WebSockets Thread Safety question

2013-06-03 Thread Martin Schmiedel
I have recently had problems with a simple WebSocket sample I'm developing.

Tomcat Version is 7.0.39.

When I use the syntax from the samples in the onTextMessage() method, I get
ConcurrentModificationException if I have more than one client sending data
to the server at the same time:

for(MyMessageInbound mmib: mmiList){
CharBuffer buffer = CharBuffer.wrap(cb);
mmib.myoutbound.writeTextMessage(buffer);
mmib.myoutbound.flush();
}


Changing it to the following works fine:

for(int i = 0; i  mmib.size(); i++) {
MyMessageInbound mmib = mmiList.get(i);
CharBuffer buffer = CharBuffer.wrap(cb);
mmib.myoutbound.writeTextMessage(buffer);
mmib.myoutbound.flush();
}

However, this approach is not as efficient as to use an Iterator, unless I
clone the mmiList Collection to iterate over it...


About the mmiList object, why isn't it a Threadsafe Collection?

What's the recommended approach for this?


Regards


Tomcat 6 and Windows Service

2013-06-03 Thread Walter . Heestermans
Hi,

I'm running tomcat as Windows service.

Now I like to add JMX support to the process:

-Dcom.sun.management.jmxremote.port=10150
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false

Configuring the service



added the above options to the Java options. The start is then working 
fine and JMX is working fine. But since I made this service the stop 
operation is not working anymore. When I run via console, then I see that 
the stop is complaining on port (used by JMX), already in use. This is 
propably the root cause of the stop not working. Is there a way to specify 
JVM arguments for only the start operation?

Please advise
Walter


Re: Making sure I understand application startup order correctly

2013-06-03 Thread Mark Thomas
On 01/06/2013 16:59, Nick Williams wrote:
 Off-topic, I should point out that I believe this is also a potential flaw in 
 the Tomcat WebSocket filter registration. It is also mapped 
 isMatchAfter=false. So, if someone were to add similar logging/auth filters 
 to their deployment descriptor, they would only ever match AFTER the 
 WebSocket filter, which I can't imagine would ever be desired. IMO, the 
 WebSocket filter registration needs to be isMatchAfter=true. This would 
 ensure that logging/auth filters in the deployment descriptor matched first, 
 and also eliminate my need to have an absolute-ordering.

Fair point. I'll get that changed.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Scalable WebSocket broadcast with Tomcat 7

2013-06-03 Thread Mark Thomas
On 02/06/2013 21:12, Dimitri wrote:
 Hi,
 
 I am developing a collaboration webapp using Tomcat 7 implementation of
 WebSockets. Imagine we have a 1000+ of connected clients, each of them
 having his own WsOutbound. How do we implement broadcast messages in a
 scalable way? Yet I've seen only examples that do iterate over connected
 clients and send messages in a sequential manner. Obviously, this
 approach doesn't scale to hundreds an thousands of clients.
 
 I've yet come up with a workaround using a fixed ThreadPool executor of
 some 50 threads that do the work in parallel, however, this approach is
 far from perfect, too. I'm wondering if there exists more elegant,
 standard way to do the same, probably employing NIO and multiplexing?

The Tomcat 7 implementation uses blocking IO within a WebSocket frame so
there is no easy way to do what you want to do.

At some point (still TBD) the JSR-356 implementation from Tomcat 8 will
be back-ported to Tomcat 7.

Mark

 I've heard that this will be available in JSR-356 out-of-the-box, but
 the application is going to enter production soon, with TomEE 1.6.0 as
 target platform.
 
 Thanks!
 Dimitri
 
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: WebSockets Thread Safety question

2013-06-03 Thread Mark Thomas
On 03/06/2013 08:45, Martin Schmiedel wrote:
 About the mmiList object, why isn't it a Threadsafe Collection?

Where / how is that object declared?

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: WebSockets Thread Safety question

2013-06-03 Thread chris derham
 When I use the syntax from the samples in the onTextMessage() method, I get
 ConcurrentModificationException if I have more than one client sending data
 to the server at the same time:

 for(MyMessageInbound mmib: mmiList){
 CharBuffer buffer = CharBuffer.wrap(cb);
 mmib.myoutbound.writeTextMessage(buffer);
 mmib.myoutbound.flush();
 }


 Changing it to the following works fine:

 for(int i = 0; i  mmib.size(); i++) {
 MyMessageInbound mmib = mmiList.get(i);
 CharBuffer buffer = CharBuffer.wrap(cb);
 mmib.myoutbound.writeTextMessage(buffer);
 mmib.myoutbound.flush();
 }

 However, this approach is not as efficient as to use an Iterator, unless I
 clone the mmiList Collection to iterate over it...

Can you explain where is the in-efficiency?

