headers
Filip Hanik - Dev Lists | 1 Mar 2011 01:16

Re: svn commit: r1074675 - in /tomcat/trunk: java/org/apache/coyote/http11/ java/org/apache/tomcat/util/net/ webapps/docs/

On 2/28/2011 4:49 PM, Mark Thomas wrote:
> It isn't clear to me if you are voting -1
on the above commit, and the following commits. r1074675

If you wish to do this, it should at least include:
1. input filters need to check if they retrieved the entire body
if only partial, why even attempt a reneg and make your thread hang for soTimeout while it fails. this is
another DoS scenario. the system 
knows if it read the entire body or not. it's part of the protocol itself, no need to rely on timeouts for a
reneg to fail.

2. don't change the names of all the flags, since it makes the diffs so much harder to review. just change the
lines pertinent to the change.

3. implement rehandshake as simple as possible, by using the handshake(...) and using its return code

4. SSLAuthenticator should have a flag to fail directly without trying to reneg if the connector is
misconfigured to avoid reneg for clients 
vulnerable to the man in the middle reneg attack

5. SSLAuthenticator should be able to find out if the cert truly was client-auth or if it came from another
source. otherwise, putting 
httpd/mod_jk in front of it, and I can bypass client-auth as the document states is required

6. And if you want the most performant solution, instead of opening a selector on the same thread, just call
sslEngine.beginHandshake, add 
the connection to the poller, and return from the call all together. this way, the worker thread is not in use
during a handshake, and it's 
done in the poller just like the initial hand shake. this protects you from slow clients using up threads.
this is of course more
(Continue reading)

Permalink | Reply | 3 comments |
headers
Mark Thomas | 1 Mar 2011 01:27
Picon
Favicon
Gravatar

Re: svn commit: r1074675 - in /tomcat/trunk: java/org/apache/coyote/http11/ java/org/apache/tomcat/util/net/ webapps/docs/

On 01/03/2011 00:16, Filip Hanik - Dev Lists wrote:
> On 2/28/2011 4:49 PM, Mark Thomas wrote:
>> It isn't clear to me if you are voting -1
> on the above commit, and the following commits. r1074675

Understood and agree those commits are broken. I'll get those backed out
shortly.

> If you wish to do this, it should at least include:
> 1. input filters need to check if they retrieved the entire body
> if only partial, why even attempt a reneg and make your thread hang for
> soTimeout while it fails. this is another DoS scenario. the system knows
> if it read the entire body or not. it's part of the protocol itself, no
> need to rely on timeouts for a reneg to fail.
> 
> 2. don't change the names of all the flags, since it makes the diffs so
> much harder to review. just change the lines pertinent to the change.
> 
> 3. implement rehandshake as simple as possible, by using the
> handshake(...) and using its return code
> 
> 4. SSLAuthenticator should have a flag to fail directly without trying
> to reneg if the connector is misconfigured to avoid reneg for clients
> vulnerable to the man in the middle reneg attack
> 
> 5. SSLAuthenticator should be able to find out if the cert truly was
> client-auth or if it came from another source. otherwise, putting
> httpd/mod_jk in front of it, and I can bypass client-auth as the
> document states is required
>
(Continue reading)

Permalink | Reply | 2 comments |
headers
markt | 1 Mar 2011 02:15
Picon
Favicon
Gravatar

svn commit: r1075604 - in /tomcat/trunk/test/org/apache/tomcat/util/net: TestCustomSsl.java TestSsl.java TesterSupport.java ca.jks localhost-cert.pem localhost-key.pem localhost.jks test-cert.pem test-key.pem test.keystore user1.jks

Author: markt
Date: Tue Mar  1 01:15:11 2011
New Revision: 1075604

URL: http://svn.apache.org/viewvc?rev=1075604&view=rev
Log:
Start of an SSL re-negotiation test. Need to expand it to handle request bodies and the other issues
highlighted by Filip.
Switch to using a CA since it makes the code cleaner and it is easier to get CLIENT-CERT working than will all
self-signed certs.

