[JBoss JIRA] (WFLY-7457) UT005013 causes OutOfMemoryError
by Stuart Douglas (JIRA)
[ https://issues.jboss.org/browse/WFLY-7457?page=com.atlassian.jira.plugin.... ]
Stuart Douglas commented on WFLY-7457:
--------------------------------------
Can you provide more details?
Judging by your description I think you are saying that a SSL connection that is simply dropped instead of being closed cleanly is causing out of memory errors?
If so can you provide the 'jmap -histo' output from the JVM to give details about exactly what is running out of memory?
> UT005013 causes OutOfMemoryError
> --------------------------------
>
> Key: WFLY-7457
> URL: https://issues.jboss.org/browse/WFLY-7457
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 10.1.0.Final
> Reporter: Steve Vater
> Assignee: Stuart Douglas
> Labels: new_and_noteworthy
>
> There's some F5 WAF within the network where our WildFly is running. The WAF sends multiple Keep Alive-Requests to our WAF via TCP, but without sending "close_notify" after the communication has ended.
> Undertow throws UT005013, which is correct, but this causes the JVM to run out of Memory. The keepalive is sent 12 times per minute (every 5 seconds) to our WildFly.
> We already installed an update of Undertow (1.4.3); This didn't help.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 8 months
[JBoss JIRA] (WFLY-7530) Get LegacySubsystemConfigurationUtil out of full or stop using ExtensionRegistry in it
by Brian Stansberry (JIRA)
Brian Stansberry created WFLY-7530:
--------------------------------------
Summary: Get LegacySubsystemConfigurationUtil out of full or stop using ExtensionRegistry in it
Key: WFLY-7530
URL: https://issues.jboss.org/browse/WFLY-7530
Project: WildFly
Issue Type: Task
Components: Test Suite
Reporter: Brian Stansberry
Assignee: Kabir Khan
LegacySubsystemConfigurationUtil is instantiating ExtensionRegistry. That's not a class that is available for use in full.
This use is breaking the current attempt to release core as the constructor it calls has changed in core.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 8 months
[JBoss JIRA] (WFCORE-1964) Internal ModelControllerClient should bypass access control by default
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-1964?page=com.atlassian.jira.plugi... ]
Brian Stansberry edited comment on WFCORE-1964 at 11/8/16 3:52 PM:
-------------------------------------------------------------------
The client is obtained via service injection of a ModelController and then invoking its ModelControllerClient createClient(Executor executor) method. The ModelController interface is only implemented by us so we are free to add other methods to it, e.g. a createClient variant that somehow specifies that some sort of inflow should happen when that client is used.
The default behavior should be as it was in WF 10 or earlier; calls end up with SUPERUSER-like powers.
Just an FYI: I may want to refactor the ModelController interface a bit, to separate the createClient API from the "execute" API. There are two different kinds of users for those methods and it would be better if the createClient callers didn't see the "execute" methods. The createClient stuff would then be available via a capability. The "execute" stuff is purely internal to the kernel, so no capability-based access.
was (Author: brian.stansberry):
The client is obtained via service injection of a ModelController and then invoking its ModelControllerClient createClient(Executor executor) method. The ModelController interface is only implemented by us so we are via to add other methods to it, e.g. a createClient variant that somehow specifies that some sort of inflow should happen when that client is used.
The default behavior should be as it was in WF 10 or earlier; calls end up with SUPERUSER-like powers.
Just an FYI: I may want to refactor the ModelController interface a bit, to separate the createClient API from the "execute" API. There are two different kinds of users for those methods and it would be better if the createClient callers didn't see the "execute" methods. The createClient stuff would then be available via a capability. The "execute" stuff is purely internal to the kernel, so no capability-based access.
> Internal ModelControllerClient should bypass access control by default
> ----------------------------------------------------------------------
>
> Key: WFCORE-1964
> URL: https://issues.jboss.org/browse/WFCORE-1964
> Project: WildFly Core
> Issue Type: Task
> Components: Domain Management, Security
> Reporter: Darran Lofthouse
> Assignee: Darran Lofthouse
> Priority: Blocker
> Fix For: 3.0.0.Alpha12
>
>
> This is continuing compatibility where in-vm clients can perform actions without triggering management access control.
> It would be nice also if we could find a way to make it possible to selectively disable this for cases where we want identity propagation between applications and the management tier.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 8 months