RE: TC 3.3.3 with Apache stack space error

2002-01-31 Thread Tomas Rokicki

Be aware that glibc sometimes puts some heap allocations in
shared library space rather than heap space using mmap,
especially if you have large ones (as a 400M starting heap
would seem to indicate).  See if you can determine if this
is happening; top will show the library allocations as LIB.
Maybe there is something wrong here.

Also, when glibc uses LIB and when it uses DATA is
configurable by some strange environment variables
The variables are something like M_MMAP_THRESHOLD and
M_MMAP_MAX.

-tom

-Original Message-
From: GOMEZ Henri [mailto:[EMAIL PROTECTED]]
Sent: Thursday, January 31, 2002 3:31 PM
To: Tomcat Developers List
Subject: RE: TC 3.3.3 with Apache stack space error


Hi Ray


After some testing, I have made some observations that might be worth
something, or maybe not...

I installed Redhat 7.2 w/tomcat3.3a-2.  I used all RPMS to do this
(including the tomcat-mod-3.3-1 rpm.)  I got the stack space
error.  So,
I installed a redhat 7.1, same exact tomcat RPM's, and it worked fine..
So, I applied all the update RPM's from the redhat errata, and
the stack
space error came back.  The RPM's included kernel 2.4.9-21 and
glibc-2.2.4-19.3 (and of course a bunch more that probably
don't matter)

Did you got the problem in Apache with mod_jk or just tomcat 3.3
stand alone ?

I am still using the IBM 1.3 JDK.

It appears that if I don't update reddhat 7.1's glibc RPM's, everything
should be fine.

I think I might have seen something else on the list about glibc, so
apologies if this is all just redundant..

All the RPMs are today built under Redhat 6.2.

I feel that we may have a glibc 2.2 problem.
Could you try to rebuild tomcat-mod source RPM ?

--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]



--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]




RE: TC 3.3.3 with Apache stack space error

2002-01-31 Thread Tomas Rokicki

Have you considered using the ss command line argument
(varies from JVM to JVM; java -X usually tells you what to
do; sometimes it's -Xoss and/or -Xss; usually parameters
like 64k are sufficient but sometimes you may need to go
higher . . .

-Original Message-
From: Ray Pitmon [mailto:[EMAIL PROTECTED]]
Sent: Monday, January 07, 2002 1:12 PM
To: [EMAIL PROTECTED]
Subject: Re: TC 3.3.3 with Apache stack space error


Originally sent to tomcat-user, but here may be a better place for this.

Why do I have to start java with -Xms400m -Xmx500m to get it to compile
JSP pages?

(see below for a better description of the problem)

Ok, that works.  I tried all sorts of different values less than that,
but -Xms needed to be 400 to get it to work.

That doesn't make alot of sense to me.
My tomcat is using 32 megs of RAM now.

Why in the world would I have to specify that it use 400-500 megs?

Is this a bug?

thx,

-Ray




On Mon, 2002-01-07 at 10:27, Renato wrote:
 Try to put something like -Xms400m -Xmx500m on TOMCAT_OPTS of
tomcat.sh in
 the $TOMCAT_HOME/bin directory.


 On 07 Jan 2002 12:08:44 -0600, Ray Pitmon [EMAIL PROTECTED]
escreveu :

 
 
  Hi,
 
  I have many machines running older versions of tomcat(3.2.x), but
now I
  am setting up a new one, with 3.3.1, and I get this error whenever I
try
  to hit a JSP:
 
  2002-01-07 12:41:21 - Ctx() : compile error: req=R(  + /index.jsp +
  null) - org.apache.jasper.JasperException: Unable to compile The
  compiler has run out of stack space.  Consider using the
  -J-ossnumber command line option to increase the memory
allocated
  for the Java stack.
 
 
  I am using the following:
  tomcat-mod-3.3-1 rpm
  tomcat-3.3-3 rpm
  apache 1.3.20-16 rpm
  IBM 1.3.0 JDK
 
  all on redhat 7.2.  It gives the same error whether thru apache or
  directly to tomcat's webserver.
 
 
  thx for any ideas anyone has...
 
  -Ray


--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]



--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]




RE: Minimalistic Docs

2002-01-16 Thread Tomas Rokicki

Oops; different dictionaries disagree on the possible
meanings of minimalist.  Sorry.  (My OED is at home.)

