You are viewing a plain text version of this content. The canonical link for it is here.
Posted to c-commits@axis.apache.org by ro...@apache.org on 2026/04/12 20:11:14 UTC
(axis-axis2-c-core) branch master updated (147c8ace1 -> aefbff639)
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
from 147c8ace1 Update transport note: both C and Java now use HTTPS/HTTP2
new 23f05e634 Add C vs Java MCP feature comparison; fix proprietary service name
new ff3eb4499 Harden financial benchmark: size_t cast, exp() overflow guard
new f3f034f78 Document pandemic stress test results (Feb-Apr 2020 market data)
new 684d1a190 Raise FinancialBenchmarkService limit to 50MB; document payload sizes
new 05e662f02 Add stock Ubuntu 22.04 apache2.conf as reference
new 99c4f62e5 Add fuzz target for Financial Benchmark Service (OSS-Fuzz)
new aefbff639 Raise FINBENCH_MAX_ASSETS from 2000 to 3000
The 7 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
deploy/share/doc/axis2c-src/docs/OSS-Fuzz.md | 112 +++++++++
docs/MCP.md | 37 ++-
docs/MCP_EXAMPLES.md | 60 +++++
docs/userguide/apache2.conf | 254 +++++++++++++++++++++
docs/userguide/axis2-services.conf | 6 +-
docs/userguide/httpd.conf | 6 +-
fuzz/fuzz_finbench.c | 174 ++++++++++++++
.../src/financial_benchmark_service.c | 17 +-
.../src/financial_benchmark_service.h | 8 +-
9 files changed, 662 insertions(+), 12 deletions(-)
create mode 100644 deploy/share/doc/axis2c-src/docs/OSS-Fuzz.md
create mode 100644 docs/userguide/apache2.conf
create mode 100644 fuzz/fuzz_finbench.c
(axis-axis2-c-core) 07/07: Raise FINBENCH_MAX_ASSETS from 2000 to 3000
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit aefbff63925b1a07c320f48455465ba9ad9c60b0
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sun Apr 12 06:27:41 2026 -1000
Raise FINBENCH_MAX_ASSETS from 2000 to 3000
Production AT departments have up to 2,270 assets (departmentID=861
on stg-rapi06, April 2026). The previous 2000 cap would reject
valid production-scale portfolios.
3000 provides growth margin. At 3000 assets the covariance matrix
payload is ~135 MB — reachable via MCP stdio (no payload limit)
but exceeds the HTTP 50MB LimitRequestBody for portfolioVariance.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
.../financial-benchmark-service/src/financial_benchmark_service.h | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.h b/samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.h
index b77d406f2..65a636593 100644
--- a/samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.h
+++ b/samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.h
@@ -48,8 +48,12 @@ extern "C"
{
#endif
-/* Maximum supported assets for benchmark */
-#define FINBENCH_MAX_ASSETS 2000
+/* Maximum supported assets for benchmark.
+ * Production AT departments have up to 2,270 assets (departmentID=861,
+ * stg-rapi06 April 2026). Cap at 3000 to cover growth with margin.
+ * Note: 3000-asset covariance matrix payload is ~135 MB (O(n²)),
+ * reachable via MCP stdio but exceeds HTTP 50MB LimitRequestBody. */
+#define FINBENCH_MAX_ASSETS 3000
#define FINBENCH_MAX_SCENARIOS 10
#define FINBENCH_MAX_SIMULATIONS 1000000
(axis-axis2-c-core) 01/07: Add C vs Java MCP feature comparison; fix proprietary service name
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 23f05e6343e50154eb7f4a3418c1a3fdbfeeb663
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sat Apr 11 16:17:33 2026 -1000
Add C vs Java MCP feature comparison; fix proprietary service name
New section "Feature Comparison: C vs Java MCP" documents:
- Feature parity on MCP essentials (initialize/tools/list/tools/call)
- Where C wins: startup (<100ms vs 1-3s), memory (30MB vs 512MB+),
throughput (150K vs 73K MC sims/sec), Android/edge/IoT support
- Where Java wins: auto-schema from types, Spring Boot integration
- Design intent: static struct array is the C idiom for tool catalogs,
not a limitation vs Java reflection
Also replaced proprietary service name in demo section.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
docs/MCP.md | 37 +++++++++++++++++++++++++++++++++++--
1 file changed, 35 insertions(+), 2 deletions(-)
diff --git a/docs/MCP.md b/docs/MCP.md
index b12dfcb0f..2d9e72bb8 100644
--- a/docs/MCP.md
+++ b/docs/MCP.md
@@ -266,6 +266,39 @@ is accepted by the Apache community.
---
+## Feature Comparison: C vs Java MCP
+
+Both implementations cover the MCP essentials — the three required methods
+(`initialize`, `tools/list`, `tools/call`) over stdio with full `inputSchema`.
