Re: OSCP support in tomcat-native (was OCSP)

[Coty Sutherland]

On Thu, Nov 9, 2017 at 1:45 PM, Christopher Schultz
 wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Coty,
>
> On 11/9/17 12:19 PM, Coty Sutherland wrote:
>> Hi,
>>
>> I'm trying to determine whether or not we fully support OCSP in
>> tomcat-native 1.2.x on Linux. There isn't any documentation about
>> it other than some on the Downloads page that says it's
>> experimental on Windows:
>>
>> "The Windows binaries are available in two variants. a) Default.
>> This is what people usually use. This version of library is
>> included in Apache Tomcat distributions. b) OCSP-enabled. This one
>> has enabled (experimental) support for verification of client SSL
>> certificates via OCSP protocol (45392)."
>>
>> I see that it's enabled by default when building Linux, but for
>> Windows you have to enable it in the build.
>>
>> Can anyone help me out here?
>
> Without reading anything at all (from memory), I believe it all has to
> do with how OpenSSL itself was built.
>
> The reason we are mum on *NIX is because the consumer is expected to
> provide their own OpenSSL library, while the Windows build comes from
> us with a statically-linked OpenSSL (with or without OSCP compiled-in).

So technically all OCSP support is considered experimental then (since
we consider OCSP support in Windows experimental where we know that
openssl supports it)? It isn't just a pass through to openssl, the
call to the OCSP server (for example) happens inside of tomcat-native.
I have a user complaining about the fact that there's no logging in
those functions, so I plan to eventually add some, but I wanted to
make sure we are confident that it works correctly first :)

> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAloEokkACgkQHPApP6U8
> pFgdcA/+LomHqxKsVS5VMn9ZCZT3Vuwdwl6JbBL5Tfrx+r226zfEvDDP/xjrKDNm
> WxD+fXhfi4Vrf+vcZEdTSr2/ubCQIIE+fgj2WYhz9XWWGgPNOK1LRgk92HvWqy9B
> tSbv5+hg6T7+gP8YoNKSr32j+MicgbkNE8BGmewMJNOMKkyHTWeGZaU726kqGeFC
> oCGmuUbcWWxcE6wkk48Cdsy+/oTZcvAEDu82Pfl490joBI7gCURqa2AfYpv7b3qu
> oYs/T7Cm+YMZAIU/kZBtlEQUUIscc/vf2AqHM8n22Uft5s9F9e1pSnm3aWmzAF6a
> fM3NifxyQl1Yabl5wTfXxm3hBTzovZJsOQhfASq1pkbNS2dRGg1s9Z4ITXzCYwVv
> +whoNLocxWeFmOY8S9CQM4PaGDPEWT2Pd7dFL1ae9xBNdNuc4mnbnvk980DpCHbG
> 7p6+U8T7Pun+GBC602VXDgdajfGHO6bWhwuu33H7G1JgGnPnrYaOCLupaQhXT/FC
> ZQiyex2n+j3g07d269gs3UqsHxM3SA3COdogNpdfOYrdq+cYhov19G3R2O+lGd1/
> WqciphuopiUbMtDs+s88zhw5AZldwEDHdsI2bxzthjATbT7VH+BLGSR+aF8SS3H/
> ybix8mdlIP4G28Ml2q7jYzXoBji7SeTNt95Bes0xaQ6FcfaPI+Q=
> =uwu2
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Service killed by signal 9

[Coty Sutherland]

On Fri, Nov 10, 2017 at 4:31 AM, Greg Huber  wrote:
> Since switching to jsvc, randomly I am getting tomcat restarting, looking
> at the logs I see that the jsvc is using alot of memory total-vm:  and
> being killed by the system.
>
> Nov  9 13:11:11 prodbox kernel: Out of memory: Kill process 1287 (jsvc)
> score 121 or sacrifice child
> Nov  9 13:11:11 prodbox kernel: Killed process 1287 (jsvc)
> total-vm:3453120kB, anon-rss:378280kB, file-rss:0kB, shmem-rss:0kB
>
> I am using the below on properties on the startup (from previous version
> statup scripts):
>
> -Xms256M -Xmx768m -Xss1280k -XX:+UseParallelGC -XX:MaxGCPauseMillis=1500
> -XX:GCTimeRatio=9 -server -XX:+DisableExplicitGC
>
> (I replaced -Xss256k with -Xss1280k to stop crashing see
> https://issues.apache.org/jira/browse/DAEMON-365)

The root cause for that broke a lot of things, so I imagine your OS
has fixed the kernel problem by now. If you tell me which OS I can try
and see if it's fixed for you. I'd suggest that you try reducing your
Xss back to 256k and see if that shrinks your process size enough to
keep it off of oom-killer's radar.

