Hi, It appears that the CVE-2017-5647 fix lacked this pre-requisite: https://bz.apache.org/bugzilla/show_bug.cgi?id=57799 https://svn.apache.org/viewvc?view=revision&revision=1712081
The test case is not flacky anymore, I'm going to test full builds again. Cheers! Sylvain On 07/08/2019 00:45, Sylvain Beucler wrote: > Hi Markus, > > I'm investigating tomcat8's FTBFS and I confirm Abhijith's findings in a > Jessie VM: > > - test catalina/connector/TestSendFile.java fails with nio2 connector > but is not reliable and will report success ~1 out of 10 even with lots > of exceptions; catalina.log will report header parsing error and return 400 > > - it passes reliably without CVE-2017-5647.patch > > - the test certificate did expire on 2019-02-27 but changing the date to > 2019-01-01 and rebuilding does not impact these results > (incidentally the test certs seems to depend on an external CA > ca-test.tomcat.apache.org, fixing the certs will require switching to > the new-style local CA in tomcat8 - if fixing the certs is needed) > > As you fixed CVE-2017-5647 as well as generated the last jessie upload, > I would be interested in your take on this :) > TestSendFile only got trivial changes, so I guess I'll look for a fix in > later changes affecting files modified by CVE-2017-5647. > Still, I'm surprised updates were built given this situation - did > everybody got lucky with the flacky test or did I miss something? > > Cheers! > Sylvain > > On 27/07/2019 20:30, Abhijith PA wrote: >> Hi, >> >> >> I don't think the link you gave on commit [fe932dd39d] is the reason for >> FTBFS. I tried building on a VM that matches the certificate date and it >> was successful. I also tried disabling all ssl related tests and was fine. >> >> While doing these all I found TestSendFile test is the culprit. In >> CVE-2017-5647 security patch a good amount of changes is applied for >> SendFile*.java and *Nio2*.java. These are mostly about conditions on how >> long the socket of sendfile keep active and to take away from it. But I >> couldn't see any those change in its test file. Please take a look on >> the attached patch. :) >> >> >> --abhijith
