Re: SUSPICIOUS Re: Updating configTest to include shutdown port validation

2025-06-23 Thread Amit Pande
Thank you Chris for the inputs. export JAVA_OPTS=-Dorg.apache.catalina.startup.EXIT_ON_INIT_FAILURE=true before running the configtest This seems to help fail the validation if connector initialization fails. Thanks, Amit From: Christopher Schultz Sent: Sunday

Re: Updating configTest to include shutdown port validation

2025-06-20 Thread Amit Pande
nce), the return code is 0. Did I miss anything here? Jun 20, 2025 10:23:15 AM org.apache.catalina.startup.Catalina load INFO: Server initialization in [2457] milliseconds [me@mymachine bin]# echo $? 0 Thanks, Amit From: Mark Thomas Sent: Friday, June 20, 2025 2:58 AM

Updating configTest to include shutdown port validation

2025-06-19 Thread Amit Pande
idea to enhance the server.xml config validation check? Thanks, Amit

Re: TLS 1.3 and post handshake authentication (PHA)

2025-06-19 Thread Amit Pande
Thank you Mark for the clarification. Thanks, Amit From: Mark Thomas Sent: Friday, June 13, 2025 12:57 PM To: users@tomcat.apache.org Subject: Re: TLS 1.3 and post handshake authentication (PHA) On 13/06/2025 18:26, Amit Pande wrote: > Hello, > > W

Updating configTest to include shutdown port validation

2025-06-19 Thread Amit Pande
idea to enhance the server.xml config validation check? Thanks, Amit

TLS 1.3 and post handshake authentication (PHA)

2025-06-13 Thread Amit Pande
TP/1.1. Is this understanding correct? If yes, could we update the warning to be logged only when HTTP/2 is used or at least update the message "The JSSE TLS 1.3 implementation does not support post handshake authentication (PHA) for HTTP/2..." ? Thanks, Amit

TLS 1.3 and post handshake authentication (PHA)

2025-06-13 Thread Amit Pande
TP/1.1. Is this understanding correct? If yes, could we update the warning to be logged only when HTTP/2 is used or at least update the message "The JSSE TLS 1.3 implementation does not support post handshake authentication (PHA) for HTTP/2..." ? Thanks, Amit

Re: [ANN] Apache Tomcat 10.1.36 Available

2025-02-19 Thread Amit Pande
And the release status in the header. (Sorry for spam.) From: Amit Pande Sent: Wednesday, February 19, 2025 8:55 AM To: Tomcat Users List Subject: Re: [ANN] Apache Tomcat 10.1.36 Available CAUTION: This email originated from outside the organization. Do not

Re: [ANN] Apache Tomcat 10.1.36 Available

2025-02-19 Thread Amit Pande
Just a very minor nitpick/typo. https://tomcat.apache.org/tomcat-10.1-doc/changelog.html We need to update the header from Tomcat 10.1.35 to 10.1.36. Thanks, Amit From: Christopher Schultz Sent: Tuesday, February 18, 2025 8:32 AM To: Tomcat Developers List

RE: HTTP/2 support in Tomcat

2025-02-12 Thread Amit Pande
Thank you, Chuck and Mark, for the detailed feedback. Really helpful. Regarding " protocol=org.apache.coyote.http2.Http2Protocol" , it was more of a question to support pure HTTP/2 like protocol attribute. Sorry for confusion. Thanks, Amit -Original Message- From: Mark Tho

HTTP/2 support in Tomcat

2025-02-11 Thread Amit Pande
protocol mechanism allows to fallback on HTTP 1.1 in case the client and server don't agree on HTTP2. Is this right understanding? Were there any other design considerations to support HTTP/2 via upgrade protocol mechanisms? My apologies but I didn't find details around this. Thanks, Amit

Re: Puzzling NoClassDefFoundErrors on Tomcat 10.1.x

2025-01-16 Thread Amit Pande
Thank you, Chris, for the inputs. I did try copying the war and trying to deploy the two copies. I didn't see any issues and both these copies got deployed as expected. I will try this on different setups and will keep you posted with my observations. Thanks,

Puzzling NoClassDefFoundErrors on Tomcat 10.1.x

2025-01-13 Thread Amit Pande
Also, does it matter that the applications being deployed might have same set of third-party libraries packaged the war files? Thanks, Amit

RE: [External] Re: Best way to *programmatically* detect that all webapps are fully deployed and running?