Added:
    tomcat/trunk/test/org/apache/tomcat/util/net/ca.jks   (with props)
    tomcat/trunk/test/org/apache/tomcat/util/net/localhost-cert.pem
    tomcat/trunk/test/org/apache/tomcat/util/net/localhost-key.pem
    tomcat/trunk/test/org/apache/tomcat/util/net/localhost.jks   (with props)
    tomcat/trunk/test/org/apache/tomcat/util/net/user1.jks   (with props)
Removed:
    tomcat/trunk/test/org/apache/tomcat/util/net/test-cert.pem
    tomcat/trunk/test/org/apache/tomcat/util/net/test-key.pem
    tomcat/trunk/test/org/apache/tomcat/util/net/test.keystore
Modified:
    tomcat/trunk/test/org/apache/tomcat/util/net/TestCustomSsl.java
    tomcat/trunk/test/org/apache/tomcat/util/net/TestSsl.java
    tomcat/trunk/test/org/apache/tomcat/util/net/TesterSupport.java

Modified: tomcat/trunk/test/org/apache/tomcat/util/net/TestCustomSsl.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/test/org/apache/tomcat/util/net/TestCustomSsl.java?rev=1075604&r1=1075603&r2=1075604&view=diff
==============================================================================
--- tomcat/trunk/test/org/apache/tomcat/util/net/TestCustomSsl.java (original)
(Continue reading)

Permalink | Reply | 0 comments |
headers
markt | 1 Mar 2011 02:23
Picon
Favicon
Gravatar

svn commit: r1075606 - in /tomcat/trunk: java/org/apache/coyote/http11/ java/org/apache/tomcat/util/net/ webapps/docs/

Author: markt
Date: Tue Mar  1 01:23:31 2011
New Revision: 1075606

URL: http://svn.apache.org/viewvc?rev=1075606&view=rev
Log:
Revert SSL renegotiation for NIO - implementation is broken
Reverts r1074675 and r1075030

Modified:
    tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java
    tomcat/trunk/java/org/apache/coyote/http11/LocalStrings.properties
    tomcat/trunk/java/org/apache/tomcat/util/net/NioChannel.java
    tomcat/trunk/java/org/apache/tomcat/util/net/SecureNioChannel.java
    tomcat/trunk/webapps/docs/changelog.xml

Modified: tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java?rev=1075606&r1=1075605&r2=1075606&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java (original)
+++ tomcat/trunk/java/org/apache/coyote/http11/Http11NioProcessor.java Tue Mar  1 01:23:31 2011
 <at>  <at>  -23,8 +23,6  <at>  <at>  import java.nio.channels.SelectionKey;
 import java.util.Locale;
 import java.util.concurrent.Executor;

-import javax.net.ssl.SSLEngine;
-
 import org.apache.coyote.ActionCode;
 import org.apache.coyote.Request;
 import org.apache.coyote.RequestInfo;
(Continue reading)

Permalink | Reply | 0 comments |
headers
Rex Wang | 1 Mar 2011 08:12
Picon

Re: [taglibs] Time to release 1.2.0?

+1

2011/1/24 Jeremy Boynes <jboynes <at> apache.org>

> The only bug remaining that impact the JSTL libraries is #46052 (locale
> performance on 1.6). Henri suggested releasing in its current form which
> sounds reasonable. Should we release this as 1.2.0? Is this a good version
> number - should we use something like 1.2.0-beta?
>
> This will be the first release in a long time and the first since the
> switch to a Maven based build. The process is described here
>        http://www.apache.org/dev/publishing-maven-artifacts.html
>
> I think we need to release the parent POM first to get it in the central
> repo, and then the artifacts that depend on it.
>
> I'd volunteer to RM this but:
> 1) I'm not a PMC member (which I don't think matters if we get enough votes
> from PMC members)
> 2) I'd need to update my PGP key in the WoT (somehow)
> 3) I've not done the above process before so will likely mess things up.
>
> If we're ready to do this I'd suggest going for it this week.
> Thoughts?
> Jeremy
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe <at> tomcat.apache.org
> For additional commands, e-mail: dev-help <at> tomcat.apache.org
>
>
(Continue reading)

