You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@stratos.apache.org by Akila Ravihansa Perera <ra...@wso2.com> on 2015/08/18 05:52:19 UTC
Applying Carbon kernel patches up to patch0011 to Stratos
Hi,
I've been working on applying Carbon kernel patches up to patch0011 to
Stratos. These kernel patches provides various bug fixes and security fixes
for Carbon which is the underlying platform of Stratos. While testing with
the patches I observed that webapp mgt features are broken after patch0010.
This is because patch0010 contains a upgraded Tomcat version (embedded
Tomcat for Carbon) which was released to fix a security vulnerability [1].
This newer Tomcat version contains some API changes, hence webapp mgt ver.
4.2.2 feature currently installed in Stratos is not compatible with kernel
patch0010.
The fix would be to uplift webapp mgt feature to ver. 4.2.3 which I have
already done and tested basic functionality in REST API and console app.
But we will have to do extensive testing of Carbon UI and other webapps
(api, metadata, console, mockiaas, oauth2) before we release it. I've all
the changes done in my fork and ready to be pushed to master. Are we going
with this for next patch release? What are your thoughts?
Changes made to p2 profile:
- uplifted org.wso2.carbon.webapp.mgt.feature to 4.2.3
- uplifted org.wso2.carbon.logging.mgt.feature.group to 4.2.2
[1] https://wso2.org/jira/browse/CARBON-15181
Thanks.
--
Akila Ravihansa Perera
WSO2 Inc.; http://wso2.com/
Blog: http://ravihansa3000.blogspot.com
Re: Applying Carbon kernel patches up to patch0011 to Stratos
Posted by Imesh Gunaratne <im...@apache.org>.
Hi Akila,
If you think this has a critical impact on existing web apps we can move
this to 4.1.3. Do we know which Tomcat APIs have been changed and how it
affects webapps?
Thanks
On Tue, Aug 18, 2015 at 2:17 PM, Akila Ravihansa Perera <ra...@wso2.com>
wrote:
> Hi Lasindu,
>
> That is a good alternative. But anyway we will have to test our webapps
> thoroughly after applying kernel patches. Since Carbon user core has been
> patched multiple times we may have to completely test identity related
> features (oauth, jwt tokens, metadata service etc.) as well.
>
> IMO, it is better to properly fix this in p2 profile by uplifting the
> webapp mgt feature. Also that is not the only feature I had to uplift.
>
> @All: appreciate your thoughts on this. Are we going to do this in next
> release?
>
> Thanks.
>
> On Tue, Aug 18, 2015 at 1:35 PM, Lasindu Charith <la...@wso2.com> wrote:
>
>> Hi Akila,
>>
>> Instead of uplifting the webapp.mgt.feature version, you might be able
>> to use security patch WSO2-CARBON-PATCH-4.2.0-1262 from [1
>> <http://wso2.com/products/identity-server/#Security-Patches>]
>> which upgrades embedded tomcat version from 7.0.34 to 7.0.55.
>>
>> [1] http://wso2.com/products/identity-server/#Security-Patches
>>
>> Thanks,
>>
>> On Tue, Aug 18, 2015 at 9:22 AM, Akila Ravihansa Perera <
>> ravihansa@wso2.com> wrote:
>>
>>> Hi,
>>>
>>> I've been working on applying Carbon kernel patches up to patch0011 to
>>> Stratos. These kernel patches provides various bug fixes and security fixes
>>> for Carbon which is the underlying platform of Stratos. While testing with
>>> the patches I observed that webapp mgt features are broken after patch0010.
>>> This is because patch0010 contains a upgraded Tomcat version (embedded
>>> Tomcat for Carbon) which was released to fix a security vulnerability [1].
>>> This newer Tomcat version contains some API changes, hence webapp mgt ver.
>>> 4.2.2 feature currently installed in Stratos is not compatible with kernel
>>> patch0010.
>>>
>>> The fix would be to uplift webapp mgt feature to ver. 4.2.3 which I have
>>> already done and tested basic functionality in REST API and console app.
>>> But we will have to do extensive testing of Carbon UI and other webapps
>>> (api, metadata, console, mockiaas, oauth2) before we release it. I've all
>>> the changes done in my fork and ready to be pushed to master. Are we going
>>> with this for next patch release? What are your thoughts?
>>>
>>> Changes made to p2 profile:
>>> - uplifted org.wso2.carbon.webapp.mgt.feature to 4.2.3
>>> - uplifted org.wso2.carbon.logging.mgt.feature.group to 4.2.2
>>>
>>> [1] https://wso2.org/jira/browse/CARBON-15181
>>>
>>> Thanks.
>>>
>>>
>>> --
>>> Akila Ravihansa Perera
>>> WSO2 Inc.; http://wso2.com/
>>>
>>> Blog: http://ravihansa3000.blogspot.com
>>>
>>
>>
>>
>> --
>> *Lasindu Charith*
>> Software Engineer, WSO2 Inc.
>> Committer & PMC Member, Apache Stratos
>> Mobile: +94714427192 | Web: blog.lasindu.com
>>
>
>
>
> --
> Akila Ravihansa Perera
> WSO2 Inc.; http://wso2.com/
>
> Blog: http://ravihansa3000.blogspot.com
>
--
Imesh Gunaratne
Senior Technical Lead, WSO2
Committer & PMC Member, Apache Stratos
Re: Applying Carbon kernel patches up to patch0011 to Stratos
Posted by Akila Ravihansa Perera <ra...@wso2.com>.
