Bug 62794 - Tomcat request-read fails when using TLSv1.3 with APR connector
Summary: Tomcat request-read fails when using TLSv1.3 with APR connector
Status: RESOLVED DUPLICATE of bug 62748
Alias: None
Product: Tomcat 9
Classification: Unclassified
Component: Connectors (show other bugs)
Version: unspecified
Hardware: PC Mac OS X 10.1
: P2 normal (vote)
Target Milestone: -----
Assignee: Tomcat Developers Mailing List
Depends on:
Reported: 2018-10-02 14:39 UTC by Christopher Schultz
Modified: 2019-06-27 04:28 UTC (History)
0 users


Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Schultz 2018-10-02 14:39:33 UTC
When TLSv1.3 is enabled with the APR connector, Tomcat fails with an IOException after the TLS handshake completed but before a request is processed.


0. Use OpenSSL 1.1.1

1. Patch Tomcat and tcnative to support OpenSSL TLSv1.3. Please see bug #62748 for the requisite patches. Note that both Tomcat and tcnative need patches.

2. Configure Tomcat trunk with a connector:

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
               maxThreads="150" SSLEnabled="true">
        <SSLHostConfig protocols="TLSv1.2+TLSv1.3">
            <Certificate certificateKeyFile="conf/localhost.key"
                         type="RSA" />

3. Start Tomcat

4. Attempt to make a connection:

    $ openssl s_client -tls1_3 -connect [host]:8443
    [handshake succeeds]
    GET /[CRLF]

Result: connection is closed, Tomcat throws an exception:

02-Oct-2018 10:32:10.734 FINE [https-openssl-apr-8443-exec-6] org.apache.coyote.http11.Http11Processor.service Error parsing HTTP request header
 java.io.IOException: Unexpected error [53] reading data from the APR/native socket [140,449,444,320,416] with wrapper [org.apache.tomcat.util.net.AprEndpoin
        at org.apache.tomcat.util.net.AprEndpoint$AprSocketWrapper.fillReadBuffer(AprEndpoint.java:2533)
        at org.apache.tomcat.util.net.AprEndpoint$AprSocketWrapper.fillReadBuffer(AprEndpoint.java:2453)
        at org.apache.tomcat.util.net.AprEndpoint$AprSocketWrapper.read(AprEndpoint.java:2436)
        at org.apache.coyote.http11.Http11InputBuffer.fill(Http11InputBuffer.java:729)
        at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:352)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:294)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:770)
        at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2338)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1135)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.base/java.lang.Thread.run(Thread.java:844)

Expected: successful HTTP request/response

Running the same s_client command with the -tls1_2 switch works as expected.

There is a report in bug #62748 indicating that Google Chrome fails in a similar way and so does Tomcat.
Comment 1 Mark Thomas 2018-10-09 11:58:42 UTC
I have found the problem. It is related to how Tomcat Native tracks the renegotiation status and that TLS 1.3 doesn't use renegotiation. I have a working fix. I am currently reviewing the overall patch and should have something ready to commit later today.
Comment 2 Mark Thomas 2018-10-09 17:25:31 UTC
Fixed in trunk for 1.2.18 onwards.

*** This bug has been marked as a duplicate of bug 62748 ***