[JBoss JIRA] (SECURITY-759) JASPIServerAuthenticationManager.isValid method should log configuration problems at WARN or ERROR level
by RH Bugzilla Integration (JIRA)
[ https://issues.jboss.org/browse/SECURITY-759?page=com.atlassian.jira.plug... ]
RH Bugzilla Integration commented on SECURITY-759:
--------------------------------------------------
Paul Gier <pgier(a)redhat.com> changed the Status of [bug 901074|https://bugzilla.redhat.com/show_bug.cgi?id=901074] from MODIFIED to ON_QA
> JASPIServerAuthenticationManager.isValid method should log configuration problems at WARN or ERROR level
> --------------------------------------------------------------------------------------------------------
>
> Key: SECURITY-759
> URL: https://issues.jboss.org/browse/SECURITY-759
> Project: PicketBox
> Issue Type: Enhancement
> Security Level: Public(Everyone can see)
> Components: JBossSX
> Affects Versions: PicketBox_4_0_20.Beta1
> Reporter: Stefan Guilhen
> Assignee: Stefan Guilhen
> Fix For: 2.0.3.Beta2
>
>
> As reported by Josef Cacek:
> All fatal exception are swallowed in JASPIServerAuthenticationManager.isValid() method.
> {code}
> // PicketBox 4.0.9 used in EAP 6.0.0 - TRACE level
> catch(AuthException ae)
> {
> if(trace)
> log.trace("AuthException:",ae);
> }
> // PicketBox 4.0.14 - DEBUG level
> catch(AuthException ae)
> {
> PicketBoxLogger.LOGGER.debugIgnoredException(ae);
> }
> {code}
> It includes configuration errors, which should absolutely be visible on ERROR log level or another relevant level.
> We need to make sure to use ERROR log if the user-defined module cannot be found for instance.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 7 months
[JBoss JIRA] (SECURITY-751) Misleading stacktrace on server startup with malformed security-domain
by RH Bugzilla Integration (JIRA)
[ https://issues.jboss.org/browse/SECURITY-751?page=com.atlassian.jira.plug... ]
RH Bugzilla Integration commented on SECURITY-751:
--------------------------------------------------
Paul Gier <pgier(a)redhat.com> changed the Status of [bug 979117|https://bugzilla.redhat.com/show_bug.cgi?id=979117] from MODIFIED to ON_QA
> Misleading stacktrace on server startup with malformed security-domain
> ----------------------------------------------------------------------
>
> Key: SECURITY-751
> URL: https://issues.jboss.org/browse/SECURITY-751
> Project: PicketBox
> Issue Type: Enhancement
> Security Level: Public(Everyone can see)
> Components: PicketBox
> Reporter: Stefan Guilhen
> Assignee: Stefan Guilhen
> Fix For: PicketBox_4_0_19.Final
>
>
> Description of problem:
> Misleading stack trace upon server startup. Occurs when adding a <security-domain> with a malformed <jsse> element.
> Version-Release number of selected component (if applicable):
> Picketbox version: 4.0.17.Final-redhat-1
> How reproducible:
> Always
> Steps to Reproduce:
> 1. Start the server in standalone mode.
> ./standalone.sh
> 2. Run the following jboss-cli.sh commands:
> /subsystem=security/security-domain=test:add()
> /subsystem=security/security-domain=test1/jsse=classic:add(keystore={password=123456})
> :reload
> 3. See the stacktrace:
> 11:49:45,138 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-5) MSC000001: Failed to start service jboss.security.security-domain.test: org.jboss.msc.service.StartException in service jboss.security.security-domain.test: JBAS013308: Unable to start the SecurityDomainService service
> at org.jboss.as.security.service.SecurityDomainService.start(SecurityDomainService.java:107)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1811) [jboss-msc-1.0.4.GA-redhat-1.jar:1.0.4.GA-redhat-1]
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1746) [jboss-msc-1.0.4.GA-redhat-1.jar:1.0.4.GA-redhat-1]
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_25]
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_25]
> at java.lang.Thread.run(Thread.java:724) [rt.jar:1.7.0_25]
> Caused by: java.lang.RuntimeException: PBOX000117: Invalid KeyStore type: JKS
> at org.jboss.security.JBossJSSESecurityDomain.loadKeyAndTrustStore(JBossJSSESecurityDomain.java:469)
> at org.jboss.security.JBossJSSESecurityDomain.reloadKeyAndTrustStore(JBossJSSESecurityDomain.java:335)
> at org.jboss.as.security.service.SecurityDomainService.start(SecurityDomainService.java:104)
> ... 5 more
> Actual results:
> Stacktrace says that the keystore type "JKS" is not supported. This is the default keystore type, so this is not true.
