June 2019 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFCORE-4532) Investigate new JDK 13 regressions

by Richard Opalka (Jira)

[ https://issues.jboss.org/browse/WFCORE-4532?page=com.atlassian.jira.plugi... ] Richard Opalka edited comment on WFCORE-4532 at 6/19/19 11:24 AM: ------------------------------------------------------------------ These three tests mentioned above are passing on Open JDK 13 ea 24. They started to fail with latest Open JDK 13 ea 25. I was debugging TlsTestCase failures and my observation is there was a new feature introduced in JDK 13 ea 25: https://bugs.openjdk.java.net/browse/JDK-8211018 This new feature causes that some SSL sessions are not propagated to sun.security.ssl.SSLSessionContextImpl.sessionCache field. For anybody from our security team that will have a look, for easy and fast investigation you will need: * Open JDK 13 ea 24 installed * Open JDK 13 ea 25 installed Put breakpoints to methods: * sun.security.ssl.Finished.onProduceFinished() * sun.security.ssl.SSLSessionContextImpl.put(SSLSessionImpl) * org.wildfly.extension.elytron.SSLDefinitions (line 904) // performRuntime method of ACTIVE_SESSION_COUNT attribute handler Execute test in debug mode: $ cd wildfly-core/elytron $ mvn clean test -Dtest=**/TlsTestCase#testSslServiceAuth -Dmaven.surefire.debug My observation is that in method sun.security.ssl.Finished.onProduceFinished() there is a new shc.statelessResumption field check that causes SSL session not to be registered into the cache. was (Author: ropalka): These three tests mentioned above are passing on Open JDK 13 ea 24. They started to fail with latest Open JDK 13 ea 25. I was debugging TlsTestCase failures and my observation is there was a new feature introduced in JDK 13 ea 25: https://bugs.openjdk.java.net/browse/JDK-8211018 This new feature causes that some SSL sessions are not propagated to sun.security.ssl.SSLSessionContextImpl.sessionCache field. For anybody from our security team that will have a look, for easy and fast investigation you will need: * Open JDK 13 ea 24 installed * Open JDK 13 ea 25 installed Put breakpoints to methods: * sun.security.ssl.Finished.onProduceFinished() * sun.security.ssl.SSLSessionContextImpl.put(SSLSessionImpl) * org.wildfly.extension.elytron.SSLDefinitions (line 904) // performRuntime method of ACTIVE_SESSION_COUNT attribute handler Execute test in debug mode: $ cd wildfly-core/elytron $ mvn clean test -Dtest=**/TlsTestCase#testSslServiceAuth -Dmaven.surefire.debug My observation is that in method sun.security.ssl.Finished.onProduceFinished() there is a new shc.statelessResumption field check that causes SSL session not to be registered into the cache. > Investigate new JDK 13 regressions > ---------------------------------- > > Key: WFCORE-4532 > URL: https://issues.jboss.org/browse/WFCORE-4532 > Project: WildFly Core > Issue Type: Task > Components: Security > Reporter: Richard Opalka > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 9.0.2.Final > > > Latest Open JDK 13 Early Access 25 introduced three new regressions in our test suite. > Failing tests are: > wildfly-core/elytron/src/test/java/org/wildfly/extension/elytron/TlsTestCase.java > wildfly-core/testsuite/elytron/src/test/java/org/wildfly/test/integration/elytron/sasl/mgmt/KerberosHttpMgmtSaslTestCase.java > wildfly-core/testsuite/elytron/src/test/java/org/wildfly/test/integration/elytron/sasl/mgmt/KerberosNativeMgmtSaslTestCase.java > Could somebody from our security team have a look what is going on [~darran] ? -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4532) Investigate new JDK 13 regressions

by Richard Opalka (Jira)