2024-11-24 Thread Amit Pande
Though it's super late, thought of sharing using JMX to get the application deployment status. https://github.com/amitlpande/java-utils/blob/master/ApplicationeploymentCheckerValve.java https://github.com/amitlpande/java-utils/blob/master/server.xml Appreciate reviews/comments. Thanks,

Spring MVC web app and HostConfig logging

2024-11-15 Thread Amit Pande
rom a custom appBase likeL I wanted to get the timing logs. Essentially, application deployed start and finish logging that we otherwise see in HostConfig. Appreciate pointers in debugging this missing logs case. Thanks, Amit

RE: pluggabilitySkip JarScanFilter and JMX calls

2024-11-03 Thread Amit Pande
? Thanks, Amit -Original Message- From: Christopher Schultz Sent: Sunday, November 3, 2024 3:39 PM To: Tomcat Users List Subject: Re: pluggabilitySkip JarScanFilter and JMX calls CAUTION: This email originated from outside the organization. Do not click links or open attachments unless

pluggabilitySkip JarScanFilter and JMX calls

2024-11-03 Thread Amit Pande
tAttribute(Unknown Source) ~[?:?] at java.management/com.sun.jmx.mbeanserver.JmxMBeanServer.getAttribute(Unknown Source) ~[?:?] at com.myapp.findMBeanState(MyTest.java:124) ~[myapp.jar:?] Am I missing some additional configuration? Appreciate the help. Thanks, Amit

Tomcat stderr/stdout to console

2024-10-22 Thread Amit Pande
Catalina log file while looking for progress of the server startup (deploying all apps). "INFO [Catalina-utility-2] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory" Appreciate your help. Thanks, Amit

RE: Migrating from Tomcat 9.0.x to 10.1.x

2024-04-05 Thread Amit Pande
both Tomcat upgrade and the application TPIPs upgrade go together. Thanks, Amit -Original Message- From: Christopher Schultz Sent: Thursday, April 4, 2024 9:37 PM To: users@tomcat.apache.org Subject: Re: Migrating from Tomcat 9.0.x to 10.1.x CAUTION: This email originated from outsid

Migrating from Tomcat 9.0.x to 10.1.x

2024-04-04 Thread Amit Pande
diate step to upgrade to Tomcat 10.1 without having to update the applications at the same time? FWIW, Spring 5 to Spring 6 is a major upgrade and Tomcat 10 is a requirement. Appreciate the guidance. Thanks, Amit

RE: Regression in mutual authentication in 9.0.86+?

2024-03-21 Thread Amit Pande
round the awesome Tomcat leads. Thanks, Amit -Original Message- From: Mark Thomas Sent: Monday, March 18, 2024 4:41 AM To: users@tomcat.apache.org Subject: Re: Regression in mutual authentication in 9.0.86+? CAUTION: This email originated from outside the organization. Do not click

Regression in mutual authentication in 9.0.86+?

2024-03-14 Thread Amit Pande
sed by client, is that correct understanding? Thanks, Amit

RE: JAVA -tomcat- Request header is too large

2023-12-12 Thread Amit Pande
Thank you, Chris. Right now, we're on 9.x line. But this is a very important and useful field for debugging which we should be aware of. Thanks, Amit -Original Message- From: Christopher Schultz Sent: Monday, December 11, 2023 2:02 PM To: users@tomcat.apache.org Subject: Re:

RE: JAVA -tomcat- Request header is too large

2023-12-11 Thread Amit Pande
Mark, Chris, What request ID we're referring to here? Perhaps, I missed some documentation? How do we enable it? Thanks, Amit -Original Message- From: Mark Thomas Sent: Monday, December 11, 2023 3:06 AM To: users@tomcat.apache.org Subject: Re: JAVA -tomcat- Request header i

FIPS Configuration for Java 11/17 and Tomcat 9

2023-11-02 Thread Amit Pande
ways for Java 8 at least (https://github.com/amitlpande/tomcat-9-fips). Appreciate reviews and any other feedback. Thanks, Amit

RE: [External] RE: Java 9+ and custom JCE/JSSE providers

2023-11-02 Thread Amit Pande
/browse/JDK-7133344 https://github.com/frohoff/jdk8u-dev-jdk/blob/master/src/share/lib/security/java.security-linux Thanks, Amit -Original Message- From: Berneburg, Cris J. - US Sent: Thursday, November 2, 2023 3:41 PM To: Tomcat Users List Subject: [External] RE: Java 9+ and custom JCE/JSSE provid