> Expected results:
> I believe that the stacktrace should report that the keystore-url attribute is missing, since adding only that attribute causes the stacktrace to disappear.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 7 months
[JBoss JIRA] (JGRP-1742) BARRIER: minimize closing time
by Bela Ban (JIRA)
[ https://issues.jboss.org/browse/JGRP-1742?page=com.atlassian.jira.plugin.... ]
Bela Ban edited comment on JGRP-1742 at 12/4/13 9:26 AM:
---------------------------------------------------------
OK, so the following things might solve this puzzle:
h5. Coordinator blocked during fetching of digest
* Since BARRIER is closed during a state transfer, the coordinator will not only drop messages from other members (except from members for which holes were punched into BARRIER), but also *from itself*
* Currently, the only message that causes problems when dropped is a VIEW change multicast
* SOLUTION: when multicasting a view V, *have the coord install V locally before multicasting it*. When receiving V, it will get dropped as it is already installed
h5. BARRIER skips threads in BLOCKED or WAITING state
* Don't skip these, as a blocked thread might simply block on a lock, before changing state (e.g. Infinispan)
* If message P:10 was blocked, and we skipped it when fetching the digest, we'd include P:10 in the digest, but not in the state. This would mean that the state requester will never get P:10, neither as part of the state, nor as a retransmission from P
h5. Flushing of threads in BARRIER should time out
* We cannot wait forever for the threads to time out
* The timeout passed to {{getState(timeout)}} should be used to bound the max duration for flushing the threads. If we run into a timeout, either at the state requester or the provider, state transfer (the {{getState()}}) call will fail
* A timeout of 0 means wait forever
* Closing the channel should terminate the flush
h5. Things not tackled
* While flushing of threads might succeed in BARRIER, if the application has its own thread pool (e.g. using the _Asynchronous Invocation API_) to handle requests, then flushing will return quickly
* However, this is not a guarantee that all incoming threads have completed their changes to the application state
* A possible solution might be to call the {{block()}} and {{unblock()}} callbacks in the application. The former would have to wait until all current threads are done modifying the application state. The latter would be called when the digest has been fetched and the application pool can continue making modifications.
** Not very nice, but state transfer should not be used for very large states (taking a long time) anyway
** This will not be addressed by this JIRA. Perhaps it will be tackled in a later release.
was (Author: belaban):
OK, so the following things might solve this puzzle:
h5. Coordinator blocked during fetching of digest
* Since BARRIER is closed during a state transfer, the coordinator will not only drop messages from other members (except from members for which holes were punched into BARRIER), but also *from itself*
* Currently, the only message that causes problems when dropped is a VIEW change multicast
* SOLUTION: when multicasting a view V, *have the coord install V locally before multicasting it*. When receiving V, it will get dropped as it is already installed
h5. BARRIER skips threads in BLOCKED or WAITING state
* Don't skip these, as a blocked thread might simply block on a lock, before changing state (e.g. Infinispan)
* If message P:10 was blocked, and we skipped it when fetching the digest, we'd include P:10 in the digest, but not in the state. This would mean that the state requester will never get P:10, neither as part of the state, nor as a retransmission from P
h5. Flushing of threads in BARRIER should time out
* We cannot wait forever for the threads to time out
* The timeout passed to {{getState(timeout)}} should be used to bound the max duration for flushing the threads
* A timeout of 0 means wait forever
* Closing the channel should terminate the flush
> BARRIER: minimize closing time
> ------------------------------
>
> Key: JGRP-1742
> URL: https://issues.jboss.org/browse/JGRP-1742
> Project: JGroups
> Issue Type: Enhancement
> Reporter: Bela Ban
> Assignee: Bela Ban
> Fix For: 3.5
>
>
> During a state transfer, BARRIER.up() waits until all incoming threads (delivering messages to the application) are done, and blocks further incoming messages. This is done to get the digest and the state.
