Re: 9.0.13 encrypted cluster traffic

2019-01-05 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

On 1/4/19 08:23, Tim K wrote:
> On Sat, Dec 22, 2018, 11:56 AM Christopher Schultz < 
> ch...@christopherschultz.net wrote:
> 
> Tim,
> 
> On 12/21/18 08:14, Tim K wrote:
 On Thu, Dec 20, 2018, 10:11 PM Christopher Schultz < 
 ch...@christopherschultz.net wrote:
 
 Tim,
 
 On 12/20/18 10:18, Tim K wrote:
 
 I just downloaded and tried 9.0.14 but I'm still
 getting the same BadPaddingException upon starting
 the second instance.  I confirmed the encryptionKey
 matches on my two instances.
 
>>> 
>>> Maybe something is wrong with my config?  For this
>>> test, I have both Tomcats on the same server using
>>> different ports:
 
 This is the only thing that matters to the encryption
 interceptor:
 
>>> >> className="org.apache.catalina.tribes.group.interceptors.Encrypt
Int
>
>>> 
erc
 
>>> 
> eptor"
>>> 
>>> 
 encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
 
 I'm not sure if the order of encrypt/asyncdispatch
 interceptors matters much.
 
 I copy/pasted your key into the TestEncryptInterceptor unit
 test and I didn't get any errors. I generated 4 new
 32-character (16-byte) keys and tried all of them and didn't
 get any errors.
 
 Oddly, the very first time I copy/pasted it from your email 
 message into the tester it failed with BadPaddingException,
 but when I re-copied "just in case" it stopped failing. Can
 you download and build the 9.0.14 source and run that unit
 test in your environment? Like this:
 
 $ ant test 
 -Dtest.entry=org.apache.catalina.tribes.group.interceptors.TestEncr
ypt
>
 
In
 
 
> terceptor
 
 If that works, try copy/pasting your key into the source file
 of the test -- it's right up at the top, called
 "encryptionKey128" -- then save and re-run the test (ant will
 recompile it). If that works... then I'm stumped.
 
 -chris
> 
> --
- ---
>
>
>
> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail:
> users-h...@tomcat.apache.org
 
 
 I grabbed the src from the site and built it successfully,
 tried the test but it is looking for a message.bin file...
> 
> If the file doesn't exist, it skips the test. That's normal.
> 
 I tried just touch'ing that file and the first test fails
 with a NegativeArraySizeException
> 
> Right... because it should contain an encrypted message. A
> zero-byte file won't be decrypted properly.
> 
> (BTW this explains why I got a BadPaddingException in that
> *single* test... I forgot that the test decrypts the file
> left-behind from the previous test. This was intentional, to ensure
> that there wasn't some magical state being held within the JVM
> allowing it to decrypt the message.)
> 
 and it deletes the message.bin file and the subsequent 2
 tests can't find it.  Is there something special I need to do
 with that message.bin file to run the junit tests?
> No. The tests are running as expected.
> 
 Also, I tried just using the exact encryptionKey128 you had
 within the test class and that one didn't work in my config
 either, same BadPaddingException.
> 
> Try running the test twice in a row. From your output, it looks
> like the test runs fine.
> 
> Oh, you meant using my cafebabe key in your setup didn't work?
> Please see Keiichi's reply: it seems that the EncryptInterceptor
> must be "outside" of the TcpFailureDetector.
> 
> -chris
>> 
>> -
>>
>> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
> 
> Moving the encryption interceptor to the first position appears to
> have resolved this for me.  Thank you all for the assistance!

Excellent. Thanks for the confirmation.

I was thinking about this the other day and it seems like such an easy
mistake to make with such a bad outcome it would be best to detect the
situation and throw a warning/error. I think that should be possible.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwwx9EACgkQHPApP6U8
pFgnsRAAofp4lUUj3hTYEH+9/6MoJj2kDTYG3fOvZgqrFKD2PDQtX47nzTplAEBM
5egfE3HKSykFvS5oPFLTSmbhZng+T4oLWsR0DwWVGIrcBQukYIx7BN7eR3txRAft
p2vt9KH89eBuKLjryXgItn0GIs6DG5Bq0iVSF+1dO2SdoNNhuZBPmu2z6Eq3lv4x
cUhJMKJ4RYoFv0xSjquScg6L2Ql+H5WFQneXDLP3vGLkq8pP4STbPazzm2GgnyVm
DDg2D2BpAjYSlhWE7THQM1odqmfDlconFpoft8gzy28TyWZiVJ/Di62Xy7YbKs+v
HtU5/yfPmeGksRoAFIlieERB+ZH+Bqk2QVoClpI10Af+bmzEAg7FQtjYPh5AuGKG
rAon+zD2vGHl3l8pp12w8Uk7u/be/PCrFUUYbfc7ETmLkD80MM4HFuLq3CUCsdYP

Re: 9.0.13 encrypted cluster traffic

2019-01-04 Thread Tim K 
On Sat, Dec 22, 2018, 11:56 AM Christopher Schultz <
ch...@christopherschultz.net wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Tim,
>
> On 12/21/18 08:14, Tim K wrote:
> > On Thu, Dec 20, 2018, 10:11 PM Christopher Schultz <
> > ch...@christopherschultz.net wrote:
> >
> > Tim,
> >
> > On 12/20/18 10:18, Tim K wrote:
> >
> > I just downloaded and tried 9.0.14 but I'm still getting
> > the same BadPaddingException upon starting the second
> > instance.  I confirmed the encryptionKey matches on my two
> > instances.
> >
> 
>  Maybe something is wrong with my config?  For this test, I
>  have both Tomcats on the same server using different ports:
> >
> > This is the only thing that matters to the encryption interceptor:
> >
>    className="org.apache.catalina.tribes.group.interceptors.EncryptInt
> erc
> >
> 
> eptor"
> 
> 
> > encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
> >
> > I'm not sure if the order of encrypt/asyncdispatch interceptors
> > matters much.
> >
> > I copy/pasted your key into the TestEncryptInterceptor unit test
> > and I didn't get any errors. I generated 4 new 32-character
> > (16-byte) keys and tried all of them and didn't get any errors.
> >
> > Oddly, the very first time I copy/pasted it from your email
> > message into the tester it failed with BadPaddingException, but
> > when I re-copied "just in case" it stopped failing. Can you
> > download and build the 9.0.14 source and run that unit test in your
> > environment? Like this:
> >
> > $ ant test
> > -Dtest.entry=org.apache.catalina.tribes.group.interceptors.TestEncrypt
> In
> >
> >
> terceptor
> >
> > If that works, try copy/pasting your key into the source file of
> > the test -- it's right up at the top, called "encryptionKey128" --
> > then save and re-run the test (ant will recompile it). If that
> > works... then I'm stumped.
> >
> > -chris
> >>
> >> -
> >>
> >>
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >> For additional commands, e-mail: users-h...@tomcat.apache.org
> >
> >
> > I grabbed the src from the site and built it successfully, tried
> > the test but it is looking for a message.bin file...
>
> If the file doesn't exist, it skips the test. That's normal.
>
> > I tried just touch'ing that file and the first test fails with a
> > NegativeArraySizeException
>
> Right... because it should contain an encrypted message. A zero-byte
> file won't be decrypted properly.
>
> (BTW this explains why I got a BadPaddingException in that *single*
> test... I forgot that the test decrypts the file left-behind from the
> previous test. This was intentional, to ensure that there wasn't some
> magical state being held within the JVM allowing it to decrypt the
> message.)
>
> > and it deletes the message.bin file and the subsequent 2 tests
> > can't find it.  Is there something special I need to do with that
> > message.bin file to run the junit tests?
> No. The tests are running as expected.
>
> > Also, I tried just using the exact encryptionKey128 you had within
> > the test class and that one didn't work in my config either, same
> > BadPaddingException.
>
> Try running the test twice in a row. From your output, it looks like
> the test runs fine.
>
> Oh, you meant using my cafebabe key in your setup didn't work? Please
> see Keiichi's reply: it seems that the EncryptInterceptor must be
> "outside" of the TcpFailureDetector.
>
> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwebM8ACgkQHPApP6U8
> pFg2ew/+K1IqiZQR7brZVz7Oi8wa7VdRWvVz8viQDrTj05dbRCdicntdxz7PTWXQ
> SGNH/qxXaPfgDHq2N7S8zDHwpj0gTfadn6IFuWUgZYR3jaufpEAS4lmNpyg8e5K4
> +JIacYRZDGaMWzGo+MvhNLPZQ/RhdMc2MMHW6Gmg4PSU7vwYP6o3Pp5TZsOd7U6p
> asQKKDfleVjavxeLUOVlUoXwxXIGdYBe8Jd0iuS725xG68GX//8az85nHkbJfrqd
> 0jgKx2YpWONStGjOtlsNhBEn9Sj5XTdZ3qJV36O1KtfT1vYBFZtzD748iuLTS+GI
> xxcVZuxdZgbF2qrISnPCfjnGVC0lJn6mDJgXMdVNCJ//kqlsrq1BTu5elOgRZxsG
> dLNF5WqVdPpBzFnHXaTg1nLxK0/wtox6RVR6ENid5jto6vu+nX5M+Fnus02st5W0
> 7OsKkODnz8Vc32tB1u6HwvfQiVvEYU/kTQhMG6Crvouqzguzl4rjH9A3rLzYugSs
> 5bULs57Ac6d+xnp/8lwM0742piCJD60oBHEYqLWDZQjYPc0sIo77bzBceJXk3t4K
> tIPZuOJOaQVBTom/CThoWMmliaECD7QL9dJnci2Rr4G8QBL+Bw86vvDOej/HnW6b
> N5A1brToQjHJQ7M2DeKm/u+mT0xG8zBgGAI0VL6DK229yOLpvFo=
> =nSuF
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org


Moving the encryption interceptor to the first position appears to have
resolved this for me.  Thank you all for the assistance!

Re: 9.0.13 encrypted cluster traffic

2018-12-30 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Keiichi,

On 12/25/18 02:33, Keiichi Fujino wrote:
> 2018年12月23日(日) 2:10 Christopher Schultz
> :
> 
> Keiichi,
> 
> On 12/21/18 02:58, Keiichi Fujino wrote:
 2018年12月21日(金) 12:11 Christopher Schultz 
 :
 
 Tim,
 
 On 12/20/18 10:18, Tim K wrote:
 
 I just downloaded and tried 9.0.14 but I'm still
 getting the same BadPaddingException upon starting
 the second instance.  I confirmed the encryptionKey
 matches on my two instances.
 
