Bug 996558
| Summary: | Https connection hangs after adding https connector | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [JBoss] JBoss Enterprise Application Platform 6 | Reporter: | Petr Sakař <psakar> | ||||||
| Component: | Web | Assignee: | Jean-frederic Clere <jclere> | ||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Radim Hatlapatka <rhatlapa> | ||||||
| Severity: | high | Docs Contact: | Russell Dickenson <rdickens> | ||||||
| Priority: | unspecified | ||||||||
| Version: | 6.1.1, 6.2.0 | CC: | akostadi, asoldano, brian.stansberry, jcacek, jclere, jdoyle, myarboro, nobody, tcerar | ||||||
| Target Milestone: | CR2 | ||||||||
| Target Release: | EAP 6.2.0 | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: |
When adding an HTTPS connector via the management CLI, any attempted connection would hang, despite each command completing successful. The cause of the issue was that the connector was started as soon as it was created, yet its configuration was incomplete, preventing the connector working as expected. A workaround in this instance was to wrap the configuration commands in a `batch`, `end-batch` sequence, so that all configuration statements were completed together. The root cause of this issue has been resolved and access to a HTTP connector is successful, whether or not the configuration statements are completed in sequence or as a management CLI batch.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2013-12-15 16:17:27 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
|
Description
Petr Sakař
2013-08-13 12:43:57 UTC
Created attachment 786136 [details]
war with index.html
I'm also experiencing the same behavior when trying to add a native ssl connector. If I add the connector with two separate cli commands, then attempting to open a https URL results in connection hand and eventually timing out in the browser. Server restart fixes the issue. On the other hand, using the same two commands to within a batch, makes everything work correctly. The problem is that there is no error message in cli console or server log to indicate any problem. So user wouldn't know what's wrong. FYI here is how I do that: 1. change native="true" in server config 2. start server 3. generate self-signed certificate with openssl > openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=localhost" -keyout certs/localhost.key -out certs/localhost.cert 4. use the following cli commands: > /subsystem=web/connector=https:add(enabled="true", enable-lookups="false", secure="true", scheme="https", socket-binding="https", protocol="HTTP/1.1") > {"outcome" => "success"} > /subsystem=web/connector=https/configuration=ssl:add(name="native-https", certificate-file="/tmp/certs/localhost.cert", certificate-key-file="/tmp/certs/localhost.key") > {"outcome" => "success"} 5. try to open https URL As I already said, if I wrap the cli commands within batch/run-batch, then everything works correctly. I think that is unknown bug and no possible to fix it. The connector starts without ssl and adding ssl doesn't tell to restart the server. if you use http:// instead https:// you should get a working connection. This could be quite easily fixed, by restart-parent service handler on ssl:add() operation. A workaround would be to add whole ssl connector configuration as part of batch. Jean-Fredederic, Do you have a comment on Tomaz's suggestion? Can we try this for 6.2? Tomaz gave me an example I have a patch I need to test... Actually when adding ssl there is already a message:
++++
[standalone@localhost:9999 /] /subsystem=web/connector=https/:add(socket-binding=https,protocol="HTTP/1.1",scheme="https")
{"outcome" => "success"}
[standalone@localhost:9999 /] /subsystem=web/connector=https/ssl=configuration:add
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
+++
A quick try with "restart-parent service handler on ssl:add() " doesn't seem to work. I think we should move this one to 6.3. Tomaz helped me today on the topic. It is working I will do the pull request soon. Verified for EAP 6.2.0.CR2 preview using procedure described in comment#0 Result of command from step 4 is "Reload-required", page is not available before reload and is available after reload Was not the fix to make the restart automatic on ssl add? it does you need {allow-resource-service-restart=true }
cause: When adding a connector it is started immediately. So when a SSL connector in 2 steps (first the connector, then ssl to the connector) the connector was running without ssl. Note that a message is displayed asking for restart. the rest is in the BZ... Russel, as far as I see now the change is that reload required is returned as status instead of success. It's not like connector is restarted by default. The reload required was already returned but the connector wasn't restarted. |