[JBoss JIRA] Created: (MODCLUSTER-211) SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
by Jim Tyrrell (JIRA)
SE Linux in RHEL 6 does not support mod_cluster in the context of HTTPD
-----------------------------------------------------------------------
Key: MODCLUSTER-211
URL: https://issues.jboss.org/browse/MODCLUSTER-211
Project: mod_cluster
Issue Type: Feature Request
Affects Versions: 1.0.4.GA
Environment: Apache 2.2.15 in RHEL 6 with mod_cluster in EAP
Reporter: Jim Tyrrell
Assignee: Jean-Frederic Clere
When trying to run mod_cluster module inside of Apache I need to create a custom SE Linux policy. This should not need to be done as RHEL should ship the correctly enabled SE Linux policy, although in talking with my resident RHEL expert, the error messaging is that mod_cluster is using write instead of append as the existing policy does. I will cross post this in BZ for the SE Linux team, as I am not sure where changes need to be made, I will update this ticket with that ticket number.
The create SE Linux TE file looks like this:
module jbosshttpd 1.0;
require {
type httpd_log_t;
type httpd_t;
type port_t;
type soundd_port_t;
class tcp_socket name_bind;
class file write;
class dir remove_name;
class udp_socket name_bind;
}
#============= httpd_t ==============
allow httpd_t httpd_log_t:dir remove_name;
allow httpd_t httpd_log_t:file write;
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow httpd_t port_t:udp_socket name_bind;
allow httpd_t soundd_port_t:tcp_socket name_bind;
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 8 months
[JBoss JIRA] (MODCLUSTER-285) get_path_param in mod_proxy_cluster doesn't expect '; ' as separator
by Stefano Nichele (JIRA)
Stefano Nichele created MODCLUSTER-285:
------------------------------------------
Summary: get_path_param in mod_proxy_cluster doesn't expect ';' as separator
Key: MODCLUSTER-285
URL: https://issues.jboss.org/browse/MODCLUSTER-285
Project: mod_cluster
Issue Type: Bug
Affects Versions: 1.2.0.Final, 1.1.3.Final
Reporter: Stefano Nichele
Assignee: Jean-Frederic Clere
Current version of get_path_param doesn't expect ';' as path parameters separator so this urls are not correctly handled:
/test.jsp;jsessionid=123123.NODE01;name=vale
See for instance the mod_proxy_balancer implementation (in httpd 2.2.21):
/* Retrieve the parameter with the given name
* Something like 'JSESSIONID=12345...N'
*/
static char *get_path_param(apr_pool_t *pool, char *url,
const char *name, int scolon_sep)
{
char *path = NULL;
char *pathdelims = "?&";
if (scolon_sep) {
pathdelims = ";?&";
}
for (path = strstr(url, name); path; path = strstr(path + 1, name)) {
path += strlen(name);
if (*path == '=') {
/*
* Session path was found, get it's value
*/
++path;
if (strlen(path)) {
char *q;
path = apr_strtok(apr_pstrdup(pool, path), pathdelims, &q);
return path;
}
}
}
return NULL;
}
Severity of this bug to me is not so high since using more than one path parameters is not so common.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 8 months
[JBoss JIRA] (MODCLUSTER-284) remove_session_route doesn't work as expected with session id in the URL
by Stefano Nichele (JIRA)
Stefano Nichele created MODCLUSTER-284:
------------------------------------------
Summary: remove_session_route doesn't work as expected with session id in the URL
Key: MODCLUSTER-284
URL: https://issues.jboss.org/browse/MODCLUSTER-284
Project: mod_cluster
Issue Type: Bug
Affects Versions: 1.2.0.Final, 1.1.3.Final
Reporter: Stefano Nichele
Assignee: Jean-Frederic Clere
Looking at the code of remove_session_route (and trying it) i saw that URLs lke this one
/test.jsp;jsessionid=1233454532432342.NODE01
/test.jsp;jsessionid=1233454532432342.NODE01?p1=v1&p2=v2
/test.jsp;jsessionid=1233454532432342.NODE01;otherparam=value
are not correctly parsed and the session id is not removed.
To note that it seems the code handles jsessionid as url parameter and not as URL "path parameter" (see for isntance http://doriantaylor.com/policy/http-url-path-parameter-syntax).