> Is there a way to limit the total-vm or find out why its got so big?
> -XX:+DisableExplicitGC ??
>
> Standard tomcat install with apache/modjk.
>
> Cheers Greg

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Service killed by signal 9

[Christopher Schultz]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Konstantin,

On 11/10/17 8:46 AM, Konstantin Kolinko wrote:
> 2017-11-10 12:31 GMT+03:00 Greg Huber :
>> Since switching to jsvc, randomly I am getting tomcat restarting,
>> looking at the logs I see that the jsvc is using alot of memory
>> total-vm:  and being killed by the system.
>> 
>> Nov  9 13:11:11 prodbox kernel: Out of memory: Kill process 1287
>> (jsvc) score 121 or sacrifice child Nov  9 13:11:11 prodbox
>> kernel: Killed process 1287 (jsvc) total-vm:3453120kB,
>> anon-rss:378280kB, file-rss:0kB, shmem-rss:0kB
>> 
>> I am using the below on properties on the startup (from previous
>> version statup scripts):
>> 
>> -Xms256M -Xmx768m -Xss1280k -XX:+UseParallelGC
>> -XX:MaxGCPauseMillis=1500 -XX:GCTimeRatio=9 -server
>> -XX:+DisableExplicitGC
>> 
>> (I replaced -Xss256k with -Xss1280k to stop crashing see 
>> https://issues.apache.org/jira/browse/DAEMON-365)
> 
> The links in that issue go to a thread that explains that the issue
> is actually caused a kernel bug. It was reported & diagnosed in
> June 2017, thus should it have already been fixed?
> 
> 1,2 Mb of stack for each thread mean that for 200 threads you will 
> need 240 Mb of memory just for thread stacks.  Most of that is
> wasted memory: You do not need to increase -Xss unless you are
> hitting StackOverflowError.
> 
>> Is there a way to limit the total-vm or find out why its got so
>> big? -XX:+DisableExplicitGC ??
>> 
>> Standard tomcat install with apache/modjk.
> 
> https://wiki.apache.org/tomcat/FAQ/Linux_Unix#Q5
> 
> In Tomcat Manager web application there is "Server Status" page.
> It has a table that shows current memory consumption, as reported
> by Java.  The values can also be queried via JMX (e.g. with
> jconsole application).

Linux oom will use the actual process's used memory to compute its
killability, so the Java-reported memory usage won't tell the whole stor
y.

Greg, how much total memory does the server actually have? Do you have
other services running on it as well? If you run low on memory, Linux
will simply kill your process. There are ways to minimize the
likelihood that your process will be killed, but if it's the only way
to free-up memory that the kernel is convinced it needs, well, then
your process is simply going to die.

One way to reduce your memory usage would be to reduce the heap size
you are using. Do you need that much heap? It's also possible that you
have a native memory leak somewhere, possibly caused by code outside
of your control. Do you have any native components involved that don't
ship with the JVM (or jsvc)? I'm unaware of any memory issues with
jsvc, but I'm not super familiar with it.

- -chris
-BEGIN PGP SIGNATURE-
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAloFvOIACgkQHPApP6U8
pFhPdBAAyvgvwEovYQXGpDDVZ2c3JwkzyKjQrWboW9wYjKsPTjy+xGiDqVfhxCLC
ukbQL6spVYlqc1y5N+5i2iyqX+JRKa7OA3unvFRDrpxJDOfJmDqwBavJ8xlpl9mX
v/E/WMPXAgZLYK05aPCsul7/ewavahADi2vwt2SQgUE9ARrV/qN7QXYPaa6XwNjM
SSb35dWK0k9pDCl2OrKfFOEgm3nsY+P6FKx29k1z/8sAYBYQJRC/slBboqsj7uzj
X4DFThtKvkiPGRSjzEeDmkthMN7CFz1QFHa3NaPDkj5Zjv7mUfLZRdHB0ETlQdvq
Zx2md/OZBw/EoE5j+K/C9yfK6qwcdgHX2zsHdwbweC/QZJrFVaf9VxfaXmeZavLX
KXYRhk3W1R93/QigXVjPxMod1ToiLjSzGPG34F1jkC/FBj7X359dZokL6pLl6hDw
h+6M5rUxWevLVdKg9gWX8peT/jxk4P7KInWjdH2oI4Rl40vMbSPA23qWkaVTbHfG
WWsdDMWrmxNW2e+zzNRCikjMT6ksWas18tzgn9KVWy8cau8yy208d0opSUloUZht
2LwUhrEKmbZjQywyyq/7MyXTIwMeAg6y3xJ04al6ZBp7YnrmW/zhay4yaT2ZBJ8R
E1PnVf1MPnOAIHIev562CadG/FiveQ0n94/7KMiQf81YgIiFQeo=
=AXyl
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Service killed by signal 9

