You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bo...@apache.org on 2002/09/18 18:44:35 UTC
cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11 Http11Processor.java
bobh 2002/09/18 09:44:35
Modified: . gump.xml
coyote/src/java/org/apache/coyote Request.java
http11/src/java/org/apache/coyote/http11
Http11Processor.java
Log:
- This associates the socket with the Request. This is so the
CertificatesValve.verify() can tell where (which socket) the Request
is comeing from. Without this association, CertificatesValve.verify()
returns with no SSL Handshake.
- this change is in part based on feed back from; Vivek N. Yingxian
Wang (JSSE), Craig M., Qingqing Ouyang
Revision Changes Path
1.8 +1 -0 jakarta-tomcat-connectors/gump.xml
Index: gump.xml
===================================================================
RCS file: /home/cvs/jakarta-tomcat-connectors/gump.xml,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- gump.xml 7 Sep 2002 15:17:19 -0000 1.7
+++ gump.xml 18 Sep 2002 16:44:35 -0000 1.8
@@ -55,6 +55,7 @@
<ant basedir="coyote">
<property name="catalina.home" reference="home"
project="jakarta-tomcat-catalina"/>
+ <property name="tomcat33.home" value=""/>
</ant>
<depend project="jakarta-ant"/>
1.14 +16 -0 jakarta-tomcat-connectors/coyote/src/java/org/apache/coyote/Request.java
Index: Request.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat-connectors/coyote/src/java/org/apache/coyote/Request.java,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -r1.13 -r1.14
--- Request.java 9 Apr 2002 18:19:27 -0000 1.13
+++ Request.java 18 Sep 2002 16:44:35 -0000 1.14
@@ -73,6 +73,8 @@
import org.apache.tomcat.util.http.ContentType;
import org.apache.tomcat.util.http.Cookies;
+import java.net.Socket;
+
/**
* This is a low-level, efficient representation of a server request. Most
* fields are GC-free, expensive operations are delayed until the user code
@@ -184,6 +186,9 @@
private Response response;
private ActionHook hook;
+
+ private Socket socket;
+
// ------------------------------------------------------------- Properties
@@ -203,10 +208,21 @@
return headers;
}
+ /* Used to associate this Request with a socket. Used later to do
+ SSL related stuff. */
+ public Socket getSocket() {
+ return this.socket;
+ }
+
+ public void setSocket(Socket socket) {
+ this.socket = socket;
+ }
+
public UDecoder getURLDecoder() {
return urlDecoder;
}
+
// -------------------- Request data --------------------
1.35 +3 -1 jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11/Http11Processor.java
Index: Http11Processor.java
===================================================================
RCS file: /home/cvs/jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11/Http11Processor.java,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -r1.34 -r1.35
--- Http11Processor.java 8 Jul 2002 16:50:46 -0000 1.34
+++ Http11Processor.java 18 Sep 2002 16:44:35 -0000 1.35
@@ -602,8 +602,10 @@
http11 = true;
http09 = false;
contentDelimitation = false;
- if (sslSupport != null)
+ if (sslSupport != null) {
request.scheme().setString("https");
+ request.setSocket( socket );
+ }
MessageBytes protocolMB = request.protocol();
if (protocolMB.equals(Constants.HTTP_11)) {
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
Http11Processor.java
Posted by Remy Maucherat <re...@apache.org>.
Bill Barker wrote:
> ----- Original Message -----
> From: <bo...@apache.org>
> To: <ja...@apache.org>
> Sent: Wednesday, September 18, 2002 9:44 AM
> Subject: cvs commit:
> jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
> Http11Processor.java
>
>
>
>>bobh 2002/09/18 09:44:35
>>
>> Modified: . gump.xml
>> coyote/src/java/org/apache/coyote Request.java
>> http11/src/java/org/apache/coyote/http11
>> Http11Processor.java
>> Log:
>> - This associates the socket with the Request. This is so the
>> CertificatesValve.verify() can tell where (which socket) the Request
>> is comeing from. Without this association, CertificatesValve.verify()
>> returns with no SSL Handshake.