This is for instance a piece of tomcat code that does something like what remove_session_route should do (at least in the URL part):
/**
* Strips a servlet session ID from <tt>url</tt>. The session ID
* is encoded as a URL "path parameter" beginning with "jsessionid=".
* We thus remove anything we find between ";jsessionid=" (inclusive)
* and either EOS or a subsequent ';' (exclusive).
*
* taken from org.apache.taglibs.standard.tag.common.core.ImportSupport
*/
public static String stripSession(String url) {
StringBuffer u = new StringBuffer(url);
int sessionStart;
while ((sessionStart = u.toString().indexOf(";jsessionid=")) != -1) {
int sessionEnd = u.toString().indexOf(";", sessionStart + 1);
if (sessionEnd == -1)
sessionEnd = u.toString().indexOf("?", sessionStart + 1);
if (sessionEnd == -1) // still
sessionEnd = u.length();
u.delete(sessionStart, sessionEnd);
}
return u.toString();
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 8 months
[JBoss JIRA] (MODCLUSTER-290) mod_cluster's mod_advertise can not start on IPv6-only box
by Michal Babacek (JIRA)
Michal Babacek created MODCLUSTER-290:
-----------------------------------------
Summary: mod_cluster's mod_advertise can not start on IPv6-only box
Key: MODCLUSTER-290
URL: https://issues.jboss.org/browse/MODCLUSTER-290
Project: mod_cluster
Issue Type: Bug
Affects Versions: 1.2.0.Final
Environment: Pure IPv6, Apache/2.2.21 (Unix), mod_cluster/1.2.0.Final, Fedora 15
Reporter: Michal Babacek
Assignee: Michal Babacek
Priority: Blocker
Fix For: 1.2.1.Beta1
With the following network configuration on Fedora 15:
{noformat}
lo Link encap:Local Loopback
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
+++
eth0 Link encap:Ethernet HWaddr 08:00:27:2F:DD:4A
inet6 addr: fe80::a00:27ff:fe2f::dd4a/64 Scope:Link
inet6 addr: 1:0:0:1::11/128 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
+++
{noformat}
and this *Apache/2.2.21* (Unix) *mod_cluster/1.2.0.Final* config:
{code:title=httpd.conf|borderStyle=solid|borderColor=#ccc| titleBGColor=#F7D6C1}
+++
Listen [1:0:0:1::11]:8000
+++
<IfModule manager_module>
Listen [1:0:0:1::11]:6666
ManagerBalancerName mycluster
<VirtualHost [1:0:0:1::11]:6666>
<Location />
Order deny,allow
Deny from all
Allow from all
</Location>
KeepAliveTimeout 300
MaxKeepAliveRequests 0
ServerAdvertise on http://[1:0:0:1::11]:6666
AdvertiseFrequency 5
AdvertiseGroup [ff01::1]:23364
EnableMCPMReceive
<Location /mcm>
SetHandler mod_cluster-manager
Order deny,allow
Deny from all
Allow from all
</Location>
</VirtualHost>
</IfModule>
{code}
I get the undermentioned error:
{code:title=httpd/logs/error_log|borderStyle=solid|borderColor=#ccc| titleBGColor=#F7D6C1}
[Mon Mar 05 13:47:26 2012] [notice] Digest: generating secret for digest authentication ...
[Mon Mar 05 13:47:26 2012] [notice] Digest: done
[Mon Mar 05 13:47:27 2012] [error] (EAI 9)Address family for hostname not supported: mod_advertise: ma_group_join apr_sockaddr_info_get(ff01::1:23364) failed
[Mon Mar 05 13:47:27 2012] [error] (EAI 9)Address family for hostname not supported: mod_advertise: multicast join failed for ff01::1:23364.
[Mon Mar 05 13:47:27 2012] [notice] Advertise initialized for process 2157
[Mon Mar 05 13:47:27 2012] [notice] Apache/2.2.21 (Unix) mod_cluster/1.2.0.Final DAV/2 mod_jk/1.2.30 configured -- resuming normal operations
{code}
, Apache carries on and http://[1:0:0:1::11]:8000/ displays "It works!".
What should one do in order to enable IPv6 in *apr* (apr_sockaddr_info_get) ?
Do you see any configuration errors? Please, share your ideas and tips...
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 8 months
[JBoss JIRA] (MODCLUSTER-289) MemManagerFile creates directory but put files in ..
by Jean-Frederic Clere (JIRA)
Jean-Frederic Clere created MODCLUSTER-289:
----------------------------------------------
Summary: MemManagerFile creates directory but put files in ..
