BonCode Connector, IIS 7.5 & Tomcat 8, Intermittent Generic Connector Error - iis-7.5

I have a JSP web-app hosted on IIS 7.5 & Tomcat 8.0.30 via BonCode AJP13 v1.0.26 on Win 2008 R2 64 bit.
On the production environment, some users are getting an intermittent BonCode error:
Generic Connector Error: Please check...
Has anyone got a known working configuration for BonCode 1.0.26, IIS 7.5 & Tomcat 8?
Details
The users affected seem to be roaming laptops and home-workers that connect via a VPN
ie desktops seem unaffected.
There is no authentication on Tomcat / JSP web-app.
A single instance of Tomcat is on the same server as IIS 7.5.
ie no load-balancing etc.
Only plain HTTP is being used
ie not HTTPS and no associated certificates.
Client Diagnosis
IE 11 Developer Tools > Network
shows the generation of a HTTP 502.
Fiddler
shows the generation of a HTTP 502.
Server Diagnosis
BonCode logs
Occasionally, this is seen:
2016-02-29 15:59:01 1.0.26 ERROR
TCP Client level -- Server/Port:localhost/8009
Value cannot be null.
Parameter name: buffer
2016-02-29 15:59:01 One Connection raised an error
but usually, no related errors / warnings are being shown
IIS Failed Trace Requests
shows the generation of a HTTP 502 in module ‘ManagedPipelineHandler’.
Tomcat logs
no errors, as expected as servlet/JSP requests are not being forwarded.
Configuration Files
BonCode - BonCodeAJP13.settings
<Settings>
<Port>8009</Port>
<Server>localhost</Server>
<MaxConnections>0</MaxConnections>
<LogLevel>4</LogLevel>
<LogDir>E:\inetpub\logs\BonCode</LogDir>
<FlushThresholdTicks>0</FlushThresholdTicks>
<EnableRemoteAdmin>False</EnableRemoteAdmin>
<PacketSize>65536</PacketSize>
</Settings>
Tomcat - server.xml
...
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443"
packetSize="65536" />
...
Notes
I am aware that, as well as BonCode, there are these other connector options:
Tomcat ISAPI
IIS ARR
If we get no joy with BonCode, we will probably try IIS ARR next.
Thanks for reading.

After much trial and error, it seems that the authorization HTTP header must be filtered out.
Some client machines, roaming laptops etc, seem to generate very large authorization packets - I have seen sizes of about 12K.
For whatever reason, despite setting the packet size to 64K on both BonCode & Tomcat 8, this header seems to be too large.
This is now our BonCode configuration - note the updated HeaderBlacklist value
<Settings>
<Port>8009</Port>
<Server>localhost</Server>
<MaxConnections>0</MaxConnections>
<LogLevel>2</LogLevel>
<LogDir>E:\inetpub\logs\BonCode</LogDir>
<FlushThreshold>0</FlushThreshold>
<EnableRemoteAdmin>False</EnableRemoteAdmin>
<HeaderBlacklist>AUTHORIZATION,URL,SERVER_SOFTWARE,SERVER_NAME,SERVER_PROTOCOL</HeaderBlacklist>
<PacketSize>65536</PacketSize>
</Settings>

Related

WOPI Host IIS 10.0 / http.sys allow POST requests to be empty

OS: Windows Server 2019 Version 1809
IIS: 10.0.17763.1
When sending a POST request with no content, we are receiving an 411 error thrown by http.sys. I already read this question, but we cannot change the client code since the request are coming from a WOPI client. I also went through the registy entries for http.sys but I couldn't find the correct one. It somehow must be possible, because there are WOPI Hosts running with IIS. Since WOPI Hosts are nothing completely new, someone else must have stumbled across this issue.
Can I somehow tell http.sys to allow empty content for post requests or is this some kind of config for each WOPI client?

Getting net::ERR_CONNECTION_RESET Intermittently with Node API Hosted in IIS using IISNODE

I have a video streaming API developed in Node.js using the Express module.
This API is hosted on my local machine under IIS 8.5 using iisnode module, which makes the IIS as my reverse proxy server and the express (node) as my web server.
When I hit my API URL in the browser, it plays the video for a while and then I get net::ERR_CONNECTION_RESET error.
I get this error after few minutes (approx 7 mins.), but there is no specific time duration observed.
I see below two errors in HTTPERR folder under "C:\WINDOWS\system32\LogFiles\".
2019-05-09 14:55:39 ::1%0 64836 ::1%0 3005 HTTP/1.1 GET /api/videolib/streamvideo?id=f80b4ae0725f11e9b42fcb6803fde91b - 8 Connection_Dropped VideoLibrary.WebAPI.Node
2019-05-10 08:51:02 ::1%0 54848 ::1%0 3005 HTTP/1.1 GET /api/videolib/streamvideo?id=f80b4ae0725f11e9b42fcb6803fde91b - 8 Connection_Abandoned_By_ReqQueue VideoLibrary.WebAPI.Node
I have observed that, I don't get this error at all when I run the API directly under Node.exe thus bypassing the IIS and IISNODE altogether on my local machine.
However, I have no choice but to use IIS and IISNODE in production.
UPDATE:
So, I created an API in .NET equivalent to my node API, and hosted it in the IIS; it works fine without issues of any kind.
Now, I know that there is something weird going on with the iisnode module.
I have tried changing couple of settings in iisnode via web.config, but nothing seems to fix this problem.
Any help on this would be greatly appreciated. Thanks.