Thanks

Chris

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: WebSockets Thread Safety question

2013-06-03 Thread Martin Gainty
/java/utiljavap Collections | grep synchronized
public static java.util.Collection synchronizedCollection(java.util.Collecti
on);
static java.util.Collection synchronizedCollection(java.util.Collection, jav
a.lang.Object);
public static java.util.Set synchronizedSet(java.util.Set);
static java.util.Set synchronizedSet(java.util.Set, java.lang.Object);
public static java.util.SortedSet synchronizedSortedSet(java.util.SortedSet)
;
public static java.util.List synchronizedList(java.util.List);
static java.util.List synchronizedList(java.util.List, java.lang.Object);
public static java.util.Map synchronizedMap(java.util.Map);
public static java.util.SortedMap synchronizedSortedMap(java.util.SortedMap)
;

use java.util.Collections.synchronizedList 

Martin 
__ 
Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité

Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaenger 
sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiterleitung 
oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient lediglich dem 
Austausch von Informationen und entfaltet keine rechtliche Bindungswirkung. 
Aufgrund der leichten Manipulierbarkeit von E-Mails koennen wir keine Haftung 
fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le 
destinataire prévu, nous te demandons avec bonté que pour satisfaire informez 
l'expéditeur. N'importe quelle diffusion non autorisée ou la copie de ceci est 
interdite. Ce message sert à l'information seulement et n'aura pas n'importe 
quel effet légalement obligatoire. Étant donné que les email peuvent facilement 
être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité 
pour le contenu fourni.


 From: ch...@derham.me.uk
 Date: Mon, 3 Jun 2013 07:42:01 -0300
 Subject: Re: WebSockets Thread Safety question
 To: users@tomcat.apache.org
 
  When I use the syntax from the samples in the onTextMessage() method, I get
  ConcurrentModificationException if I have more than one client sending data
  to the server at the same time:
 
  for(MyMessageInbound mmib: mmiList){
  CharBuffer buffer = CharBuffer.wrap(cb);
  mmib.myoutbound.writeTextMessage(buffer);
  mmib.myoutbound.flush();
  }
 
 
  Changing it to the following works fine:
 
  for(int i = 0; i  mmib.size(); i++) {
  MyMessageInbound mmib = mmiList.get(i);
  CharBuffer buffer = CharBuffer.wrap(cb);
  mmib.myoutbound.writeTextMessage(buffer);
  mmib.myoutbound.flush();
  }
 
  However, this approach is not as efficient as to use an Iterator, unless I
  clone the mmiList Collection to iterate over it...
 
 Can you explain where is the in-efficiency?
 
 Thanks
 
 Chris
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 
  

Re: Tomcat 6 and Windows Service

2013-06-03 Thread Konstantin Kolinko
2013/6/3 walter.heesterm...@toyota-europe.com

 Hi,

 I'm running tomcat as Windows service.

 Now I like to add JMX support to the process:

 -Dcom.sun.management.jmxremote.port=10150
 -Dcom.sun.management.jmxremote.ssl=false
 -Dcom.sun.management.jmxremote.authenticate=false

 Configuring the service



 added the above options to the Java options. The start is then working fine 
 and JMX is working fine. But since I made this service the stop operation is 
 not working anymore. When I run via console, then I see that the stop is 
 complaining on port (used by JMX), already in use. This is propably the root 
 cause of the stop not working. Is there a way to specify JVM arguments for 
 only the start operation?


The service wrapper comes from Apache Commons Daemon project.
http://commons.apache.org/proper/commons-daemon/

You are better to ask there.

The things that I would try:
a) add those -D,.. to start arguments setting. (The one that
contains a single argument start by default).

Maybe it works, maybe not.

b) add those properties to conf/catalina.properties file

It would not work if JVM reads them at startup (before the Bootstrap
class runs), but should work if it reads them at a later time.


Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



.net web service client calling Tomcat 7

2013-06-03 Thread Jan Vávra

Hello,
 I have a METRO web service at Tomcat 7.0.39 (S). The service is under 
http basic authentication.
I have written own realm for http basic authentication. The realm's 
implementation is very small. It's something like read ini file with 
username with passwords. Few lines ...

Our customer wrote a .net 4.5 web service client - WCF (C).

When client sends a request there are written 2 lines at tomcat access log:
192.168.1.211 - - [03/Jun/2013:16:02:24 +0200] POST 
/ades-server/adesOperationsWebService HTTP/1.1 401 951
192.168.1.211 - - [01/Jan/1970:00:59:59 +0100] s:Envelope 
xmlns:s=http://schemas.xmlsoap.org/soap/envelope/;s:Body null 400 -


Basically the .net client never sends Authorization header at first time.
I used wireshark to see the communication:

1. C sends packet with http headers.
2. C sends  packet with first part of soap xml request that begins 
s:Envelope ...

3. S replies 401 Unauthorized.
4. S replies 400 Bad Request.
5. S sends RST (reset packet).

The http headers are:

POST http://xxx.xxx.cz:8080/ades-server/adesOperationsWebService HTTP/1.1
Content-Type: text/xml; charset=utf-8
VsDebuggerCausalityData: 
uIDPo/1qFcW8E5lEl/4q6vnckqsAsk/yOV26Z0GeRPNudW6KS8R+D9VgeudJgruTaBNYol8ACQAA

SOAPAction: 
Host: xxx.xxx.cz:8080
Content-Length: 444815
Expect: 100-continue
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

I checked the Content-Length value against really sent data and these 
numbers match.
My questions are. Why tomcat doesn't continue reading data until the 
whole request is read? Is it some configurable option? Is it against a 
DOS attack?