Permalink | Reply | 0 comments |
headers
markt | 1 Mar 2011 09:36
Picon
Favicon
Gravatar

svn commit: r1075699 - /tomcat/trunk/test/org/apache/tomcat/util/net/TestSsl.java

Author: markt
Date: Tue Mar  1 08:36:57 2011
New Revision: 1075699

URL: http://svn.apache.org/viewvc?rev=1075699&view=rev
Log:
Comment tweaks

Modified:
    tomcat/trunk/test/org/apache/tomcat/util/net/TestSsl.java

Modified: tomcat/trunk/test/org/apache/tomcat/util/net/TestSsl.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/test/org/apache/tomcat/util/net/TestSsl.java?rev=1075699&r1=1075698&r2=1075699&view=diff
==============================================================================
--- tomcat/trunk/test/org/apache/tomcat/util/net/TestSsl.java (original)
+++ tomcat/trunk/test/org/apache/tomcat/util/net/TestSsl.java Tue Mar  1 08:36:57 2011
 <at>  <at>  -42,10 +42,9  <at>  <at>  import org.apache.catalina.startup.Tomca
 import org.apache.tomcat.util.buf.ByteChunk;

 /**
- * Requires test.keystore (checked in), generated with:
- *  keytool -genkey -alias tomcat -keyalg RSA
- *  pass: changeit 
- *  CN: localhost ( for hostname validation )
+ * The keys and certificates used in this file are all available in svn and were
+ * generated using a test CA the files for which are in the Tomcat PMC private
+ * repository since not all of them are AL2 licensed.
  */
 public class TestSsl extends TomcatBaseTest {
(Continue reading)

Permalink | Reply | 0 comments |
headers
markt | 1 Mar 2011 09:44
Picon
Favicon
Gravatar

svn commit: r1075708 - /tomcat/trunk/test/org/apache/el/lang/TestELArithmetic.java

Author: markt
Date: Tue Mar  1 08:44:29 2011
New Revision: 1075708

URL: http://svn.apache.org/viewvc?rev=1075708&view=rev
Log:
FindBugs fixes - make constants static

Modified:
    tomcat/trunk/test/org/apache/el/lang/TestELArithmetic.java

Modified: tomcat/trunk/test/org/apache/el/lang/TestELArithmetic.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/test/org/apache/el/lang/TestELArithmetic.java?rev=1075708&r1=1075707&r2=1075708&view=diff
==============================================================================
--- tomcat/trunk/test/org/apache/el/lang/TestELArithmetic.java (original)
+++ tomcat/trunk/test/org/apache/el/lang/TestELArithmetic.java Tue Mar  1 08:44:29 2011
 <at>  <at>  -21,8 +21,9  <at>  <at>  import java.math.BigInteger;
 import junit.framework.TestCase;

 public class TestELArithmetic extends TestCase {
-    private final String a = "1.1";
-    private final BigInteger b = new BigInteger("1000000000000000000000");
+    private static final String a = "1.1";
+    private static final BigInteger b =
+        new BigInteger("1000000000000000000000");

     public void testAdd() throws Exception {
         assertEquals("1000000000000000000001.1",
Permalink | Reply | 0 comments |
headers
markt | 1 Mar 2011 09:50
Picon
Favicon
Gravatar

svn commit: r1075713 - /tomcat/trunk/test/org/apache/catalina/servlets/TestDefaultServlet.java

Author: markt
Date: Tue Mar  1 08:50:40 2011
New Revision: 1075713

URL: http://svn.apache.org/viewvc?rev=1075713&view=rev
Log:
More explicit failure message - fixed FindBugs nags

Modified:
    tomcat/trunk/test/org/apache/catalina/servlets/TestDefaultServlet.java

Modified: tomcat/trunk/test/org/apache/catalina/servlets/TestDefaultServlet.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/test/org/apache/catalina/servlets/TestDefaultServlet.java?rev=1075713&r1=1075712&r2=1075713&view=diff
==============================================================================
--- tomcat/trunk/test/org/apache/catalina/servlets/TestDefaultServlet.java (original)
+++ tomcat/trunk/test/org/apache/catalina/servlets/TestDefaultServlet.java Tue Mar  1 08:50:40 2011
 <at>  <at>  -153,7 +153,10  <at>  <at>  public class TestDefaultServlet extends 
      */
     public void testCustomErrorPage() throws Exception {
         File appDir = new File(getTemporaryDirectory(), "MyApp");
-        new File(appDir, "WEB-INF").mkdirs();
+        File webInf = new File(appDir, "WEB-INF");
+        if (!webInf.mkdirs()) {
+            fail("Unable to create directory [" + webInf + "]");
+        }
         Writer w = new OutputStreamWriter(new FileOutputStream(new File(appDir,
                 "WEB-INF/web.xml")), "UTF-8");
         try {
 <at>  <at>  -234,7 +237,10  <at>  <at>  public class TestDefaultServlet extends 
      */
(Continue reading)

Permalink | Reply | 0 comments |
headers
markt | 1 Mar 2011 09:56
Picon
Favicon
Gravatar

svn commit: r1075718 - /tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java

Author: markt
Date: Tue Mar  1 08:56:48 2011
New Revision: 1075718

URL: http://svn.apache.org/viewvc?rev=1075718&view=rev
Log:
Fix FindBugs warning 

Modified:
    tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java

Modified: tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java?rev=1075718&r1=1075717&r2=1075718&view=diff
==============================================================================
--- tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java (original)
+++ tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java Tue Mar  1 08:56:48 2011
 <at>  <at>  -113,8 +113,8  <at>  <at>  public class TestTomcat extends TomcatBa
                 try {
                     is = conn.getInputStream();
                     reader = new InputStreamReader(is);
-                    reader.read(cbuf);
-                    res.getWriter().write(cbuf);
+                    int len = reader.read(cbuf);
+                    res.getWriter().write(cbuf, 0, len);
                 } finally {
                     if (reader != null) {
                         try { reader.close(); } catch(IOException ioe) {/*Ignore*/}
Permalink | Reply | 0 comments |
headers
markt | 1 Mar 2011 10:00
Picon
Favicon
Gravatar

svn commit: r1075719 - /tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java

Author: markt
Date: Tue Mar  1 09:00:01 2011
New Revision: 1075719

URL: http://svn.apache.org/viewvc?rev=1075719&view=rev
Log:
Better fix, we actually need to read 20 byres for the test to pass

Modified:
    tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java

Modified: tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java?rev=1075719&r1=1075718&r2=1075719&view=diff
==============================================================================
--- tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java (original)
+++ tomcat/trunk/test/org/apache/catalina/startup/TestTomcat.java Tue Mar  1 09:00:01 2011
 <at>  <at>  -110,11 +110,15  <at>  <at>  public class TestTomcat extends TomcatBa
                 InputStream is = null;
                 Reader reader = null;
                 char cbuf[] = new char[20];
+                int read = 0;
                 try {
-                    is = conn.getInputStream();
-                    reader = new InputStreamReader(is);
-                    int len = reader.read(cbuf);
-                    res.getWriter().write(cbuf, 0, len);
+                    while (read < 20) {
+                        is = conn.getInputStream();
+                        reader = new InputStreamReader(is);
+                        int len = reader.read(cbuf, read, cbuf.length - read);
(Continue reading)

Permalink | Reply | 1 comment |

Gmane