-tom

-Original Message-
From: Arnold Shore [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 11:15 AM
To: Tomcat Developers List
Subject: RE: Minimalistic Docs


And a minimalistic use of Minimalistic would be Minimal.

as

-Original Message-
From: Christopher K. St. John [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 12:47 PM
To: Tomcat Developers List
Subject: Re: Minimalistic Docs


Anthony Holland wrote:

 Tomcat - A Minimalistic User's Guide

 There is no such word as 'minimalistic'.



 In the style of a member of the art movement Minimalism.
 In the style of a minimalist.
 Minimalistic.

 Works for me.

 Minimalist User's Guide would imply that the user's
guide has to do with the art movement (or communism),
while Minimalistic implies that the guide is in the
style of, but not actually about, Minimalism.

 A Minimalist's Guide might work.

--
Christopher St. John [EMAIL PROTECTED]
DistribuTopia http://www.distributopia.com

--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]


--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]



--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]




RE: Minimalistic Docs

2002-01-16 Thread Tomas Rokicki

Well, if you believe dictionaries:

minimal:  adj.
1a Smallest in amount or degree.
1b Small in amount or degree.
1c Only barely adequate.
2 often Minimal Of, relating to, or being minimalism

minimalist: n.
1 One who advocates a moderate or conservative approach, action, or policy,
as in a political or governmental organization.
2 A practitioner of minimalism.

minimalist: adj.
1 Of, relating to, characteristic of, or in the style of minimalism.
2 Being or providing a bare minimum of what is necessary.

So minimal is clearly not what we mean, but the second adjective definition
is clearly what we mean.  So minimalist seems to work.  Minimalistic is
clearly not a word.  Minimal means, and further, connotes, the wrong
thing.

Don't techies ever use dictionaries?

-tom

-Original Message-
From: Arnold Shore [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 11:15 AM
To: Tomcat Developers List
Subject: RE: Minimalistic Docs


And a minimalistic use of Minimalistic would be Minimal.

as

-Original Message-
From: Christopher K. St. John [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 12:47 PM
To: Tomcat Developers List
Subject: Re: Minimalistic Docs


Anthony Holland wrote:

 Tomcat - A Minimalistic User's Guide

 There is no such word as 'minimalistic'.



 In the style of a member of the art movement Minimalism.
 In the style of a minimalist.
 Minimalistic.

 Works for me.

 Minimalist User's Guide would imply that the user's
guide has to do with the art movement (or communism),
while Minimalistic implies that the guide is in the
style of, but not actually about, Minimalism.

 A Minimalist's Guide might work.

--
Christopher St. John [EMAIL PROTECTED]
DistribuTopia http://www.distributopia.com

--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]


--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]



--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]




RE: Disable Refresh Function in IE

2001-11-28 Thread Tomas Rokicki

You can't really avoid refresh.

Consider that people can double-click on a submit button or
link, quite inadverdantly, and your server sees it as two
submissions but you only get the second response.

Other than the timing, there is very little to distinguish this
from hitting the refresh button.

If the server refuses to serve refresh requests, well, you've
just broken anyone with a slow finger on the mouse.

(And yes, some people still double-click links intentionally
because you double-click to launch on Windows and why should
the Web be any different?  True these people are typically
moms and pops, but everyone's got them, right?  Parents, that
is?)

-tom

-Original Message-
From: Denis Balazuc [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, November 28, 2001 11:28 AM
To: Tomcat Developers List
Subject: Re: Disable Refresh Function in IE


No, there's no way to disable any of the browser's buttons such as Refresh,
Back or Forward

The only way to prevent a refresh is to maintain some flag when you serve
requests, but even this is hardly feasible.
I'd love to hear about a clean solution on that topicWe need to avoid
people from refreshing pages too

- Original Message -
From: Bala Nemani [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, November 28, 2001 12:54 PM
Subject: Disable Refresh Function in IE


 Hi:

 Is there a way to disable REFRESH functionality. I.e. not just
 hiding the Refresh button but disable the refresh functionality it self
(F5
 function key also).

 Thanks


 --
 To unsubscribe, e-mail:
mailto:[EMAIL PROTECTED]
 For additional commands, e-mail:
mailto:[EMAIL PROTECTED]



--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]



--
To unsubscribe, e-mail:   mailto:[EMAIL PROTECTED]
For additional commands, e-mail: mailto:[EMAIL PROTECTED]




RE: New resource: Bugs every servlet programmer should know about

2001-09-11 Thread Tomas Rokicki

You forgot:  never use servlet instance variables.

