Common task attributes
Attribute	Description	Attribute	Description
url	url	The JMX Connection URL of the remote Tomcat MBeansServer.
username	username	The username of a MBeanServer auth, when configured.
password	password	The password of a MBeanServer auth, when configured.
host	host	The JMX Connection host.
port	port	The JMX Connection port.
ref	ref	The name of the ant internal reference for a jmx connection.

Digester Configuration Properties
Property	Description	Property	Description
classLoader	classLoader	You can optionally specify the class loader that will be used to load classes when required by the `ObjectCreateRule` and `FactoryCreateRule` rules. If not specified, @@ -110,14 +111,14 @@ Digester Configuration Properties used to load the `Digester` class itself.
errorHandler	errorHandler	You can optionally specify a SAX `ErrorHandler` that is notified when parsing errors occur. By default, any parsing errors that are encountered are logged, but Digester will continue processing as well.
namespaceAware	namespaceAware	A boolean that is set to `true` to perform parsing in a manner that is aware of XML namespaces. Among other things, this setting affects how elements are matched to processing rules. See @@ -125,7 +126,7 @@ Digester Configuration Properties information.
ruleNamespaceURI	ruleNamespaceURI	The public URI of the namespace for which all subsequently added rules are associated, or `null` for adding rules that are not associated with any namespace. See @@ -133,7 +134,7 @@ Digester Configuration Properties information.
rules	rules	The `Rules` component that actually performs matching of `Rule` instances against the current element nesting pattern is pluggable. By default, Digester includes a @@ -143,7 +144,7 @@ Digester Configuration Properties more information.
useContextClassLoader +	useContextClassLoader	A boolean that is set to `true` if you want application classes required by `FactoryCreateRule` and `ObjectCreateRule` to be loaded from the context class @@ -154,7 +155,7 @@ Digester Configuration Properties will be used unconditionally.
validating	validating	A boolean that is set to `true` if you wish to validate the XML document against a Document Type Definition (DTD) that is specified in its `DOCTYPE` declaration. The default @@ -268,7 +269,7 @@ Element Matching Patterns pattern is matched whenever an `<a>` top-level element is encountered in the XML document, no matter how many times it occurs. Note that nested `<a>` elements will not match this -pattern -- we will describe means to support this kind of matching later. +pattern -- we will describe means to support this kind of matching later. The next step up in matching pattern complexity is "a/b". This pattern will be matched when a `<b>` element is found nested inside a @@ -448,7 +449,7 @@ Logging Usage Examples - Creating a Simple Object Tree + Creating a Simple Object Tree Let's assume that you have two simple JavaBeans, `Foo` and `Bar`, with the following method signatures: @@ -528,7 +529,7 @@ Creating a Simple Object Tree created for you. - Processing A Struts Configuration File + Processing A Struts Configuration File As stated earlier, the primary reason that the `Digester` package was created is because the @@ -622,7 +623,7 @@ Processing A Struts Configuration File servlet, as well as being exposed as servlet context attributes. - Parsing Body Text In XML Files + Parsing Body Text In XML Files The Digester module also allows you to process the nested body text in an XML file, not just the elements and attributes that are encountered. The @@ -861,7 +862,7 @@ RegexRules digester.setRules(new RegexRules(new SimpleRegexMatcher())); ... - RegexMatchers + RegexMatchers `Digester` ships only with one `RegexMatcher` implementation: SimpleRegexMatcher. @@ -987,7 +988,7 @@ Using Named Stacks For Inter-Rule Communication accessed through calls to: - + void push(String stackName, Object value) Object pop(String stackName) @@ -1063,9 +1064,9 @@ External Entity Resolution Using Digester to be easily associated with `public-identifiers`. For example: - `+ digester.register("-//Example Dot Com //DTD Sample Example//EN", "assets/sample.dtd"); -` + will make digester return the relative file path `assets/sample.dtd` whenever an external entity with public id @@ -1091,7 +1092,7 @@ Debugging Exceptions of the XML cannot be completed. So, to diagnose the cause a certain familiarity with the way that SAX error handling works is very useful. - Diagnosing SAX Exceptions + Diagnosing SAX Exceptions This is a short, potted guide to SAX error handling strategies. It's not intended as a proper guide to error handling in SAX. @@ -1116,16 +1117,15 @@ Diagnosing SAX Exceptions Frequently Asked Questions - + Why do I get warnings when using a JAXP 1.1 parser? - If you're using a JAXP 1.1 parser, you might see the following warning (in your log): - `+If you're using a JAXP 1.1 parser, you might see the following warning (in your log): + [WARN] Digester - -Error: JAXP SAXParser property not recognized: http://java.sun.com/xml/jaxp/properties/schemaLanguage -` + This property is needed for JAXP 1.2 (XML Schema support) as required for the Servlet Spec. 2.4 but is not recognized by JAXP 1.1 parsers. -This warning is harmless. - +This warning is harmless. Why Doesn't Schema Validation Work With Parser XXX Out Of The Box? @@ -1160,7 +1160,7 @@ Frequently Asked Questions Where Can I Find Example Code? - + Digester ships with a sample application: a mapping for the Rich Site Summary format used by many newsfeeds. Download the source distribution to see how it works. diff --git a/src/main/java/org/apache/tomcat/util/file/ConfigFileLoader.java b/core/src/main/java/org/apache/tomcat/util/file/ConfigFileLoader.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/file/ConfigFileLoader.java rename to core/src/main/java/org/apache/tomcat/util/file/ConfigFileLoader.java diff --git a/src/main/java/org/apache/tomcat/util/file/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/file/LocalStrings.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/file/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/util/file/LocalStrings.properties diff --git a/src/main/java/org/apache/tomcat/util/file/Matcher.java b/core/src/main/java/org/apache/tomcat/util/file/Matcher.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/file/Matcher.java rename to core/src/main/java/org/apache/tomcat/util/file/Matcher.java diff --git a/src/main/java/org/apache/tomcat/util/file/package.html b/core/src/main/java/org/apache/tomcat/util/file/package.html similarity index 100% rename from src/main/java/org/apache/tomcat/util/file/package.html rename to core/src/main/java/org/apache/tomcat/util/file/package.html diff --git a/src/main/java/org/apache/tomcat/util/http/CookieProcessor.java b/core/src/main/java/org/apache/tomcat/util/http/CookieProcessor.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/CookieProcessor.java rename to core/src/main/java/org/apache/tomcat/util/http/CookieProcessor.java diff --git a/src/main/java/org/apache/tomcat/util/http/CookieProcessorBase.java b/core/src/main/java/org/apache/tomcat/util/http/CookieProcessorBase.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/CookieProcessorBase.java rename to core/src/main/java/org/apache/tomcat/util/http/CookieProcessorBase.java diff --git a/src/main/java/org/apache/tomcat/util/http/FastHttpDateFormat.java b/core/src/main/java/org/apache/tomcat/util/http/FastHttpDateFormat.java similarity index 99% rename from src/main/java/org/apache/tomcat/util/http/FastHttpDateFormat.java rename to core/src/main/java/org/apache/tomcat/util/http/FastHttpDateFormat.java index f30c04b..1de6eb5 100644 --- a/src/main/java/org/apache/tomcat/util/http/FastHttpDateFormat.java +++ b/core/src/main/java/org/apache/tomcat/util/http/FastHttpDateFormat.java @@ -160,7 +160,7 @@ public static final long parseDate(String value, throw new IllegalArgumentException(); } if (date == null) { - return (-1L); + return -1L; } return date.longValue(); diff --git a/src/main/java/org/apache/tomcat/util/http/LegacyCookieProcessor.java b/core/src/main/java/org/apache/tomcat/util/http/LegacyCookieProcessor.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/LegacyCookieProcessor.java rename to core/src/main/java/org/apache/tomcat/util/http/LegacyCookieProcessor.java diff --git a/src/main/java/org/apache/tomcat/util/http/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/http/LocalStrings.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/util/http/LocalStrings.properties diff --git a/src/main/java/org/apache/tomcat/util/http/MimeHeaders.java b/core/src/main/java/org/apache/tomcat/util/http/MimeHeaders.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/MimeHeaders.java rename to core/src/main/java/org/apache/tomcat/util/http/MimeHeaders.java diff --git a/src/main/java/org/apache/tomcat/util/http/Parameters.java b/core/src/main/java/org/apache/tomcat/util/http/Parameters.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/Parameters.java rename to core/src/main/java/org/apache/tomcat/util/http/Parameters.java diff --git a/src/main/java/org/apache/tomcat/util/http/RequestUtil.java b/core/src/main/java/org/apache/tomcat/util/http/RequestUtil.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/RequestUtil.java rename to core/src/main/java/org/apache/tomcat/util/http/RequestUtil.java diff --git a/src/main/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java b/core/src/main/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java rename to core/src/main/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java diff --git a/src/main/java/org/apache/tomcat/util/http/ServerCookie.java b/core/src/main/java/org/apache/tomcat/util/http/ServerCookie.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/ServerCookie.java rename to core/src/main/java/org/apache/tomcat/util/http/ServerCookie.java diff --git a/src/main/java/org/apache/tomcat/util/http/ServerCookies.java b/core/src/main/java/org/apache/tomcat/util/http/ServerCookies.java similarity index 97% rename from src/main/java/org/apache/tomcat/util/http/ServerCookies.java rename to core/src/main/java/org/apache/tomcat/util/http/ServerCookies.java index 401cffb..93c9e69 100644 --- a/src/main/java/org/apache/tomcat/util/http/ServerCookies.java +++ b/core/src/main/java/org/apache/tomcat/util/http/ServerCookies.java @@ -49,7 +49,7 @@ public ServerCookie addCookie() { } if (cookieCount >= serverCookies.length) { - int newSize = Math.min(2cookieCount, limit); + int newSize = limit > -1 ? Math.min(2cookieCount, limit) : 2cookieCount; ServerCookie scookiesTmp[] = new ServerCookie[newSize]; System.arraycopy(serverCookies, 0, scookiesTmp, 0, cookieCount); serverCookies = scookiesTmp; diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/ByteArrayOutputStream.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/ByteArrayOutputStream.java similarity index 85% rename from src/main/java/org/apache/tomcat/util/http/fileupload/ByteArrayOutputStream.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/ByteArrayOutputStream.java index c2ac9a4..5cc26df 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/ByteArrayOutputStream.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/ByteArrayOutputStream.java @@ -30,9 +30,9 @@ The data can be retrieved using `toByteArray()` and * `toString()`. * - * Closing a `ByteArrayOutputStream` has no effect. The methods in + * Closing a {@code ByteArrayOutputStream} has no effect. The methods in * this class can be called after the stream has been closed without - * generating an `IOException`. + * generating an {@code IOException}. * * This is an alternative implementation of the {@link java.io.ByteArrayOutputStream} * class. The original implementation only allocates 32 bytes at the beginning. @@ -45,6 +45,8 @@ / public class ByteArrayOutputStream extends OutputStream { + static final int DEFAULT_SIZE = 1024; + /* A singleton empty byte array. / private static final byte[] EMPTY_BYTE_ARRAY = new byte[0]; @@ -64,7 +66,7 @@ public class ByteArrayOutputStream extends OutputStream { initially 1024 bytes, though its size increases if necessary. / public ByteArrayOutputStream() { - this(1024); + this(DEFAULT_SIZE); } /* @@ -74,7 +76,7 @@ public ByteArrayOutputStream() { * @param size the initial size * @throws IllegalArgumentException if size is negative / - public ByteArrayOutputStream(int size) { + public ByteArrayOutputStream(final int size) { if (size < 0) { throw new IllegalArgumentException( "Negative initial size: " + size); @@ -90,7 +92,7 @@ public ByteArrayOutputStream(int size) { * @param newcount the size of the buffer if one is created / - private void needNewBuffer(int newcount) { + private void needNewBuffer(final int newcount) { if (currentBufferIndex < buffers.size() - 1) { //Recycling old buffer filledBufferSum += currentBuffer.length; @@ -123,7 +125,7 @@ private void needNewBuffer(int newcount) { @param len The number of bytes to write / @Override - public void write(byte[] b, int off, int len) { + public void write(final byte[] b, final int off, final int len) { if ((off < 0) \|\| (off > b.length) \|\| (len < 0) @@ -134,11 +136,11 @@ public void write(byte[] b, int off, int len) { return; } synchronized (this) { - int newcount = count + len; + final int newcount = count + len; int remaining = len; int inBufferPos = count - filledBufferSum; while (remaining > 0) { - int part = Math.min(remaining, currentBuffer.length - inBufferPos); + final int part = Math.min(remaining, currentBuffer.length - inBufferPos); System.arraycopy(b, off + len - remaining, currentBuffer, inBufferPos, part); remaining -= part; if (remaining > 0) { @@ -155,7 +157,7 @@ public void write(byte[] b, int off, int len) { @param b the byte to write / @Override - public synchronized void write(int b) { + public synchronized void write(final int b) { int inBufferPos = count - filledBufferSum; if (inBufferPos == currentBuffer.length) { needNewBuffer(count + 1); @@ -176,7 +178,7 @@ public synchronized void write(int b) { @throws IOException if an I/O error occurs while reading the input stream * @since 1.4 / - public synchronized int write(InputStream in) throws IOException { + public synchronized int write(final InputStream in) throws IOException { int readCount = 0; int inBufferPos = count - filledBufferSum; int n = in.read(currentBuffer, inBufferPos, currentBuffer.length - inBufferPos); @@ -194,12 +196,12 @@ public synchronized int write(InputStream in) throws IOException { } /* - * Closing a `ByteArrayOutputStream` has no effect. The methods in + * Closing a {@code ByteArrayOutputStream} has no effect. The methods in * this class can be called after the stream has been closed without - * generating an `IOException`. + * generating an {@code IOException}. * * @throws IOException never (this method should not declare this exception - * but it has to now due to backwards compatability) + * but it has to now due to backwards compatibility) / @Override public void close() throws IOException { @@ -214,10 +216,10 @@ public void close() throws IOException { @throws IOException if an I/O error occurs, such as if the stream is closed * @see java.io.ByteArrayOutputStream#writeTo(OutputStream) / - public synchronized void writeTo(OutputStream out) throws IOException { + public synchronized void writeTo(final OutputStream out) throws IOException { int remaining = count; - for (byte[] buf : buffers) { - int c = Math.min(buf.length, remaining); + for (final byte[] buf : buffers) { + final int c = Math.min(buf.length, remaining); out.write(buf, 0, c); remaining -= c; if (remaining == 0) { @@ -227,7 +229,7 @@ public synchronized void writeTo(OutputStream out) throws IOException { } /* - * Gets the curent contents of this byte stream as a byte array. + * Gets the current contents of this byte stream as a byte array. * The result is independent of this stream. * * @return the current contents of this output stream, as a byte array @@ -238,10 +240,10 @@ public synchronized byte[] toByteArray() { if (remaining == 0) { return EMPTY_BYTE_ARRAY; } - byte newbuf[] = new byte[remaining]; + final byte newbuf[] = new byte[remaining]; int pos = 0; - for (byte[] buf : buffers) { - int c = Math.min(buf.length, remaining); + for (final byte[] buf : buffers) { + final int c = Math.min(buf.length, remaining); System.arraycopy(buf, 0, newbuf, pos, c); pos += c; remaining -= c; @@ -251,14 +253,4 @@ public synchronized byte[] toByteArray() { } return newbuf; } - - /** - * Gets the curent contents of this byte stream as a string. - * @return the contents of the byte array as a String - * @see java.io.ByteArrayOutputStream#toString() - / - @Override - public String toString() { - return new String(toByteArray()); - } } diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/DeferredFileOutputStream.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/DeferredFileOutputStream.java similarity index 85% rename from src/main/java/org/apache/tomcat/util/http/fileupload/DeferredFileOutputStream.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/DeferredFileOutputStream.java index 8a936e7..86a4995 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/DeferredFileOutputStream.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/DeferredFileOutputStream.java @@ -36,12 +36,11 @@ public class DeferredFileOutputStream extends ThresholdingOutputStream { - // ----------------------------------------------------------- Data members /* - * The output stream to which data will be written prior to the theshold + * The output stream to which data will be written prior to the threshold * being reached. / private ByteArrayOutputStream memoryOutputStream; @@ -81,13 +80,14 @@ public class DeferredFileOutputStream /* * Constructs an instance of this class which will trigger an event at the * specified threshold, and save data to a file beyond that point. + * The initial buffer size will default to 1024 bytes which is ByteArrayOutputStream's default buffer size. * * @param threshold The number of bytes at which to trigger an event. * @param outputFile The file to which data is saved beyond the threshold. / - public DeferredFileOutputStream(int threshold, File outputFile) + public DeferredFileOutputStream(final int threshold, final File outputFile) { - this(threshold, outputFile, null, null, null); + this(threshold, outputFile, null, null, null, ByteArrayOutputStream.DEFAULT_SIZE); } @@ -100,16 +100,18 @@ public DeferredFileOutputStream(int threshold, File outputFile) @param prefix Prefix to use for the temporary file. * @param suffix Suffix to use for the temporary file. * @param directory Temporary file directory. + * @param initialBufferSize The initial size of the in memory buffer. / - private DeferredFileOutputStream(int threshold, File outputFile, String prefix, String suffix, File directory) { + private DeferredFileOutputStream(final int threshold, final File outputFile, final String prefix, + final String suffix, final File directory, final int initialBufferSize) { super(threshold); this.outputFile = outputFile; - - memoryOutputStream = new ByteArrayOutputStream(); - currentOutputStream = memoryOutputStream; this.prefix = prefix; this.suffix = suffix; this.directory = directory; + + memoryOutputStream = new ByteArrayOutputStream(initialBufferSize); + currentOutputStream = memoryOutputStream; } @@ -122,7 +124,7 @@ private DeferredFileOutputStream(int threshold, File outputFile, String prefix, * @return The underlying output stream. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / @Override protected OutputStream getStream() throws IOException @@ -137,7 +139,7 @@ protected OutputStream getStream() throws IOException much data is being written to keep in memory, so we elect to switch to * disk-based storage. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / @Override protected void thresholdReached() throws IOException @@ -145,8 +147,14 @@ protected void thresholdReached() throws IOException if (prefix != null) { outputFile = File.createTempFile(prefix, suffix, directory); } - FileOutputStream fos = new FileOutputStream(outputFile); - memoryOutputStream.writeTo(fos); + FileUtils.forceMkdirParent(outputFile); + final FileOutputStream fos = new FileOutputStream(outputFile); + try { + memoryOutputStream.writeTo(fos); + } catch (final IOException e){ + fos.close(); + throw e; + } currentOutputStream = fos; memoryOutputStream = null; } @@ -209,7 +217,7 @@ public File getFile() /* * Closes underlying output stream, and mark this as closed * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / @Override public void close() throws IOException diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileItem.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItem.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileItem.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItem.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemFactory.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemFactory.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileItemFactory.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemFactory.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemHeaders.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemHeaders.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileItemHeaders.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemHeaders.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemHeadersSupport.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemHeadersSupport.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileItemHeadersSupport.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemHeadersSupport.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemIterator.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemIterator.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileItemIterator.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemIterator.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemStream.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemStream.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileItemStream.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileItemStream.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileUpload.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUpload.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileUpload.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUpload.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadBase.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadBase.java similarity index 99% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadBase.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadBase.java index 3800034..eb5a487 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadBase.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadBase.java @@ -584,11 +584,6 @@ class FileItemStreamImpl implements FileItemStream { / private final InputStream stream; - /** - * Whether the file item was already opened. - / - private boolean opened; - /* * The headers, if any. / @@ -698,10 +693,6 @@ public boolean isFormField() { / @Override public InputStream openStream() throws IOException { - if (opened) { - throw new IllegalStateException( - "The stream was already opened."); - } if (((Closeable) stream).isClosed()) { throw new FileItemStream.ItemSkippedException(); } diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadException.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadException.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadException.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUploadException.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/FileUtils.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUtils.java similarity index 61% rename from src/main/java/org/apache/tomcat/util/http/fileupload/FileUtils.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUtils.java index c1102a5..53e0489 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/FileUtils.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/FileUtils.java @@ -38,6 +38,10 @@ * calculating a checksum * * + * Note that a specific charset should be specified whenever possible. + * Relying on the platform default means that the code is Locale-dependent. + * Only use the default if the files are known to always use the platform default. + * * Origin of code: Excalibur, Alexandria, Commons-Utils / public class FileUtils { @@ -53,10 +57,11 @@ public FileUtils() { /* * Deletes a directory recursively. * - * @param directory directory to delete - * @throws IOException in case deletion is unsuccessful + * @param directory directory to delete + * @throws IOException in case deletion is unsuccessful + * @throws IllegalArgumentException if {@code directory} does not exist or is not a directory / - public static void deleteDirectory(File directory) throws IOException { + public static void deleteDirectory(final File directory) throws IOException { if (!directory.exists()) { return; } @@ -66,8 +71,8 @@ public static void deleteDirectory(File directory) throws IOException { } if (!directory.delete()) { - String message = - "Unable to delete directory " + directory + "."; + final String message = + "Unable to delete directory " + directory + "."; throw new IOException(message); } } @@ -76,20 +81,21 @@ public static void deleteDirectory(File directory) throws IOException { Cleans a directory without deleting it. * * @param directory directory to clean - * @throws IOException in case cleaning is unsuccessful + * @throws IOException in case cleaning is unsuccessful + * @throws IllegalArgumentException if {@code directory} does not exist or is not a directory / - public static void cleanDirectory(File directory) throws IOException { + public static void cleanDirectory(final File directory) throws IOException { if (!directory.exists()) { - String message = directory + " does not exist"; + final String message = directory + " does not exist"; throw new IllegalArgumentException(message); } if (!directory.isDirectory()) { - String message = directory + " is not a directory"; + final String message = directory + " is not a directory"; throw new IllegalArgumentException(message); } - File[] files = directory.listFiles(); + final File[] files = directory.listFiles(); if (files == null) { // null if security restricted throw new IOException("Failed to list contents of " + directory); } @@ -116,25 +122,25 @@ public static void cleanDirectory(File directory) throws IOException { * A directory to be deleted does not have to be empty. * You get exceptions when a file or directory cannot be deleted. - * (java.io.File methods returns a boolean) + * (java.io.File methods returns a boolean) * * - * @param file file or directory to delete, must not be {@code null} - * @throws NullPointerException if the directory is {@code null} + * @param file file or directory to delete, must not be {@code null} + * @throws NullPointerException if the directory is {@code null} * @throws FileNotFoundException if the file was not found - * @throws IOException in case deletion is unsuccessful + * @throws IOException in case deletion is unsuccessful / - public static void forceDelete(File file) throws IOException { + public static void forceDelete(final File file) throws IOException { if (file.isDirectory()) { deleteDirectory(file); } else { - boolean filePresent = file.exists(); + final boolean filePresent = file.exists(); if (!file.delete()) { - if (!filePresent){ + if (!filePresent) { throw new FileNotFoundException("File does not exist: " + file); } - String message = - "Unable to delete file: " + file; + final String message = + "Unable to delete file: " + file; throw new IOException(message); } } @@ -144,11 +150,11 @@ public static void forceDelete(File file) throws IOException { Schedules a file to be deleted when JVM exits. * If file is directory delete it and all sub-directories. * - * @param file file or directory to delete, must not be {@code null} + * @param file file or directory to delete, must not be {@code null} * @throws NullPointerException if the file is {@code null} - * @throws IOException in case deletion is unsuccessful + * @throws IOException in case deletion is unsuccessful / - public static void forceDeleteOnExit(File file) throws IOException { + public static void forceDeleteOnExit(final File file) throws IOException { if (file.isDirectory()) { deleteDirectoryOnExit(file); } else { @@ -159,11 +165,11 @@ public static void forceDeleteOnExit(File file) throws IOException { /* * Schedules a directory recursively for deletion on JVM exit. * - * @param directory directory to delete, must not be {@code null} + * @param directory directory to delete, must not be {@code null} * @throws NullPointerException if the directory is {@code null} - * @throws IOException in case deletion is unsuccessful + * @throws IOException in case deletion is unsuccessful / - private static void deleteDirectoryOnExit(File directory) throws IOException { + private static void deleteDirectoryOnExit(final File directory) throws IOException { if (!directory.exists()) { return; } @@ -177,11 +183,11 @@ private static void deleteDirectoryOnExit(File directory) throws IOException { /* * Cleans a directory without deleting it. * - * @param directory directory to clean, must not be {@code null} + * @param directory directory to clean, must not be {@code null} * @throws NullPointerException if the directory is {@code null} - * @throws IOException in case cleaning is unsuccessful + * @throws IOException in case cleaning is unsuccessful / - private static void cleanDirectoryOnExit(File directory) throws IOException { + private static void cleanDirectoryOnExit(final File directory) throws IOException { if (!directory.exists()) { String message = directory + " does not exist"; throw new IllegalArgumentException(message); @@ -211,6 +217,57 @@ private static void cleanDirectoryOnExit(File directory) throws IOException { } } + /* + * Makes a directory, including any necessary but nonexistent parent + * directories. If a file already exists with specified name but it is + * not a directory then an IOException is thrown. + * If the directory cannot be created (or does not already exist) + * then an IOException is thrown. + * + * @param directory directory to create, must not be {@code null} + * @throws NullPointerException if the directory is {@code null} + * @throws IOException if the directory cannot be created or the file already exists but is not a directory + / + public static void forceMkdir(final File directory) throws IOException { + if (directory.exists()) { + if (!directory.isDirectory()) { + final String message = + "File " + + directory + + " exists and is " + + "not a directory. Unable to create directory."; + throw new IOException(message); + } + } else { + if (!directory.mkdirs()) { + // Double-check that some other thread or process hasn't made + // the directory in the background + if (!directory.isDirectory()) { + final String message = + "Unable to create directory " + directory; + throw new IOException(message); + } + } + } + } + + /* + * Makes any necessary but nonexistent parent directories for a given File. If the parent directory cannot be + * created then an IOException is thrown. + * + * @param file file with parent to create, must not be {@code null} + * @throws NullPointerException if the file is {@code null} + * @throws IOException if the parent directory cannot be created + * @since 2.5 + / + public static void forceMkdirParent(final File file) throws IOException { + final File parent = file.getParentFile(); + if (parent == null) { + return; + } + forceMkdir(parent); + } + /* * Determines whether the specified file is a Symbolic Link rather than an actual file. diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/IOUtils.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/IOUtils.java similarity index 85% rename from src/main/java/org/apache/tomcat/util/http/fileupload/IOUtils.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/IOUtils.java index b3943d6..e2eb2c3 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/IOUtils.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/IOUtils.java @@ -54,7 +54,7 @@ * Origin of code: Excalibur. / public class IOUtils { - // NOTE: This class is focussed on InputStream, OutputStream, Reader and + // NOTE: This class is focused on InputStream, OutputStream, Reader and // Writer. Each method should take at least one of these as a parameter, // or return one of them. @@ -82,7 +82,7 @@ public IOUtils() { finally blocks. * * Example code: - * + * * * Closeable closeable = null; * try { @@ -95,9 +95,9 @@ public IOUtils() { * IOUtils.closeQuietly(closeable); * } * - * + * * Closing all streams: - * + * * * try { * return IOUtils.copy(inputStream, outputStream); @@ -107,8 +107,7 @@ public IOUtils() { * } * * - * @param closeable - * the objects to close, may be null or already closed + * @param closeable the objects to close, may be null or already closed * @since 2.0 / public static void closeQuietly(final Closeable closeable) { @@ -124,7 +123,7 @@ public static void closeQuietly(final Closeable closeable) { // copy from InputStream //----------------------------------------------------------------------- /* - * Copy bytes from an `InputStream` to an + * Copies bytes from an `InputStream` to an * `OutputStream`. * * This method buffers the input internally, so there is no need to use a @@ -135,15 +134,15 @@ public static void closeQuietly(final Closeable closeable) { * number of bytes cannot be returned as an int. For large streams * use the `copyLarge(InputStream, OutputStream)` method. * - * @param input the `InputStream` to read from - * @param output the `OutputStream` to write to + * @param input the `InputStream` to read from + * @param output the `OutputStream` to write to * @return the number of bytes copied, or -1 if > Integer.MAX_VALUE * @throws NullPointerException if the input or output is null - * @throws IOException if an I/O error occurs + * @throws IOException if an I/O error occurs * @since 1.1 / - public static int copy(InputStream input, OutputStream output) throws IOException { - long count = copyLarge(input, output); + public static int copy(final InputStream input, final OutputStream output) throws IOException { + final long count = copyLarge(input, output); if (count > Integer.MAX_VALUE) { return -1; } @@ -151,7 +150,7 @@ public static int copy(InputStream input, OutputStream output) throws IOExceptio } /* - * Copy bytes from a large (over 2GB) `InputStream` to an + * Copies bytes from a large (over 2GB) `InputStream` to an * `OutputStream`. * * This method buffers the input internally, so there is no need to use a @@ -159,14 +158,14 @@ public static int copy(InputStream input, OutputStream output) throws IOExceptio * * The buffer size is given by {@link #DEFAULT_BUFFER_SIZE}. * - * @param input the `InputStream` to read from - * @param output the `OutputStream` to write to + * @param input the `InputStream` to read from + * @param output the `OutputStream` to write to * @return the number of bytes copied * @throws NullPointerException if the input or output is null - * @throws IOException if an I/O error occurs + * @throws IOException if an I/O error occurs * @since 1.3 / - public static long copyLarge(InputStream input, OutputStream output) + public static long copyLarge(final InputStream input, final OutputStream output) throws IOException { byte[] buffer = new byte[DEFAULT_BUFFER_SIZE]; @@ -193,7 +192,8 @@ public static long copyLarge(InputStream input, OutputStream output) @throws IOException if a read error occurs * @since 2.2 / - public static int read(final InputStream input, final byte[] buffer, final int offset, final int length) throws IOException { + public static int read(final InputStream input, final byte[] buffer, final int offset, final int length) + throws IOException { if (length < 0) { throw new IllegalArgumentException("Length must not be negative: " + length); } @@ -220,12 +220,13 @@ public static int read(final InputStream input, final byte[] buffer, final int o @param offset initial offset into buffer * @param length length to read, must be >= 0 * - * @throws IOException if there is a problem reading the file + * @throws IOException if there is a problem reading the file * @throws IllegalArgumentException if length is negative - * @throws EOFException if the number of bytes read was incorrect + * @throws EOFException if the number of bytes read was incorrect * @since 2.2 / - public static void readFully(final InputStream input, final byte[] buffer, final int offset, final int length) throws IOException { + public static void readFully(final InputStream input, final byte[] buffer, final int offset, final int length) + throws IOException { final int actual = read(input, buffer, offset, length); if (actual != length) { throw new EOFException("Length to read: " + length + " actual: " + actual); @@ -241,9 +242,9 @@ public static void readFully(final InputStream input, final byte[] buffer, final @param input where to read input from * @param buffer destination * - * @throws IOException if there is a problem reading the file + * @throws IOException if there is a problem reading the file * @throws IllegalArgumentException if length is negative - * @throws EOFException if the number of bytes read was incorrect + * @throws EOFException if the number of bytes read was incorrect * @since 2.2 / public static void readFully(final InputStream input, final byte[] buffer) throws IOException { diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/InvalidFileNameException.