I think that the reasons why tomcat considers  (2) as a new http request 
are:

  - not reading the full request data according the value Content-Length
  - Connection: Keep-Alive

I also tried curl client with intentionally not specifying Authorization 
header. Curl client doesn't send packet with data (2), but curl also 
complaints with message:

* HTTP error before end of send, stop sending

Thanks for any advice.
Jan.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat 6 and Windows Service

2013-06-03 Thread Jeffrey Janner
 From: walter.heesterm...@toyota-europe.com 
 [mailto:walter.heesterm...@toyota-europe.com] 
 Sent: Monday, June 03, 2013 3:01 AM
 To: users@tomcat.apache.org
 Subject: Tomcat 6 and Windows Service

 Hi, 

 I'm running tomcat as Windows service. 

 Now I like to add JMX support to the process: 

 -Dcom.sun.management.jmxremote.port=10150 
 -Dcom.sun.management.jmxremote.ssl=false 
 -Dcom.sun.management.jmxremote.authenticate=false 

 Configuring the service 



 added the above options to the Java options. The start is then working fine 
 and JMX is working fine. But since I made this service the  stop operation 
 is not working anymore. When I run via console, then I see that the stop is 
 complaining on port (used by JMX), already  in use. This is propably the 
 root cause of the stop not working. Is there a way to specify JVM arguments 
 for only the start operation? 

 Please advise 
 Walter 

Never seen that happen before.  Normally you'd get port in use errors on 
startup.
You are missing one line from your configuration. At the top you need:
  -Dcom.sun.management.jmxremote
Add that line and try a different port number.
Jeff


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: .net web service client calling Tomcat 7

2013-06-03 Thread Bean William R
When client sends a request there are written 2 lines at tomcat access log:
192.168.1.211 - - [03/Jun/2013:16:02:24 +0200] POST 
/ades-server/adesOperationsWebService HTTP/1.1 401 951
192.168.1.211 - - [01/Jan/1970:00:59:59 +0100] s:Envelope 
xmlns:s=http://schemas.xmlsoap.org/soap/envelope/;s:Body null 400 -

Basically the .net client never sends Authorization header at first time.
I used wireshark to see the communication:

1. C sends packet with http headers.
2. C sends  packet with first part of soap xml request that begins s:Envelope 
...
3. S replies 401 Unauthorized.
4. S replies 400 Bad Request.
5. S sends RST (reset packet).

I can't offer an answer, but sympathy and a workaround:

We ran into this exact same issue when we moved to Apache httpd webservers.  We 
opted to disable keepalive for MS Web Services clients with:

BrowserMatch MS Web Services nokeepalive

rather than fighting an RFC interpretation battle... 

It looks like similar could be done in tomcat with restrictedUserAgents 
option on the http connector: 
http://tomcat.apache.org/tomcat-7.0-doc/config/http.html

-- Bill

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat 6 and Windows Service

2013-06-03 Thread Caldarale, Charles R
 From: Jeffrey Janner [mailto:jeffrey.jan...@polydyne.com] 
 Subject: RE: Tomcat 6 and Windows Service

 You are missing one line from your configuration. At the top you need:
   -Dcom.sun.management.jmxremote

That hasn't been needed for many years (if ever).  Setting any of the 
com.sun.management.jmxremote.* properties enables JMX, at least on 
Sun/Oracle/OpenJDK JVMs.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



IE 8 and before refusing to download files (I hate IE)

2013-06-03 Thread Jeffrey Janner
Ran into an interesting problem today.  It seems that IE8 and before no longer 
likes how we are sending BLOB files.
Worked last week as far as we can tell.  Works fine for IE9+ and other 
browsers, but IE8 is suddenly giving us an error message, as though it is 
ignoring the response headers.
I'm not going to completely rule out the possibility it is in our code 
somewhere, but we haven't found it yet.  We did also upgrade out app over the 
weekend, but the problem didn't show up in our test environment (as far as we 
can tell).
Here is the relevant code:


protected void viewAction(ServletContext ctx, HttpServletRequest req, 
HttpServletResponse rsp)
throws ServletException, IOException, PolyError {
// Get beans
ReportDashboardBean bean = (ReportDashboardBean) 
session.getAttribute(SessionConstants.REPORT_DASHBOARD_BEAN);