Hi Lasindu,
That is a good alternative. But anyway we will have to test our webapps
thoroughly after applying kernel patches. Since Carbon user core has been
patched multiple times we may have to completely test identity related
features (oauth, jwt tokens, metadata service etc.) as well.
IMO, it is better to properly fix this in p2 profile by uplifting the
webapp mgt feature. Also that is not the only feature I had to uplift.
@All: appreciate your thoughts on this. Are we going to do this in next
release?
Thanks.
On Tue, Aug 18, 2015 at 1:35 PM, Lasindu Charith <la...@wso2.com> wrote:
> Hi Akila,
>
> Instead of uplifting the webapp.mgt.feature version, you might be able to
> use security patch WSO2-CARBON-PATCH-4.2.0-1262 from [1
> <http://wso2.com/products/identity-server/#Security-Patches>]
> which upgrades embedded tomcat version from 7.0.34 to 7.0.55.
>
> [1] http://wso2.com/products/identity-server/#Security-Patches
>
> Thanks,
>
> On Tue, Aug 18, 2015 at 9:22 AM, Akila Ravihansa Perera <
> ravihansa@wso2.com> wrote:
>
>> Hi,
>>
>> I've been working on applying Carbon kernel patches up to patch0011 to
>> Stratos. These kernel patches provides various bug fixes and security fixes
>> for Carbon which is the underlying platform of Stratos. While testing with
>> the patches I observed that webapp mgt features are broken after patch0010.
>> This is because patch0010 contains a upgraded Tomcat version (embedded
>> Tomcat for Carbon) which was released to fix a security vulnerability [1].
>> This newer Tomcat version contains some API changes, hence webapp mgt ver.
>> 4.2.2 feature currently installed in Stratos is not compatible with kernel
>> patch0010.
>>
>> The fix would be to uplift webapp mgt feature to ver. 4.2.3 which I have
>> already done and tested basic functionality in REST API and console app.
>> But we will have to do extensive testing of Carbon UI and other webapps
>> (api, metadata, console, mockiaas, oauth2) before we release it. I've all
>> the changes done in my fork and ready to be pushed to master. Are we going
>> with this for next patch release? What are your thoughts?
>>
>> Changes made to p2 profile:
>> - uplifted org.wso2.carbon.webapp.mgt.feature to 4.2.3
>> - uplifted org.wso2.carbon.logging.mgt.feature.group to 4.2.2
>>
>> [1] https://wso2.org/jira/browse/CARBON-15181
>>
>> Thanks.
>>
>>
>> --
>> Akila Ravihansa Perera
>> WSO2 Inc.; http://wso2.com/
>>
>> Blog: http://ravihansa3000.blogspot.com
>>
>
>
>
> --
> *Lasindu Charith*
> Software Engineer, WSO2 Inc.
> Committer & PMC Member, Apache Stratos
> Mobile: +94714427192 | Web: blog.lasindu.com
>
--
Akila Ravihansa Perera
WSO2 Inc.; http://wso2.com/
Blog: http://ravihansa3000.blogspot.com
Re: Applying Carbon kernel patches up to patch0011 to Stratos
Posted by Lasindu Charith <la...@wso2.com>.
Hi Akila,
Instead of uplifting the webapp.mgt.feature version, you might be able to
use security patch WSO2-CARBON-PATCH-4.2.0-1262 from [1
<http://wso2.com/products/identity-server/#Security-Patches>]
which upgrades embedded tomcat version from 7.0.34 to 7.0.55.
[1] http://wso2.com/products/identity-server/#Security-Patches
Thanks,
On Tue, Aug 18, 2015 at 9:22 AM, Akila Ravihansa Perera <ra...@wso2.com>
wrote:
> Hi,
>
> I've been working on applying Carbon kernel patches up to patch0011 to
> Stratos. These kernel patches provides various bug fixes and security fixes
> for Carbon which is the underlying platform of Stratos. While testing with
> the patches I observed that webapp mgt features are broken after patch0010.
> This is because patch0010 contains a upgraded Tomcat version (embedded
> Tomcat for Carbon) which was released to fix a security vulnerability [1].
> This newer Tomcat version contains some API changes, hence webapp mgt ver.
> 4.2.2 feature currently installed in Stratos is not compatible with kernel
> patch0010.
>
> The fix would be to uplift webapp mgt feature to ver. 4.2.3 which I have
> already done and tested basic functionality in REST API and console app.
> But we will have to do extensive testing of Carbon UI and other webapps
> (api, metadata, console, mockiaas, oauth2) before we release it. I've all
> the changes done in my fork and ready to be pushed to master. Are we going
> with this for next patch release? What are your thoughts?
>
> Changes made to p2 profile:
> - uplifted org.wso2.carbon.webapp.mgt.feature to 4.2.3
> - uplifted org.wso2.carbon.logging.mgt.feature.group to 4.2.2
>
> [1] https://wso2.org/jira/browse/CARBON-15181
>
> Thanks.
>
>
> --
> Akila Ravihansa Perera
> WSO2 Inc.; http://wso2.com/
>
> Blog: http://ravihansa3000.blogspot.com
>
--
*Lasindu Charith*
Software Engineer, WSO2 Inc.
Committer & PMC Member, Apache Stratos
Mobile: +94714427192 | Web: blog.lasindu.com