RE: [External] Re: Java 9+ and custom JCE/JSSE providers

2023-11-01 Thread Amit Pande
Setting CLASSPATH worked perfectly! Thank you so much Mark! Thanks, Amit -Original Message- From: Mark Thomas Sent: Tuesday, October 31, 2023 2:47 PM To: users@tomcat.apache.org Subject: [External] Re: Java 9+ and custom JCE/JSSE providers CAUTION: This email originated from outside

RE: [External] Re: Java 9+ and custom JCE/JSSE providers

2023-11-01 Thread Amit Pande
Adding the provider jars to CLASSPATH solved the issue. Thank you so much Mark for your quick feedback. Thanks, Amit -Original Message- From: Mark Thomas Sent: Tuesday, October 31, 2023 2:47 PM To: users@tomcat.apache.org Subject: [External] Re: Java 9+ and custom JCE/JSSE providers

Java 9+ and custom JCE/JSSE providers

2023-10-31 Thread Amit Pande
Tomcat 9, by registering a custom listener and adding providers there. Will soon update the https://github.com/amitlpande/tomcat-9-fips for detailed steps. Thanks, Amit

RE: [External] Re: Tomcat upgrade from 9.0.80 to 9.0.81

2023-10-10 Thread Amit Pande
form (black box) testing and communicate the results (Details in case of >> failures). Thanks, Amit -Original Message- From: Konstantin Kolinko Sent: Tuesday, October 10, 2023 7:11 PM To: Tomcat Users List Subject: Re: [External] Re: Tomcat upgrade from 9.0.80 to 9.0.81 CAUTION: This

Re: [External] Re: Tomcat upgrade from 9.0.80 to 9.0.81

2023-10-10 Thread Amit Pande
go in subsequent release? Thanks, Amit From: Konstantin Kolinko Sent: Tuesday, October 10, 2023 5:12:45 PM To: Tomcat Users List Subject: [External] Re: Tomcat upgrade from 9.0.80 to 9.0.81 CAUTION: This email originated from outside the organization. Do not

Tomcat upgrade from 9.0.80 to 9.0.81

2023-10-10 Thread Amit Pande
keep everyone posted after debugging more. Thanks, Amit

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-09-05 Thread Amit Pande
Thank you, Jonathan, for updating this thread. I was thinking of cleaning up the existing patch and submit it for review. I agree it's better to get feedback before any work is started. Thanks, Amit -Original Message- From: Jonathan S. Fisher Sent: Monday, September 4, 2023 9:42

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-08-28 Thread Amit Pande
Oh, sure. So, what would be the best way to get some conclusion on this thread? https://bz.apache.org/bugzilla/show_bug.cgi?id=57830 The state of the ticket isn't updated for long. Perhaps add comments/ask the folks on user list to vote? Thanks, Amit -Original Message- From:

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-08-28 Thread Amit Pande
Mark, Just checking - Did this issue get discussed in any of the core members' meeting? Thanks, Amit -Original Message- From: Amit Pande Sent: Monday, July 31, 2023 9:29 AM To: Tomcat Users List Subject: RE: [External] Re: Supporting Proxy Protocol in Tomcat Yes, understood.

RE: [External] Re: listening all local addresses by default is not security best practice

2023-08-25 Thread Amit Pande
Thank you, Chris, for inputs. I have created a BZ ticket: https://bz.apache.org/bugzilla/show_bug.cgi?id=67065 Thanks, Amit -Original Message- From: Christopher Schultz Sent: Monday, August 14, 2023 10:47 AM To: Tomcat Users List Subject: Re: [External] Re: listening all local

RE: [External] Re: listening all local addresses by default is not security best practice

2023-08-06 Thread Amit Pande
net.SocketException: Protocol family unavailable at sun.nio.ch.Net.bind0(Native Method) which has caused confusion/concerns. What would be a better way to bind on "all available loopback addresses? Thanks, Amit -Original Message- From: Christopher Schult

RE: [External] Re: Using dedicated SSL handshake failure logger

2023-08-03 Thread Amit Pande
Yes, I have verified that CATALINA_HOME is set correctly. And just for testing purposes, I changed the prefix to something like: 1catalina.org.apache.juli.AsyncFileHandler.prefix = catalina.amit. And I do see a catalina.amit.2023-08-03.log file created under web server logs. Thanks, Amit