// get request data
int row = userBean.getLongValue(req, ROW).intValue();
ReportContentBean conBean = (ReportContentBean) 
bean.getContentList().get(row);

//System.out.println(***  + conBean.getFilename(false));

rsp.setContentType(conBean.getDbObject().getMimeType());
StringBuilder sbContentDisposition = new StringBuilder();
if (conBean.getDbObject().getMimeType().indexOf(text/html) = 0) {
sbContentDisposition.append(inline; );  // streamline output 
automatically
} else {
sbContentDisposition.append(attachment; );  // ask user to open 
or save content
}

sbContentDisposition.append(filename=).append(conBean.getFilename(false)).append(;);

rsp.setHeader(Content-Disposition, sbContentDisposition.toString());
conBean.getDbObject().getContent(rsp.getOutputStream());
   }

Works great if the MimeType is text/html, but anything else generates an error.
The getContent routine reads from the BLOB and copies it to the response output 
stream.
None of this code has changed, and the access log shows a 200 response and the 
full number of bytes of the file.

Anybody have any ideas?

Server1 specs: Tomcat 6.0.33/Java 1.6.0_33/Windows 2003 SP2
Server2 specs: Tomcat 6.0.36/Java 1.6.0_34/Windows 2008 R2/SP1


Jeffrey Janner
Sr. Network Administrator
jeffrey.jan...@polydyne.commailto:first.l...@polydyne.com
PolyDyne Software Inc.
Main:   512.343.9100
Direct:  512.583.8930

 [cid:image002.png@01CC0FB7.4FF43CE0]

Speed, Intelligence  Savings in Sourcing



Re: IE 8 and before refusing to download files (I hate IE)

2013-06-03 Thread verlag.preis...@t-online.de
Hi,

-Original-Nachricht-
 Von: Jeffrey Janner jeffrey.jan...@polydyne.com
 An: 'Tomcat Users List' users@tomcat.apache.org

 Ran into an interesting problem today.  It seems that IE8 and before
 no longer likes how we are sending BLOB files.
 
 Worked last week as far as we can tell.  Works fine for IE9+ and other
 browsers, but IE8 is suddenly giving us an error message, as though it
 is ignoring the response headers.
 
 I'm not going to completely rule out the possibility it is in our code
 somewhere, but we haven't found it yet.  We did also upgrade out app
 over the weekend, but the problem didn't show up in our test
 environment (as far as we can tell).
 
 Here is the relevant code:
 
[...]
 
 Works great if the MimeType is text/html, but anything else generates
 an error.
 
 The getContent routine reads from the BLOB and copies it to the
 response output stream.
 
 None of this code has changed, and the access log shows a 200
 response and the full number of bytes of the file.
 
 Anybody have any ideas?
 
 Server1 specs: Tomcat 6.0.33/Java 1.6.0_33/Windows 2003 SP2
 Server2 specs: Tomcat 6.0.36/Java 1.6.0_34/Windows 2008 R2/SP1


can you give an example of the actual HTTP response headers that are sent to 
the client?

I just tested that the following response works with IE8 on WinXP and IE10 
using its IE8-Mode on WIndows 8:

HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: application/x-zip-compressed
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=Portal.zip
Date: Mon, 03 Jun 2013 18:14:14 GMT

[...]

This is generated by a Servlet on Tomcat 7.0.40 that sets the Content-Type and 
Content-Disposition headers and then writes bytes to the respone's OutputStream 
(the response is served by IIS/7.5 using ISAPI Redirector). For 
Content-Disposition, I'm using javax.mail.internet.ContentDisposition which 
should automatically add necessary escaping and quoting to the filename: part.

I also tested with IE10's IE7-Mode that is used when activating Compatibility 
View and no X-UA-Compatible header is present that tells IE to use it's highest 
browser mode (like X-UA-Compatible: IE=Edge).

(As an aside, for my websites I don't support any IE below IE9... ;-)  However, 
I use the X-UA-Compatible: IE=Edge header to prevent IE to use the 
compatibility mode, which can happen if Microsoft suddenly decides to add your 
site to its compatibility view list, or sometimes if IE is embedded as 
ActiveX control etc...)


Regards,
Konstantin Preißer



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat7 and SPNEGO configuration questions

2013-06-03 Thread Edward Siewick
Felix  Friends,

I've made a fair amount of progress, though I'm still not able to log in with a 
domain credential. The domain account ID doesn't appear in the Tomcat7 logging 
at all, though it is in tomcat-users.xml. So I might now only be confused as to 
the syntax of: server.xml for JAAS; the webapp's realm bits in web.xml for 
SPNEGO, or; tomcat-users.xml. I have tried changing tomcat-users.xml to 
OPENIDMDEV/esiewick, COM.OPENIDMDEV/esiewick and just esiewick. And, I've 
adjusted the Account ID in the Windows Security prompt to match each of these.

On the progress, here's some detail for the listserv archive.

