[JBoss JIRA] (WFCORE-2292) HTTPS / Native Management protocol mismatch when using SSL
by Ken Wills (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2292?page=com.atlassian.jira.plugi... ]
Ken Wills resolved WFCORE-2292.
-------------------------------
Resolution: Duplicate Issue
> HTTPS / Native Management protocol mismatch when using SSL
> ----------------------------------------------------------
>
> Key: WFCORE-2292
> URL: https://issues.jboss.org/browse/WFCORE-2292
> Project: WildFly Core
> Issue Type: Bug
> Components: Server
> Reporter: Ken Wills
> Assignee: Ken Wills
>
> It looks like https://github.com/wildfly/wildfly-core/commit/77158040d82d74af33800fce88... may have introduced some soft or mismatch when trying to connect using SSL / TLS, the requested buffer size is quite large.
> 1:30:58,377 TRACE [org.xnio.nio.selector] (management Accept) Beginning select on sun.nio.ch.EPollSelectorImpl@2ab25536
> 11:30:58,377 TRACE [org.xnio.listener] (management I/O-1) Invoking listener org.jboss.remoting3.remote.ServerConnectionOpenListener$Initial@aca44ee on channel org.xnio.conduits.ConduitStreamSourceChannel@787e0a1f
> 11:30:58,377 TRACE [org.jboss.remoting.remote.connection] (management I/O-1) Not enough buffered bytes for message of size 369296128+4 (java.nio.DirectByteBuffer[pos=0 lim=135 cap=8192])
> ^^^^^^^
> 11:30:58,377 TRACE [org.jboss.remoting.remote.connection] (management I/O-1) Compacted existing buffer java.nio.DirectByteBuffer[pos=135 lim=8192 cap=8192]
> 11:30:58,377 TRACE [org.jboss.remoting.remote.connection] (management I/O-1) Received EOF
> 11:30:58,377 TRACE [org.jboss.remoting.remote] (management I/O-1) Received connection end-of-stream
> 11:30:58,377 TRACE [org.xnio.nio.selector] (management I/O-1) Beginning select on sun.nio.ch.EPollSelectorImpl@1cc4241b
> This was with native management, but I see the same thing using https. The client is jboss-cli.sh, connecting with:
> ./bin/jboss-cli.sh -c --controller=127.0.0.1:9999 --user=admin --password=password
> Relevant bits of config in use:
> {quote}
> <management>
> <security-realms>
> <security-realm name="sslSecurityRealm">
> <server-identities>
> <ssl>
> <keystore path="/home/kwills/ssl/configuration/server.keystore" alias="server" keystore-password="asdasd"/>
> </ssl>
> </server-identities>
> <authentication>
> <properties path="/home/kwills/ssl/configuration/users.properties" plain-text="true"/>
> </authentication>
> </security-realm>
> </security-realms>
> <management-interfaces>
> <native-interface security-realm="sslSecurityRealm">
> <socket-binding native="native"/>
> </native-interface>
> </management-interfaces>
> </management>
> <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
> <socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
> <socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
> <socket-binding name="native" interface="management" port="${jboss.management.https.port:9999}"/>
> </socket-binding-group>
> {quote}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 1 month
[JBoss JIRA] (WFCORE-2342) CLI can't connect to DC on native port without defined remote protocol
by Ken Wills (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2342?page=com.atlassian.jira.plugi... ]
Ken Wills moved JBEAP-9197 to WFCORE-2342:
------------------------------------------
Project: WildFly Core (was: JBoss Enterprise Application Platform)
Key: WFCORE-2342 (was: JBEAP-9197)
Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1)
Component/s: CLI
Remoting
Security
(was: CLI)
(was: Remoting)
(was: Security)
Affects Version/s: (was: 7.1.0.DR12)
Affects Testing: (was: Regression)
> CLI can't connect to DC on native port without defined remote protocol
> ----------------------------------------------------------------------
>
> Key: WFCORE-2342
> URL: https://issues.jboss.org/browse/WFCORE-2342
> Project: WildFly Core
> Issue Type: Bug
> Components: CLI, Remoting, Security
> Reporter: Ken Wills
> Assignee: Ken Wills
> Priority: Blocker
> Labels: cli, regression, remoting, ssl
>
> CLI is able to connect to DC to native port (9999) only when protocol _remote_ is specified. It is regression, EAP 7.0.0.GA is able to connect when no protocol is defined or with _remoting_ and _remote_ (maybe some others).
> EAP 7.0.0.GA
> {noformat}
> msimka@msimka-t450:/tmp/GA/jboss-eap-7.0$ ./bin/jboss-cli.sh -c --controller=127.0.0.1:9999
> [domain@127.0.0.1:9999 /] quit
> msimka@msimka-t450:/tmp/GA/jboss-eap-7.0$ ./bin/jboss-cli.sh -c --controller=remoting://127.0.0.1:9999
> [domain@127.0.0.1:9999 /] quit
> msimka@msimka-t450:/tmp/GA/jboss-eap-7.0$ ./bin/jboss-cli.sh -c --controller=remote://127.0.0.1:9999
> [domain@127.0.0.1:9999 /] quit
> {noformat}
> EAP 7.1.0.DR12
> {noformat}
> msimka@msimka-t450:/tmp/jboss-eap-7.1$ ./bin/jboss-cli.sh -c --controller=127.0.0.1:9999
> Failed to connect to the controller: Unable to negotiate SSL connection with controller at 127.0.0.1:9999
> msimka@msimka-t450:/tmp/jboss-eap-7.1$ ./bin/jboss-cli.sh -c --controller=remoting://127.0.0.1:9999
> Failed to connect to the controller: Unable to negotiate SSL connection with controller at 127.0.0.1:9999
> msimka@msimka-t450:/tmp/jboss-eap-7.1$ ./bin/jboss-cli.sh -c --controller=remote://127.0.0.1:9999
> [domain@127.0.0.1:9999 /] quit
> {noformat}
> Stacktrace from attached jboss-cli.log
> {noformat}
> 15:46:26,184 TRACE [org.jboss.remoting.remote.connection] Connection error detail: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
> at sun.security.ssl.EngineInputRecord.bytesInCompletePacket(EngineInputRecord.java:156)
> at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:868)
> at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
> at org.xnio.ssl.JsseStreamConduit.performIO(JsseStreamConduit.java:1364)
> at org.xnio.ssl.JsseStreamConduit.read(JsseStreamConduit.java:991)
> at org.xnio.conduits.ConduitStreamSourceChannel.read(ConduitStreamSourceChannel.java:123)
> at org.jboss.remoting3.remote.MessageReader.getMessage(MessageReader.java:131)
> at org.jboss.remoting3.remote.ClientConnectionOpenListener$Greeting.handleEvent(ClientConnectionOpenListener.java:165)
> at org.jboss.remoting3.remote.ClientConnectionOpenListener$Greeting.handleEvent(ClientConnectionOpenListener.java:160)
> at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
> at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
> at org.xnio.ssl.JsseStreamConduit.run(JsseStreamConduit.java:446)
> at org.xnio.nio.WorkerThread.safeRun(WorkerThread.java:588)
> at org.xnio.nio.WorkerThread.run(WorkerThread.java:468)
> {noformat}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 1 month