You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-dev@db.apache.org by "Manjula Kutty (JIRA)" <ji...@apache.org> on 2007/06/26 20:17:25 UTC
[jira] Created: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
NetworkServer not accepting connections with default security manager on Ipv6 machines
--------------------------------------------------------------------------------------
Key: DERBY-2874
URL: https://issues.apache.org/jira/browse/DERBY-2874
Project: Derby
Issue Type: Bug
Components: Security
Affects Versions: 10.3.0.0
Environment: Ipv6 machine with ibm jvm 15
Reporter: Manjula Kutty
Fix For: 10.3.0.0
While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
and the server started with the following command
Security manager installed using the Basic server security policy.
Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
So I think the server is using the default security manager. Then when I tried to get conenction though ij
got the following error message
Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
at java.security.AccessController.checkPermission(AccessController.java:104)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
at java.net.ServerSocket.implAccept(ServerSocket.java:466)
at java.net.ServerSocket.accept(ServerSocket.java:433)
at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
at java.security.AccessController.doPrivileged(AccessController.java:242)
at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
I had the derby.properties file like this
derby.database.sqlAuthorization=true
derby.connection.requireAuthentication=true
derby.infolog.append=true
derby.authentication.provider=BUILTIN
derby.stream.error.logSeverityLevel=0
#derby.language.logStatementText=true
# User's Definitions
derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508567 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
Dan asks:
>Is it not possible to set derby.security.host to the correct format for the policy file when using an IPv6 address?
>>From looking at the error message and some brief googling it looks like the address should be enclosed in square brackets.
It's possible. I think the devil is in the details and I'm worried about edge cases this close to the release date. We could log a new JIRA to improve this.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas updated DERBY-2874:
---------------------------------
Attachment: derby-2874-04-bracketsAllPorts.diff
Thanks for testing that last patch, Manjula. I'm attaching another patch, derby-2874-04-bracketsAllPorts.diff. This patch adds ":0-" to the end of the bracketed host address on the off chance that the port spec needs to be wildcarded. I am running out of ideas!
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12509115 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
Thanks, Dan. You're right, the javadoc says "The port or portrange is optional." I don't see an explicit statement of what meaning is attached to a SocketPermission which doesn't have a port spec. However, I'm having a hard time imagining any meaning other than "all ports on that host".
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508359 ]
Manjula Kutty commented on DERBY-2874:
--------------------------------------
Rick,
With this patch I could get connection to the server using default security manager. But by looking at the policy file I got this doubt , are we giving permission to everyone?
By removing the "${derby.security.host} I feel now the server is less secure.
I don't know much about the security and policy. This is what I felt. If we are not loosing any intended security by doing this patch, then I would like to get this fix done on the 10.3 release candidate.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508310 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
Thanks for running this experiment, Manjula. I'm a little unclear on what test you tried. The command line above indicates that you installed your own security manager and used your own policy file. The policy file you used has unsubstutited parameters in it. It doesn't appear as though any of those parameters are declared on your command line, so the VM won't substitute them. That would explain why you have now lost file permissions as well as the socket permission. Those parameters are forced to reasonable values by the server only if the server decides that it needs to install its own security manager and default policy file.
Could you try the following experiments:
1) In your server policy file, replace the parameters with good values. So for instance,
${derby.install.url} would be replaced with something like file:///export/home/rh161140/derby/mainline/trunk/jars/sane/
${derby.system.home} would be replaced with something like /export/home/rh161140/derby/mainline
${derby.security.host} would be replaced with the host address you use as the -h argument on your command line
Since you are running with your own policy file you will probably also need to add the following permission to the rights granted to derby.jar:
permission java.util.PropertyPermission "user.dir", "read";
2) In the second experiment, it would be great if you could apply the patch to your workspace and build the jar files. Then use those jar files to run the original test which you described in your first mail message--that is, just bring boot the server with your port specification but without declaring a security manager or policy file. This should force the server to install its own security manager and pick up the new default policy file (which is the only change introduced by the patch).
Thanks!
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Manjula Kutty updated DERBY-2874:
---------------------------------
Derby Info: [Regression]
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Myrna van Lunteren (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Myrna van Lunteren updated DERBY-2874:
--------------------------------------
Fix Version/s: (was: 10.3.0.0)
10.3.1.1
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.1.1
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508612 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
I am happy to write a new patch so that we can experiment with (2) as long as Manjula can help test this. First, I would like to figure out what the behavior should be. Is it the following? In this discussion originalHostAddress means the value of the -h option or the value of derby.drda.host.