A first issue was how I was trying to get the CATALINA_OPTS set, so I should 
start with a Thank you for nudging me on the CATALINA_OPTS bit. I had tried 
to add CATALINA_OPTS  to the init.d script, which apparently was getting 
over-written later in the Tomcat7 startup sequence. To correct, I simply added 
-Dsun.security.krb5.debug=true -Dsun.security.jgss.debug=true to the 
bin/setenv.sh, vice the init.d script. After this, debug=true appeared properly 
in the resulting process, below.

ps ajx | grep tomc
27474 29541 29541 27446 pts/329541 S+   0   0:00 tail -f 
/var/log/tomcat7/catalina.out
1 29585 29571 27391 pts/029626 Sl   0   0:36 
/usr/java/jre1.6.0_39/bin/java
 -Djava.util.logging.config.file=/usr/share/tomcat7c/conf/logging.properties
 -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
 -Xmx512m -XX:MaxPermSize=256m -XX:PermSize=256m
 -Dsun.security.krb5.debug=true -Dsun.security.jgss.debug=true
 -Djava.endorsed.dirs=/usr/share/tomcat7c/endorsed
 -classpath 
/usr/share/tomcat7c/bin/bootstrap.jar:/usr/share/tomcat7c/bin/tomcat-juli.jar
 -Dcatalina.base=/usr/share/tomcat7c -Dcatalina.home=/usr/share/tomcat7c
 -Djava.io.tmpdir=/usr/share/tomcat7c/temp 
org.apache.catalina.startup.Bootstrap start

This changed the error logging, adding a clue that smelled like a crypto module 
limitation:

Found unsupported keytype (18) for 
HTTP/openid-linux.openidmdev@openidmdev.com

The trace was:

Debug is  true storeKey true useTicketCache false useKeyTab true doNotPrompt 
true ticketCache is null isInitiator true KeyTab is 
/usr/share/tomcat7c/conf/tomcat7.keytab refreshKrb5Config is false principal is 
HTTP/openid-linux.openidmdev@openidmdev.com tryFirstPass is false 
useFirstPass is false storePass is false clearPass is false
 KeyTabInputStream, readName(): OPENIDMDEV.COM
 KeyTabInputStream, readName(): HTTP
 KeyTabInputStream, readName(): openid-linux.openidmdev.com
 KeyTab: load() entry length: 98; type: 18
Found unsupported keytype (18) for 
HTTP/openid-linux.openidmdev@openidmdev.com
Key for the principal HTTP/openid-linux.openidmdev@openidmdev.com not 
available in /usr/share/tomcat7c/conf/tomcat7.keytab
[Krb5LoginModule] authentication failed
Unable to obtain password from user

In 
http://docs.oracle.com/javase/6/docs/technotes/guides/security/jgss/jgss-features.html
I found:

NOTE: The JCE framework within JDK includes an ability to enforce restrictions 
regarding the cryptographic algorithms and maximum cryptographic strengths 
available to applications. Such restrictions are specified in jurisdiction 
policy files. The jurisdiction policy files bundled in Java SE limits the 
maximum key length. Hence, in order to use AES256 encryption type, you will 
need to install the JCE crypto policy with the unlimited version to allow AES 
with 256-bit key.

So, the second issue pertained to cryptography limitations set in 
/usr/java/jre1.6.0_39/lib/security/. The tomcat7.keytab was created only with 
aes256-cts-hmac-sha1-96 and the /etc/krb5.conf has a likewise limited suite. 
The fix was to download Oracle's jce_policy-6.zip, unzip it, and copy the 
unlimited versions of local_policy.jar and US_export_policy.jar into 
/usr/java/jre1.6.0_39/lib/security/.

After the jce_policy-6.zip *.jar files were in place, I got:

Debug is  true storeKey true useTicketCache false useKeyTab true doNotPrompt 
true ticketCache is null isInitiator true KeyTab is 
/usr/share/tomcat7c/conf/tomcat7.keytab refreshKrb5Config is false principal is 
HTTP/openid-linux.openidmdev@openidmdev.com tryFirstPass is false 
useFirstPass is false storePass is false clearPass is false
 KeyTabInputStream, readName(): OPENIDMDEV.COM
 KeyTabInputStream, readName(): HTTP
 KeyTabInputStream, readName(): openid-linux.openidmdev.com
 KeyTab: load() entry length: 98; type: 18
Added key: 18version: 0
Ordering keys wrt default_tkt_enctypes list
default etypes for default_tkt_enctypes: 18.
0: EncryptionKey: keyType=18 kvno=0 keyValue (hex dump)=
: F3 27 EC F5 C3 55 4D E0   01 F5 40 7E DB 2F DB 0C  .'...UM...@../..
0010: F6 4C 17 56 91 A6 A6 D4   3C 4B 5A BE F6 41 49 07  .L.VKZ..AI.