Using dedicated SSL handshake failure logger

2023-08-03 Thread Amit Pande
ng in the logger configuration? Do we have to have the console handler configured? Thanks, Amit

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-07-31 Thread Amit Pande
Yes, understood. Thank you for clarifying. Even I was referring to initial consensus without any timeline or approach conclusion. Thanks, Amit -Original Message- From: Mark Thomas Sent: Friday, July 28, 2023 2:48 PM To: users@tomcat.apache.org Subject: Re: [External] Re: Supporting

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-07-28 Thread Amit Pande
Thank you all for the valuable discussion on this topic. Is it okay to say that we're agreeing to adding proxy protocol support in Tomcat? Thanks, Amit -Original Message- From: Christopher Schultz Sent: Thursday, July 27, 2023 4:13 PM To: users@tomcat.apache.org Subject: Re: [Ext

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-07-26 Thread Amit Pande
Missed to ask this: Looking the patch, it involves modifying Tomcat code. Was wondering if it would be possible to refactor this patch and/or allow Tomcat core code to extend and plug-in the proxy protocol support? Thanks, Amit -Original Message- From: Amit Pande Sent: Wednesday, July

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-07-26 Thread Amit Pande
Chris, Mark, Any thoughts on this? Mark, if we clean up the patch and re-submit, do you will have any concerns (specially security wise)? Thanks, Amit -Original Message- From: Jonathan S. Fisher Sent: Monday, July 24, 2023 12:41 PM To: Tomcat Users List Subject: Re: [External] Re

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-07-24 Thread Amit Pande
about using the patch in its current state, but I see last comment (#24) on the issue and looks like there are some more points to be concluded. Thanks, Amit -Original Message- From: Christopher Schultz Sent: Wednesday, May 10, 2023 4:21 PM To: users@tomcat.apache.org Subject: Re: [External

Setting security response headers when Valve returns error..

2023-06-09 Thread Amit Pande
7;s web.xml has "org.apache.catalina.filters.HttpHeaderSecurityFilter" confugred. The requirement is to set the security related headers even when the request is denied from the "org.apache.catalina.valves.RemoteAddrValve", which I don't see being set. What is the right way to address such requirement? Did I miss anything here? Thanks, Amit

Re: [External] Re: Rate Limiting support in Tomcat 9.x

2023-05-24 Thread Amit Pande
Thank you Mark for quick response. Yes, I see that in the change log for 9.0.76 (dev). 😊 Thanks, Amit From: Mark Thomas Sent: Tuesday, May 23, 2023 2:29:21 AM To: users@tomcat.apache.org Subject: [External] Re: Rate Limiting support in Tomcat 9.x On 22/05

Rate Limiting support in Tomcat 9.x

2023-05-22 Thread Amit Pande
request be raised to get this in next Tomcat 9.x release? Thanks, Amit

RE: [External] Re: Supporting Proxy Protocol in Tomcat

2023-05-10 Thread Amit Pande
://bz.apache.org/bugzilla/show_bug.cgi?id=57830, does it imply that most of the times Tomcat is running behind HTTP proxies and not TCP proxies? Or does it mean that, Tomcat or applications running in Tomcat does not need the remote client address information? Thanks, Amit -Original Message- From

Supporting Proxy Protocol in Tomcat

2023-05-04 Thread Amit Pande
other alternatives to pass the client information from load balancer to Tomcat in situations where there is no SSL termination at load balancer? Appreciate any feedback. Thanks, Amit

RE: [External] Re: Customizing CorsFilter

2022-09-07 Thread Amit Pande
Thank you, again! 😊 -Original Message- From: Mark Thomas Sent: Wednesday, September 7, 2022 6:31 AM To: users@tomcat.apache.org Subject: Re: [External] Re: Customizing CorsFilter On 07/09/2022 12:22, Amit Pande wrote: > Thank you, Mark! Will do some more research on this and see i

RE: [External] Re: Customizing CorsFilter

2022-09-07 Thread Amit Pande
Thank you, Mark! Will do some more research on this and see if I can leverage this. However, are we still okay refactoring the CorsFilter for extension? Thanks, Amit -Original Message- From: Mark Thomas Sent: Wednesday, September 7, 2022 6:18 AM To: users@tomcat.apache.org Subject