>>> 
>>> Maybe something is wrong with my config?  For this
>>> test, I have both Tomcats on the same server using
>>> different ports:
 
 This is the only thing that matters to the encryption
 interceptor:
 
>>> >> className="org.apache.catalina.tribes.group.interceptors.Encrypt
Int
>
>>> 
erc
 
>>> 
> eptor"
>>> 
>>> 
 encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
 
 I'm not sure if the order of encrypt/asyncdispatch
 interceptors matters much.
 
 
 
> Hi.
 
> The case of using TcpFailureDetector, there is a case to
> write directly without passing through the interceptor
> chain.
 
> TcpFailureDetector#memberAlive writes the channel data
> directly to outputstream without passing through the
> interceptor chain. However, when receiving this channel
> data, It passes through the interceptor chain. So, it must
> be received by TcpFailureDetector before decrypt of
> EncryptInterceptor. That is, the order is important. The
> order is EncryptInterceptor -> TcpFailureDetector.
> 
> How's this for an update to the EncryptInterceptor documentation:
> 
> " If using the TcpFailureDetector, the 
> EncryptInterceptor must be inserted into the
> interceptor chain before the 
> TcpFailureDetector. This is becuase the 
> TcpFailureDetector writes channel data directly 
> without using the remainder of the interceptor chain, but on the
> receiving side, the message still goes through the chain (in
> reverse). Because of this asymmetry, the
> EncryptInterceptor must execute before the
> TcpFailureDetector on the sender and after it
> on the receiver. "
> 
> 
>> Hi Chris.
> 
>> Writing channel data directly is only for member verification. 
>> Normal message are sent/received via the interceptor chain. So,
>> It may be better to add a sentence that interprets that writing
>> channel data directly is only for member verification. such as,
>> "When TcpFailureDetector validates cluster members..." etc.

How about this:

"
If using the TcpFailureDetector, the
EncryptInterceptor
must be inserted into the interceptor chain before the
TcpFailureDetector. This is becuase when validating cluster
members, TcpFailureDetector writes channel data directly
to the other members without using the remainder of the interceptor chai
n,
but on the receiving side, the message still goes through the chain (in
reverse).
Because of this asymmetry, the EncryptInterceptor must
execute
before the TcpFailureDetector on the sender and
after
it on the receiver, otherwise message corruption will occur.
"

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwo1DkACgkQHPApP6U8
pFj5RxAAhhhMiY//Q5JqJOUSD4whffm64N0jlq1tpmQzVp5bU9Xu6qL36aelFZMP
YH4VTQOvWwcPDyYBirix1feBBYWTIfIHCGtRw26fWj7OilE+EouiMM1gVPyfKSqj
LdrTlDpTzQ7LeZdukkYKIDNpaI02k9EbeYWCNi3AHIp3YCB0dX3XnpN4dmnm7lsw
idwc8B2ExmkdSqy/4Yzn21IIia2DSfAA8BrdHlwlWiAF8VQZyVMO/gkeXk4HQ4Fg
jwKdRtZxNcwyMW4o2S2owYNFdd85pNyPiFihTS7M0+WHoLHRO29kR/c0yeVlBfCf
AijiVpTjKyYZ/Al0cavuBRDty5Cg0AEX0DDwj1PvxUQ+i1Teiv3Y7f8IhpEnwmFI
AFoVFN3lghJ5U/cMkm+TzDjwME2TbTup35zabclzNTpDx7EKjPve66MJmOs4xxoJ
jtKepyt9W5z9/FlhAvxxrLJjj5T3LJSqBrtSw+YUlj0DKqrW92sxf5s3hHoy4tkH
Fji36KYx8Sryj+jQsyd+w7YlZHZ7A6W7wRIKBtqc/zxECowHSD5Q2fpqC9hUTMfN
TB9JPhFvwOBRgDWp5UWTT3JHidOQSiL/0OFdvW2d5RutZq424MpY2gObFJIoRYMp
uRIwO+AU7kyt6kkSYpN/dShScGOJ8sdX0TBK2K9CyrbK8OD5H4U=
=y0zP
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-12-24 Thread Keiichi Fujino 
2018年12月23日(日) 2:10 Christopher Schultz :

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Keiichi,
>
> On 12/21/18 02:58, Keiichi Fujino wrote:
> > 2018年12月21日(金) 12:11 Christopher Schultz
> > :
> >
> > Tim,
> >
> > On 12/20/18 10:18, Tim K wrote:
> >
> > I just downloaded and tried 9.0.14 but I'm still getting
> > the same BadPaddingException upon starting the second
> > instance.  I confirmed the encryptionKey matches on my two
> > instances.
> >
> 
>  Maybe something is wrong with my config?  For this test, I
>  have both Tomcats on the same server using different ports:
> >
> > This is the only thing that matters to the encryption interceptor:
> >
>    className="org.apache.catalina.tribes.group.interceptors.EncryptInt
> erc
> >
> 
> eptor"
> 
> 
> > encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
> >
> > I'm not sure if the order of encrypt/asyncdispatch interceptors
> > matters much.
> >
> >
> >
> >> Hi.
> >
> >> The case of using TcpFailureDetector, there is a case to write
> >> directly without passing through the interceptor chain.
> >
> >> TcpFailureDetector#memberAlive writes the channel data directly
> >> to outputstream without passing through the interceptor chain.
> >> However, when receiving this channel data, It passes through the
> >> interceptor chain. So, it must be received by TcpFailureDetector
> >> before decrypt of EncryptInterceptor. That is, the order is
> >> important. The order is EncryptInterceptor ->
> >> TcpFailureDetector.
>
> How's this for an update to the EncryptInterceptor documentation:
>
> "
> If using the TcpFailureDetector, the
> EncryptInterceptor
> must be inserted into the interceptor chain before the
> TcpFailureDetector. This is becuase the
> TcpFailureDetector writes channel data directly
> without using
> the remainder of the interceptor chain, but on the receiving side,
> the message still goes through the chain (in reverse). Because of this
> asymmetry, the EncryptInterceptor must execute
> before
> the TcpFailureDetector on the sender and after
> it on the receiver.
> "
>
>
Hi Chris.

Writing channel data directly is only for member verification.
Normal message are sent/received via the interceptor chain.
So, It may be better to add a sentence that interprets that writing channel
data directly is only for member verification.
such as, "When TcpFailureDetector validates cluster members..." etc.



> ??
>
> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlweb+MACgkQHPApP6U8
> pFibAhAAuQWi3IGaGRGGwZEHYo9jMB9gdxGkZvQGMEK4naN2KgMkzZ56wTxWRwFh
> SEV6yHj6Tz+MERc6YL2st3Hm8VH6DgwEth1g1SmLZGM0JxD4HgqTwtVE9JZk9s4Y
> dMCgRR+O09bUh0fnCOybcOHeMZv1SewPFhXq8e/rquTbJAhljRhCrANkzRmo5/05
> WS+DsG78EVrjMG/X8uZIkkBOO43TzwTyAWNrX7u3DwUvf01idgHUceBQ/pRVC+L9
> a4TwypZjYkxJcLeHexzytXYLs8j/r8JtrPYFZfTeQvnlFdDkAcFgYL+CjfjKRTwo
> GPJyMU8HjxAfROe0HsRXwtX/OL0XTDq21bwE7yNTCtV1NcnsLSY74eh7WtwMgIKx
> kmNva4roGCeb+IQAC2QRnXmenB3qX2RN2ZrY3KWEq2s+UJP7PTf3Xga5ov/OJ0ce
> SE8UIuXfmh8IS7nZPn0mFwflbB9xjJZZV8c/oScQflAJKtVjc3mQ6b+29Jfx+zMI
> imvx+B7szFkccjtIjZQlPHqgW0MbnuflqiVBUb8tH29adDOWELRPook3V6htHdBA
> 1Izbpng+dVU2R2xEQdtdcevUKbaIvmB8xYGRgilu//o/1RrC8wzGqZuXaiomBT01
> Q/wIOQjjXKvVELoAu7Ym23KEv+IDrZAmtZy7QWiBP5azPwbc4sA=
> =wOVI
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

-- 
Keiichi.Fujino

Re: 9.0.13 encrypted cluster traffic

2018-12-22 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Keiichi,

On 12/21/18 02:58, Keiichi Fujino wrote:
> 2018年12月21日(金) 12:11 Christopher Schultz
> :
> 
> Tim,
> 
> On 12/20/18 10:18, Tim K wrote:
> 
> I just downloaded and tried 9.0.14 but I'm still getting
> the same BadPaddingException upon starting the second
> instance.  I confirmed the encryptionKey matches on my two
> instances.
> 
 
 Maybe something is wrong with my config?  For this test, I
 have both Tomcats on the same server using different ports:
> 
> This is the only thing that matters to the encryption interceptor:
> 
 >>> className="org.apache.catalina.tribes.group.interceptors.EncryptInt
erc
>
 
eptor"
 
 
> encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
> 
> I'm not sure if the order of encrypt/asyncdispatch interceptors 
> matters much.
> 
> 
> 
>> Hi.
> 
>> The case of using TcpFailureDetector, there is a case to write
>> directly without passing through the interceptor chain.
> 
>> TcpFailureDetector#memberAlive writes the channel data directly
>> to outputstream without passing through the interceptor chain. 
>> However, when receiving this channel data, It passes through the 
>> interceptor chain. So, it must be received by TcpFailureDetector
>> before decrypt of EncryptInterceptor. That is, the order is
>> important. The order is EncryptInterceptor ->
>> TcpFailureDetector.

How's this for an update to the EncryptInterceptor documentation:

"
If using the TcpFailureDetector, the
EncryptInterceptor
must be inserted into the interceptor chain before the
TcpFailureDetector. This is becuase the
TcpFailureDetector writes channel data directly
without using
the remainder of the interceptor chain, but on the receiving side,
the message still goes through the chain (in reverse). Because of this
asymmetry, the EncryptInterceptor must execute
before
the TcpFailureDetector on the sender and after
it on the receiver.
"

??