principal's key obtained from the keytab
Acquire TGT using AS Exchange
 KdcAccessibility: reset
default etypes for default_tkt_enctypes: 18.
 KrbAsReq calling createMessage
 KrbAsReq 

Re: WebSockets Thread Safety question

2013-06-03 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Chris,

On 6/3/13 6:42 AM, chris derham wrote:
 When I use the syntax from the samples in the onTextMessage()
 method, I get ConcurrentModificationException if I have more than
 one client sending data to the server at the same time:
 
 for(MyMessageInbound mmib: mmiList){ CharBuffer buffer =
 CharBuffer.wrap(cb); mmib.myoutbound.writeTextMessage(buffer); 
 mmib.myoutbound.flush(); }
 
 
 Changing it to the following works fine:
 
 for(int i = 0; i  mmib.size(); i++) { MyMessageInbound mmib =
 mmiList.get(i); CharBuffer buffer = CharBuffer.wrap(cb); 
 mmib.myoutbound.writeTextMessage(buffer); 
 mmib.myoutbound.flush(); }
 
 However, this approach is not as efficient as to use an Iterator,
 unless I clone the mmiList Collection to iterate over it...
 
 Can you explain where is the in-efficiency?

+1 -- the compiler generates pretty much identical bytecode in either
case.

I suppose having less actual code is a nice thing; I tend to agree
with that sentiment.

What I'd like to know is why there is a difference /at all/ in the two
code samples shown above.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJRrPPTAAoJEBzwKT+lPKRYkEsP/AiTKqT+ZM2uH9tmi2Ktcm2F
yjtSNQHW/iCp3aGZH+GsQf82FulpZh81j/fRAKJNf/5EWX8LQEdXZt7+r3OvlVs/
t0gF0CWgmyyF0blHu0L8/0uE4n1j+9fNpNdSKveQdfnXNoJ+3OAUd9FtkJfRz3cv
/VnIbztxmTdVtpFXRLCNLHSDd13zHKK8+KW/jE7W0aoQlxDFcnozdOniDZgvoIgv
r5YwgeZTdNLDf703DfspjjWkqc4rp1LVKjBAUcIbIIvqXMlNiXWrTWrMXHatcOQY
6pNJxmWXB05IOCzK39U2VX7v9vkbrh/8tpbNgM15MRoJlwm2sGwHHRCNWrgvS9Pj
YNVWaz/gED4GKVzs2ky+wYu1OQwVTOW3IJPktIORuf8w6RdPC9tHbzE7JdVBGabj
2vJ6t6xqHiEAw0deQPUvVZqvOWRELR+Zs1+++ESPswnl2Dn50QobN1JRVqmEEtVn
ZTxQE8onwCxv92yv4R5Yy/NtrHD8g02kMm12YqlFlT73fSGN+GR+uq0fgN8nYv1A
QIbVpZ4essX7LrhQ8HvRaiFX0RjwLiUHVlPDOagnHO4KFp+ttQK6DL19444Jv9Y/
gXCe1eFEexzF2MBdeNV+j3HjQCmCVJkGiCGoEXAwEKli5orNl8+WNts7TybAFIgg
n2HAWhN0WaU+/G8pEc3r
=DGKf
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat 6 and Windows Service

2013-06-03 Thread Jeffrey Janner
 -Original Message-
 From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com]
 Sent: Monday, June 03, 2013 12:50 PM
 To: Tomcat Users List
 Subject: RE: Tomcat 6 and Windows Service
 
  From: Jeffrey Janner [mailto:jeffrey.jan...@polydyne.com]
  Subject: RE: Tomcat 6 and Windows Service
 
  You are missing one line from your configuration. At the top you
 need:
-Dcom.sun.management.jmxremote
 
 That hasn't been needed for many years (if ever).  Setting any of the
 com.sun.management.jmxremote.* properties enables JMX, at least on
 Sun/Oracle/OpenJDK JVMs.
 
  - Chuck
 
Thanks Chuck.  Last I looked, it still says to use it in the Tomcat Docs.
Jeff


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: IE 8 and before refusing to download files (I hate IE)

2013-06-03 Thread Jeffrey Janner
 -Original Message-
 From: verlag.preis...@t-online.de [mailto:verlag.preis...@t-online.de]
 Sent: Monday, June 03, 2013 1:28 PM
 To: Tomcat Users List
 Subject: Re: IE 8 and before refusing to download files (I hate IE)
 
 Hi,
 
 -Original-Nachricht-
  Von: Jeffrey Janner jeffrey.jan...@polydyne.com
  An: 'Tomcat Users List' users@tomcat.apache.org
 
  Ran into an interesting problem today.  It seems that IE8 and before
  no longer likes how we are sending BLOB files.
 
  Worked last week as far as we can tell.  Works fine for IE9+ and
 other
  browsers, but IE8 is suddenly giving us an error message, as though
 it
  is ignoring the response headers.
 