RE: [External] Re: Customizing CorsFilter

2022-09-07 Thread Amit Pande
server restart? What is the best/safe way to edit the main web.xml? Thanks, Amit -Original Message- From: Mark Thomas Sent: Wednesday, September 7, 2022 1:37 AM To: users@tomcat.apache.org Subject: [External] Re: Customizing CorsFilter On 07/09/2022 07:31, Mark Thomas wrote: > O

Customizing CorsFilter

2022-09-06 Thread Amit Pande
lore the option of looking for adding interface to "edit" the web.xml, wanted to check if it's possible to update the CorsFilter and make some methods protected (e.g. https://github.com/apache/tomcat/blob/9.0.65/java/org/apache/catalina/filters/CorsFilter.java#L712) for extension. Thanks, Amit

RE: [External] Re: SSL Handshake Failure - Logging Level

2022-06-06 Thread Amit Pande
I mean this log is helpful troubleshooting issues in production systems. We can't have Tomcat log level set to DEBUG in this case. And debugging on local/development environments. Agree, in this case, we could change the Tomcat logging configuration and get this log. Thanks, Amit -Ori

RE: [External] Re: SSL Handshake Failure - Logging Level

2022-06-03 Thread Amit Pande
at SSL host config level in "server.xml". Thanks, Amit -Original Message- From: Mark Thomas Sent: Friday, June 3, 2022 12:24 PM To: users@tomcat.apache.org Subject: [External] Re: SSL Handshake Failure - Logging Level On 03/06/2022 15:33, Amit Pande wrote: > Hello, >

SSL Handshake Failure - Logging Level

2022-06-03 Thread Amit Pande
rror level? Thanks, Amit

RE: [External] Re: Maximum header size in Tomcat 9

2022-06-03 Thread Amit Pande
Thank you, Mark! -Original Message- From: Mark Thomas Sent: Thursday, May 26, 2022 6:10 AM To: users@tomcat.apache.org Subject: Re: [External] Re: Maximum header size in Tomcat 9 On 25/05/2022 16:21, Amit Pande wrote: > Hello Mark, > > Could we slightly update the description

RE: [External] Re: Maximum header size in Tomcat 9

2022-05-25 Thread Amit Pande
. maxHttpHeaderSize The maximum size of the request and response HTTP header, specified in bytes. If not specified, this attribute is set to 8192 (8 KB). Thanks, Amit -Original Message- From: Mark Thomas Sent: Wednesday, May 25, 2022 6:16 AM To: users@tomcat.apache.org Subject: [External] Re: Maximum

RE: [OT] web app big memory usage?

2021-05-27 Thread Amit Pande
Have you enabled the " Enable 'keep unreachable objects'" setting of MAT? https://blog.gceasy.io/2015/12/11/eclipse-mat-titbits/ Thanks, Amit -Original Message- From: Berneburg, Cris J. - US Sent: Thursday, May 27, 2021 2:24 PM To: users@tomcat.apache.org Sub

Re: Not able to make JSESSIONID cookie secure

2021-01-06 Thread Amit Khosla
21 03:17, Mark Thomas wrote: > > On 04/01/2021 06:02, Amit Khosla wrote: > >> Hi, > >> > >> We are still facing this issue. Can someone please help us? > > > > In a clean 8.5.x install, session cookies are only marked as secure if > > the reque

Re: Not able to make JSESSIONID cookie secure

2021-01-03 Thread Amit Khosla
Hi, We are still facing this issue. Can someone please help us? Thanks & Regards Amit On Fri, Jan 1, 2021 at 8:22 PM Amit Khosla wrote: > Thanks for reply! > > We did changes in /conf/web.xml. > But when the changes did not reflect, we made changes in specific app as > wel

Re: Not able to make JSESSIONID cookie secure

2021-01-01 Thread Amit Khosla
/http-headers-test > > > On 31/12/20, 8:29 pm, "Amit Khosla" wrote: > > Thanks for reply, > we did restarted server while trying. The issue is still there even > after > restart. > > On Thu, Dec 31, 2020 at 11:14

Re: Not able to make JSESSIONID cookie secure

2020-12-31 Thread Amit Khosla
Thanks for reply, we did restarted server while trying. The issue is still there even after restart. On Thu, Dec 31, 2020 at 11:14 AM Darryl Lewis wrote: > > > true > true > > > > Restart the server. > > On 31/12/20, 3:50 pm, "A

Not able to make JSESSIONID cookie secure

2020-12-30 Thread Amit Khosla
? Thanks & Regards Amit

RE: [EXTERNAL] Re: Can Tomcat 9 be FIPS compliant without OpenSSL?