Key: MODCLUSTER-289
URL: https://issues.jboss.org/browse/MODCLUSTER-289
Project: mod_cluster
Issue Type: Bug
Reporter: Jean-Frederic Clere
Assignee: Jean-Frederic Clere
Fix For: 1.2.1.Beta1
MemManagerFile /var/cache/httpd/FILES
[root@neo4 jfclere]# ls -lt /var/cache/httpd/
total 28
-rw-r--r--. 1 root root 4 Mar 2 17:05 FILES.domain.domain
-rw-r--r--. 1 root root 4 Mar 2 17:05 FILES.balancer.balancers
-rw-r--r--. 1 root root 0 Mar 2 17:05 FILES.balancer.balancers.lock
-rw-r--r--. 1 root root 0 Mar 2 17:05 FILES.domain.domain.lock
-rw-r--r--. 1 root root 4 Mar 2 17:05 FILES.sessionid.sessionid
-rw-r--r--. 1 root root 0 Mar 2 17:05 FILES.sessionid.sessionid.lock
-rw-r--r--. 1 root root 4 Mar 2 17:05 FILES.context.contexts
-rw-r--r--. 1 root root 0 Mar 2 17:05 FILES.context.contexts.lock
-rw-r--r--. 1 root root 4 Mar 2 17:05 FILES.host.hosts
-rw-r--r--. 1 root root 0 Mar 2 17:05 FILES.host.hosts.lock
-rw-r--r--. 1 root root 4 Mar 2 17:05 FILES.node.nodes
-rw-r--r--. 1 root root 0 Mar 2 17:05 FILES.node.nodes.lock
drwx------. 2 root root 4096 Mar 2 17:05 FILES
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 8 months
[JBoss JIRA] (MODCLUSTER-249) Doubled jvmRoute value in JSESSIONID
by Michal Babacek (JIRA)
[ https://issues.jboss.org/browse/MODCLUSTER-249?page=com.atlassian.jira.pl... ]
Michal Babacek closed MODCLUSTER-249.
-------------------------------------
> Doubled jvmRoute value in JSESSIONID
> ------------------------------------
>
> Key: MODCLUSTER-249
> URL: https://issues.jboss.org/browse/MODCLUSTER-249
> Project: mod_cluster
> Issue Type: Bug
> Reporter: Michal Babacek
> Assignee: Paul Ferraro
> Labels: as7, mod_cluster
>
> If we force Mod_cluster to use an explicit jvmRoute by editing *standalone-ha.xml* in this way:
> {code:xml}
> <server xmlns="urn:jboss:domain:1.0">
> ...
> <extensions>
> ...
> </extensions>
> <system-properties>
> <property name="jboss.mod_cluster.jvmRoute" value="perf22node"/>
> </system-properties>
> <management>
> ...
> {code}
> *JSESSIONID* returned as a cookie to a client contains this (note the doubled jvmRoute):
> {noformat}
> Session was created! JSESSIONID - R4PL5AAmojvW0zWd9Ddp86Qs.perf22node.perf22node
> {noformat}
> On the other side, perf22node log says:
> {noformat}
> [org.jboss.modcluster.ModClusterService] (ContainerBackgroundProcessor[StandardEngine[jboss.web]]) Engine [jboss.web] will use jvmRoute: perf22node
> {noformat}
> I tried to modify the [SystemPropertyJvmRouteFactory.java|http://anonsvn.jboss.org/repos/mod_clu...] so as to know what jvmRoute it gets:
> {code:java}
> public String createJvmRoute(Engine engine)
> {
> final String defaultJvmRoute = this.factory.createJvmRoute(engine);
> final String property = this.property;
>
> PrivilegedAction<String> action = new PrivilegedAction<String>()
> {
> public String run()
> {
> String jvmRoute = System.getProperty(property, defaultJvmRoute);
> log.info("Info HELL: "+jvmRoute);
> return jvmRoute;
> }
> };
>
> return AccessController.doPrivileged(action);
> }
> {code}
> And the result in perf22node log says:
> {noformat}
> [org.jboss.modcluster.SystemPropertyJvmRouteFactory] (ContainerBackgroundProcessor[StandardEngine[jboss.web]]) Info HELL: perf22node
> {noformat}
> So it appears it is OK as far as SystemPropertyJvmRouteFactory goes...
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months