This alone is the most common servlet programming bug I've
ever seen, and I see it again and again and again.

I think the containers should use reflection to sniff
a servlet class and if there is a servlet instance variable,
refuse to load the class.

But that's just me.

-tom

-Original Message-
From: Jason Hunter [mailto:[EMAIL PROTECTED]]
Sent: Monday, September 10, 2001 10:11 PM
To: [EMAIL PROTECTED]
Subject: New resource: Bugs every servlet programmer should know about


I just posted on Servlets.com a new resource listing the top bugs a
servlet/JSP programmer should know about.  They're culled from my email
inbox, based on the most
frequently reported problems sent to me by users.  Several directly
involve Apache/Tomcat, so I thought this would be a good forum in which
to post a mention.

http://www.servlets.com/soapbox/bugs.html

If you know of other similarly high profile bugs, please let me know.

-jh-




RE: Addition of 'dirty' field to Session interface

2001-08-08 Thread Tomas Rokicki

Best to do this by layering your own abstraction on top of Sessions.
That's what we do [although we don't use it to solve this particular
problem].

-tom
-Original Message-
From: Kief Morris [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, August 08, 2001 12:36 PM
To: [EMAIL PROTECTED]
Subject: Re: Addition of 'dirty' field to Session interface


Jim Seach typed the following on 04:29 PM 8/7/2001 -0700
 Selected setXXX methods in StandardSession will set the dirty bit to
 true indicating that Session data has changed and it needs to be
 saved
 in the next save cycle by PersistentManager.

But what happens if in one servlet you put an object in the session,
then later, after the session has been saved, another request is
handled by a different servlet that get's the object from the session
and changes its state.

In this case, you have to have the cooperation of the application
developer to call setDirty(true) so you know something has changed.

This doesn't seem like a good idea - not only is it prone to developer
error as you said, it also makes any application which uses it non-portable
to other servlet containers.

Another possibility would be to flag the session is dirty when
getAttribute()
is called - it would result in unnecessary saves since it assumes the
attribute
was modified even when it wasn't, but it would be safer. Maybe it's possible
to use reflection to detect if an object has been modified? I've seen a DB
persistence package which appears to do this, although I haven't examined
that part of the code (ObjectBridge, aka OJB, on sourceforge).

Kief








RE: [jtc] tabs policy??

2001-06-22 Thread Tomas Rokicki

No, it says indentation of 4, and it also says that tabs are
equivalent to 8 spaces.  This is precise and sufficient and
will work with any virtually any editor [assuming people know
how to use their editor].  Hint:  if your editor displays
a single hard-tab (^I in the file) as four spaces
(the indentation), you probably have your editor misconfigured.

-Original Message-
From: Justin Erenkrantz [mailto:[EMAIL PROTECTED]]
Sent: Friday, June 22, 2001 5:25 PM
To: [EMAIL PROTECTED]
Subject: Re: [jtc] tabs policy??


On Fri, Jun 22, 2001 at 07:17:37PM -0500, kevin seguin wrote:
 so, is there a tabs policy in jakarta?  like the number of spaces per
 tab (4 vs. 8), of no tabs in source code?  i ask because i just got the
 latest jtc source, and when i open up some of the files in emacs (in
 which i have tab width set to 8 spaces), some lines are indented 4
 spaces, and some 8.  what it looks like is someone used an editor with
 tabs configured to be 4 spaces, but insert tab characters rather than
 spaces.  anyway, it's quite unreadable, so that why i ask ;)  (i hope
 this doesn't start a war ;-))

According to the Jakarta site, I believe the Java code goes under:

http://java.sun.com/docs/codeconv/html/CodeConvTOC.doc.html

Spaces vs. tabs aren't specified, but it says indention of 8.

I'd imagine that the j-t-c code (non-Java code) uses the traditional
Apache style:

http://dev.apache.org/styleguide.html

But, that isn't specified anywhere.

I wish that the Java code used the Apache style.  I find indention of 
8 with hard tabs to be downright awful.  Some of us don't use GUI 
editors.  =)  -- justin





RE: Solaris Sparc Performance Problem

2001-05-02 Thread Tomas Rokicki

It might be Nagle's algorithm on one of the sockets involved.  A simple
test with snoop should show precisely where the delay is coming from.

