Latest snapshot is failing to deploy with java.net.SocketTimeoutException: connect timed out

Miguel-F · September 19, 2023, 8:07pm

I am trying to install the latest 5.4 snapshot (5.4.4.2-SNAPSHOT.lco) but it keeps failing. I’ve tried placing the file in the ‘deploy’ folder but that results in a ‘failed-to-deploy’ folder. I tried placing the file directly in the ‘patches’ folder but that borks the server.

Looking in the deploy.log file I see that a SocketTimeoutException is occurring. What is it trying to connect to? Our servers do not have access to the internet so if it trying to reach out to luccee.org it will fail. If that’s what it is trying to do how do I get around that? The Lucee server is useless after these failures and I have to revert back.

I built this server using the 5.4.3.2 Windows installer.
I then successfully installed 5.4.3.9-SNAPSHOT.lco by placing that file in the ‘patches’ folder.
Now I am trying to install 5.4.4.2-SNAPSHOT.lco but it keeps failing.

Windows Server 2019
Java 11.0.20
Apache Tomcat/9.0.78
Lucee 5.4.3.9-SNAPSHOT

Here is the stacktrace from deploy.log

"ERROR","Thread-255","09/19/2023","15:50:14","Extension","java.net.SocketTimeoutException: connect timed out;lucee.runtime.exp.NativeException: java.net.SocketTimeoutException: connect timed out
	at lucee.loader.engine.CFMLEngineFactory.initEngine(CFMLEngineFactory.java:397)
	at lucee.loader.engine.CFMLEngineFactory._restart(CFMLEngineFactory.java:617)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at lucee.runtime.config.XMLConfigAdmin.restart(XMLConfigAdmin.java:4087)
	at lucee.runtime.config.XMLConfigAdmin.updateCore(XMLConfigAdmin.java:4733)
	at lucee.runtime.config.DeployHandler.deploy(DeployHandler.java:91)
	at lucee.runtime.engine.Controler.control(Controler.java:223)
	at lucee.runtime.engine.Controler.access$000(Controler.java:58)
	at lucee.runtime.engine.Controler$ControlerThread.run(Controler.java:113)
Caused by: javax.servlet.ServletException: java.net.SocketTimeoutException: connect timed out
	... 12 more
Caused by: java.net.SocketTimeoutException: connect timed out
	at java.base/java.net.PlainSocketImpl.waitForConnect(Native Method)
	at java.base/java.net.PlainSocketImpl.socketConnect(Unknown Source)
	at java.base/java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
	at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
	at java.base/java.net.AbstractPlainSocketImpl.connect(Unknown Source)
	at java.base/java.net.SocksSocketImpl.connect(Unknown Source)
	at java.base/java.net.Socket.connect(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
	at java.base/sun.net.NetworkClient.doConnect(Unknown Source)
	at java.base/sun.net.www.http.HttpClient.openServer(Unknown Source)
	at java.base/sun.net.www.http.HttpClient.openServer(Unknown Source)
	at java.base/sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
	at java.base/sun.net.www.protocol.https.HttpsClient.New(Unknown Source)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
	at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
	at lucee.loader.engine.CFMLEngineFactory.downloadBundle(CFMLEngineFactory.java:727)
	at lucee.loader.osgi.BundleLoader.loadBundles(BundleLoader.java:129)
	at lucee.loader.engine.CFMLEngineFactory.initEngine(CFMLEngineFactory.java:381)
	... 11 more"

Miguel-F · September 19, 2023, 8:18pm

I just saw this warning in the application.log as well. Notice that it was written like 13 minutes later.

"WARN","http-nio-8550-exec-1","09/19/2023","16:03:23","controller","Page /lucee/admin/Application.cfc [zip://X:\luceeserver\web-contexts\site1\context\lucee-admin.lar!/Application.cfc] not found;lucee.runtime.exp.MissingIncludeException: Page /lucee/admin/Application.cfc [zip://X:\luceeserver\web-contexts\site1\context\lucee-admin.lar!/Application.cfc] not found
	at lucee.runtime.PageSourceImpl.loadPage(PageSourceImpl.java:227)
	at lucee.runtime.component.ComponentLoader.loadComponent(ComponentLoader.java:448)
	at lucee.runtime.listener.ModernAppListener._onRequest(ModernAppListener.java:116)
	at lucee.runtime.listener.ModernAppListener.onRequest(ModernAppListener.java:107)
	at lucee.runtime.PageContextImpl.execute(PageContextImpl.java:2493)
	at lucee.runtime.PageContextImpl._execute(PageContextImpl.java:2478)
	at lucee.runtime.PageContextImpl.executeCFML(PageContextImpl.java:2449)
	at lucee.runtime.engine.Request.exe(Request.java:45)
	at lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1216)
	at lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1162)
	at lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:97)
	at lucee.loader.servlet.CFMLServlet.service(CFMLServlet.java:51)
..."

That file does indeed exist at that location. I am on a fairly vanilla install so not sure what’s going on here. I did perform some of the documented security steps. Like moving the web context folder out from the web root.