>> - this change is in part based on feed back from; Vivek N. Yingxian
>> Wang (JSSE), Craig M., Qingqing Ouyang
>>
>
>
> I'm -1 on this, since having a socket in the Request makes no sense for Jk2.
> CertificatesValve is only for use with the deprecated HttpConnector. With
> Coyote, the SSL handling has moved to the connector (where it belonged in
> the first place).
I agree. I forgot this was done through a notification, and 99% of the
code was already there. Thanks for adding the clientauth support and
removing the need for hacks. I will revert the changes to
Http11Processor and Request.
Remy
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11 Http11Processor.java
Posted by Bill Barker <wb...@wilshire.com>.
----- Original Message -----
From: "Craig R. McClanahan" <cr...@apache.org>
To: "Tomcat Developers List" <to...@jakarta.apache.org>
Sent: Wednesday, September 18, 2002 12:34 PM
Subject: Re: cvs commit:
jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
Http11Processor.java
>
>
> On Wed, 18 Sep 2002, Bill Barker wrote:
>
> > Date: Wed, 18 Sep 2002 12:06:50 -0700
> > From: Bill Barker <wb...@wilshire.com>
> > Reply-To: Tomcat Developers List <to...@jakarta.apache.org>
> > To: Tomcat Developers List <to...@jakarta.apache.org>
> > Subject: Re: cvs commit:
> > jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
> > Http11Processor.java
> >
> >
> > ----- Original Message -----
> > From: <bo...@apache.org>
> > To: <ja...@apache.org>
> > Sent: Wednesday, September 18, 2002 9:44 AM
> > Subject: cvs commit:
> > jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
> > Http11Processor.java
> >
> >
> > > bobh 2002/09/18 09:44:35
> > >
> > > Modified: . gump.xml
> > > coyote/src/java/org/apache/coyote Request.java
> > > http11/src/java/org/apache/coyote/http11
> > > Http11Processor.java
> > > Log:
> > > - This associates the socket with the Request. This is so the
> > > CertificatesValve.verify() can tell where (which socket) the Request
> > > is comeing from. Without this association,
CertificatesValve.verify()
> > > returns with no SSL Handshake.
> > > - this change is in part based on feed back from; Vivek N. Yingxian
> > > Wang (JSSE), Craig M., Qingqing Ouyang
> > >
> >
> > I'm -1 on this, since having a socket in the Request makes no sense for
Jk2.
> > CertificatesValve is only for use with the deprecated HttpConnector.
With
> > Coyote, the SSL handling has moved to the connector (where it belonged
in
> > the first place).
> >
>
> The current Tomcat standalone implementation does not appear to meet the
> spec requirements for exposing a certificate chain, or for implementing
> CLIENT-CERT authentication. For the latter, the container needs to
> challenge the client to send a certificate if they didn't do so already.
>
> How do you propose to meet those requirements for Tomcat stand-alone
> without access to the underlying SSL socket? (For the connectors, you'll
> obviously need to provide an alternative solution to meet the spec
> requirements).
The correct place to fix it is
o.a.t.u.net.JSSESupport.getPeerCertificateChain (called from
o.a.c.http11.Http11Processor.action). The code there was so heavily cribbed
from CertificatesValve, that I should probably add you to the @author. :-)
I'm strongly against reverting TC 4/5 back to only supporting JSSE (which
would be the effect of requiring CertificatesValve).
>
> Craig
>
>
>
> --
> To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
> For additional commands, e-mail:
<ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
Http11Processor.java
Posted by "Craig R. McClanahan" <cr...@apache.org>.
