April 2017 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFCORE-2612) Upgrade WildFly Common to 1.2.0.Beta9

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2612?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-2612: ------------------------------- Fix Version/s: 3.0.0.Beta14 (was: 3.0.0.Beta13) > Upgrade WildFly Common to 1.2.0.Beta9 > ------------------------------------- > > Key: WFCORE-2612 > URL: https://issues.jboss.org/browse/WFCORE-2612 > Project: WildFly Core > Issue Type: Component Upgrade > Reporter: David Lloyd > Assignee: David Lloyd > Fix For: 3.0.0.Beta14 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2611) Upgrade WildFly Client Config to 1.0.0.Beta3

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2611?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-2611: ------------------------------- Fix Version/s: 3.0.0.Beta14 (was: 3.0.0.Beta13) > Upgrade WildFly Client Config to 1.0.0.Beta3 > -------------------------------------------- > > Key: WFCORE-2611 > URL: https://issues.jboss.org/browse/WFCORE-2611 > Project: WildFly Core > Issue Type: Component Upgrade > Reporter: David Lloyd > Assignee: David Lloyd > Fix For: 3.0.0.Beta14 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2610) Upgrade XNIO to 3.5.0.Beta4

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2610?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-2610: ------------------------------- Fix Version/s: 3.0.0.Beta14 (was: 3.0.0.Beta13) > Upgrade XNIO to 3.5.0.Beta4 > --------------------------- > > Key: WFCORE-2610 > URL: https://issues.jboss.org/browse/WFCORE-2610 > Project: WildFly Core > Issue Type: Component Upgrade > Reporter: David Lloyd > Assignee: David Lloyd > Fix For: 3.0.0.Beta14 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2574) Ensure wrap on server-ssl-context default to false

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2574?page=com.atlassian.jira.plugi... ] Kabir Khan reopened WFCORE-2574: -------------------------------- > Ensure wrap on server-ssl-context default to false > -------------------------------------------------- > > Key: WFCORE-2574 > URL: https://issues.jboss.org/browse/WFCORE-2574 > Project: WildFly Core > Issue Type: Task > Components: Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2574) Ensure wrap on server-ssl-context default to false

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2574?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-2574: ------------------------------- Fix Version/s: (was: 3.0.0.Beta13) > Ensure wrap on server-ssl-context default to false > -------------------------------------------------- > > Key: WFCORE-2574 > URL: https://issues.jboss.org/browse/WFCORE-2574 > Project: WildFly Core > Issue Type: Task > Components: Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2614) Elytron SecurityRealm included more times in a SecurityDomain breaks the domain service

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2614?page=com.atlassian.jira.plugi... ] Darran Lofthouse commented on WFCORE-2614: ------------------------------------------ Discussed with Brian, we do need to add an additional step to verify no duplicates to allow for composite operations. Additionally we previously added support to verify the default realm is within the list of referenced realms, this should also be in an additional step so both can be added to a dedicated op at the end of Stage.MODEL and verified together. > Elytron SecurityRealm included more times in a SecurityDomain breaks the domain service > --------------------------------------------------------------------------------------- > > Key: WFCORE-2614 > URL: https://issues.jboss.org/browse/WFCORE-2614 > Project: WildFly Core > Issue Type: Bug > Components: Security > Affects Versions: 3.0.0.Beta12 > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Critical > Labels: eap71_beta, management-model, security-domain > Fix For: 3.0.0.Beta13 > > > Elytron subsystem allows to add the same realm more times into a single security domain. Nevertheless in such case domain stops to work with following error message: > {noformat} > 16:14:17,411 ERROR [org.jboss.as.controller.management-operation] (ServerService Thread Pool -- 54) WFLYCTL0013: Operation ("add") failed - address: ([ > ("subsystem" => "elytron"), > ("security-domain" => "ManagementDomain") > ]) - failure description: "WFLYELY00002: Can not inject the same realm 'local' in a single security domain." > {noformat} > If such the changed domain is ManagementDomain, then the server stops to start at all. > *Suggested fix* > * either allow to have the same realm in a security domain more times > * or check for duplicate realms already when adding/changing the domain -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2574) Ensure wrap on server-ssl-context default to false