  I'm not going to completely rule out the possibility it is in our
 code
  somewhere, but we haven't found it yet.  We did also upgrade out app
  over the weekend, but the problem didn't show up in our test
  environment (as far as we can tell).
 
  Here is the relevant code:
 
 [...]
 
  Works great if the MimeType is text/html, but anything else generates
  an error.
 
  The getContent routine reads from the BLOB and copies it to the
  response output stream.
 
  None of this code has changed, and the access log shows a 200
 response
  and the full number of bytes of the file.
 
  Anybody have any ideas?
 
  Server1 specs: Tomcat 6.0.33/Java 1.6.0_33/Windows 2003 SP2
  Server2 specs: Tomcat 6.0.36/Java 1.6.0_34/Windows 2008 R2/SP1
 
 
 can you give an example of the actual HTTP response headers that are
 sent to the client?
 
 I just tested that the following response works with IE8 on WinXP and
 IE10 using its IE8-Mode on WIndows 8:
 
 HTTP/1.1 200 OK
 Transfer-Encoding: chunked
 Content-Type: application/x-zip-compressed
 Server: Microsoft-IIS/7.5
 Content-Disposition: attachment; filename=Portal.zip
 Date: Mon, 03 Jun 2013 18:14:14 GMT
 
 [...]
 
 This is generated by a Servlet on Tomcat 7.0.40 that sets the Content-
 Type and Content-Disposition headers and then writes bytes to the
 respone's OutputStream (the response is served by IIS/7.5 using ISAPI
 Redirector). For Content-Disposition, I'm using
 javax.mail.internet.ContentDisposition which should automatically add
 necessary escaping and quoting to the filename: part.
 
 I also tested with IE10's IE7-Mode that is used when activating
 Compatibility View and no X-UA-Compatible header is present that tells
 IE to use it's highest browser mode (like X-UA-Compatible: IE=Edge).
 
 (As an aside, for my websites I don't support any IE below IE9... ;-)
 However, I use the X-UA-Compatible: IE=Edge header to prevent IE to
 use the compatibility mode, which can happen if Microsoft suddenly
 decides to add your site to its compatibility view list, or sometimes
 if IE is embedded as ActiveX control etc...)
 
 
 Regards,
 Konstantin Preißer
 

The error presented is Internet Explorer cannot download from servlet from 
host-url.  Internet Explorer was unable to open this Internet site. The 
request site is either unavailable for cannot be found. Please try again later.

But figured it just now.
I had removed the line 
  Valve className=org.apache.catalina.authenticator.SSLAuthenticator 
securePagesWithPragma=false /
from my context files as it wasn't supposed to be needed, since we don't do SSL 
Authentication for logins.
However, apparently it is setting something in the response header that matters 
as a side effect of being there.
Now I just need to find out what so I can duplicate it with a filter.

Jeff


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: IE 8 and before refusing to download files (I hate IE)

2013-06-03 Thread Jeffrey Janner
 -Original Message-
 From: Jeffrey Janner [mailto:jeffrey.jan...@polydyne.com]
 Sent: Monday, June 03, 2013 3:39 PM
 To: 'Tomcat Users List'; 'verlag.preis...@t-online.de'
 Subject: RE: IE 8 and before refusing to download files (I hate IE)
 
  -Original Message-
  From: verlag.preis...@t-online.de [mailto:verlag.preisser@t-
 online.de]
  Sent: Monday, June 03, 2013 1:28 PM
  To: Tomcat Users List
  Subject: Re: IE 8 and before refusing to download files (I hate IE)
 
  Hi,
 
  -Original-Nachricht-
   Von: Jeffrey Janner jeffrey.jan...@polydyne.com
   An: 'Tomcat Users List' users@tomcat.apache.org
 
   Ran into an interesting problem today.  It seems that IE8 and
 before
   no longer likes how we are sending BLOB files.
  
   Worked last week as far as we can tell.  Works fine for IE9+ and
  other
   browsers, but IE8 is suddenly giving us an error message, as though
  it
   is ignoring the response headers.
  
   I'm not going to completely rule out the possibility it is in our
  code
   somewhere, but we haven't found it yet.  We did also upgrade out
 app
   over the weekend, but the problem didn't show up in our test
   environment (as far as we can tell).
  
   Here is the relevant code:
  
  [...]
  
   Works great if the MimeType is text/html, but anything else
   generates an error.
  
   The getContent routine reads from the BLOB and copies it to the
   response output stream.
  
   None of this code has changed, and the access log shows a 200
  response
   and the full number of bytes of the file.
  
   Anybody have any ideas?
  
   Server1 specs: Tomcat 6.0.33/Java 1.6.0_33/Windows 2003 SP2
   Server2 specs: Tomcat 6.0.36/Java 1.6.0_34/Windows 2008 R2/SP1
 
 
  can you give an example of the actual HTTP response headers that are
  sent to the client?
 
