Re: Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[Mark Eggers]

On 6/1/2017 1:32 AM, Nicholas Cottrell wrote:
> yum provides /usr/lib64/httpd/modules/mod_proxy_ajp.so

OK - don't know how I missed it. I could have sworn it wasn't there
yesterday :-p.

I just checked my system and it's there (run CentOS 6 in production).

/mde/



signature.asc
Description: OpenPGP digital signature

Re: Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[Mark Thomas]

On 1 June 2017 09:24:16 BST, Nicholas Cottrell  wrote:
>
>> On 31 May 2017, at 22:44, André Warnier (tomcat) 
>wrote:
>> 
>> On 31.05.2017 21:52, Nicholas Cottrell wrote:
 On 5/31/17 8:42 AM, Nicholas Cottrell wrote:
> Hi All!
> 
> I'm having a problem setting up an existing webapp from Apache
> 2.2/Tomcat6 on a new server running Centos 7, and the following
> packages:
> 
> httpd 2.4.6-45.el7.centos.4 tomcat.noarch
> 7.0.69-11.el7_3 @updates tomcat-native.x86_64
> 1.1.34-1.el7@epel
> 
> For debugging I have enabled AJP/1.3 and 8009 and HTTP on 8080,
> then use Apache to ProxyPass.
> 
> With my initial configuration, data from a form POST is not
> available via request.getParameter:
> 
> ProxyPass / ajp://localhost:8009/ 
>> retry=1
> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
> ajp://localhost:8009/ 
>>
> 
> But changing it to this fixes everything:
> 
> ProxyPass / http://localhost:8080/ 
>> retry=1
> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
> http://localhost:8080/ 
>>
> 
> In the broken instance, request.getParameter("x") returned null,
> but request.getReader() returned bytes with "x=123" so seems that
> Apache is sending the POST body but Tomcat is not processing it
> correctly, yes?
> 
> Please also see
>
>https://stackoverflow.com/questions/44167876/problems-with-post-parame
>
 ters-with-tomcat-ajp-on-apache-2-4-but-not-2-2
>
>
 eters-with-tomcat-ajp-on-apache-2-4-but-not-2-2>
> for my steps so far.
> 
> I would prefer to switch back to AJP for the proxy, since I
> understand it is more performant, right? Should I try forcing a
> Tomcat 8 install to see if the problem persists there too?
 
 If you call request.getReader/getInputStream before any of the
 request.getParameter family of methods, then all
>request.getParameter*
 methods will return null. That's because Tomcat must consume the
 request body in order to parse POST parameters. If you call
 request.getReader/getInputStream, then Tomcat assumes that you will
>be
 handling the request body (and any associated parameters therein).
 
 Is it possible that you are "damaging" the request by inspecting
>the
 request body?
>>> 
>>> I've been thinking about that but I don't call
>getReader/getInputStream anywhere myself.
>>> Also, the fact that accessing the same page via 8080 directly to
>Tomcat works, but via Apache/AJP through Tomcat's port 8009 works fine,
>and setting the proxy to use the 8080 also works.
>>> 
>> 
>> There must be a typo in the phrase above, or else what are you
>complaining about ?
>
>Sorry - via AJP and port 8009 does NOT work, and I don't want to switch
>production to Proxying via HTTP since I understand that's much less
>performant.

Your understanding is incorrect.

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[Nicholas Cottrell]