+An AI assistant configured with either backend gets identical capabilities.
+
+| Feature | Axis2/C | Axis2/Java |
+|---|---|---|
+| `initialize` / `tools/list` / `tools/call` | ✅ | ✅ |
+| stdio transport | ✅ Native (fgets/fprintf) | ✅ Bridge JAR |
+| inputSchema | Static struct array (compile-time) | Auto-generated from Java types + manual override |
+| Startup time | **< 100 ms** | 1–3 sec (JVM cold-start) |
+| Memory footprint | **~30 MB** | 512 MB–2 GB JVM heap |
+| Monte Carlo throughput | **~150K sims/sec** | ~73K sims/sec |
+| HTTP/SSE transport | Planned (C2) | Planned (A4) |
+| Spring Boot integration | N/A | ✅ Starter with autoconfiguration |
+| Auto-schema from types | N/A (C has no reflection) | ✅ Java POJO introspection |
+| Android / edge / IoT | **✅ Native binary** | ❌ JVM required |
+
+The approaches differ by design, not by omission. Java's auto-schema
+generation uses runtime reflection — a language feature C does not have.
+C's static tool catalog is the idiomatic equivalent: explicit, zero-overhead,
+compile-time checked. Both produce the same MCP catalog JSON that AI
+assistants consume.
+
+Where the implementations compete is on the deployment edge: C runs where
+Java cannot (Android phones, IoT gateways, embedded systems) and starts
+instantly for stdio MCP (where Claude Desktop spawns a subprocess per
+session). Java runs where enterprise infrastructure already exists
+(WildFly, Tomcat, Spring Boot) with richer integration tooling.
+
+---
+
## Key Design Decisions for C Port
**Why static tool catalog, not services.xml reflection**
@@ -334,8 +367,8 @@ Claude Desktop
│ monteCarlo VaR — 10,000 GBM simulations in 100ms
│ scenarioAnalysis — O(n) vs O(1) hash, 2,000 assets
│
- └── axis2-java-services (HTTP/SSE, enterprise server)
- AssetCalculations — same calculations, JVM runtime
+ └── axis2-java-services (HTTPS/HTTP2, enterprise server)
+ FinancialBenchmarkService — same calculations, JVM runtime
BigDataH2Service — HTTP/2 streaming, large payloads
```
(axis-axis2-c-core) 06/07: Add fuzz target for Financial Benchmark Service (OSS-Fuzz)
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 99c4f62e551dac857bad1adb7a55e2c2b39fcb8e
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sun Apr 12 04:43:46 2026 -1000
Add fuzz target for Financial Benchmark Service (OSS-Fuzz)
New fuzz target fuzz_finbench.c exercises the complete
request->compute->response path for all three operations:
- portfolioVariance: O(n²) covariance matrix, weight normalization,
negative variance sqrt guard
- monteCarlo: GBM exp() overflow guard, percentile clamping,
CVaR div-by-zero guard, xorshift128+ PRNG
- scenarioAnalysis: hash table key management, probability
validation, O(n) vs O(1) benchmark paths
Caps n_simulations=100 and n_periods=50 during fuzzing to avoid
burning CPU on compute while still exercising all code paths.
Submitted to Google OSS-Fuzz for 24/7 continuous fuzzing on
Google infrastructure alongside the existing transport-layer
fuzz targets (JSON parser, HTTP headers, URL parser, XML parser).
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
deploy/share/doc/axis2c-src/docs/OSS-Fuzz.md | 112 +++++++++++++++++
fuzz/fuzz_finbench.c | 174 +++++++++++++++++++++++++++
2 files changed, 286 insertions(+)
diff --git a/deploy/share/doc/axis2c-src/docs/OSS-Fuzz.md b/deploy/share/doc/axis2c-src/docs/OSS-Fuzz.md
new file mode 100644
index 000000000..1822b9a78
--- /dev/null
+++ b/deploy/share/doc/axis2c-src/docs/OSS-Fuzz.md
@@ -0,0 +1,112 @@
+# OSS-Fuzz Integration for Apache Axis2/C
+
+## What is Fuzz Testing?
+
+Fuzz testing (fuzzing) automatically generates random, malformed, or unexpected inputs to find bugs that manual testing misses. It's especially effective at discovering:
+
+- Buffer overflows and memory corruption
+- Crashes from malformed input
+- Integer overflows
+- Denial of service vulnerabilities
+
+## What is OSS-Fuzz?
+
+[OSS-Fuzz](https://github.com/google/oss-fuzz) is Google's free continuous fuzzing service for open source projects. Once integrated, it runs 24/7 on Google's infrastructure, automatically:
+
+- Testing your code with millions of inputs daily
+- Reporting crashes and vulnerabilities privately
+- Tracking bug fixes and regressions
+
+## Eligibility
+
+Apache Axis2/C qualifies for OSS-Fuzz because it:
+
+1. **Is widely used** - Deployed in enterprise SOAP/web services
+2. **Processes untrusted input** - Parses XML, JSON, HTTP from network
+3. **Is open source** - Apache License 2.0
+4. **Has an active community** - Apache Software Foundation project
+
+Other Apache projects using OSS-Fuzz include Apache httpd (which Axis2/C uses as a dependency), Apache Commons, and Apache Tomcat.
+
+## Fuzz Targets
+
+The `fuzz/` directory contains these targets:
+
+| Target | Tests | Security Focus |
+|--------|-------|----------------|
+| `fuzz_xml_parser.c` | AXIOM XML/SOAP parsing | XXE, XML bombs, buffer overflows |
+| `fuzz_json_parser.c` | JSON parsing (HTTP/2 mode) | DoS, integer overflows (CVE-2020-12762) |
+| `fuzz_json_reader.c` | JSON→AXIOM conversion (HTTP/1.1) | Malformed JSON, type confusion |
+| `fuzz_http_header.c` | HTTP header/request/status parsing | Header injection, buffer overflows |
+| `fuzz_url_parser.c` | URL parsing | SSRF, malformed URLs |
+| `fuzz_finbench.c` | Financial Benchmark Service — full request→compute→response | Integer overflow, exp() overflow, div-by-zero, hash keys, array bounds |
+
+## Local Testing
+
+### Prerequisites
+
+```bash
+# Install clang with fuzzer support
+sudo apt-get install clang llvm
+
+# Build Axis2/C with AddressSanitizer
+export CC=clang
+export CFLAGS="-fsanitize=address,fuzzer-no-link -g"
+./configure --prefix=/usr/local
+make
+```
+
+### Run a Fuzz Target Locally
+
+```bash
+# Compile fuzz target
+clang -fsanitize=address,fuzzer \
+ -I/usr/local/include/axis2-2.0.0 \
+ -I/usr/local/include/axis2-2.0.0/platforms \
+ fuzz/fuzz_http_header.c \
+ -L/usr/local/lib -laxis2_http_sender -laxutil \
+ -o fuzz_http_header
+
+# Run with seed corpus
+./fuzz_http_header fuzz/corpus/http/
+
+# Run for 60 seconds
+./fuzz_http_header -max_total_time=60 fuzz/corpus/http/
+```
+
+## OSS-Fuzz Project Setup
+
+To submit Axis2/C to OSS-Fuzz, create a PR to [google/oss-fuzz](https://github.com/google/oss-fuzz) with:
+
+```
+projects/axis2c/
+├── Dockerfile # Build environment
+├── build.sh # Compilation script
+├── project.yaml # Project metadata
+```
+
+See `fuzz/oss-fuzz/` for ready-to-use templates.
+
+## Seed Corpus
+
+The `fuzz/corpus/` directory contains seed inputs that help the fuzzer explore code paths faster:
+
+- `corpus/xml/` - SOAP envelopes, XML with namespaces
+- `corpus/json/` - Valid JSON objects, arrays, nested structures
+- `corpus/http/` - HTTP request lines, headers, status lines
+- `corpus/url/` - HTTP/HTTPS URLs with various components
+
+## Handling Bug Reports
+
+When OSS-Fuzz finds a bug:
+
+1. You receive a private email with crash details
+2. Fix the bug within 90 days (before public disclosure)
+3. OSS-Fuzz automatically verifies the fix
+4. After 30 days of being fixed, the bug report becomes public
+
+## Resources
+
+- [OSS-Fuzz Documentation](https://google.github.io/oss-fuzz/)
+- [libFuzzer Tutorial](https://llvm.org/docs/LibFuzzer.html)
+- [Fuzzing Best Practices](https://google.github.io/oss-fuzz/getting-started/new-project-guide/)
diff --git a/fuzz/fuzz_finbench.c b/fuzz/fuzz_finbench.c
new file mode 100644
index 000000000..5487dcebf
--- /dev/null
+++ b/fuzz/fuzz_finbench.c
@@ -0,0 +1,174 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file fuzz_finbench.c
+ * @brief OSS-Fuzz target for the Financial Benchmark Service
+ *
+ * This fuzzer exercises the complete request→compute→response path
+ * of the financial benchmark service with random/malformed inputs:
+ *
+ * - portfolioVariance: O(n²) covariance matrix computation
+ * Tests: integer overflow in n_assets*n_assets, weight normalization
+ * div-by-zero, negative variance sqrt, array bounds
+ *
+ * - monteCarlo: GBM simulation with exp() overflow guard
+ * Tests: extreme volatility → exp() overflow, zero volatility,
+ * negative expected return, 1-simulation edge case, percentile
+ * out-of-bounds
+ *
+ * - scenarioAnalysis: hash table O(1) vs O(n) benchmark
+ * Tests: probability sum validation, zero prices, hash key
+ * collision, empty asset list
+ *
+ * The fuzzer feeds raw bytes as JSON to the service's request parsers,
+ * which must handle any input without crashing. This catches the same
+ * class of bugs that the pandemic stress test exercises but with far
+ * more input diversity — millions of random inputs per day on OSS-Fuzz
+ * infrastructure.