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/InvalidFileNameException.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/InvalidFileNameException.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/InvalidFileNameException.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/MultipartStream.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/MultipartStream.java similarity index 99% rename from src/main/java/org/apache/tomcat/util/http/fileupload/MultipartStream.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/MultipartStream.java index 19ad36d..fd35346 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/MultipartStream.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/MultipartStream.java @@ -87,6 +87,7 @@ public class MultipartStream { {@link ProgressListener}. / public static class ProgressNotifier { + /* * The listener to invoke. / @@ -226,7 +227,7 @@ private void notifyListener() { private final byte[] boundary; /* - * The table for Knuth-Morris-Pratt search algorithm + * The table for Knuth-Morris-Pratt search algorithm. / private int[] boundaryTable; @@ -302,7 +303,7 @@ public MultipartStream(InputStream input, } this.input = input; - this.bufSize = Math.max(bufSize, boundaryLength2); + this.bufSize = Math.max(bufSize, boundaryLength * 2); this.buffer = new byte[this.bufSize]; this.notifier = pNotifier; @@ -732,7 +733,6 @@ public MalformedStreamException(String message) { / public static class IllegalBoundaryException extends IOException { - /* * The UID to use when serializing this instance. / diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/ParameterParser.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/ParameterParser.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/ParameterParser.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/ParameterParser.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/ProgressListener.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/ProgressListener.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/ProgressListener.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/ProgressListener.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/RequestContext.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/RequestContext.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/RequestContext.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/RequestContext.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/ThresholdingOutputStream.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/ThresholdingOutputStream.java similarity index 88% rename from src/main/java/org/apache/tomcat/util/http/fileupload/ThresholdingOutputStream.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/ThresholdingOutputStream.java index e8d8e8e..8f1fcaf 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/ThresholdingOutputStream.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/ThresholdingOutputStream.java @@ -68,7 +68,7 @@ public abstract class ThresholdingOutputStream * @param threshold The number of bytes at which to trigger an event. / - public ThresholdingOutputStream(int threshold) + public ThresholdingOutputStream(final int threshold) { this.threshold = threshold; } @@ -82,10 +82,10 @@ public ThresholdingOutputStream(int threshold) * @param b The byte to be written. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / @Override - public void write(int b) throws IOException + public void write(final int b) throws IOException { checkThreshold(1); getStream().write(b); @@ -99,10 +99,10 @@ public void write(int b) throws IOException * @param b The array of bytes to be written. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / @Override - public void write(byte b[]) throws IOException + public void write(final byte b[]) throws IOException { checkThreshold(b.length); getStream().write(b); @@ -118,10 +118,10 @@ public void write(byte b[]) throws IOException @param off The start offset in the byte array. * @param len The number of bytes to write. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / @Override - public void write(byte b[], int off, int len) throws IOException + public void write(final byte b[], final int off, final int len) throws IOException { checkThreshold(len); getStream().write(b, off, len); @@ -133,7 +133,7 @@ public void write(byte b[], int off, int len) throws IOException Flushes this output stream and forces any buffered output bytes to be * written out. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / @Override public void flush() throws IOException @@ -146,7 +146,7 @@ public void flush() throws IOException Closes this output stream and releases any system resources associated * with this stream. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / @Override public void close() throws IOException @@ -155,7 +155,7 @@ public void close() throws IOException { flush(); } - catch (IOException ignored) + catch (final IOException ignored) { // ignore } @@ -190,9 +190,9 @@ public boolean isThresholdExceeded() @param count The number of bytes about to be written to the underlying * output stream. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / - protected void checkThreshold(int count) throws IOException + protected void checkThreshold(final int count) throws IOException { if (!thresholdExceeded && written + count > threshold) { @@ -210,7 +210,7 @@ protected void checkThreshold(int count) throws IOException * @return The underlying output stream. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / protected abstract OutputStream getStream() throws IOException; @@ -220,7 +220,7 @@ protected void checkThreshold(int count) throws IOException subclass should take whatever action necessary on this event. This may * include changing the underlying output stream. * - * @exception IOException if an error occurs. + * @throws IOException if an error occurs. / protected abstract void thresholdReached() throws IOException; } diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/UploadContext.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/UploadContext.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/UploadContext.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/UploadContext.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java similarity index 96% rename from src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java index b684b13..87f8a8c 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java @@ -140,6 +140,12 @@ public class DiskFileItem / private FileItemHeaders headers; + /** + * Default content charset to be used when no explicit charset + * parameter is provided by the sender. + / + private String defaultCharset = DEFAULT_CHARSET; + // ----------------------------------------------------------- Constructors /* @@ -335,7 +341,7 @@ public String getString() { byte[] rawdata = get(); String charset = getCharSet(); if (charset == null) { - charset = DEFAULT_CHARSET; + charset = defaultCharset; } try { return new String(rawdata, charset); @@ -422,7 +428,7 @@ public void write(File file) throws Exception { public void delete() { cachedContent = null; File outputFile = getStoreLocation(); - if (outputFile != null && outputFile.exists()) { + if (outputFile != null && !isInMemory() && outputFile.exists()) { outputFile.delete(); } } @@ -535,7 +541,7 @@ public File getStoreLocation() { / @Override protected void finalize() { - if (dfos == null) { + if (dfos == null \|\| dfos.isInMemory()) { return; } File outputFile = dfos.getFile(); @@ -622,4 +628,21 @@ public void setHeaders(FileItemHeaders pHeaders) { headers = pHeaders; } + /* + * Returns the default charset for use when no explicit charset + * parameter is provided by the sender. + * @return the default charset + / + public String getDefaultCharset() { + return defaultCharset; + } + + /* + * Sets the default charset for use when no explicit charset + * parameter is provided by the sender. + * @param charset the default charset + / + public void setDefaultCharset(String charset) { + defaultCharset = charset; + } } diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItemFactory.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItemFactory.java similarity index 88% rename from src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItemFactory.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItemFactory.java index 4d2a3ce..f5a273d 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItemFactory.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItemFactory.java @@ -77,6 +77,12 @@ public class DiskFileItemFactory implements FileItemFactory { / private int sizeThreshold = DEFAULT_SIZE_THRESHOLD; + /** + * Default content charset to be used when no explicit charset + * parameter is provided by the sender. + / + private String defaultCharset = DiskFileItem.DEFAULT_CHARSET; + // ----------------------------------------------------------- Constructors /* @@ -173,7 +179,27 @@ public void setSizeThreshold(int sizeThreshold) { @Override public FileItem createItem(String fieldName, String contentType, boolean isFormField, String fileName) { - return new DiskFileItem(fieldName, contentType, + DiskFileItem result = new DiskFileItem(fieldName, contentType, isFormField, fileName, sizeThreshold, repository); + result.setDefaultCharset(defaultCharset); + return result; + } + + /** + * Returns the default charset for use when no explicit charset + * parameter is provided by the sender. + * @return the default charset + / + public String getDefaultCharset() { + return defaultCharset; + } + + /* + * Sets the default charset for use when no explicit charset + * parameter is provided by the sender. + * @param pCharset the default charset + / + public void setDefaultCharset(String pCharset) { + defaultCharset = pCharset; } } diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/disk/package-info.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/disk/package-info.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/disk/package-info.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/disk/package-info.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/package-info.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/package-info.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/package-info.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/package-info.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/ServletFileUpload.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/ServletFileUpload.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/servlet/ServletFileUpload.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/ServletFileUpload.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/ServletRequestContext.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/ServletRequestContext.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/servlet/ServletRequestContext.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/ServletRequestContext.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/package-info.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/package-info.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/servlet/package-info.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/servlet/package-info.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/Closeable.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/Closeable.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/Closeable.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/Closeable.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/FileItemHeadersImpl.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/FileItemHeadersImpl.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/FileItemHeadersImpl.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/FileItemHeadersImpl.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/LimitedInputStream.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/LimitedInputStream.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/LimitedInputStream.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/LimitedInputStream.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/Streams.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/Streams.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/Streams.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/Streams.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/MimeUtility.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/MimeUtility.java similarity index 99% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/MimeUtility.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/MimeUtility.java index 7e45525..b5b4cdd 100644 --- a/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/MimeUtility.java +++ b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/MimeUtility.java @@ -101,7 +101,7 @@ private MimeUtility() { public static String decodeText(String text) throws UnsupportedEncodingException { // if the text contains any encoded tokens, those tokens will be marked with "=?". If the // source string doesn't contain that sequent, no decoding is required. - if (text.indexOf(ENCODED_TOKEN_MARKER) < 0) { + if (!text.contains(ENCODED_TOKEN_MARKER)) { return text; } diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/ParseException.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/ParseException.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/ParseException.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/ParseException.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/QuotedPrintableDecoder.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/QuotedPrintableDecoder.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/QuotedPrintableDecoder.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/QuotedPrintableDecoder.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/package-info.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/package-info.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/package-info.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/mime/package-info.java diff --git a/src/main/java/org/apache/tomcat/util/http/fileupload/util/package-info.java b/core/src/main/java/org/apache/tomcat/util/http/fileupload/util/package-info.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/fileupload/util/package-info.java rename to core/src/main/java/org/apache/tomcat/util/http/fileupload/util/package-info.java diff --git a/src/main/java/org/apache/tomcat/util/http/package.html b/core/src/main/java/org/apache/tomcat/util/http/package.html similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/package.html rename to core/src/main/java/org/apache/tomcat/util/http/package.html diff --git a/src/main/java/org/apache/tomcat/util/http/parser/AcceptLanguage.java b/core/src/main/java/org/apache/tomcat/util/http/parser/AcceptLanguage.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/parser/AcceptLanguage.java rename to core/src/main/java/org/apache/tomcat/util/http/parser/AcceptLanguage.java diff --git a/src/main/java/org/apache/tomcat/util/http/parser/Authorization.java b/core/src/main/java/org/apache/tomcat/util/http/parser/Authorization.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/parser/Authorization.java rename to core/src/main/java/org/apache/tomcat/util/http/parser/Authorization.java diff --git a/src/main/java/org/apache/tomcat/util/http/parser/Cookie.java b/core/src/main/java/org/apache/tomcat/util/http/parser/Cookie.java similarity index 99% rename from src/main/java/org/apache/tomcat/util/http/parser/Cookie.java rename to core/src/main/java/org/apache/tomcat/util/http/parser/Cookie.java index 98d739c..a4331e2 100644 --- a/src/main/java/org/apache/tomcat/util/http/parser/Cookie.java +++ b/core/src/main/java/org/apache/tomcat/util/http/parser/Cookie.java @@ -147,7 +147,6 @@ public static void parseCookie(byte[] bytes, int offset, int len, if (b == SEMICOLON_BYTE \|\| b == COMMA_BYTE) { parseCookieRfc2109(bb, serverCookies, version); } - return; } else { // Unrecognised version. // Ignore this header. diff --git a/src/main/java/org/apache/tomcat/util/http/parser/Host.java b/core/src/main/java/org/apache/tomcat/util/http/parser/Host.