[Konstantin Kolinko]

2017-11-10 12:31 GMT+03:00 Greg Huber :
> Since switching to jsvc, randomly I am getting tomcat restarting, looking
> at the logs I see that the jsvc is using alot of memory total-vm:  and
> being killed by the system.
>
> Nov  9 13:11:11 prodbox kernel: Out of memory: Kill process 1287 (jsvc)
> score 121 or sacrifice child
> Nov  9 13:11:11 prodbox kernel: Killed process 1287 (jsvc)
> total-vm:3453120kB, anon-rss:378280kB, file-rss:0kB, shmem-rss:0kB
>
> I am using the below on properties on the startup (from previous version
> statup scripts):
>
> -Xms256M -Xmx768m -Xss1280k -XX:+UseParallelGC -XX:MaxGCPauseMillis=1500
> -XX:GCTimeRatio=9 -server -XX:+DisableExplicitGC
>
> (I replaced -Xss256k with -Xss1280k to stop crashing see
> https://issues.apache.org/jira/browse/DAEMON-365)

The links in that issue go to a thread that explains that the issue is
actually caused a kernel bug.
It was reported & diagnosed in June 2017, thus should it have already
been fixed?

1,2 Mb of stack for each thread mean that for 200 threads you will
need 240 Mb of memory just for thread stacks.  Most of that is wasted
memory: You do not need to increase -Xss unless you are hitting
StackOverflowError.

> Is there a way to limit the total-vm or find out why its got so big?
> -XX:+DisableExplicitGC ??
>
> Standard tomcat install with apache/modjk.

https://wiki.apache.org/tomcat/FAQ/Linux_Unix#Q5

In Tomcat Manager web application there is "Server Status" page. It
has a table that shows current memory consumption, as reported by
Java.  The values can also be queried via JMX (e.g. with jconsole
application).


Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: stopping scanning of TLDs

[Ray Holme]

Thanks for your help Chris. Here is my final script to do this right.
-/local/bin/tld_scan:#!/bin/bash -
#    find tldS -    Ray Holme 2017
#      embedded spaces in filenames wreak havoc

if [ $# -eq 0 ]; then
  echo " usage $0 list-of-jar-files"
  exit 1
fi

VERBOSE=0
LIST=
WORK=/tmp/$$.wrk

for i in $*
  do
    if [ "$i" = "-v" -o "$i" = "V" ]; then VERBOSE=1
    elif [ ! -f "$i" ]; then echo " $i not found"
    else
  echo $i | grep -i "\.jar$" > $WORK
  if [ -s $WORK ]; then LIST="$LIST $i"
  else echo " $i not a jar"
  fi  
    fi
  done

if [ "$LIST" = "" ]; then
  echo nothing to do
  exit 0
fi

for i in $LIST
 do
   unzip -l "$i" | grep -i "\.tld" > $WORK
   if [ -s $WORK ]; then echo " $i contains tlds"
   elif [ $VERBOSE -gt 0 ]; then echo " $i has no tlds"
   fi
 done

exit 0
 

On Thursday, November 9, 2017 11:19 AM, Christopher Schultz 
 wrote:
 

 -BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Ray,

On 11/8/17 3:51 PM, Ray Holme wrote:
> this makes it easy in linux or mac land for i in *.jar; do echo
> scanning $i; jar tf $i | grep "\.tld"; sleep 1; done

I'd change that to:

$ for i in *.jar; do echo scanning $i; unzip -l "$i" | grep -i "\.tld"
; done

Changes:

1. Use unzip instead of jar. It's much faster.
2. Quote "$i", in case the filename contain (*shudder*) spaces
3. Use -i switch with grep, in case the filename happens to be TAGLIB.TL
D

