Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Patching clobbers existing server.xml #20

Open
rrowlands opened this issue Aug 22, 2022 · 0 comments
Open

Patching clobbers existing server.xml #20

rrowlands opened this issue Aug 22, 2022 · 0 comments

Comments

@rrowlands
Copy link
Contributor

If a change has been made to tomcat or any of its configuration files, the patcher rolls out a new server.xml file which clobbers any existing SSL settings. Additionally, the server.xml file rolled out by our installer / patcher does not include a connector for port 80, which in addition to being very non-standard behaviour (requiring users to access the app via the non-standard port 8080), also breaks the Aiims server's SSL renewal process which requires port 80 to be open (when the manager has disabled SSL). The following changes need to be made to the system to satisfy these issues:

  1. The server.xml file, which is currently bundled within the thirdparty/tomcat/tomcat64 and thirdparty/tomcat/tomcat32 directories, needs to be moved into a separate directory, which will allow for future upgrades of tomcat and will allow the patcher to detect when configuration has changed independently of upgrading tomcat. Additionally, the patcher and installer will need to have an additional step whereby it configures tomcat, instead of just rolling out all files as is.
  2. When patching, if there are changes to the server.xml, the existing SSL connector, if it exists, must be preserved through the configuration upgrade.
  3. The following additional connector must be added to the default server.xml rollout, placed directly below the existing port 8080 connector:
    <Connector connectionTimeout="20000" port="80" protocol="HTTP/1.1" maxPostSize="-1" maxSavePostSize="-1" />
  4. Finally, the SSL connector generated by the manager has a bug in it. It is redirecting from port 8443 to port 8443, which is a no-op at best, a bug at worst. Line 308 of ServerSettingContextBean element.setAttribute("redirectPort", "8443") needs to be changed to redirect from port 8080.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant