
convert again to 'more central'.


This is about as convoluted and ugly as it gets.  And I don't make any 
claims of thinking I can give a rational explanation for why it works 
this way.  But it's on to fight a battle on another hill now.


Just to summarize for anybody who comes along with a similar problem 
I original set the timezone of mySQL RDS instance to Central time when I 
created it months back (unchangable after it's set).  I set my Linux 
timezone to Central as well in order to make my log files have entries 
with the correct timestamps.  But as I described earlier, changing the 
OS timezone made the JVM also go to Central as well.  But the JVM 
apparently assumed the database was in GMT so it subtracted 6 more hours 
off the already-central time from the db.  I guess the real error was 
not initially leaving the MySQL RDS in GMT.  But since that's not 
changeable without recreating a whole new RDS instance, the next option 
is what I did with the jvm.   Makes total sense, right???  :-)


Thanks again.

Jerry


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Breakthrough, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread James H. H. Lampert

On 1/7/20 4:54 PM, Christopher Schultz wrote:


I have further confused you, because TCP packets+connections also have
state, and I misspoke.


Think nothing of it: at my age, I'm easily confused.

--
JHHL

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Jerry,

On 1/7/20 7:42 PM, Jerry Malcolm wrote:
> Summarizing what I know now... when I use the command line on the
> linux instance and do a mysql query, I get the correct date (i.e.
> the date that I set, the date I wanted, the date that mySQL exports
> to SQL file, and the date that appears in Windows tomcat).  So this
> pretty much rules out the problem being in the mySQL server.  I
> would think this also rules out the problem being in some timezone
> setting  in the base Linux system hosting tomcat since I get the
> right date in the command line. That only leaves the JVM; JDBC
> package, and MySQL connector.

The JDBC package and the MySQL connector are the same thing. They will
convert correctly from the server's time zone into the JVM's time zone.

> MySQL RDS instance is set to US Central timezone.  So it's going to
> return dates in central time, right?

Sort of? See my other reply for ... details.

> It appears that jdbc and/or the connector is assuming the db is gmt
> and knocking off another 6 hours. Is there some place in the
> datasource to tell tomcat the timezone of the database so it knows
> not to convert TZ when it doesn't need to? I can't find anything
> like that in the datasource documentation.

Your JVM is probably in GMT/UTC.

The conversion is not the problem. It's just the output that is
causing you pain.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VMeoACgkQHPApP6U8
pFjzWRAAlSOt1Yu3jGYUzM0zxfuaSNJ88Tu0QS2Ibt3AtuJEqwvU6LWmjS+B1DpR
THxpP/RYEUbEoe9BMxm6aN4qT0DpmP5sWqbceqcOmLH1ACAGalvtX/mLh9auSXk/
+paOkUB6aZ6CNTXwth8O0c89KuKIdydw0jAcJesU32leuKzOsgPlY5Ey5QG/G6Gv
YvqY61730vQ573fTzAFX84w10v+Q7+vTGxzS5RgtQcjCK6vH6jXPinzmkTOKSa3E
7gC2yHGJ0yQvRUVNYWqUS8yiBX5GmrO7bXPGxIT5jbfzdlCOUgciElLaoO1WmxTX
1tU6wX5zh3Mm3ACNN6+JRPJXUkJNO5bcfkvVRUkNoyyFyEFMHqg9edDQLMDA3IlU
+KTzFLJqEsTvxiZ3t5T5b/POo8uNxleMO23AEzZZYVCTtl9pfPi9d/EtLsbwUhO2
USpLiKhEmiBe0EXFdnXJEBIkaMh7TllVZqeueTgfyMdWq42XIxb6xtfbZhRBjhYT
i8tBwOXlTdI6NltW7RA9ucPcCh6esNYRwPcozXlwVBr8yJPNAWtL3y0OCO5/kGTw
73BPCiNcFmm5bR9Qh+2CRrjIzYaEmoLDEccsScfSrLIvne4mrKgyi7FkFbH7tlKk
0IPxvJrwNBjtHLPppZdnqDYaXAQX+j+mAcSbJVU9dFhjv3tBWzM=
=3pbq
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Curl problem with reloadSslHostConfigs, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread James H. H. Lampert

On 1/7/20 4:19 PM, Christopher Schultz wrote:


You probably "spelled" something incorrectly. It might be a
quoting/escaping issue. It might be a literal misspelling/typo.

The JMXProxyServlet shouldn't NPE like that, though.

I'll take a look and see if we can give you a better error message
than that when it happens.


Well given that (1) there's no production data at stake, (2) you don't 
know where this server is, (3) the test user will be removed permanently 
and replaced with something else once this problem is resolved, and (4) 
the test user will never be active if I'm not running actual tests, 
there's no reason to censor the curl call.


curl -k -u test:test 
https://localhost:8443/manager/jmxproxy?invoke=Catalina%3Atype%3DProtocolHandler%2Cport%3D8443%2Caddress%3D%22127.0.0.1%22&op=reloadSslHostConfigs


I tried it with or without quote marks around the URL; I tried it both 
with the user in a "-u" clause, as above, or with the user prefixing the 
domain. In all four cases, I get what appears to be the exact same 
stacktrace as before.


I can't tell any difference, other than the user, and specifying a port, 
between that and the "hard-coded" curl call on slide 35 of the 
presentation. And if I leave out the port number, I get "connection 
refused."


FYI, the relevant lines in tomcat-users.xml (with the actual admin user 
definition redacted) are:





[line redacted]



--
JHHL

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: [OT] Re: Maven Warning. Ubuntu Users

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Zahid,

On 1/6/20 3:13 PM, Zahid Rahman wrote:
> That must be the reason why Apache Netbeans is using a version from
>  2015

A version of what?

> and Apache Struts is recommending to use jdk 8.
Apache Struts 2.5.x supports Java 7 and later. I see no official
documentation recommending a specific Java version over any others.

> Because there is somebody like you keeps telling people it is off
> topic and Giant IT companies are not releasing jdk further than JDK
> 8.

Maybe just not for free.

https://www.oracle.com/technetwork/java/javase/downloads/jdk13-downloads
- -5672538.html
https://www.azul.com/category/java13/

Admittedly, Oracle's JDK/JRE is based upon
https://openjdk.java.net/projects/jdk/13/ so maybe that doesn't count
as a separate release.

But no, IBM doesn't appear to have a new version beyond Java 11.

> The issue is a miserable and disgraceful failure in coordination by
> Apache Foundation.

So you found a problem with a package provided by Ubuntu/Debian, and
your solution was to install the official Maven package from the
Apache Software Foundation. And your conclusion is that the ASF is the
miserable and disgraceful party, here?

I'm so confused.

It's worth pointing-out that there is no enforced coordination between
ASF projects. Some of them work together in almost lock-step, like APR
and httpd. Others are completely de-coupled. Some ignore each other
(e.g. Apache Maven and Apache Tomcat). It's up to the individual
projects to determine if/how they will work together.

You may wish to read a little more about the ASF before you make
blanket statements about it.
https://community.apache.org/projectIndependence.html

If you are dissatisfied with the ASF communities (or maybe just a few
in particular), may I suggest that you take one of these two courses
of action:

1. Volunteer to improve the situation. Usually in the form of
patches/PRs to that project.

2. Take your complaints elsewhere.

- -chris

> On Mon, 6 Jan 2020, 19:45 Mark Thomas,  wrote:
> 
>> On 06/01/2020 18:37, Zahid Rahman wrote:
>>> To all ubuntu Maven  users.
>> 
>> This is off-topic for this mailing list.
>> 
>> Please keep posts on this list on topic.
>> 
>> Thanks,
>> 
>> Mark
>> 
>> 
>>> 
>>> Do NOT  install maven using sudo apt install maven
>>> 
>>> Install by  direct download  only  from 
>>> https://maven.apache.org/download.cgi
>>> 
>>> BECAUSE:
>>> 
>>> "I seem to remember they [ubuntu] have their own build of Maven
>>> which differs from the Apache source.
>>> 
>>> ( https://bugs.launchpad.net/ubuntu/+source/maven/+bug/1754602
>>> suggests it's a known bug in their packaging/build? )
>>> 
>>> If you download Maven from http://maven.apache.org/download.cgi
>>> and
>> follow
>>> the instructions in http://maven.apache.org/install.html then
>>> you
>> shouldn't
>>> see those warnings. " ‐---
>>> 
>>> The Java 11 warning mentions that
>>> "/usr/share/maven/lib/guice.jar" has a class named
>>> "com.google.inject.internal.cglib.core.$ReflectUtils$1"
>>> 
>>> This looks suspect because the official Maven distribution uses
>>> the "no-AOP" version of Guice which doesn't contain any CGLIB
>>> classes. It suggests that whoever provided that copy of Maven
>>> has replaced the
>> "no-AOP"
>>> version with the "AOP" version, and this will cause warnings on
>>> Java 11. (The "AOP" version uses CGLIB which currently relies
>>> on certain
>> reflective
>>> access that Java 11 warns about - whereas the "no-AOP" version
>>> doesn't.)
>>> 
>> 
>> 
>> -
>>
>> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>> 
>> 
>> 
> 
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VLGgACgkQHPApP6U8
pFjmuw//cXWmOfcRCt/2FqHwWZwuB23fIXrzEdOJ3RPdJEfwDUxtVcz/rXGI9TB6
ae64Vr1+8Znh8xX+wGvoScITo3L/qUPWDkWf5W3rAhhQNWCqsvJvCM4Sw7YE4ytE
pv9gT9seDOx+wiGq+FQ5gdy1T7adgTwgYAVLCeuG/bvk4niz9vtYxXBXdfeTIb5e
fjYY7sRzyhC9TQy8wq35JGXtlabxgXOPYqtlSRaZGX4m3wiLjOCyN5O+zXtmYfFk
pnQ9exU5fez4RHgMt2ys9WFXYH8ZHVqIEkCwaFMrufOKGI+P6PVhtuj3c1mnHa0H
RjSXHnd+hnUhwO3TWN7ClDH50KOHJCoT6kfXPh/RYxBC6yoY71DsFtP+l27xkVaV
xh5nGkMcbBBLEpifhGBFd2tmjpRCMZqDU2433ROJJx7bqpNrLuAzRYcb8DISclSE
ylqWL+s46ws251dp9RNBXJ1IYCI4fSxw/jiQUtjk7JCM1d8K6EyXK3NYC8IMLl9P
Vw9OJdOhPvWHYISeym19GKKzFSWE/Qa/N8/jbzMf46jJMvJbrPwTAn3+IkTbSUoB
aK7gfzjkReAUDmE//28CvTVdeF0tfHwM5lTnsJVWqFq+YsWH1hT9H5l4twkBvvsD
WoyAfdtd/6F0WOWrjbkvB+WfT1QQ2rDgOUrYCJxAk4dSGsm95Ro=
=ltKd
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Mark Eggers
On 1/7/2020 1:13 PM, Jerry Malcolm wrote:
> On 1/7/2020 3:09 PM, Michael Osipov wrote:
>> Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:
>>> This may be more of a Java question than Tomcat.  But I'm not sure. 
>>> I have the same code, talking to the same MySql Linux (AWS)
>>> database.  I read a date column value in a Tomcat app.  After calling
>>> resultSet.getDate(...) I printed the date instance and the getTime()
>>> value:
>>>
>>> On windows: 2019-02-01 154900080
>>>
>>> On linux:   2019-01-31 154897920
>>>
>>> Again this is the SAME line of code in java reading the SAME field in
>>> the SAME database.  Only thing different is Linux/Windows OS.  The
>>> date is supposed to be 2/1/2019 and shows that in phpMyAdmin.
>>>
>>> I've been running on Linux for a few months.  But I don't have an
>>> extensive background in the specifics of Linux.  I'm sure there must
>>> be something that is configured differently.  I'm at a loss. But this
>>> is not a trivial problem.  I do monthly billing. My dates need to be
>>> accurate.
>>
>> Have you verified that you aren't tricked by any timezone issues?
> Probably so.  But how would I know?  I was under the impression that
> java.sql.Date was timezone independent.  Shouldn't it simply convert a
> month/day/year value to the number of milliseconds since the epoch?  How
> would timezone issues affect that?  And if I am 'tricked' how do I
> 'untrick'.  What do I set/change?

According to the AWS documentation, there are two places that you have
to set manually in order to get the timezone changed universally.

1. /etc/sysconfig/clock

This you've already changed correctly.

2. /etc/localtime

According to the documentation, you'll need to link /etc/localtime to
the appropriate /usr/share/zoneinfo/America timezone file - most likely
Chicago.

sudo ln -sf /usr/share/zoneinfo/America/Chicago /etc/localtime

Also, do you have chrony installed and running on your Linux instance?
This is an NTP replacement that the AWS documentation recommends, and
will sync your time with AWS time servers.

Once you do all of this, you'll have to reboot.

Here's a link to the documentation:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html

For what it's worth, the following quick and dirty code (note, no
packages, ma) prints out the correct timezone (Pacific Standard Time)
before I made the link and rebooted the machine.

Here's the code (no package, bad programming practice).

tz.java:

import java.util.TimeZone;
public class tz {
public static void main(String[] args) {
System.out.println(TimeZone.getDefault().getDisplayName());
}
}

$ javac tz.java
$ java -cp . tz
Pacific Standard Time
$

As an aside, on my CentOS 6 system, there are notes in the
/etc/sysconfig/clock file:

# The time zone of the system is defined by the contents of /etc/localtime.
# This file is only for evaluation by system-config-date, do not rely on its
# contents elsewhere.

So I suspect that part of your system thinks it's UTC and part CST/CDT?

. . . just my two cents.
/mde/



signature.asc
Description: OpenPGP digital signature


Re: Breakthrough, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

James,

On 1/7/20 7:22 PM, James H. H. Lampert wrote:
> On 1/7/20 4:17 PM, Christopher Schultz wrote:
>> iptables doesn't work on pipes, it works on packets. So you have
>> to redirect both incoming AND outgoing packets. That's why you
>> have the "output redirect" as well as the (more obvious) "input
>> redirect".
> 
> Well, that just leaves me more puzzled than ever: why would our
> webapp (and Manager, for that matter) "work just fine" even though
> there's no sign of an output redirect in the iptables-save output
> (which I posted in its entirety)?

I have further confused you, because TCP packets+connections also have
state, and I misspoke. For UDP, you'd need the output redirect. The
TCP stack knows where the packets from a particular connection came
from, so responses along the same connection will go back the way they
came (this is NAT).

I'm not sure under what circumstances you need an OUTPUT redirect. I
seem to remember in my testing that I did indeed require the OUTPUT
redirect for things to work properly, but I may be making that up. The
slides mention that you "may need" those, and so I went ahead and put
the commands into the slides to show how to do it, if necessary.

Actually, it's not INPUT and OUTPUT, it's PREROUTING and POSTROUTING.
But those are basically the same concept for NAT as INPUT/OUTPUT are
for the "filter" tables.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VKC8ACgkQHPApP6U8
pFjqSRAAtKLif+WBswtmW8jOswhHn2SNRX2jUPm/RYOf7YqEFMYgeunA6GqewcT0
E2AVcBangWNGLuMWaaDhmFb5S4KcgW2c5HlbafBVtdggESkfjzozJnBw+sg6ShbZ
SxRQ4Lty/WwczAwduHkOaG7pFIeQlTKLSA1wL5zCJ02hQllYa1CYGIxMRAbwqu/m
1oC0jgiJs1zGXQN7XlgZdTD6uyHuUEhSLzh0it8+QtWEoLtki+LcvRy+Bmv+nEtw
ssqHpCX+TD4PnhcLpgFqWzy3DrUJYPUdV6dExnBujrFe2tzBAYtZfDy+Gshb6efo
LtGdLwaHgd6BLA71wEUEGMr85o9Opeuu1l3niENP/WaOuELidre3+umAVWr5Ypdq
zSGhO6clt6V9JCpXqM1EWh18hjDomKLb6Q1V9hpeTbBodmr8yFGo6D9pv9lddRyD
ArXxmqvL3aUSWXb80zrsUuPYXTO+SIbIXJRSJGPVRWM7eCrO8o1VpeTcD1bsXnPz
3l32YDEd6hbWjwLMWKzWu4oIuoZlHiCgsx4Tm2T0KtdBRn2/kStTLIoXOF5s129Y
ewZ0ygViiPqnTL1QD1jwnKG7EuAplx9ppKXCRM1MSbbB/+VSjdwDFvQCAnVykLhg
IB0AniJsaYP6BnPIGHcihPU3mj7Qp9uGcm/3QeAIwX0ULf1iEKs=
=tP73
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Jerry Malcolm
>> If your systems always use the same time zone to read and write the 
data, it isn't a problem.


Terrance, thanks for the info.  In my case I do only have one timezone 
(or at least I want to...).  Using the string for dates is a good idea.  
But this is a massive application that's been in production for years 
with tons of date and timestamp fields spread everywhere across the code 
and the db.  So converting to strings is not a possibility now.


It still comes down to the fact that the mysql command line on my linux 
box gets the date right, but it's converted incorrectly by JDBC and only 
on the linux box (and works on WIndows)


When I first set up the box an installed Tomcat, the default Linux time 
was gmt.  I didn't change the Linux time to central until later.  Any 
chance that tomcat stored the timezone in effect when it was installed 
and still is using that even though I changed the linux timezone?  (Just 
grasping at straws here).



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Zahid,

On 1/7/20 4:19 PM, Zahid Rahman wrote:
> If you wish  to find out if the database connection API is buggy.
> 
> Is the result when you use select query from each of the operating
> system same.
> 
> Select column_name  from table;
> 
> 
> If select on both return values are same then likely  the database
> API is buggy.  You have choice of two database connection APIs.
> 
> One API is tomcat specific. The other  is vendor neutral.

The API that matters is the JDBC API, and the driver you are using.
Most people use Connector/J for both MySQL and MariaDB. It is a
correct implementation and is reliable.

- -chris

> On Tue, 7 Jan 2020, 21:09 Michael Osipov, 
> wrote:
> 
>> Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:
>>> This may be more of a Java question than Tomcat.  But I'm not
>>> sure.  I have the same code, talking to the same MySql Linux
>>> (AWS) database.  I read a date column value in a Tomcat app.
>>> After calling resultSet.getDate(...) I printed the date
>>> instance and the getTime()
>> value:
>>> 
>>> On windows: 2019-02-01 154900080
>>> 
>>> On linux:   2019-01-31 154897920
>>> 
>>> Again this is the SAME line of code in java reading the SAME
>>> field in the SAME database.  Only thing different is
>>> Linux/Windows OS.  The date is supposed to be 2/1/2019 and
>>> shows that in phpMyAdmin.
>>> 
>>> I've been running on Linux for a few months.  But I don't have
>>> an extensive background in the specifics of Linux.  I'm sure
>>> there must be something that is configured differently.  I'm at
>>> a loss. But this is not a trivial problem.  I do monthly
>>> billing. My dates need to be
>> accurate.
>> 
>> Have you verified that you aren't tricked by any timezone
>> issues?
>> 
>> 
>> -
>>
>> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>> 
>> 
> 
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VJwgACgkQHPApP6U8
pFj0whAAh5BtS70kaQq/G/CdHIttfjCnkkrSsEqudyKhMuzuSL+TX8OFYYpHEL8g
sVsK7KWzoOCWKJa6v0St52vubU0yUh3xvgNv7VpkFkoEVL8+DuXeJrv+rKIcqI4m
HxcMwZJIQQhLbTHX0pYDMWN88WaG5tdJIKjQBNXy17JSr4WMTThT4Oiei34QCD7O
9G+Cji2C6gf83AJTlMdihNEh71M/Xh2BUuz10m6CN+M2DN7UikUhU+u6St6AQp/f
JTApL7cYS9d9weapGZiTHGwg6nyxj4morHRfT2BCMJq+tyK2u8X+Tim2cPzIyTdj
YdtJOJQ3RtZRufS0DYlTVk5+1kHWI7l8KVBo2yo4QuRwoxesigODPNLAVsZBsFgc
A1M2UyN4CKRAbTkVxoKq3ORVHXlDY6hPuCD8UATIzIfd/q0fdexue6Q8wMwOyQvp
6GuRc6WNCAXXaDdcUZzZFgteALiYG+GInLiisxP0THdb4vKQMn5XqV+PDFURAWmY
SY9MZ7bUQcT/MXXxeEbF+Wj34dBDolwtkOcZ9FfCBgmXRyhUCKcYg/UAwMeg6qkN
qGbtAGBRe4JzUqcKhJRLWu5Z6uoKhIcFdi8+cm3eM9cqZLcJIDAtxlbbVQDdUjZ1
X25QFzlgzMDu+b3reHus4TTWZ61GZ+ujzkgSAL0xrur5UvHpZLU=
=ruIX
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Terence,

On 1/7/20 7:33 PM, Terence M. Bandoian wrote:
> On 1/7/2020 4:04 PM, Zahid Rahman wrote:
>> Jerry Malcolm wrote :
>> 
>>> Again this is the SAME line of code in java reading the
>>> >SAME
>> field in
>>> the SAME database.  Only thing different is  >Linux/Windows OS
>> 
>> 
>> 
>> On Tue, 7 Jan 2020, 21:52 , 
>> wrote:
>> 
 -Original Message- From: Jerry Malcolm
  Sent: Tuesday, January 07, 2020 3:14
 PM To: users@tomcat.apache.org Subject: Re: Dates on Linux
 vs. Windows
 
 On 1/7/2020 3:09 PM, Michael Osipov wrote:
> Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:
>> This may be more of a Java question than Tomcat.  But I'm
>> not sure. I have the same code, talking to the same MySql
>> Linux (AWS) database. I read a date column value in a
>> Tomcat app.  After calling resultSet.getDate(...) I
>> printed the date instance and the getTime() value:
>> 
>> On windows: 2019-02-01 154900080
>> 
>> On linux:   2019-01-31 154897920
>> 
>> Again this is the SAME line of code in java reading the
>> SAME field in the SAME database.  Only thing different is
>> Linux/Windows OS.  The date is supposed to be 2/1/2019
>> and shows that in phpMyAdmin.
>> 
>> I've been running on Linux for a few months.  But I don't
>> have an extensive background in the specifics of Linux.
>> I'm sure there must be something that is configured
>> differently.  I'm at a loss. But this is not a trivial
>> problem.  I do monthly billing. My dates need to be 
>> accurate.
> Have you verified that you aren't tricked by any timezone
> issues?
 Probably so.  But how would I know?  I was under the
 impression that java.sql.Date was timezone independent.
 Shouldn't it simply convert a month/day/year value to the
 number of milliseconds since the epoch? How would timezone
 issues affect that?  And if I am 'tricked' how do I 
 'untrick'.  What do I set/change?
> 
>>> Those millisecond values are 6 hours apart, which looks like a
>>> timezone issue.  I happen to be in US Central time, which is 6
>>> hours earlier than UTC in winter.
>>> 
>>> You're right that System.currentTimeMillis() itself is
>>> independent of timezone but Date is not.
> 
> As I understand it, for certain date/time column types, MySQL
> subtracts the time zone from the value when written and adds it
> back in when read.  If your systems always use the same time zone
> to read and write the data, it isn't a problem.  But it can be if
> the time zone varies.
> 
> See https://dev.mysql.com/doc/refman/5.7/en/datetime.html

Only for TIMESTAMP columns, which are fairly rarely used. Usually, you
want a DATETIME field, which is a SQL standard.

> The actual behavior is a little confusing, at least to me, because
> I seem to remember variations in the storage of the date/time
> columns while the documentation seems to indicate that date/time
> values are not modified.  Also, if I remember correctly, writing a
> date/time value as a formatted string and then reading it back as a
> string (e.g. ResultSet.getString) and parsing it circumvented the
> time zone issue.

I've never had the intestinal fortitude to change the time zone on a
running MySQL server. So I'm not sure if it would shift every DATETIME
value I've ever written to it. Yikes, I'm using local time. I hope I
remember that for every server I ever migrate to.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VJrMACgkQHPApP6U8
pFgfyhAAu4jR5+hzu9oJJX9yN2rDeVw+3yGmHsiBF6eAZPUh7BLUkVV+kuhVxC+X
pqWAvgStzyUAt/L7mdxNbNhyDSBMn5WJgjenQ70eLTqg+u3PYtkB/S+zxDgfwRbN
x5WOzj/N1ypapdXCOZu7JnkmyL9tLQ1F+KfRIXPE9L6phlg4kDDvfvn9CGn+L/ir
YkWtDk6YcNiWo4tguYj3lXNQ68CGBM2gkYKjWVtNKO1Keit8w/GgHbXnm9QmzEX8
jeXAL1LO4kUVEZayfaEmaLaSVfltR6ROB1Ubx4KNMG777wy9ln0odP1KSdWcmq+u
Fu5kdsB25B+pxym0tPA21xIieGUp/4txCQn5WX66aLVS8CDgrWnl0uSP8iatZmPO
wKL6i4qCEfPXYNTzB+CcLBuiK/8PXqcnp3YO2Xj2nqvh4pqqmkCUgJBM5umQVmhR
7iH3T1LjWhOPEBUx50Vz7+Dd7yj4Z6CZ/ubRYXTWXmUifu8hO2d1YehYj0ean+3r
LaiTsmOHH9Tw1RDn+Wae4TCS+YEZZMLytSF2HnvXko87b/pU6eguapbO1ScBUepv
KFhAUWUAzPtdvf2aZhveVscLCFGR1+Jl3Zv31qjSSriPuB3shRpWa2Q+g0/KPwrl
zw3NiPsaIWL5hvxKdBllOKCMqoI7BwDlTkNocqb0QbHrYB5qcoA=
=ETH9
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Jerry Malcolm
Summarizing what I know now... when I use the command line on the linux 
instance and do a mysql query, I get the correct date (i.e. the date 
that I set, the date I wanted, the date that mySQL exports to SQL file, 
and the date that appears in Windows tomcat).  So this pretty much rules 
out the problem being in the mySQL server.  I would think this also 
rules out the problem being in some timezone setting  in the base Linux 
system hosting tomcat since I get the right date in the command line.  
That only leaves the JVM; JDBC package, and MySQL connector.   MySQL RDS 
instance is set to US Central timezone.  So it's going to return dates 
in central time, right?  It appears that jdbc and/or the connector is 
assuming the db is gmt and knocking off another 6 hours. Is there some 
place in the datasource to tell tomcat the timezone of the database so 
it knows not to convert TZ when it doesn't need to? I can't find 
anything like that in the datasource documentation.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Jerry,

On 1/7/20 7:03 PM, Jerry Malcolm wrote:
> 
> On 1/7/2020 5:31 PM, calder wrote:
>> On Tue, Jan 7, 2020, 17:17 Jerry Malcolm 
>> wrote:
>> 
 On Tue, 7 Jan 2020, 21:52 ,
  wrote:
>> '.  What do I set/change?
> Those millisecond values are 6 hours apart, which looks
> like a timezone issue.  I happen to be in US Central time,
> which is 6 hours earlier than UTC in winter.
> 
> You're right that System.currentTimeMillis() itself is
> independent of timezone but Date is not.
>>> That all makes sense.  But at the end of the day, what do I do
>>> to make it work right?  I am also in Central time.  My Linux OS
>>> is set to central (at least I tried to set that.  Afterwards my
>>> log entries are correctly logging in central time instead of
>>> gmt.  So I assume it's set right).   What do I need to do in
>>> Tomcat to 'fix' it so that sql dates aren't somehow adjusted?
>>> I simply want a 2019-02-01 in the database to appear as
>>> 2019-02-01 in java.  And the same code must work identically on
>>> both OS's.
>>> 
>> 
>> Have you checked the DST setting?
> 
> I googled around trying to see how to check DST in Amazon Linux.
> the Date command gave me the correct date and timezone with no DST
> which is currently correct.  I looked at the /etc/sysconfig/clock
> file.  It has two lines:
> 
> ZONE="CST6ST" UTC=true
> 
> But DST is only one hour change.  An earlier post said that my two 
> different values of times were 6 hours off.  Would DST be the cause
> of that?

Welcome to the wonderful world of civil date-reckoning.

First off: you have the correct date. You just aren't holding it
correctly[1].

Second, where are you showing this date? In a log somewhere? How are
you printing it?

If you are using java.sql.Date.toString(), then it should probably be
telling you the TZ. If you are using SimpleDateFormat then you need to
be aware that both java.util.Date (the surprising superclass of
java.sql.Date, which doesn't have a time portion!) and
SimpleDateFormat have their own TimeZone settings. And, for fun, there
is no SimpleDateFormat constructor which takes a TimeZone argument.
And, for more fun, java.util.Date doesn't have a TimeZone... it's got
a (primitive) long offset in milliseconds. And a DST offset. Which is
separate. Confused, yet?

So you pretty much always need to do this:

SimpleDateFormat df = new SimpleDateFormat("-MM-dd");
df.setTimeZone(TimeZone.getTimeZone("America/Chicago"));

Date d = ... // whatever

logger.trace("Got date: " + df.format(d));

If you aren't showing the time zone, you can always become confused.
For example, if your Date object has an offset in UTC and your
SimpleDateFormat is in US-CST, you can get different *days* depending
upon the time of day represented by the Date object.

It's a mess.

The only way to do it is to always always ALWAYS handle the time zone
properly.

If you are using java.sql.Date which should be -MM-dd *only*, then
you may have to truncate the time and/or adjust to e.g. UTC and maybe
even do both of those so that you never accidentally cross the
international date-line when interpreting your dates.

But the good news is that only the humans will be confused by these
dates. Generally speaking, the database and Java are doing things
correctly.

Unless you are accepting input.

Whenever you ask a user to enter a date (or, worse, a date-time), you
need to read their input *in their timezone*, since, well, that's how
they think. It's 19:38 local time for me, but for someone in London
it's 01:38 *tomorrow*. So if I ask them for the current datetime, they
will say 2020-01-08T01:38:00. If I don't interpret that as being in UK
Winter Time, then I might think that the timestamp represents
2020-01-08T01:38:00 CST. Or maybe whatever the default time zone is
for your EC2 instance. Or your JVM. Or for the user who actually
launched your JVM. This time.

So do yourself a favor and fix all your date-manipulation code so it's
always doing the right thing. It may take a while, but it will be Correc
t.

Everybody has to go through this at some point. Good luck.

Oh, and just so you don't feel like you bet on the wrong horse, this
isn't just a Java thing. It's the same with all languages. Java was
written in a quaint time when they thought that java.util.Date would
do everything necessary. Until java.util.Calendar came along. And then
Jodatime. And then java.time.*. If you look at most other languages,
there are similar progressions with vestigial leftovers that still
work, and are littered all over all the APIs.

- -chris

[1] https://knowyourmeme.com/memes/events/iphone-4-death-grip
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VJZ4ACgkQHPApP6U8
pFgnIQ//S3S/K34K80fQN4nhgzdFBlVEcko+tiDBD5GR2e3Tt0BJ36nF6v9D+p3o
Y37JRaMiU4T2SaMWXREs2rNID+UmZXsfB3Cfgvub+vFqGZiXeEUm2KMv8KS1NYER
goPZ0aSuRqKibI

Re: Dates on Linux vs. Windows

2020-01-07 Thread Terence M. Bandoian

On 1/7/2020 4:04 PM, Zahid Rahman wrote:

  Jerry Malcolm wrote :

  >Again this is the SAME line of code in java reading the   >SAME field in

the SAME database.  Only thing different is  >Linux/Windows OS




On Tue, 7 Jan 2020, 21:52 ,  wrote:


-Original Message-
From: Jerry Malcolm 
Sent: Tuesday, January 07, 2020 3:14 PM
To: users@tomcat.apache.org
Subject: Re: Dates on Linux vs. Windows

On 1/7/2020 3:09 PM, Michael Osipov wrote:

Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:

This may be more of a Java question than Tomcat.  But I'm not sure. I
have the same code, talking to the same MySql Linux (AWS) database.
I read a date column value in a Tomcat app.  After calling
resultSet.getDate(...) I printed the date instance and the getTime()
value:

On windows: 2019-02-01 154900080

On linux:   2019-01-31 154897920

Again this is the SAME line of code in java reading the SAME field in
the SAME database.  Only thing different is Linux/Windows OS.  The
date is supposed to be 2/1/2019 and shows that in phpMyAdmin.

I've been running on Linux for a few months.  But I don't have an
extensive background in the specifics of Linux.  I'm sure there must
be something that is configured differently.  I'm at a loss. But this
is not a trivial problem.  I do monthly billing. My dates need to be
accurate.

Have you verified that you aren't tricked by any timezone issues?

Probably so.  But how would I know?  I was under the impression that
java.sql.Date was timezone independent.  Shouldn't it simply convert a
month/day/year value to the number of milliseconds since the epoch?  How
would timezone issues affect that?  And if I am 'tricked' how do I
'untrick'.  What do I set/change?



Those millisecond values are 6 hours apart, which looks like a timezone
issue.  I happen to be in US Central time, which is 6 hours earlier than
UTC in winter.

You're right that System.currentTimeMillis() itself is independent of
timezone but Date is not.


As I understand it, for certain date/time column types, MySQL subtracts 
the time zone from the value when written and adds it back in when 
read.  If your systems always use the same time zone to read and write 
the data, it isn't a problem.  But it can be if the time zone varies.


See https://dev.mysql.com/doc/refman/5.7/en/datetime.html

The actual behavior is a little confusing, at least to me, because I 
seem to remember variations in the storage of the date/time columns 
while the documentation seems to indicate that date/time values are not 
modified.  Also, if I remember correctly, writing a date/time value as a 
formatted string and then reading it back as a string (e.g. 
ResultSet.getString) and parsing it circumvented the time zone issue.


Hope that helps.

-Terence Bandoian


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Breakthrough, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread James H. H. Lampert

On 1/7/20 4:17 PM, Christopher Schultz wrote:

iptables doesn't work on pipes, it works on packets. So you have to
redirect both incoming AND outgoing packets. That's why you have the
"output redirect" as well as the (more obvious) "input redirect".


Well, that just leaves me more puzzled than ever: why would our webapp 
(and Manager, for that matter) "work just fine" even though there's no 
sign of an output redirect in the iptables-save output (which I posted 
in its entirety)?


--
JHHL

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Curl problem with reloadSslHostConfigs, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

James,

On 1/7/20 1:33 PM, James H. H. Lampert wrote:
> This just gets weirder and weirder.
> 
> I added manager-jmx to the admin account. I continued to get "401 
> unauthorized."
> 
> I then tried setting up another user, temporarily, with a
> URL-friendly user-ID and password. If I just gave that user
> "manager-gui," I got "403 access denied" instead, regardless of
> whether I put the user-ID and password into the URL, or into a -u
> clause.
> 
> But then, when I tried adding "manager-jmx" to the temporary user,
> I got a null pointer exception!
> 
>> java.lang.NullPointerException at 
>> org.apache.catalina.manager.JMXProxyServlet.invokeOperationInternal(J
MXProxyServlet.java:264)
>>
>>
>> 
at
>> org.apache.catalina.manager.JMXProxyServlet.invokeOperation(JMXProxyS
ervlet.java:207)
>>
>>
>> 
at
>> org.apache.catalina.manager.JMXProxyServlet.doGet(JMXProxyServlet.jav
a:116)
>>
>>
>> 
at javax.servlet.http.HttpServlet.service(HttpServlet.java:635)
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) 
>> at 
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:231)
>>
>>
>> 
at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:166)
>>
>>
>> 
at
>> org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52
)
>>
>> 
at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:193)
>>
>>
>> 
at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:166)
>>
>>
>> 
at
>> org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCh
aracterEncodingFilter.java:109)
>>
>>
>> 
at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:193)
>>
>>
>> 
at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:166)
>>
>>
>> 
at
>> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:199)
>>
>>
>> 
at
>> org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:96)
>>
>>
>> 
at
>> org.apache.catalina.authenticator.AuthenticatorBase.invoke(Authentica
torBase.java:610)
>>
>>
>> 
at
>> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:137)
>>
>>
>> 
at
>> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:81)
>>
>>
>> 
at
>> org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAcce
ssLogValve.java:660)
>>
>>
>> 
at
>> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:87)
>>
>>
>> 
at
>> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:343)
>>
>>
>> 
at
>> org.apache.coyote.http11.Http11Processor.service(Http11Processor.java
:798)
>>
>>
>> 
at
>> org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLig
ht.java:66)
>>
>>
>> 
at
>> org.apache.coyote.AbstractProtocol$ConnectionHandler.process(Abstract
Protocol.java:808)
>>
>>
>> 
at
>> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpo
int.java:1498)
>>
>>
>> 
at
>> org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBas
e.java:49)
>>
>>
>> 
at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.
java:1149)
>>
>>
>> 
at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor
.java:624)
>>
>>
>> 
at
>> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskTh
read.java:61)
>>
>>
>> 
at java.lang.Thread.run(Thread.java:748)
> 
> What I have on this box is Tomcat 8.5.40, under JVM 1.8.0_201-b09
> 
> Anybody know what's wrong now?

You probably "spelled" something incorrectly. It might be a
quoting/escaping issue. It might be a literal misspelling/typo.

The JMXProxyServlet shouldn't NPE like that, though.

I'll take a look and see if we can give you a better error message
than that when it happens.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VICUACgkQHPApP6U8
pFgpHRAAquY32hPePQt4UBarAvgr1WkryFCoHXO+thEvVtpOj6/S/GBS3L6+Hxlu
muT90BbQsFy4fhGM7cmSSeC44GQB5FV0EXiMskDnlqohM0BwgiwGUEVaXW9L7UwA
G4KrOCRzYdgzjpdEmS2k1s71bcarawKD2sA7EB/GFmIZjTDj1Lgs66hGNNXsyy4e
vrWAYWpp3omSh40a5Z5+ROwOvyjI6hgft33UXFwZbbGQdTmpbx5Y8f9mTRnhh8R0
EMq1Olu9ONsbOi0SPHb4/8DHoBIT4cHgrBtV8mqX3MrSn91D55rVouZzmyOttgXO
txdH4mku8z8rr/C7+A8NG/Uc2R3YfH4tzYvzum+DavhL6HQ3N+Ob4GcRWwzR/RXN
D35zI4trxtELYpnwJ3nNnSms9J79CIO/jfODubsRlWmBQuKcDww4sWyHQGvMbMGZ
JW1MjCywXdcuKe9DXynxkTjjbbJktQEsszBhaFptJBzg7iG1BJXQmgXG70npj1pc
FZiqvyKF7fATkZLEeumYmeKzKAb3F2M8l8ZuInscaiBWwHskb6JNkKeZNzvMdiGn
kZibenXy78dhaYaldXrTzea7DYHFUdzaEL/1vRh6tdYM8OMHQBF+YIa41A5ICrPY
Tx5Oav1yO9QQpsgu+BYjxrrK536g6ezLc8d7HjXh6lmq5K+CFHc=
=jukF
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For

Re: Breakthrough, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

James,

On 1/7/20 12:28 PM, James H. H. Lampert wrote:
> On 1/7/20 7:32 AM, Christopher Schultz wrote:
>> Hah, sorry about that. Nobody thought of specifying that only
>> root can view the iptables stuff. :)
> 
> Not your fault, nor that of anybody else here; I blame the author
> of iptables and iptables-save: it should either (a) allow *anybody*
> to *see* the information, or (b) *tell* the user that he/she is
> not authorized to see it.
> 
> While I occasionally use "quiet failure" myself, when writing code
> to protect database fields from unauthorized modification, I
> generally do so only when it actually makes sense, and the user can
> actually *see* that his or her attempt to change the value(s) was
> quietly ignored.
> 
> ***
> 
> But I'm still puzzled about the "output redirect" specified in the 
> presentation, but absent from this installation (and yet it still
> works just fine).

iptables doesn't work on pipes, it works on packets. So you have to
redirect both incoming AND outgoing packets. That's why you have the
"output redirect" as well as the (more obvious) "input redirect".

> Does the "proxyPort" clause on the connector have something to do
> with it "working just fine" without the "output redirect"?

The proxyPort is just a configuration option which overrides the port
that will be used when Tomcat is building URLs that point back to
itself  (e.g. Location: for redirects). If Tomcat is listening on port
8443, then, obviously, port 8443 should be used. But if there is a
reverse-proxy in the way (or some other hand-wavy magic like
iptables), then you want to use the port that the CLIENT needs to use
to get back to you, regardless of the actual port being bound to by
Tomcat.

It's just like setting the virtual host hostname: you can't just
take-over "microsoft.com" by setting your 's hostname to
"microsoft.com". But if you don't do that, your users might be sent to
"node-1-6-2-4-6-32-34.binhost.net" which isn't quite what you want.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4VH60ACgkQHPApP6U8
pFiW/g//VnCbgnHs/fbsxKANfdIwNGSZP37SEkfLMOzQxBK9eC6nb6LQeWHw5FQd
8yVFVP1LnbvM0ey+UDhWME7Chbm9iyLfpMO09BqAuzcJWopODk9JYQOn0YFJsiVh
kcKeoUGLV1nw4I3qPdh0fjVRV6GDwSpt9XXZvwOZdIbqBUrS+rGuobBDJU5SaA8y
SSVzTYKqoHryJAt7yNiPkulrqpS7rgmiLbm/RvDfF5VFnaYMfh3/Mz7kmBhcvDDC
lkG2+Zs29g/mQ3YyCoKCKLfs0m7bS3WHlxv9qwsZkJzx0Rql2LJ1PSgPnO9vh4VH
LecAk9/6rQGySVuDY4f8r265Gm/jDAn5z+WWT8mv6FsbZZckYbm4f+8DYhxzWjh0
jYJNJf0dOorjjUY7hIQKw9k+QQgBKdufKtfHpDK5u1MIYsC8pdrzyjN9LFl566ad
ESEtlXjnFCzCr9wobi7YJAJLXc9rFsd/IoN988Oui69RIroqZWL6Jjxetj4fDr+8
RiJiTiSl8yWXZuSpkHrQuIrD4eLSpdoOWkrNJOOzDExuJbTpPpFABjapqSrWDEV/
BP0+xAKzeH4RMHLyUciVzw4czRe8DB/0mOBIxSv5z2LXKlef07McFzg8ACOsMCS2
oCG7vXqh7iZbNdB+AKhFs0+TIxJNcBe8bT75t0LF7xgcD0nyXf4=
=67mG
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Jerry Malcolm



On 1/7/2020 5:31 PM, calder wrote:

On Tue, Jan 7, 2020, 17:17 Jerry Malcolm  wrote:


On Tue, 7 Jan 2020, 21:52 ,  wrote:

'.  What do I set/change?

Those millisecond values are 6 hours apart, which looks like a timezone
issue.  I happen to be in US Central time, which is 6 hours earlier than
UTC in winter.

You're right that System.currentTimeMillis() itself is independent of
timezone but Date is not.

That all makes sense.  But at the end of the day, what do I do to make
it work right?  I am also in Central time.  My Linux OS is set to
central (at least I tried to set that.  Afterwards my log entries are
correctly logging in central time instead of gmt.  So I assume it's set
right).   What do I need to do in Tomcat to 'fix' it so that sql dates
aren't somehow adjusted?  I simply want a 2019-02-01 in the database to
appear as 2019-02-01 in java.  And the same code must work identically
on both OS's.



Have you checked the DST setting?


I googled around trying to see how to check DST in Amazon Linux. the 
Date command gave me the correct date and timezone with no DST which is 
currently correct.  I looked at the /etc/sysconfig/clock file.  It has 
two lines:


ZONE="CST6ST"
UTC=true

But DST is only one hour change.  An earlier post said that my two 
different values of times were 6 hours off.  Would DST be the cause of that?






-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread calder
On Tue, Jan 7, 2020, 17:17 Jerry Malcolm  wrote:

>
> > On Tue, 7 Jan 2020, 21:52 ,  wrote:
>

'.  What do I set/change?
> 
> >> Those millisecond values are 6 hours apart, which looks like a timezone
> >> issue.  I happen to be in US Central time, which is 6 hours earlier than
> >> UTC in winter.
> >>
> >> You're right that System.currentTimeMillis() itself is independent of
> >> timezone but Date is not.
>
> That all makes sense.  But at the end of the day, what do I do to make
> it work right?  I am also in Central time.  My Linux OS is set to
> central (at least I tried to set that.  Afterwards my log entries are
> correctly logging in central time instead of gmt.  So I assume it's set
> right).   What do I need to do in Tomcat to 'fix' it so that sql dates
> aren't somehow adjusted?  I simply want a 2019-02-01 in the database to
> appear as 2019-02-01 in java.  And the same code must work identically
> on both OS's.
>


Have you checked the DST setting?


Re: Dates on Linux vs. Windows

2020-01-07 Thread Jerry Malcolm



On 1/7/2020 4:04 PM, Zahid Rahman wrote:

  Jerry Malcolm wrote :

  >Again this is the SAME line of code in java reading the   >SAME field in

the SAME database.  Only thing different is  >Linux/Windows OS




On Tue, 7 Jan 2020, 21:52 ,  wrote:


-Original Message-
From: Jerry Malcolm 
Sent: Tuesday, January 07, 2020 3:14 PM
To: users@tomcat.apache.org
Subject: Re: Dates on Linux vs. Windows

On 1/7/2020 3:09 PM, Michael Osipov wrote:

Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:

This may be more of a Java question than Tomcat.  But I'm not sure. I
have the same code, talking to the same MySql Linux (AWS) database.
I read a date column value in a Tomcat app.  After calling
resultSet.getDate(...) I printed the date instance and the getTime()
value:

On windows: 2019-02-01 154900080

On linux:   2019-01-31 154897920

Again this is the SAME line of code in java reading the SAME field in
the SAME database.  Only thing different is Linux/Windows OS.  The
date is supposed to be 2/1/2019 and shows that in phpMyAdmin.

I've been running on Linux for a few months.  But I don't have an
extensive background in the specifics of Linux.  I'm sure there must
be something that is configured differently.  I'm at a loss. But this
is not a trivial problem.  I do monthly billing. My dates need to be
accurate.

Have you verified that you aren't tricked by any timezone issues?

Probably so.  But how would I know?  I was under the impression that
java.sql.Date was timezone independent.  Shouldn't it simply convert a
month/day/year value to the number of milliseconds since the epoch?  How
would timezone issues affect that?  And if I am 'tricked' how do I
'untrick'.  What do I set/change?



Those millisecond values are 6 hours apart, which looks like a timezone
issue.  I happen to be in US Central time, which is 6 hours earlier than
UTC in winter.

You're right that System.currentTimeMillis() itself is independent of
timezone but Date is not.


That all makes sense.  But at the end of the day, what do I do to make 
it work right?  I am also in Central time.  My Linux OS is set to 
central (at least I tried to set that.  Afterwards my log entries are 
correctly logging in central time instead of gmt.  So I assume it's set 
right).   What do I need to do in Tomcat to 'fix' it so that sql dates 
aren't somehow adjusted?  I simply want a 2019-02-01 in the database to 
appear as 2019-02-01 in java.  And the same code must work identically 
on both OS's.


Thanks







-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Zahid Rahman
 Jerry Malcolm wrote :

 >Again this is the SAME line of code in java reading the   >SAME field in
> the SAME database.  Only thing different is  >Linux/Windows OS




On Tue, 7 Jan 2020, 21:52 ,  wrote:

>
> > -Original Message-
> > From: Jerry Malcolm 
> > Sent: Tuesday, January 07, 2020 3:14 PM
> > To: users@tomcat.apache.org
> > Subject: Re: Dates on Linux vs. Windows
> >
> > On 1/7/2020 3:09 PM, Michael Osipov wrote:
> > > Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:
> > >> This may be more of a Java question than Tomcat.  But I'm not sure. I
> > >> have the same code, talking to the same MySql Linux (AWS) database.
> > >> I read a date column value in a Tomcat app.  After calling
> > >> resultSet.getDate(...) I printed the date instance and the getTime()
> > >> value:
> > >>
> > >> On windows: 2019-02-01 154900080
> > >>
> > >> On linux:   2019-01-31 154897920
> > >>
> > >> Again this is the SAME line of code in java reading the SAME field in
> > >> the SAME database.  Only thing different is Linux/Windows OS.  The
> > >> date is supposed to be 2/1/2019 and shows that in phpMyAdmin.
> > >>
> > >> I've been running on Linux for a few months.  But I don't have an
> > >> extensive background in the specifics of Linux.  I'm sure there must
> > >> be something that is configured differently.  I'm at a loss. But this
> > >> is not a trivial problem.  I do monthly billing. My dates need to be
> > >> accurate.
> > >
> > > Have you verified that you aren't tricked by any timezone issues?
> > Probably so.  But how would I know?  I was under the impression that
> > java.sql.Date was timezone independent.  Shouldn't it simply convert a
> > month/day/year value to the number of milliseconds since the epoch?  How
> > would timezone issues affect that?  And if I am 'tricked' how do I
> > 'untrick'.  What do I set/change?
> > >
> > >
>
> Those millisecond values are 6 hours apart, which looks like a timezone
> issue.  I happen to be in US Central time, which is 6 hours earlier than
> UTC in winter.
>
> You're right that System.currentTimeMillis() itself is independent of
> timezone but Date is not.
>
>
>
>


RE: Dates on Linux vs. Windows

2020-01-07 Thread John.E.Gregg

> -Original Message-
> From: Jerry Malcolm 
> Sent: Tuesday, January 07, 2020 3:14 PM
> To: users@tomcat.apache.org
> Subject: Re: Dates on Linux vs. Windows
> 
> On 1/7/2020 3:09 PM, Michael Osipov wrote:
> > Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:
> >> This may be more of a Java question than Tomcat.  But I'm not sure. I
> >> have the same code, talking to the same MySql Linux (AWS) database.
> >> I read a date column value in a Tomcat app.  After calling
> >> resultSet.getDate(...) I printed the date instance and the getTime()
> >> value:
> >>
> >> On windows: 2019-02-01 154900080
> >>
> >> On linux:   2019-01-31 154897920
> >>
> >> Again this is the SAME line of code in java reading the SAME field in
> >> the SAME database.  Only thing different is Linux/Windows OS.  The
> >> date is supposed to be 2/1/2019 and shows that in phpMyAdmin.
> >>
> >> I've been running on Linux for a few months.  But I don't have an
> >> extensive background in the specifics of Linux.  I'm sure there must
> >> be something that is configured differently.  I'm at a loss. But this
> >> is not a trivial problem.  I do monthly billing. My dates need to be
> >> accurate.
> >
> > Have you verified that you aren't tricked by any timezone issues?
> Probably so.  But how would I know?  I was under the impression that
> java.sql.Date was timezone independent.  Shouldn't it simply convert a
> month/day/year value to the number of milliseconds since the epoch?  How
> would timezone issues affect that?  And if I am 'tricked' how do I
> 'untrick'.  What do I set/change?
> >
> >

Those millisecond values are 6 hours apart, which looks like a timezone issue.  
I happen to be in US Central time, which is 6 hours earlier than UTC in winter.

You're right that System.currentTimeMillis() itself is independent of timezone 
but Date is not.





Re: Dates on Linux vs. Windows

2020-01-07 Thread Zahid Rahman
If you wish  to find out if the database connection API is buggy.

Is the result when you use select query from each of the operating system
same.

Select column_name  from table;


If select on both return values are same then likely  the database API is
buggy.  You have choice of two database connection APIs.

One API is tomcat specific.
The other  is vendor neutral.



On Tue, 7 Jan 2020, 21:09 Michael Osipov,  wrote:

> Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:
> > This may be more of a Java question than Tomcat.  But I'm not sure.  I
> > have the same code, talking to the same MySql Linux (AWS) database.  I
> > read a date column value in a Tomcat app.  After calling
> > resultSet.getDate(...) I printed the date instance and the getTime()
> value:
> >
> > On windows: 2019-02-01 154900080
> >
> > On linux:   2019-01-31 154897920
> >
> > Again this is the SAME line of code in java reading the SAME field in
> > the SAME database.  Only thing different is Linux/Windows OS.  The date
> > is supposed to be 2/1/2019 and shows that in phpMyAdmin.
> >
> > I've been running on Linux for a few months.  But I don't have an
> > extensive background in the specifics of Linux.  I'm sure there must be
> > something that is configured differently.  I'm at a loss. But this is
> > not a trivial problem.  I do monthly billing. My dates need to be
> accurate.
>
> Have you verified that you aren't tricked by any timezone issues?
>
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>


Re: Dates on Linux vs. Windows

2020-01-07 Thread Jerry Malcolm

On 1/7/2020 3:09 PM, Michael Osipov wrote:

Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:
This may be more of a Java question than Tomcat.  But I'm not sure.  
I have the same code, talking to the same MySql Linux (AWS) 
database.  I read a date column value in a Tomcat app.  After calling 
resultSet.getDate(...) I printed the date instance and the getTime() 
value:


On windows: 2019-02-01 154900080

On linux:   2019-01-31 154897920

Again this is the SAME line of code in java reading the SAME field in 
the SAME database.  Only thing different is Linux/Windows OS.  The 
date is supposed to be 2/1/2019 and shows that in phpMyAdmin.


I've been running on Linux for a few months.  But I don't have an 
extensive background in the specifics of Linux.  I'm sure there must 
be something that is configured differently.  I'm at a loss. But this 
is not a trivial problem.  I do monthly billing. My dates need to be 
accurate.


Have you verified that you aren't tricked by any timezone issues?
Probably so.  But how would I know?  I was under the impression that 
java.sql.Date was timezone independent.  Shouldn't it simply convert a 
month/day/year value to the number of milliseconds since the epoch?  How 
would timezone issues affect that?  And if I am 'tricked' how do I 
'untrick'.  What do I set/change?



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Felix Schumacher


Am 07.01.20 um 21:58 schrieb Jerry Malcolm:
> This may be more of a Java question than Tomcat.  But I'm not sure.  I
> have the same code, talking to the same MySql Linux (AWS) database.  I
> read a date column value in a Tomcat app.  After calling
> resultSet.getDate(...) I printed the date instance and the getTime()
> value:
>
> On windows: 2019-02-01 154900080
>
> On linux:   2019-01-31 154897920
>
> Again this is the SAME line of code in java reading the SAME field in
> the SAME database.  Only thing different is Linux/Windows OS.  The
> date is supposed to be 2/1/2019 and shows that in phpMyAdmin.
>
> I've been running on Linux for a few months.  But I don't have an
> extensive background in the specifics of Linux.  I'm sure there must
> be something that is configured differently.  I'm at a loss. But this
> is not a trivial problem.  I do monthly billing. My dates need to be
> accurate.
>
> What am I doing wrong? (BTW Tomcat 8.5.x and Java 1.8.0_222 running on
> AWS Linux, not AWS Linux 2).

Maybe different timezone settings on the clients that propagate to the
database?

Have you looked at setting/reading the timezones in mysql (and after
that on the clients) like
https://stackoverflow.com/questions/930900/how-do-i-set-the-time-zone-of-mysql

On linux a simple "date" command will print out the currently used
timezone. For me it prints:

$ date
Di 7. Jan 22:06:37 CET 2020

or without a language setting:

$ LANG= date
Tue Jan  7 22:12:05 CET 2020

Felix

>
> Thanks.
>
> Jerry
>
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Dates on Linux vs. Windows

2020-01-07 Thread Michael Osipov

Am 2020-01-07 um 21:58 schrieb Jerry Malcolm:
This may be more of a Java question than Tomcat.  But I'm not sure.  I 
have the same code, talking to the same MySql Linux (AWS) database.  I 
read a date column value in a Tomcat app.  After calling 
resultSet.getDate(...) I printed the date instance and the getTime() value:


On windows: 2019-02-01 154900080

On linux:   2019-01-31 154897920

Again this is the SAME line of code in java reading the SAME field in 
the SAME database.  Only thing different is Linux/Windows OS.  The date 
is supposed to be 2/1/2019 and shows that in phpMyAdmin.


I've been running on Linux for a few months.  But I don't have an 
extensive background in the specifics of Linux.  I'm sure there must be 
something that is configured differently.  I'm at a loss. But this is 
not a trivial problem.  I do monthly billing. My dates need to be accurate.


Have you verified that you aren't tricked by any timezone issues?


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Dates on Linux vs. Windows

2020-01-07 Thread Jerry Malcolm
This may be more of a Java question than Tomcat.  But I'm not sure.  I 
have the same code, talking to the same MySql Linux (AWS) database.  I 
read a date column value in a Tomcat app.  After calling 
resultSet.getDate(...) I printed the date instance and the getTime() value:


On windows: 2019-02-01 154900080

On linux:   2019-01-31 154897920

Again this is the SAME line of code in java reading the SAME field in 
the SAME database.  Only thing different is Linux/Windows OS.  The date 
is supposed to be 2/1/2019 and shows that in phpMyAdmin.


I've been running on Linux for a few months.  But I don't have an 
extensive background in the specifics of Linux.  I'm sure there must be 
something that is configured differently.  I'm at a loss. But this is 
not a trivial problem.  I do monthly billing. My dates need to be accurate.


What am I doing wrong? (BTW Tomcat 8.5.x and Java 1.8.0_222 running on 
AWS Linux, not AWS Linux 2).


Thanks.

Jerry


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Apache SSI breaks with tomcat-connectors-1.2.43 or newer

2020-01-07 Thread Mark Thomas
On 07/01/2020 20:22, Ezsra McDonald wrote:
> Mark,
> 
> Has there been a decision on when a new release with the fix will go out?

It hasn't been forgotten. It is around the middle of my fairly long TODO
list.

I'd like to say I should get to it this month but between the stuff that
is already above it on the TODO list and what might turn up in the next
few weeks I can't be at all sure I'll get to it by the end of the month.

Mark


> 
> On Fri, Oct 4, 2019 at 10:50 AM Ezsra McDonald 
> wrote:
> 
>> The SVN Build works for us! Thanks Mark.
>>
>> When do you think the official release will be ready?
>>
>> --Ez
>>
>> On Wed, Oct 2, 2019 at 10:02 AM Mark Thomas  wrote:
>>
>>> On 02/10/2019 15:39, Mark Thomas wrote:
 On 02/10/2019 14:51, Mark Thomas wrote:
>>>
>>>
>>> 
>>>
 There is a work-around. Use virtual="..." in the SSI includes.

 Meanwhile, I am working on a fix for mod_jk.
>>>
>>> Done. If you want to test it out you'll have to build from svn.
>>> Meanwhile, I'll start thinking about a mod_jk release. We haven't had
>>> one for about a year and this bug fix seems like a good reason to have
>>> one.
>>>
>>> Mark
>>>
>>> -
>>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>>> For additional commands, e-mail: users-h...@tomcat.apache.org
>>>
>>>
> 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Apache SSI breaks with tomcat-connectors-1.2.43 or newer

2020-01-07 Thread Ezsra McDonald
Mark,

Has there been a decision on when a new release with the fix will go out?

On Fri, Oct 4, 2019 at 10:50 AM Ezsra McDonald 
wrote:

> The SVN Build works for us! Thanks Mark.
>
> When do you think the official release will be ready?
>
> --Ez
>
> On Wed, Oct 2, 2019 at 10:02 AM Mark Thomas  wrote:
>
>> On 02/10/2019 15:39, Mark Thomas wrote:
>> > On 02/10/2019 14:51, Mark Thomas wrote:
>>
>>
>> 
>>
>> > There is a work-around. Use virtual="..." in the SSI includes.
>> >
>> > Meanwhile, I am working on a fix for mod_jk.
>>
>> Done. If you want to test it out you'll have to build from svn.
>> Meanwhile, I'll start thinking about a mod_jk release. We haven't had
>> one for about a year and this bug fix seems like a good reason to have
>> one.
>>
>> Mark
>>
>> -
>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>>
>>


Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Peter Kreuser
Mark,

maybe this getting offtopic.

> Am 07.01.2020 um 18:58 schrieb Mark Thomas :
> 
> On 07/01/2020 16:22, Christopher Schultz wrote:
> 
> 
> 
>> Since the Host header seems to be special in this regard (i.e. there
>> is no prohibition against multiple Accept headers), might we be
>> willing to interpret the spec in a slightly less strict manner?
>> 
>> "
>> A server MUST respond with a 400 (Bad Request) status code to any
>> HTTP/1.1 request message that lacks a Host header field and to any
>> request message that contains more than one Host header field [[WITH A
>> CONFLICTING VALUE]]] or a Host header field with an invalid field-value.
>> "
>> 
>> So a request with:
>> 
>> Host: foo.bar.com
>> Host: foo.bar.com
>> 
>> Would be okay, while:
>> 
>> Host: foo.bar.com
>> Host: bar.foo.com
>> 
>> Would return a 400 response?
> 
> Not sure.
> 
> The usual concern with multiple headers is that a reverse proxy uses
> one, the back-end uses another and you get unexpected behaviour that may
> result in some sort of information leak - i.e. a vulnerability. That
> shouldn't apply here since the values are the same.
> 
> Experience suggests that being more relaxed about parsing an HTTP
> request that the specification requires is likely to result - at some
> point in the future - with a vulnerability report.
> 

> In this instance I can image some other server somehow merging the two
> header values and - essentially - treating it as a different value to
> Tomcat. That could lead to a similar information disclosure as above.
> 

I didn’t think that far! However, if they are the same and tomcat would also 
have to respond to the given host, that would be extremely unlikely...


> The usual counter argument is that there is no vulnerability if the
> other server is spec compliant. But the same is true if Tomcat is spec
> compliant.
> 
> I certainly wouldn't support this behaviour by default.
> 

Agreed.

> Making the behaviour configurable is possible so it could be enabled
> when necessary and safe to do so (i.e. clients connecting directly to
> Tomcat). That then gets you to the question how complex would this be to
> implement and is that complexity justified by the benefit it brings?
> 
Just thinking how to handle “n” Host headers at various locations in the 
request... 8-0

> At this point, I'm not sure.
> 
> So far we are looking at a feature required by a single user to handle
> clearly non-spec compliant clients. I lean more towards a custom
> protocol / processor implementation when a single user is affected.
> 
That’s true.

Could this be a documented “extra”? Like a drop-in Jar?

Peter

> Mark
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
> 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Curl problem with reloadSslHostConfigs, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread James H. H. Lampert

This just gets weirder and weirder.

I added manager-jmx to the admin account. I continued to get "401 
unauthorized."


I then tried setting up another user, temporarily, with a URL-friendly 
user-ID and password. If I just gave that user "manager-gui," I got "403 
access denied" instead, regardless of whether I put the user-ID and 
password into the URL, or into a -u clause.


But then, when I tried adding "manager-jmx" to the temporary user, I got 
a null pointer exception!



java.lang.NullPointerException
at 
org.apache.catalina.manager.JMXProxyServlet.invokeOperationInternal(JMXProxyServlet.java:264)
at 
org.apache.catalina.manager.JMXProxyServlet.invokeOperation(JMXProxyServlet.java:207)
at 
org.apache.catalina.manager.JMXProxyServlet.doGet(JMXProxyServlet.java:116)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:635)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at 
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at 
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at 
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at 
org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)
at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at 
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at 
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
at 
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at 
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:610)
at 
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:137)
at 
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
at 
org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:660)
at 
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at 
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
at 
org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:798)
at 
org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at 
org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:808)
at 
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1498)
at 
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at 
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at 
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at 
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)


What I have on this box is Tomcat 8.5.40, under JVM 1.8.0_201-b09

Anybody know what's wrong now?

--
JHHL

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Mark Thomas
On 07/01/2020 16:22, Christopher Schultz wrote:



> Since the Host header seems to be special in this regard (i.e. there
> is no prohibition against multiple Accept headers), might we be
> willing to interpret the spec in a slightly less strict manner?
> 
> "
> A server MUST respond with a 400 (Bad Request) status code to any
> HTTP/1.1 request message that lacks a Host header field and to any
> request message that contains more than one Host header field [[WITH A
> CONFLICTING VALUE]]] or a Host header field with an invalid field-value.
> "
> 
> So a request with:
> 
> Host: foo.bar.com
> Host: foo.bar.com
> 
> Would be okay, while:
> 
> Host: foo.bar.com
> Host: bar.foo.com
> 
> Would return a 400 response?

Not sure.

The usual concern with multiple headers is that a reverse proxy uses
one, the back-end uses another and you get unexpected behaviour that may
result in some sort of information leak - i.e. a vulnerability. That
shouldn't apply here since the values are the same.

Experience suggests that being more relaxed about parsing an HTTP
request that the specification requires is likely to result - at some
point in the future - with a vulnerability report.

In this instance I can image some other server somehow merging the two
header values and - essentially - treating it as a different value to
Tomcat. That could lead to a similar information disclosure as above.

The usual counter argument is that there is no vulnerability if the
other server is spec compliant. But the same is true if Tomcat is spec
compliant.

I certainly wouldn't support this behaviour by default.