+ *
+ * Attack vectors:
+ * - Malformed JSON (missing fields, wrong types, nested garbage)
+ * - Extreme numeric values (INT_MAX, -0.0, NaN, Inf in JSON)
+ * - Oversized arrays (n_assets near MAX, huge covariance matrices)
+ * - Empty/null strings for request_id
+ * - Memory exhaustion from large n_simulations
+ */
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <axutil_env.h>
+#include <axutil_error_default.h>
+#include <axutil_log_default.h>
+#include <axutil_thread_pool.h>
+
+/* Include the financial benchmark service header */
+#include "../samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.h"
+
+static axutil_env_t *create_env(void)
+{
+ axutil_allocator_t *allocator = axutil_allocator_init(NULL);
+ axutil_error_t *error = axutil_error_create(allocator);
+ axutil_log_t *log = axutil_log_create(allocator, NULL, NULL);
+ axutil_thread_pool_t *pool = axutil_thread_pool_init(allocator);
+ return axutil_env_create_with_error_log_thread_pool(allocator, error, log, pool);
+}
+
+/**
+ * Main fuzzer entry point — called millions of times with random data.
+ * The data is treated as a JSON string and fed to each service parser.
+ */
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+ static axutil_env_t *env = NULL;
+ if (!env) {
+ env = create_env();
+ if (!env) return 0;
+ }
+
+ /* Skip empty or oversized inputs (OSS-Fuzz best practice) */
+ if (size == 0 || size > 1024 * 1024) {
+ return 0;
+ }
+
+ /* Null-terminate the input for JSON parsing */
+ char *json_str = (char *)malloc(size + 1);
+ if (!json_str) return 0;
+ memcpy(json_str, data, size);
+ json_str[size] = '\0';
+
+ /*
+ * Exercise 1: Portfolio Variance request parsing + computation.
+ * This hits the O(n²) covariance path, weight normalization,
+ * and the variance→sqrt guard.
+ */
+ {
+ finbench_portfolio_variance_request_t *req =
+ finbench_portfolio_variance_request_create_from_json(env, json_str);
+ if (req) {
+ finbench_portfolio_variance_response_t *resp =
+ finbench_calculate_portfolio_variance(env, req);
+ if (resp) {
+ /* Exercise response serialization */
+ axis2_char_t *json_out =
+ finbench_portfolio_variance_response_to_json(resp, env);
+ if (json_out) {
+ AXIS2_FREE(env->allocator, json_out);
+ }
+ finbench_portfolio_variance_response_free(resp, env);
+ }
+ finbench_portfolio_variance_request_free(req, env);
+ }
+ }
+
+ /*
+ * Exercise 2: Monte Carlo request parsing + GBM simulation.
+ * This hits the exp() overflow guard, percentile clamping,
+ * CVaR div-by-zero guard, and the xorshift128+ PRNG.
+ */
+ {
+ finbench_monte_carlo_request_t *req =
+ finbench_monte_carlo_request_create_from_json(env, json_str);
+ if (req) {
+ /* Cap simulations for fuzzing performance — don't burn
+ * CPU on 1M sims for each of millions of fuzz inputs */
+ if (req->n_simulations > 100) req->n_simulations = 100;
+ if (req->n_periods > 50) req->n_periods = 50;
+
+ finbench_monte_carlo_response_t *resp =
+ finbench_calculate_monte_carlo(env, req);
+ if (resp) {
+ axis2_char_t *json_out =
+ finbench_monte_carlo_response_to_json(resp, env);
+ if (json_out) {
+ AXIS2_FREE(env->allocator, json_out);
+ }
+ finbench_monte_carlo_response_free(resp, env);
+ }
+ finbench_monte_carlo_request_free(req, env);
+ }
+ }
+
+ /*
+ * Exercise 3: Scenario Analysis request parsing + hash benchmark.
+ * This hits the hash table key management, probability validation,
+ * and the O(n) vs O(1) benchmark paths.