Mark,
> 
> On 5/31/2017 5:42 AM, Nicholas Cottrell wrote:
>> Hi All!
>> 
>> I'm having a problem setting up an existing webapp from Apache
>> 2.2/Tomcat6 on a new server running Centos 7, and the following
>> packages:
>> 
>> httpd2.4.6-45.el7.centos.4 tomcat.noarch
>> 7.0.69-11.el7_3 @updates tomcat-native.x86_64
>> 1.1.34-1.el7@epel
>> 
>> For debugging I have enabled AJP/1.3 and 8009 and HTTP on 8080, then
>> use Apache to ProxyPass.
>> 
>> With my initial configuration, data from a form POST is not available
>> via request.getParameter:
>> 
>> ProxyPass / ajp://localhost:8009/  retry=1
>> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
>> ajp://localhost:8009/ 
>> 
>> But changing it to this fixes everything:
>> 
>> ProxyPass / http://localhost:8080/  retry=1
>> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
>> http://localhost:8080/ 
>> 
>> In the broken instance, request.getParameter("x") returned null, but
>> request.getReader() returned bytes with "x=123" so seems that Apache
>> is sending the POST body but Tomcat is not processing it correctly,
>> yes?
>> 
>> Please also see
>> https://stackoverflow.com/questions/44167876/problems-with-post-parameters-with-tomcat-ajp-on-apache-2-4-but-not-2-2
>> 
>> for my steps so far.
>> 
>> I would prefer to switch back to AJP for the proxy, since I
>> understand it is more performant, right? Should I try forcing a
>> Tomcat 8 install to see if the problem persists there too?
>> 
>> Best, Nic.
>> 
> 
> I wasn't aware that mod_proxy_ajp was available on a stock CentOS 7 even
> with epel enabled.
> 
> If you're using the ajp protocol (it's not HTTP), then you'll need to
> get mod_jk (from tomcat.apache.org) and build it yourself. It's not
> difficult.
> 
> However, the configuration is quite a bit different. Fortunately, there
> is an excellent set of example configuration files in the source (see
> the conf subdirectory).
> 
> mod_proxy_ajp.so was shipped with CentOS 6, but does not appear to be
> available with CentOS 7.
> 
> Either that - or go with mod_proxy_http and proxy to the HTTP connector
> (default in server.xml is port 8080).
> 
> . . . just my two cents
> /mde/

Yes, seems that Centos 7 does provide mod_proxy_ajp.so:

[root@blanche nic]# yum provides /usr/lib64/httpd/modules/mod_proxy_ajp.so
Loaded plugins: etckeeper, fastestmirror, priorities, protectbase
Loading mirror speeds from cached hostfile
 * base: mirror.wiuwiu.de
 * epel: mirrors.n-ix.net
 * extras: mirror.softaculous.com
 * remi: mirror.23media.de
 * remi-php56: mirror.23media.de
 * remi-safe: mirror.23media.de
 * updates: mirror.wiuwiu.de
0 packages excluded due to repository protections
httpd-2.4.6-45.el7.centos.x86_64 : Apache HTTP Server
Repo: base
Matched from:
Filename: /usr/lib64/httpd/modules/mod_proxy_ajp.so

httpd-2.4.6-45.el7.centos.4.x86_64 : Apache HTTP Server
Repo: updates
Matched from:
Filename: /usr/lib64/httpd/modules/mod_proxy_ajp.so

httpd-2.4.6-45.el7.centos.4.x86_64 : Apache HTTP Server
Repo: @updates
Matched from:
Filename: /usr/lib64/httpd/modules/mod_proxy_ajp.so

Is mod_jk really still recommended? I thought it was mostly deprecated now in 
preference for mod_proxy_ajp? See 
https://serverfault.com/questions/182289/mod-proxy-vs-mod-proxy-ajp-vs-mod-jk 
 

Re: Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[Nicholas Cottrell]

> On 31 May 2017, at 22:44, André Warnier (tomcat)  wrote:
> 
> On 31.05.2017 21:52, Nicholas Cottrell wrote:
>>> On 5/31/17 8:42 AM, Nicholas Cottrell wrote:
 Hi All!
 
 I'm having a problem setting up an existing webapp from Apache
 2.2/Tomcat6 on a new server running Centos 7, and the following
 packages:
 
 httpd  2.4.6-45.el7.centos.4 tomcat.noarch
 7.0.69-11.el7_3 @updates tomcat-native.x86_64
 1.1.34-1.el7@epel
 
 For debugging I have enabled AJP/1.3 and 8009 and HTTP on 8080,
 then use Apache to ProxyPass.
 
 With my initial configuration, data from a form POST is not
 available via request.getParameter:
 
 ProxyPass / ajp://localhost:8009/  
 > retry=1
 acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
 ajp://localhost:8009/  >>> >
 
 But changing it to this fixes everything:
 
 ProxyPass / http://localhost:8080/  
 > retry=1
 acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
 http://localhost:8080/  >
 
 In the broken instance, request.getParameter("x") returned null,
 but request.getReader() returned bytes with "x=123" so seems that
 Apache is sending the POST body but Tomcat is not processing it
 correctly, yes?
 
 Please also see
 https://stackoverflow.com/questions/44167876/problems-with-post-parame 
 
>>> ters-with-tomcat-ajp-on-apache-2-4-but-not-2-2
 
>>> eters-with-tomcat-ajp-on-apache-2-4-but-not-2-2>
 for my steps so far.
 