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlweb+MACgkQHPApP6U8
pFibAhAAuQWi3IGaGRGGwZEHYo9jMB9gdxGkZvQGMEK4naN2KgMkzZ56wTxWRwFh
SEV6yHj6Tz+MERc6YL2st3Hm8VH6DgwEth1g1SmLZGM0JxD4HgqTwtVE9JZk9s4Y
dMCgRR+O09bUh0fnCOybcOHeMZv1SewPFhXq8e/rquTbJAhljRhCrANkzRmo5/05
WS+DsG78EVrjMG/X8uZIkkBOO43TzwTyAWNrX7u3DwUvf01idgHUceBQ/pRVC+L9
a4TwypZjYkxJcLeHexzytXYLs8j/r8JtrPYFZfTeQvnlFdDkAcFgYL+CjfjKRTwo
GPJyMU8HjxAfROe0HsRXwtX/OL0XTDq21bwE7yNTCtV1NcnsLSY74eh7WtwMgIKx
kmNva4roGCeb+IQAC2QRnXmenB3qX2RN2ZrY3KWEq2s+UJP7PTf3Xga5ov/OJ0ce
SE8UIuXfmh8IS7nZPn0mFwflbB9xjJZZV8c/oScQflAJKtVjc3mQ6b+29Jfx+zMI
imvx+B7szFkccjtIjZQlPHqgW0MbnuflqiVBUb8tH29adDOWELRPook3V6htHdBA
1Izbpng+dVU2R2xEQdtdcevUKbaIvmB8xYGRgilu//o/1RrC8wzGqZuXaiomBT01
Q/wIOQjjXKvVELoAu7Ym23KEv+IDrZAmtZy7QWiBP5azPwbc4sA=
=wOVI
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-12-22 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

On 12/21/18 08:14, Tim K wrote:
> On Thu, Dec 20, 2018, 10:11 PM Christopher Schultz < 
> ch...@christopherschultz.net wrote:
> 
> Tim,
> 
> On 12/20/18 10:18, Tim K wrote:
> 
> I just downloaded and tried 9.0.14 but I'm still getting
> the same BadPaddingException upon starting the second
> instance.  I confirmed the encryptionKey matches on my two
> instances.
> 
 
 Maybe something is wrong with my config?  For this test, I
 have both Tomcats on the same server using different ports:
> 
> This is the only thing that matters to the encryption interceptor:
> 
 >>> className="org.apache.catalina.tribes.group.interceptors.EncryptInt
erc
>
 
eptor"
 
 
> encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
> 
> I'm not sure if the order of encrypt/asyncdispatch interceptors 
> matters much.
> 
> I copy/pasted your key into the TestEncryptInterceptor unit test
> and I didn't get any errors. I generated 4 new 32-character
> (16-byte) keys and tried all of them and didn't get any errors.
> 
> Oddly, the very first time I copy/pasted it from your email
> message into the tester it failed with BadPaddingException, but
> when I re-copied "just in case" it stopped failing. Can you
> download and build the 9.0.14 source and run that unit test in your
> environment? Like this:
> 
> $ ant test 
> -Dtest.entry=org.apache.catalina.tribes.group.interceptors.TestEncrypt
In
>
> 
terceptor
> 
> If that works, try copy/pasting your key into the source file of
> the test -- it's right up at the top, called "encryptionKey128" --
> then save and re-run the test (ant will recompile it). If that
> works... then I'm stumped.
> 
> -chris
>> 
>> -
>>
>> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
> 
> I grabbed the src from the site and built it successfully, tried
> the test but it is looking for a message.bin file...

If the file doesn't exist, it skips the test. That's normal.

> I tried just touch'ing that file and the first test fails with a
> NegativeArraySizeException

Right... because it should contain an encrypted message. A zero-byte
file won't be decrypted properly.

(BTW this explains why I got a BadPaddingException in that *single*
test... I forgot that the test decrypts the file left-behind from the
previous test. This was intentional, to ensure that there wasn't some
magical state being held within the JVM allowing it to decrypt the
message.)

> and it deletes the message.bin file and the subsequent 2 tests
> can't find it.  Is there something special I need to do with that 
> message.bin file to run the junit tests?
No. The tests are running as expected.

> Also, I tried just using the exact encryptionKey128 you had within
> the test class and that one didn't work in my config either, same 
> BadPaddingException.

Try running the test twice in a row. From your output, it looks like
the test runs fine.

Oh, you meant using my cafebabe key in your setup didn't work? Please
see Keiichi's reply: it seems that the EncryptInterceptor must be
"outside" of the TcpFailureDetector.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwebM8ACgkQHPApP6U8
pFg2ew/+K1IqiZQR7brZVz7Oi8wa7VdRWvVz8viQDrTj05dbRCdicntdxz7PTWXQ
SGNH/qxXaPfgDHq2N7S8zDHwpj0gTfadn6IFuWUgZYR3jaufpEAS4lmNpyg8e5K4
+JIacYRZDGaMWzGo+MvhNLPZQ/RhdMc2MMHW6Gmg4PSU7vwYP6o3Pp5TZsOd7U6p
asQKKDfleVjavxeLUOVlUoXwxXIGdYBe8Jd0iuS725xG68GX//8az85nHkbJfrqd
0jgKx2YpWONStGjOtlsNhBEn9Sj5XTdZ3qJV36O1KtfT1vYBFZtzD748iuLTS+GI
xxcVZuxdZgbF2qrISnPCfjnGVC0lJn6mDJgXMdVNCJ//kqlsrq1BTu5elOgRZxsG
dLNF5WqVdPpBzFnHXaTg1nLxK0/wtox6RVR6ENid5jto6vu+nX5M+Fnus02st5W0
7OsKkODnz8Vc32tB1u6HwvfQiVvEYU/kTQhMG6Crvouqzguzl4rjH9A3rLzYugSs
5bULs57Ac6d+xnp/8lwM0742piCJD60oBHEYqLWDZQjYPc0sIo77bzBceJXk3t4K
tIPZuOJOaQVBTom/CThoWMmliaECD7QL9dJnci2Rr4G8QBL+Bw86vvDOej/HnW6b
N5A1brToQjHJQ7M2DeKm/u+mT0xG8zBgGAI0VL6DK229yOLpvFo=
=nSuF
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-12-21 Thread Tim K 
On Thu, Dec 20, 2018, 10:11 PM Christopher Schultz <
ch...@christopherschultz.net wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Tim,
>
> On 12/20/18 10:18, Tim K wrote:
> >>
> >> I just downloaded and tried 9.0.14 but I'm still getting the same
> >> BadPaddingException upon starting the second instance.  I
> >> confirmed the encryptionKey matches on my two instances.
> >>
> >
> > Maybe something is wrong with my config?  For this test, I have
> > both Tomcats on the same server using different ports:
>
> This is the only thing that matters to the encryption interceptor:
>
> >  > className="org.apache.catalina.tribes.group.interceptors.EncryptInterc
> eptor"
> >
> >
> encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
>
> I'm not sure if the order of encrypt/asyncdispatch interceptors
> matters much.
>
> I copy/pasted your key into the TestEncryptInterceptor unit test and I
> didn't get any errors. I generated 4 new 32-character (16-byte) keys
> and tried all of them and didn't get any errors.
>
> Oddly, the very first time I copy/pasted it from your email message
> into the tester it failed with BadPaddingException, but when I
> re-copied "just in case" it stopped failing. Can you download and
> build the 9.0.14 source and run that unit test in your environment?
> Like this:
>
>   $ ant test
> - -Dtest.entry=org.apache.catalina.tribes.group.interceptors.TestEncryptIn
> terceptor
>
> If that works, try copy/pasting your key into the source file of the
> test -- it's right up at the top, called "encryptionKey128" -- then
> save and re-run the test (ant will recompile it). If that works...
> then I'm stumped.
>
> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwcWdEACgkQHPApP6U8
> pFhClRAAnW4mZ59yG6exLzJqv6nNW8wdUhrLY2eGWFroWN3JMADU7kwA14ndNZfv
> iOEIaaE1zvtEiScivqAj6VhIetrb/j07NUSX8eoUYzsEWS6GlFtAY53ok/6xPX4F
> 5MUxJTjklQr16C/IAx+4mgbTE/eUKWodfE58Q5sZo6acKxmikwMFFdRkGfqlkLe3
> Gmed6zCHMjbhr/yq3g7J484wEqmzYXhGcOHHfNERxunjrcnfd4m4pqQhjTiLMNRN
> wRG6wovEbAwv3P/PPlGu30d776m3OKNAaYIh17AHFEB2dS6Xn5GToMHAyp5nmRFs
> Tt+bWhWnB37EmsvvvU+yH17CqUtatdnCw1UHVseoVZGmzefpxQdwuh57Hs1NLSSN
> 683giOomSALGWupBd6XV56XfV19k+PuB1gv2He4AfJRmBzJhyS4WTJgwalMcIEOF
> 4r2hmJQGhoopTZR3grvycLTzKvSH/s35Lbf2C1BSxZ+lxsig46NYeemX8xe9H39g
> s/30ACCNV3h2LUjrqHTQ+wT4VBtOvC7VviZnWzaegmjDuP7xPEENr2uYt230eRGt
> Z+WkHrhTkLchwmdK4v1ziCNPgggfI8vEM6IOQwxxmwiwthYpfxA7zDBFgqiJUMO4
> HN/74VauFxG2YeK4LFPYd3i65fCYZRqLceMuzfquYgdmX6ccgQQ=
> =IAd9
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org


I grabbed the src from the site and built it successfully, tried the test
but it is looking for a message.bin file... I tried just touch'ing that
file and the first test fails with a NegativeArraySizeException and it
deletes the message.bin file and the subsequent 2 tests can't find it.  Is
there something special I need to do with that message.bin file to run the
junit tests?

test-nio:

[junit] Running
org.apache.catalina.tribes.group.interceptors.TestEncryptInterceptor

[junit] Tests run: 17, Failures: 0, Errors: 0, Skipped: 2, Time
elapsed: 0.364 sec

[junit] File message.bin does not exist. Skipping test.



test-nio2:

[junit] Running
org.apache.catalina.tribes.group.interceptors.TestEncryptInterceptor

[junit] Tests run: 17, Failures: 0, Errors: 0, Skipped: 2, Time
elapsed: 0.625 sec

[junit] File message.bin does not exist. Skipping test.



test-apr-exists:



test-apr:

[junit] Running
org.apache.catalina.tribes.group.interceptors.TestEncryptInterceptor

[junit] Tests run: 17, Failures: 0, Errors: 0, Skipped: 2, Time
elapsed: 0.465 sec

[junit] File message.bin does not exist. Skipping test.



cobertura-report:



test:

   [concat] Testsuites with skipped tests:

   [concat]
TEST-org.apache.catalina.tribes.group.interceptors.TestEncryptInterceptor.APR.txt

   [concat]
TEST-org.apache.catalina.tribes.group.interceptors.TestEncryptInterceptor.NIO.txt

   [concat]
TEST-org.apache.catalina.tribes.group.interceptors.TestEncryptInterceptor.NIO2.txt

   [concat] Testsuites with failed tests:



BUILD SUCCESSFUL

Total time: 11 seconds

Also, I tried just using the exact encryptionKey128 you had within the test
class and that one didn't work in my config either, same
BadPaddingException.