On Wed, 18 Sep 2002, Bill Barker wrote:
> Date: Wed, 18 Sep 2002 12:06:50 -0700
> From: Bill Barker <wb...@wilshire.com>
> Reply-To: Tomcat Developers List <to...@jakarta.apache.org>
> To: Tomcat Developers List <to...@jakarta.apache.org>
> Subject: Re: cvs commit:
> jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
> Http11Processor.java
>
>
> ----- Original Message -----
> From: <bo...@apache.org>
> To: <ja...@apache.org>
> Sent: Wednesday, September 18, 2002 9:44 AM
> Subject: cvs commit:
> jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
> Http11Processor.java
>
>
> > bobh 2002/09/18 09:44:35
> >
> > Modified: . gump.xml
> > coyote/src/java/org/apache/coyote Request.java
> > http11/src/java/org/apache/coyote/http11
> > Http11Processor.java
> > Log:
> > - This associates the socket with the Request. This is so the
> > CertificatesValve.verify() can tell where (which socket) the Request
> > is comeing from. Without this association, CertificatesValve.verify()
> > returns with no SSL Handshake.
> > - this change is in part based on feed back from; Vivek N. Yingxian
> > Wang (JSSE), Craig M., Qingqing Ouyang
> >
>
> I'm -1 on this, since having a socket in the Request makes no sense for Jk2.
> CertificatesValve is only for use with the deprecated HttpConnector. With
> Coyote, the SSL handling has moved to the connector (where it belonged in
> the first place).
>
The current Tomcat standalone implementation does not appear to meet the
spec requirements for exposing a certificate chain, or for implementing
CLIENT-CERT authentication. For the latter, the container needs to
challenge the client to send a certificate if they didn't do so already.
How do you propose to meet those requirements for Tomcat stand-alone
without access to the underlying SSL socket? (For the connectors, you'll
obviously need to provide an alternative solution to meet the spec
requirements).
Craig
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11 Http11Processor.java
Posted by Bill Barker <wb...@wilshire.com>.
----- Original Message -----
From: <bo...@apache.org>
To: <ja...@apache.org>
Sent: Wednesday, September 18, 2002 9:44 AM
Subject: cvs commit:
jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
Http11Processor.java
> bobh 2002/09/18 09:44:35
>
> Modified: . gump.xml
> coyote/src/java/org/apache/coyote Request.java
> http11/src/java/org/apache/coyote/http11
> Http11Processor.java
> Log:
> - This associates the socket with the Request. This is so the
> CertificatesValve.verify() can tell where (which socket) the Request
> is comeing from. Without this association, CertificatesValve.verify()
> returns with no SSL Handshake.
> - this change is in part based on feed back from; Vivek N. Yingxian
> Wang (JSSE), Craig M., Qingqing Ouyang
>
I'm -1 on this, since having a socket in the Request makes no sense for Jk2.
CertificatesValve is only for use with the deprecated HttpConnector. With
Coyote, the SSL handling has moved to the connector (where it belonged in
the first place).
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
Http11Processor.java
Posted by jean-frederic clere <jf...@fujitsu-siemens.com>.
Bob Herrmann wrote:
> On Wed, 2002-09-18 at 13:58, Remy Maucherat wrote:
>
>>Remy Maucherat wrote:
>>
>>>bobh@apache.org wrote:
>>>
>>>
>>>>bobh 2002/09/18 09:44:35
>>>>
>>>> Modified: . gump.xml
>>>> coyote/src/java/org/apache/coyote Request.java
>>>> http11/src/java/org/apache/coyote/http11
>>>> Http11Processor.java
>>>> Log:
>>>> - This associates the socket with the Request. This is so the
>>>> CertificatesValve.verify() can tell where (which socket) the Request
>>>> is comeing from. Without this association, CertificatesValve.verify()
>>>> returns with no SSL Handshake.
>>>> - this change is in part based on feed back from; Vivek N. Yingxian
>>>> Wang (JSSE), Craig M., Qingqing Ouyang
>>>
>>>
>>>-1 (ie, revert this).
>>>
>>>The socket should already have been associated with the request, but as
>>>a note. It is available, and accessible.
>>
>>Ok, I checked it, and the socket os not currently associated with the
>>request (I thought it was). OTOH, you shouldn't add a field for socket
>>in the request (native webservers don't have the notion of a Java
>>socket). Instead, use one of the notes.