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/parser/Host.java rename to core/src/main/java/org/apache/tomcat/util/http/parser/Host.java diff --git a/src/main/java/org/apache/tomcat/util/http/parser/HttpParser.java b/core/src/main/java/org/apache/tomcat/util/http/parser/HttpParser.java similarity index 83% rename from src/main/java/org/apache/tomcat/util/http/parser/HttpParser.java rename to core/src/main/java/org/apache/tomcat/util/http/parser/HttpParser.java index 6baf7e6..10352c5 100644 --- a/src/main/java/org/apache/tomcat/util/http/parser/HttpParser.java +++ b/core/src/main/java/org/apache/tomcat/util/http/parser/HttpParser.java @@ -19,6 +19,8 @@ import java.io.IOException; import java.io.Reader; +import org.apache.tomcat.util.res.StringManager; + /* * HTTP header value parser implementation. Parsing HTTP headers as per RFC2616 * is not always as simple as it first appears. For headers that only use tokens @@ -96,6 +98,9 @@ public class HttpParser { } + private static final StringManager sm = StringManager.getManager(HttpParser.class); + + public static String unquote(String input) { if (input == null \|\| input.length() < 2) { return input; @@ -479,37 +484,38 @@ static double readWeight(Reader input, char delimiter) throws IOException { /** - * @return If inIPv6 us false, the position of ':' that separates the host + * @return If inIPv6 is false, the position of ':' that separates the host * from the port or -1 if it is not present. If inIPv6 is true, the * number of characters read / static int readHostIPv4(Reader reader, boolean inIPv6) throws IOException { - int octect = -1; - int octectCount = 1; + int octet = -1; + int octetCount = 1; int c; int pos = 0; do { c = reader.read(); if (c == '.') { - if (octect > -1 && octect < 256) { + if (octet > -1 && octet < 256) { // Valid - octectCount++; - octect = -1; + octetCount++; + octet = -1; } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException( + sm.getString("http.invalidOctet", Integer.toString(octet))); } } else if (isNumeric(c)) { - if (octect == -1) { - octect = c - '0'; + if (octet == -1) { + octet = c - '0'; } else { - octect = octect 10 + c - '0'; + octet = octet * 10 + c - '0'; } } else if (c == ':') { break; } else if (c == -1) { if (inIPv6) { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.noClosingBracket")); } else { pos = -1; break; @@ -519,19 +525,22 @@ static int readHostIPv4(Reader reader, boolean inIPv6) throws IOException { pos++; break; } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.closingBracket")); } } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString( + "http.illegalCharacterIpv4", Character.toString((char) c))); } pos++; } while (true); - if (octectCount != 4) { - throw new IllegalArgumentException(); + if (octetCount != 4) { + throw new IllegalArgumentException( + sm.getString("http.wrongOctetCount", Integer.toString(octetCount))); } - if (octect < 0 \|\| octect > 255) { - throw new IllegalArgumentException(); + if (octet < 0 \|\| octet > 255) { + throw new IllegalArgumentException( + sm.getString("http.invalidOctet", Integer.toString(octet))); } return pos; @@ -546,7 +555,7 @@ static int readHostIPv6(Reader reader) throws IOException { // Must start with '[' int c = reader.read(); if (c != '[') { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.noOpeningBracket")); } int h16Count = 0; @@ -559,7 +568,7 @@ static int readHostIPv6(Reader reader) throws IOException { c = reader.read(); if (h16Count == 0 && precedingColonsCount == 1 && c != ':') { // Can't start with a single : - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.singleColonStart")); } if (HttpParser.isHex(c)) { if (h16Size == 0) { @@ -569,18 +578,19 @@ static int readHostIPv6(Reader reader) throws IOException { } h16Size++; if (h16Size > 4) { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.invalidHextet")); } } else if (c == ':') { if (precedingColonsCount >=2 ) { // ::: is not allowed - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.tooManyColons")); } else { if(precedingColonsCount == 1) { // End of :: if (parsedDoubleColon ) { // Only allowed one :: sequence - throw new IllegalArgumentException(); + throw new IllegalArgumentException( + sm.getString("http.tooManyDoubleColons")); } parsedDoubleColon = true; // :: represents at least one h16 block @@ -594,7 +604,7 @@ static int readHostIPv6(Reader reader) throws IOException { } else if (c == ']') { if (precedingColonsCount == 1) { // Can't end on a single ':' - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.singleColonEnd")); } pos++; break; @@ -606,18 +616,21 @@ static int readHostIPv6(Reader reader) throws IOException { h16Count++; break; } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.invalidIpv4Location")); } } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString( + "http.illegalCharacterIpv6", Character.toString((char) c))); } pos++; } while (true); if (h16Count > 8) { - throw new IllegalArgumentException(); + throw new IllegalArgumentException( + sm.getString("http.tooManyHextets", Integer.toString(h16Count))); } else if (h16Count != 8 && !parsedDoubleColon) { - throw new IllegalArgumentException(); + throw new IllegalArgumentException( + sm.getString("http.tooFewHextets", Integer.toString(h16Count))); } c = reader.read(); @@ -627,7 +640,8 @@ static int readHostIPv6(Reader reader) throws IOException { if(c == -1) { return -1; } - throw new IllegalArgumentException(); + throw new IllegalArgumentException( + sm.getString("http.illegalAfterIpv6", Character.toString((char) c))); } } @@ -669,14 +683,14 @@ static SkipResult skipUntil(Reader input, int c, char target) throws IOException } - private static enum DomainParseState { - NEW( true, false, false, false, false, false), - ALPHA( true, true, true, true, true, true), - NUMERIC( true, true, true, true, true, true), - PERIOD( true, false, false, false, true, true), - HYPHEN( true, true, true, false, false, false), - COLON( false, false, false, false, false, false), - END( false, false, false, false, false, false); + private enum DomainParseState { + NEW( true, false, false, false, false, false, " at the start of"), + ALPHA( true, true, true, true, true, true, " after a letter in"), + NUMERIC( true, true, true, true, true, true, " after a number in"), + PERIOD( true, false, false, false, true, true, " after a period in"), + HYPHEN( true, true, true, false, false, false, " after a hypen in"), + COLON( false, false, false, false, false, false, " after a colon in"), + END( false, false, false, false, false, false, " at the end of"); private final boolean mayContinue; private final boolean allowsNumeric; @@ -684,15 +698,17 @@ private static enum DomainParseState { private final boolean allowsPeriod; private final boolean allowsColon; private final boolean allowsEnd; + private final String errorLocation; private DomainParseState(boolean mayContinue, boolean allowsNumeric, boolean allowsHyphen, - boolean allowsPeriod, boolean allowsColon, boolean allowsEnd) { + boolean allowsPeriod, boolean allowsColon, boolean allowsEnd, String errorLocation) { this.mayContinue = mayContinue; this.allowsNumeric = allowsNumeric; this.allowsHyphen = allowsHyphen; this.allowsPeriod = allowsPeriod; this.allowsColon = allowsColon; this.allowsEnd = allowsEnd; + this.errorLocation = errorLocation; } public boolean mayContinue() { @@ -706,34 +722,40 @@ public DomainParseState next(int c) { if (allowsNumeric) { return NUMERIC; } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.invalidCharacterDomain", + Character.toString((char) c), errorLocation)); } } else if (c == '.') { if (allowsPeriod) { return PERIOD; } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.invalidCharacterDomain", + Character.toString((char) c), errorLocation)); } } else if (c == ':') { if (allowsColon) { return COLON; } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.invalidCharacterDomain", + Character.toString((char) c), errorLocation)); } } else if (c == -1) { if (allowsEnd) { return END; } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.invalidCharacterDomain", + Character.toString((char) c), errorLocation)); } } else if (c == '-') { if (allowsHyphen) { return HYPHEN; } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString("http.invalidCharacterDomain", + Character.toString((char) c), errorLocation)); } } else { - throw new IllegalArgumentException(); + throw new IllegalArgumentException(sm.getString( + "http.illegalCharacterDomain", Character.toString((char) c))); } } } diff --git a/core/src/main/java/org/apache/tomcat/util/http/parser/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/http/parser/LocalStrings.properties new file mode 100644 index 0000000..a5cdd44 --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/util/http/parser/LocalStrings.properties @@ -0,0 +1,40 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +authorization.unknownType=Unknown Type [{0}] + +cookie.fallToDebug=Note: further occurrences of this error will be logged at DEBUG level. +cookie.invalidCookieValue=A cookie header was received [{0}] that contained an invalid cookie. That cookie will be ignored. +cookie.invalidCookieVersion=A cookie header was received using an unrecognised cookie version of [{0}]. The header and the cookies it contains will be ignored. +cookie.valueNotPresent= + +http.closingBracket=A closing bracket ']' was found in a non-IPv6 host name. +http.illegalAfterIpv6=The character [{0}] is not permitted to follow an IPv6 address in a host name +http.illegalCharacterDomain=The character [{0}] is never valid in a domain name. +http.illegalCharacterIpv4=The character [{0}] is never valid in an IPv4 address. +http.illegalCharacterIpv6=The character [{0}] is never valid in an IPv6 address. +http.invalidCharacterDomain=The character [{0}] is not valid{1} a domain name. +http.invalidHextet=Invalid hextet. A hextet must consist of 4 or less hex characters. +http.invalidIpv4Location=The IPv6 address contains an embedded IPv4 address at an invalid location. +http.invalidOctet=Invalid octet [{0}]. The valid range for IPv4 octets is 0 to 255. +http.noClosingBracket=The IPv6 address is missing a closing bracket. +http.noOpeningBracket=The IPv6 address is missing an opening bracket. +http.singleColonEnd=An IPv6 address may not end with a single ':'. +http.singleColonStart=An IPv6 address may not start with a single ':'. +http.tooFewHextets=An IPv6 address must consist of 8 hextets but this address contains [{0}] hextets and no '::' sequence to represent one or more zero hextets. +http.tooManyColons=An IPv6 address may not contain more than 2 sequential colon characters. +http.tooManyDoubleColons=An IPv6 address may only contain a single '::' sequence. +http.tooManyHextets=The IPv6 address contains [{0}] hextets but a valid IPv6 address may not have more than 8. +http.wrongOctetCount=An IPv4 address should have exactly 4 octets, not [{0}]. \ No newline at end of file diff --git a/src/main/java/org/apache/tomcat/util/http/parser/MediaType.java b/core/src/main/java/org/apache/tomcat/util/http/parser/MediaType.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/parser/MediaType.java rename to core/src/main/java/org/apache/tomcat/util/http/parser/MediaType.java diff --git a/src/main/java/org/apache/tomcat/util/http/parser/MediaTypeCache.java b/core/src/main/java/org/apache/tomcat/util/http/parser/MediaTypeCache.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/parser/MediaTypeCache.java rename to core/src/main/java/org/apache/tomcat/util/http/parser/MediaTypeCache.java diff --git a/src/main/java/org/apache/tomcat/util/http/parser/SkipResult.java b/core/src/main/java/org/apache/tomcat/util/http/parser/SkipResult.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/http/parser/SkipResult.java rename to core/src/main/java/org/apache/tomcat/util/http/parser/SkipResult.java diff --git a/src/main/java/org/apache/tomcat/util/log/CaptureLog.java b/core/src/main/java/org/apache/tomcat/util/log/CaptureLog.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/log/CaptureLog.java rename to core/src/main/java/org/apache/tomcat/util/log/CaptureLog.java diff --git a/src/main/java/org/apache/tomcat/util/log/SystemLogHandler.java b/core/src/main/java/org/apache/tomcat/util/log/SystemLogHandler.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/log/SystemLogHandler.java rename to core/src/main/java/org/apache/tomcat/util/log/SystemLogHandler.java diff --git a/src/main/java/org/apache/tomcat/util/log/UserDataHelper.java b/core/src/main/java/org/apache/tomcat/util/log/UserDataHelper.java similarity index 98% rename from src/main/java/org/apache/tomcat/util/log/UserDataHelper.java rename to core/src/main/java/org/apache/tomcat/util/log/UserDataHelper.java index 7539ae9..a4354dd 100644 --- a/src/main/java/org/apache/tomcat/util/log/UserDataHelper.java +++ b/core/src/main/java/org/apache/tomcat/util/log/UserDataHelper.java @@ -131,7 +131,7 @@ private boolean logAtInfo() { } - private static enum Config { + private enum Config { NONE, DEBUG_ALL, INFO_THEN_DEBUG, @@ -141,7 +141,7 @@ private static enum Config { /** * Log mode for the next log message. / - public static enum Mode { + public enum Mode { DEBUG, INFO_THEN_DEBUG, INFO diff --git a/src/main/java/org/apache/tomcat/util/modeler/AttributeInfo.java b/core/src/main/java/org/apache/tomcat/util/modeler/AttributeInfo.java similarity index 95% rename from src/main/java/org/apache/tomcat/util/modeler/AttributeInfo.java rename to core/src/main/java/org/apache/tomcat/util/modeler/AttributeInfo.java index b932fa0..14342af 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/AttributeInfo.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/AttributeInfo.java @@ -45,7 +45,7 @@ public class AttributeInfo extends FeatureInfo { @return the display name of this attribute. / public String getDisplayName() { - return (this.displayName); + return this.displayName; } public void setDisplayName(String displayName) { @@ -58,7 +58,7 @@ public void setDisplayName(String displayName) { public String getGetMethod() { if(getMethod == null) getMethod = getMethodName(getName(), true, isIs()); - return (this.getMethod); + return this.getMethod; } public void setGetMethod(String getMethod) { @@ -71,7 +71,7 @@ public void setGetMethod(String getMethod) { with an "is" getter / public boolean isIs() { - return (this.is); + return this.is; } public void setIs(boolean is) { @@ -84,7 +84,7 @@ public void setIs(boolean is) { @return `true` if readable / public boolean isReadable() { - return (this.readable); + return this.readable; } public void setReadable(boolean readable) { @@ -98,7 +98,7 @@ public void setReadable(boolean readable) { public String getSetMethod() { if( setMethod == null ) setMethod = getMethodName(getName(), false, false); - return (this.setMethod); + return this.setMethod; } public void setSetMethod(String setMethod) { @@ -110,7 +110,7 @@ public void setSetMethod(String setMethod) { @return `true` if writable / public boolean isWriteable() { - return (this.writeable); + return this.writeable; } public void setWriteable(boolean writeable) { @@ -147,7 +147,6 @@ MBeanAttributeInfo createAttributeInfo() { @return the method name / private String getMethodName(String name, boolean getter, boolean is) { - StringBuilder sb = new StringBuilder(); if (getter) { if (is) @@ -158,8 +157,7 @@ private String getMethodName(String name, boolean getter, boolean is) { sb.append("set"); sb.append(Character.toUpperCase(name.charAt(0))); sb.append(name.substring(1)); - return (sb.toString()); - + return sb.toString(); } diff --git a/src/main/java/org/apache/tomcat/util/modeler/BaseAttributeFilter.java b/core/src/main/java/org/apache/tomcat/util/modeler/BaseAttributeFilter.java similarity index 96% rename from src/main/java/org/apache/tomcat/util/modeler/BaseAttributeFilter.java rename to core/src/main/java/org/apache/tomcat/util/modeler/BaseAttributeFilter.java index befe287..30a02a1 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/BaseAttributeFilter.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/BaseAttributeFilter.java @@ -20,6 +20,7 @@ import java.util.HashSet; +import java.util.Set; import javax.management.AttributeChangeNotification; import javax.management.Notification; @@ -63,7 +64,7 @@ public BaseAttributeFilter(String name) { The set of attribute names that are accepted by this filter. If this * list is empty, all attribute names are accepted. / - private HashSet names = new HashSet<>(); + private Set names = new HashSet<>(); // --------------------------------------------------------- Public Methods @@ -136,7 +137,7 @@ public boolean isNotificationEnabled(Notification notification) { if (names.size() < 1) return true; else - return (names.contains(acn.getAttributeName())); + return names.contains(acn.getAttributeName()); } } diff --git a/src/main/java/org/apache/tomcat/util/modeler/BaseModelMBean.java b/core/src/main/java/org/apache/tomcat/util/modeler/BaseModelMBean.java similarity index 97% rename from src/main/java/org/apache/tomcat/util/modeler/BaseModelMBean.java rename to core/src/main/java/org/apache/tomcat/util/modeler/BaseModelMBean.java index 5a03150..11f4740 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/BaseModelMBean.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/BaseModelMBean.java @@ -100,23 +100,10 @@ @author Craig R. McClanahan * @author Costin Manolache / -public class BaseModelMBean implements DynamicMBean, MBeanRegistration, ModelMBeanNotificationBroadcaster { - private static final Log log = LogFactory.getLog(BaseModelMBean.class); - - // ----------------------------------------------------------- Constructors +public class BaseModelMBean implements DynamicMBean, MBeanRegistration, + ModelMBeanNotificationBroadcaster { - /* - * Construct a `ModelMBean` with default - * `ModelMBeanInfo` information. - * - * @exception MBeanException if the initializer of an object - * throws an exception - * @exception RuntimeOperationsException if an IllegalArgumentException - * occurs - / - protected BaseModelMBean() throws MBeanException, RuntimeOperationsException { - super(); - } + private static final Log log = LogFactory.getLog(BaseModelMBean.class); // ----------------------------------------------------- Instance Variables @@ -208,7 +195,7 @@ else if (t instanceof Error) // Return the results of this method invocation // FIXME - should we validate the return type? - return (result); + return result; } @@ -236,7 +223,7 @@ public AttributeList getAttributes(String names[]) { // is the indication of a getter problem } } - return (response); + return response; } @@ -321,7 +308,7 @@ else if (t instanceof Error) // Return the results of this method invocation // FIXME - should we validate the return type? - return (result); + return result; } @@ -484,7 +471,7 @@ public AttributeList setAttributes(AttributeList attributes) { } } - return (getAttributes(names)); + return getAttributes(names); } @@ -835,7 +822,7 @@ public MBeanNotificationInfo[] getNotificationInfo() { // Copy remaining notifications as reported by the application System.arraycopy(current, 0, response, 2, current.length); - return (response); + return response; } diff --git a/src/main/java/org/apache/tomcat/util/modeler/BaseNotificationBroadcaster.java b/core/src/main/java/org/apache/tomcat/util/modeler/BaseNotificationBroadcaster.java similarity index 92% rename from src/main/java/org/apache/tomcat/util/modeler/BaseNotificationBroadcaster.java rename to core/src/main/java/org/apache/tomcat/util/modeler/BaseNotificationBroadcaster.java index cc4dc92..7566bb3 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/BaseNotificationBroadcaster.