AJP pings and proxy attempts fail after updating to EAP 7.4.25

Solution Verified - Updated

Environment

  • JBoss Enterprise Application Platform (EAP) 7.4.25

Issue

  • After updating to EAP 7.4.25 and configuring the io.undertow.ajp.AJP_SECRET and matching secret on the AJP proxy, AJP CPINGs fail like below and place JBoss in an error state on the proxy so any request attempts fail:
[:error] [pid 58762:tid 58860] (70014)End of file found: ajp_cping_cpong: apr_socket_recv failed

Resolution

Update to EAP 7.4.26+ or consider as an alternative solution:

  • Switch to HTTP(s) proxying from AJP. This is preferable for security as the AJP secret is a cleartext secret adding no true security
  • Rollback to 7.4.24
  • Set -Dio.undertow.ajp.REQUIRE_AJP_SECRET=false on 7.4.25 for functionality equivalent to EAP 7.4.24 without the AJP secret
  • If still desiring an AJP secret check on 7.4.25, set -Dio.undertow.ajp.REQUIRE_AJP_SECRET=false and add a secret check through an undertow expression-filter with CLI commands modifying the configuration like below (changing 8009 if that is not the AJP port used):
/subsystem=undertow/configuration=filter/expression-filter=secret-checker:add(expression="not equals(%{r,secret}, 'YOUR_AJP_SECRET') -> response-code(403)")
/subsystem=undertow/server=default-server/host=default-host/filter-ref=secret-checker:add(predicate="equals(%p,8009)")

Root Cause

SBR
Product(s)
Components
Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.