Re: Invalid character found in method name. HTTP method names must be tokens

2019-02-07 Thread Sean Dawson
On Thu, Feb 7, 2019 at 6:57 PM Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Sean, > > On 2/7/19 14:01, Sean Dawson wrote: > > Hello, we're using Tomcat 8.5_35 on Linux (CentOS7) and Windows > > (2016 Server and above) and here a

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Pawel Veselov
Sorry for a rather rude intrusion. On Thu, Feb 7, 2019 at 4:18 PM Christopher Schultz wrote: > Chunked encoding is like sending a bunch of small HTTP message-pieces > (I have to be careful about my wording here, since "part" actually > means something in multipart messages May be just "chunks"?

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Bhavesh Mistry
Hi Chuck, Thank for your answer and details explanation. We have requested our customer to fix the wrong client. Are there any logs we can see if the content length does not match? Once again thanks for your help! Thanks, Bhavesh On Thu, Feb 7, 2019 at 4:03 PM Caldarale, Charles R < chuck.cal

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Bhavesh, On 2/7/19 19:11, Christopher Schultz wrote: > The Content-Length of the PUT request says "I'm going to send 128 > bytes". The server is required to accept exactly 128 bytes, no more > no less. There is another option, here, but also requi

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Bhavesh, On 2/7/19 18:40, Bhavesh Mistry wrote: > Hi Mark, > > I understand what you are stating the root of issue originated with > the client (wrong client). I am stating following when you have > request/response on the same TCP connection. f

RE: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Caldarale, Charles R
> From: Bhavesh Mistry [mailto:mistry.p.bhav...@gmail.com] > Subject: Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting > Parsing logic for Subsequent Request > I am stating following when you have request/response on the same TCP > connection. for example, > My unders

Re: Invalid character found in method name. HTTP method names must be tokens

2019-02-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Sean, On 2/7/19 14:01, Sean Dawson wrote: > Hello, we're using Tomcat 8.5_35 on Linux (CentOS7) and Windows > (2016 Server and above) and here and there we see this in the > logs... > > org.apache.coyote.http11.AbstractHttp11Processor.process Error

Re: current best practices for Tomcat with SSL on port 443

2019-02-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Garret, On 2/7/19 12:22, Garret Wilson wrote: > On 2/7/2019 3:13 PM, Christopher Schultz wrote: >> … Have a look at this presentation: >> https://people.apache.org/~schultz/ApacheCon%20NA%202018/Let's%20Encr ypt >> >> %20Apache%20Tomcat.pdf > > T

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Bhavesh Mistry
Hi Mark, I understand what you are stating the root of issue originated with the client (wrong client). I am stating following when you have request/response on the same TCP connection. for example, My understanding (please correct me if my wrong): Client --

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Mark Thomas
On 07/02/2019 20:05, Bhavesh Mistry wrote: > Hi Mark, > > There is no way to validate the END of a request for PUT call and if > Content-Lenght does not match what client had sent payload body then > rejected it and reset position. You can't do that. The only way to determine how much data to exp

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Bhavesh Mistry
Hi Mark, There is no way to validate the END of a request for PUT call and if Content-Lenght does not match what client had sent payload body then rejected it and reset position. If content length does match then reject PUT request, and then close the connection for PUT call not for subsequent re

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Mark Thomas
On 07/02/2019 18:48, Bhavesh Mistry wrote: > Hello Tomcat Developers, > > I have a unique situation about HTTP Protocol PAYLOAD parsing and > Content-Length Header. There is nothing unique here. >  When PUT/POST Content-Length is NOT correct > (client send wrong Content-Lenght), the tomcat is ab

Re: Invalid character found in method name. HTTP method names must be tokens

2019-02-07 Thread Mark Thomas
On 07/02/2019 19:01, Sean Dawson wrote: > Hello, we're using Tomcat 8.5_35 on Linux (CentOS7) and Windows (2016 > Server and above) and here and there we see this in the logs... > > org.apache.coyote.http11.AbstractHttp11Processor.process Error parsing HTTP > request header > Note: further occurr

