Bug 901143 (JBPAPP6-1170)
| Summary: | mod_cluster returns "Bad Gateway" HTTP ErrorCode 502 with https | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [JBoss] JBoss Enterprise Application Platform 6 | Reporter: | Michal Karm Babacek <mbabacek> | ||||||
| Component: | mod_cluster | Assignee: | Permaine Cheung <pcheung> | ||||||
| Status: | CLOSED NEXTRELEASE | QA Contact: | |||||||
| Severity: | urgent | Docs Contact: | |||||||
| Priority: | urgent | ||||||||
| Version: | 6.0.0 | CC: | aogburn, christopher.hiner, jfclere, mbabacek, pcheung, rhatlapa | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | EAP 6.0.1 | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| URL: | http://jira.jboss.org/jira/browse/JBPAPP6-1170 | ||||||||
| Whiteboard: | mod_cluster | ||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: |
Confirmed: RHEL on x86 x86_64
, To be confirmed: Solaris, Windows
|
|||||||
| Last Closed: | 2012-11-29 14:51:41 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Attachment: Added: JBPAPP-9493-reproduced-with-m_c-1.2.3.Final.zip Link: Added: This issue is related to JBPAPP-10029 Link: Added: This issue is related to JBPAPP-9493 Attachment: Removed: JBPAPP-9493-reproduced-with-m_c-1.2.3.Final.zip (i) *Note:* I've just updated [^JBPAPP-9493-reproduced-with-m_c-1.2.3.Final.zip] with {{ssl.conf}}, where one might find some auxiliary info. Just for sake of completeness.
Attachment: Added: JBPAPP-9493-reproduced-with-m_c-1.2.3.Final.zip Link: Added: This issue Cloned to JBPAPP-10321 Release Notes Docs Status: Added: Not Yet Documented Follow the most up-to-date feed on [JBPAPP-10029|https://issues.jboss.org/browse/JBPAPP-10029?focusedCommentId=12732465&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-12732465] ... Release Notes Docs Status: Removed: Not Yet Documented Docs QE Status: Removed: NEW Link: Added: This issue is related to JBPAPP-10409 Please provide the patch for mod_cluster 1.2.3.Final so that we can build with the patch for the next ER. Thanks! patch for 1.2.3.Final Attachment: Added: 855cdda451eb561abe10463133f36360d5a302fe.patch Thanks for the patch, we've started on the rebuilding with the patch applied. Patch added to mod_cluster-native-1.2.3-3.Final.ep6.el6 and mod_cluster-native-1.2.3-3.Final.ep6.el5, both builds added to EAP 6.0.1 errata. Also updated jboss-eap-native-webserver-connectors-6.0.1-5.ep6.el6 and jboss-eap-native-webserver-connectors-6.0.1-5.ep6.el5 to include the fix in the connectors zip. New Solaris and Windows webserver connector builds are ready as well, with Release: tag 4.win6 and 4.sun10. All of the above builds updated in jboss-eap6-compose build to collect new natives, jboss-eap6-compose-6.0.1-10.ER4.ep6.el6 is the latest with all of the above builds. Will be in 6.0.1.ER4. Verified with ER4. |
Complexity: High Steps to Reproduce: h3. How to reproduce # Configure AS7 with HTTPS connector as in [^JBPAPP-9493-reproduced-with-m_c-1.2.3.Final.zip] # Configure Httpd + Mod_cluster with SSL as in [^JBPAPP-9493-reproduced-with-m_c-1.2.3.Final.zip] # Start httpd # Start AS7 # Send a request, e.g. like: {noformat} curl https://localhost:8888/SessionTest/session --cert /home/mbabacek/EAP6/Client/client.crt --key /home/mbabacek/EAP6/Client/client.key --cacert /home/mbabacek/EAP6/Client/myca.crt --insecure -c originally_empty_cookiefile.txt -b originally_empty_cookiefile.txt 2> /dev/null {noformat} # Optionally, wait ~10 minutes. (!) You might start to having errors even without this request free wait period. # Sned another request & get an error # Eventually, after *STATUS* message is received, you will get correct HTTP 200 again. (i) *Note:* As soon as STATUS message is received, it picks up again... Workaround Description: Turning off keepAlive settings, see [Aaron's comment|https://issues.jboss.org/browse/JBPAPP-9493?focusedCommentId=12709722&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-12709722] project_key: JBPAPP6 h3. Error :-( {noformat} [info] [client 127.0.0.1] Connection to child 0 established (server dhcp-27-136.brq.redhat.com:8888) [info] Seeding PRNG with 144 bytes of entropy [debug] ssl_engine_kernel.c(1889): OpenSSL: Handshake: start [debug] ssl_engine_kernel.c(1897): OpenSSL: Loop: before/connect initialization [debug] ssl_engine_kernel.c(1897): OpenSSL: Loop: SSLv2/v3 write client hello A [debug] ssl_engine_io.c(1897): OpenSSL: read 7/7 bytes from BIO#7fe4c4d61a00 [mem: 7fe4c4d646e0] (BIO dump follows) [debug] ssl_engine_io.c(1830): +-------------------------------------------------------------------------+ [debug] ssl_engine_io.c(1869): | 0000: 15 03 01 00 02 02 0a ....... | [debug] ssl_engine_io.c(1875): +-------------------------------------------------------------------------+ [debug] ssl_engine_kernel.c(1902): OpenSSL: Read: SSLv2/v3 read server hello A [debug] ssl_engine_kernel.c(1926): OpenSSL: Exit: error in SSLv2/v3 read server hello A [info] [client 127.0.0.1] SSL Proxy connect failed [info] SSL Library Error: 336032754 error:140773F2:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert unexpected message [info] [client 127.0.0.1] Connection closed to child 0 with abortive shutdown (server dhcp-27-136.brq.redhat.com:8888) [error] (502)Unknown error 502: proxy: pass request body failed to 127.0.0.1:8443 (localhost) [error] [client 127.0.0.1] proxy: Error during SSL Handshake with remote server returned by /SessionTest/session [error] proxy: pass request body failed to 127.0.0.1:8443 (localhost) from 127.0.0.1 () [debug] proxy_util.c(2029): proxy: HTTPS: has released connection for (localhost) {noformat} h3. Related reading This problem is being actively investigated as a part of [JBPAPP-10029]. The original JIRA is [JBPAPP-9493]. * [2012-10-31] At the moment, follow comments on [JBPAPP-10029] please.