+ */
+ {
+ finbench_scenario_analysis_request_t *req =
+ finbench_scenario_analysis_request_create_from_json(env, json_str);
+ if (req) {
+ finbench_scenario_analysis_response_t *resp =
+ finbench_calculate_scenario_analysis(env, req);
+ if (resp) {
+ axis2_char_t *json_out =
+ finbench_scenario_analysis_response_to_json(resp, env);
+ if (json_out) {
+ AXIS2_FREE(env->allocator, json_out);
+ }
+ finbench_scenario_analysis_response_free(resp, env);
+ }
+ finbench_scenario_analysis_request_free(req, env);
+ }
+ }
+
+ free(json_str);
+ return 0;
+}
(axis-axis2-c-core) 02/07: Harden financial benchmark: size_t cast, exp() overflow guard
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit ff3eb44990245b1fa0497e157cec55a00a598591
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sat Apr 11 16:50:27 2026 -1000
Harden financial benchmark: size_t cast, exp() overflow guard
Fixes from Gemini code review (gemini-2.5-pro):
1. Monte Carlo allocation: cast n_simulations to size_t before
multiplying by sizeof(double) to prevent integer overflow on
32-bit platforms (e.g., 1M sims × 8 bytes). The portfolio
variance allocation already had this cast (line 231).
2. GBM exp() overflow guard: cap the exponent at 709.0 (near
DBL_MAX threshold for exp()) to prevent Inf propagation through
Monte Carlo statistics. Extreme volatility + random shock can
produce exponents that overflow double precision.
Not fixed (already correct):
- Hash key use-after-free: code already uses axutil_strdup() for
stable per-entry key copies (line 1440), freed after hash (1462)
- Percentile out-of-bounds: already clamped (line 928)
- CVaR division by zero: already guarded (line 916)
- Weight normalization div-by-zero: already checked (line 466)
- Variance negative clamp: already done (line 524)
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
.../src/financial_benchmark_service.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.c b/samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.c
index 535bc463c..42271df67 100644
--- a/samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.c
+++ b/samples/user_guide/financial-benchmark-service/src/financial_benchmark_service.c
@@ -826,9 +826,11 @@ finbench_run_monte_carlo(
return response;
}
- /* Allocate array for final values (needed for percentiles) */
+ /* Allocate array for final values (needed for percentiles).
+ * Cast to size_t to prevent integer overflow on 32-bit platforms
+ * when n_simulations is large (e.g., 1M × 8 bytes = 8 MB). */
final_values = AXIS2_MALLOC(env->allocator,
- request->n_simulations * sizeof(double));
+ (size_t)request->n_simulations * sizeof(double));
if (!final_values) {
response->status = axutil_strdup(env, FINBENCH_STATUS_FAILED);
response->error_message = axutil_strdup(env, "Memory allocation failed");
@@ -865,7 +867,16 @@ finbench_run_monte_carlo(
for (period = 0; period < request->n_periods; period++) {
double z = rand_normal(&rng);
- value *= exp(drift + vol_sqrt_dt * z);
+ double exponent = drift + vol_sqrt_dt * z;
+ /* Guard against exp() overflow — exp(709.78) ≈ DBL_MAX.
+ * Extreme GBM shocks with high volatility can produce
+ * exponents that overflow to Inf, corrupting all downstream
+ * statistics. Cap to a safe maximum. */
+ if (exponent > 709.0) {
+ value = 1e308; /* Near DBL_MAX — treat as extreme outcome */
+ } else {
+ value *= exp(exponent);
+ }
/* Track drawdown */
if (value > peak) {
(axis-axis2-c-core) 03/07: Document pandemic stress test results (Feb-Apr 2020 market data)
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit f3f034f7893ce17ecab57b8b99ca899c10d79eb4
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sat Apr 11 19:03:30 2026 -1000
Document pandemic stress test results (Feb-Apr 2020 market data)
Stress-tested financial benchmark service with real FIS market data
from the COVID-19 crash: 5 tickers, 62 trading days, JPM vol 89.6%,
correlations 0.54-0.95. 14 tests including:
- Pandemic-era portfolio variance and Monte Carlo 1M sims
- Extreme edge case: 80% vol, -50% return, 1M simulations
- Scale: 500-asset (273 us) and 1000-asset (950 us) portfolios
- Edge cases: zero vol, 200% vol, 1 sim, empty/malformed JSON
- Concurrency: 20 parallel requests
- Memory: 500 sequential requests, no RSS growth
- MCP stdio: extreme params via tools/call
Zero crashes, zero Inf/NaN, zero memory leaks, Apache stable
throughout. Tested on Ubuntu 22.04 / Apache httpd / HTTPS+HTTP2.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
docs/MCP_EXAMPLES.md | 41 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
diff --git a/docs/MCP_EXAMPLES.md b/docs/MCP_EXAMPLES.md
index f77d24efb..8ec93c3d2 100644
--- a/docs/MCP_EXAMPLES.md
+++ b/docs/MCP_EXAMPLES.md
@@ -1,5 +1,46 @@
# MCP Examples: Financial Services over HTTP/2
+## Stress Test Results: Pandemic-Era Market Data (Feb-Apr 2020)
+
+The financial benchmark service was stress-tested with real market data from
+the COVID-19 crash period (February-April 2020), when markets experienced:
+
+- **JPM annualized volatility: 89.6%** (normal: ~22%)
+- **MSFT-AAPL correlation: 0.945** (normal: ~0.5)
+- **All sector correlations: 0.54-0.95** (crisis correlation spike)
+- **VIX peaked at 82** (normal: 15-20)
+
+Data was fetched live from FIS TimeSeries for 5 tickers (MSFT.O, AAPL.O,
+AMZN.O, JPM.N, JNJ.N), 62 trading days. The covariance matrix was computed
+from 61 daily log returns and annualized (×252).