  I just tested that the following response works with IE8 on WinXP and
  IE10 using its IE8-Mode on WIndows 8:
 
  HTTP/1.1 200 OK
  Transfer-Encoding: chunked
  Content-Type: application/x-zip-compressed
  Server: Microsoft-IIS/7.5
  Content-Disposition: attachment; filename=Portal.zip
  Date: Mon, 03 Jun 2013 18:14:14 GMT
 
  [...]
 
  This is generated by a Servlet on Tomcat 7.0.40 that sets the
 Content-
  Type and Content-Disposition headers and then writes bytes to the
  respone's OutputStream (the response is served by IIS/7.5 using ISAPI
  Redirector). For Content-Disposition, I'm using
  javax.mail.internet.ContentDisposition which should automatically add
  necessary escaping and quoting to the filename: part.
 
  I also tested with IE10's IE7-Mode that is used when activating
  Compatibility View and no X-UA-Compatible header is present that
 tells
  IE to use it's highest browser mode (like X-UA-Compatible:
 IE=Edge).
 
  (As an aside, for my websites I don't support any IE below IE9... ;-)
  However, I use the X-UA-Compatible: IE=Edge header to prevent IE to
  use the compatibility mode, which can happen if Microsoft suddenly
  decides to add your site to its compatibility view list, or
  sometimes if IE is embedded as ActiveX control etc...)
 
 
  Regards,
  Konstantin Preißer
 
 
 The error presented is Internet Explorer cannot download from
 servlet from host-url.  Internet Explorer was unable to open this
 Internet site. The request site is either unavailable for cannot be
 found. Please try again later.
 
 But figured it just now.
 I had removed the line
   Valve className=org.apache.catalina.authenticator.SSLAuthenticator
 securePagesWithPragma=false / from my context files as it
 wasn't supposed to be needed, since we don't do SSL Authentication for
 logins.
 However, apparently it is setting something in the response header that
 matters as a side effect of being there.
 Now I just need to find out what so I can duplicate it with a filter.
 
 Jeff
 

For those who might be interested, here are the two header sets returned:

Without SSLAuthenticator:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: No-cache
Cache-Control: no-cache
Expires: Wed, 31 Dec 1969 18:00:00 CST
Content-Disposition: attachment; 
filename=SITE_VIEW_COST_SAVING_PART_NUMBER_%26QUOT%3BQUOTES_IN_PROJ_SV%26QUOT%3B_20130603.xls;
Content-Type: application/vnd.ms-excel
Transfer-Encoding: chunked
Date: Mon, 03 Jun 2013 22:34:41 GMT

With SSLAuthenticator:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 18:00:00 CST
Content-Disposition: attachment; 
filename=SITE_VIEW_COST_SAVING_PART_NUMBER_%26QUOT%3BQUOTES_IN_PROJ_SV%26QUOT%3B_20130603.xls;
Content-Type: application/vnd.ms-excel
Transfer-Encoding: chunked
Date: Mon, 03 Jun 2013 22:29:41 GMT

Note the only real difference is the addition of a Pragma header.  Apparently, 
this is giving IE8 and earlier fits.
Anybody know how to disable the Pragma being added without using the 
SSLAuthenticator Valve?  Or remove it?

Jeff



Re: IE 8 and before refusing to download files (I hate IE)

2013-06-03 Thread Michael-O

Am 2013-06-04 00:40, schrieb Jeffrey Janner:

[..]
For those who might be interested, here are the two header sets returned:

Without SSLAuthenticator:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: No-cache
Cache-Control: no-cache
Expires: Wed, 31 Dec 1969 18:00:00 CST
Content-Disposition: attachment; 
filename=SITE_VIEW_COST_SAVING_PART_NUMBER_%26QUOT%3BQUOTES_IN_PROJ_SV%26QUOT%3B_20130603.xls;
Content-Type: application/vnd.ms-excel
Transfer-Encoding: chunked
Date: Mon, 03 Jun 2013 22:34:41 GMT

With SSLAuthenticator:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 18:00:00 CST
Content-Disposition: attachment; 
filename=SITE_VIEW_COST_SAVING_PART_NUMBER_%26QUOT%3BQUOTES_IN_PROJ_SV%26QUOT%3B_20130603.xls;
Content-Type: application/vnd.ms-excel
Transfer-Encoding: chunked
Date: Mon, 03 Jun 2013 22:29:41 GMT

Note the only real difference is the addition of a Pragma header.  Apparently, 
this is giving IE8 and earlier fits.
Anybody know how to disable the Pragma being added without using the 
SSLAuthenticator Valve?  Or remove it?


Hi Jeff,

I have observed this stupid IE behavior a couple of years ago. Took me 
almost a day to figure out. Though I use an authenticator in Tomcat 
which sets securePagesWithPragma to false.


Have you considered searching Tomcat's source code -- or better yet 
writing an always-pass-through authenticator which sets this flag by 
default?


Michael

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org