[ https://issues.jboss.org/browse/WFCORE-4532?page=com.atlassian.jira.plugi... ] Richard Opalka commented on WFCORE-4532: ---------------------------------------- These three tests mentioned above are passing on Open JDK 13 ea 24. They started to fail with latest Open JDK 13 ea 25. I was debugging TlsTestCase failures and my observation is there was a new feature introduced in JDK 13 ea 25: https://bugs.openjdk.java.net/browse/JDK-8211018 This new feature causes that some SSL sessions are not propagated to sun.security.ssl.SSLSessionContextImpl.sessionCache field. For anybody from our security team that will have a look, for easy and fast investigation you will need: * Open JDK 13 ea 24 installed * Open JDK 13 ea 25 installed Put breakpoints to methods: * sun.security.ssl.Finished.onProduceFinished() * sun.security.ssl.SSLSessionContextImpl.put(SSLSessionImpl) * org.wildfly.extension.elytron.SSLDefinitions (line 904) // performRuntime method of ACTIVE_SESSION_COUNT attribute handler Execute test in debug mode: $ cd wildfly-core/elytron $ mvn clean test -Dtest=**/TlsTestCase#testSslServiceAuth -Dmaven.surefire.debug My observation is that in method sun.security.ssl.Finished.onProduceFinished() there is a new shc.statelessResumption field check that causes SSL session not to be registered into the cache. > Investigate new JDK 13 regressions > ---------------------------------- > > Key: WFCORE-4532 > URL: https://issues.jboss.org/browse/WFCORE-4532 > Project: WildFly Core > Issue Type: Task > Components: Security > Reporter: Richard Opalka > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 9.0.2.Final > > > Latest Open JDK 13 Early Access 25 introduced three new regressions in our test suite. > Failing tests are: > wildfly-core/elytron/src/test/java/org/wildfly/extension/elytron/TlsTestCase.java > wildfly-core/testsuite/elytron/src/test/java/org/wildfly/test/integration/elytron/sasl/mgmt/KerberosHttpMgmtSaslTestCase.java > wildfly-core/testsuite/elytron/src/test/java/org/wildfly/test/integration/elytron/sasl/mgmt/KerberosNativeMgmtSaslTestCase.java > Could somebody from our security team have a look what is going on [~darran] ? -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-12101) Integration test for EJBCLIENT-335

by Ingo Weiss (Jira)

[ https://issues.jboss.org/browse/WFLY-12101?page=com.atlassian.jira.plugin... ] Ingo Weiss updated WFLY-12101: ------------------------------ Git Pull Request: https://github.com/wildfly/wildfly/pull/12375 (was: https://github.com/wildfly/wildfly/pull/12320) > Integration test for EJBCLIENT-335 > ---------------------------------- > > Key: WFLY-12101 > URL: https://issues.jboss.org/browse/WFLY-12101 > Project: WildFly > Issue Type: Task > Reporter: Teresa Miyar Gil > Assignee: Teresa Miyar Gil > Priority: Major > -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4532) Investigate new JDK 13 regressions

by Richard Opalka (Jira)

Richard Opalka created WFCORE-4532: -------------------------------------- Summary: Investigate new JDK 13 regressions Key: WFCORE-4532 URL: https://issues.jboss.org/browse/WFCORE-4532 Project: WildFly Core Issue Type: Task Components: Security Reporter: Richard Opalka Assignee: Darran Lofthouse Fix For: 9.0.2.Final Latest Open JDK 13 Early Access 25 introduced three new regressions in our test suite. Failing tests are: wildfly-core/elytron/src/test/java/org/wildfly/extension/elytron/TlsTestCase.java wildfly-core/testsuite/elytron/src/test/java/org/wildfly/test/integration/elytron/sasl/mgmt/KerberosHttpMgmtSaslTestCase.java wildfly-core/testsuite/elytron/src/test/java/org/wildfly/test/integration/elytron/sasl/mgmt/KerberosNativeMgmtSaslTestCase.java Could somebody from our security team have a look what is going on [~darran] ? -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11956) @PostConstruct on @ApplicationScoped bean called too late in case @Valid is annotated on a business method

by Ingo Weiss (Jira)

[ https://issues.jboss.org/browse/WFLY-11956?page=com.atlassian.jira.plugin... ] Ingo Weiss updated WFLY-11956: ------------------------------ Labels: downstream_dependency (was: ) > @PostConstruct on @ApplicationScoped bean called too late in case @Valid is annotated on a business method > ---------------------------------------------------------------------------------------------------------- > > Key: WFLY-11956 > URL: https://issues.jboss.org/browse/WFLY-11956 > Project: WildFly > Issue Type: Bug > Components: Bean Validation, REST > Affects Versions: 16.0.0.Final > Reporter: Joerg Baesner > Assignee: Ronald Sigal > Priority: Major > Labels: downstream_dependency > Fix For: 17.0.0.Beta1, 17.0.0.Final > > Attachments: logging.txt, playground.zip > > > Having a bean class with {{@ApplicationScoped}}, which has a {{@PostConstruct}} and is implementing the following _Interface_: > {code} > @Path("/validated") > public interface ValidatedJaxRsInterface { > > @GET > @Valid > @Produces(MediaType.APPLICATION_JSON) > GreetingModel getHelloGreeting(); > } > {code} > will result in calling the {{getHelloGreeting}} method of the implementation class twice *_before_* the {{@PostConstruct}} is getting executed. > This can be reproduced with the attached reproducer application... -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-12115) Console shows server URL as n/a if http is disabled

by Ingo Weiss (Jira)