+
+### Results
+
+| Test | Input | Result |
+|------|-------|--------|
+| Pandemic portfolio variance | 5 assets, real 2020 covariance | SUCCESS, portfolio vol=61.2%, 0 μs |
+| Pandemic Monte Carlo 1M sims | vol=89.6%, return=-20% | SUCCESS, no Inf/NaN, 88K sims/sec |
+| Extreme Monte Carlo 1M sims | vol=80%, return=-50% | SUCCESS, no Inf/NaN |
+| 500-asset portfolio | 250K matrix operations | SUCCESS, 273 μs |
+| 1000-asset portfolio | 1M operations, 8 MB payload | SUCCESS, 950 μs, 148 MB RSS |
+| Zero volatility MC | vol=0.0 (deterministic) | SUCCESS |
+| 200% volatility MC | vol=2.0 (extreme) | SUCCESS, no Inf/NaN |
+| 1 simulation MC | Minimum input | SUCCESS |
+| Malformed/empty JSON | Edge cases | Clean error messages, no crash |
+| 20 concurrent requests | Parallel pandemic PV | All HTTP 200 |
+| 500 sequential requests | Memory leak check | No RSS growth |
+| Rapid-fire 100 requests | Sequential pandemic PV | All HTTP 200 |
+| MCP stdio extreme | vol=80%, return=-50%, 100K sims | SUCCESS via stdio |
+| Apache health post-stress | After all tests | Active, no crash |
+
+**Zero crashes. Zero Inf/NaN. Zero memory leaks.** Tested on Ubuntu 22.04,
+Apache httpd with mod_axis2, HTTPS/HTTP2, 64 GB RAM.
+
+The same test payloads can be run against Axis2/Java for identical financial
+results (different performance — see the performance comparison below).
+
+---
+
**Summary**: Apache Axis2/C serves financial calculations — portfolio variance,
Monte Carlo VaR, scenario analysis — over HTTP/2 JSON and MCP (Model Context
Protocol). An AI agent asks a question in natural language. The MCP server
(axis-axis2-c-core) 05/07: Add stock Ubuntu 22.04 apache2.conf as reference
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 05e662f024366d89bf69bfbf236a19b675cdb88a
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sat Apr 11 19:50:26 2026 -1000
Add stock Ubuntu 22.04 apache2.conf as reference
The docs/userguide/ directory now has both Apache config models:
- httpd.conf — standalone custom build (/usr/local/apache2)
- apache2.conf — Ubuntu/Debian system Apache (/etc/apache2/)
+ axis2-services.conf adds Axis2/C as a site
The apache2.conf is the unmodified Ubuntu 22.04 default. Axis2/C
config lives entirely in axis2-services.conf, installed by
deploy-localhost.sh. This file is included for documentation
completeness — new contributors on Ubuntu need to understand the
split config model (apache2.conf + sites-available/*.conf).
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
docs/userguide/apache2.conf | 254 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 254 insertions(+)
diff --git a/docs/userguide/apache2.conf b/docs/userguide/apache2.conf
new file mode 100644
index 000000000..1d47cfeda
--- /dev/null
+++ b/docs/userguide/apache2.conf
@@ -0,0 +1,254 @@
+#
+# Ubuntu 22.04 System Apache Configuration (/etc/apache2/apache2.conf)
+#
+# This is the STOCK Ubuntu 22.04 apache2.conf — unchanged from the default
+# installed by `apt install apache2`. It is included here as a reference for
+# deployments that add Axis2/C services to an existing Ubuntu Apache install.
+#
+# Axis2/C configuration is NOT in this file. It lives in:
+# /etc/apache2/sites-available/axis2-services.conf
+#
+# That site config is installed by the deploy script:
+# docs/userguide/deploy-localhost.sh
+#
+# The two Apache configs in this directory serve different deployment models:
+#
+# httpd.conf — Standalone custom Apache build (/usr/local/apache2)
+# Monolithic config, all modules loaded explicitly.
+# Use when building Apache from source.
+#
+# apache2.conf — Ubuntu/Debian system Apache (/etc/apache2/)
+# + axis2-services.conf Debian split config: apache2.conf is the base,
+# axis2-services.conf adds Axis2/C as a site.
+# Use when Apache is installed via apt.
+#
+# Tested on: Ubuntu 22.04 LTS, Apache 2.4.52, penguin.alphatheory.local
+#
+
+# This is the main Apache server configuration file. It contains the
+# configuration directives that give the server its instructions.