-Tim

Re: 9.0.13 encrypted cluster traffic

2018-12-20 Thread Keiichi Fujino 
2018年12月21日(金) 12:11 Christopher Schultz :

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Tim,
>
> On 12/20/18 10:18, Tim K wrote:
> >>
> >> I just downloaded and tried 9.0.14 but I'm still getting the same
> >> BadPaddingException upon starting the second instance.  I
> >> confirmed the encryptionKey matches on my two instances.
> >>
> >
> > Maybe something is wrong with my config?  For this test, I have
> > both Tomcats on the same server using different ports:
>
> This is the only thing that matters to the encryption interceptor:
>
> >  > className="org.apache.catalina.tribes.group.interceptors.EncryptInterc
> eptor"
> >
> >
> encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
>
> I'm not sure if the order of encrypt/asyncdispatch interceptors
> matters much.
>


Hi.

The case of using TcpFailureDetector, there is a case to write directly
without passing through the interceptor chain.

TcpFailureDetector#memberAlive writes the channel data directly to
outputstream without passing through the interceptor chain.
However, when receiving this channel data, It passes through the
interceptor chain.
So, it must be received by TcpFailureDetector before decrypt of
EncryptInterceptor.
That is, the order is important.
The order is
EncryptInterceptor -> TcpFailureDetector.


>
> I copy/pasted your key into the TestEncryptInterceptor unit test and I
> didn't get any errors. I generated 4 new 32-character (16-byte) keys
> and tried all of them and didn't get any errors.
>
> Oddly, the very first time I copy/pasted it from your email message
> into the tester it failed with BadPaddingException, but when I
> re-copied "just in case" it stopped failing. Can you download and
> build the 9.0.14 source and run that unit test in your environment?
> Like this:
>
>   $ ant test
> - -Dtest.entry=org.apache.catalina.tribes.group.interceptors.TestEncryptIn
> terceptor
>
> If that works, try copy/pasting your key into the source file of the
> test -- it's right up at the top, called "encryptionKey128" -- then
> save and re-run the test (ant will recompile it). If that works...
> then I'm stumped.
>
> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwcWdEACgkQHPApP6U8
> pFhClRAAnW4mZ59yG6exLzJqv6nNW8wdUhrLY2eGWFroWN3JMADU7kwA14ndNZfv
> iOEIaaE1zvtEiScivqAj6VhIetrb/j07NUSX8eoUYzsEWS6GlFtAY53ok/6xPX4F
> 5MUxJTjklQr16C/IAx+4mgbTE/eUKWodfE58Q5sZo6acKxmikwMFFdRkGfqlkLe3
> Gmed6zCHMjbhr/yq3g7J484wEqmzYXhGcOHHfNERxunjrcnfd4m4pqQhjTiLMNRN
> wRG6wovEbAwv3P/PPlGu30d776m3OKNAaYIh17AHFEB2dS6Xn5GToMHAyp5nmRFs
> Tt+bWhWnB37EmsvvvU+yH17CqUtatdnCw1UHVseoVZGmzefpxQdwuh57Hs1NLSSN
> 683giOomSALGWupBd6XV56XfV19k+PuB1gv2He4AfJRmBzJhyS4WTJgwalMcIEOF
> 4r2hmJQGhoopTZR3grvycLTzKvSH/s35Lbf2C1BSxZ+lxsig46NYeemX8xe9H39g
> s/30ACCNV3h2LUjrqHTQ+wT4VBtOvC7VviZnWzaegmjDuP7xPEENr2uYt230eRGt
> Z+WkHrhTkLchwmdK4v1ziCNPgggfI8vEM6IOQwxxmwiwthYpfxA7zDBFgqiJUMO4
> HN/74VauFxG2YeK4LFPYd3i65fCYZRqLceMuzfquYgdmX6ccgQQ=
> =IAd9
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

-- 
Keiichi.Fujino

Re: 9.0.13 encrypted cluster traffic

2018-12-20 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

On 12/20/18 10:18, Tim K wrote:
>> 
>> I just downloaded and tried 9.0.14 but I'm still getting the same
>> BadPaddingException upon starting the second instance.  I
>> confirmed the encryptionKey matches on my two instances.
>> 
> 
> Maybe something is wrong with my config?  For this test, I have
> both Tomcats on the same server using different ports:

This is the only thing that matters to the encryption interceptor:

>  className="org.apache.catalina.tribes.group.interceptors.EncryptInterc
eptor"
>
> 
encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />

I'm not sure if the order of encrypt/asyncdispatch interceptors
matters much.

I copy/pasted your key into the TestEncryptInterceptor unit test and I
didn't get any errors. I generated 4 new 32-character (16-byte) keys
and tried all of them and didn't get any errors.

Oddly, the very first time I copy/pasted it from your email message
into the tester it failed with BadPaddingException, but when I
re-copied "just in case" it stopped failing. Can you download and
build the 9.0.14 source and run that unit test in your environment?
Like this:

  $ ant test
- -Dtest.entry=org.apache.catalina.tribes.group.interceptors.TestEncryptIn
terceptor

If that works, try copy/pasting your key into the source file of the
test -- it's right up at the top, called "encryptionKey128" -- then
save and re-run the test (ant will recompile it). If that works...
then I'm stumped.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwcWdEACgkQHPApP6U8
pFhClRAAnW4mZ59yG6exLzJqv6nNW8wdUhrLY2eGWFroWN3JMADU7kwA14ndNZfv
iOEIaaE1zvtEiScivqAj6VhIetrb/j07NUSX8eoUYzsEWS6GlFtAY53ok/6xPX4F
5MUxJTjklQr16C/IAx+4mgbTE/eUKWodfE58Q5sZo6acKxmikwMFFdRkGfqlkLe3
Gmed6zCHMjbhr/yq3g7J484wEqmzYXhGcOHHfNERxunjrcnfd4m4pqQhjTiLMNRN
wRG6wovEbAwv3P/PPlGu30d776m3OKNAaYIh17AHFEB2dS6Xn5GToMHAyp5nmRFs
Tt+bWhWnB37EmsvvvU+yH17CqUtatdnCw1UHVseoVZGmzefpxQdwuh57Hs1NLSSN
683giOomSALGWupBd6XV56XfV19k+PuB1gv2He4AfJRmBzJhyS4WTJgwalMcIEOF
4r2hmJQGhoopTZR3grvycLTzKvSH/s35Lbf2C1BSxZ+lxsig46NYeemX8xe9H39g
s/30ACCNV3h2LUjrqHTQ+wT4VBtOvC7VviZnWzaegmjDuP7xPEENr2uYt230eRGt
Z+WkHrhTkLchwmdK4v1ziCNPgggfI8vEM6IOQwxxmwiwthYpfxA7zDBFgqiJUMO4
HN/74VauFxG2YeK4LFPYd3i65fCYZRqLceMuzfquYgdmX6ccgQQ=
=IAd9
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-12-20 Thread Tim K 
>
> I just downloaded and tried 9.0.14 but I'm still getting the
> same BadPaddingException upon starting the second instance.  I confirmed
> the encryptionKey matches on my two instances.
>

Maybe something is wrong with my config?  For this test, I have both
Tomcats on the same server using different ports:

server1:
















































server2:

Re: 9.0.13 encrypted cluster traffic

2018-12-20 Thread Tim K 
On Wed, Dec 19, 2018, 11:00 PM Christopher Schultz <
ch...@christopherschultz.net wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Tim,
>
> Tomcat 9.0.14 is available and should work much better. Would it be
> possible for you to test the latest release with the encrypted clusterin
> g?
>
> Thanks,
> - -chris
>
> On 11/24/18 11:13, Christopher Schultz wrote:
> > Tim,
> >
> > On 11/23/18 12:55, Christopher Schultz wrote:
> >> Okay, the problem is that I built the EncryptInterceptor without
> >>  realizing that cluster-messaging isn't single-threaded. It's
> >> completely non-thread-safe and it needs to be.
> >
> >> There is a simple fix that can be applied (synchronize the
> >> encrypt and decrypt methods) but it'll create a big bottleneck
> >> for you. On the other hand, it's easy to apply and test and
> >> ensure it's working in your environment. Are you willing to grab
> >> the Tomcat source and compile it? If you get the 9.0.13 source
> >> and are able to compile it, I can give you a 2-line patch that
> >> should fix your issue. Alternatively, I can give you a patched
> >> catalina-tribes.jar that you can just drop-in-replace to try
> >> out.
> >
> >> I have a more elaborate patch that I'm going to apply soon and it
> >>  should be available in the next release of Tomcat 9.
> >
> > I think this should be fixed, now. If you build from trunk, I
> > think things will work remarkably better for you. Or, just wait
> > until the next release (a few weeks maybe). If you *can* build from
> > source, it would be great to get some real-world mileage on this
> > code before the next release.
> >
> > -chris
> >
> > -
> >
> >
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> > For additional commands, e-mail: users-h...@tomcat.apache.org
> >
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwbE9MACgkQHPApP6U8
> pFhHPQ/+PMCSp8YuG811TLmzZg91gdgbxXgMOKrSnNDh/w3paiUhQD2+uPW8FPbP
> 3E8yRgN34JOm+r5ND3x57e3TpXXO9QzQ287d7Pka2RxLlkz4tj/wPbRmyiNaot/t
> f/IjVx0NdLdfCxEkntcTAwQUUkqP6VM8umrN2URJqsWqTVs0tqFGMtw2xe8zVCIT
> FkZCfwTqGFCHa65iCTlA8LCJbhc1E1d8lDJVBetYrEREE//3y6U1xEbfOJPcKdEv
> s8RsTcdOt4A0iQDyqdY0Zsj58Bb6xSUfdRVSqgmQDUDUF3SQLif9a38VNwp2xaPE
> BgQiiLHa6Mpmd2+2iZPM/k3GcTSVeFq21opvmlKmYI1QNhy++UsOHbQ1KaSPbDed
> GIQ+MWE8K4SPIbX3RSz9lJqKySJabDsQliI+Cfktz6Q0MhvQoFH33E2IsrxgFUxn
> 3tU/Yyaa6fUpRYmWuersKU2ps3BMoMT4dwou57cQiTqcgHDVYXcXj64pJv5EM2Ap
> /dL1pzAlv0mKkS+wIeFraVvAbH0qeg2sjk0kEjQTN+hrYi74UpKrp076Oc2i8TUI
> Wc7TmSiuBqpAIjNb3oLjs1EjbI/B8V2tULOUJYlWz2GTPSdJAQp/u/8lQpu26m6W
> EisenCnlc18ANvuIko/ZqlXNKrYIkociip1krluNGH2gCmq/6N4=
> =5/TA
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org