-tom

-Original Message-
From: Douglas E. Hornig [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, May 02, 2001 3:42 AM
To: [EMAIL PROTECTED]
Subject: RE: Solaris Sparc Performance Problem


I ran truss and it generated a ton of stuff that I frankly had trouble
making much sense of.  My approach for now is to work with some Sun
engineers to try to get to the bottom of it.  So far they have suggested
trying the latest JDK (J2SE 1.3.1 RC2), and passing the requests through
apache (I'm running tomcat standalone now).  The latter may make the problem
go away since apache doesn't seem to suffer from the problem, but I consider
it avoiding the problem rather than solving it.  I have not tried either
yet.

I'll keep you all posted if anything turns up.
Doug

--- You wrote:
Maybe I missed the response, but whatever became of this issue?

Thanks,

Dave


-Original Message-
From: Arieh Markel [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, April 24, 2001 10:31 AM
To: [EMAIL PROTECTED]
Subject: Re: Solaris Sparc Performance Problem

Here is what I would do to see the differences:

. on Solaris, run the application through truss

. on Linux, run the application through strace

This should yield information about where the time is being spent.

I am also wondering whether the Solaris machine is properly configured
with regards to things like nameserver lookups, proxy setups, etc.

Arieh

 Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm
 Delivered-To: mailing list [EMAIL PROTECTED]
 From: [EMAIL PROTECTED] (Douglas E. Hornig)
 Subject: Solaris Sparc Performance Problem
 To: [EMAIL PROTECTED]
 Content-Disposition: inline
 X-MIME-Autoconverted: from quoted-printable to 8bit by
amon.Central.Sun.COM id
LAA19808

 I posed this problem to the good folks on the users list.  While they are
a
great bunch, and several offered some suggestions, I was unable to get any
help
from them so I'm trying the dev list now.

 The problem in a nutshell is that requests I make to tomcat running on a
Solaris Sparc from a Windows client take at least 0.15 to 0.20 seconds.  If
I
run tomcat on a Linux PC, or use a Linux PC as a client instead of Windows,
the
turnaround time is more like 0.01 seconds.

 Here are the particulars:

 * All machines are on the same 100Mbit ethernet.
 * Tomcat is running standalone.
 * I tried a couple of different Sparcs, a 420R and an Ultra 5, neither
with
any load.  No difference.
 * I wrote a simple Java program to use as the test client so there are no
browsers involved.
 * I tried various different Java VM releases on the Sparcs, 1.2.1 and
1.3.0
with no difference seen.
 * I tried a couple different PCs (NT4 and Win2000) and found the same
results.
 * Other programmers here reported slowness using VisualBasic as the client
instead of Java (that's how I got started investigating this).  Java Web
Server
2.0 also appeared to have the same problem as tomcat.  I have not personally
been able to verify these assertions.
 * The results seem very repeatable.
 * I used a generic tomcat 3.2.1 for the server and hit the
examples/servlet/HelloWorldExample URL for these tests.

 This is a very serious problem for us.  The above mentioned VB client that
we're developing can make dozens of calls to the server per screen, so those
0.2
second delays add up.  I like Linux a lot myself but the bosses here feel
more
comfortable with more traditional business models, and besides shouldn't
Java
run best on a Sparc with Solaris?  I am perplexed as to what the problem is
and
would greatly appreciate any help or ideas I can get.

 Thanks in advance,

 Douglas Hornig
 Dartmouth-Hitchcock Medical Center
 Lebanon, NH

--
 Arieh Markel   Sun Microsystems Inc.
 Network Storage500 Eldorado Blvd. MS UBRM11-194
 e-mail: [EMAIL PROTECTED]   Broomfield, CO 80021
 Pray for snow  Phone: (303) 272-8547 x78547
 (e-mail me with subject S
--- end of quote ---




RE: Tabs vs. spaces (was: cvs commit: blah blah blah)

2001-04-12 Thread Tomas Rokicki

Here's an edited version of a comment on tabs and spaces I sent to
our development team that might be useful.

---cut---

Okay, we've had some discussions this morning, and we've got to
deal with tabs and indentation better than we have been.

Some files are simply unviewable right now in various editors
with various settings, and it is time to clean it all up and do
it right.

First, there is a distinction between *tab stops* and *indentation*.

The tab stops define how the editor interprets a tab character in
the file---how many space-equivalents that tab character gives.

