Bug 45453

Summary: JDBCRealm.getRoles bad synchronization causes hangs w/ DIGEST authentication
Product: Tomcat 5 Reporter: Santtu Hyrkkö <santtu.hyrkko>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Severity: normal Keywords: PatchAvailable
Priority: P2    
Version: 5.5.26   
Target Milestone: ---   
Hardware: PC   
OS: Linux   
Attachments: proposed patch for tomcat-6.0.16
proposed patch for tomcat-5.5.26

Description Santtu Hyrkkö 2008-07-22 02:25:02 UTC
JDBCRealm.getRoles bad synchronization causes hangs w/ DIGEST authentication

JDBCRealm caches PreparedStatement preparedRoles. That, and missing synchronization in JDBCRealm and/or DigestAuthenticator allow two threads to call getRoles simultaneously so that T1 will do stmt.executeQuery() while T2 does stmt.setString(1, userName) plus another .executeQuery() on the same PreparedStatement object.

In the worst case, the JDBC driver gets confused by this, and blocks forever waiting for server response, causing all other threads that try to access DB hang. (This was observed with PostgreSQL 8.3-603-jdbc4 JDBC driver)

Comment 1 Santtu Hyrkkö 2008-07-23 00:54:05 UTC
Created attachment 22301 [details]
proposed patch for tomcat-6.0.16

synchronize JDBCRealm.getPrincipal
Comment 2 Santtu Hyrkkö 2008-07-23 00:54:33 UTC
Created attachment 22302 [details]
proposed patch for tomcat-5.5.26

synchronize JDBCRealm.getPrincipal()
Comment 3 Santtu Hyrkkö 2008-07-23 01:01:45 UTC
The problem is also in 6.0.16
Comment 4 Mark Thomas 2008-07-29 08:00:47 UTC
Thanks for the patch. It has been applied to trunk and proposed for 6.0.x and 5.5.x.
Note you will probably be better off using the DataSourceRealm.
Comment 5 Mark Thomas 2008-08-13 15:05:09 UTC
This has been fixed in 6.0.x and will be included in 6.0.19 onwards.
Comment 6 Mark Thomas 2008-08-14 02:37:32 UTC
This has been fixed 5.5.x and will be included in 5.5.27 onwards