 I would prefer to switch back to AJP for the proxy, since I
 understand it is more performant, right? Should I try forcing a
 Tomcat 8 install to see if the problem persists there too?
>>> 
>>> If you call request.getReader/getInputStream before any of the
>>> request.getParameter family of methods, then all request.getParameter*
>>> methods will return null. That's because Tomcat must consume the
>>> request body in order to parse POST parameters. If you call
>>> request.getReader/getInputStream, then Tomcat assumes that you will be
>>> handling the request body (and any associated parameters therein).
>>> 
>>> Is it possible that you are "damaging" the request by inspecting the
>>> request body?
>> 
>> I've been thinking about that but I don't call getReader/getInputStream 
>> anywhere myself.
>> Also, the fact that accessing the same page via 8080 directly to Tomcat 
>> works, but via Apache/AJP through Tomcat's port 8009 works fine, and setting 
>> the proxy to use the 8080 also works.
>> 
> 
> There must be a typo in the phrase above, or else what are you complaining 
> about ?

Sorry - via AJP and port 8009 does NOT work, and I don't want to switch 
production to Proxying via HTTP since I understand that's much less performant.
-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[Mark Eggers]

Nic,

On 5/31/2017 5:42 AM, Nicholas Cottrell wrote:
> Hi All!
> 
> I'm having a problem setting up an existing webapp from Apache
> 2.2/Tomcat6 on a new server running Centos 7, and the following
> packages:
> 
> httpd 2.4.6-45.el7.centos.4 tomcat.noarch
> 7.0.69-11.el7_3 @updates tomcat-native.x86_64
> 1.1.34-1.el7@epel
> 
> For debugging I have enabled AJP/1.3 and 8009 and HTTP on 8080, then
> use Apache to ProxyPass.
> 
> With my initial configuration, data from a form POST is not available
> via request.getParameter:
> 
> ProxyPass / ajp://localhost:8009/  retry=1
> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
> ajp://localhost:8009/ 
> 
> But changing it to this fixes everything:
> 
> ProxyPass / http://localhost:8080/  retry=1
> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
> http://localhost:8080/ 
> 
> In the broken instance, request.getParameter("x") returned null, but
> request.getReader() returned bytes with "x=123" so seems that Apache
> is sending the POST body but Tomcat is not processing it correctly,
> yes?
> 
> Please also see
> https://stackoverflow.com/questions/44167876/problems-with-post-parameters-with-tomcat-ajp-on-apache-2-4-but-not-2-2
> 
> for my steps so far.
> 
> I would prefer to switch back to AJP for the proxy, since I
> understand it is more performant, right? Should I try forcing a
> Tomcat 8 install to see if the problem persists there too?
> 
> Best, Nic.
> 

I wasn't aware that mod_proxy_ajp was available on a stock CentOS 7 even
with epel enabled.

If you're using the ajp protocol (it's not HTTP), then you'll need to
get mod_jk (from tomcat.apache.org) and build it yourself. It's not
difficult.

However, the configuration is quite a bit different. Fortunately, there
is an excellent set of example configuration files in the source (see
the conf subdirectory).

mod_proxy_ajp.so was shipped with CentOS 6, but does not appear to be
available with CentOS 7.

Either that - or go with mod_proxy_http and proxy to the HTTP connector
(default in server.xml is port 8080).

. . . just my two cents
/mde/




signature.asc
Description: OpenPGP digital signature

Re: Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[tomcat]

On 31.05.2017 21:52, Nicholas Cottrell wrote:

On 5/31/17 8:42 AM, Nicholas Cottrell wrote:

Hi All!

I'm having a problem setting up an existing webapp from Apache
2.2/Tomcat6 on a new server running Centos 7, and the following
packages:

httpd   2.4.6-45.el7.centos.4 tomcat.noarch
7.0.69-11.el7_3 @updates tomcat-native.x86_64
1.1.34-1.el7@epel

For debugging I have enabled AJP/1.3 and 8009 and HTTP on 8080,
then use Apache to ProxyPass.

With my initial configuration, data from a form POST is not
available via request.getParameter:

ProxyPass / ajp://localhost:8009/  > retry=1
acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
ajp://localhost:8009/  >

But changing it to this fixes everything:

ProxyPass / http://localhost:8080/  > retry=1
acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
http://localhost:8080/  >

In the broken instance, request.getParameter("x") returned null,
but request.getReader() returned bytes with "x=123" so seems that
Apache is sending the POST body but Tomcat is not processing it
correctly, yes?