Making the behaviour configurable is possible so it could be enabled
when necessary and safe to do so (i.e. clients connecting directly to
Tomcat). That then gets you to the question how complex would this be to
implement and is that complexity justified by the benefit it brings?

At this point, I'm not sure.

So far we are looking at a feature required by a single user to handle
clearly non-spec compliant clients. I lean more towards a custom
protocol / processor implementation when a single user is affected.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Breakthrough, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread James H. H. Lampert

On 1/7/20 7:32 AM, Christopher Schultz wrote:

Hah, sorry about that. Nobody thought of specifying that only root can
view the iptables stuff. :)


Not your fault, nor that of anybody else here; I blame the author of 
iptables and iptables-save: it should either (a) allow *anybody* to 
*see* the information, or (b) *tell* the user that he/she is not 
authorized to see it.


While I occasionally use "quiet failure" myself, when writing code to 
protect database fields from unauthorized modification, I generally do 
so only when it actually makes sense, and the user can actually *see* 
that his or her attempt to change the value(s) was quietly ignored.


***

But I'm still puzzled about the "output redirect" specified in the 
presentation, but absent from this installation (and yet it still works 
just fine). Does the "proxyPort" clause on the connector have something 
to do with it "working just fine" without the "output redirect"?


--
JHHL

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Peter Kreuser



Chris (and Mark),



> Am 07.01.2020 um 17:22 schrieb Christopher Schultz 
> :
> 
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
> 
> Mark,
> 
>> On 1/7/20 4:36 AM, Mark Thomas wrote:
>>> On 07/01/2020 07:10, Dennis Rech wrote:
>>> POST /foo HTTP/1.1 Host: foo.com POST /foo HTTP/1.1 Host:
>>> foo.com Content-[stuff] [...]
>> 
>> First two lines are OK.
>> 
>> The third line is going to be treated as an HTTP header. It is
>> invalid and Tomcat will reject it with a 400 response but you can
>> tell Tomcat to just ignore the invalid header with
>> rejectIllegalHeaderName="false" on the Connector.
>> 
>> The problem is going to be the second Host header.
>> 
>> RFC 7230 states:
>> 
>>  A server MUST respond with a 400 (Bad Request) status code
>> to any HTTP/1.1 request message that lacks a Host header field and
>> to any request message that contains more than one Host header
>> field or a Host header field with an invalid field-value. 
>> 
>> Any spec compliant server is almost certainly going to reject that 
>> request. I guess a server might provide a hook for request
>> modification prior to rejection to allow the "fixing" of known
>> invalid requests but I'm not aware of any that do - at least not
>> without going down the writing a custom module route.
>> 
>> If we made Http11Processor.prepareRequest() protected then it would
>> be fairly simple to write a custom Processor that: - extended
>> Http11Processor - overrode prepareRequest() to a) remove the
>> duplicate Host header b) call super.prepareRequest()
>> 
>> I could provide one for you if you weren't comfortable doing that 
>> yourself). However, even if we made the change now (which I'm happy
>> to do if you think it would be useful) it will take a while to
>> filter through to the Debian distribution.
>> 
>> There are several variations on this theme. One could write a
>> custom Processor for 8.5.50 that did the same thing - it would just
>> be rather more involved as one would have to copy rather more code
>> from Http11Processor.
> 
> Since the Host header seems to be special in this regard (i.e. there
> is no prohibition against multiple Accept headers), might we be
> willing to interpret the spec in a slightly less strict manner?
> 
> "
> A server MUST respond with a 400 (Bad Request) status code to any
> HTTP/1.1 request message that lacks a Host header field and to any
> request message that contains more than one Host header field [[WITH A
> CONFLICTING VALUE]]] or a Host header field with an invalid field-value.
> "

That would be a good idea - maybe only in conjunction with setting 
rejectIllegalHeaderName=false

If that makes the implementation easier???


> 
> So a request with:
> 
> Host: foo.bar.com
> Host: foo.bar.com
> 
> Would be okay, while:
> 
> Host: foo.bar.com
> Host: bar.foo.com
> 
> Would return a 400 response?
> 

That would be a messed up request and worth a 400!

Peter

> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
> 
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4UsEEACgkQHPApP6U8
> pFjprxAAi60mVwH+LHo2HSCl+hwIhIyG2B9Dg2LjIJ8JPMA/WxaiDOOJCS+yMTbV
> rVfdPrlT0B6Zd8ceTjz4ooZa79SwPFfCiFM97q1H/JwwsqVxaBEFEx6PgvnJzUUF
> ZuJJEtQHijQgZo0gXv2plkqHTBrG5NMPNqQYEJ8aZqdjtSvtNkP2E03agVC/8SqW
> mNyERNFcyOP3hUlNHSghPXl81ckSabqa83rLrwFCZQGJ2U71EnnietYxXT5Dz6Kx
> W03z8HY2mClTETmZB/WvkCmG0F1AXQ8Xr2E4fJ2+meyNHgTZ2XjfYsKtZNKTQmiC
> zlDgweuXuQ1r6DorLB4MUCm7HMffeDTwKEHBaYkIt7reHN8yGfT8sq1F8A0ZDKHi
> y9Ugt0KwePPOGFK8mfST7lBWojPJL1wbyBVAYh+FL5f1hMScOdHRxbU9uz2p9NSB
> RMubUWNCD1p8+sI8bLjQ//vU/iCLcWg7RStr/FSfXZEqjJv6EZ4OaNafahTcxvey
> 37Qz/eVTJQGeYa0+1rBvttVZJB6xrJwcscC3dgskTJ8VXJuAnwK0WdmMRzD7XLos
> HP13SOoLXUgek07XH61OPq5dnbpUwq996GqpSLldLUJlCnbMi1vxkAmGe006zVXH
> GWPoV1d4r7p0JjkyBlGQYUwiltuDFyNOx9uRS5FTaapaarhY6G0=
> =Z571
> -END PGP SIGNATURE-
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
> 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Mark,

On 1/7/20 4:36 AM, Mark Thomas wrote:
> On 07/01/2020 07:10, Dennis Rech wrote:
>> POST /foo HTTP/1.1 Host: foo.com POST /foo HTTP/1.1 Host:
>> foo.com Content-[stuff] [...]
> 
> First two lines are OK.
> 
> The third line is going to be treated as an HTTP header. It is
> invalid and Tomcat will reject it with a 400 response but you can
> tell Tomcat to just ignore the invalid header with
> rejectIllegalHeaderName="false" on the Connector.
> 
> The problem is going to be the second Host header.
> 
> RFC 7230 states:
> 
>  A server MUST respond with a 400 (Bad Request) status code
> to any HTTP/1.1 request message that lacks a Host header field and
> to any request message that contains more than one Host header
> field or a Host header field with an invalid field-value. 
> 
> Any spec compliant server is almost certainly going to reject that 
> request. I guess a server might provide a hook for request
> modification prior to rejection to allow the "fixing" of known
> invalid requests but I'm not aware of any that do - at least not
> without going down the writing a custom module route.
> 
> If we made Http11Processor.prepareRequest() protected then it would
> be fairly simple to write a custom Processor that: - extended
> Http11Processor - overrode prepareRequest() to a) remove the
> duplicate Host header b) call super.prepareRequest()
> 
> I could provide one for you if you weren't comfortable doing that 
> yourself). However, even if we made the change now (which I'm happy
> to do if you think it would be useful) it will take a while to
> filter through to the Debian distribution.
> 
> There are several variations on this theme. One could write a
> custom Processor for 8.5.50 that did the same thing - it would just
> be rather more involved as one would have to copy rather more code
> from Http11Processor.

Since the Host header seems to be special in this regard (i.e. there
is no prohibition against multiple Accept headers), might we be
willing to interpret the spec in a slightly less strict manner?

"
A server MUST respond with a 400 (Bad Request) status code to any
HTTP/1.1 request message that lacks a Host header field and to any
request message that contains more than one Host header field [[WITH A
CONFLICTING VALUE]]] or a Host header field with an invalid field-value.
"

So a request with:

Host: foo.bar.com
Host: foo.bar.com

Would be okay, while:

Host: foo.bar.com
Host: bar.foo.com

Would return a 400 response?

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4UsEEACgkQHPApP6U8
pFjprxAAi60mVwH+LHo2HSCl+hwIhIyG2B9Dg2LjIJ8JPMA/WxaiDOOJCS+yMTbV
rVfdPrlT0B6Zd8ceTjz4ooZa79SwPFfCiFM97q1H/JwwsqVxaBEFEx6PgvnJzUUF
ZuJJEtQHijQgZo0gXv2plkqHTBrG5NMPNqQYEJ8aZqdjtSvtNkP2E03agVC/8SqW
mNyERNFcyOP3hUlNHSghPXl81ckSabqa83rLrwFCZQGJ2U71EnnietYxXT5Dz6Kx
W03z8HY2mClTETmZB/WvkCmG0F1AXQ8Xr2E4fJ2+meyNHgTZ2XjfYsKtZNKTQmiC
zlDgweuXuQ1r6DorLB4MUCm7HMffeDTwKEHBaYkIt7reHN8yGfT8sq1F8A0ZDKHi
y9Ugt0KwePPOGFK8mfST7lBWojPJL1wbyBVAYh+FL5f1hMScOdHRxbU9uz2p9NSB
RMubUWNCD1p8+sI8bLjQ//vU/iCLcWg7RStr/FSfXZEqjJv6EZ4OaNafahTcxvey
37Qz/eVTJQGeYa0+1rBvttVZJB6xrJwcscC3dgskTJ8VXJuAnwK0WdmMRzD7XLos
HP13SOoLXUgek07XH61OPq5dnbpUwq996GqpSLldLUJlCnbMi1vxkAmGe006zVXH
GWPoV1d4r7p0JjkyBlGQYUwiltuDFyNOx9uRS5FTaapaarhY6G0=
=Z571
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat 9 does not allow to read file in /tmp folder with 777 permission?

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Zahid,

On 1/7/20 9:17 AM, zahid wrote:
>> Well - why do you think someone is calling you names? Mark did
>> not,
> right?
> 
> My efforts in chasing up a bug which effected many Apache  and non 
> Apache products
> 
> and  with MR Emmanuel Bourg 's  DILIGENT , VIGOROUS  efforts
> produced this :-
> 
> [1] https://bugs.debian.org/948309 [2]
> https://bugs.debian.org/948310
> 
> IBM can now upgrade from JDK 8 
> https://developer.ibm.com/javasdk/downloads/.
> 
> if this was their issue too.
> 
> I also sent same message to Apache Struts because the local expert
> there was recommending to use JDK 8 to people who had MAVEN warning
> caused when using Internationalisation API. (I looked through
> archive and saw that)
> 
> I also sent same message to Apache NetBeans because they were
> using Maven 3.3.9 (2015)  which knows nothing about the  trouble
> some java classes.
> 
>> Well - why do you think someone is calling you names? Mark did
>> not,
> right?
> 
> Mark T refer to me as "troll"
> 
> I am not part of the fashion victim of *nix, so  Mr Shultz also
> referred to me as a "troll".

Anyone who is stirring-up off-topic trouble on a mailing list for no
apparent purpose is trolling. Whether or not that makes you a troll is
debatable.

But posting messages about how one operating environment versus
another is superior/inferior is definitely off-topic, especially if it
is not some frustration which you are trying to solve and get past. It
is not useful to the community to post open-ended complaints about
e.g. UNIX or Windows for that matter. So if you hate the UNIX
philosophy, that's fine. We just don't really care to hear you
complain about it. We also don't want to hear complaints about
Windows, MacOS, BeOS, iOS, etc., either.

Extending the (useless) debate just wastes people's time. Extending
the debate is also a technique used by trolls to continue to anger peopl
e.

This is a community that exists to support users of Apache Tomcat.
If you are having a specific problem with an operating environment,
someone (or, typically, more than one someone) who has expertise in
that environment will generally try to explain what is happening and
help you. Complaining about the answer doesn't encourage others to
help you in the future. It also discourages others from participating
in the community, and THAT is the reason why we will (eventually) ban
people who continuously troll our community.

We are not threatening to ban you. We are explaining that actual
trolls WILL be banned.

- -chris

> On 06/01/2020 21:45, logo wrote:
>> Well - why do you think someone is calling you names? Mark did
>> not, right?
>> 
>>> Am 06.01.2020 um 22:11 schrieb Zahid Rahman
>>> :
>>> 
>>> Are you calling me names  ?
>>> 
>>> On Mon, 6 Jan 2020, 20:35 Mark Thomas, 
>>> wrote:
>>> 
 On 06/01/2020 16:29, Christopher Schultz wrote:
> You have a right to a view, and you can troll all you want.
> But you will be ignored.
 Up to a point.
 
 Users that continue to troll will be unsubscribed and blocked
 from re-subscribing.
 
 As a general reminder aimed at keeping noise down on the
 list:
 
 Please don't feed the trolls.
 