A) If originalHostAddress evaluates to the same socket as the wildcard "0.0.0.0" or is the ipv6 wildcard "::", then set derby.security.host to the socket wildcard "*"
B) Otherwise, if originalHostAddress is composed entirely of hex digits and colons and InetAddress.getByName( originalHostAddress ) is an Inet6Address, then bracket originalHostAddress with [] and set derby.security.host to that bracketed value.
C) Otherwise, set derby.security.host to originalHostAddress.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508290 ]
Manjula Kutty commented on DERBY-2874:
--------------------------------------
Here is the e-mail thread regarding this issue
http://www.nabble.com/Derby-on-Ipv6-tf3979831.html#a11298151
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12510000 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
P:orted previous submission to 10.3 branch at subversion revision 552981.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.1.1
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508332 ]
Manjula Kutty commented on DERBY-2874:
--------------------------------------
Tried with the patch and using the default security manager.
started the server with the command:
[root@incus pantry]# java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
And the stack trace is
Security manager installed using the Basic server security policy.
Apache Derby Network Server - 10.3.1.1 beta - (550927M) started and ready to accept connections on port 1527 at 2007-06-26 20:40:16.862 GMT
Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34047 accept,resolve)
java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34047 accept,resolve)
at java.security.AccessController.checkPermission(AccessController.java:104)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
at java.lang.SecurityManager.checkAccept(SecurityManager.java:1172)
at java.net.ServerSocket.implAccept(ServerSocket.java:466)
at java.net.ServerSocket.accept(ServerSocket.java:433)
at org.apache.derby.impl.drda.ClientThread$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(AccessController.java:242)
at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:115]:1241 accept,resolve)
java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:115]:1241 accept,resolve)
at java.security.AccessController.checkPermission(AccessController.java:104)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
at java.lang.SecurityManager.checkAccept(SecurityManager.java:1172)
at java.net.ServerSocket.implAccept(ServerSocket.java:466)
at java.net.ServerSocket.accept(ServerSocket.java:433)
at org.apache.derby.impl.drda.ClientThread$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(AccessController.java:242)
at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:115]:1242 accept,resolve)
java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:115]:1242 accept,resolve)
at java.security.AccessController.checkPermission(AccessController.java:104)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
at java.lang.SecurityManager.checkAccept(SecurityManager.java:1172)
at java.net.ServerSocket.implAccept(ServerSocket.java:466)
at java.net.ServerSocket.accept(ServerSocket.java:433)
at org.apache.derby.impl.drda.ClientThread$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(AccessController.java:242)
at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508545 ]
Daniel John Debrunner commented on DERBY-2874:
----------------------------------------------
Is it not possible to set derby.security.host to the correct format for the policy file when using an IPv6 address?
>From looking at the error message and some brief googling it looks like the address should be enclosed in square brackets.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12509869 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
Thanks for sticking with this, Manjula. Unless someone objects, I intend to commit the derby-2874-04-bracketsAllPorts.diff patch this afternoon (San Francisco time).
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.1.1
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508934 ]
Daniel John Debrunner commented on DERBY-2874:
----------------------------------------------
Is there a reference for putting the ipv6 address in square brackets, apart from my comment above?
Just wondered if some research had gone in this or you just trusted my brief comment?
My searching was very quick, early morning *and* before coffee :-)
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508586 ]
Daniel John Debrunner commented on DERBY-2874:
----------------------------------------------
> It's possible. I think the devil is in the details and I'm worried about edge cases this close to the release date. We could log a new JIRA to improve this.
Probably it's just me, but I'd be more worried about a late security change with little security analysis rather than handling a formatting change that can be tested with a handful of cases (8?, hostname, ip address, localhost, all addresses for IPv4 & IPv6).
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508949 ]
Daniel John Debrunner commented on DERBY-2874:
----------------------------------------------
Thanks Rick, I never say that. I may now have had more coffee than you, I don't see anything that calls for "tacking on a port spec", seems optional in every thing I read there. Could you quote whatever leads you to believe that. Thanks.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508624 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
We could eliminate (A) and see what happens. It's a case which was put in to handle DERBY-2811.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508534 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
Thanks for test-driving this patch, Manjula. It also works for me on my personal laptop, which runs a version of Suse with dual v4 and v6 protocol stacks.
