This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 85d7b3a067245b1fef7a2b80e303f9847b6c765b Author: Mark Thomas <[email protected]> AuthorDate: Thu Sep 24 11:04:54 2026 +0100 Fix various edge cases for secure only configurations --- .../tribes/group/interceptors/TcpFailureDetector.java | 17 ++++++++++++++++- .../apache/catalina/tribes/membership/MemberImpl.java | 2 +- .../catalina/tribes/transport/nio/NioReceiver.java | 2 ++ 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/java/org/apache/catalina/tribes/group/interceptors/TcpFailureDetector.java b/java/org/apache/catalina/tribes/group/interceptors/TcpFailureDetector.java index 4f9a83bf88..be1c15d79e 100644 --- a/java/org/apache/catalina/tribes/group/interceptors/TcpFailureDetector.java +++ b/java/org/apache/catalina/tribes/group/interceptors/TcpFailureDetector.java @@ -32,6 +32,7 @@ import org.apache.catalina.tribes.ChannelMessage; import org.apache.catalina.tribes.Member; import org.apache.catalina.tribes.RemoteProcessException; import org.apache.catalina.tribes.group.ChannelInterceptorBase; +import org.apache.catalina.tribes.group.GroupChannel; import org.apache.catalina.tribes.group.InterceptorPayload; import org.apache.catalina.tribes.io.ChannelData; import org.apache.catalina.tribes.io.XByteBuffer; @@ -419,9 +420,23 @@ public class TcpFailureDetector extends ChannelInterceptorBase implements TcpFai return false; } + boolean channelSecure = getChannel() instanceof GroupChannel groupChannel && groupChannel.getSecure(); + boolean useSecurePort = channelSecure || mbr.getSecurePort() >= 0 && mbr.getPort() < 0; + int port = useSecurePort ? mbr.getSecurePort() : mbr.getPort(); + if (port < 0) { + // no usable port to connect to, so the member can't be checked + return false; + } + // the plaintext test message can't be spoken to a TLS-only listener, so a secure port check is + // limited to a plain TCP connect + if (useSecurePort) { + sendTest = false; + readTest = false; + } + try (Socket socket = new Socket()) { InetAddress ia = InetAddress.getByAddress(mbr.getHost()); - InetSocketAddress addr = new InetSocketAddress(ia, mbr.getPort()); + InetSocketAddress addr = new InetSocketAddress(ia, port); socket.setSoTimeout((int) readTimeout); socket.connect(addr, (int) conTimeout); if (sendTest) { diff --git a/java/org/apache/catalina/tribes/membership/MemberImpl.java b/java/org/apache/catalina/tribes/membership/MemberImpl.java index ded0596239..a54eb43240 100644 --- a/java/org/apache/catalina/tribes/membership/MemberImpl.java +++ b/java/org/apache/catalina/tribes/membership/MemberImpl.java @@ -56,7 +56,7 @@ public class MemberImpl implements Member, java.io.Externalizable { /** * The tcp listen port for this member */ - protected volatile int port; + protected volatile int port = -1; /** * The udp listen port for this member */ diff --git a/java/org/apache/catalina/tribes/transport/nio/NioReceiver.java b/java/org/apache/catalina/tribes/transport/nio/NioReceiver.java index 7aa1a617b4..49acb3238b 100644 --- a/java/org/apache/catalina/tribes/transport/nio/NioReceiver.java +++ b/java/org/apache/catalina/tribes/transport/nio/NioReceiver.java @@ -234,6 +234,8 @@ public class NioReceiver extends ReceiverBase implements Runnable, NioReceiverMB } startSecureListener(); if (tlsOnly) { + // Disable non-secure port + setPort(-1); setListen(true); return; } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