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/BaseNotificationBroadcaster.java @@ -82,10 +82,7 @@ public void addNotificationListener(NotificationListener listener, // Optimization to coalesce attribute name filters if (filter instanceof BaseAttributeFilter) { BaseAttributeFilter newFilter = (BaseAttributeFilter) filter; - Iterator items = - entries.iterator(); - while (items.hasNext()) { - BaseNotificationBroadcasterEntry item = items.next(); + for (BaseNotificationBroadcasterEntry item : entries) { if ((item.listener == listener) && (item.filter != null) && (item.filter instanceof BaseAttributeFilter) && @@ -121,9 +118,7 @@ public void addNotificationListener(NotificationListener listener, / @Override public MBeanNotificationInfo[] getNotificationInfo() { - - return (new MBeanNotificationInfo[0]); - + return new MBeanNotificationInfo[0]; } @@ -161,10 +156,7 @@ public void removeNotificationListener(NotificationListener listener) public void sendNotification(Notification notification) { synchronized (entries) { - Iterator items = - entries.iterator(); - while (items.hasNext()) { - BaseNotificationBroadcasterEntry item = items.next(); + for (BaseNotificationBroadcasterEntry item : entries) { if ((item.filter != null) && (!item.filter.isNotificationEnabled(notification))) continue; diff --git a/src/main/java/org/apache/tomcat/util/modeler/FeatureInfo.java b/core/src/main/java/org/apache/tomcat/util/modeler/FeatureInfo.java similarity index 96% rename from src/main/java/org/apache/tomcat/util/modeler/FeatureInfo.java rename to core/src/main/java/org/apache/tomcat/util/modeler/FeatureInfo.java index c463a2f..7eef166 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/FeatureInfo.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/FeatureInfo.java @@ -48,7 +48,7 @@ public class FeatureInfo implements Serializable { * @return the human-readable description of this feature. / public String getDescription() { - return (this.description); + return this.description; } public void setDescription(String description) { @@ -61,7 +61,7 @@ public void setDescription(String description) { in the same collection. / public String getName() { - return (this.name); + return this.name; } public void setName(String name) { @@ -72,7 +72,7 @@ public void setName(String name) { @return the fully qualified Java class name of this element. / public String getType() { - return (this.type); + return this.type; } public void setType(String type) { diff --git a/src/main/java/org/apache/tomcat/util/modeler/ManagedBean.java b/core/src/main/java/org/apache/tomcat/util/modeler/ManagedBean.java similarity index 99% rename from src/main/java/org/apache/tomcat/util/modeler/ManagedBean.java rename to core/src/main/java/org/apache/tomcat/util/modeler/ManagedBean.java index 1670ec7..42daeda 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/ManagedBean.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/ManagedBean.java @@ -209,7 +209,7 @@ public OperationInfo[] getOperations() { by this descriptor. / public String getType() { - return (this.type); + return this.type; } public void setType(String type) { @@ -318,7 +318,7 @@ public DynamicMBean createMBean(Object instance) } try { // Stupid - this will set the default minfo first.... - mbean = (BaseModelMBean) clazz.newInstance(); + mbean = (BaseModelMBean) clazz.getConstructor().newInstance(); } catch (RuntimeOperationsException e) { throw e; } catch (Exception e) { diff --git a/src/main/java/org/apache/tomcat/util/modeler/NotificationInfo.java b/core/src/main/java/org/apache/tomcat/util/modeler/NotificationInfo.java similarity index 99% rename from src/main/java/org/apache/tomcat/util/modeler/NotificationInfo.java rename to core/src/main/java/org/apache/tomcat/util/modeler/NotificationInfo.java index 098ccf5..19159cf 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/NotificationInfo.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/NotificationInfo.java @@ -151,6 +151,6 @@ public String toString() { readLock.unlock(); } sb.append("]"); - return (sb.toString()); + return sb.toString(); } } diff --git a/src/main/java/org/apache/tomcat/util/modeler/OperationInfo.java b/core/src/main/java/org/apache/tomcat/util/modeler/OperationInfo.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/OperationInfo.java rename to core/src/main/java/org/apache/tomcat/util/modeler/OperationInfo.java diff --git a/src/main/java/org/apache/tomcat/util/modeler/ParameterInfo.java b/core/src/main/java/org/apache/tomcat/util/modeler/ParameterInfo.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/ParameterInfo.java rename to core/src/main/java/org/apache/tomcat/util/modeler/ParameterInfo.java diff --git a/src/main/java/org/apache/tomcat/util/modeler/Registry.java b/core/src/main/java/org/apache/tomcat/util/modeler/Registry.java similarity index 97% rename from src/main/java/org/apache/tomcat/util/modeler/Registry.java rename to core/src/main/java/org/apache/tomcat/util/modeler/Registry.java index 8339d19..f24aaec 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/Registry.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/Registry.java @@ -26,8 +26,8 @@ import java.net.URL; import java.util.HashMap; import java.util.Hashtable; -import java.util.Iterator; import java.util.List; +import java.util.Map; import javax.management.DynamicMBean; import javax.management.MBeanAttributeInfo; @@ -97,14 +97,14 @@ public class Registry implements RegistryMBean, MBeanRegistration { The set of ManagedBean instances for the beans this registry * knows about, keyed by name. / - private HashMap descriptors = new HashMap<>(); + private Map descriptors = new HashMap<>(); /* List of managed beans, keyed by class name / - private HashMap descriptorsByClass = new HashMap<>(); + private Map descriptorsByClass = new HashMap<>(); // map to avoid duplicated searching or loading descriptors - private HashMap searchedPaths = new HashMap<>(); + private Map searchedPaths = new HashMap<>(); private Object guard; @@ -170,7 +170,7 @@ public static synchronized Registry getRegistry(Object key, Object guard) { registry.guard != guard ) { return null; } - return (registry); + return registry; } // -------------------- Generic methods -------------------- @@ -258,9 +258,7 @@ public void invoke(List mbeans, String operation, if( mbeans==null ) { return; } - Iterator itr = mbeans.iterator(); - while(itr.hasNext()) { - ObjectName current = itr.next(); + for (ObjectName current : mbeans) { try { if(current == null) { continue; @@ -702,19 +700,18 @@ private void findDescriptor(Class beanClass, String type) { } loadDescriptors(pkg, classLoader); } - return; } private ModelerSource getModelerSource( String type ) throws Exception { if( type==null ) type="MbeansDescriptorsDigesterSource"; - if( type.indexOf( ".") < 0 ) { + if(!type.contains(".")) { type="org.apache.tomcat.util.modeler.modules." + type; } Class c = Class.forName(type); - ModelerSource ds=(ModelerSource)c.newInstance(); + ModelerSource ds=(ModelerSource)c.getConstructor().newInstance(); return ds; } diff --git a/src/main/java/org/apache/tomcat/util/modeler/RegistryMBean.java b/core/src/main/java/org/apache/tomcat/util/modeler/RegistryMBean.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/RegistryMBean.java rename to core/src/main/java/org/apache/tomcat/util/modeler/RegistryMBean.java diff --git a/src/main/java/org/apache/tomcat/util/modeler/Util.java b/core/src/main/java/org/apache/tomcat/util/modeler/Util.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/Util.java rename to core/src/main/java/org/apache/tomcat/util/modeler/Util.java diff --git a/src/main/java/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd b/core/src/main/java/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd rename to core/src/main/java/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd diff --git a/src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsDigesterSource.java b/core/src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsDigesterSource.java similarity index 96% rename from src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsDigesterSource.java rename to core/src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsDigesterSource.java index bd439ec..bfcaff1 100644 --- a/src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsDigesterSource.java +++ b/core/src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsDigesterSource.java @@ -21,7 +21,6 @@ import java.io.InputStream; import java.net.URL; import java.util.ArrayList; -import java.util.Iterator; import java.util.List; import javax.management.ObjectName; @@ -157,7 +156,7 @@ public void execute() throws Exception { InputStream stream = (InputStream) source; - ArrayList loadedMbeans = new ArrayList<>(); + List loadedMbeans = new ArrayList<>(); synchronized(dLock) { if (digester == null) { digester = createDigester(); @@ -176,9 +175,8 @@ public void execute() throws Exception { } } - Iterator iter = loadedMbeans.iterator(); - while (iter.hasNext()) { - registry.addManagedBean(iter.next()); + for (ManagedBean loadedMbean : loadedMbeans) { + registry.addManagedBean(loadedMbean); } } } diff --git a/src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsIntrospectionSource.java b/core/src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsIntrospectionSource.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsIntrospectionSource.java rename to core/src/main/java/org/apache/tomcat/util/modeler/modules/MbeansDescriptorsIntrospectionSource.java diff --git a/src/main/java/org/apache/tomcat/util/modeler/modules/ModelerSource.java b/core/src/main/java/org/apache/tomcat/util/modeler/modules/ModelerSource.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/modules/ModelerSource.java rename to core/src/main/java/org/apache/tomcat/util/modeler/modules/ModelerSource.java diff --git a/src/main/java/org/apache/tomcat/util/modeler/modules/package.html b/core/src/main/java/org/apache/tomcat/util/modeler/modules/package.html similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/modules/package.html rename to core/src/main/java/org/apache/tomcat/util/modeler/modules/package.html diff --git a/src/main/java/org/apache/tomcat/util/modeler/package.html b/core/src/main/java/org/apache/tomcat/util/modeler/package.html similarity index 100% rename from src/main/java/org/apache/tomcat/util/modeler/package.html rename to core/src/main/java/org/apache/tomcat/util/modeler/package.html diff --git a/src/main/java/org/apache/tomcat/util/net/AbstractEndpoint.java b/core/src/main/java/org/apache/tomcat/util/net/AbstractEndpoint.java similarity index 82% rename from src/main/java/org/apache/tomcat/util/net/AbstractEndpoint.java rename to core/src/main/java/org/apache/tomcat/util/net/AbstractEndpoint.java index 12ea334..b59f054 100644 --- a/src/main/java/org/apache/tomcat/util/net/AbstractEndpoint.java +++ b/core/src/main/java/org/apache/tomcat/util/net/AbstractEndpoint.java @@ -33,10 +33,14 @@ import java.util.concurrent.RejectedExecutionException; import java.util.concurrent.TimeUnit; +import javax.management.MalformedObjectNameException; +import javax.management.ObjectName; + import org.apache.juli.logging.Log; import org.apache.tomcat.util.ExceptionUtils; import org.apache.tomcat.util.IntrospectionUtils; import org.apache.tomcat.util.collections.SynchronizedStack; +import org.apache.tomcat.util.modeler.Registry; import org.apache.tomcat.util.net.Acceptor.AcceptorState; import org.apache.tomcat.util.res.StringManager; import org.apache.tomcat.util.threads.LimitLatch; @@ -170,6 +174,8 @@ public SocketProperties getSocketProperties() { / protected SynchronizedStack> processorCache; + private ObjectName oname = null; + // ----------------------------------------------------------------- Properties private String defaultSSLHostConfigName = SSLHostConfig.DEFAULT_SSL_HOST_NAME; @@ -182,23 +188,111 @@ public void setDefaultSSLHostConfigName(String defaultSSLHostConfigName) { protected ConcurrentMap sslHostConfigs = new ConcurrentHashMap<>(); + /** + * Add the given SSL Host configuration. + * + * @param sslHostConfig The configuration to add + * + * @throws IllegalArgumentException If the host name is not valid or if a + * configuration has already been provided + * for that host + / public void addSslHostConfig(SSLHostConfig sslHostConfig) throws IllegalArgumentException { + addSslHostConfig(sslHostConfig, false); + } + /* + * Add the given SSL Host configuration, optionally replacing the existing + * configuration for the given host. + * + * @param sslHostConfig The configuration to add + * @param replace If {@code true} replacement of an existing + * configuration is permitted, otherwise any such + * attempted replacement will trigger an exception + * + * @throws IllegalArgumentException If the host name is not valid or if a + * configuration has already been provided + * for that host and replacement is not + * allowed + / + public void addSslHostConfig(SSLHostConfig sslHostConfig, boolean replace) throws IllegalArgumentException { String key = sslHostConfig.getHostName(); if (key == null \|\| key.length() == 0) { throw new IllegalArgumentException(sm.getString("endpoint.noSslHostName")); } - sslHostConfig.setConfigType(getSslConfigType()); if (bindState != BindState.UNBOUND && isSSLEnabled()) { + sslHostConfig.setConfigType(getSslConfigType()); try { createSSLContext(sslHostConfig); } catch (Exception e) { throw new IllegalArgumentException(e); } } - SSLHostConfig duplicate = sslHostConfigs.putIfAbsent(key, sslHostConfig); - if (duplicate != null) { - releaseSSLContext(sslHostConfig); - throw new IllegalArgumentException(sm.getString("endpoint.duplicateSslHostName", key)); + if (replace) { + SSLHostConfig previous = sslHostConfigs.put(key, sslHostConfig); + if (previous != null) { + unregisterJmx(sslHostConfig); + } + registerJmx(sslHostConfig); + + // Do not release any SSLContexts associated with a replaced + // SSLHostConfig. They may still be in used by existing connections + // and releasing them would break the connection at best. Let GC + // handle the clean up. + } else { + SSLHostConfig duplicate = sslHostConfigs.putIfAbsent(key, sslHostConfig); + if (duplicate != null) { + releaseSSLContext(sslHostConfig); + throw new IllegalArgumentException(sm.getString("endpoint.duplicateSslHostName", key)); + } + registerJmx(sslHostConfig); + } + } + /* + * Removes the SSL host configuration for the given host name, if such a + * configuration exists. + * + * @param hostName The host name associated with the SSL host configuration + * to remove + * + * @return The SSL host configuration that was removed, if any + / + public SSLHostConfig removeSslHostConfig(String hostName) { + if (hostName == null) { + return null; + } + // Host names are case insensitive + if (hostName.equalsIgnoreCase(getDefaultSSLHostConfigName())) { + throw new IllegalArgumentException( + sm.getString("endpoint.removeDefaultSslHostConfig", hostName)); + } + SSLHostConfig sslHostConfig = sslHostConfigs.remove(hostName); + unregisterJmx(sslHostConfig); + return sslHostConfig; + } + /* + * Re-read the configuration files for the SSL host and replace the existing + * SSL configuration with the updated settings. Note this replacement will + * happen even if the settings remain unchanged. + * + * @param hostName The SSL host for which the configuration should be + * reloaded. This must match a current SSL host + / + public void reloadSslHostConfig(String hostName) { + SSLHostConfig sslHostConfig = sslHostConfigs.get(hostName); + if (sslHostConfig == null) { + throw new IllegalArgumentException( + sm.getString("endpoint.unknownSslHostName", hostName)); + } + addSslHostConfig(sslHostConfig, true); + } + /* + * Re-read the configuration files for all SSL hosts and replace the + * existing SSL configuration with the updated settings. Note this + * replacement will happen even if the settings remain unchanged. + / + public void reloadSslHostConfigs() { + for (String hostName : sslHostConfigs.keySet()) { + reloadSslHostConfig(hostName); } } public SSLHostConfig[] findSslHostConfigs() { @@ -403,9 +497,7 @@ public final int getLocalPort() { is 100. / private int acceptCount = 100; - public void setAcceptCount(int acceptCount) { - if (acceptCount > 0) this.acceptCount = acceptCount; - } + public void setAcceptCount(int acceptCount) { if (acceptCount > 0) this.acceptCount = acceptCount; } public int getAcceptCount() { return acceptCount; } /* @@ -559,17 +651,6 @@ public void setMaxKeepAliveRequests(int maxKeepAliveRequests) { this.maxKeepAliveRequests = maxKeepAliveRequests; } - /** - * The maximum number of headers in a request that are allowed. - * 100 by default. A value of less than 0 means no limit. - / - private int maxHeaderCount = 100; // as in Apache HTTPD server - public int getMaxHeaderCount() { - return maxHeaderCount; - } - public void setMaxHeaderCount(int maxHeaderCount) { - this.maxHeaderCount = maxHeaderCount; - } /* * Name of the thread pool, which will be used for naming child threads. @@ -578,6 +659,15 @@ public void setMaxHeaderCount(int maxHeaderCount) { public void setName(String name) { this.name = name; } public String getName() { return name; } + + /** + * Name of domain to use for JMX registration. + / + private String domain; + public void setDomain(String domain) { this.domain = domain; } + public String getDomain() { return domain; } + + /* * The default is true - the created threads will be * in daemon mode. If set to false, the control thread @@ -828,9 +918,10 @@ private void unlockAccept() { waitLeft -= 50; } } - } catch(Exception e) { + } catch(Throwable t) { + ExceptionUtils.handleThrowable(t); if (getLog().isDebugEnabled()) { - getLog().debug(sm.getString("endpoint.debug.unlock.fail", "" + getPort()), e); + getLog().debug(sm.getString("endpoint.debug.unlock.fail", "" + getPort()), t); } } } @@ -911,7 +1002,6 @@ public boolean processSocket(SocketWrapperBase socketWrapper, } Executor executor = getExecutor(); if (dispatch && executor != null) { - TimeUnit.SECONDS.sleep(10000); executor.execute(sc); } else { sc.run(); @@ -953,6 +1043,62 @@ public final void init() throws Exception { bind(); bindState = BindState.BOUND_ON_INIT; } + if (this.domain != null) { + // Register endpoint (as ThreadPool - historical name) + oname = new ObjectName(domain + ":type=ThreadPool,name=\"" + getName() + "\""); + Registry.getRegistry(null, null).registerComponent(this, oname, null); + + for (SSLHostConfig sslHostConfig : findSslHostConfigs()) { + registerJmx(sslHostConfig); + } + } + } + + + private void registerJmx(SSLHostConfig sslHostConfig) { + ObjectName sslOname = null; + try { + sslOname = new ObjectName(domain + ":type=SSLHostConfig,ThreadPool=" + + getName() + ",name=" + ObjectName.quote(sslHostConfig.getHostName())); + sslHostConfig.setObjectName(sslOname); + try { + Registry.getRegistry(null, null).registerComponent(sslHostConfig, sslOname, null); + } catch (Exception e) { + getLog().warn(sm.getString("endpoint.jmxRegistrationFailed", sslOname), e); + } + } catch (MalformedObjectNameException