+# See http://httpd.apache.org/docs/2.4/ for detailed information about
+# the directives and /usr/share/doc/apache2/README.Debian about Debian specific
+# hints.
+#
+#
+# Summary of how the Apache 2 configuration works in Debian:
+# The Apache 2 web server configuration in Debian is quite different to
+# upstream's suggested way to configure the web server. This is because Debian's
+# default Apache2 installation attempts to make adding and removing modules,
+# virtual hosts, and extra configuration directives as flexible as possible, in
+# order to make automating the changes and administering the server as easy as
+# possible.
+
+# It is split into several files forming the configuration hierarchy outlined
+# below, all located in the /etc/apache2/ directory:
+#
+# /etc/apache2/
+# |-- apache2.conf
+# | `-- ports.conf
+# |-- mods-enabled
+# | |-- *.load
+# | `-- *.conf
+# |-- conf-enabled
+# | `-- *.conf
+# `-- sites-enabled
+# `-- *.conf
+#
+#
+# * apache2.conf is the main configuration file (this file). It puts the pieces
+# together by including all remaining configuration files when starting up the
+# web server.
+#
+# * ports.conf is always included from the main configuration file. It is
+# supposed to determine listening ports for incoming connections which can be
+# customized anytime.
+#
+# * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/
+# directories contain particular configuration snippets which manage modules,
+# global configuration fragments, or virtual host configurations,
+# respectively.
+#
+# They are activated by symlinking available configuration files from their
+# respective *-available/ counterparts. These should be managed by using our
+# helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See
+# their respective man pages for detailed information.
+#
+# * The binary is called apache2. Due to the use of environment variables, in
+# the default configuration, apache2 needs to be started/stopped with
+# /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not
+# work with the default configuration.
+
+
+# Global configuration
+#
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# NOTE! If you intend to place this on an NFS (or otherwise network)
+# mounted filesystem then please read the Mutex documentation (available
+# at <URL:http://httpd.apache.org/docs/2.4/mod/core.html#mutex>);
+# you will save yourself a lot of trouble.
+#
+# Do NOT add a slash at the end of the directory path.
+#
+#ServerRoot "/etc/apache2"
+
+#
+# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
+#
+#Mutex file:${APACHE_LOCK_DIR} default
+
+#
+# The directory where shm and other runtime files will be stored.
+#
+
+DefaultRuntimeDir ${APACHE_RUN_DIR}
+
+#
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+# This needs to be set in /etc/apache2/envvars
+#
+PidFile ${APACHE_PID_FILE}
+
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 5
+
+
+# These need to be set in /etc/apache2/envvars
+User ${APACHE_RUN_USER}
+Group ${APACHE_RUN_GROUP}
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here. If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog ${APACHE_LOG_DIR}/error.log
+
+#
+# LogLevel: Control the severity of messages logged to the error_log.
+# Available values: trace8, ..., trace1, debug, info, notice, warn,
+# error, crit, alert, emerg.
+# It is also possible to configure the log level for particular modules, e.g.
+# "LogLevel info ssl:warn"
+#
+LogLevel warn
+
+# Include module configuration:
+IncludeOptional mods-enabled/*.load
+IncludeOptional mods-enabled/*.conf
+
+# Include list of ports to listen on
+Include ports.conf
+
+
+# Sets the default security model of the Apache2 HTTPD server. It does
+# not allow access to the root filesystem outside of /usr/share and /var/www.
+# The former is used by web applications packaged in Debian,
+# the latter may be used for local directories served by the web server. If
+# your system is serving content from a sub-directory in /srv you must allow
+# access here, or in any related virtual host.
+<Directory />
+ Options FollowSymLinks
+ AllowOverride None
+ Require all denied
+</Directory>
+
+<Directory /usr/share>
+ AllowOverride None
+ Require all granted
+</Directory>
+
+<Directory /var/www/>
+ Options Indexes FollowSymLinks
+ AllowOverride None
+ Require all granted
+</Directory>
+
+#<Directory /srv/>
+# Options Indexes FollowSymLinks
+# AllowOverride None
+# Require all granted
+#</Directory>
+
+
+
+
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives. See also the AllowOverride
+# directive.
+#
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being
+# viewed by Web clients.
+#
+<FilesMatch "^\.ht">
+ Require all denied
+</FilesMatch>
+
+
+#
+# The following directives define some format nicknames for use with
+# a CustomLog directive.
+#
+# These deviate from the Common Log Format definitions in that they use %O
+# (the actual bytes sent including headers) instead of %b (the size of the
+# requested file), because the latter makes it impossible to detect partial
+# requests.
+#
+# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
+# Use mod_remoteip instead.
+#
+LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %O" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+
+# Include of directories ignores editors' and dpkg's backup files,
+# see README.Debian for details.