Please also see
https://stackoverflow.com/questions/44167876/problems-with-post-parame 


ters-with-tomcat-ajp-on-apache-2-4-but-not-2-2



eters-with-tomcat-ajp-on-apache-2-4-but-not-2-2>

for my steps so far.

I would prefer to switch back to AJP for the proxy, since I
understand it is more performant, right? Should I try forcing a
Tomcat 8 install to see if the problem persists there too?


If you call request.getReader/getInputStream before any of the
request.getParameter family of methods, then all request.getParameter*
methods will return null. That's because Tomcat must consume the
request body in order to parse POST parameters. If you call
request.getReader/getInputStream, then Tomcat assumes that you will be
handling the request body (and any associated parameters therein).

Is it possible that you are "damaging" the request by inspecting the
request body?


I've been thinking about that but I don't call getReader/getInputStream 
anywhere myself.
Also, the fact that accessing the same page via 8080 directly to Tomcat works, 
but via Apache/AJP through Tomcat's port 8009 works fine, and setting the proxy 
to use the 8080 also works.



There must be a typo in the phrase above, or else what are you complaining 
about ?




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[Nicholas Cottrell]

> On 5/31/17 8:42 AM, Nicholas Cottrell wrote:
>> Hi All!
>> 
>> I'm having a problem setting up an existing webapp from Apache
>> 2.2/Tomcat6 on a new server running Centos 7, and the following
>> packages:
>> 
>> httpd2.4.6-45.el7.centos.4 tomcat.noarch
>> 7.0.69-11.el7_3 @updates tomcat-native.x86_64
>> 1.1.34-1.el7@epel
>> 
>> For debugging I have enabled AJP/1.3 and 8009 and HTTP on 8080,
>> then use Apache to ProxyPass.
>> 
>> With my initial configuration, data from a form POST is not
>> available via request.getParameter:
>> 
>> ProxyPass / ajp://localhost:8009/  
>> > retry=1
>> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
>> ajp://localhost:8009/  > >
>> 
>> But changing it to this fixes everything:
>> 
>> ProxyPass / http://localhost:8080/  
>> > retry=1
>> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
>> http://localhost:8080/  > >
>> 
>> In the broken instance, request.getParameter("x") returned null,
>> but request.getReader() returned bytes with "x=123" so seems that
>> Apache is sending the POST body but Tomcat is not processing it
>> correctly, yes?
>> 
>> Please also see
>> https://stackoverflow.com/questions/44167876/problems-with-post-parame 
>> 
> ters-with-tomcat-ajp-on-apache-2-4-but-not-2-2
>> > 
> eters-with-tomcat-ajp-on-apache-2-4-but-not-2-2>
>> for my steps so far.
>> 
>> I would prefer to switch back to AJP for the proxy, since I
>> understand it is more performant, right? Should I try forcing a
>> Tomcat 8 install to see if the problem persists there too?
> 
> If you call request.getReader/getInputStream before any of the
> request.getParameter family of methods, then all request.getParameter*
> methods will return null. That's because Tomcat must consume the
> request body in order to parse POST parameters. If you call
> request.getReader/getInputStream, then Tomcat assumes that you will be
> handling the request body (and any associated parameters therein).
> 
> Is it possible that you are "damaging" the request by inspecting the
> request body?

I've been thinking about that but I don't call getReader/getInputStream 
anywhere myself. 
Also, the fact that accessing the same page via 8080 directly to Tomcat works, 
but via Apache/AJP through Tomcat's port 8009 works fine, and setting the proxy 
to use the 8080 also works.

Re: Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[Christopher Schultz]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Nic,

On 5/31/17 8:42 AM, Nicholas Cottrell wrote:
> Hi All!
> 
> I'm having a problem setting up an existing webapp from Apache
> 2.2/Tomcat6 on a new server running Centos 7, and the following
> packages:
> 
> httpd 2.4.6-45.el7.centos.4 tomcat.noarch
> 7.0.69-11.el7_3 @updates tomcat-native.x86_64
> 1.1.34-1.el7@epel
> 
> For debugging I have enabled AJP/1.3 and 8009 and HTTP on 8080,
> then use Apache to ProxyPass.
> 
> With my initial configuration, data from a form POST is not
> available via request.getParameter:
> 
> ProxyPass / ajp://localhost:8009/  retry=1
> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
> ajp://localhost:8009/ 
> 
> But changing it to this fixes everything:
> 
> ProxyPass / http://localhost:8080/  retry=1
> acquire=3000 timeout=600 Keepalive=On ProxyPassReverse /
> http://localhost:8080/ 
> 
> In the broken instance, request.getParameter("x") returned null,
> but request.getReader() returned bytes with "x=123" so seems that
> Apache is sending the POST body but Tomcat is not processing it
> correctly, yes?
> 
> Please also see
> https://stackoverflow.com/questions/44167876/problems-with-post-parame
ters-with-tomcat-ajp-on-apache-2-4-but-not-2-2
> 
> for my steps so far.
> 
> I would prefer to switch back to AJP for the proxy, since I
> understand it is more performant, right? Should I try forcing a
> Tomcat 8 install to see if the problem persists there too?