Invalid character found in method name. HTTP method names must be tokens

2019-02-07 Thread Sean Dawson
Hello, we're using Tomcat 8.5_35 on Linux (CentOS7) and Windows (2016 Server and above) and here and there we see this in the logs... org.apache.coyote.http11.AbstractHttp11Processor.process Error parsing HTTP request header Note: further occurrences of HTTP header parsing errors will be logged a

Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

2019-02-07 Thread Bhavesh Mistry
Hello Tomcat Developers, I have a unique situation about HTTP Protocol PAYLOAD parsing and Content-Length Header. When PUT/POST Content-Length is NOT correct (client send wrong Content-Lenght), the tomcat is able to parse the request and respond to request with 2xx but subsequent on SAME TCP conn

Re: current best practices for Tomcat with SSL on port 443

2019-02-07 Thread Garret Wilson
On 2/7/2019 3:13 PM, Christopher Schultz wrote: … Have a look at this presentation: https://people.apache.org/~schultz/ApacheCon%20NA%202018/Let's%20Encrypt %20Apache%20Tomcat.pdf The presentation gets two thumbs up, specifically: * Great corny grammar ambiguity joke on the title page. * The

Re: current best practices for Tomcat with SSL on port 443

2019-02-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Garret, On 2/7/19 11:45, Garret Wilson wrote: > Hi, everyone. In the computer course I'm writing I'm using Tomcat > for the server. (Students learn how to set up CentOS and everything > from scratch. Currently the course has them using Tomcat runnin

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 James, On 2/6/19 12:21, James H. H. Lampert wrote: > Thanks. I do have some follow up questions > > On 2/6/19, 1:04 AM, Mark Thomas wrote: >> On the TLS Connector: >> >> sslEnabledProtocols="TLSv1.1,TLSv1.2" > > Ok. So the active connector we cur

Re: current best practices for Tomcat with SSL on port 443

2019-02-07 Thread John Larsen
You can use apache with mod_jk and then just setup the ssl through apache and tomcat will use the 443 port through apache. If you want to use letencrypt you need to add JkUnMount for /.well-known/* directory so that when you run lets encrypt it can create and get to this directory through apache.

current best practices for Tomcat with SSL on port 443

2019-02-07 Thread Garret Wilson
Hi, everyone. In the computer course I'm writing I'm using Tomcat for the server. (Students learn how to set up CentOS and everything from scratch. Currently the course has them using Tomcat running on port 8080.) I'm going back to write the section on security. I want students to learn to set

Re: response sent before request

2019-02-07 Thread Giuseppe Sacco
Hello Mark, Il giorno gio, 07/02/2019 alle 09.49 +, Mark Thomas ha scritto: > On 06/02/2019 17:27, Giuseppe Sacco wrote: [...] > > So, I wonder, what instructs tomcat to start parsing a request? Is > > it > > the newline inbetween the header and the body? How is it possible > > to > > explain

Re: response sent before request

2019-02-07 Thread Mark Thomas
On 06/02/2019 17:27, Giuseppe Sacco wrote: > Hello, > I have a tomcat 8.5.20 installation that handle many applications. When > calling one of the URLs of a specific application, sometimes I get > a 500 http error. Please note that this it does not happens always. > > The connector uses SSL, so I

Re: Tomcat patch management and patching best practices

2019-02-07 Thread Mark Thomas
The Apache Tomcat project does not provide patches for individual issues and has no plans to change that. The simplest way to manage updates is to separate CATALINA_HOME and CATALINA_BASE as per http://tomcat.apache.org/tomcat-9.0-doc/introduction.html#CATALINA_HOME_and_CATALINA_BASE or https://to

Re: HTTP2 with WebSockets

2019-02-07 Thread Mark Thomas
On 07/02/2019 00:31, Jesse Schulman wrote: > Is it possible for tomcat to run with HTTP2 and WebSockets on the same > connector? I have tried configuring it myself and looked for examples > without success. This works out of the box. I have confirmed the behaviour with my local build of 9.0.x bu