2020-12-09 Thread Amit Pande
(over PKCS12) for our key stores as it is the only format meeting our FIPS requirements. Thanks, Amit -Original Message- From: George Stanchev Sent: Saturday, December 5, 2020 11:17 AM To: Tomcat Users List Subject: RE: [EXTERNAL] Re: Can Tomcat 9 be FIPS compliant without OpenSSL?

RE: [EXTERNAL] Re: Bouncy Castle FIPS on RHEL 7.3

2020-12-09 Thread Amit Pande
Thank you Stefan, Chris for the inputs. As I understood from our security experts, there is no moving away from /dev/random (anything else isn't (strongly) FIPS compliant) for us. Thanks, Amit -Original Message- From: Christopher Schultz Sent: Wednesday, December 2, 2020 10:29

RE: [EXTERNAL] Re: Bouncy Castle FIPS on RHEL 7.3

2020-11-30 Thread Amit Pande
7.3 systems I have, maybe I need to look for machines from different data center or a physical 7.3 server). And yes, the 10 year certificate validity is just for testing purposes. 😊 Thank you for your inputs. Indeed helpful in evaluating our choices. Thanks, Amit -Original Message

RE: [EXTERNAL] Re: Bouncy Castle FIPS on RHEL 7.3

2020-11-25 Thread Amit Pande
ion and starting Tomcat in timely manner (FIPS or no FIPS) has been a critical requirement. And now, with this issue, test suites timing out, hard to convince to get the suite timeouts increased. 😊 Thanks, Amit -Original Message- From: Christopher Schultz Sent: Wednesday, November

RE: [EXTERNAL] Re: Can Tomcat 9 be FIPS compliant without OpenSSL?

2020-11-24 Thread Amit Pande
above rely purely on JSSE and JCA/JCE providers, no OpenSSL use. These steps will enable a plain vanilla Tomcat to run in FIPS compliant mode. And as Chris mentioned below, we need to ensure any web app deployed within the Tomcat use FIPS compliant constructs. Thanks, Amit -Original Me

Bouncy Castle FIPS on RHEL 7.3

2020-11-24 Thread Amit Pande
e has seen this behavior or be aware of such potential issue as it may tie in to their Tomcat (or web apps to be deployed in Tomcat). Thanks, Amit

Re: [EXTERNAL] Re: Embedded vs Standalone Tomcat

2020-10-20 Thread Amit Pande
Thank you so much Igal for the inputs. Thanks, Amit Thanks, Amit From: Igal Sapir Sent: Sunday, October 18, 2020 11:36:22 AM To: Tomcat Users List Subject: [EXTERNAL] Re: Embedded vs Standalone Tomcat Amit, On Fri, Oct 16, 2020 at 8:32 AM Amit Pande wrote

Embedded vs Standalone Tomcat

2020-10-16 Thread Amit Pande
any issues, limitations here? 6. Any differences with resource usages (e.g. heap)? Any help is greatly appreciated. Thanks, Amit

RE: [EXTERNAL] Re: Enabling FIPS for Tomcat

2020-09-30 Thread Amit Pande
Thank you Mark! Will work on getting this added to the Wiki page. Would appreciate feedback from all to confirm accuracy/usefulness. Thanks, Amit -Original Message- From: Mark Thomas Sent: Tuesday, September 29, 2020 1:40 PM To: users@tomcat.apache.org Subject: [EXTERNAL] Re

Enabling FIPS for Tomcat

2020-09-29 Thread Amit Pande
(extended) Tomcat documentation? Even if currently it uses Bouncy Castle as FIPS JCA/JCE provider, with minor changes it would work for any other provider too (e.g. CryptoComply for Java / CCJ from Safelogic) Thanks, Amit

Mitigating slow HTTP headers vulnerability

2020-06-08 Thread Amit Pande
an can be done to address this? We're trying to avoid putting reverse proxy in front of Tomcat as we do have our own pass-through proxy but it doesn't have any special capabilities to avoid this vulnerability like some reverse proxies (e.g. ngnix) have. Appreciate the inputs here. Thanks, Amit