The indentation defines how many spaces a nested level should be
indented compared to the previous level.  Most editors (including
vim and emacs) use the *indentation*, not the tab stops, in
interpreting how much whitespace to introduce when the user hits
the tab key.  That is, when the user hits the tab key, some number
of spaces or tabs will be inserted to match the indentation.

Most modern editors (including emacs and vi) support both concepts.

Unfortunately, most modern programmers (including most of us)
only understand the tab stop concept.  This is broken.

Finally, many programs, printers, and so forth are hard-wired to use
8-character tab stops, and there is often no way to work around
this.

There is a clean solution.  It's simple and it's elegant and it's
easy.

The rules are as follows.

1.  Never ever set your tab stops to something other than 8.  This
means, never do (setq tab-width 4) in emacs or set tabstop=4
in vim.  If you do, you will create files that will be unusable
by others.

2.  Instead, set your indentation to whatever you want, as the
author of a file.  This is usually done with
(setq c-basic-indent 4) in emacs, or set softtabstop=4
in vim.  This is what you want to do, and if you do this, your
files will work well with everyone.

3.  If you want, in your files, add a line such as

 /* -*- mode: java; c-basic-indent: 4; -*- */

to force all other emacs users to get *your* desired indentation
so that if they edit your files, their new lines will match your
indentation.

4.  I would prefer that none of our source files contain any tab
characters at all since this is what causes the files to display
incorrectly in the different editors, but I'm not going to insist
on this.  To do this, in emacs use (setq indent-tabs-mode nil);
in vim use set expandtab.  If everyone does as in 1 above, there
won't be a problem in any case.

If you encounter a file that just doesn't display properly for you,
it's probably got a mixture of tabs and spaces and your tab stop is
set differently than (one of the) authors'.  This is the crux of
the problem.  To fix this, you can set the tab stop of your editor
until it looks most proper, then untabify it (in emacs, untabify;
in vi, set expandtab) and save out the file with no tabs.  Then fix
up any remaining indentation problems by hand and check it in.

Unfortunately, the changes will be massive by perforce standards, but
it's probably best to deal with this as early as possible, set the
standard now, and totally prevent problems in the future.

For further reference, consult

http://www.jwz.org/doc/tabs-vs-spaces.html

If anyone has any questions or further discussion is needed, contact
me.

-tom

-Original Message-
From: Kief Morris [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 12, 2001 8:43 AM
To: [EMAIL PROTECTED]
Subject: Tabs vs. spaces (was: cvs commit: blah blah blah)


Jon Stevens typed the following on 06:50 PM 4/10/2001 -0700

Craig, does this mean you (finally) aren't using tabs anymore? :-)


So, are spaces kosher? The Sun coding standards document (which is the
official Jakarta guideline?) says either is OK, but the mixed tabs and
spaces
format I've found in the Catalina code I've mucked with is a PITA. Can I
just
set my editor to use 4 spaces for tabs and reformat files I work with
accordingly, without spawning a jihad?

Kief





RE: Tabs vs. spaces (was: cvs commit: blah blah blah)

2001-04-12 Thread Tomas Rokicki

True; not using a beautifier or CVS (now we're using
Perforce).  I find that beautifiers do more damage
than good, but I'm happy to be enlightened; is anyone
actually doing this in practice?

-tom

-Original Message-
From: Nick Bauman [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 12, 2001 9:34 AM
To: [EMAIL PROTECTED]
Subject: RE: Tabs vs. spaces (was: cvs commit: blah blah blah)


This issue would be moot if you frontended your CVS checkins with a
beautifier.

 Here's an edited version of a comment on tabs and spaces I sent to our
 development team that might be useful.

 ---cut---

--
Nick Bauman
Software Developer
3023 Lynn #22
Minneapolis, MN
55416
Mobile Phone: (612) 810-7406





RE: denial of service attack

2001-01-17 Thread Tomas Rokicki

What's a client?  For instance, if it's truly an attack, it would be
trivial to spoof IP addresses.  And with entire corporations behind
NAT firewalls, simply setting the number of sessions per IP addresses
to a `small' number would not work.

Or, are you saying, don't initiate a session until the client
authenticates himself?  That's great, except it still breaks for
things like account creation sequences.

Which can be implemented with hidden fields instead of sessions or
some such . . .