- -chris

> -BEGIN PGP SIGNED MESSAGE- Hash: SHA256
> 
> Ray,
> 
> On 11/8/17 11:24 AM, Ray Holme wrote:
>> In a prior post, I asked if there was a way to see if a jar uses
>> a tag library. Chris responded - look for ".tld" in the files.
> 
> To clarify, I was responding to a question as to whether a JAR
> file *contained* a tag library, not that it used one. Big
> difference.
> 
>> So I looked (turns out ecj.. has no ".tld": $ grep "tld" 
>> *.jarBinary file catalina-storeconfig.jar matches Binary file 
>> ecj-4.6.1.jar matches Binary file tomcat-util-scan.jar matches
> 
> I agree with Chris Cheshire: check the ZIP contents list and not a 
> binary check. Though the ZIP filenames are stored (mostly) in the 
> clear, it's possible that you might get unlucky. Also make sure
> you use a case-insensitive check.
> 
>> I am just trying to find a reliable way to see if there is TAG 
>> library.
> 
> Searching for .tld files ought to do it.
> 
> Have you found a case where this *didn't* work?
> 
> - -chris -BEGIN PGP SIGNATURE- Comment: GPGTools -
> http://gpgtools.org Comment: Using GnuPG with Thunderbird -
> http://www.enigmail.net/
> 
> iQJRBAEBCAA7FiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAloDaJ0dHGNocmlzQGNo 
> cmlzdG9waGVyc2NodWx0ei5uZXQACgkQHPApP6U8pFgcMQ/8Dv1fKlSVTjyznXD5 
> cYi2HPYt+enG2bMSzJICEhpQEHn6S0S1Veaf4pGfM1m27KPqvdghDgqGB/yoGt4P 
> 2YU6LF8xa7AHVIvx+TwFtwcyL58NcqpO6uFM1MsUiAa3VYGUTY63R1B4EkTeWHuB 
> HoEDDIi17hOBGivctsFjkBaNgCKpnN4SUpMg3b9f4SZHgI4DjFIm0AQGUsI5pstQ 
> NKHzc/QFYu4+qqtb+A41cawf0jpvBtk2mY6SGqPu930SNWGpy8C5iQnyEguBS9ts 
> ZJVx3uYHBUFDByv+Cjudu7oJ1ceFrGQWWT6IumzMRQwL4RqueKLSjW2nXGR2gYmb 
> tF23FlKIQ2jljn5YgKkMmfgkQ2MeAbTJcubJBdJBT2LrzAKxK+0Ms2HCjfGBo777 
> GeRJ5JPHku0h3sn5clnYwsGMP1lcut+353VuNJsHg9NyhltBm7ubHB2240vaEGFF 
> CxpNBa/VZuMRbu1Jp8OmCTO232sjHWY0b8ySESy0CQXYHx5S3/pCB8IoLfGV8VVh 
> VQChjyJcsUePa0qmioi6kmKPeluy9J63POXgiPk+UCKUgr3R0Ogc2Fu+sqE3CkqK 
> 0zf4Op/FALSfSqq67LTksy2oz4Ep1QC7CjKR2C/KG0nf6zaAPMVccmpqwccOuGWU 
> acEI1f6+9qXg6ZZQNneKsqr9Sfw= =kaCd -END PGP SIGNATURE-
> 
> -
>
> 
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
> 
> 
> 
> 
-BEGIN PGP SIGNATURE-
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQJRBAEBCAA7FiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAloEgBQdHGNocmlzQGNo
cmlzdG9waGVyc2NodWx0ei5uZXQACgkQHPApP6U8pFgsuw/+IE2s4l93jQcAMKcL
0bbQ3lqski6L6zgaq38odjPgyMvx1tWugGKRY8vDsBpGl2b/hFmm4R5V+D6i4lX+
kq6el8pqrvimx/o/R+81eZxQ/PgMFj8I1Gp900gnnEarO9QsrnbWZnV85+HN75OG
cAwvjpdL8KcCabiw8r3jxXTmfS3xCKW9F/RBj+nftwV1tT8V/tBqWl3WsryZBlER
xG+cpijACb51z0e3Lo6N2+S/kFHKPk7xBhh+IWp2lPdrBY2I6YbR53kwP9ZG76+g
qYB/LPawQjSFVBUoMgpg/HSitay9sgwOeUcHnNcZRsQqNvMuf+WOCRope/tnGV48
xqbHE4xRJV7m13glAgtDugWjNNqVw4zEpzoZHFnnXyy4zrZ5iYO38NiMf8Ni8rwU
6BS4gVAnEAHTF29j1iFsRTOxsqrxBdMXhlNyk+NThpY3GyZr1OHc2D3XXb5av0zM
3GOq8rmrNy7ck7T0BuoHQmkEfJWsv0R0INVYuysJd01dFl3aQ+JQ9BNhyhcnGR9f
EyN0R+yKjNnUUiCUDhGE7zBxcqK7mda/T1Qzb4o40efY6zYno7Er6W4Rf0e4Y4Tl
juPT/z+asZrGva4LvVYnFHH21OgyNF47S80CnL0RafqPJuN0/EFxOUjknU24afL2
cUY3WrObveDJ1n9lsfSCKlNE4Qg=
=mNz6
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



   

Service killed by signal 9

[Greg Huber]

Since switching to jsvc, randomly I am getting tomcat restarting, looking
at the logs I see that the jsvc is using alot of memory total-vm:  and
being killed by the system.