e) { + getLog().warn(sm.getString("endpoint.invalidJmxNameSslHost", + sslHostConfig.getHostName()), e); + } + + for (SSLHostConfigCertificate sslHostConfigCert : sslHostConfig.getCertificates()) { + ObjectName sslCertOname = null; + try { + sslCertOname = new ObjectName(domain + + ":type=SSLHostConfigCertificate,ThreadPool=" + getName() + + ",Host=" + ObjectName.quote(sslHostConfig.getHostName()) + + ",name=" + sslHostConfigCert.getType()); + sslHostConfigCert.setObjectName(sslCertOname); + try { + Registry.getRegistry(null, null).registerComponent( + sslHostConfigCert, sslCertOname, null); + } catch (Exception e) { + getLog().warn(sm.getString("endpoint.jmxRegistrationFailed", sslCertOname), e); + } + } catch (MalformedObjectNameException e) { + getLog().warn(sm.getString("endpoint.invalidJmxNameSslHostCert", + sslHostConfig.getHostName(), sslHostConfigCert.getType()), e); + } + } + } + + + private void unregisterJmx(SSLHostConfig sslHostConfig) { + Registry registry = Registry.getRegistry(null, null); + registry.unregisterComponent(sslHostConfig.getObjectName()); + for (SSLHostConfigCertificate sslHostConfigCert : sslHostConfig.getCertificates()) { + registry.unregisterComponent(sslHostConfigCert.getObjectName()); + } } @@ -1018,8 +1164,14 @@ public final void destroy() throws Exception { unbind(); bindState = BindState.UNBOUND; } + Registry registry = Registry.getRegistry(null, null); + registry.unregisterComponent(oname); + for (SSLHostConfig sslHostConfig : findSslHostConfigs()) { + unregisterJmx(sslHostConfig); + } } + protected abstract Log getLog(); protected LimitLatch initializeConnectionLatch() { diff --git a/src/main/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java b/core/src/main/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java similarity index 97% rename from src/main/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java rename to core/src/main/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java index d255e88..463d9ce 100644 --- a/src/main/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java +++ b/core/src/main/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java @@ -21,7 +21,6 @@ import java.net.SocketAddress; import java.nio.channels.NetworkChannel; import java.util.ArrayList; -import java.util.Iterator; import java.util.LinkedHashSet; import java.util.List; import java.util.Set; @@ -82,6 +81,7 @@ protected void initialiseSsl() throws Exception { sslImplementation = SSLImplementation.getInstance(getSslImplementationName()); for (SSLHostConfig sslHostConfig : sslHostConfigs.values()) { + sslHostConfig.setConfigType(getSslConfigType()); createSSLContext(sslHostConfig); } @@ -177,8 +177,9 @@ protected SSLEngine createSSLEngine(String sniHostName, List clientReque SSLParameters sslParameters = engine.getSSLParameters(); sslParameters.setUseCipherSuitesOrder(sslHostConfig.getHonorCipherOrder()); - if (JreCompat.isJre9Available() && clientRequestedApplicationProtocols.size() > 0 && - negotiableProtocols.size() > 0) { + if (JreCompat.isJre9Available() && clientRequestedApplicationProtocols != null + && clientRequestedApplicationProtocols.size() > 0 + && negotiableProtocols.size() > 0) { // Only try to negotiate if both client and server have at least // one protocol in common // Note: Tomcat does not explicitly negotiate http/1.1 @@ -217,9 +218,7 @@ private SSLHostConfigCertificate selectCertificate( candidateCiphers.retainAll(serverCiphers); } - Iterator candidateIter = candidateCiphers.iterator(); - while (candidateIter.hasNext()) { - Cipher candidate = candidateIter.next(); + for (Cipher candidate : candidateCiphers) { for (SSLHostConfigCertificate certificate : certificates) { if (certificate.getType().isCompatibleWith(candidate.getAu())) { return certificate; diff --git a/src/main/java/org/apache/tomcat/util/net/Acceptor.java b/core/src/main/java/org/apache/tomcat/util/net/Acceptor.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/Acceptor.java rename to core/src/main/java/org/apache/tomcat/util/net/Acceptor.java diff --git a/src/main/java/org/apache/tomcat/util/net/ApplicationBufferHandler.java b/core/src/main/java/org/apache/tomcat/util/net/ApplicationBufferHandler.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/ApplicationBufferHandler.java rename to core/src/main/java/org/apache/tomcat/util/net/ApplicationBufferHandler.java diff --git a/src/main/java/org/apache/tomcat/util/net/AprEndpoint.java b/core/src/main/java/org/apache/tomcat/util/net/AprEndpoint.java similarity index 93% rename from src/main/java/org/apache/tomcat/util/net/AprEndpoint.java rename to core/src/main/java/org/apache/tomcat/util/net/AprEndpoint.java index 1723f32..a2a1d36 100644 --- a/src/main/java/org/apache/tomcat/util/net/AprEndpoint.java +++ b/core/src/main/java/org/apache/tomcat/util/net/AprEndpoint.java @@ -43,6 +43,7 @@ import org.apache.tomcat.jni.Poll; import org.apache.tomcat.jni.Pool; import org.apache.tomcat.jni.SSL; +import org.apache.tomcat.jni.SSLConf; import org.apache.tomcat.jni.SSLContext; import org.apache.tomcat.jni.SSLContext.SNICallBack; import org.apache.tomcat.jni.SSLSocket; @@ -55,6 +56,7 @@ import org.apache.tomcat.util.net.AbstractEndpoint.Handler.SocketState; import org.apache.tomcat.util.net.Acceptor.AcceptorState; import org.apache.tomcat.util.net.SSLHostConfig.Type; +import org.apache.tomcat.util.net.openssl.OpenSSLConf; import org.apache.tomcat.util.net.openssl.OpenSSLEngine; @@ -370,6 +372,7 @@ public void bind() throws Exception { // Initialize SSL if needed if (isSSLEnabled()) { for (SSLHostConfig sslHostConfig : sslHostConfigs.values()) { + sslHostConfig.setConfigType(getSslConfigType()); createSSLContext(sslHostConfig); } SSLHostConfig defaultSSLHostConfig = sslHostConfigs.get(getDefaultSSLHostConfigName()); @@ -534,12 +537,87 @@ protected void createSSLContext(SSLHostConfig sslHostConfig) throws Exception { } if (negotiableProtocols.size() > 0) { - ArrayList protocols = new ArrayList<>(); + List protocols = new ArrayList<>(); protocols.addAll(negotiableProtocols); protocols.add("http/1.1"); String[] protocolsArray = protocols.toArray(new String[0]); SSLContext.setAlpnProtos(ctx, protocolsArray, SSL.SSL_SELECTOR_FAILURE_NO_ADVERTISE); } + + // If client authentication is being used, OpenSSL requires that + // this is set so always set it in case an app is configured to require + // it + SSLContext.setSessionIdContext(ctx, SSLContext.DEFAULT_SESSION_ID_CONTEXT); + + long cctx; + OpenSSLConf openSslConf = sslHostConfig.getOpenSslConf(); + if (openSslConf != null) { + // Create OpenSSLConfCmd context if used + try { + if (log.isDebugEnabled()) + log.debug(sm.getString("endpoint.apr.makeConf")); + cctx = SSLConf.make(rootPool, + SSL.SSL_CONF_FLAG_FILE \| + SSL.SSL_CONF_FLAG_SERVER \| + SSL.SSL_CONF_FLAG_CERTIFICATE \| + SSL.SSL_CONF_FLAG_SHOW_ERRORS); + } catch (Exception e) { + throw new Exception(sm.getString("endpoint.apr.errMakeConf"), e); + } + if (cctx != 0) { + // Check OpenSSLConfCmd if used + if (log.isDebugEnabled()) + log.debug(sm.getString("endpoint.apr.checkConf")); + try { + if (!openSslConf.check(cctx)) { + log.error(sm.getString("endpoint.apr.errCheckConf")); + throw new Exception(sm.getString("endpoint.apr.errCheckConf")); + } + } catch (Exception e) { + throw new Exception(sm.getString("endpoint.apr.errCheckConf"), e); + } + // Apply OpenSSLConfCmd if used + if (log.isDebugEnabled()) + log.debug(sm.getString("endpoint.apr.applyConf")); + try { + if (!openSslConf.apply(cctx, ctx)) { + log.error(sm.getString("endpoint.apr.errApplyConf")); + throw new Exception(sm.getString("endpoint.apr.errApplyConf")); + } + } catch (Exception e) { + throw new Exception(sm.getString("endpoint.apr.errApplyConf"), e); + } + // Reconfigure the enabled protocols + int opts = SSLContext.getOptions(ctx); + List enabled = new ArrayList<>(); + // Seems like there is no way to explicitly disable SSLv2Hello + // in OpenSSL so it is always enabled + enabled.add(Constants.SSL_PROTO_SSLv2Hello); + if ((opts & SSL.SSL_OP_NO_TLSv1) == 0) { + enabled.add(Constants.SSL_PROTO_TLSv1); + } + if ((opts & SSL.SSL_OP_NO_TLSv1_1) == 0) { + enabled.add(Constants.SSL_PROTO_TLSv1_1); + } + if ((opts & SSL.SSL_OP_NO_TLSv1_2) == 0) { + enabled.add(Constants.SSL_PROTO_TLSv1_2); + } + if ((opts & SSL.SSL_OP_NO_SSLv2) == 0) { + enabled.add(Constants.SSL_PROTO_SSLv2); + } + if ((opts & SSL.SSL_OP_NO_SSLv3) == 0) { + enabled.add(Constants.SSL_PROTO_SSLv3); + } + sslHostConfig.setEnabledProtocols( + enabled.toArray(new String[enabled.size()])); + // Reconfigure the enabled ciphers + sslHostConfig.setEnabledCiphers(SSLContext.getCiphers(ctx)); + } + } else { + cctx = 0; + } + + sslHostConfig.setOpenSslConfContext(Long.valueOf(cctx)); sslHostConfig.setOpenSslContext(Long.valueOf(ctx)); } @@ -551,6 +629,11 @@ protected void releaseSSLContext(SSLHostConfig sslHostConfig) { SSLContext.free(ctx.longValue()); sslHostConfig.setOpenSslContext(null); } + Long cctx = sslHostConfig.getOpenSslConfContext(); + if (cctx != null) { + SSLConf.free(cctx.longValue()); + sslHostConfig.setOpenSslConfContext(null); + } } @@ -1786,7 +1869,7 @@ private int mergeDescriptors(long[] desc, int startCount) { * are populated. * The array is event, socket, event, socket etc. / - HashMap merged = new HashMap<>(startCount); + Map merged = new HashMap<>(startCount); for (int n = 0; n < startCount; n++) { Long newValue = merged.merge(Long.valueOf(desc[2n+1]), Long.valueOf(desc[2n]), (v1, v2) -> Long.valueOf(v1.longValue() \| v2.longValue())); @@ -1918,7 +2001,7 @@ public SendfileState add(SendfileData data) { 0, data.fdpool); // Set the socket to nonblocking mode Socket.timeoutSet(data.socket, 0); - while (true) { + while (sendfileRunning) { long nw = Socket.sendfilen(data.socket, data.fd, data.pos, data.length, 0); if (nw < 0) { @@ -2417,9 +2500,9 @@ public boolean isReadyForRead() throws IOException { return true; } - fillReadBuffer(false); + int read = fillReadBuffer(false); - boolean isReady = socketBufferHandler.getReadBuffer().position() > 0; + boolean isReady = socketBufferHandler.getReadBuffer().position() > 0 \|\| read == -1; return isReady; } @@ -2749,11 +2832,56 @@ public SSLSupport getSslSupport(String clientCertProvider) { @Override - public void doClientAuth(SSLSupport sslSupport) { + public void doClientAuth(SSLSupport sslSupport) throws IOException { long socket = getSocket().longValue(); - // Configure connection to require a certificate - SSLSocket.setVerify(socket, SSL.SSL_CVERIFY_REQUIRE, -1); - SSLSocket.renegotiate(socket); + // Configure connection to require a certificate. This requires a + // re-handshake and must block until the re-handshake completes. + // Therefore, make sure socket is in blocking mode. + Lock readLock = getBlockingStatusReadLock(); + WriteLock writeLock = getBlockingStatusWriteLock(); + boolean renegotiateDone = false; + try { + readLock.lock(); + try { + if (getBlockingStatus()) { + Socket.timeoutSet(getSocket().longValue(), getReadTimeout() 1000); + + SSLSocket.setVerify(socket, SSL.SSL_CVERIFY_REQUIRE, -1); + SSLSocket.renegotiate(socket); + + renegotiateDone = true; + } + } finally { + readLock.unlock(); + } + + if (!renegotiateDone) { + writeLock.lock(); + try { + // Set the current settings for this socket + setBlockingStatus(true); + Socket.timeoutSet(getSocket().longValue(), getReadTimeout() * 1000); + // Downgrade the lock + readLock.lock(); + try { + writeLock.unlock(); + SSLSocket.setVerify(socket, SSL.SSL_CVERIFY_REQUIRE, -1); + SSLSocket.renegotiate(socket); + } finally { + readLock.unlock(); + } + } finally { + // Should have been released above but may not have been on some + // exception paths + if (writeLock.isHeldByCurrentThread()) { + writeLock.unlock(); + } + } + } + } catch (Throwable t) { + ExceptionUtils.handleThrowable(t); + throw new IOException(sm.getString("socket.sslreneg"), t); + } } @@ -2761,5 +2889,44 @@ public void doClientAuth(SSLSupport sslSupport) { public void setAppReadBufHandler(ApplicationBufferHandler handler) { // no-op } + + String getSSLInfoS(int id) { + synchronized (closedLock) { + if (closed) { + return null; + } + try { + return SSLSocket.getInfoS(getSocket().longValue(), id); + } catch (Exception e) { + throw new IllegalStateException(e); + } + } + } + + int getSSLInfoI(int id) { + synchronized (closedLock) { + if (closed) { + return 0; + } + try { + return SSLSocket.getInfoI(getSocket().longValue(), id); + } catch (Exception e) { + throw new IllegalStateException(e); + } + } + } + + byte[] getSSLInfoB(int id) { + synchronized (closedLock) { + if (closed) { + return null; + } + try { + return SSLSocket.getInfoB(getSocket().longValue(), id); + } catch (Exception e) { + throw new IllegalStateException(e); + } + } + } } } diff --git a/src/main/java/org/apache/tomcat/util/net/AprSSLSupport.java b/core/src/main/java/org/apache/tomcat/util/net/AprSSLSupport.java similarity index 65% rename from src/main/java/org/apache/tomcat/util/net/AprSSLSupport.java rename to core/src/main/java/org/apache/tomcat/util/net/AprSSLSupport.java index b620ce9..8f9be75 100644 --- a/src/main/java/org/apache/tomcat/util/net/AprSSLSupport.java +++ b/core/src/main/java/org/apache/tomcat/util/net/AprSSLSupport.java @@ -22,7 +22,6 @@ import java.security.cert.X509Certificate; import org.apache.tomcat.jni.SSL; -import org.apache.tomcat.jni.SSLSocket; /** * Implementation of SSLSupport for APR. @@ -32,11 +31,11 @@ / public class AprSSLSupport implements SSLSupport { - private final SocketWrapperBase socketWrapper; + private final AprEndpoint.AprSocketWrapper socketWrapper; private final String clientCertProvider; - public AprSSLSupport(SocketWrapperBase socketWrapper, String clientCertProvider) { + public AprSSLSupport(AprEndpoint.AprSocketWrapper socketWrapper, String clientCertProvider) { this.socketWrapper = socketWrapper; this.clientCertProvider = clientCertProvider; } @@ -44,12 +43,8 @@ public AprSSLSupport(SocketWrapperBase socketWrapper, String clientCertPro @Override public String getCipherSuite() throws IOException { - long socketRef = socketWrapper.getSocket().longValue(); - if (socketRef == 0) { - return null; - } try { - return SSLSocket.getInfoS(socketRef, SSL.SSL_INFO_CIPHER); + return socketWrapper.getSSLInfoS(SSL.SSL_INFO_CIPHER); } catch (Exception e) { throw new IOException(e); } @@ -58,17 +53,18 @@ public String getCipherSuite() throws IOException { @Override public X509Certificate[] getPeerCertificateChain() throws IOException { - long socketRef = socketWrapper.getSocket().longValue(); - if (socketRef == 0) { - return null; - } - try { - // certLength == -1 indicates an error - int certLength = SSLSocket.getInfoI(socketRef, SSL.SSL_INFO_CLIENT_CERT_CHAIN); - byte[] clientCert = SSLSocket.getInfoB(socketRef, SSL.SSL_INFO_CLIENT_CERT); + // certLength == -1 indicates an error unless TLS session tickets + // are in use in which case OpenSSL won't store the chain in the + // ticket. + int certLength = socketWrapper.getSSLInfoI(SSL.SSL_INFO_CLIENT_CERT_CHAIN); + byte[] clientCert = socketWrapper.getSSLInfoB(SSL.SSL_INFO_CLIENT_CERT); X509Certificate[] certs = null; - if (clientCert != null && certLength > -1) { + + if (clientCert != null) { + if (certLength < 0) { + certLength = 0; + } certs = new X509Certificate[certLength + 1]; CertificateFactory cf; if (clientCertProvider == null) { @@ -78,7 +74,7 @@ public X509Certificate[] getPeerCertificateChain() throws IOException { } certs[0] = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(clientCert)); for (int i = 0; i < certLength; i++) { - byte[] data = SSLSocket.getInfoB(socketRef, SSL.SSL_INFO_CLIENT_CERT_CHAIN + i); + byte[] data = socketWrapper.getSSLInfoB(SSL.SSL_INFO_CLIENT_CERT_CHAIN + i); certs[i+1] = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(data)); } } @@ -91,13 +87,8 @@ public X509Certificate[] getPeerCertificateChain() throws IOException { @Override public Integer getKeySize() throws IOException { - long socketRef = socketWrapper.getSocket().longValue(); - if (socketRef == 0) { - return null; - } - try { - return Integer.valueOf(SSLSocket.getInfoI(socketRef, SSL.SSL_INFO_CIPHER_USEKEYSIZE)); + return Integer.valueOf(socketWrapper.getSSLInfoI(SSL.SSL_INFO_CIPHER_USEKEYSIZE)); } catch (Exception e) { throw new IOException(e); } @@ -106,13 +97,8 @@ public Integer getKeySize() throws IOException { @Override public String getSessionId() throws IOException { - long socketRef = socketWrapper.getSocket().longValue(); - if (socketRef == 0) { - return null; - } - try { - return SSLSocket.getInfoS(socketRef, SSL.SSL_INFO_SESSION_ID); + return socketWrapper.getSSLInfoS(SSL.SSL_INFO_SESSION_ID); } catch (Exception e) { throw new IOException(e); } @@ -120,13 +106,8 @@ public String getSessionId() throws IOException { @Override public String getProtocol() throws IOException { - long socketRef = socketWrapper.getSocket().longValue(); - if (socketRef == 0) { - return null; - } - try { - return SSLSocket.getInfoS(socketRef, SSL.SSL_INFO_PROTOCOL); + return socketWrapper.getSSLInfoS(SSL.SSL_INFO_PROTOCOL); } catch (Exception e) { throw new IOException(e); } diff --git a/src/main/java/org/apache/tomcat/util/net/Constants.java b/core/src/main/java/org/apache/tomcat/util/net/Constants.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/Constants.java rename to core/src/main/java/org/apache/tomcat/util/net/Constants.java diff --git a/src/main/java/org/apache/tomcat/util/net/DispatchType.java b/core/src/main/java/org/apache/tomcat/util/net/DispatchType.