RE: [EXTERNAL] Re: Ensuring clean Tomcat shutdown

2020-06-08 Thread Amit Pande
Thank you Luis for the inputs. Yes, we do use the listeners and "contextDestroyed" and clean up the resources. But with many team members working, wanted to have some automated check to ensure cleaning up wasn't missed. Thanks, Amit -Original Message- From: Luis Rodr

Ensuring clean Tomcat shutdown

2020-06-06 Thread Amit Pande
e a better/elegant way to achieve this? E.g. using life cycle listeners? Also, the catalina stop option (where a kill is attempted after n seconds are passed) works for all platforms, is my understanding correct? Thanks, Amit

Re: [EXTERNAL] Re: Query regarding bindOnInit default value..

2020-03-29 Thread Amit Pande
Thanks for the inputs, Mark. Thanks, Amit > On Mar 29, 2020, at 5:06 PM, Mark Thomas wrote: > > On 29/03/2020 08:11, Amit Pande wrote: >> Hello all, >> >> I was exploring Tomcat configuration which doesn't accept requests until the >> web applicati

Query regarding bindOnInit default value..

2020-03-29 Thread Amit Pande
ss. When this is set to "true", all requests during when the application deployment wasn't complete, I could see failed SSL handshakes in access logs. Wanted to understand more about the current default of true before I change the default. Thanks, Amit

RE: [EXTERNAL] Re: Uploads breaking post upgrade to 9.0.31

2020-03-18 Thread Amit Pande
Thank you so much Mark! Moving to Tomcat 9.0.33 indeed solved the problem I was facing. Thanks, Amit -Original Message- From: Mark Thomas Sent: Tuesday, March 17, 2020 1:06 PM To: users@tomcat.apache.org Subject: Re: [EXTERNAL] Re: Uploads breaking post upgrade to 9.0.31 On 17/03

RE: [EXTERNAL] Re: Uploads breaking post upgrade to 9.0.31

2020-03-17 Thread Amit Pande
gException: Unexpected end-of-input in VALUE_STRING at [Source: (PushbackInputStream); line: 1, column: 17] (through reference chain: com.abc.xyz["str"])at For smaller payloads, no issues are observed. Will this also be addressed by upgrading to 9.0.32/33? Thanks, Amit -

Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS

2019-06-20 Thread Amit Pande
Could you please clarify: Affected versions 8.5.0 to 8.5.40 Mitigation says: 8.5.40 or later What am I missing? > On Jun 20, 2019, at 2:25 PM, Mark Thomas wrote: > > CVE-2019-10072 Apache Tomcat HTTP/2 DoS > > Severity: Important > > Vendor: The Apache Software Foundation > > Versions Aff

Re: [EXTERNAL] Re: Request header too large..

2018-11-05 Thread Amit Pande
documentation be made more elaborate? Can we mention that this attribute puts the upper bound on combined size of all request headers and the request line? Thanks, Amit On 11/3/18, 4:39 AM, "Mark Thomas" wrote: On 03/11/2018 01:35, Amit Pande wrote: > Thanks Chris. Yes, I will soon

Re: [EXTERNAL] Re: Request header too large..

2018-11-02 Thread Amit Pande
Thanks Chris. Yes, I will soon send out the patch for review. Thanks, Amit On 11/2/18, 5:25 PM, "Christopher Schultz" wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Amit, On 11/2/18 17:16, Amit Pande wrote: > As per current implementation (

Request header too large..

2018-11-02 Thread Amit Pande
ell? Thanks, Amit

Re: [EXTERNAL] Re: Hostnames with underscores

2018-10-26 Thread Amit Pande
erscore too. Thanks, Amit On Oct 26, 2018, at 12:02 PM, M. Manna mailto:manme...@gmail.com>> wrote: Have you checked the connector config doc for relaxedPathChars and relaxedQueryChars? On Fri, 26 Oct 2018 at 18:00, Amit Pande mailto:amit.pa...@veritas.com>> wrote: Hello all,

Hostnames with underscores

2018-10-26 Thread Amit Pande
this strict check configurable so that we can continue to cater to our customers without breaking the functionality? Are there any other alternates to help solve this issue? Thanks, Amit