ASP.NET Core 2.1 Give me HTTP Error 502.5 - Process Failure

After using deploying my .NET Core 2.1 App to my server, I get the following error when I access the page:
HTTP Error 502.5 - Process Failure
Following Microsoft's always helpful link on the same page (cough cough), I checked the Event View Log and it states:
Application 'MACHINE/WEBROOT/APPHOST/BLAH.COM' with physical root
'D:\inetpub\vhosts\BLAH.com\httpdocs\' failed to start process with
commandline 'dotnet .\blah.dll', ErrorCode = '0x80070002 : 0.
The message was not only unhelpful, but completely irrelevant. I tried to enable the web app's logging in web.config:
<aspNetCore requestTimeout="23:00:00" processPath="dotnet" arguments=".\blah.dll" forwardWindowsAuthToken="false" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" startupTimeLimit="3600" />
Oddly, no files were created in the Log directory until I granted permission to my IWPD process. The files it created weren't in the stdout directory as specified, but were in the parent log directory. They also were empty.
I ran the web app from the command line using:
dotnet .\blah.dll
The application appeared to run and I could see some messages on the screen, but I still got the same 502.2 error accessing the site with no additional information in the logs. I followed the troubleshooting steps for ASP.NET Core 2.1 and it mentioned this:
If the errors occur when making a request to the app, make a request
to the host and port where Kestrel listens. Using the default host and
post, make a request to http://localhost:5000/. If the app responds
normally at the Kestrel endpoint address, the problem is more likely
related to the reverse proxy configuration and less likely within the
app.
I ran the web app from the command line and tried to access it using http://localhost:5000. I was finally able to access the site, but I still got the same 502.2 error via IIS.
It's obvious IIS and Kestrel are not communicating with each other. I don't understand why there's two web servers and how to get them to communicate with each other.
Solved the problem. The installer for the server's IIS module doesn't restart or warn the user to restart IIS. Restarting IIS loaded the necessary module. Clearly, this is a bug by any other name.

Routing requests from IIS to Jetty with isapi_redirect (tomcat connector)

I have installed the isapi_redirect into IIS, and allowed to run.
I have enabled the ajp13 in Jetty and I can telnet to port 8009.
This is my current uiworkermap.properties:
/hudson=jetty
/hudson/*=jetty
If I make a request to "http://localhost/hudson" or any subdirectory I get a 404 error.
All the other urls return the site defined in IIS.
This tells me that the isapi_redirect is looking at the uiworkermap file and trying to redirect correctly.
In the Jetty log and in the isapi_redirect log I don't see any errors.
If I go to http://localhost:8008/hudson I see it correctly.
Do you have any idea what could cause this?
UPDATE: I created a virtual directory with name "Jakarta" that pointed to the isapi_redirect dll like it is said here: http://tomcat.apache.org/connectors-doc/webserver_howto/iis.html
After this step the error changed, now in the browser I see:
Bad Gateway!
There is a problem with the page you are looking for, and it cannot be displayed. When the Web server (while acting as a gateway or proxy) contacted the upstream content server, it received an invalid response from the content server.
Jakarta/ISAPI/isapi_redirector/1.2.32 ()
In the error log (in debug mode) I can see that it first connects and the request is made but there is no response from jetty, and this error is generated:
[error] ajp_get_reply::jk_ajp_common.c (2118): (jetty) Tomcat is down or refused connection. No response has been sent to the client (yet)
This is the part of the log with the request and error:
https://rapidshare.com/files/3999719393/isapi_redirect_log.txt
Ok, in the end not having any help from stackoverflow users and also reading that in the official Jetty site about ajp13:
It is recommended to NOT use the AJP protocol, and superior
performance and clearer semantics will be achieve using HTTP.
I gave up on ajp and used a great and well documented open source dll to have HTTP proxy functions in IIS, IIRF.
So I would suggest anyone who has similar issues to just use an HTTP proxy instead.