 
 Mark
 
 ---
- --

 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail:
 users-h...@tomcat.apache.org
 
 
>> 
>> -
>>
>> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>> 
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4UrqMACgkQHPApP6U8
pFjx/w//Xs5LSFDgWtubi3hDdQqr/IYzPCSfWWhxsRxtT9sZRXx3dPd+O39Hj62v
7+Oiy/hQcTx+LFhLpdxbaJ2ntHU5B+Cj1336ikd8ndpeauMK8XPibv/Zf/fmeQb1
WO6g2+o4HA0OGtVtcZ56Q8W7UduHcVUHIYxim1dclscABrHbNzyNI+biX8IPA5Uu
D2XmItyjRuRnFZjeSwNAjMD+zPRs2K/j7Q+IDChObJJasjX04cDOV2QWKnAlUTWb
yoY5we6I7qVrGymp0eHovlMN6wKU+d620+/XKd9CLPlcID/TcAzmyCdxInKob+9m
uXW/B9CDAY3TwpiSIE6nsfjox/vCoNzLB6nUWH16VtTf+YqQwk036vvcpsX4qvof
uiV8I7PdUuwIik/g5/uaynXlSXOY+QMls0p4dveIj89GYhlGKuv/w3KZh5ugedSO
RYzHDyiHtCkP2uQddJMxKbsjEV4sWfai5I2TY7BUBoL8muPFso8/o8fwjK32yaUt
a3HrEAWa/NL7nfwG9VbtzWEDAtSiKsCxRpoCh7bgHnLt9ez+Bt+MIGpuVRWf0tGt
hTANri4MquduPz/phZpWFp930YlSBaWC15ZdDiZeoF0kclml/JhHtc+yJfufRjxO
BWksNkttTxMHkC2vlB44OUicTNxW0xowni2I+olieYDs1uUXDLQ=
=b3mX
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Curl problem with reloadSslHostConfigs, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

James,

On 1/6/20 9:10 PM, James H. H. Lampert wrote:
> Dear Mr. Schultz, et al.:
> 
> The manager password on this Tomcat server has an embedded curly
> brace, and an embedded question mark.
> 
> If I do this (the names have been changed to protect the innocent,
> and the -k!)
> 
>> curl -k 
>> "https://foo:b?a{r@localhost:8443/manager/jmxproxy?invoke=Catalina%3A
type%3DProtocolHandler%2Cport%3D8443%2Caddress%3D%22127.0.0.1%22&op=relo
adSslHostConfigs"
>>
>
>> 
> I get curl: (3) [globbing] unmatched brace in column xx
> 
> If I change the curly brace to "%7B," I get:
> 
>> curl -k 
>> "https://foo:b?a%7Br@localhost:8443/manager/jmxproxy?invoke=Catalina%
3Atype%3DProtocolHandler%2Cport%3D8443%2Caddress%3D%22127.0.0.1%22&op=re
loadSslHostConfigs"
>>
>
>> 
> I get curl: (3) Port number ended with 'n'
> 
> And if I put the user-ID and password in with a -u clause on curl, 
> rather than in the URL itself, I get "Unauthorized."
> 
> What is wrong here? Are there characters it simply can't tolerate
> in passwords, even if URL-escaped?
> 
> Or do I need to give the manager user an additional role?
> Currently, I have:  roles="manager-gui"/>

You need another role. The role necessary for jmxproxy is "manager-jmx".

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4Up+EACgkQHPApP6U8
pFjy0xAAmwbNbBSnW5mydxPPSD5OXyJW13wmLtZy2BoMyV5E6HR9wu/u79i27VbI
qfNoIMk3K1wAKNTzuBOtM+cUgXaiFBZeehXuN9lF2AvqiOnp948n3JXrY2JvAovk
Adr3tsx+21nZgNVaVTsEezdKcad+odCRVWER52eVKdnz8In3oh4bWXOEcHQ6T22o
/o+JvQY0kjrRFGMWGHGUu7EvtzM+zawf3RDMuRD2xdhMv3MWhH5o5nrt4DalglUU
qhvZQ5RfVcjMNC43clCjdRhoz7hhCAkf6GTCkqQmVGW0KYP4x8yGxM2NFV0ft8Vc
/DJiy3h3rX6j4lE1c7XXDksUqfPx70h8RJ1ApzcYumXrGxHDUsvYzkuzsGQCBMSF
5qo1lRCgK+qaITNuc9nZIhKdtai3iojjCUr0VNN9+3wI61rNBlncPyIRrNJR2pS7
m6IeML1cKxE7c4sWr7Th4egM+NOX65E4oyv1X6vqpWZYL5TrB2Eys+zcPdG981KI
OF06FybbBW4XDpyv9ECTE9gmtqiw0LYLTz8bg9ytRqOfCgSCmUxVzIc9CTk0glgZ
3AJA8QElFlibnORB7rD1nagDBO4VYmcSXnttHrXf47jjtchWEF+cI24IUUZnbWKb
+yVgFfBJS4mqIIe7IvxYjL2I2bMTx+FWGf7erAm+/WYbMt8DAEE=
=bHGS
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Breakthrough, Re: Let's Encrypt with Tomcat?

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

James,

On 1/6/20 4:28 PM, James H. H. Lampert wrote:
> I think I found something, with the help of "MLu" on ServerFault:
> 
> He advised me to try "iptables -L" and "iptables-save" again, only
> this time "sudo" them.

Hah, sorry about that. Nobody thought of specifying that only root can
view the iptables stuff. :)

> When I did "iptables -L" under root privileges, I still only got
> column headings, but when I did "iptables-save" under root
> privileges, I hit what appears to be paydirt:
>> # Generated by iptables-save v1.4.18 on Mon Jan  6 21:17:22 2020 
>> *filter :INPUT ACCEPT [5018099:5766179544] :FORWARD ACCEPT [0:0] 
>> :OUTPUT ACCEPT [400:2863742410] COMMIT

This means "no filtering". You have a firewall, so that's fine.

>> # Completed on Mon Jan  6 21:17:22 2020 # Generated by
>> iptables-save v1.4.18 on Mon Jan  6 21:17:22 2020 *nat 
>> :PREROUTING ACCEPT [41828:2351495] :INPUT ACCEPT [76356:4167904] 
>> :OUTPUT ACCEPT [254990:18418937] :POSTROUTING ACCEPT
>> [254990:18418937] -A PREROUTING -p tcp -m tcp --dport 443 -j
>> REDIRECT --to-ports 8443 COMMIT

This means that the NAT table is being used to forward port 443 ->
8443 just like we were all assuming, but hadn't yet proven.

>> # Completed on Mon Jan  6 21:17:22 2020
> 
> Other than the one obvious line near the bottom,
>> -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports
>> 8443
> I'm not entirely sure what all of this means, nor do I remember
> what I did to set it up.

This definitely means that clients can connect to host:443 and will
actually communicate with host:8443. Mystery solved!

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4UpIQACgkQHPApP6U8
pFgHWg/9GkBh1aVeCqqUmKd4l8BcBTrYGCEdVf5FxirWHwWTbmqAY5NYwDPqNOEU
OzOrdbFr6O4tbrcrQGg78pD/ZqhyuwyTKN+NY41/IOFBegbB7ziHyGMNWt81mWbW
n9yYQblEHDkwrdLxu1p6l9DFLsNkWmZxbIE+Ktp8Dyvocv0rfeEh6Ht2jQGOyWKm
m4xhgIc9i9ewGglpRoOwJmfSYuHLs8ijw8CA7owfMz+A3brS4RzreNzLW1nxU7m0
1neLHu2e8AFHw0CPb8NAMt4kC1Rf67wyLbxE2umOPIK16V6yIY96fWmkFNqIlHCl
tiY2oncn6A9jG4r86W2i1MHMEust8a2d/F/bvL5Yjiw26TMr+T5rL/EFU6debTfW
jkFSCS2gFaUM/bBb78d6vQfmpHTj17lP87YK4YJtjQT5/SAXnnty8g7PtOO+jp+W
6gaHYKp1TSYPareexO9NcNd4QM6aWMjMqNgNqiPnggZ6We1Xc+eK7U7kmMpp3hee
7Jggk4oM7G7d8ld1KNW5lRvEGc15E39ZEstFP0UJ78qbHv0ROlh4xoD0lhkW00YB
fC4P4RQE4nwCbDRC7hd2vNPPrSKu6IKo/rwTcGl7yPpi0oX1eTg0AYkaxd2MOTX8
o7NemE0CY01Y65Fev7Yir/WRBxuC1wfuJb1U91t8WblAejQV5bU=
=z5M1
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat 9 does not allow to read file in /tmp folder with 777 permission?

2020-01-07 Thread zahid
> Well - why do you think someone is calling you names? Mark did not, 
right?


My efforts in chasing up a bug which effected many Apache  and non 
Apache products


and  with MR Emmanuel Bourg 's  DILIGENT , VIGOROUS  efforts produced 
this :-


[1] https://bugs.debian.org/948309
[2] https://bugs.debian.org/948310

IBM can now upgrade from JDK 8 https://developer.ibm.com/javasdk/downloads/.

if this was their issue too.

I also sent same message to Apache Struts because the local expert there 
was recommending to use JDK 8 to people who had MAVEN warning caused 
when using Internationalisation API. (I looked through archive and saw that)


I also sent same message to Apache NetBeans because they were using 
Maven 3.3.9 (2015)  which knows nothing about the  trouble some java 
classes.


> Well - why do you think someone is calling you names? Mark did not, 
right?


Mark T refer to me as "troll"

I am not part of the fashion victim of *nix, so  Mr Shultz also referred 
to me as a "troll".



On 06/01/2020 21:45, logo wrote:

Well - why do you think someone is calling you names? Mark did not, right?


Am 06.01.2020 um 22:11 schrieb Zahid Rahman :

Are you calling me names  ?

On Mon, 6 Jan 2020, 20:35 Mark Thomas,  wrote:


On 06/01/2020 16:29, Christopher Schultz wrote:

You have a right to a view, and you can troll all you want. But you
will be ignored.

Up to a point.

Users that continue to troll will be unsubscribed and blocked from
re-subscribing.

As a general reminder aimed at keeping noise down on the list:

Please don't feed the trolls.


Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


--
www.backbutton.co.uk
♡۶¯\_(ツ)_/¯ ♡۶
Marriage of loose and tight coupling
-> healthy applications
  ♡۶
java -cp classpath class-path


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: HTTP/2 configuration

2020-01-07 Thread M. Manna
Hey Mark et. al.,

On Tue, 7 Jan 2020 at 11:20, Mark Thomas  wrote:

> On 12/12/2019 15:23, Christopher Schultz wrote:
> > Arief,
> >
> > On 12/12/19 00:25, Arief Hasani wrote:
> >> IMHO, being able to override form HTTP1.1 conf is all good as user
> >> could easily assume that if not specified in the upgrade than use
> >> http1.1 configs
> > I'm not sure you understand the question.
> >
> > Mark is asking if any users in the community are finding that they
> > need to independently configure specific parts of the HTTP/<2 versus
> > h2 *for the same port*.
> >
> > Thinks like the compression, keepalives, max headers/trailers,
> > timeouts, sendfile config, etc.
> >
> > Does it ever make sense to have sendFile enabled on the HTTP/1.1
> > connector but disable sendFile if the client upgrades to h2?
>
> Exactly.
>
> > The suspicion is that identical configuration is acceptable. Mark is
> > trying to ask if there are any exceptions before we simplify the code
> > which handles the configuration.
> >
> > If you have a specific use-case, please explain.
>
> Just pinging this thread in case there is someone with a specific use case.
>
> At the moment, I'm leaning towards the simplification for Tomcat 10
> onwards.
>

 It's probably better that way. The change here is big and a major release
such as 10.x is more appropriate for GA.


> Mark
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>


Re: HTTP/2 configuration

2020-01-07 Thread Mark Thomas
On 12/12/2019 15:23, Christopher Schultz wrote:
> Arief,
> 
> On 12/12/19 00:25, Arief Hasani wrote:
>> IMHO, being able to override form HTTP1.1 conf is all good as user
>> could easily assume that if not specified in the upgrade than use
>> http1.1 configs
> I'm not sure you understand the question.
> 
> Mark is asking if any users in the community are finding that they
> need to independently configure specific parts of the HTTP/<2 versus
> h2 *for the same port*.
> 
> Thinks like the compression, keepalives, max headers/trailers,
> timeouts, sendfile config, etc.
> 
> Does it ever make sense to have sendFile enabled on the HTTP/1.1
> connector but disable sendFile if the client upgrades to h2?

Exactly.

> The suspicion is that identical configuration is acceptable. Mark is
> trying to ask if there are any exceptions before we simplify the code
> which handles the configuration.
> 
> If you have a specific use-case, please explain.

Just pinging this thread in case there is someone with a specific use case.

At the moment, I'm leaning towards the simplification for Tomcat 10 onwards.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: performance issue with Tomcat 8.5.35 in org.apache.tomcat.util.net.NioBlockingSelector.write API

2020-01-07 Thread Rathore, Rajendra
Hi Remy,

Thanks for the reply,

As you mention below points

"There's a problem only if things are blocked improperly, for example if the 
client is correctly reading the data and/or there's no network backlog.
Also the timeout configured on the connector must be respected by the 
operation."

1. how can we check the network backlog or data read/write not working 
properly, if any tool pls let us know
2. how can we set connector timeout.