+
+# Include generic snippets of statements
+IncludeOptional conf-enabled/*.conf
+
+# Include the virtual host configurations:
+IncludeOptional sites-enabled/*.conf
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
(axis-axis2-c-core) 04/07: Raise FinancialBenchmarkService limit to 50MB; document payload sizes
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 684d1a190b137bd1bd3281a2486a5063f4850799
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sat Apr 11 19:46:12 2026 -1000
Raise FinancialBenchmarkService limit to 50MB; document payload sizes
The 10MB Apache LimitRequestBody blocked portfolioVariance at ~670
assets (realistic floats produce ~10.9 MB at 700 assets). Raised
to 50MB to match BigDataH2Service — supports up to ~1200 assets
over HTTP. The FINBENCH_MAX_ASSETS=2000 code cap is reachable only
via MCP stdio (no payload limit).
Updated both axis2-services.conf (Debian/Ubuntu site config) and
httpd.conf (standalone reference config).
Added payload size table to MCP_EXAMPLES.md documenting the O(n²)
growth: 500 assets = 6 MB, 1000 = 22 MB, 2000 = 89 MB.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
docs/MCP_EXAMPLES.md | 19 +++++++++++++++++++
docs/userguide/axis2-services.conf | 6 ++++--
docs/userguide/httpd.conf | 6 +++---
3 files changed, 26 insertions(+), 5 deletions(-)
diff --git a/docs/MCP_EXAMPLES.md b/docs/MCP_EXAMPLES.md
index 8ec93c3d2..7c1e02a7f 100644
--- a/docs/MCP_EXAMPLES.md
+++ b/docs/MCP_EXAMPLES.md
@@ -39,6 +39,25 @@ Apache httpd with mod_axis2, HTTPS/HTTP2, 64 GB RAM.
The same test payloads can be run against Axis2/Java for identical financial
results (different performance — see the performance comparison below).
+### Payload Size Limits
+
+Portfolio variance payloads grow as O(n²) — the covariance matrix dominates:
+
+| Assets | Covariance elements | JSON payload | HTTP limit (50 MB) |
+|--------|--------------------:|-------------:|:------------------:|
+| 500 | 250,000 | ~6 MB | ✅ |
+| 700 | 490,000 | ~11 MB | ✅ |
+| 1000 | 1,000,000 | ~22 MB | ✅ |
+| 1500 | 2,250,000 | ~50 MB | ✅ (borderline) |
+| 2000 | 4,000,000 | ~89 MB | ❌ exceeds limit |
+
+Monte Carlo and scenario analysis requests are always small (~200 bytes)
+regardless of simulation count — all computation happens server-side.
+
+MCP stdio transport has no payload size limit (line-buffered I/O).
+The `FINBENCH_MAX_ASSETS=2000` code cap is reachable via MCP but not
+via HTTP for portfolio variance due to the quadratic payload growth.
+
---
**Summary**: Apache Axis2/C serves financial calculations — portfolio variance,
diff --git a/docs/userguide/axis2-services.conf b/docs/userguide/axis2-services.conf
index dce427998..f8fcf8d8a 100644
--- a/docs/userguide/axis2-services.conf
+++ b/docs/userguide/axis2-services.conf
@@ -133,9 +133,11 @@ LimitRequestFieldSize 8190
# These limits are enforced by Apache BEFORE Axis2/C code executes
# =========================================================================
- # Financial Benchmark Service - Enterprise payloads up to 10MB
+ # Financial Benchmark Service - Enterprise payloads up to 50MB
+ # Portfolio variance payload is O(n²): 500 assets = ~6 MB, 1000 assets = ~22 MB.
+ # Must match BigDataH2Service limit to support large portfolios.
<Location /services/FinancialBenchmarkService>
- LimitRequestBody 10485760
+ LimitRequestBody 52428800
Header always set Cache-Control "no-cache, no-store, must-revalidate"
</Location>
diff --git a/docs/userguide/httpd.conf b/docs/userguide/httpd.conf
index dd403f0dd..aafa4250e 100644
--- a/docs/userguide/httpd.conf
+++ b/docs/userguide/httpd.conf
@@ -226,10 +226,10 @@ LogLevel warn
Header always set Cache-Control "no-cache, no-store, must-revalidate"
</Location>
- # Financial Benchmark Service - Enterprise payloads up to 10MB
+ # Financial Benchmark Service - Enterprise payloads up to 50MB
+ # Portfolio variance payload is O(n²): 500 assets = ~6 MB, 1000 assets = ~22 MB.
<Location /services/FinancialBenchmarkService>
- # Enterprise payloads: 10MB max (500-asset portfolios ~5MB)
- LimitRequestBody 10485760
+ LimitRequestBody 52428800
Header always set Cache-Control "no-cache, no-store, must-revalidate"
</Location>