Java Update Encouraged

[phildunlap]

Hi all!

It's come to our attention that there is a bug in Java that could lead to a deteriorating performance. Users are encouraged to update their Java version to the latest Java 8. Any version of Java 8 prior to 102 is affected! The extent of Java 7 hasn't been resolved, but it does affect Java 7 as well!

Here's a test Java program to see if you wish to see if you're affected. To use, save it into a text file (QueueTest.java), navigate to the folder on a command line, run javac QueueTest.java, then java QueueTest If you are affected, each row of output should take longer to produce. If you are unaffected, lines of output should come pouring out with nearly constant times (CTRL + c to terminate!)

import java.util.concurrent.ConcurrentLinkedQueue;

public class QueueTest {
	public static void main(String[] args)
    {
        ConcurrentLinkedQueue<Object> queue = new ConcurrentLinkedQueue();
        queue.add(new Object()); //Required for the leak to appear.
        Object object = new Object();
 
        int loops = 0;
        long last=System.currentTimeMillis();
        while(true)
        {
            if(loops%10000==0)
            {
                long now = System.currentTimeMillis();
                long duration = now - last;
                last=now;
                System.err.printf("loops=%d duration=%d%n", loops, duration);
            }
            queue.add(object);
            queue.remove(object);
            ++loops;
        }
    }
}

[mihairosu]

On our Ubuntu server install, Oracle version is 1.3.0_121 and is not affected.

On both our MangoES, Oracle version 1.8.0_33 is installed on the MangoES, and they are affected. I assume this is Java 8 build 33.

Apt-get upgrade does not download a new java version. I presume the repositories for java were not built into MangoES or maybe I just don't know what I'm talking about?

If so, is this the correct repo?

sudo add-apt-repository ppa:webupd8team/java

Do I need to worry any manual configuration necessary when upgrading the java version?

[phildunlap]

Hi Mihai,

I think the simplest way to update an ES is to download the lastest 32 bit ARM Java 8 SE from Oracle (121 as of this writing), copy it onto your MangoES and move it to /usr/lib/jvm/, then

tar -xvzf jdk-*.tar.gz
cp -rf jdk1.8.0_121/* java-8-oracle/
rm -r jdk1.8.0_121
rm jdk-*.tar.gz
#Edit: On newer ES units, you need to give the new java executable permissions to the ports below 1024, like,
setcap 'cap_net_bind_service=+ep' java-8-oracle/bin/java #sudo or root
setcap 'cap_net_bind_service=+ep' java-8-oracle/jre/bin/java #sudo or root

apt-get is handy, but this will work for almost any ES. For older ES's the JDK may be installed in /opt/jdk and never under the management of apt. In that situation, one could do almost the same thing, only cp -rf into the old JDK's directory instead of java-8-oracle/

I was able to apt-get install oracle-java8-installer on an ES, these seem to be the pertinent entries in /etc/apt/sources.list (but I personally may still do it manually so that I don't have to believe its dependency list)

deb http://ppa.launchpad.net/webupd8team/java/ubuntu trusty main
deb-src http://ppa.launchpad.net/webupd8team/java/ubuntu trusty main

Edit: To worrying about manual configuration, that's why I take the lazy man's route of overwriting the files in the existing JDK. All of the installation type steps are just making symlinks to this or package management. If you use apt it will handle all that for you. If you overwrite the old Java it'll already be set up. But, if you install Java into a different directory, you'll have to do some update-alternatives commands to get /etc/alternatives/java (and javac, javaws) to point to the right file.

[mihairosu]

I was able to successfully manually upgrade java with your instructions, and the Queue test performed well on the MangoES now.

Thank you.

[andrewh]

I have upgraded to oracle jdk-13 using this method, but then Mango fails to start.
I first upgraded a fairly new mangoES to the newest mango (3.7.2).
I unzipped the file, then renamed folders so all the new files are now in /usr/lib/jvm/java-8-oracle/
I updated the owner of all the subfolders and files in them to 'root' as they were previously. There is only one file directly under java-8oracle: 'release' - it's owner is '10668'.
When I attempt to start the mango app, nothing is logged in 'ma.log' and the start script gets stuck in a loop running start and restart extensions:

Mon Dec 30 08:55:45 AWST 2019 ma-start: running restart extentions
Mon Dec 30 08:55:45 AWST 2019 ma-start: running start extensions...
Mon Dec 30 08:55:45 AWST 2019 ma-start: starting MA
Mon Dec 30 08:55:45 AWST 2019 ma-start: MA started with Process ID 4471
Mon Dec 30 08:55:45 AWST 2019 ma-start: running restart extentions
Mon Dec 30 08:55:45 AWST 2019 ma-start: running start extensions...
Mon Dec 30 08:55:45 AWST 2019 ma-start: starting MA
Mon Dec 30 08:55:45 AWST 2019 ma-start: MA started with Process ID 4483
Mon Dec 30 08:55:45 AWST 2019 ma-start: running restart extentions
Mon Dec 30 08:55:45 AWST 2019 ma-start: running start extensions...
Mon Dec 30 08:55:45 AWST 2019 ma-start: starting MA
Mon Dec 30 08:55:45 AWST 2019 ma-start: MA started with Process ID 4495
Mon Dec 30 08:55:45 AWST 2019 ma-start: running restart extentions
Mon Dec 30 08:55:45 AWST 2019 ma-start: running start extensions...

Can anyone please suggest any potential remediation?

[Jared Wiltshire]

@andrewh said in Java Update Encouraged:

Can anyone please suggest any potential remediation?

I think the problem might be that the setcap commands do not work with newer versions of Java. I suggest you downgrade to Java 8 if you want to run Mango on port 80/443 without running it as root.

The alternative is to run Mango on ports above 1000 and use iptables to redirect port 80/443 to 8080/8443 -
https://help.infiniteautomation.com/linux-security

[andrewh]

Thanks Jared

We have just received some new MangoGT's. These come with java AdoptOpenJDK v13.0.1 and mango 3.7.
I'm now thinking this is probably the best target software to upgrade to? Is this not the case for MangoES? Terry Packer had recommended this a couple of weeks ago.
In any case, are you please able to provide an upgrade procedure for java? Upgrading mango is very straightforward.

Thanks
Andrew

[Jared Wiltshire]

For Mango it is better to run on a newer version of Java yes. But due to the problem I mentioned above it is difficult to get Mango running on port 80/443. The solution we use on the MangoGT is to use the iptables port redirect.

I will have to see if there's any other way to make Java 9+ able to bind to ports under 1000 without setcap.

[andrewh]

Hi
Have you had any luck with this?
Andrew

[andrewh]

Anyone?

[terrypacker]

@andrewh does this not help:

https://help.infiniteautomation.com/installing-java

and

https://help.infiniteautomation.com/linux-security

[andrewh]

Thanks Terry
Yes, I did find that recently, and it does help.
Andrew