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/DispatchType.java rename to core/src/main/java/org/apache/tomcat/util/net/DispatchType.java diff --git a/src/main/java/org/apache/tomcat/util/net/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/net/LocalStrings.properties similarity index 84% rename from src/main/java/org/apache/tomcat/util/net/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/util/net/LocalStrings.properties index 17ada32..cb8f59a 100644 --- a/src/main/java/org/apache/tomcat/util/net/LocalStrings.properties +++ b/core/src/main/java/org/apache/tomcat/util/net/LocalStrings.properties @@ -49,6 +49,9 @@ endpoint.getAttribute=[{0}] is [{1}] endpoint.init.bind=Socket bind failed: [{0}] [{1}] endpoint.init.listen=Socket listen failed: [{0}] [{1}] endpoint.init.notavail=APR not available +endpoint.invalidJmxNameSslHost=Unable to generate a valid JMX object name for the SSLHostConfig associated with host [{0}] +endpoint.invalidJmxNameSslHostCert=Unable to generate a valid JMX object name for the SSLHostConfigCertificate associated with host [{0}] and certificate type [{1}] +endpoint.jmxRegistrationFailed=Failed to register the JMX object with name [{0}] endpoint.launch.fail=Failed to launch new runnable endpoint.noSslHostConfig=No SSLHostConfig element was found with the hostName [{0}] to match the defaultSSLHostConfigName for the connector [{1}] endpoint.noSslHostName=No host name was provided for the SSL host configuration @@ -58,10 +61,12 @@ endpoint.poll.fail=Critical poller failure (restarting poller): [{0}] [{1}] endpoint.poll.error=Unexpected poller error endpoint.process.fail=Error allocating socket processor endpoint.processing.fail=Error running socket processor +endpoint.removeDefaultSslHostConfig=The default SSLHostConfig (named [{0}]) may not be removed endpoint.sendfile.error=Unexpected sendfile error endpoint.sendfile.addfail=Sendfile failure: [{0}] [{1}] endpoint.setAttribute=Set [{0}] to [{1}] endpoint.timeout.err=Error processing socket timeout +endpoint.unknownSslHostName=The SSL host name [{0}] is not recognised for this endpoint endpoint.apr.failSslContextMake=Unable to create SSLContext. Check that SSLEngine is enabled in the AprLifecycleListener, the AprLifecycleListener has initialised correctly and that a valid SSLProtocol has been specified endpoint.apr.invalidSslProtocol=An invalid value [{0}] was provided for the SSLProtocol attribute endpoint.apr.maxConnections.running=The APR endpoint does not support the setting of maxConnections while it is running. The existing value of [{0}] will continue to be used. @@ -74,13 +79,23 @@ endpoint.apr.pollMergeEvents=Merge poller event [{1}] for socket [{0}] to create endpoint.apr.pollUnknownEvent=A socket was returned from the poller with an unrecognized event [{0}] endpoint.apr.tooManyCertFiles=More certificate files were configured than the AprEndpoint can handle endpoint.apr.remoteport=APR socket [{0}] opened with remote port [{1}] +endpoint.apr.makeConf=Creating OpenSSLConf context +endpoint.apr.errMakeConf=Could not create OpenSSLConf context +endpoint.apr.checkConf=Checking OpenSSLConf +endpoint.apr.errCheckConf=Error during OpenSSLConf check +endpoint.apr.assignConf=Assigning SSL context to OpenSSLConfCmd context +endpoint.apr.applyConf=Applying OpenSSLConfCmd to SSL context +endpoint.apr.errApplyConf=Could not apply OpenSSLConf to SSL context endpoint.jsse.noSslContext=No SSLContext could be found for the host name [{0}] endpoint.nio.registerFail=Failed to register socket with selector from poller endpoint.nio.selectorCloseFail=Failed to close selector when closing the poller +endpoint.nio.stopLatchAwaitFail=The pollers did not stop within the expected time +endpoint.nio.stopLatchAwaitInterrupted=This thread was interrupted while waiting for the pollers to stop endpoint.nio.timeoutCme=Exception during processing of timeouts. The code has been checked repeatedly and no concurrent modification has been found. If you are able to repeat this error please open a Tomcat bug and provide the steps to reproduce. endpoint.nio2.exclusiveExecutor=The NIO2 connector requires an exclusive executor to operate properly on shutdown channel.nio.interrupted=The current thread was interrupted +channel.nio.ssl.closeSilentError=As expected, there was an exception trying to close the connection cleanly. channel.nio.ssl.notHandshaking=NOT_HANDSHAKING during handshake channel.nio.ssl.handshakeError=Handshake error channel.nio.ssl.unexpectedStatusDuringWrap=Unexpected status [{0}] during handshake WRAP. @@ -106,10 +121,13 @@ channel.nio.ssl.expandNetInBuffer=Expanding network input buffer to [{0}] bytes channel.nio.ssl.expandNetOutBuffer=Expanding network output buffer to [{0}] bytes channel.nio.ssl.sniDefault=Unable to buffer enough data to determine requested SNI host name. Using default channel.nio.ssl.sniHostName=The SNI host name extracted for this connection was [{0}] +channel.nio.ssl.foundHttp=Found an plain text HTTP request on what should be an encrypted TLS connection jsse.invalid_truststore_password=The provided trust store password could not be used to unlock and/or validate the trust store. Retrying to access the trust store with a null password which will skip validation. jsse.keystore_load_failed=Failed to load keystore type [{0}] with path [{1}] due to [{2}] +jsse.ssl3=SSLv3 has been explicitly enabled. This protocol is known to be insecure. +sniExtractor.clientHelloInvalid=The ClientHello message was not correctly formatted sniExtractor.clientHelloTooBig=The ClientHello was not presented in a single TLS record so no SNI information could be extracted socket.closed=The socket associated with this connection has been closed. @@ -123,9 +141,11 @@ socket.apr.closed=The socket [{0}] associated with this connection has been clos sslHostConfig.certificateVerificationInvalid=The certificate verification value [{0}] is not recognised sslHostConfig.certificate.notype=Multiple certificates were specified and at least one is missing the required attribute type -sslHostConfig.mismatch=The property [{0}] was set on the SSLHostConfig named [{1}] and is for connectors of type [{2}] but the SSLHostConfig is being used with a connector of type [{3}] +sslHostConfig.mismatch=The property [{0}] was set on the SSLHostConfig named [{1}] and is for the [{2}] configuration syntax but the SSLHostConfig is being used with the [{3}] configuration syntax sslHostConfig.prefix_missing=The protocol [{0}] was added to the list of protocols on the SSLHostConfig named [{1}]. Check if a +/- prefix is missing. sslHostConfigCertificate.mismatch=The property [{0}] was set on the SSLHostConfigCertificate named [{1}] and is for certificate storage type [{2}] but the certificate is being used with a storage of type [{3}] +sslHostConfig.opensslconf.null=Attempt to set null OpenSSLConf ignored +sslHostConfig.opensslconf.alreadyset=Attempt to set another OpenSSLConf ignored sslImplementation.cnfe= Unable to create SSLImplementation for class [{0}] diff --git a/src/main/java/org/apache/tomcat/util/net/LocalStrings_es.properties b/core/src/main/java/org/apache/tomcat/util/net/LocalStrings_es.properties similarity index 99% rename from src/main/java/org/apache/tomcat/util/net/LocalStrings_es.properties rename to core/src/main/java/org/apache/tomcat/util/net/LocalStrings_es.properties index 3c39faf..e7280ec 100644 --- a/src/main/java/org/apache/tomcat/util/net/LocalStrings_es.properties +++ b/core/src/main/java/org/apache/tomcat/util/net/LocalStrings_es.properties @@ -12,6 +12,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. +# # net resources endpoint.err.handshake = Acuerdo fallido endpoint.err.unexpected = Error inesperado al procesar conector diff --git a/src/main/java/org/apache/tomcat/util/net/LocalStrings_fr.properties b/core/src/main/java/org/apache/tomcat/util/net/LocalStrings_fr.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/LocalStrings_fr.properties rename to core/src/main/java/org/apache/tomcat/util/net/LocalStrings_fr.properties diff --git a/src/main/java/org/apache/tomcat/util/net/LocalStrings_ja.properties b/core/src/main/java/org/apache/tomcat/util/net/LocalStrings_ja.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/LocalStrings_ja.properties rename to core/src/main/java/org/apache/tomcat/util/net/LocalStrings_ja.properties diff --git a/src/main/java/org/apache/tomcat/util/net/Nio2Channel.java b/core/src/main/java/org/apache/tomcat/util/net/Nio2Channel.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/Nio2Channel.java rename to core/src/main/java/org/apache/tomcat/util/net/Nio2Channel.java diff --git a/src/main/java/org/apache/tomcat/util/net/Nio2Endpoint.java b/core/src/main/java/org/apache/tomcat/util/net/Nio2Endpoint.java similarity index 95% rename from src/main/java/org/apache/tomcat/util/net/Nio2Endpoint.java rename to core/src/main/java/org/apache/tomcat/util/net/Nio2Endpoint.java index 41c8ae3..31c6f70 100644 --- a/src/main/java/org/apache/tomcat/util/net/Nio2Endpoint.java +++ b/core/src/main/java/org/apache/tomcat/util/net/Nio2Endpoint.java @@ -33,6 +33,7 @@ import java.nio.channels.NetworkChannel; import java.nio.file.StandardOpenOption; import java.util.ArrayList; +import java.util.List; import java.util.concurrent.ExecutionException; import java.util.concurrent.ExecutorService; import java.util.concurrent.Future; @@ -361,10 +362,14 @@ private void closeSocket(SocketWrapperBase socket) { ExceptionUtils.handleThrowable(e); if (log.isDebugEnabled()) log.error("",e); } + Nio2SocketWrapper nio2Socket = (Nio2SocketWrapper) socket; try { synchronized (socket.getSocket()) { - if (socket.getSocket().isOpen()) { + if (!nio2Socket.closed) { + nio2Socket.closed = true; countDownConnection(); + } + if (socket.getSocket().isOpen()) { socket.getSocket().close(true); } } @@ -373,7 +378,6 @@ private void closeSocket(SocketWrapperBase socket) { if (log.isDebugEnabled()) log.error("",e); } try { - Nio2SocketWrapper nio2Socket = (Nio2SocketWrapper) socket; if (nio2Socket.getSendfileData() != null && nio2Socket.getSendfileData().fchannel != null && nio2Socket.getSendfileData().fchannel.isOpen()) { @@ -406,6 +410,7 @@ protected AtomicInteger initialValue() { private final Semaphore writePending = new Semaphore(1); private boolean writeInterest = false; // Guarded by writeCompletionHandler private boolean writeNotify = false; + private boolean closed = false; private CompletionHandler> awaitBytesHandler = new CompletionHandler>() { @@ -565,7 +570,7 @@ public void completed(Integer nBytes, ByteBuffer attachment) { } else if (bufferedWrites.size() > 0) { nestedWriteCompletionCount.get().incrementAndGet(); // Continue writing data using a gathering write - ArrayList arrayList = new ArrayList<>(); + List arrayList = new ArrayList<>(); if (attachment.hasRemaining()) { arrayList.add(attachment); } @@ -623,7 +628,7 @@ public void completed(Long nBytes, ByteBuffer[] attachment) { } else if (bufferedWrites.size() > 0 \|\| arrayHasData(attachment)) { // Continue writing data nestedWriteCompletionCount.get().incrementAndGet(); - ArrayList arrayList = new ArrayList<>(); + List arrayList = new ArrayList<>(); for (ByteBuffer buffer : attachment) { if (buffer.hasRemaining()) { arrayList.add(buffer); @@ -893,14 +898,14 @@ public void completed(Long nBytes, OperationState state) { } } if (complete) { - readPending.release(); - if (state.block == BlockingMode.BLOCK && currentState != CompletionState.INLINE) { - synchronized (this) { + synchronized (state) { + readPending.release(); + if (state.block == BlockingMode.BLOCK && currentState != CompletionState.INLINE) { + state.state = currentState; + state.notify(); + } else { state.state = currentState; - notify(); } - } else { - state.state = currentState; } if (completion && state.handler != null) { state.handler.completed(Long.valueOf(state.nBytes), state.attachment); @@ -920,14 +925,14 @@ public void failed(Throwable exc, OperationState state) { ioe = new IOException(exc); } setError(ioe); - readPending.release(); - if (state.block == BlockingMode.BLOCK) { - synchronized (this) { + synchronized (state) { + readPending.release(); + if (state.block == BlockingMode.BLOCK) { + state.state = Nio2Endpoint.isInline() ? CompletionState.ERROR : CompletionState.DONE; + state.notify(); + } else { state.state = Nio2Endpoint.isInline() ? CompletionState.ERROR : CompletionState.DONE; - notify(); } - } else { - state.state = Nio2Endpoint.isInline() ? CompletionState.ERROR : CompletionState.DONE; } if (exc instanceof AsynchronousCloseException) { // If already closed, don't call onError and close again @@ -962,14 +967,14 @@ public void completed(Long nBytes, OperationState state) { } } if (complete) { - writePending.release(); - if (state.block == BlockingMode.BLOCK && currentState != CompletionState.INLINE) { - synchronized (this) { + synchronized (state) { + writePending.release(); + if (state.block == BlockingMode.BLOCK && currentState != CompletionState.INLINE) { + state.state = currentState; + state.notify(); + } else { state.state = currentState; - notify(); } - } else { - state.state = currentState; } if (completion && state.handler != null) { state.handler.completed(Long.valueOf(state.nBytes), state.attachment); @@ -989,14 +994,14 @@ public void failed(Throwable exc, OperationState state) { ioe = new IOException(exc); } setError(ioe); - writePending.release(); - if (state.block == BlockingMode.BLOCK) { - synchronized (this) { + synchronized (state) { + writePending.release(); + if (state.block == BlockingMode.BLOCK) { + state.state = Nio2Endpoint.isInline() ? CompletionState.ERROR : CompletionState.DONE; + state.notify(); + } else { state.state = Nio2Endpoint.isInline() ? CompletionState.ERROR : CompletionState.DONE; - notify(); } - } else { - state.state = Nio2Endpoint.isInline() ? CompletionState.ERROR : CompletionState.DONE; } if (state.handler != null) { state.handler.failed(ioe, state.attachment); @@ -1008,6 +1013,11 @@ public void failed(Throwable exc, OperationState state) { public CompletionState read(ByteBuffer[] dsts, int offset, int length, BlockingMode block, long timeout, TimeUnit unit, A attachment, CompletionCheck check, CompletionHandler handler) { + IOException ioe = getError(); + if (ioe != null) { + handler.failed(ioe, attachment); + return CompletionState.ERROR; + } if (block != BlockingMode.NON_BLOCK) { try { if (!readPending.tryAcquire(timeout, unit)) { @@ -1026,13 +1036,29 @@ public CompletionState read(ByteBuffer[] dsts, int offset, int length, OperationState state = new OperationState<>(dsts, offset, length, block, timeout, unit, attachment, check, handler); ScatterReadCompletionHandler completion = new ScatterReadCompletionHandler<>(); Nio2Endpoint.startInline(); - getSocket().read(dsts, offset, length, timeout, unit, state, completion); + long nBytes = 0; + if (!socketBufferHandler.isReadBufferEmpty()) { + // There is still data inside the main read buffer, use it to fill out the destination buffers + synchronized (readCompletionHandler) { + // Note: It is not necessary to put this code in the completion handler + socketBufferHandler.configureReadBufferForRead(); + for (int i = 0; i < length && !socketBufferHandler.isReadBufferEmpty(); i++) { + nBytes += transfer(socketBufferHandler.getReadBuffer(), dsts[offset + i]); + } + } + if (nBytes > 0) { + completion.completed(Long.valueOf(nBytes), state); + } + } + if (nBytes == 0) { + getSocket().read(dsts, offset, length, timeout, unit, state, completion); + } Nio2Endpoint.endInline(); if (block == BlockingMode.BLOCK) { - synchronized (completion) { + synchronized (state) { if (state.state == CompletionState.PENDING) { try { - completion.wait(unit.toMillis(timeout)); + state.wait(unit.toMillis(timeout)); if (state.state == CompletionState.PENDING) { handler.failed(new SocketTimeoutException(), attachment); return CompletionState.ERROR; @@ -1081,13 +1107,14 @@ public CompletionState write(ByteBuffer[] srcs, int offset, int length, OperationState state = new OperationState<>(srcs, offset, length, block, timeout, unit, attachment, check, handler); GatherWriteCompletionHandler completion = new GatherWriteCompletionHandler<>(); Nio2Endpoint.startInline(); + // It should be less necessary to check the buffer state as it is easy to flush before getSocket().write(srcs, offset, length, timeout, unit, state, completion); Nio2Endpoint.endInline(); if (block == BlockingMode.BLOCK) { - synchronized (completion) { + synchronized (state) { if (state.state == CompletionState.PENDING) { try { - completion.wait(unit.toMillis(timeout)); + state.wait(unit.toMillis(timeout)); if (state.state == CompletionState.PENDING) { handler.failed(new SocketTimeoutException(), attachment); return CompletionState.ERROR; @@ -1282,7 +1309,7 @@ private boolean flushNonBlocking(boolean hasPermit) throws IOException { socketBufferHandler.configureWriteBufferForRead(); if (bufferedWrites.size() > 0) { // Gathering write of the main buffer plus all leftovers - ArrayList arrayList = new ArrayList<>(); + List arrayList = new ArrayList<>(); if (socketBufferHandler.getWriteBuffer().hasRemaining()) { arrayList.add(socketBufferHandler.getWriteBuffer()); } @@ -1588,18 +1615,14 @@ public SSLSupport getSslSupport(String clientCertProvider) { @Override - public void doClientAuth(SSLSupport sslSupport) { + public void doClientAuth(SSLSupport sslSupport) throws IOException { SecureNio2Channel sslChannel = (SecureNio2Channel) getSocket(); SSLEngine engine = sslChannel.getSslEngine(); if (!engine.getNeedClientAuth()) { // Need to re-negotiate SSL connection engine.setNeedClientAuth(true); - try { - sslChannel.rehandshake(); - ((JSSESupport) sslSupport).setSession(engine.getSession()); - } catch (IOException ioe) { - log.warn(sm.getString("socket.sslreneg"), ioe); - } + sslChannel.rehandshake(); + ((JSSESupport) sslSupport).setSession(engine.getSession()); } } diff --git a/src/main/java/org/apache/tomcat/util/net/NioBlockingSelector.java b/core/src/main/java/org/apache/tomcat/util/net/NioBlockingSelector.java similarity index 91% rename from src/main/java/org/apache/tomcat/util/net/NioBlockingSelector.java rename to core/src/main/java/org/apache/tomcat/util/net/NioBlockingSelector.java index 6c2cf3b..fe193bc 100644 --- a/src/main/java/org/apache/tomcat/util/net/NioBlockingSelector.java +++ b/core/src/main/java/org/apache/tomcat/util/net/NioBlockingSelector.java @@ -260,14 +260,27 @@ public void remove(final NioSocketWrapper key, final int ops) { } public boolean events() { - boolean result = false; Runnable r = null; - result = (events.size() > 0); - while ( (r = events.poll()) != null ) { + + / We only poll and run the runnable events when we start this + * method. Further events added to the queue later will be delayed + * to the next execution of this method. + * + * We do in this way, because running event from the events queue + * may lead the working thread to add more events to the queue (for + * example, the worker thread may add another RunnableAdd event when + * waken up by a previous RunnableAdd event who got an invalid + * SelectionKey). Trying to consume all the events in an increasing + * queue till it's empty, will make the loop hard to be terminated, + * which will kill a lot of time, and greatly affect performance of + * the poller loop. + / + int size = events.size(); + for (int i = 0; i < size && (r = events.poll()) != null; i++) { r.run(); - result = true; } - return result; + + return (size > 0); } @Override @@ -328,13 +341,20 @@ public void run() { } } events.clear(); - try { - selector.selectNow();//cancel all remaining keys - }catch( Exception ignore ) { - if (log.isDebugEnabled())log.debug("",ignore); + // If using a shared selector, the NioSelectorPool will also try and + // close the selector. Try and avoid the ClosedSelectorException + // although because multiple threads are involved there is always + // the possibility of an Exception here. + if (selector.isOpen()) { + try { + // Cancels all remaining keys + selector.selectNow(); + }catch( Exception ignore ) { + if (log.isDebugEnabled())log.debug("",ignore); + } } try { - selector.close();//Close the connector + selector.close(); }catch( Exception ignore ) { if (log.isDebugEnabled())log.debug("",ignore); } @@ -375,7 +395,7 @@ public void run() { } catch (CancelledKeyException cx) { cancel(sk, key, ops); } catch (ClosedChannelException cx) { - cancel(sk, key, ops); + cancel(null, key, ops); } } } @@ -450,7 +470,6 @@ public void finalize() { log.warn("Possible key leak, cancelling key in the finalizer."); try {key.cancel();}catch (Exception ignore){} } - key = null; } } } diff --git a/src/main/java/org/apache/tomcat/util/net/NioChannel.java b/core/src/main/java/org/apache/tomcat/util/net/NioChannel.