Re: [EXTERNAL] Re: Tomcat custom location for configuration

2018-10-26 Thread Amit Pande
aned up in next Tomcat release(s), right? Thanks, Amit On 10/4/18, 12:15 PM, "Christopher Schultz" wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Amit, On 10/4/18 12:17, Amit Pande wrote: > Thanks! I will take a detailed relook at using CATALINA_

Re: [EXTERNAL] Re: Tomcat custom location for configuration

2018-10-04 Thread Amit Pande
ing it? If it's going to stay, do you feel it's worth documenting (till the time it isn't actually deprecated with some alternate)? I agree while not desirable at the moment, using "-config" solves our problem. So, we might have to use this as last fallback option. Th

Re: [EXTERNAL] Re: Tomcat custom location for configuration

2018-10-03 Thread Amit Pande
, Amit On 10/3/18, 10:16 AM, "Mark Thomas" wrote: On 02/10/18 17:41, Amit Pande wrote: > Hello SMEs, > > I am looking at Tomcat documentation to see if there is a way to move the “/conf” to a custom location and use this path while running the startup/shutdown sc

Tomcat custom location for configuration

2018-10-02 Thread Amit Pande
have observed “configtest” script isn’t working with “-config ”. I am seeing “WARNING: Unable to load server configuration from [path_to_server_dot_xml] Configuration error detected!”. Is this know issue on Linux system? It seemed to work fine for Windows. Appreciate your inputs. Thanks, Amit

Re: [EXTERNAL] Using CLIENT-CERT

2018-04-11 Thread Amit Pande
Thank you so much Chris and Mark! Sincerely appreciate the inputs. Sent from my iPhone > On Apr 11, 2018, at 8:16 AM, Christopher Schultz > wrote: > > Mark and Amit, > >> On 4/10/18 2:21 AM, Mark Thomas wrote: >>> On 9 April 2018 23:29:43 BST, Amit Pande wrote

Re: [EXTERNAL] Using CLIENT-CERT

2018-04-09 Thread Amit Pande
a protected resource? Appreciate your inputs. On 4/8/18, 6:44 PM, "Amit Pande" wrote: I am trying to setup Tomcat (8.5.28) and the web-app correctly in order to get the mutual authentication (using client certificates) done but only for some recourses and not all. Fo

Using CLIENT-CERT

2018-04-08 Thread Amit Pande
provided credentials Description The request has not been applied because it lacks valid authentication credentials for the target resource. Appreciate your help on this. Thanks, Amit

Bug 45014 - Request and Response classes should have wrappers for use in Valves

2017-10-05 Thread Amit Pande
level (to make it application independent) which essentially meant wrapping the request body to make it available to subsequent components. But, no built-in support meant we had to move the implementation at a filter level. Thanks, Amit

Re: Tomcat 8.5 : Jasper errors

2017-02-27 Thread Amit Pande
) The jasper ant task is as follows -→ (This directory has the above mentioned jar file) On 2/25/17, 7:32 AM, "Amit Pande" wrote: When upg

Tomcat 8.5 : Jasper errors

2017-02-25 Thread Amit Pande
When upgraded from Tomcat 8.0.x to 8.5.x, while building our custom tags, the build is failing with below stack trace. The exception file not found does not give any clue on what’s the problem with the custom tag definition. I tried setting verbose attribute in jspc ant task as well as tried ru

Re: JIO Connector support in Tomcat 8.5

2017-02-20 Thread Amit Pande
instead of private. Appreciate your thoughts. Thanks, Amit On 2/16/17, 11:48 AM, "Christopher Schultz" wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Amit, On 2/13/17 8:19 PM, Amit Pande wrote: > Thanks for a quick reply. > > W

Re: JIO Connector support in Tomcat 8.5

2017-02-14 Thread Amit Pande
Any suggestions on this? Could the Tomcat NIO connector be modified to receive the file descriptor from the other process ( mentioned below)? Thanks, Amit Original Message Subject: Re: JIO Connector support in Tomcat 8.5 From: Amit Pande Date: Feb 13, 2017, 19:20 To

Re: JIO Connector support in Tomcat 8.5

2017-02-13 Thread Amit Pande
processes. Tomcat being one such process. Our custom connector accepts the handed-off socket and then resumes the normal processing done by Tomcat. Now for NIO connector, seems we need to have a custom implementation of the SocketChannel but not sure how it might work. Thanks, Amit

  1   2   >