Setting up SMTP under IIS 7 on Windows Server 2008

Website started life originally under IIS 6 and the site worked great there. Now after relocating to a new server running W2K8S, everything but mail delivery from the website now works great under IIS 7.
Researched briefly on the Web to see if anybody had a good resolution, but no avail... Not even a glimmer of hope on Microsoft's own support site.
Here are the steps taken so far on the new W2K8S box:
Added the feature for SMTP under the Server Manager
Enabled SMTP e-mail for the site itself in IIS 7 Manager to deliver e-mail to SMTP server local host, unsuccessful
Enabled SMTP e-mail for the root site in IIS 7 Manager (not sure if that needs to be on to enable sites) to deliver e-mail to SMTP server local host, unsuccessful
After failing those basic setups, I wanted to be sure I can actually talk from/to the serveron port 25. And I can successfully telnet from/to the server in question to a test e-mail on port 25 get a HELO, etc. So I do not believe it is a firewall config issue.
The IIS 7 setup test was performed with both anonymous and Windows authentication - no luck either way.
Manually checked Web Config file and it reflects correct entry for the server to use the localhost.
Read the manual and no luck there either... :-/
I faced the same problem.
I came across this link http://www.frontpagewebmaster.com/m-215289/tm.htm
and I was able to solve the issue. Go to the last post of this link.
In my case I solve problem by giving rights to "NETWORK SERVICE" user to the "Pickup" folder.
Hope this might help....
OK, to the post that said "give NETWORK USER the write rights to the pickup folder" it finally works. What I did was:
You need to use a "smart host" unless you are running exchange server. I am using a Gmail account, Gmail allows SMTP forwarding.
You can use Windows authentication for security on the SMTP server and the IIS7 config setting.
First step, set the delivery method = "network" in your web page, and get your smart host configured independently of the SMTP server.
SmtpClient client = new SmtpClient("smtp.gmail.com", 587);
client.DeliveryMethod = SmtpDeliveryMethod.Network;
client.UseDefaultCredentials = false; // use your smart host login client.Credentials = new NetworkCredential("xxxxx#gmail.com", "password");
client.EnableSsl = true;
This will send the email directly and bypass your SMTP server.
Second step, once you have that working, write a sample windows app to use your SMTP server independent of your web page, and get that working.
SmtpClient client = new SmtpClient("your server ip", 25);
client.DeliveryMethod = SmtpDeliveryMethod.PickupDirectoryFromIis;
client.EnableSsl = false; // you can't use ssl with a pickup folder
client.UseDefaultCredentials = true; // use windows credentials
This will bypass your web page and make sure you have your SMTP server configured properly.
Finally, get your web page working, by setting the sharing on your pickup folder to allow write access to NETWORK_SERVICE. Transfer the login info from step 3, into your SMTP settings, set authentication to integrated security, and use the code in step 4 for your web page.
I had exactly the same problem as described in this old question. Finally I found a solution to it. In my case the operation system is W2008 R2 with IIS 7.5, but I think this doesn’t matter.
The underlying problem is that the SMTP Service in W2008 R2 seems to be a legacy part of the IIS. It is installed with the IIS 6.0 administration tools, side by side to the IIS 7.X Server. This causes two derived problems:
IIS 7.X knows nothing about the SMTP service. If you configure SMTP in ASP.NET to use the PickupDirectoryFromIis this results in an exception. Therefore you can’t use this SMTP configuration:
<smtp deliveryMethod="PickupDirectoryFromIis" />
But it is possible to configure SMTP with SpecifiedPickupDirectory, You can use this configuration:
<smtp deliveryMethod="SpecifiedPickupDirectory">
<specifiedPickupDirectory pickupDirectoryLocation="C:\inetpub\mailroot\Pickup" />
</smtp>
If you configure the pickup directory in this way, you may run into a second kind of problem: IIS6 and IIS7.X have different security systems. IIS 7.X introduces integrated security with application pool identities. IIS 6.0 and its SMTP service don’t know about this. Therefore you have to grant write permissions for IIS_IUSRS to the pickup folder. In my configuration the pickup folder is C:\inetpub\mailroot\pickup.
I noticed that the event ID 4006 was refering to the domain controller ip instead of the mail server ip.
I used the iis 6 admin tool to configure a smarthost pointing to the mail server and voila! the issue was resolved.
I am not sure if this diagnostic tool can provide more insights,
http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1308
This tool is for x86.
Have you checked to see if the SMTP service is accepting mail for relay from localhost? To do this, telnet from the machine in question to the local SMTP server and use SMTP commands to send a test message. The SMTP service is very picky about command formatting so you'll have to be careful when entering commands (i.e. don't use backspace to correct typographical errors).
Is this, by chance, an old "classic" ASP app relying on CDONTS to send mail?
If so, perhaps one of these links would be helpful?
Edited: I had replied before noticing the note on the original post. Disregard...
I came across this post when researching getting SMTP running on my ASP.Net app we're migrating from IIS6 to IIS7. What I found was we didn't have to set up the SMTP SERVER at all - simply setting up SMTP Email was enough - with the additional benefit of NOT having the security concerns of SMTP relaying thru the web server!
so if you don't need your web server to actually do the SMTP routing, you don't have to set up the server at all in IIS7.

Resources