>
>
> Ok,
> - change Http11Processor to use a note
> - change Request.java to it's original form
> - change the CertificatesValve.verify()
>
> Does that sound about right?
For me: yes.
>
> Cheers,
> -bob
>
>
>>Remy
>>
>>
>>--
>>To unsubscribe, e-mail: <ma...@jakarta.apache.org>
>>For additional commands, e-mail: <ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: cvs commit:
jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
Http11Processor.java
Posted by Bob Herrmann <bo...@jadn.com>.
On Wed, 2002-09-18 at 13:58, Remy Maucherat wrote:
> Remy Maucherat wrote:
> > bobh@apache.org wrote:
> >
> >> bobh 2002/09/18 09:44:35
> >>
> >> Modified: . gump.xml
> >> coyote/src/java/org/apache/coyote Request.java
> >> http11/src/java/org/apache/coyote/http11
> >> Http11Processor.java
> >> Log:
> >> - This associates the socket with the Request. This is so the
> >> CertificatesValve.verify() can tell where (which socket) the Request
> >> is comeing from. Without this association, CertificatesValve.verify()
> >> returns with no SSL Handshake.
> >> - this change is in part based on feed back from; Vivek N. Yingxian
> >> Wang (JSSE), Craig M., Qingqing Ouyang
> >
> >
> > -1 (ie, revert this).
> >
> > The socket should already have been associated with the request, but as
> > a note. It is available, and accessible.
>
> Ok, I checked it, and the socket os not currently associated with the
> request (I thought it was). OTOH, you shouldn't add a field for socket
> in the request (native webservers don't have the notion of a Java
> socket). Instead, use one of the notes.
Ok,
- change Http11Processor to use a note
- change Request.java to it's original form
- change the CertificatesValve.verify()
Does that sound about right?
Cheers,
-bob
>
> Remy
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
--
Cheers,
-bob
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
Http11Processor.java
Posted by Remy Maucherat <re...@apache.org>.
Remy Maucherat wrote:
> bobh@apache.org wrote:
>
>> bobh 2002/09/18 09:44:35
>>
>> Modified: . gump.xml
>> coyote/src/java/org/apache/coyote Request.java
>> http11/src/java/org/apache/coyote/http11
>> Http11Processor.java
>> Log:
>> - This associates the socket with the Request. This is so the
>> CertificatesValve.verify() can tell where (which socket) the Request
>> is comeing from. Without this association, CertificatesValve.verify()
>> returns with no SSL Handshake.
>> - this change is in part based on feed back from; Vivek N. Yingxian
>> Wang (JSSE), Craig M., Qingqing Ouyang
>
>
> -1 (ie, revert this).
>
> The socket should already have been associated with the request, but as
> a note. It is available, and accessible.
Ok, I checked it, and the socket os not currently associated with the
request (I thought it was). OTOH, you shouldn't add a field for socket
in the request (native webservers don't have the notion of a Java
socket). Instead, use one of the notes.
Remy
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: cvs commit: jakarta-tomcat-connectors/http11/src/java/org/apache/coyote/http11
Http11Processor.java
Posted by Remy Maucherat <re...@apache.org>.
bobh@apache.org wrote:
> bobh 2002/09/18 09:44:35
>
> Modified: . gump.xml
> coyote/src/java/org/apache/coyote Request.java
> http11/src/java/org/apache/coyote/http11
> Http11Processor.java
> Log:
> - This associates the socket with the Request. This is so the
> CertificatesValve.verify() can tell where (which socket) the Request
> is comeing from. Without this association, CertificatesValve.verify()
> returns with no SSL Handshake.
> - this change is in part based on feed back from; Vivek N. Yingxian
> Wang (JSSE), Craig M., Qingqing Ouyang
-1 (ie, revert this).
The socket should already have been associated with the request, but as
a note. It is available, and accessible.
Thanks,
Remy
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>