Re: Tomcat 8.5 appends null characters

2020-05-20 Thread Tuukka Ilomäki
On 5/19/20 09:50, Martin Grigorov wrote: >> Hi, >> >> On Tue, May 19, 2020 at 3:32 PM Tuukka Ilomäki >> wrote: >> >>> Dear collective wisdom, as the EOL of Tomcat 7 is looming, we are >>> migrating our legacy app from Tomcat 7.0 to Tomcat 8.5. We deploy >>> exactly the same war in both versions. F

Re: maxSwallowSize and misbehaving clients (e.g., mod_proxy_http)

2020-05-20 Thread Osipov, Michael
Am 2020-05-20 um 15:07 schrieb Mark Thomas: On 20/05/2020 11:05, Osipov, Michael wrote: My questions are: * Why is parseRequestLine printing the request body? Because it is the contents of the input buffer that is being logged, not just the headers. * Can someone confirm the erratic behav

Clustering/Session Replication in docker swarm

2020-05-20 Thread Praveen Kumar K S
Hello, I'm not sure if this is the right forum to ask this question. Since this is a bigger community, I hope someone might have faced this issue and hope I will get some help. I'm seeing many posts achieving Tomcat session replication in docker swarm using traefik. But I just don't want to add a

[SECURITY] CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence

2020-05-20 Thread Mark Thomas
CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence Severity: High Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M4 Apache Tomcat 9.0.0.M1 to 9.0.34 Apache Tomcat 8.5.0 to 8.5.54 Apache Tomcat 7.0.0 to 7.0.103 Description: If:

Implementing Store and getting java.io.StreamCorruptedException

2020-05-20 Thread Jonathan Yom-Tov
I implemented my own Store which uses Redis to persist sessions (I'm using Jedis as the interface library). I copied most of the load()/save() code from FileStore. When my Store loads the session from Redis I consistently get java.io.StreamCorruptedException: Inconsistent vector internals. Any idea

Re: 7.0.77 to 8.5.51 upgrade on Solaris 11.4 (csh)

2020-05-20 Thread Trae McCombs
Thank you for trying. I've looked into your suggestions and unfortunately they did not help. I am on CSH and all I really need to know how to do is get the JAVA_OPTS and CATALINA_OPTS environment variables set. I'm still researching but haven't found anything. On Wed, May 20, 2020 at 9:07 AM Al

Re: 7.0.77 to 8.5.51 upgrade on Solaris 11.4 (csh)

2020-05-20 Thread Alberto Cabello Sánchez
On Wed, 20 May 2020 14:58:53 +0200 Alberto Cabello Sánchez wrote: > On Wed, 20 May 2020 07:42:33 -0400 > Trae McCombs wrote: > > > cat $TOMCAT_DIR/bin/setenv.sh > > #!/usr/bin/csh > > setenv FOO "-Dcom1 -Dcom2 -Dcom3 etc" > > > > run the above as a test in that bin dir: ./setenv.sh (no errors)

Re: maxSwallowSize and misbehaving clients (e.g., mod_proxy_http)

2020-05-20 Thread Mark Thomas
On 20/05/2020 11:05, Osipov, Michael wrote: > My questions are: > * Why is parseRequestLine printing the request body? Because it is the contents of the input buffer that is being logged, not just the headers. > * Can someone confirm the erratic behavior of HTTPd's module? I'm not sure it is

Re: 7.0.77 to 8.5.51 upgrade on Solaris 11.4 (csh)

2020-05-20 Thread Alberto Cabello Sánchez
On Wed, 20 May 2020 07:42:33 -0400 Trae McCombs wrote: > cat $TOMCAT_DIR/bin/setenv.sh > #!/usr/bin/csh > setenv FOO "-Dcom1 -Dcom2 -Dcom3 etc" > > run the above as a test in that bin dir: ./setenv.sh (no errors) > env |grep FOO > > Nothing. The command ./setenv.sh spans a new csh process, t

7.0.77 to 8.5.51 upgrade on Solaris 11.4 (csh)

2020-05-20 Thread Trae McCombs
Hello, We are trying to upgrade one of our tomcats from 7.0.77 to 8.5.51 and are running into a bit of an issue. First a bit of history on our current setup: Apache Tomcat 7.0.77 on Solaris 11.4.20.4.0, 1 webapps warfile with CSH as the shell. In order to set our JAVA_OPTS and our CATALINA_OPT

Re: RST on TCP level sent by Tomcat

2020-05-20 Thread Mark Thomas
On 20/05/2020 10:07, Arshiya Shariff wrote: > Hi Mark, > Thank you for the response. > > Getting back on Query 3 and 4. > There are no active streams and still connection is not being closed by tomcat , and after sometime for new requests tomcat is sending RST. As it is a produ

maxSwallowSize and misbehaving clients (e.g., mod_proxy_http)

2020-05-20 Thread Osipov, Michael
Hi folks, I am experiencing an issue which I believe is an already reported bug in HTTPd, but I am not 100% sure. I first observed this with py-requests which does not support the Expect header, but was also able to reproduce with curl too. My setup is running several Tomcat instances behind

RE: RST on TCP level sent by Tomcat

2020-05-20 Thread Arshiya Shariff
Hi Mark, Thank you for the response. Getting back on Query 3 and 4. >>> There are no active streams and still connection is not being closed by >>> tomcat , and after sometime for new requests tomcat is sending RST. >>> As it is a production issue, it's hard for us to reproduce this at our end

RE: RST on TCP level sent by Tomcat

2020-05-20 Thread Arshiya Shariff
Hi Mark, Thank you for the response. Getting back on Query 3 and 4. >>> There are no active streams and still connection is not being closed by >>> tomcat , and after sometime for new requests tomcat is sending RST. How long does new connection have to wait when connection limit reached , whe

Re: RST on TCP level sent by Tomcat

2020-05-20 Thread Mark Thomas
On 20/05/2020 07:02, Arshiya Shariff wrote: > Hi Team , > > 1.We are facing a problem where tomcat is closing the http2 connections > silently without sending GOAWAY and FIN. Under what cases does this happen ? Tomcat always tries to write the GOAWAY frame. Network issues may prevent the client