I just downloaded and tried 9.0.14 but I'm still getting the
same BadPaddingException upon starting the second instance.  I confirmed
the encryptionKey matches on my two instances.

>
>

Re: 9.0.13 encrypted cluster traffic

2018-12-19 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

Tomcat 9.0.14 is available and should work much better. Would it be
possible for you to test the latest release with the encrypted clusterin
g?

Thanks,
- -chris

On 11/24/18 11:13, Christopher Schultz wrote:
> Tim,
> 
> On 11/23/18 12:55, Christopher Schultz wrote:
>> Okay, the problem is that I built the EncryptInterceptor without
>>  realizing that cluster-messaging isn't single-threaded. It's 
>> completely non-thread-safe and it needs to be.
> 
>> There is a simple fix that can be applied (synchronize the
>> encrypt and decrypt methods) but it'll create a big bottleneck
>> for you. On the other hand, it's easy to apply and test and
>> ensure it's working in your environment. Are you willing to grab
>> the Tomcat source and compile it? If you get the 9.0.13 source
>> and are able to compile it, I can give you a 2-line patch that
>> should fix your issue. Alternatively, I can give you a patched
>> catalina-tribes.jar that you can just drop-in-replace to try
>> out.
> 
>> I have a more elaborate patch that I'm going to apply soon and it
>>  should be available in the next release of Tomcat 9.
> 
> I think this should be fixed, now. If you build from trunk, I
> think things will work remarkably better for you. Or, just wait
> until the next release (a few weeks maybe). If you *can* build from
> source, it would be great to get some real-world mileage on this
> code before the next release.
> 
> -chris
> 
> -
>
> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlwbE9MACgkQHPApP6U8
pFhHPQ/+PMCSp8YuG811TLmzZg91gdgbxXgMOKrSnNDh/w3paiUhQD2+uPW8FPbP
3E8yRgN34JOm+r5ND3x57e3TpXXO9QzQ287d7Pka2RxLlkz4tj/wPbRmyiNaot/t
f/IjVx0NdLdfCxEkntcTAwQUUkqP6VM8umrN2URJqsWqTVs0tqFGMtw2xe8zVCIT
FkZCfwTqGFCHa65iCTlA8LCJbhc1E1d8lDJVBetYrEREE//3y6U1xEbfOJPcKdEv
s8RsTcdOt4A0iQDyqdY0Zsj58Bb6xSUfdRVSqgmQDUDUF3SQLif9a38VNwp2xaPE
BgQiiLHa6Mpmd2+2iZPM/k3GcTSVeFq21opvmlKmYI1QNhy++UsOHbQ1KaSPbDed
GIQ+MWE8K4SPIbX3RSz9lJqKySJabDsQliI+Cfktz6Q0MhvQoFH33E2IsrxgFUxn
3tU/Yyaa6fUpRYmWuersKU2ps3BMoMT4dwou57cQiTqcgHDVYXcXj64pJv5EM2Ap
/dL1pzAlv0mKkS+wIeFraVvAbH0qeg2sjk0kEjQTN+hrYi74UpKrp076Oc2i8TUI
Wc7TmSiuBqpAIjNb3oLjs1EjbI/B8V2tULOUJYlWz2GTPSdJAQp/u/8lQpu26m6W
EisenCnlc18ANvuIko/ZqlXNKrYIkociip1krluNGH2gCmq/6N4=
=5/TA
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-11-24 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Esther,

On 11/24/18 14:48, Esther Montes wrote:
> Disculpe pero es q no le entiendo

Lo siento si no me entiendes El idioma oficial de esta lista de correo
es el inglés. Si lo desea, puede unirse a una lista de correo
diferente si desea utilizar el español en su lugar.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlv5vmMACgkQHPApP6U8
pFgolhAAwGxL9wl/vd4Iv1Gez60QQpgukAx0n+G5Vx1+LrumvXR3Geu96J1Be+m0
wU2YhRxVmq85CDjTcRKrDnih7BP5Lu8Xenk8BljWQRnt4zeuleN40jFyLH88MBXe
E52lqmTfZXIP6eA/2csZpz5Ug436JxG20PaCqB4d2/NuNgSM0yyu2p/r+LHPqz8p
EFi5x0RKcLcSgLNObM1aauMcBPnIe/i0AaO3L5LV/RGglNXZbTJOtx3WfOrDpkpY
8FH5pGb3UiWw1Q2zT4mgcWqcSzBMTwaNGHtApA47TWiYc18CqOe2Yz4T3QkEBUhW
hHKqEKtDxHOZJUTGrnNhuEu8mVbCqd8xjBpsZKjncgMmtZunx8xoka+QLo/DOiXE
oMEPRDZ+wAzbw/9OXj3QWgPAI4FGGjCBD2U420HP/9yggxUO+rxX2XYLcRQcM8Kl
KlRMM/um/z+ogY/CST3lJ+brL+RIlFZtLKq1hxw7ouBk32yZyGTt5m+WkFMqxeIc
aEn4wDKmF3/8PZhI7ByMVlZPnRph8hBqyZHkvZRrbwtnT4AHuBXRm7n9m3y9brj+
46eT5NOMXju604pF0D+Kg2McHEjT5WEEQViLpNPy7SU0YGNb9YR9EoqA1sSXwFPe
EhJo2+SrqQ5geGWFn9dCS1D5S5n9LGczvocumyw6n9s+AXP7G0Y=
=fYD7
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-11-24 Thread Esther Montes 
Disculpe pero es q no le entiendo

El sáb., 24 de nov. de 2018 8:13 AM, Christopher Schultz <
ch...@christopherschultz.net> escribió:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Tim,
>
> On 11/23/18 12:55, Christopher Schultz wrote:
> > Okay, the problem is that I built the EncryptInterceptor without
> > realizing that cluster-messaging isn't single-threaded. It's
> > completely non-thread-safe and it needs to be.
> >
> > There is a simple fix that can be applied (synchronize the encrypt
> > and decrypt methods) but it'll create a big bottleneck for you. On
> > the other hand, it's easy to apply and test and ensure it's working
> > in your environment. Are you willing to grab the Tomcat source and
> > compile it? If you get the 9.0.13 source and are able to compile
> > it, I can give you a 2-line patch that should fix your issue.
> > Alternatively, I can give you a patched catalina-tribes.jar that
> > you can just drop-in-replace to try out.
> >
> > I have a more elaborate patch that I'm going to apply soon and it
> > should be available in the next release of Tomcat 9.
>
> I think this should be fixed, now. If you build from trunk, I think
> things will work remarkably better for you. Or, just wait until the
> next release (a few weeks maybe). If you *can* build from source, it
> would be great to get some real-world mileage on this code before the
> next release.
>
> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlv5eJ4ACgkQHPApP6U8
> pFgMQw//Z1BND215m27Lja3sHlJjWDEHdS/snEqtZfbED1ps7C0a/1/P867yS004
> XWdcgRlPLEZub0exaav3J84EGPB+7KTaipPvulIap2pyoXDhd9H2UInqtqRZqR+u
> RLzDQoXXErFY5usigR2lVUlNyHjFyBybWV4Wrru/J+VuN9+E9iYe9czXYSKmZNX0
> Kig8NlaQcVdcCazQEQ60bPuLxEUoVW+ggZAwsBJ2hCvWjaBH3naTXZEzhOWu+R4J
> /tZ+o1echoWQSH5um7nPeFlNU5wla7zKCSg6zpLLFIzolJjR3Yr9LRP6wBw0Herj
> ikKs4fURsF+MDP04JLbJO0qHuV+6Ydz4nbln3mQRtLMNlkBP9dNB8pdQ7kTdntxG
> k3Olp2805Gb+9aVdkD805g4fk/4eRTafwRRVaSPtVPvXm0544tjUh7AxpWIyL3k4
> /qPAK84AvY1EacRzvr9pnKZcUGiY5WT6Zn7yPYkVX+OUhFwLgowJEnyhdq1Uy1r6
> rm20H4UWHH+hC1Ae+ErXAVJj7n5+7LHq/2BAtL6qDJjBSiGp4iuO8XHv89EwHC1B
> pTV2SkwKNtFoLy7iOOIBgSqp6urYVhZnQNKAXvFZotoEgkKm/GdtsKR3IayAgBUe
> 7uLltKHvfKKyYh6KL7BhbntBSILIYbWYVohgdsquIuk+94NFgwc=
> =293j
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: 9.0.13 encrypted cluster traffic

2018-11-24 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

On 11/23/18 12:55, Christopher Schultz wrote:
> Okay, the problem is that I built the EncryptInterceptor without 
> realizing that cluster-messaging isn't single-threaded. It's 
> completely non-thread-safe and it needs to be.
> 
> There is a simple fix that can be applied (synchronize the encrypt
> and decrypt methods) but it'll create a big bottleneck for you. On
> the other hand, it's easy to apply and test and ensure it's working
> in your environment. Are you willing to grab the Tomcat source and 
> compile it? If you get the 9.0.13 source and are able to compile
> it, I can give you a 2-line patch that should fix your issue.
> Alternatively, I can give you a patched catalina-tribes.jar that
> you can just drop-in-replace to try out.
> 
> I have a more elaborate patch that I'm going to apply soon and it 
> should be available in the next release of Tomcat 9.

