Solved

tomcat 5- dns lookup- jvm params

Posted on 2004-08-09
8
1,885 Views
Last Modified: 2008-02-01
Hello Experts,

I am writing a filter to restrict access to the parts of the web application based on domain name.
In my doFilter method I added this code:


 HttpServletRequest req = (HttpServletRequest) request;
        String id = req.getSession().getId();
        String ipaddress = req.getRemoteAddr();
        String remoteHost=req.getRemoteHost();

unfortunately   remoteHost contains IP address when the application is accessed via IIS-Tomcat integration. If it is accessed using http://localhost:8080 (without IIS) I get domain name in remoteHost. I have enabled lookups=true in both AJP 1.3 connector also
  <!-- Define a Coyote/JK2 AJP 1.3 Connector on port 8009 -->
    <Connector port="8009"
               enableLookups="true" redirectPort="8443" debug="0"
               protocol="AJP/1.3" />

 Still I get ip address via req.getRemoteHost(). So I thought of using java.net package to do it:

String hostname = InetAddress.getAllByName( "199.93.4.15" ) .getHostName();

From java doc:

InetAddress Caching
The InetAddress class has a cache to store successful as well as unsuccessful host name resolutions. The positive caching is there to guard against DNS spoofing attacks; while the negative caching is used to improve performance.
By default, the result of positive host name resolutions are cached forever, because there is no general rule to decide when it is safe to remove cache entries. The result of unsuccessful host name resolution is cached for a very short period of time (10 seconds) to improve performance.

"host name resolutions are cached forever"--> cached forever

To rectify this I would like to set a default time period for caching using jvm parameter "networkaddress.cache.ttl (default: -1) "
but how do I set this parameter for Tomcat 5 started as service in windows 2000. One option is to set the JAVA_OPTS environment variable... which our system admin do not want to use. Is there an alternative way to set the parameter.

Also, is there an easy way to access jvm parameters in Filter or servlet?

Thank you in advance for your help!!!

0
Comment
Question by:iit
  • 5
  • 3
8 Comments
 
LVL 35

Expert Comment

by:TimYates
ID: 11760223
> One option is to set the JAVA_OPTS environment variable... which our system admin do not want to use. Is there an alternative way to set the parameter.

Unfortunately, I don't think so...  I think that number is set when the jvm loads tomcat, so you would have to set it in the JAVA_OPTS

> Also, is there an easy way to access jvm parameters in Filter or servlet?

System.getProperty( "propname" ) ;
0
 

Author Comment

by:iit
ID: 11762674
Thank you TimYates for your comments!!

>>Unfortunately, I don't think so...  I think that number is set when the jvm loads tomcat, so you would have to set it in the JAVA_OPTS

I suppose in the earlier version of Tomcat (I am using tomcat 5) you can set JAVA_OPTS in catalina.bat

From: http://jakarta.apache.org/tomcat/faq/misc.html

How do I set system properties at startup?
Set JAVA_OPTS to be something BEFORE calling startup.bat or before calling catalina.bat. (or you can edit those files, but it isn't advised)

Example (windows): SET JAVA_OPTS='-DpropName=propValue'

Example (UNIX): export JAVA_OPTS='-DpropName=propValue'

Windows service users - use http://web.bvu.edu/staff/david/index.jsp?section=software&subsection=tcservcfg&page=overview

It looks like the Tomcat Service Manager is making some registry changes or something else. I did not try this yet. I am not sure if it works with Tomcat 5.

I am assuming there might be some option to pass jvm parameters to the tomcat service in windows 2000. I can set the environment variable (instead of system variable) if I am starting the Tomcat using startup.bat. But we need to set that up as a service that runs all times even when user is not logged in.

>System.getProperty( "propname" ) ;
Thanks. I just didn't recall this method. It's been a while I used it...

Thanks again for your comments!!
0
 
LVL 35

Expert Comment

by:TimYates
ID: 11762850
> I suppose in the earlier version of Tomcat (I am using tomcat 5) you can set JAVA_OPTS in catalina.bat

You can still do that in Tomcat 5 :-)

But I am not sure whether the Service wrapper goes through catalina.bat to run tomcat, or if it runs it via another route :-(
0
 

Author Comment

by:iit
ID: 11763279
>>You can still do that in Tomcat 5 :-)
Sure. But that way I have to start tomcat at the command prompt using the startup batch file. But I do not want to start it this way. Instead I want to configure the Apache Tomcat as automatic service to start it automatically. This way if anyone restarts the server Tomcat service will be started automatically and it seems to be a good idea.

How about adding this in init() method of a custom Filter that I developed:

   System.setProperty("networkaddress.cache.ttl","10")

Thanks much!!
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 35

Accepted Solution

by:
TimYates earned 125 total points
ID: 11763398
>  System.setProperty("networkaddress.cache.ttl","10")

That will work if the property is not read before this point (as I think it caches it)...

Why don't you add it to service.bat?

after the line:

rem Set extra parameters

change:

"%EXECUTABLE%" //US//%SERVICE_NAME% --JavaOptions -Dcatalina.home="\"%CATALINA_HOME%\""#-Djava.endorsed.dirs="\"%CATALINA_HOME%\common\endorsed\""#-Xrs --StdOutputFile "%CATALINA_HOME%\logs\stdout.log" --StdErrorFile "%CATALINA_HOME%\logs\stderr.log" --WorkingPath "%CATALINA_HOME%\bin"

to:

"%EXECUTABLE%" //US//%SERVICE_NAME% --JavaOptions -Dcatalina.home="\"%CATALINA_HOME%\""#-Djava.endorsed.dirs="\"%CATALINA_HOME%\common\endorsed\""#-Dnetworkaddress.cache.ttl=0#-Xrs --StdOutputFile "%CATALINA_HOME%\logs\stdout.log" --StdErrorFile "%CATALINA_HOME%\logs\stderr.log" --WorkingPath "%CATALINA_HOME%\bin"

?