> However, duing the block, the following messages are not sent up:
> * Views !
> * STABLE messages, triggering retransmissions
> This is bad, so we should try to minimize the time BARRIER is closed. This can be done with JGRP-1352.
> However, we could also do the following:
> * A state request is received
> * Close BARRIER and flush all pending threads. This ensures that any message which updated the *digest* also updated the *application state*
> * Get the digest D
> * *Open* BARRIER. Messages will now be delivered and thus applied to the state
> * Get the application state S
> * When done, return D and S to the state requester
> The difference to JGRP-1352 is that we don't queue messages during state transfer. How does this work ? It is critical to ensure that all mesages which updated the digest D also updated the state S, or else messages present in D but not in S would not be retransmitted. However, if there are more messages in S than in D, this is not an issue as they will be retransmitted again.
> Example:
> * BARRIER is closed and pending threads are flushed
> * Digest D is (only for a given member P) 5, state S is 5 as well
> * Now we open BARRIER
> * P sends a few more messages (6, 7 and 8)
> * The digest is now 8, but the copy we have is still 5
> * State S is 8
> * We return D=5 and S=8
> * The state requester closes BARRIER and sets its digest to 5 and its state to 8
> * Since the digest is only 5 for P, the state requester asks P for retransmission of messages 6, 7 and 8
> * Messages 6, 7 and 8 from P are received and applied to the state
> * The assumption here is that if messages 6, 7 and 8 are applied twice, the state doesn't change (idempotency). This should be the case with Infinispan.
> The advantage of this issue over JGRP-1352 is that we don't need to queue messages for a long time if the state is large.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 7 months
[JBoss JIRA] (WFLY-164) java.io.IOException Channel closed exception after several reload of server
by RH Bugzilla Integration (JIRA)
[ https://issues.jboss.org/browse/WFLY-164?page=com.atlassian.jira.plugin.s... ]
RH Bugzilla Integration commented on WFLY-164:
----------------------------------------------
Paul Gier <pgier(a)redhat.com> changed the Status of [bug 1006246|https://bugzilla.redhat.com/show_bug.cgi?id=1006246] from MODIFIED to ON_QA
> java.io.IOException Channel closed exception after several reload of server
> ---------------------------------------------------------------------------
>
> Key: WFLY-164
> URL: https://issues.jboss.org/browse/WFLY-164
> Project: WildFly
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Components: Domain Management
> Reporter: Ondřej Chaloupka
> Assignee: Emanuel Muckenhuber
> Fix For: 8.0.0.Alpha1
>
>
> Small testing program:
> https://github.com/ochaloup/jboss-dmr-test/blob/master/src/main/java/ocha...
> When I run it first time then everything is fine and reload is done and info from server is shown.