If you call request.getReader/getInputStream before any of the
request.getParameter family of methods, then all request.getParameter*
methods will return null. That's because Tomcat must consume the
request body in order to parse POST parameters. If you call
request.getReader/getInputStream, then Tomcat assumes that you will be
handling the request body (and any associated parameters therein).

Is it possible that you are "damaging" the request by inspecting the
request body?

- -chris
-BEGIN PGP SIGNATURE-
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJZLwp0AAoJEBzwKT+lPKRY+GkP/RRGHM9JZmBneogWEN1WEjJK
LhBlXJE1aQvKaP7Mpsj5q8VG+/pjWVfBSz8yBcLQPK4ty27LjPQF9fa1kTQZikrc
xpe5pJDo/Tp/xeztPLWf3l4fvBaH8/fjbb+U9XrA1+00rev1FmcI/E5Qz6qMpj70
P2g/eCWYVUaNGNjrSR4YGGFzjq3/e7uD+a1V/gdQ5XtQQZBwT8tY4BdWBqbXmKoS
MCvDzORr5QpD7Oy2OA9SCQ9/oMNe8ygmfKNlX+zMaasUhFfcXNP20iVor8YQLuLL
jHmABh0VyRwKwodOcpiXg28+7sdGaD5HQvqG1flTS9xK2OdzYNLVXuek2smq3KU4
1qXiUp8dz6V7H/CYjG8hWXgQnZnfdgHSyi/S0NiZucQ35v4IbhRjQzKaLGHduqyV
5GP5eToQ2OrSwdFYVoa73E8eQgiBmDrodDzc9Ocew/fOTVQ1rP8nsNYU77mjwr3k
Zh1m9RtG0Yi7RvBE9ifIm1p2woQQkD7ctIeaQvpUjJFfmexC3UFTFzwj9WLg0l46
rREx7BPkua9rxr+ttlSN/Dij26CPTVoy/RbM0naIBZYHBRNd4KFy85INdxYC79ug
ZZZrlQEozSEqtA7ooT5+fw25B9cudH+Dy5mfjqxtF2m8Ll0p3m+o1f53T0sEHV7m
hZTfhw0inWvHyEiece/v
=NL2s
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Possible bug between Apache 2.4 and Tomcat 7 via AJP when POSTing

[Nicholas Cottrell]

Hi All!

I'm having a problem setting up an existing webapp from Apache 2.2/Tomcat6 on a 
new server running Centos 7, and the following packages:

httpd   2.4.6-45.el7.centos.4
tomcat.noarch7.0.69-11.el7_3 @updates   
tomcat-native.x86_64 1.1.34-1.el7@epel  

For debugging I have enabled AJP/1.3 and 8009 and HTTP on 8080, then use Apache 
to ProxyPass.

With my initial configuration, data from a form POST is not available via 
request.getParameter:

  ProxyPass / ajp://localhost:8009/  retry=1 
acquire=3000 timeout=600 Keepalive=On
  ProxyPassReverse / ajp://localhost:8009/ 

But changing it to this fixes everything:

  ProxyPass / http://localhost:8080/  retry=1 
acquire=3000 timeout=600 Keepalive=On
  ProxyPassReverse / http://localhost:8080/ 

In the broken instance, request.getParameter("x") returned null, but 
request.getReader() returned bytes with "x=123" so seems that Apache is sending 
the POST body but Tomcat is not processing it correctly, yes?

Please also see 
https://stackoverflow.com/questions/44167876/problems-with-post-parameters-with-tomcat-ajp-on-apache-2-4-but-not-2-2
 

 for my steps so far.

I would prefer to switch back to AJP for the proxy, since I understand it is 
more performant, right? Should I try forcing a Tomcat 8 install to see if the 
problem persists there too?

Best,
Nic.