Zackster · September 20, 2023, 8:30am

shouldn’t be downloading any bundles, ther are only minor changes between 5.4.3.9 and 5.4.4.2

I’ll try in windows sandbox so see if i can repo

Zackster · September 20, 2023, 8:54am

ah yes, we did actually update the commons-compress lib due a to CVE

which is dynamically downloaded when upgrading via a .lco file, if your server is firewalled, you’ll need to replace the fat jar, rather than using the dynamic upgrade approach

so, do the following

stop the server
download the jar from download.lucee.org
delete or change the file extension for that 5.4.3.2.jar (aka the fat jar, the full distribution, including all jars)
download the lucee.jar and drop it in there https://cdn.lucee.org/lucee-5.4.4.2-SNAPSHOT.jar
5 start the server

I have updated the Deploying Lucee docs page with this information

this is what I saw in the lucee-server\context\logs\deploy.log

"Severity","ThreadID","Date","Time","Application","Message"
"ERROR","Thread-93","09/20/2023","10:43:03","Extension","java.io.IOException: Failed to download the bundle  [org.apache.commons.commons-compress:1.24.0] from [https://update.lucee.org/rest/update/provider/download/org.apache.commons.commons-compress/1.24.0/?serverId=1c3caf05f01220a565c78ead02f95797&serverSecurityKey=f77dfe5c-97ae-4d83-8bc8-8c619f0f6702&allowRedirect=true&jv=11.0.20] and copy to [C:\lucee\tomcat\lucee-server\bundles\org-apache-commons-commons-compress-1-24-0.jar];lucee.runtime.exp.NativeException: java.io.IOException: Failed to download the bundle  [org.apache.commons.commons-compress:1.24.0] from [https://update.lucee.org/rest/update/provider/download/org.apache.commons.commons-compress/1.24.0/?serverId=1c3caf05f01220a565c78ead02f95797&serverSecurityKey=f77dfe5c-97ae-4d83-8bc8-8c619f0f6702&allowRedirect=true&jv=11.0.20] and copy to [C:\lucee\tomcat\lucee-server\bundles\org-apache-commons-commons-compress-1-24-0.jar]
	at lucee.loader.engine.CFMLEngineFactory.initEngine(CFMLEngineFactory.java:397)
	at lucee.loader.engine.CFMLEngineFactory._restart(CFMLEngineFactory.java:617)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at lucee.runtime.config.XMLConfigAdmin.restart(XMLConfigAdmin.java:4087)
	at lucee.runtime.config.XMLConfigAdmin.updateCore(XMLConfigAdmin.java:4733)
	at lucee.runtime.config.DeployHandler.deploy(DeployHandler.java:91)
	at lucee.runtime.engine.Controler.control(Controler.java:223)
	at lucee.runtime.engine.Controler.access$000(Controler.java:58)
	at lucee.runtime.engine.Controler$ControlerThread.run(Controler.java:113)
Caused by: javax.servlet.ServletException: java.io.IOException: Failed to download the bundle  [org.apache.commons.commons-compress:1.24.0] from [https://update.lucee.org/rest/update/provider/download/org.apache.commons.commons-compress/1.24.0/?serverId=1c3caf05f01220a565c78ead02f95797&serverSecurityKey=f77dfe5c-97ae-4d83-8bc8-8c619f0f6702&allowRedirect=true&jv=11.0.20] and copy to [C:\lucee\tomcat\lucee-server\bundles\org-apache-commons-commons-compress-1-24-0.jar]
	... 12 more
Caused by: java.io.IOException: Failed to download the bundle  [org.apache.commons.commons-compress:1.24.0] from [https://update.lucee.org/rest/update/provider/download/org.apache.commons.commons-compress/1.24.0/?serverId=1c3caf05f01220a565c78ead02f95797&serverSecurityKey=f77dfe5c-97ae-4d83-8bc8-8c619f0f6702&allowRedirect=true&jv=11.0.20] and copy to [C:\lucee\tomcat\lucee-server\bundles\org-apache-commons-commons-compress-1-24-0.jar]
	at lucee.loader.engine.CFMLEngineFactory.downloadBundle(CFMLEngineFactory.java:733)
	at lucee.loader.osgi.BundleLoader.loadBundles(BundleLoader.java:129)
	at lucee.loader.engine.CFMLEngineFactory.initEngine(CFMLEngineFactory.java:381)
	... 11 more
Caused by: java.net.UnknownHostException: update.lucee.org
	at java.base/java.net.AbstractPlainSocketImpl.connect(Unknown Source)
	at java.base/java.net.SocksSocketImpl.connect(Unknown Source)
	at java.base/java.net.Socket.connect(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
	at java.base/sun.net.NetworkClient.doConnect(Unknown Source)
	at java.base/sun.net.www.http.HttpClient.openServer(Unknown Source)
	at java.base/sun.net.www.http.HttpClient.openServer(Unknown Source)
	at java.base/sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
	at java.base/sun.net.www.protocol.https.HttpsClient.New(Unknown Source)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
	at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
	at lucee.loader.engine.CFMLEngineFactory.downloadBundle(CFMLEngineFactory.java:727)
	... 13 more
"

Miguel-F · September 20, 2023, 12:24pm

Thank you so much for the detailed information Zac. You are a rockstar! I will use this deployment approach for our updates now since our servers are always firewalled.

FYI for others who may find this post. Zac has added this deployment information to the docs as well. You can find that in the link he posted above.