> When I left the server run and execute my program several more times (3 or more) then it's starting to crash with exception
> {code}
> java.lang.reflect.InvocationTargetException
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> at java.lang.reflect.Method.invoke(Method.java:597)
> at org.codehaus.mojo.exec.ExecJavaMojo$1.run(ExecJavaMojo.java:297)
> at java.lang.Thread.run(Thread.java:662)
> Caused by: java.io.IOException: java.util.concurrent.ExecutionException: Operation failed
> at org.jboss.as.controller.client.impl.AbstractModelControllerClient.executeForResult(AbstractModelControllerClient.java:129)
> at org.jboss.as.controller.client.impl.AbstractModelControllerClient.execute(AbstractModelControllerClient.java:71)
> at ochaloup.ClientReload.main(ClientReload.java:19)
> ... 6 more
> Caused by: java.util.concurrent.ExecutionException: Operation failed
> at org.jboss.threads.AsyncFutureTask.operationFailed(AsyncFutureTask.java:74)
> at org.jboss.threads.AsyncFutureTask.get(AsyncFutureTask.java:268)
> at org.jboss.as.controller.client.impl.AbstractDelegatingAsyncFuture.get(AbstractDelegatingAsyncFuture.java:100)
> at org.jboss.as.controller.client.impl.AbstractModelControllerClient.executeForResult(AbstractModelControllerClient.java:127)
> ... 8 more
> Caused by: java.io.IOException: Channel closed
> at org.jboss.as.protocol.mgmt.AbstractMessageHandler.handleChannelClosed(AbstractMessageHandler.java:354)
> at org.jboss.as.controller.client.impl.RemotingModelControllerClient$2.handleClose(RemotingModelControllerClient.java:135)
> at org.jboss.as.controller.client.impl.RemotingModelControllerClient$2.handleClose(RemotingModelControllerClient.java:132)
> at org.jboss.as.protocol.mgmt.ManagementClientChannelStrategy$Establishing$3.handleClose(ManagementClientChannelStrategy.java:189)
> at org.jboss.as.protocol.mgmt.ManagementClientChannelStrategy$Establishing$3.handleClose(ManagementClientChannelStrategy.java:180)
> at org.jboss.remoting3.spi.SpiUtils.safeHandleClose(SpiUtils.java:54)
> at org.jboss.remoting3.spi.AbstractHandleableCloseable$CloseHandlerTask.run(AbstractHandleableCloseable.java:501)
> at org.jboss.remoting3.spi.AbstractHandleableCloseable.runCloseTask(AbstractHandleableCloseable.java:406)
> at org.jboss.remoting3.spi.AbstractHandleableCloseable.closeComplete(AbstractHandleableCloseable.java:277)
> at org.jboss.remoting3.remote.RemoteConnectionChannel.closeAction(RemoteConnectionChannel.java:517)
> at org.jboss.remoting3.spi.AbstractHandleableCloseable.closeAsync(AbstractHandleableCloseable.java:359)
> at org.jboss.remoting3.remote.RemoteConnectionHandler.closeAllChannels(RemoteConnectionHandler.java:382)
> at org.jboss.remoting3.remote.RemoteConnectionHandler.handleConnectionClose(RemoteConnectionHandler.java:103)
> at org.jboss.remoting3.remote.RemoteReadListener.handleEvent(RemoteReadListener.java:78)
> at org.jboss.remoting3.remote.RemoteReadListener.handleEvent(RemoteReadListener.java:45)
> at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
> at org.xnio.channels.TranslatingSuspendableChannel.handleReadable(TranslatingSuspendableChannel.java:189)
> at org.xnio.channels.TranslatingSuspendableChannel$1.handleEvent(TranslatingSuspendableChannel.java:103)
> at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
> at org.xnio.channels.TranslatingSuspendableChannel.handleReadable(TranslatingSuspendableChannel.java:189)
> at org.xnio.ssl.JsseConnectedSslStreamChannel.handleReadable(JsseConnectedSslStreamChannel.java:180)
> at org.xnio.channels.TranslatingSuspendableChannel$1.handleEvent(TranslatingSuspendableChannel.java:103)
> at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
> at org.xnio.nio.NioHandle.run(NioHandle.java:90)
> at org.xnio.nio.WorkerThread.run(WorkerThread.java:184)
> {code}
> Maybe this could be connected with AS7 testsuite problem:
> https://issues.jboss.org/browse/AS7-4185
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 7 months