Then uninstall the service with:

service.bat remove [servicename]

and reinstall it

Hope that helps :-)
0
 

Author Comment

by:iit
ID: 11766969
Thanks TimYates!!

that's a very good idea!!

I did not find the exact same line in service.bat file. What version of tomcat are you using? I have tomcat 5.0

It appears to me I do not need to uninstall/install the service completely. These is doInstall from Tomcat5 service.bat :

:doInstall
rem Install the service
rem Use the environment variables as an exaple
rem Each command line option is prefixed with PR_

set PR_DISPLAYNAME=Apache Tomcat
set PR_DESCRIPTION=Apache Tomcat Server - http://jakarta.apache.org/tomcat
set PR_INSTALL=%EXECUTABLE%
set PR_LOGPATH=%CATALINA_HOME%\logs
set PR_CLASSPATH=%CATALINA_HOME%\bin\bootstrap.jar

rem************************** Is this command actually installing the service???
"%EXECUTABLE%" //IS//%SERVICE_NAME% --Jvm auto --StartClass org.apache.catalina.startup.Bootstrap --StopClass org.apache.catalina.startup.Bootstrap --StartParams start --StopParams stop
rem Clear the environment variables. They are not needed any more.
set PR_DISPLAYNAME=
set PR_DESCRIPTION=
set PR_INSTALL=
set PR_LOGPATH=
set PR_CLASSPATH=
rem Set extra parameters

rem*************************What is this command doing... setting parameters???
rem*************************There is probably a place/file where all these parameters are stored...
"%EXECUTABLE%" //US//%SERVICE_NAME% --JvmOptions "-Dcatalina.base=%CATALINA_BASE%;-Dcatalina.home=%CATALINA_HOME%;-Djava.endorsed.dirs=%CATALINA_HOME%\common\endorsed" --StartMode jvm --StopMode jvm

rem More extra parameters
set PR_STDOUTPUT=%CATALINA_HOME%\logs\stdout.log
set PR_STDERROR=%CATALINA_HOME%\logs\stderr.log

rem******************************************Is this setting addtional parameters for the already installed service?

"%EXECUTABLE%" //US//%SERVICE_NAME% ++JvmOptions "-Djava.io.tmpdir=%CATALINA_BASE%\temp" ========> notice ++JvmOptions

So just running these command at the prompt might be enough:

set EXECUTABLE=%CATALINA_HOME%\bin\tomcat5.exe
rem Set default Service name
set SERVICE_NAME=Tomcat5
"%EXECUTABLE%" //US//%SERVICE_NAME% ++JvmOptions "-Djava.io.tmpdir=%CATALINA_BASE%\temp"

Any comments? If you do not have service.bat from Tomcat 5, I can paste it here.

There must be a place where the service stores these jvm parameters. Is it in registry?

I appreciate your help very much !!
0
 

Author Comment

by:iit
ID: 11767067
Typo:

So just running these command at the prompt might be enough:

set EXECUTABLE=%CATALINA_HOME%\bin\tomcat5.exe
rem Set default Service name
set SERVICE_NAME=Tomcat5
"%EXECUTABLE%" //US//%SERVICE_NAME% ++JvmOptions "-Dnetworkaddress.cache.ttl=10"

Actually, I found some settings in registry: HKLM\software\Apache Software Foundation\Tomcat5\Parameters\Java

Key Options:

Value:
-Dcatalina.home=C:\Program Files\Apache Software Foundation\Tomcat 5.0
-Djava.endorsed.dirs=C:\Program Files\Apache Software Foundation\Tomcat 5.0\common\endorsed
-Djava.io.tmpdir=C:\Program Files\Apache Software Foundation\Tomcat 5.0

I added -Dnetworkaddress.cache.ttl=100 to the value and restarted Tomcat. I logged the value of "networkaddress.cache.ttl " in my Filter and it works :) I changed the vlaue from 100 to 10 and restarted to 10... the log shows 10... so this confirms that is using the value from registry at this location...

I got this idea from Tomcat Service Manager I mentioned before:
 http://web.bvu.edu/staff/david/index.jsp?section=software&subsection=tcservcfg&page=overview

I didnt want to install it and change using this tool as I am not sure for what version of Tomcat it is designed for.

Thanks much for your help again!!
0
 

Author Comment

by:iit
ID: 11767213
Actually, the reason behind doing all this is to avoid setting environment parameters... to make the installation of web application easier.

>  System.setProperty("networkaddress.cache.ttl","10")

>>That will work if the property is not read before this point (as I think it caches it)...
Do you mean, if the property is set using the above statement after it has been initalized then it wouldn't/(may not) make any difference or that the jvm wil continue to cache lookup values? that's an interesting pont. But how do we verify? just curious...

Thank you!!
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Owning a franchise can be the dream of a lifetime. It provides a chance for economic growth. You can be as successful as you want.  To make your franchise successful, you need to market it successfully. Here are six of the best marketing strategies …
Are you unable to connect or configure Hotmail email account in Microsoft Outlook 2010, 2007? Or Outlook.com emails are not downloading to Outlook? Lets’ see the problem and resolve Outlook Connector error syncing folder hierarchy (0x8004102A).
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now