[ https://issues.jboss.org/browse/WFLY-12115?page=com.atlassian.jira.plugin... ] Ingo Weiss updated WFLY-12115: ------------------------------ Labels: downstream_dependency (was: ) > Console shows server URL as n/a if http is disabled > --------------------------------------------------- > > Key: WFLY-12115 > URL: https://issues.jboss.org/browse/WFLY-12115 > Project: WildFly > Issue Type: Bug > Components: Web Console > Reporter: Ivo Studensky > Assignee: Ivo Studensky > Priority: Minor > Labels: downstream_dependency > > If only https is enabled the admin console shows no server url at {{Runtime -> Hosts -> <Host name> -> <Server name>}}. > There is a filter for socket bindings with a name started with {{http}} in {{org.jboss.hal.core.runtime.server.ServerUrlTasks}} which takes the first such binding regardless it is bound (enabled) or not, see \[1\]. This then leads to n/a at line 128, see \[2\]. > \[1\] https://github.com/hal/console/blob/develop/core/src/main/java/org/jboss/... > \[2\] https://github.com/hal/console/blob/develop/core/src/main/java/org/jboss/... -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11894) Upgrade Hibernate Validator to 6.0.16.Final

by Ingo Weiss (Jira)

[ https://issues.jboss.org/browse/WFLY-11894?page=com.atlassian.jira.plugin... ] Ingo Weiss updated WFLY-11894: ------------------------------ Labels: downstream_dependency (was: ) > Upgrade Hibernate Validator to 6.0.16.Final > ------------------------------------------- > > Key: WFLY-11894 > URL: https://issues.jboss.org/browse/WFLY-11894 > Project: WildFly > Issue Type: Component Upgrade > Components: Bean Validation > Reporter: Guillaume Smet > Assignee: Guillaume Smet > Priority: Major > Labels: downstream_dependency > Fix For: 17.0.0.Alpha1, 17.0.0.Final > > > Hibernate Validator 6.0.x is faster than Hibernate Validator 5.x when validating *constrained* beans. > However, it has been reported to us that Hibernate Validator 6.0.x was significantly slower than Hibernate Validator 5.x when validating *unconstrained* beans due to a higher memory allocation rate. > This issue has been fixed in Hibernate Validator 6.0.16.Final, together with a rounding error issue. > We now also have a JMH benchmark for this particular use case. > The full changelog is here: https://hibernate.atlassian.net/issues/?jql=project%20%3D%20HV%20AND%20fi... . -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11908) Subsystem namespace versions are out of date in appclient.xml

by Ingo Weiss (Jira)

[ https://issues.jboss.org/browse/WFLY-11908?page=com.atlassian.jira.plugin... ] Ingo Weiss updated WFLY-11908: ------------------------------ Labels: downstream_dependency (was: ) > Subsystem namespace versions are out of date in appclient.xml > ------------------------------------------------------------- > > Key: WFLY-11908 > URL: https://issues.jboss.org/browse/WFLY-11908 > Project: WildFly > Issue Type: Bug > Components: Application Client > Affects Versions: 16.0.0.Final > Reporter: Deborah Steigner > Assignee: Brian Stansberry > Priority: Minor > Labels: downstream_dependency > Fix For: 17.0.0.Beta1, 17.0.0.Final > > > The default Datasources namespace version for the other configurations (standalone.xml, domain.xml) is 5, but is set to version 2 in the appclient.xml > Same problem applies to other subsystems. -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11640) NPE with wildfly-openssl using OpenSSL 1.1.1a

by Ingo Weiss (Jira)

[ https://issues.jboss.org/browse/WFLY-11640?page=com.atlassian.jira.plugin... ] Ingo Weiss updated WFLY-11640: ------------------------------ Labels: downstream_dependency (was: ) > NPE with wildfly-openssl using OpenSSL 1.1.1a > --------------------------------------------- > > Key: WFLY-11640 > URL: https://issues.jboss.org/browse/WFLY-11640 > Project: WildFly > Issue Type: Bug > Components: Web (Undertow) > Affects Versions: 15.0.1.Final > Environment: OpenSSL 1.1.1a > Reporter: Jan Stourac > Assignee: Ingo Weiss > Priority: Major > Labels: downstream_dependency > > It is impossible to use {{wildfly-openssl}} binding with OpenSSL 1.1.1a (RHEL8 uses 1.1.1 at the moment but there seems to be same issue). There is an NPE during the ciphersuites initialization: > {code} > 9:10:58,330 WARNING [org.wildfly.openssl.OpenSSLContextSPI] (MSC service thread 1-3) WFOPENSSL0014 Failed to initialize ciphers: java.lang.NullPointerException > at org.wildfly.openssl.CipherSuiteConverter.toJava(CipherSuiteConverter.java:284) > at org.wildfly.openssl.OpenSSLContextSPI.getAvailableCipherSuites(OpenSSLContextSPI.java:109) > at org.wildfly.openssl.OpenSSLEngine.getSupportedCipherSuites(OpenSSLEngine.java:711) > at org.wildfly.openssl.OpenSSLSocket.getSupportedCipherSuites(OpenSSLSocket.java:163) > at javax.net.ssl.SSLContextSpi.engineGetSupportedSSLParameters(SSLContextSpi.java:194) > at javax.net.ssl.SSLContext.getSupportedSSLParameters(SSLContext.java:436) > at org.jboss.as.domain.management.security.SSLContextService.wrapSslContext(SSLContextService.java:116) > at org.jboss.as.domain.management.security.SSLContextService.start(SSLContextService.java:102) > at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1738) > at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1700) > at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1558) > at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) > at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985) > at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487) > at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378) > at java.lang.Thread.run(Thread.java:748) > {code} > and then there is NPE during the request itself: > {code} > 19:12:18,417 ERROR [org.xnio.listener] (default I/O-2) XNIO001007: A channel event listener threw an exception: java.lang.NullPointerException > at org.wildfly.openssl.CipherSuiteConverter.toJava(CipherSuiteConverter.java:284) > at org.wildfly.openssl.OpenSSLEngine.toJavaCipherSuite(OpenSSLEngine.java:1094) > at org.wildfly.openssl.OpenSSLEngine.getEnabledCipherSuites(OpenSSLEngine.java:729) > at org.wildfly.openssl.OpenSSLContextSPI.getCiphers(OpenSSLContextSPI.java:339) > at org.wildfly.openssl.OpenSSLEngine.getEnabledCipherSuites(OpenSSLEngine.java:720) > at io.undertow.server.protocol.http.AlpnOpenListener.engineSupportsHTTP2(AlpnOpenListener.java:324) > at io.undertow.server.protocol.http.AlpnOpenListener$1.apply(AlpnOpenListener.java:239) > at io.undertow.server.protocol.http.AlpnOpenListener$1.apply(AlpnOpenListener.java:235) > at io.undertow.server.protocol.http.AlpnOpenListener$SSLConduitUpdater.apply(AlpnOpenListener.java:430) > at io.undertow.server.protocol.http.AlpnOpenListener$SSLConduitUpdater.apply(AlpnOpenListener.java:419) > at io.undertow.protocols.alpn.DefaultAlpnEngineManager.registerEngine(DefaultAlpnEngineManager.java:31) > at io.undertow.protocols.alpn.ALPNManager.registerEngineCallback(ALPNManager.java:80) > at io.undertow.server.protocol.http.AlpnOpenListener.handleEvent(AlpnOpenListener.java:235) > at io.undertow.server.protocol.http.AlpnOpenListener.handleEvent(AlpnOpenListener.java:64) > at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92) > at org.xnio.ChannelListeners$10.handleEvent(ChannelListeners.java:291) > at org.xnio.ChannelListeners$10.handleEvent(ChannelListeners.java:286) > at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92) > at org.xnio.ChannelListeners$DelegatingChannelListener.handleEvent(ChannelListeners.java:1092) > at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92) > at org.xnio.nio.QueuedNioTcpServer$1.run(QueuedNioTcpServer.java:131) > at org.xnio.nio.WorkerThread.safeRun(WorkerThread.java:612) > at org.xnio.nio.WorkerThread.run(WorkerThread.java:479) > {code} > Looking briefly into it, the cipher that is trying to be used is *{{TLS_AES_256_GCM_SHA384}}*. It is interesting that this cipher has underscores '_' in its name instead of hyphens '-' as most of the openssl ciphers have. Looks like these were added in the sake of TLSv1.3, [see here|https://github.com/openssl/openssl/commit/fa25763b5528b56b448d64bfba...]. -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-629) Enabled automatic encryption of passwords stored in configuration

by Farah Juma (Jira)

[ https://issues.jboss.org/browse/WFCORE-629?page=com.atlassian.jira.plugin... ] Farah Juma commented on WFCORE-629: ----------------------------------- I'm going to close this issue as it's a duplicate of WFCORE-4150. > Enabled automatic encryption of passwords stored in configuration > ----------------------------------------------------------------- > > Key: WFCORE-629 > URL: https://issues.jboss.org/browse/WFCORE-629 > Project: WildFly Core > Issue Type: Feature Request > Components: Management, Security > Environment: Wildfly 9 > Reporter: Jason Shepherd > Assignee: Darran Lofthouse > Priority: Major > Fix For: 10.0.0.Beta1 > > > Currently encrypting passwords such as Datasource passwords can only be done 'after the fact'. You have to create the datasource first, then retrospectively store the password in the vault and dereference it in the configuration. > It would be great if could turn on automatic storage of passwords in the vault so that when you create a Datasource password, or add a resource adapter which specifies a remote resource password, those passwords were automatically added to the vault, and deferenced in the configuration file. -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira June 2019