I think this should be fixed, now. If you build from trunk, I think
things will work remarkably better for you. Or, just wait until the
next release (a few weeks maybe). If you *can* build from source, it
would be great to get some real-world mileage on this code before the
next release.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlv5eJ4ACgkQHPApP6U8
pFgMQw//Z1BND215m27Lja3sHlJjWDEHdS/snEqtZfbED1ps7C0a/1/P867yS004
XWdcgRlPLEZub0exaav3J84EGPB+7KTaipPvulIap2pyoXDhd9H2UInqtqRZqR+u
RLzDQoXXErFY5usigR2lVUlNyHjFyBybWV4Wrru/J+VuN9+E9iYe9czXYSKmZNX0
Kig8NlaQcVdcCazQEQ60bPuLxEUoVW+ggZAwsBJ2hCvWjaBH3naTXZEzhOWu+R4J
/tZ+o1echoWQSH5um7nPeFlNU5wla7zKCSg6zpLLFIzolJjR3Yr9LRP6wBw0Herj
ikKs4fURsF+MDP04JLbJO0qHuV+6Ydz4nbln3mQRtLMNlkBP9dNB8pdQ7kTdntxG
k3Olp2805Gb+9aVdkD805g4fk/4eRTafwRRVaSPtVPvXm0544tjUh7AxpWIyL3k4
/qPAK84AvY1EacRzvr9pnKZcUGiY5WT6Zn7yPYkVX+OUhFwLgowJEnyhdq1Uy1r6
rm20H4UWHH+hC1Ae+ErXAVJj7n5+7LHq/2BAtL6qDJjBSiGp4iuO8XHv89EwHC1B
pTV2SkwKNtFoLy7iOOIBgSqp6urYVhZnQNKAXvFZotoEgkKm/GdtsKR3IayAgBUe
7uLltKHvfKKyYh6KL7BhbntBSILIYbWYVohgdsquIuk+94NFgwc=
=293j
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-11-23 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

On 11/21/18 13:55, Tim K wrote:
> On Wed, Nov 21, 2018, 9:48 AM Christopher Schultz < 
> ch...@christopherschultz.net wrote:
> 
> Tim,
> 
> On 11/20/18 13:36, Tim K wrote:
 On Tue, Nov 20, 2018, 12:19 PM Christopher Schultz < 
 ch...@christopherschultz.net wrote:
 
 Tim,
 
 On 11/20/18 11:42, Tim K wrote:
 
 Ignore the secure port. The code behind that setting
 was never implemented. We really should remove it.
 
 You want:
 
 http://tomcat.apache.org/tomcat-9.0-doc/config/cluster-intercep
tor
>
 
.ht
 
 
> ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_At
tr

> 
 ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_At
tr
>
> 

 
 
 
> ibutes
 
 
 
 Mark
>>> 
>>> 
>>> I'm having some trouble getting it working.  Can you
>>> provide an example of the new EncryptInterceptor with
>>> an algorithm and key?
 
 Each node in the cluster needs an interceptor configured,
 like this:
 
 >>> className="org.apache.catalina.tribes.group.interceptors.EncryptInt
erc
>
 
ep
 
 
> tor"
 encryptionKey="[the key]" />
 
 All nodes need the same key. The default algorithm 
 (AES/CBC/PKCS12Padding) is sufficient.
 
 To generate a key, just get some random garbage and convert
 it into hex, like this:
 
 $ dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5
 
 That'll give you a 128-bit key you can use for encryption.
 You can also use a 256-bit key if you'd like, or a 192-bit
 key. For keys larger than 128 bite (32 bytes), you'll need to
 use a different signature algorithm such as sha1 or later.
 
 I just chose MD5 because it generates the right number of
 output characters for a 128-bit key. You can get your random
 key from anywhere, including pounding on the keyboard.
 Remember that the key must be in hex-encoded binary (so only
 characters 0-9 and a-f).
 
 -chris
> 
> --
- ---
>
>
>
> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail:
> users-h...@tomcat.apache.org
 
 
 I tried this between 2 nodes but it fails with this error on
 each:
 
 dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5sum 
 e0f2cdf931e99fdce0453964294f97f3  -
 
 >>> className="org.apache.catalina.tribes.group.interceptors.EncryptInt
erc
>
 
eptor"
 
 
> encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
 
 20-Nov-2018 13:31:20.070 SEVERE 
 [Tribes-Task-Receiver[Catalina-Channel]-1] 
 org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.me
ssa
>
 
geReceived
 
 
> Failed to decrypt message
 
 javax.crypto.BadPaddingException: Given final block not
 properly padded. Such issues can arise if a bad key is used
 during decryption.
> 
> Both nodes have the same encryption key, right? The key itself
> looks fine. For example, I dropped that key into the unit test file
> and it worked as expected.
> 
> I've been working on a patch yesterday and today that uses random
> IVs instead of re-using them. It really shouldn't change anything
> about the config, etc. but both nodes will require the new code to
> re-test. I've also expanded the unit tests to cover cipher block
> modes other than CBC.
> 
> I don't actually have a cluster here for testing, though, so 
> everything is being done with the unit tests.
> 
> I thought I had reproduced your issue (BadPaddingException) except
> it turned out that the test itself was wrong and the interceptor
> code was correct.
> 
> Are you able to build from source? I'm about to commit these
> changes to the trunk (9.0.x), which really shouldn't change
> anything for you, but it might fix some edge case that you are
> hitting.
> 
> -chris
>> 
>> -
>>
>> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
> 
> Key is the same on both, yes.
> 
> I never built from src before.

Okay, the problem is that I built the EncryptInterceptor without
realizing that cluster-messaging isn't single-threaded. It's
completely non-thread-safe and it needs to be.

There is a simple fix that can be applied (synchronize the encrypt and
decrypt methods) but it'll create a big bottleneck for you. On the
other hand, it's easy to apply and test and ensure it's working in
your environment. Are

Re: 9.0.13 encrypted cluster traffic

2018-11-21 Thread Tim K 
On Wed, Nov 21, 2018, 9:48 AM Christopher Schultz <
ch...@christopherschultz.net wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Tim,
>
> On 11/20/18 13:36, Tim K wrote:
> > On Tue, Nov 20, 2018, 12:19 PM Christopher Schultz <
> > ch...@christopherschultz.net wrote:
> >
> > Tim,
> >
> > On 11/20/18 11:42, Tim K wrote:
> >
> > Ignore the secure port. The code behind that setting was
> > never implemented. We really should remove it.
> >
> > You want:
> >
> > http://tomcat.apache.org/tomcat-9.0-doc/config/cluster-interceptor
> .ht
> >
> >
> ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_Attr
> >  ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_Attr
> 
> >
> >
> >
> ibutes
> >
> >
> >
> > Mark
> 
> 
>  I'm having some trouble getting it working.  Can you provide
>  an example of the new EncryptInterceptor with an algorithm
>  and key?
> >
> > Each node in the cluster needs an interceptor configured, like
> > this:
> >
> >  > className="org.apache.catalina.tribes.group.interceptors.EncryptInterc
> ep
> >
> >
> tor"
> > encryptionKey="[the key]" />
> >
> > All nodes need the same key. The default algorithm
> > (AES/CBC/PKCS12Padding) is sufficient.
> >
> > To generate a key, just get some random garbage and convert it
> > into hex, like this:
> >
> > $ dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5
> >
> > That'll give you a 128-bit key you can use for encryption. You can
> > also use a 256-bit key if you'd like, or a 192-bit key. For keys
> > larger than 128 bite (32 bytes), you'll need to use a different
> > signature algorithm such as sha1 or later.
> >
> > I just chose MD5 because it generates the right number of output
> > characters for a 128-bit key. You can get your random key from
> > anywhere, including pounding on the keyboard. Remember that the
> > key must be in hex-encoded binary (so only characters 0-9 and
> > a-f).
> >
> > -chris
> >>
> >> -
> >>
> >>
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >> For additional commands, e-mail: users-h...@tomcat.apache.org
> >
> >
> > I tried this between 2 nodes but it fails with this error on each:
> >
> > dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5sum
> > e0f2cdf931e99fdce0453964294f97f3  -
> >
> >  > className="org.apache.catalina.tribes.group.interceptors.EncryptInterc
> eptor"
> >
> >
> encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
> >
> > 20-Nov-2018 13:31:20.070 SEVERE
> > [Tribes-Task-Receiver[Catalina-Channel]-1]
> > org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.messa
> geReceived
> >
> >
> Failed to decrypt message
> >
> > javax.crypto.BadPaddingException: Given final block not properly
> > padded. Such issues can arise if a bad key is used during
> > decryption.
>
> Both nodes have the same encryption key, right? The key itself looks
> fine. For example, I dropped that key into the unit test file and it
> worked as expected.
>
> I've been working on a patch yesterday and today that uses random IVs
> instead of re-using them. It really shouldn't change anything about
> the config, etc. but both nodes will require the new code to re-test.
> I've also expanded the unit tests to cover cipher block modes other
> than CBC.
>
> I don't actually have a cluster here for testing, though, so
> everything is being done with the unit tests.
>
> I thought I had reproduced your issue (BadPaddingException) except it
> turned out that the test itself was wrong and the interceptor code was
> correct.
>
> Are you able to build from source? I'm about to commit these changes
> to the trunk (9.0.x), which really shouldn't change anything for you,
> but it might fix some edge case that you are hitting.
>
> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlv1cC0ACgkQHPApP6U8
> pFhjuQ/+Mb46dCFqAd1QZqKtvc6BLO/K8/JCQiD8Z10YR0231AMwdCMLGkb7X7Xx
> A11KwaOSkISQucp7cLujC3KwlvrVpPBVeQODw7TydGVGtMBXGp+cp2pqhUDRJuZt
> 9MZM0aQsQSA2udbako77qNo/ISjgytp5ruW4RaHwwj8XauMuAZuQ1KjqXCgXOlfs
> DFBkVx4Qcs/YTn0DIuc9YGqROpb+h3VafNZiXXDIhv15ecSnMxqYAH928UA5MTi9
> byA3Lq9GlHoKlhaL5IYHGE+UoMds7QKCdSiQti8u/QEhMhXtvH1LPcZy/l3V5Xj+
> vklEkXgHef+kPVdwzwGQjQIvnbVl5qppx8wXJvDbY1hNsvgGbtXIj/Z1Xfwzx+BS
> 6fkGY2vEh5//nZB6REmbT79WByIlQSiOsLixha5LgkC8/li5X2ulXu2791UpmdSr
> mHVh06MBjMgaWP0fqELvgC88Q1x0z5O4SmYNka++wDpZYv3ZGE8zgWnaBPkQYLMI
> k4xF1udoKM662Zgh/fguKzht2OVRQK1qglm8R3HCtMNWR+EHFefrWlxQebAuKdFL
> dSftpA/tD4eaZ+MAN7B7bvj0dArywrQ1sA8EALzdfKfFAxDpLhPPCARLMtxO/Hue
> wlVBRUJ/4OdxjcQVZBmytGpQ2mSc3wLsxXslrTYokGq9D9E76fQ=
> =w3kX
> -END PGP

Re: 9.0.13 encrypted cluster traffic

2018-11-21 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

I'm all ready for a back-port of the EncryptInterceptor to Tomcat 8.5
but I'd like to make sure things are working for you before I do it.