I think that it would be better to restrict the socket permission as much as possible just as it would be better to restrict the file permissions as much as possible. However, I think this more liberal socket permission is fine for the default policy just as the liberal file permission is ok. The liberal socket permission is only granted to derbynet.jar and the server limits itself to addresses specified at boot time. Socket permission continues to be denied to code outside the server, such as user-written functions and procedures.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12509997 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
Committed derby-2874-bracketsAllPorts.diff at subversion revision 552977.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.1.1
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Myrna van Lunteren (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Myrna van Lunteren updated DERBY-2874:
--------------------------------------
Fix Version/s: 10.4.0.0
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.1.1, 10.4.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508948 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
Right, I assumed you had swallowed more coffee than I had. There's the javadoc for SocketPermission: http://java.sun.com/j2se/1.4.2/docs/api/java/net/SocketPermission.html It indicates that the address should be bracketed. However, it also calls for tacking on a port spec, after the bracketed address. I'm wondering whether we need to wildcard the port spec and end up with something like "[0:1:2:3:4]:0-" I'm out of my depth here.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508618 ]
Daniel John Debrunner commented on DERBY-2874:
----------------------------------------------
What's the benefit of A), isn't the functionality covered by B) and C)?
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Dag H. Wanvik (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Dag H. Wanvik updated DERBY-2874:
---------------------------------
Bug behavior facts: [Regression, Security] (was: [Regression])
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Affects Versions: 10.3.1.4
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.1.4, 10.4.1.3
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Assigned: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas reassigned DERBY-2874:
------------------------------------
Assignee: Rick Hillegas
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12509176 ]
Manjula Kutty commented on DERBY-2874:
--------------------------------------
Thanks for the new patch Rick. But unfortunatly I'm still getting the same error with the same stack trace.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas updated DERBY-2874:
---------------------------------
Attachment: derby-2874-03.diff
Attaching derby-2874-03.diff. This implements (2) as described in steps (A) - (C). Touches the following files:
M java/drda/org/apache/derby/drda/NetworkServerControl.java
Implements steps (A) - (C)
M java/drda/org/apache/derby/drda/server.policy
M java/drda/org/apache/derby/drda/template.policy
Same as in derby-2874-02.diff, i.e., removes wildcarded port specification
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas updated DERBY-2874:
---------------------------------
Attachment: derby-2874-wildcard-02.diff
Attaching new version of the patch, derby-2874-wildcard-02.diff. In addition to wildcarding the socket permission, this patch removes the now unused code which calculated a value for derby.security.host. Touches the following files:
M java/engine/org/apache/derby/iapi/reference/Property.java
M java/drda/org/apache/derby/drda/NetworkServerControl.java
Removes logic which calculated a value for security.host.property.
M java/drda/org/apache/derby/drda/server.policy
M java/drda/org/apache/derby/drda/template.policy
Wildcards the socket permission.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508638 ]
Daniel John Debrunner commented on DERBY-2874:
----------------------------------------------
OK on A). I didn't know about the issue seen in DERBY-2811
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas updated DERBY-2874:
---------------------------------
Attachment: derby-2874-01.diff
Attaching patch which removes the wildcarded port spec from the default socket permission. Would appreciate it if someone with access to an ipv6 machine could try this out. thanks.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12509717 ]
Manjula Kutty commented on DERBY-2874:
--------------------------------------
Hi Rick,
No more ideas needed. This patch works fine...
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.1.1
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas resolved DERBY-2874.
----------------------------------
Resolution: Fixed
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.1.1
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-04-bracketsAllPorts.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508597 ]
Manjula Kutty commented on DERBY-2874:
--------------------------------------
In my personal openion I will go for option 2. Also I have the access to the Ipv6 machines for a limited time. So even if we go for option 1 , we may not be able to test it on the Ipv6 machinessoon after the fix.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508592 ]
Rick Hillegas commented on DERBY-2874:
--------------------------------------
Regardless of whether we (1) log a follow-on JIRA or (2) try to set derby.security.host in this release, it would be good to understand what extra security holes are covered by (2). What are your thoughts?
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Issue Comment Edited: (DERBY-2874) NetworkServer not
accepting connections with default security manager on Ipv6 machines
Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508949 ]
Daniel John Debrunner edited comment on DERBY-2874 at 6/28/07 4:07 PM:
-----------------------------------------------------------------------
Thanks Rick, I never saw that. I may now have had more coffee than you, I don't see anything that calls for "tacking on a port spec", seems optional in every thing I read there. Could you quote whatever leads you to believe that. Thanks.
was:
Thanks Rick, I never say that. I may now have had more coffee than you, I don't see anything that calls for "tacking on a port spec", seems optional in every thing I read there. Could you quote whatever leads you to believe that. Thanks.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-03.diff, derby-2874-wildcard-01.diff, derby-2874-wildcard-02.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas updated DERBY-2874:
---------------------------------
Attachment: derby-2874-wildcard-01.diff
Attaching derby-2874-wildcard-01.diff. This grants accept permission to the wildcard address "*".