Thanks and Regards,
Rajendra Rathore
9922701491

-Original Message-
From: Rémy Maucherat  
Sent: Tuesday, January 7, 2020 4:11 PM
To: Tomcat Users List 
Subject: Re: performance issue with Tomcat 8.5.35 in 
org.apache.tomcat.util.net.NioBlockingSelector.write API

External email from: users-return-269207-rarathore=ptc@tomcat.apache.org

On Tue, Jan 7, 2020 at 6:33 AM Rathore, Rajendra  wrote:

> Hi Rémy/ Christopher,
>
> It will stuck there for 10-15 minutes, so it will take time to load 
> simple Web UI, there is no WebSocket call. I am giving you one of the 
> sample where it will take 90% time in write operation, sometime it will reach 
> to 100%.
>
>
>  ||
>
> O-org.apache.coyote.ajp.AjpProcessor.writeData(AjpProcessor.java:1331)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.SocketWrapperBase.write(SocketWrapperBase
> .java:385)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.SocketWrapperBase.writeBlocking(SocketWra
> pperBase.java:462)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.SocketWrapperBase.doWrite(SocketWrapperBa
> se.java:726)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.doWrite(NioE
> ndpoint.java:1316)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.NioSelectorPool.write(NioSelectorPool.jav
> a:157)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.NioBlockingSelector.write(NioBlockingSele
> ctor.java:114)
> count=1667(%92.766)
>  ||
> |  
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.awaitWriteLa
> tch(NioEndpoint.java:1160)
> count=1667(%92.766)
>  ||
> |
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.awaitLatch(NioEndpoint.java:1157)
> count=1667(%92.766)
>  ||
> |
> O-java.util.concurrent.CountDownLatch.await(CountDownLatch.java:277)
> count=1667(%92.766)
>
>
It's a normal blocking write, and the await does not consume CPU (it sits there 
however and a profiler will count that but it doesn't matter).
There's a problem only if things are blocked improperly, for example if the 
client is correctly reading the data and/or there's no network backlog.
Also the timeout configured on the connector must be respected by the operation.

Rémy


Re: performance issue with Tomcat 8.5.35 in org.apache.tomcat.util.net.NioBlockingSelector.write API

2020-01-07 Thread Rémy Maucherat
On Tue, Jan 7, 2020 at 6:33 AM Rathore, Rajendra  wrote:

> Hi Rémy/ Christopher,
>
> It will stuck there for 10-15 minutes, so it will take time to load simple
> Web UI, there is no WebSocket call. I am giving you one of the sample where
> it will take 90% time in write operation, sometime it will reach to 100%.
>
>
>  ||
>
> O-org.apache.coyote.ajp.AjpProcessor.writeData(AjpProcessor.java:1331)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.SocketWrapperBase.write(SocketWrapperBase.java:385)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.SocketWrapperBase.writeBlocking(SocketWrapperBase.java:462)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.SocketWrapperBase.doWrite(SocketWrapperBase.java:726)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.doWrite(NioEndpoint.java:1316)
> count=1669(%92.877)
>  ||
>   
> O-org.apache.tomcat.util.net.NioSelectorPool.write(NioSelectorPool.java:157)
> count=1669(%92.877)
>  ||
> 
> O-org.apache.tomcat.util.net.NioBlockingSelector.write(NioBlockingSelector.java:114)
> count=1667(%92.766)
>  ||
> |  
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.awaitWriteLatch(NioEndpoint.java:1160)
> count=1667(%92.766)
>  ||
> |
> O-org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.awaitLatch(NioEndpoint.java:1157)
> count=1667(%92.766)
>  ||
> |
> O-java.util.concurrent.CountDownLatch.await(CountDownLatch.java:277)
> count=1667(%92.766)
>
>
It's a normal blocking write, and the await does not consume CPU (it sits
there however and a profiler will count that but it doesn't matter).
There's a problem only if things are blocked improperly, for example if the
client is correctly reading the data and/or there's no network backlog.
Also the timeout configured on the connector must be respected by the
operation.

Rémy


Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Dennis Rech

Dear Mark,

thanks a lot for your effort and your feedback.


Am 07.01.20 um 10:36 schrieb Mark Thomas:

On 07/01/2020 07:10, Dennis Rech wrote:

POST /foo HTTP/1.1
Host: foo.com
POST /foo HTTP/1.1
Host: foo.com
Content-[stuff] [...]

First two lines are OK.

The third line is going to be treated as an HTTP header. It is invalid
and Tomcat will reject it with a 400 response but you can tell Tomcat to
just ignore the invalid header with rejectIllegalHeaderName="false" on
the Connector.


I already tried the connector option in server.xml and also saw in the 
documentation the


rejectIllegalHeaderName

option should be on "false" even as default.


The problem is going to be the second Host header.

The second "Host" part is still a problem, you're right.

We have just tried putting nginx as a proxy before the tomcat8 instance 
and it has intercepted the malformed request fine at least it has not 
rejected the request with HTTP response code 400.




RFC 7230 states:


A server MUST respond with a 400 (Bad Request) status code to any
HTTP/1.1 request message that lacks a Host header field and to any
request message that contains more than one Host header field or a
Host header field with an invalid field-value.


Any spec compliant server is almost certainly going to reject that
request. I guess a server might provide a hook for request modification
prior to rejection to allow the "fixing" of known invalid requests but
I'm not aware of any that do - at least not without going down the
writing a custom module route.

If we made Http11Processor.prepareRequest() protected then it would be
fairly simple to write a custom Processor that:
- extended Http11Processor
- overrode prepareRequest() to
   a) remove the duplicate Host header
   b) call super.prepareRequest()

I could provide one for you if you weren't comfortable doing that
yourself). However, even if we made the change now (which I'm happy to
do if you think it would be useful) it will take a while to filter
through to the Debian distribution.

There are several variations on this theme. One could write a custom
Processor for 8.5.50 that did the same thing - it would just be rather
more involved as one would have to copy rather more code from
Http11Processor.


We will see if the nginx workaround is sufficient :-). Otherwise we will 
take into consideration your suggestion.


Thanks again.

Dennis



Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: [OT] Re: Maven Warning. Ubuntu Users

2020-01-07 Thread zahid

Thank you sir.

I was truly lucky because I don't know how this Apache organisation  
works at the moment.


Now I can prototype a rather complex skeleton application I am working 
on with a stable


environment, without concern for platform warnings.

Best Regards

Zahid

secure by design http
https://www.youtube.com/watch?v=idViw4anA6E&t=1276s
  ♡۶
www.backbutton.co.uk
¯\_(ツ)_/¯
Marriage of loose and tight coupling
-> healthy applications

On 06/01/2020 23:34, Emmanuel Bourg wrote:

Le 06/01/2020 à 21:24, Zahid Rahman a écrit :


Don't shoot the messenger.

You are not sending the message to the right list, there is nothing the
Tomcat developers can do to fix this issue. This should be brought to
debian-j...@lists.debian.org instead (Debian is the source of Ubuntu
Java packages).

But you are lucky because beside maintaining Tomcat in Debian, I also
maintain Maven, and thanks to your message I've filled the bugs to
address this issue [1][2].

Emmanuel Bourg

[1] https://bugs.debian.org/948309
[2] https://bugs.debian.org/948310

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


--
www.backbutton.co.uk
♡۶¯\_(ツ)_/¯ ♡۶
Marriage of loose and tight coupling
-> healthy applications
  ♡۶
java -cp classpath class-path


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Mark Thomas
On 07/01/2020 07:10, Dennis Rech wrote:
> POST /foo HTTP/1.1
> Host: foo.com
> POST /foo HTTP/1.1
> Host: foo.com
> Content-[stuff] [...]

First two lines are OK.

The third line is going to be treated as an HTTP header. It is invalid
and Tomcat will reject it with a 400 response but you can tell Tomcat to
just ignore the invalid header with rejectIllegalHeaderName="false" on
the Connector.

The problem is going to be the second Host header.

RFC 7230 states:


A server MUST respond with a 400 (Bad Request) status code to any
HTTP/1.1 request message that lacks a Host header field and to any
request message that contains more than one Host header field or a
Host header field with an invalid field-value.


Any spec compliant server is almost certainly going to reject that
request. I guess a server might provide a hook for request modification
prior to rejection to allow the "fixing" of known invalid requests but
I'm not aware of any that do - at least not without going down the
writing a custom module route.

If we made Http11Processor.prepareRequest() protected then it would be
fairly simple to write a custom Processor that:
- extended Http11Processor
- overrode prepareRequest() to
  a) remove the duplicate Host header
  b) call super.prepareRequest()

I could provide one for you if you weren't comfortable doing that
yourself). However, even if we made the change now (which I'm happy to
do if you think it would be useful) it will take a while to filter
through to the Debian distribution.

There are several variations on this theme. One could write a custom
Processor for 8.5.50 that did the same thing - it would just be rather
more involved as one would have to copy rather more code from
Http11Processor.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread logo

Dennis,



Am 07.01.2020 um 08:10 schrieb Dennis Rech :

Hi Christopher,


Am 06.01.20 um 17:39 schrieb Christopher Schultz:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Dennia,


On 1/6/20 07:09, Dennis Rech wrote:
we have an application where HTTP clients have a kind of unclean
way of submitting HTTP POST requests to our tomcat server for data
upload: The |POST| and |Host: xxx| part appears twice in the
request.

Yuck. You mean like this?

POST /foo HTTP/1.1
POST /foo HTTP/1.1
Host: foo.com
Host: foo.com
Content-Type: application/x-www-url-encoded
Content-Length: 13

q=Hello World

?


No, rather like that:

POST /foo HTTP/1.1
Host: foo.com
POST /foo HTTP/1.1
Host: foo.com
Content-[stuff] [...]



It could be worse. But at least the first two lines are protocol 
compliant.


As Chris mentioned you may add a reverse proxy like nginx or traefik in 
front of it and strip the lines - the POST line not a „real“ header 
though - before passing the request to tomcat.


Then if the first two lines are compliant, I wonder if a Valve on tomcat 
level could intercept the request and deal with the bad lines before 
reaching the app layer.


Peter




Until now this didn't cause any problems with tomcat, but since
the latest release, Tomcat refuses to accept this message and
returns a 400 bad request immediately.

Having two "host" headers should be okay. But repeating the request
line is a clear violation of the HTTP spec that will be difficult to
get over. I can't believe Tomcat ever allowed that, though it may have
done so.
I read in the changelog that since Tomcat 8.5.22 it will also reply 
with Bad request 400 if there are two Host fields in the header. But I 
guess the double "POST" is even worse.



Unfortunately we'll not be able to change the client-side code. Is
there any way to tell the tomcat connector "ignore duplicate
headers" or so to make it work again? I guess the rewrite filters
for tomcat won't help as tomcat probably discards the incoming
message before handing it over to rewrite.

Tomcat is responsible for reading the request line and routing the
request to an application. If the request is broken badly enough, it
won't be able to route.

Headers are parsed as a part of that, and:

POST /foo HTTP/1.1

is not a valid header for at least two reasons:

1. There is no : character (required, even when the header has no 
value)
2. There are spaces in the "name" (the name is everything before colon 
)
Well, "POST"... is the actual request followed by the HTTP headers. 
POST is not part of the actual header. Maybe I haven't pointed that 
out.



Example request:

|POST /data/upload/test HTTP/1.1 Host: www.myhost.de:8180 POST
/data/upload/test HTTP/1.1 Host: www.myhost.de:8180 [...rest of
the request is ok...] |

This got word-wrapped. Was this?


Yes I copied it from a formatted document, the pipes probably indicate 
that this text was preformatted in the original document, sorry. Also 
the newlines are missing.


POST /data/upload/test HTTP/1.1
Host: www.myhost.de:8180
POST/data/upload/test HTTP/1.1
Host: www.myhost.de:8180
[...here comes the remaining header with Content-Length etc followed by 
the body...]





POST /data/upload/test HTTP/1.1 Host: www.myhost.de:8180 POST
/data/upload/test HTTP/1.1 Host: www.myhost.de:8180 [...rest of the
request is ok...]

?

Yikes. What kind of client is this?
It's a remote unit transmitting data to a server using POST file 
uploads with - obviously - a little bug in the firmware that builds the 
HTTP request manually as there is no curl library for the unit etc. 
which can be used to generate the requests.



I wonder if there is a parameter for the |Connector| part in
server.xml or so to workaround this problem and restore the old
behaviour without downgrading.

The good news is that the second POST could theoretically be
considered to be a "broken" header and ignored. But Tomcat has been
getting progressively more strict about what it will accept. There are
all kinds of nasty ways to use malformed messages like this to confuse
environments where e.g. a reverse-proxy and the origin server behave
differently when they see requests like those above. It's better to
just fail and fix the software. Why can't you fix the clients? Is this
another case of internet-of-things garbage that can't practically be
repaired?


Something like that. The devices could be updated in theory but 
probably not over-the-air and many of them are already deployed 
somewhere in the "wild" so we don't have physical access to them 
anymore. Unfortunately we did not notice that in the past as tomcat 
always accepted these requests until the latest update for debian came 
out.


I totally agree that the best solution would be to let those devices 
send proper HTTP protocol but I guess we'll have to find a workaround 
on server-side.




- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl4T