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2574?page=com.atlassian.jira.plugi... ] Kabir Khan edited comment on WFCORE-2574 at 4/3/17 8:13 AM: ------------------------------------------------------------ [~dlofthouse] I think this is in 3.0.0.Beta12 already? If not, please reopen it was (Author: kabirkhan): [~dlofthouse] I think this is in ER1 > Ensure wrap on server-ssl-context default to false > -------------------------------------------------- > > Key: WFCORE-2574 > URL: https://issues.jboss.org/browse/WFCORE-2574 > Project: WildFly Core > Issue Type: Task > Components: Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Beta13 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (ELY-1049) Coverity, division by zero in KeyStoreCredentialStore (Elytron)

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-1049?page=com.atlassian.jira.plugin.s... ] Ilia Vassilev reassigned ELY-1049: ---------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity, division by zero in KeyStoreCredentialStore (Elytron) > --------------------------------------------------------------- > > Key: ELY-1049 > URL: https://issues.jboss.org/browse/ELY-1049 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Martin Choma > Assignee: Ilia Vassilev > Priority: Critical > > Coverity found possible division by zero code. > https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=12563... > {code:java|title=KeyStoreCredentialStore.java} > private byte[] pkcs7Pad(byte[] buffer, int blockSize) { > int len = buffer.length; > int toFill = blockSize - (len % blockSize); > byte[] padded = Arrays.copyOf(buffer, toFill + len); > Arrays.fill(padded, len, padded.length, (byte) toFill); > return padded; > } > {code} > blockSize could be 0 as {{encrypt.getBlockSize()}} return 0 if used algorithm is not blocked-based. Although default cyptographic algoritm is block-based {{DEFAULT_CRYPTOGRAPHIC_ALGORITHM = "AES/CBC/NoPadding"}} , this is configurable with {{cryptoAlg}} option and thus non-block-based algorithm can be configured. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2467) Specify detailed HttpServerAuthenticationMechanismFactory interface contract