-tom

-Original Message-
From: Scott Christley [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 17, 2001 10:54 AM
To: [EMAIL PROTECTED]
Subject: denial of service attack



I must apologize first by saying that I originally found this bug with
Jserv not Tomcat, but those of you who are familiar with Tomcat
internals can probably tell fairly quickly if this would still be an
issue.

=
This bug deals with an out of memory condition within Jserv which is
more a design/security issue.  The scenario is that when a session is
created by a servlet; memory is allocated by the JVM for that session
and stays allocated until these two conditions occur 1) the servlet
invalidates the session or the session timeout is reached which
invalidates the session and 2) JVM garbage collection returns that
allocated memory back to the heap.

The reason this is a design/security issue is because any normal Java
Servlet application can be used for a denial of service attack.  The
Java Servlet specification encourages applications to use sessions if
they wish to maintain state.  A hacker can easily discover if any
application is a Java Servlet which uses sessions by checking to see if
the JSESSIONID cookie is defined; if the hacker finds one then a simple
program can be used to increase the memory usage on the server and crash
the JVM.

while (server is still up)
   send an HTTP request to the servlet URL which creates the session

The timeout variable and the maximum java heap size are the only two
ways that the application can attempt to avoid this attack; by setting a
short timeout and a large heap size, one can hope that there is a
sufficient span to handle all of the requests (i.e. the timeout kicks in
before the memory has max'ed out).  But there are problems with this:

* Set a timeout too short and normal users get their session invalidated
before they are able to complete normal usage of the application.
* Java heap size reserves memory which cannot be swapped out (on solaris
at least), so a large heap size puts a strain on the server's memory.
* The hacker can always deploy additional clients to generate more
concurrent requests.
=

I have been writing stress tests for Jserv, Tomcat, and our own servlet
engine; when I brought this issue up with the developers here, I
essentially got my hand slapped (*sigh*) and told "application
developers must deal with this, it is not the servlet engines
responsibility".  Which I think is a highly unfortunate answer because
HttpSession is a core servlet API and telling developers that they
cannot use it and should use an alternate mechansim, just seems wrong to
me.  So, I figured I would post a message to this list for discussion.

I did have an idea for how this issue can be resolved; I've not totally
thought it through, but it may be a good start.

=
Given a parameter (num_of_sessions) which is the maximum number of new
sessions.
Given a parameter (time_period) which is a time interval.

Implement a verification such that maximum number of new sessions that
can be created from the same client within a time interval.  This would
require that you maintain a creation date and client identifier with
each session.

if (creating a new session)
{
   session_count = 0
   Loop through set of sessions for that client
   {
  /* Was this session created within the time period */
  if ((current_date - creation_date_of_session)  time_period)
 ++session_count;
   }
   if ((session_count + 1)  num_of_sessions)
  /* Good possibility we are being attacked */
   else
 /* create the new session */
}
=

Presumably default values could be given to the num_of_session and
time_period parameters which still allow the problem user (somebody
opening up multiple browser windows, stoppng/starting browser, etc) to
gain access to the application, yet small enough to prevent the JVM from
consuming large amounts of memory before the attack is discovered.  Once
an attack is discovered, the servlet engine could be proactive and
delete all of the sessions created by the client to free up the memory,
log messages, etc.

cheers
Scott

/* Thankfully Oracle doesn't speak for me, nor vice-versa */



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, email: [EMAIL PROTECTED]



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional 

RE: An alternative to JSP

2001-01-12 Thread Tomas Rokicki

 Whatcha looking for: np.instantis.com ???

Just curious to see what's happening over there, nothing more.
That's what browsers are for.  What's the relevance to Tomcat?

-tom


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, email: [EMAIL PROTECTED]




RE: An alternative to JSP

2001-01-12 Thread Tomas Rokicki

I don't look at it as odd at all.  JSP and servlets in general
are *very low level* abstractions.  They are incredibly useful,
but they are at such a low level that it's very difficult to
build a complex application.  It's like coding in machine
language.  It's not that difficult to add a layer or two to
raise the level of abstraction.

The good thing about JSP and servlets is they provide a stable,
portable, and solid base with good engineering.  They are
complex enough that getting them implemented correctly is
nontrivial (hence all the work on tomcat etc.) but yet generic
enough that different abstractions can easily be constructed
on top of them.  This is precisely what I want, a
good solid base engineered well on which I can build what
we need.