Thanks,
- -chris

On 11/21/18 09:48, Christopher Schultz wrote:
> Tim,
> 
> On 11/20/18 13:36, Tim K wrote:
>> On Tue, Nov 20, 2018, 12:19 PM Christopher Schultz < 
>> ch...@christopherschultz.net wrote:
> 
>> Tim,
> 
>> On 11/20/18 11:42, Tim K wrote:
>> 
>> Ignore the secure port. The code behind that setting was 
>> never implemented. We really should remove it.
>> 
>> You want:
>> 
>> http://tomcat.apache.org/tomcat-9.0-doc/config/cluster-intercepto
r
>
>> 
.ht
> 
>> 
> ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_At
tr
>>
> 
 ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_At
tr
>
> 
> 
> 
> ibutes
>> 
>> 
>> 
>> Mark
> 
> 
> I'm having some trouble getting it working.  Can you
> provide an example of the new EncryptInterceptor with an
> algorithm and key?
> 
>> Each node in the cluster needs an interceptor configured, like 
>> this:
> 
>> > className="org.apache.catalina.tribes.group.interceptors.EncryptInter
c
>
>> 
ep
> 
> 
> tor"
>> encryptionKey="[the key]" />
> 
>> All nodes need the same key. The default algorithm 
>> (AES/CBC/PKCS12Padding) is sufficient.
> 
>> To generate a key, just get some random garbage and convert it 
>> into hex, like this:
> 
>> $ dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5
> 
>> That'll give you a 128-bit key you can use for encryption. You
>> can also use a 256-bit key if you'd like, or a 192-bit key. For
>> keys larger than 128 bite (32 bytes), you'll need to use a
>> different signature algorithm such as sha1 or later.
> 
>> I just chose MD5 because it generates the right number of output
>>  characters for a 128-bit key. You can get your random key from 
>> anywhere, including pounding on the keyboard. Remember that the 
>> key must be in hex-encoded binary (so only characters 0-9 and 
>> a-f).
> 
>> -chris
>>> 
>>> 
- -
>>>
>>>
>
>>> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>>> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
> 
>> I tried this between 2 nodes but it fails with this error on
>> each:
> 
>> dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5sum 
>> e0f2cdf931e99fdce0453964294f97f3  -
> 
>> > className="org.apache.catalina.tribes.group.interceptors.EncryptInter
c
>
>> 
eptor"
> 
> 
> encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
> 
>> 20-Nov-2018 13:31:20.070 SEVERE 
>> [Tribes-Task-Receiver[Catalina-Channel]-1] 
>> org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.mess
a
>
>> 
geReceived
> 
> 
> Failed to decrypt message
> 
>> javax.crypto.BadPaddingException: Given final block not properly 
>> padded. Such issues can arise if a bad key is used during 
>> decryption.
> 
> Both nodes have the same encryption key, right? The key itself
> looks fine. For example, I dropped that key into the unit test file
> and it worked as expected.
> 
> I've been working on a patch yesterday and today that uses random
> IVs instead of re-using them. It really shouldn't change anything
> about the config, etc. but both nodes will require the new code to
> re-test. I've also expanded the unit tests to cover cipher block
> modes other than CBC.
> 
> I don't actually have a cluster here for testing, though, so 
> everything is being done with the unit tests.
> 
> I thought I had reproduced your issue (BadPaddingException) except
> it turned out that the test itself was wrong and the interceptor
> code was correct.
> 
> Are you able to build from source? I'm about to commit these
> changes to the trunk (9.0.x), which really shouldn't change
> anything for you, but it might fix some edge case that you are
> hitting.
> 
> -chris
> 
> -
>
> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlv1fqoACgkQHPApP6U8
pFhrVBAAiX1HKpmipHpunEQRZBW9JcWKjry+gyt2MyShjJHuui8KepIxcMkpI2TY
HIuckUX4ZPoven6X1ehDjYpm48/wIuMWPoBcOOCKt+EJqWOH3jy7uHx5+zC/32FV
ne8E7It/makhPYY9MbfUCkWgig41/rb/W5QtJQNaosB9/ZOLQzn04gD/JzWGicxJ
uWTEvvxbjTR0NP94pCNWXGnbXUboWItfhqLtUd5C4uLiHAzGQT4sShZY1kK9Osps
M/tHg/r3jhRFWmNxZJZ61jWnqvHShy0ZxU0aqrKbHbUhuCa5PZ1Y8eVkuuapZShy
De65NqUrTwzjg5zxLnHS5euzAkPRdtSlvmkUdcPgbd/i/cMyQTBvxgrnnMiwrOfy
bZT/GgjdEz8/E0dh10VTSBfwpwCg7GasEeEj98q8ndyUqbQymcs6Ddk243TZtqho
NdwYNAvdnC7ShmwwLGKRv+JQiPfn0X2uG7NN58Qm1QORrIy0y4r1w9weUxp6UUP8
1asrBL5mxnBSOunZTszsCm9Q1kkInypLCBE7zWyITqKBrP/yJ9JEvQpZpECapH32

Re: 9.0.13 encrypted cluster traffic

2018-11-21 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

On 11/20/18 13:36, Tim K wrote:
> On Tue, Nov 20, 2018, 12:19 PM Christopher Schultz < 
> ch...@christopherschultz.net wrote:
> 
> Tim,
> 
> On 11/20/18 11:42, Tim K wrote:
> 
> Ignore the secure port. The code behind that setting was
> never implemented. We really should remove it.
> 
> You want:
> 
> http://tomcat.apache.org/tomcat-9.0-doc/config/cluster-interceptor
.ht
>
> 
ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_Attr
> 
>
> 
ibutes
> 
> 
> 
> Mark
 
 
 I'm having some trouble getting it working.  Can you provide
 an example of the new EncryptInterceptor with an algorithm
 and key?
> 
> Each node in the cluster needs an interceptor configured, like
> this:
> 
>  className="org.apache.catalina.tribes.group.interceptors.EncryptInterc
ep
>
> 
tor"
> encryptionKey="[the key]" />
> 
> All nodes need the same key. The default algorithm 
> (AES/CBC/PKCS12Padding) is sufficient.
> 
> To generate a key, just get some random garbage and convert it
> into hex, like this:
> 
> $ dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5
> 
> That'll give you a 128-bit key you can use for encryption. You can 
> also use a 256-bit key if you'd like, or a 192-bit key. For keys 
> larger than 128 bite (32 bytes), you'll need to use a different 
> signature algorithm such as sha1 or later.
> 
> I just chose MD5 because it generates the right number of output 
> characters for a 128-bit key. You can get your random key from 
> anywhere, including pounding on the keyboard. Remember that the
> key must be in hex-encoded binary (so only characters 0-9 and
> a-f).
> 
> -chris
>> 
>> -
>>
>> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
> 
> I tried this between 2 nodes but it fails with this error on each:
> 
> dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5sum 
> e0f2cdf931e99fdce0453964294f97f3  -
> 
>  className="org.apache.catalina.tribes.group.interceptors.EncryptInterc
eptor"
>
> 
encryptionKey="e0f2cdf931e99fdce0453964294f97f3" />
> 
> 20-Nov-2018 13:31:20.070 SEVERE
> [Tribes-Task-Receiver[Catalina-Channel]-1] 
> org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.messa
geReceived
>
> 
Failed to decrypt message
> 
> javax.crypto.BadPaddingException: Given final block not properly
> padded. Such issues can arise if a bad key is used during
> decryption.

Both nodes have the same encryption key, right? The key itself looks
fine. For example, I dropped that key into the unit test file and it
worked as expected.

I've been working on a patch yesterday and today that uses random IVs
instead of re-using them. It really shouldn't change anything about
the config, etc. but both nodes will require the new code to re-test.
I've also expanded the unit tests to cover cipher block modes other
than CBC.

I don't actually have a cluster here for testing, though, so
everything is being done with the unit tests.

I thought I had reproduced your issue (BadPaddingException) except it
turned out that the test itself was wrong and the interceptor code was
correct.