by Martin Choma (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2467?page=com.atlassian.jira.plugi... ] Martin Choma updated WFCORE-2467: --------------------------------- Description: Please specify detailed contract of HttpServerAuthenticationMechanismFactory. Describe which params are allowed to be null and what happens in that case. Also describe if null return values are allowed from interface methods and when does that could happen. You can consider {{javax.security.sasl.SaslServerFactory}} as example of detailed contract. For example: * Is {{properties}} parameter of {{getMechanismNames()}} allowed to be null? * is {{getMechanismNames()}} allowed to return null ? * Are any of {{createAuthenticationMechanism()}} parameters allowed to be null? ** For {{ServerMechanismFactoryImpl}} implementation {{properties}} could not be null - is it general rule? {code} java.lang.IllegalArgumentException: Parameter 'properties' may not be null at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:79) {code} ** For {{ServerMechanismFactoryImpl}} implementation {{callbackHandler}} could not be null - is it general rule? {code} java.lang.IllegalArgumentException: Parameter 'callbackHandler' may not be null at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:80) {code} ** For {{ServerMechanismFactoryImpl}} implementation {{mechanismName}} could not be null - is it general rule? {code} java.lang.IllegalArgumentException: Parameter 'mechanismName' may not be null at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:78) {code} I would suggest to wrap {{java.lang.IllegalArgumentException}} to HttpAuthenticationException. Otherwise possibility of {{IllegalArgumentException}} should be documented in contract. Filing as Critical, as this interface is expected to be implemented by custom factories. was: Please specify detailed contract of HttpServerAuthenticationMechanismFactory. Describe which params are allowed to be null and what happens in that case. Also describe if null return values are allowed from interface methods and when does that could happen. You can consider {{javax.security.sasl.SaslServerFactory}} as example of detailed contract. For example: * Is {{properties}} parameter of {{getMechanismNames()}} allowed to be null? * is {{getMechanismNames()}} allowed to return null ? * Are any of {{createAuthenticationMechanism()}} parameters allowed to be null? ** For {{ServerMechanismFactoryImpl}} implementation {{properties}} could not be null - is it general rule? {code} java.lang.IllegalArgumentException: Parameter 'properties' may not be null at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:79) {code} ** For {{ServerMechanismFactoryImpl}} implementation {{callbackHandler}} could not be null - is it general rule? {code} java.lang.IllegalArgumentException: Parameter 'callbackHandler' may not be null at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:80) {code} ** For {{ServerMechanismFactoryImpl}} implementation {{mechanismName}} could not be null - is it general rule? {code} java.lang.IllegalArgumentException: Parameter 'mechanismName' may not be null at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:78) {code} I would suggest to wrap {{java.lang.IllegalArgumentException}} to HttpAuthenticationException. Otherwise possibility of {{IllegalArgumentException}} should be documented in contract. * Is {{createAuthenticationMechanism()}} allowed to return null? Filing as Critical, as this interface is expected to be implemented by custom factories. > Specify detailed HttpServerAuthenticationMechanismFactory interface contract > ---------------------------------------------------------------------------- > > Key: WFCORE-2467 > URL: https://issues.jboss.org/browse/WFCORE-2467 > Project: WildFly Core > Issue Type: Bug > Components: Security > Reporter: Martin Choma > Priority: Critical > > Please specify detailed contract of HttpServerAuthenticationMechanismFactory. > Describe which params are allowed to be null and what happens in that case. Also describe if null return values are allowed from interface methods and when does that could happen. > You can consider {{javax.security.sasl.SaslServerFactory}} as example of detailed contract. > For example: > * Is {{properties}} parameter of {{getMechanismNames()}} allowed to be null? > * is {{getMechanismNames()}} allowed to return null ? > * Are any of {{createAuthenticationMechanism()}} parameters allowed to be null? > ** For {{ServerMechanismFactoryImpl}} implementation {{properties}} could not be null - is it general rule? > {code} > java.lang.IllegalArgumentException: Parameter 'properties' may not be null > at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) > at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) > at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:79) > {code} > ** For {{ServerMechanismFactoryImpl}} implementation {{callbackHandler}} could not be null - is it general rule? > {code} > java.lang.IllegalArgumentException: Parameter 'callbackHandler' may not be null > at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) > at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) > at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:80) > {code} > ** For {{ServerMechanismFactoryImpl}} implementation {{mechanismName}} could not be null - is it general rule? > {code} > java.lang.IllegalArgumentException: Parameter 'mechanismName' may not be null > at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69) > at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47) > at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:78) > {code} > I would suggest to wrap {{java.lang.IllegalArgumentException}} to HttpAuthenticationException. Otherwise possibility of {{IllegalArgumentException}} should be documented in contract. > Filing as Critical, as this interface is expected to be implemented by custom factories. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

[JBoss JIRA] (ELY-1048) Coverity, ignoring number of bytes read

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-1048?page=com.atlassian.jira.plugin.s... ] Ilia Vassilev reassigned ELY-1048: ---------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity, ignoring number of bytes read > --------------------------------------- > > Key: ELY-1048 > URL: https://issues.jboss.org/browse/ELY-1048 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Martin Choma > Assignee: Ilia Vassilev > > Coverity found error handling of reading stream is not sufficient. There is no check if number of actual read bytes match number of expected read bytes . > {code:java|title=KeyStoreCredentialStore.java} > private byte[] readBytes(ObjectInputStream ois) throws IOException { > int len = ois.readInt(); > byte[] data = new byte[len]; > ois.read(data, 0, len); > return data; > } > {code} > [1] https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=12563... -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 7 months

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira April 2017