All the experimentation with the various macro languages and
the like is all good, and we'll all learn from them and
eventually it will all converge [or fail to do so]; I don't
see that it has happened yet, and each solution has its pros
and cons, none of which were acceptable when we started our
project, which is why I've got a stupid lightweight YATL that
we use in-house that solves our problems.

I just thought I'd toss out an example of how we solved the
`no code in JSP' problem.

-tom
-Original Message-
From: Jon Stevens [mailto:[EMAIL PROTECTED]]
Sent: Friday, January 12, 2001 11:54 AM
To: [EMAIL PROTECTED]
Subject: Re: An alternative to JSP


on 1/12/01 11:49 AM, "Tomas Rokicki" [EMAIL PROTECTED] wrote:

 With the solution we're deploying in-house here, your dynamic row
 example is just

 tabletrtd%tr rundata%%key%/tdtd = %value%/td/tr/table

 which is editable in WYSIWYG HTML editors, contains no Java code,
 and so on . . . the magic %tr ...% tells it to iterate on table rows.

 Oh, but of course it's YATL so I'll shut up now.  (It compiles down
 to JSPs.)

Exactly. JSP alone didn't solve your problem. You had to do YATL in order to
get it to do what you want. That just seems odd to me.

-jon


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, email: [EMAIL PROTECTED]



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, email: [EMAIL PROTECTED]




RE: An alternative to JSP

2001-01-12 Thread Tomas Rokicki

 Exactly. It would have been nice if JSP was done right from the start
 instead of having an original goal of attempting to provide a solution to
 strictly compete with ASP.

My thought is that JSP was `done right from the start' (at least, with
custom taglibs)---it just doesn't solve the whole problem, nor would I
want it to.

 logic:iterate id="parameter" name="parameters"

The main problem I have against tag libs and tag-based templates is the
tags are either invisible in the HTML view or else some squiggly little
box; it's really tough to get semantic information (hence my use of
%% rather than  in my template language).  Of course, dreamweaver is
making that better, but even in dreamweaver it's still a box that
looks like [~].

Until of course you turn on tomcat, which we do and our developers do, to
see what's happening with the real server, but it's great to actually
have a clue what you're looking at in the main view too.

I'll shut up now and let everyone get back to work on TOTL (their own
template language).

-tom


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, email: [EMAIL PROTECTED]




RE: [tomcat-4.0] Session Creation Slowness

2000-12-21 Thread Tomas Rokicki

This is probably due to the new SecureRandom-based session IDs.
There is an option to turn that off somewhere.

-Original Message-
From: Jon Stevens [mailto:[EMAIL PROTECTED]]
Sent: Thursday, December 21, 2000 1:47 PM
To: tomcat-dev
Cc: [EMAIL PROTECTED]
Subject: [tomcat-4.0] Session Creation Slowness


Ok, I put a whole bunch of logging into Turbine to see *exactly* what line
of code is causing the slowness that I keep reporting here and I have now
found it...

Log.note ("RunDataFactory: 11");
// Get the HttpSession object.
data.setSession ( data.getRequest().getSession(true) );
Log.note ("RunDataFactory: 12");

As you can see above, essentially, all that is happening is that I'm storing
an instance of the HttpSession object within the RunData object. Marking
things as "true" causes the redirect to happen, so there is another
request...

[Thu Dec 21 13:34:15 PST 2000] -- NOTICE  -- RunDataFactory: 11
[Thu Dec 21 13:35:01 PST 2000] -- NOTICE  -- RunDataFactory: 12
...
[Thu Dec 21 13:35:03 PST 2000] -- NOTICE  -- RunDataFactory: 11
[Thu Dec 21 13:35:03 PST 2000] -- NOTICE  -- RunDataFactory: 12

As you can see above the first request through this code takes bloody
FOREVER and the second one is quite fast.

The really *INSANE* part about all of this is that people have checked
Scarab out of CVS themselves on the SAME JVM (1.3 on Windows) and don't see
any real slowness at all (approx 4-5 seconds).

So, Craig, can we please try to do something about this? There has got to be
something wrong with either my setup or something else (I really don't think
this is entirely a classloader issue anymore). I also have this great
slowdown on MacOSX as well.

If you want to duplicate it, you can check Scarab out of CVS and do it
yourself. I have re-done the CVS tree and it is very easy to get things up
and running (even without a database installed...just ignore that part of
the README.txt file).

http://scarab.tigris.org/

thanks,

-jon