Nov  9 13:11:11 prodbox kernel: Out of memory: Kill process 1287 (jsvc)
score 121 or sacrifice child
Nov  9 13:11:11 prodbox kernel: Killed process 1287 (jsvc)
total-vm:3453120kB, anon-rss:378280kB, file-rss:0kB, shmem-rss:0kB

I am using the below on properties on the startup (from previous version
statup scripts):

-Xms256M -Xmx768m -Xss1280k -XX:+UseParallelGC -XX:MaxGCPauseMillis=1500
-XX:GCTimeRatio=9 -server -XX:+DisableExplicitGC

(I replaced -Xss256k with -Xss1280k to stop crashing see
https://issues.apache.org/jira/browse/DAEMON-365)

Is there a way to limit the total-vm or find out why its got so big?
-XX:+DisableExplicitGC ??

Standard tomcat install with apache/modjk.
​
Cheers Greg

Re: non www to www URL Rewrite

[shivashankar manukondu]

Hi,

If you want both should be accessible then try to use "ServerAlias" option

If you want redirect all requests then try

RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteCond %{HTTPS} ^on$#if you don't want https then make off
RewriteRule ^(.*)$ https://www.example.com/$ [R=permanent,L,NE]  #
flags based on your requirement

Please remember the above rules will be work based on all your existing
rewrite rules.


Regards,
Siva



On Thu, Nov 9, 2017 at 10:58 AM, RAVIRAJ SHAH 
wrote:

> Hi Andre,
>
> Thanks for quick reply
> yes it is pointing to same public IP
>
> Thanks,
> Raviraj
>
>
>
> Thanks & Regards,
> Raviraj Shah
>
>
> On 8 November 2017 at 22:50, André Warnier (tomcat)  wrote:
>
> > On 08.11.2017 17:35, RAVIRAJ SHAH wrote:
> >
> >> Sorry for my language
> >> my query with example
> >>
> >> Let's say my website domain is "example.com"
> >> Now I want to redirect "example.com" to "www.example.com"
> >> Kindly share how I can achieve it
> >>
> >
> > Well first, you need the 2 entries in the DNS server for "example.com".
> > You need :
> > example.com --> public Internet IP address of your server (A)
> > www.example.com --> public  Internet IP address of your server (B)
> >
> > and A == B
> >
> > otherwise it will never work.
> > Do you have that ?
> >
> > You can check this by getting a command-line window somewhere and
> entering
> > :
> > nslookup example.com
> > nslookup www.example.com
> > and both should give the same IP address.
> >
> >
> >
> >
> >
> >> On Wed, Nov 8, 2017, 19:08 André Warnier (tomcat) 
> wrote:
> >>
> >> On 08.11.2017 14:30, RAVIRAJ SHAH wrote:
> >>>
>  Anybody please help
> 
> >>>
> >>> I think that you first try to communicate more clearly what you want to
> >>> achieve.
> >>> "redirect non-www URL to www URL only"
> >>> does not appear to make much sense.
> >>>
> >>> Also please send your message to the list as *plain text*, not html.
> >>> It will make it easier to read configuration lines below which look
> like
> >>> URL's.
> >>>
> >>>
> >>>
>  On Tue, Nov 7, 2017, 12:00 RAVIRAJ SHAH 
>  wrote:
> 
>  Dear All,
> >
> > Kindly request you to help to resolve this issue
> >
> > Problem Statement :
> > we want to redirect non-www URL to www URL only
> >
> > Current setup :
> >
> > Defined rewrite valve in server.xml as below
> >
> >
> >  > autoDeploy=
> > "true">
> >
> >
> >
> >>
>  />
> >>>
> 
> >
> >
> > 
> >
> > Created rewrite.config file in ../conf/Catalina//
> >
> >
> > *RewriteCond %{HTTP_HOST} !^(.*)\.yourdomain\.com$ [NC] RewriteRule
> >
>  ^(.*)$
> >>>
>  http://www.yourdomain.com /$1 [R=301,L]*
> >
> > *kindly do needful*
> >
> > Thanks & Regards,
> > Raviraj Shah
> >
> >
> >
> 
> >>>
> >>> -
> >>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >>> For additional commands, e-mail: users-h...@tomcat.apache.org
> >>>
> >>>
> >>>
> >>
> >
> > -
> > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> > For additional commands, e-mail: users-h...@tomcat.apache.org
> >
> >
>



-- 

Regards
Siva
#068860592040