Manjul, thanks for sticking with this issue. Could you try experiment (2) with this patch?
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, derby-2874-wildcard-01.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Manjula Kutty updated DERBY-2874:
---------------------------------
Attachment: server.policy
Here is the policy file I used. Also this is the command I used to start the server
[[root@incus mkutty]# java -Djava.security.manager -Djava.security.policy=/usr/mkutty/server.policy org.apache.derby.drda.NetworkServerControl start -h 2002:92a: 8f7a:13:9:42:74:19
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff, server.policy
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2874) NetworkServer not accepting
connections with default security manager on Ipv6 machines
Posted by "Manjula Kutty (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12508292 ]
Manjula Kutty commented on DERBY-2874:
--------------------------------------
I tried with Rick's patch and Still has the problem. Here is the new stack trace
2007-06-26 18:23:02.674 GMT Thread[main,5,main] java.security.AccessControlException: Access denied (java.io.FilePermission derby.log read)
Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-26 18:23:02.730 GMT
Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-26 18:23:02.730 GMT
Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34040 ac cept,resolve)
Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34040 ac cept,resolve)
java.security.AccessControlException: Access denied (java.net.SocketPermission [ 2002:92a:8f7a:13:9:42:73:218]:34040 accept,resolve)
at java.security.AccessController.checkPermission(AccessController.java: 104)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
at java.lang.SecurityManager.checkAccept(SecurityManager.java:1172)
at java.net.ServerSocket.implAccept(ServerSocket.java:466)
at java.net.ServerSocket.accept(ServerSocket.java:433)
at org.apache.derby.impl.drda.ClientThread$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(AccessController.java:242 )
at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
java.security.AccessControlException: Access denied (java.net.SocketPermission [ 2002:92a:8f7a:13:9:42:73:218]:34040 accept,resolve)
at java.security.AccessController.checkPermission(AccessController.java: 104)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
at java.lang.SecurityManager.checkAccept(SecurityManager.java:1172)
at java.net.ServerSocket.implAccept(ServerSocket.java:466)
at java.net.ServerSocket.accept(ServerSocket.java:433)
at org.apache.derby.impl.drda.ClientThread$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(AccessController.java:242 )
at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
After getting this error, to the same server (didn't restart), I tried connecting from another machine to the same server got communication error. Here is the error message on the client machine for that
ERROR 58009: A communications error has been detected: Connection reset.
> NetworkServer not accepting connections with default security manager on Ipv6 machines
> --------------------------------------------------------------------------------------
>
> Key: DERBY-2874
> URL: https://issues.apache.org/jira/browse/DERBY-2874
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.3.0.0
> Environment: Ipv6 machine with ibm jvm 15
> Reporter: Manjula Kutty
> Assignee: Rick Hillegas
> Fix For: 10.3.0.0
>
> Attachments: derby-2874-01.diff
>
>
> While running tests on Ipv6 machines using the 10.3 jars with the default security manager, I had the following findings/questions
> I started the server like this java org.apache.derby.drda.NetworkServerControl start -h 2002:92a:8f7a:13:9:42:74:19
> and the server started with the following command
> Security manager installed using the Basic server security policy.
> Apache Derby Network Server - 10.3.1.0 beta - (548006) started and ready to accept connections on port 1527 at 2007-06-25 23:44: 36.835 GMT
>
> So I think the server is using the default security manager. Then when I tried to get conenction though ij
>
> got the following error message
> Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> java.security.AccessControlException: Access denied (java.net.SocketPermission [2002:92a:8f7a:13:9:42:73:218]:34016 accept,resolve)
> at java.security.AccessController.checkPermission(AccessController.java:104)
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:547)
> at java.lang.SecurityManager.checkAccept (SecurityManager.java:1172)
> at java.net.ServerSocket.implAccept(ServerSocket.java:466)
> at java.net.ServerSocket.accept(ServerSocket.java:433)
> at org.apache.derby.impl.drda.ClientThread$1.run (Unknown Source)
> at java.security.AccessController.doPrivileged(AccessController.java:242)
> at org.apache.derby.impl.drda.ClientThread.run(Unknown Source)
>
> I had the derby.properties file like this
>
> derby.database.sqlAuthorization=true
> derby.connection.requireAuthentication=true
> derby.infolog.append=true
> derby.authentication.provider=BUILTIN
> derby.stream.error.logSeverityLevel=0
> #derby.language.logStatementText=true
> # User's Definitions
> derby.user.user2=pass2
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.