Are you able to build from source? I'm about to commit these changes
to the trunk (9.0.x), which really shouldn't change anything for you,
but it might fix some edge case that you are hitting.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlv1cC0ACgkQHPApP6U8
pFhjuQ/+Mb46dCFqAd1QZqKtvc6BLO/K8/JCQiD8Z10YR0231AMwdCMLGkb7X7Xx
A11KwaOSkISQucp7cLujC3KwlvrVpPBVeQODw7TydGVGtMBXGp+cp2pqhUDRJuZt
9MZM0aQsQSA2udbako77qNo/ISjgytp5ruW4RaHwwj8XauMuAZuQ1KjqXCgXOlfs
DFBkVx4Qcs/YTn0DIuc9YGqROpb+h3VafNZiXXDIhv15ecSnMxqYAH928UA5MTi9
byA3Lq9GlHoKlhaL5IYHGE+UoMds7QKCdSiQti8u/QEhMhXtvH1LPcZy/l3V5Xj+
vklEkXgHef+kPVdwzwGQjQIvnbVl5qppx8wXJvDbY1hNsvgGbtXIj/Z1Xfwzx+BS
6fkGY2vEh5//nZB6REmbT79WByIlQSiOsLixha5LgkC8/li5X2ulXu2791UpmdSr
mHVh06MBjMgaWP0fqELvgC88Q1x0z5O4SmYNka++wDpZYv3ZGE8zgWnaBPkQYLMI
k4xF1udoKM662Zgh/fguKzht2OVRQK1qglm8R3HCtMNWR+EHFefrWlxQebAuKdFL
dSftpA/tD4eaZ+MAN7B7bvj0dArywrQ1sA8EALzdfKfFAxDpLhPPCARLMtxO/Hue
wlVBRUJ/4OdxjcQVZBmytGpQ2mSc3wLsxXslrTYokGq9D9E76fQ=
=w3kX
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-11-20 Thread Tim K 
On Tue, Nov 20, 2018, 12:19 PM Christopher Schultz <
ch...@christopherschultz.net wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Tim,
>
> On 11/20/18 11:42, Tim K wrote:
> >>
> >> Ignore the secure port. The code behind that setting was never
> >> implemented. We really should remove it.
> >>
> >> You want:
> >>
> >> http://tomcat.apache.org/tomcat-9.0-doc/config/cluster-interceptor.ht
> ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_Attr
> 
> ibutes
> >>
> >>
> >>
> Mark
> >
> >
> > I'm having some trouble getting it working.  Can you provide an
> > example of the new EncryptInterceptor with an algorithm and key?
>
> Each node in the cluster needs an interceptor configured, like this:
>
>  className="org.apache.catalina.tribes.group.interceptors.EncryptIntercep
> tor"
> encryptionKey="[the key]" />
>
> All nodes need the same key. The default algorithm
> (AES/CBC/PKCS12Padding) is sufficient.
>
> To generate a key, just get some random garbage and convert it into
> hex, like this:
>
> $ dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5
>
> That'll give you a 128-bit key you can use for encryption. You can
> also use a 256-bit key if you'd like, or a 192-bit key. For keys
> larger than 128 bite (32 bytes), you'll need to use a different
> signature algorithm such as sha1 or later.
>
> I just chose MD5 because it generates the right number of output
> characters for a 128-bit key. You can get your random key from
> anywhere, including pounding on the keyboard. Remember that the key
> must be in hex-encoded binary (so only characters 0-9 and a-f).
>
> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlv0Qg0ACgkQHPApP6U8
> pFhEMg//fqPv9UfiJ0H1XYSEhca0+XANYY11wdJCrUzjFZrBKweZtsPwBm6VErw1
> 65xx/SiBBtcbp317VoBNjrrMtgCWVxNuz9FG6YKqXuWu2PeFSlB9C8vHfsMEce2B
> 1Jk8TixIdw7zWx4IHVgQsPIKvszQ9YsjMeMa2wTK8Us1AB3HEkwHYiV84UckdQmH
> 3oac1rGS+4YxAvpYSe7WF4rRAusKkKLC/1hgbiF+pEPPoax2g8sDW/Upk2ijEWIe
> 5B5qrpH9fJIeuQjsR0xlZWEuyQ3KQpdu9j6DyhJnjAqBFLyyg6TiD3uD3M3ZO3es
> xgwlLd8C0BDS8ZzpvPOyN3IyygEwVas1+v8YHhqJF8VedGfZVkBplGKuNm7Yoqrg
> 1OxGGKCN06cVG+TbH3JzLfuhoYMNN92soqZH+Nm9BUf9G3A5Ll2oTDDYO1peyhHw
> kw3FigfUueNPM/sjb42wJp2QvSm9jpRDr8S/Vrv8SxpKmmwgGM/VDNlDcbccRQ5s
> FtY3inV9KNH7n2+V69yY8at50HKn4pTLvBRFncZ5pLoOE5DfhVt9PZeefMKzAQQd
> LGUJa7Fl+5wovL++Sclaf/MYBJ9BNSg1gpw+P33ga/c63G0JR9lzM9e8xYELJ6Mu
> 44GJAgwGzAOq2/TSimmVEffERRxXRTErRORMgG5Qo8KFDsfoDvo=
> =J0P5
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org


I tried this between 2 nodes but it fails with this error on each:

dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5sum
e0f2cdf931e99fdce0453964294f97f3  -



20-Nov-2018 13:31:20.070 SEVERE [Tribes-Task-Receiver[Catalina-Channel]-1]
org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.messageReceived
Failed to decrypt message

javax.crypto.BadPaddingException: Given final block not properly padded.
Such issues can arise if a bad key is used during decryption.

at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:991)

at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:847)

at
com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:446)

at javax.crypto.Cipher.doFinal(Cipher.java:2164)

at
org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.decrypt(EncryptInterceptor.java:369)

at
org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.messageReceived(EncryptInterceptor.java:114)

at
org.apache.catalina.tribes.group.ChannelInterceptorBase.messageReceived(ChannelInterceptorBase.java:91)

at
org.apache.catalina.tribes.group.interceptors.StaticMembershipInterceptor.messageReceived(StaticMembershipInterceptor.java:96)

at
org.apache.catalina.tribes.group.ChannelInterceptorBase.messageReceived(ChannelInterceptorBase.java:91)

at
org.apache.catalina.tribes.group.ChannelCoordinator.messageReceived(ChannelCoordinator.java:274)

at
org.apache.catalina.tribes.transport.ReceiverBase.messageDataReceived(ReceiverBase.java:261)

at
org.apache.catalina.tribes.transport.nio.NioReplicationTask.drainChannel(NioReplicationTask.java:213)

at
org.apache.catalina.tribes.transport.nio.NioReplicationTask.run(NioReplicationTask.java:101)

at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

at java.lang.Thread.run(Thread.java:748)

Re: 9.0.13 encrypted cluster traffic

2018-11-20 Thread Christopher Schultz 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Tim,

On 11/20/18 11:42, Tim K wrote:
>> 
>> Ignore the secure port. The code behind that setting was never 
>> implemented. We really should remove it.
>> 
>> You want:
>> 
>> http://tomcat.apache.org/tomcat-9.0-doc/config/cluster-interceptor.ht
ml#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_Attr
ibutes
>>
>>
>> 
Mark
> 
> 
> I'm having some trouble getting it working.  Can you provide an
> example of the new EncryptInterceptor with an algorithm and key?

Each node in the cluster needs an interceptor configured, like this:



All nodes need the same key. The default algorithm
(AES/CBC/PKCS12Padding) is sufficient.

To generate a key, just get some random garbage and convert it into
hex, like this:

$ dd if=/dev/urandom bs=128 count=1 2>/dev/null | md5

That'll give you a 128-bit key you can use for encryption. You can
also use a 256-bit key if you'd like, or a 192-bit key. For keys
larger than 128 bite (32 bytes), you'll need to use a different
signature algorithm such as sha1 or later.

I just chose MD5 because it generates the right number of output
characters for a 128-bit key. You can get your random key from
anywhere, including pounding on the keyboard. Remember that the key
must be in hex-encoded binary (so only characters 0-9 and a-f).

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlv0Qg0ACgkQHPApP6U8
pFhEMg//fqPv9UfiJ0H1XYSEhca0+XANYY11wdJCrUzjFZrBKweZtsPwBm6VErw1
65xx/SiBBtcbp317VoBNjrrMtgCWVxNuz9FG6YKqXuWu2PeFSlB9C8vHfsMEce2B
1Jk8TixIdw7zWx4IHVgQsPIKvszQ9YsjMeMa2wTK8Us1AB3HEkwHYiV84UckdQmH
3oac1rGS+4YxAvpYSe7WF4rRAusKkKLC/1hgbiF+pEPPoax2g8sDW/Upk2ijEWIe
5B5qrpH9fJIeuQjsR0xlZWEuyQ3KQpdu9j6DyhJnjAqBFLyyg6TiD3uD3M3ZO3es
xgwlLd8C0BDS8ZzpvPOyN3IyygEwVas1+v8YHhqJF8VedGfZVkBplGKuNm7Yoqrg
1OxGGKCN06cVG+TbH3JzLfuhoYMNN92soqZH+Nm9BUf9G3A5Ll2oTDDYO1peyhHw
kw3FigfUueNPM/sjb42wJp2QvSm9jpRDr8S/Vrv8SxpKmmwgGM/VDNlDcbccRQ5s
FtY3inV9KNH7n2+V69yY8at50HKn4pTLvBRFncZ5pLoOE5DfhVt9PZeefMKzAQQd
LGUJa7Fl+5wovL++Sclaf/MYBJ9BNSg1gpw+P33ga/c63G0JR9lzM9e8xYELJ6Mu
44GJAgwGzAOq2/TSimmVEffERRxXRTErRORMgG5Qo8KFDsfoDvo=
=J0P5
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: 9.0.13 encrypted cluster traffic

2018-11-20 Thread Tim K 
>
> Ignore the secure port. The code behind that setting was never
> implemented. We really should remove it.
>
> You want:
>
> http://tomcat.apache.org/tomcat-9.0-doc/config/cluster-interceptor.html#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_Attributes
>
> Mark
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org


I'm having some trouble getting it working.  Can you provide an example of
the new EncryptInterceptor with an algorithm and key?

Re: 9.0.13 encrypted cluster traffic

2018-11-20 Thread Mark Thomas 
On 20/11/2018 14:52, Tim K wrote:
> I see encrypted cluster traffic has been added to 9.0.13, but upon using a
> securePort on the NioReceiver and StaticMember, I'm still able to see clear
> text information being passed around with Wireshark...  Is there some other
> config to set to take advantage of this new feature?

Ignore the secure port. The code behind that setting was never
implemented. We really should remove it.

You want:
http://tomcat.apache.org/tomcat-9.0-doc/config/cluster-interceptor.html#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_Attributes

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

9.0.13 encrypted cluster traffic

2018-11-20 Thread Tim K 
I see encrypted cluster traffic has been added to 9.0.13, but upon using a
securePort on the NioReceiver and StaticMember, I'm still able to see clear
text information being passed around with Wireshark...  Is there some other
config to set to take advantage of this new feature?

Thank you.