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/NioChannel.java rename to core/src/main/java/org/apache/tomcat/util/net/NioChannel.java diff --git a/src/main/java/org/apache/tomcat/util/net/NioEndpoint.java b/core/src/main/java/org/apache/tomcat/util/net/NioEndpoint.java similarity index 96% rename from src/main/java/org/apache/tomcat/util/net/NioEndpoint.java rename to core/src/main/java/org/apache/tomcat/util/net/NioEndpoint.java index 1f89be0..7322abd 100644 --- a/src/main/java/org/apache/tomcat/util/net/NioEndpoint.java +++ b/core/src/main/java/org/apache/tomcat/util/net/NioEndpoint.java @@ -143,7 +143,7 @@ public boolean setProperty(String name, String value) { public void setSelectorTimeout(long timeout){ this.selectorTimeout = timeout;} public long getSelectorTimeout(){ return this.selectorTimeout; } /* - * The socket poller. + * The socket pollers. / private Poller[] pollers = null; private AtomicInteger pollerRotater = new AtomicInteger(0); @@ -199,12 +199,7 @@ public int getKeepAliveCount() { / @Override public void bind() throws Exception { - - serverSock = ServerSocketChannel.open(); - socketProperties.setProperties(serverSock.socket()); - InetSocketAddress addr = (getAddress()!=null?new InetSocketAddress(getAddress(),getPort()):new InetSocketAddress(getPort())); - serverSock.socket().bind(addr,getAcceptCount()); - serverSock.configureBlocking(true); //mimic APR behavior + initServerSocket(); // Initialize thread count defaults for acceptor, poller if (acceptorThreadCount == 0) { @@ -223,6 +218,17 @@ public void bind() throws Exception { selectorPool.open(); } + // Separated out to make it easier for folks that extend NioEndpoint to + // implement custom [server]sockets + protected void initServerSocket() throws Exception { + serverSock = ServerSocketChannel.open(); + socketProperties.setProperties(serverSock.socket()); + InetSocketAddress addr = (getAddress()!=null?new InetSocketAddress(getAddress(),getPort()):new InetSocketAddress(getPort())); + serverSock.socket().bind(addr,getAcceptCount()); + serverSock.configureBlocking(true); //mimic APR behavior + } + + /** * Start the NIO endpoint, creating acceptor, poller threads. / @@ -278,15 +284,17 @@ public void stopInternal() { pollers[i] = null; } try { - getStopLatch().await(selectorTimeout + 100, TimeUnit.MILLISECONDS); - } catch (InterruptedException ignore) { + if (!getStopLatch().await(selectorTimeout + 100, TimeUnit.MILLISECONDS)) { + log.warn(sm.getString("endpoint.nio.stopLatchAwaitFail")); + } + } catch (InterruptedException e) { + log.warn(sm.getString("endpoint.nio.stopLatchAwaitInterrupted"), e); } shutdownExecutor(); eventCache.clear(); nioChannels.clear(); processorCache.clear(); } - } @@ -587,7 +595,7 @@ public boolean events() { boolean result = false; PollerEvent pe = null; - while ( (pe = events.poll()) != null ) { + for (int i = 0, size = events.size(); i < size && (pe = events.poll()) != null; i++ ) { result = true; try { pe.run(); @@ -635,6 +643,22 @@ public NioSocketWrapper cancelledKey(SelectionKey key) { getHandler().release(ka); } if (key.isValid()) key.cancel(); + // If it is available, close the NioChannel first which should + // in turn close the underlying SocketChannel. The NioChannel + // needs to be closed first, if available, to ensure that TLS + // connections are shut down cleanly. + if (ka != null) { + try { + ka.getSocket().close(true); + } catch (Exception e){ + if (log.isDebugEnabled()) { + log.debug(sm.getString( + "endpoint.debug.socketCloseFail"), e); + } + } + } + // The SocketChannel is also available via the SelectionKey. If + // it hasn't been closed in the block above, close it now. if (key.channel().isOpen()) { try { key.channel().close(); @@ -645,16 +669,6 @@ public NioSocketWrapper cancelledKey(SelectionKey key) { } } } - try { - if (ka!=null) { - ka.getSocket().close(true); - } - } catch (Exception e){ - if (log.isDebugEnabled()) { - log.debug(sm.getString( - "endpoint.debug.socketCloseFail"), e); - } - } try { if (ka != null && ka.getSendfileData() != null && ka.getSendfileData().fchannel != null @@ -904,9 +918,9 @@ protected void timeout(int keyCount, boolean hasEvents) { // timeouts on every loop of the Poller since that would create too // much load and timeouts can afford to wait a few seconds. // However, do process timeouts if any of the following are true: - // 1.the selector simply timed out (suggests there isn't much load) - // 2.the nextExpiration time has passed - // 3.the server socket is being closed + // - the selector simply timed out (suggests there isn't much load) + // - the nextExpiration time has passed + // - the server socket is being closed if (nextExpiration > 0 && (keyCount > 0 \|\| hasEvents) && (now < nextExpiration) && !close) { return; } @@ -955,7 +969,6 @@ protected void timeout(int keyCount, boolean hasEvents) { // See https://bz.apache.org/bugzilla/show_bug.cgi?id=57943 log.warn(sm.getString("endpoint.nio.timeoutCme"), cme); } - //不同时间加入的连接，使用一个时间段做处理，会有超时不准确的问题和时间轮那种动态调整的还是不一样。 long prevExp = nextExpiration; //for logging purposes only nextExpiration = System.currentTimeMillis() + socketProperties.getTimeoutInterval(); @@ -1286,18 +1299,14 @@ public SSLSupport getSslSupport(String clientCertProvider) { @Override - public void doClientAuth(SSLSupport sslSupport) { + public void doClientAuth(SSLSupport sslSupport) throws IOException { SecureNioChannel sslChannel = (SecureNioChannel) getSocket(); SSLEngine engine = sslChannel.getSslEngine(); if (!engine.getNeedClientAuth()) { // Need to re-negotiate SSL connection engine.setNeedClientAuth(true); - try { - sslChannel.rehandshake(getEndpoint().getConnectionTimeout()); - ((JSSESupport) sslSupport).setSession(engine.getSession()); - } catch (IOException ioe) { - log.warn(sm.getString("socket.sslreneg",ioe)); - } + sslChannel.rehandshake(getEndpoint().getConnectionTimeout()); + ((JSSESupport) sslSupport).setSession(engine.getSession()); } } diff --git a/src/main/java/org/apache/tomcat/util/net/NioSelectorPool.java b/core/src/main/java/org/apache/tomcat/util/net/NioSelectorPool.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/NioSelectorPool.java rename to core/src/main/java/org/apache/tomcat/util/net/NioSelectorPool.java diff --git a/src/main/java/org/apache/tomcat/util/net/SSLContext.java b/core/src/main/java/org/apache/tomcat/util/net/SSLContext.java similarity index 91% rename from src/main/java/org/apache/tomcat/util/net/SSLContext.java rename to core/src/main/java/org/apache/tomcat/util/net/SSLContext.java index 57cacab..05f04f7 100644 --- a/src/main/java/org/apache/tomcat/util/net/SSLContext.java +++ b/core/src/main/java/org/apache/tomcat/util/net/SSLContext.java @@ -19,6 +19,7 @@ import java.security.KeyManagementException; import java.security.SecureRandom; +import java.security.cert.X509Certificate; import javax.net.ssl.KeyManager; import javax.net.ssl.SSLEngine; @@ -47,4 +48,7 @@ public void init(KeyManager[] kms, TrustManager[] tms, public SSLParameters getSupportedSSLParameters(); + public X509Certificate[] getCertificateChain(String alias); + + public X509Certificate[] getAcceptedIssuers(); } diff --git a/src/main/java/org/apache/tomcat/util/net/SSLHostConfig.java b/core/src/main/java/org/apache/tomcat/util/net/SSLHostConfig.java similarity index 93% rename from src/main/java/org/apache/tomcat/util/net/SSLHostConfig.java rename to core/src/main/java/org/apache/tomcat/util/net/SSLHostConfig.java index 85d3946..73f6879 100644 --- a/src/main/java/org/apache/tomcat/util/net/SSLHostConfig.java +++ b/core/src/main/java/org/apache/tomcat/util/net/SSLHostConfig.java @@ -21,18 +21,20 @@ import java.io.Serializable; import java.security.KeyStore; import java.security.UnrecoverableKeyException; -import java.util.HashMap; +import java.util.EnumMap; import java.util.HashSet; import java.util.LinkedHashSet; import java.util.List; import java.util.Map; import java.util.Set; +import javax.management.ObjectName; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.TrustManagerFactory; import org.apache.juli.logging.Log; import org.apache.juli.logging.LogFactory; +import org.apache.tomcat.util.net.openssl.OpenSSLConf; import org.apache.tomcat.util.net.openssl.ciphers.Cipher; import org.apache.tomcat.util.net.openssl.ciphers.OpenSSLCipherConfigurationParser; import org.apache.tomcat.util.res.StringManager; @@ -51,12 +53,9 @@ public class SSLHostConfig implements Serializable { protected static final Set SSL_PROTO_ALL_SET = new HashSet<>(); static { - / Default used if protocols is not configured, also - used if protocols="All" / - / If protocols is configured to be empty, the effective - value comes from - org.apache.tomcat.util.net.jsse.JSSESocketFactory.defaultServerProtocols - (JSSE) resp. org.apache.tomcat.jni.SSL.SSL_PROTOCOL_ALL (OpenSSL)/ + / Default used if protocols is not configured, also used if + * protocols="All" + / SSL_PROTO_ALL_SET.add(Constants.SSL_PROTO_SSLv2Hello); SSL_PROTO_ALL_SET.add(Constants.SSL_PROTO_TLSv1); SSL_PROTO_ALL_SET.add(Constants.SSL_PROTO_TLSv1_1); @@ -65,20 +64,22 @@ public class SSLHostConfig implements Serializable { private Type configType = null; private Type currentConfigType = null; - private Map> configuredProperties = new HashMap<>(); + private Map> configuredProperties = new EnumMap<>(Type.class); private String hostName = DEFAULT_SSL_HOST_NAME; + private transient Long openSslConfContext = Long.valueOf(0); // OpenSSL can handle multiple certs in a single config so the reference to // the context is here at the virtual host level. JSSE can't so the // reference is held on the certificate. - private transient Long openSslContext; + private transient Long openSslContext = Long.valueOf(0); // Configuration properties // Internal private String[] enabledCiphers; private String[] enabledProtocols; + private ObjectName oname; // Nested private SSLHostConfigCertificate defaultCertificate = null; private Set certificates = new HashSet<>(4); @@ -113,6 +114,7 @@ public class SSLHostConfig implements Serializable { private boolean disableCompression = true; private boolean disableSessionTickets = false; private boolean insecureRenegotiation = false; + private OpenSSLConf openSslConf = null; public SSLHostConfig() { // Set defaults that can't be (easily) set when defining the fields. @@ -120,6 +122,16 @@ public SSLHostConfig() { } + public Long getOpenSslConfContext() { + return openSslConfContext; + } + + + public void setOpenSslConfContext(Long openSslConfContext) { + this.openSslConfContext = openSslConfContext; + } + + public Long getOpenSslContext() { return openSslContext; } @@ -188,7 +200,7 @@ public String[] getEnabledProtocols() { } - void setEnabledProtocols(String[] enabledProtocols) { + public void setEnabledProtocols(String[] enabledProtocols) { this.enabledProtocols = enabledProtocols; } @@ -203,11 +215,21 @@ public String[] getEnabledCiphers() { } - void setEnabledCiphers(String[] enabledCiphers) { + public void setEnabledCiphers(String[] enabledCiphers) { this.enabledCiphers = enabledCiphers; } + public ObjectName getObjectName() { + return oname; + } + + + public void setObjectName(ObjectName oname) { + this.oname = oname; + } + + // ------------------------------------------- Nested configuration elements private void registerDefaultCertificate() { @@ -238,6 +260,22 @@ public void addCertificate(SSLHostConfigCertificate certificate) { } + public OpenSSLConf getOpenSslConf() { + return openSslConf; + } + + + public void setOpenSslConf(OpenSSLConf conf) { + if (conf == null) { + throw new IllegalArgumentException(sm.getString("sslHostConfig.opensslconf.null")); + } else if (openSslConf != null) { + throw new IllegalArgumentException(sm.getString("sslHostConfig.opensslconf.alreadySet")); + } + setProperty("", Type.OPENSSL); + openSslConf = conf; + } + + public Set getCertificates() { return getCertificates(false); } @@ -277,7 +315,15 @@ public String getCertificateRevocationListFile() { public void setCertificateVerification(String certificateVerification) { - this.certificateVerification = CertificateVerification.fromString(certificateVerification); + try { + this.certificateVerification = + CertificateVerification.fromString(certificateVerification); + } catch (IllegalArgumentException iae) { + // If the specified value is not recognised, default to the + // strictest possible option. + this.certificateVerification = CertificateVerification.REQUIRED; + throw iae; + } } @@ -800,14 +846,14 @@ public static String adjustRelativePath(String path) { // ----------------------------------------------------------- Inner classes - public static enum Type { + public enum Type { JSSE, OPENSSL, EITHER } - public static enum CertificateVerification { + public enum CertificateVerification { NONE, OPTIONAL_NO_CA, OPTIONAL, diff --git a/src/main/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java b/core/src/main/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java similarity index 96% rename from src/main/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java rename to core/src/main/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java index ec4217e..24018bc 100644 --- a/src/main/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java +++ b/core/src/main/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java @@ -22,6 +22,8 @@ import java.util.HashSet; import java.util.Set; +import javax.management.ObjectName; + import org.apache.juli.logging.Log; import org.apache.juli.logging.LogFactory; import org.apache.tomcat.util.net.openssl.ciphers.Authentication; @@ -41,6 +43,9 @@ public class SSLHostConfigCertificate implements Serializable { static final String DEFAULT_KEYSTORE_TYPE = System.getProperty("javax.net.ssl.keyStoreType", "JKS"); + // Internal + private ObjectName oname; + // OpenSSL can handle multiple certs in a single config so the reference to // the context is at the virtual host level. JSSE can't so the reference is // held here on the certificate. @@ -92,6 +97,18 @@ public SSLHostConfig getSSLHostConfig() { } + // Internal + + public ObjectName getObjectName() { + return oname; + } + + + public void setObjectName(ObjectName oname) { + this.oname = oname; + } + + // Common public Type getType() { @@ -239,7 +256,7 @@ private void setStoreType(String name, StoreType type) { // Nested types - public static enum Type { + public enum Type { UNDEFINED, RSA(Authentication.RSA), diff --git a/src/main/java/org/apache/tomcat/util/net/SSLImplementation.java b/core/src/main/java/org/apache/tomcat/util/net/SSLImplementation.java similarity index 97% rename from src/main/java/org/apache/tomcat/util/net/SSLImplementation.java rename to core/src/main/java/org/apache/tomcat/util/net/SSLImplementation.java index 69d1726..43ccbe5 100644 --- a/src/main/java/org/apache/tomcat/util/net/SSLImplementation.java +++ b/core/src/main/java/org/apache/tomcat/util/net/SSLImplementation.java @@ -53,7 +53,7 @@ public static SSLImplementation getInstance(String className) try { Class clazz = Class.forName(className); - return (SSLImplementation) clazz.newInstance(); + return (SSLImplementation) clazz.getConstructor().newInstance(); } catch (Exception e) { String msg = sm.getString("sslImplementation.cnfe", className); if (logger.isDebugEnabled()) { diff --git a/src/main/java/org/apache/tomcat/util/net/SSLSessionManager.java b/core/src/main/java/org/apache/tomcat/util/net/SSLSessionManager.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SSLSessionManager.java rename to core/src/main/java/org/apache/tomcat/util/net/SSLSessionManager.java diff --git a/src/main/java/org/apache/tomcat/util/net/SSLSupport.java b/core/src/main/java/org/apache/tomcat/util/net/SSLSupport.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SSLSupport.java rename to core/src/main/java/org/apache/tomcat/util/net/SSLSupport.java diff --git a/src/main/java/org/apache/tomcat/util/net/SSLUtil.java b/core/src/main/java/org/apache/tomcat/util/net/SSLUtil.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SSLUtil.java rename to core/src/main/java/org/apache/tomcat/util/net/SSLUtil.java diff --git a/src/main/java/org/apache/tomcat/util/net/SSLUtilBase.java b/core/src/main/java/org/apache/tomcat/util/net/SSLUtilBase.java similarity index 98% rename from src/main/java/org/apache/tomcat/util/net/SSLUtilBase.java rename to core/src/main/java/org/apache/tomcat/util/net/SSLUtilBase.java index d311527..08dff57 100644 --- a/src/main/java/org/apache/tomcat/util/net/SSLUtilBase.java +++ b/core/src/main/java/org/apache/tomcat/util/net/SSLUtilBase.java @@ -53,6 +53,9 @@ protected SSLUtilBase(SSLHostConfigCertificate certificate) { Set implementedProtocols = getImplementedProtocols(); List enabledProtocols = getEnabled("protocols", getLog(), true, configuredProtocols, implementedProtocols); + if (enabledProtocols.contains("SSLv3")) { + log.warn(sm.getString("jsse.ssl3")); + } this.enabledProtocols = enabledProtocols.toArray(new String[enabledProtocols.size()]); // Calculate the enabled ciphers diff --git a/src/main/java/org/apache/tomcat/util/net/SecureNio2Channel.java b/core/src/main/java/org/apache/tomcat/util/net/SecureNio2Channel.java similarity index 97% rename from src/main/java/org/apache/tomcat/util/net/SecureNio2Channel.java rename to core/src/main/java/org/apache/tomcat/util/net/SecureNio2Channel.java index 3b42bd6..68f1334 100644 --- a/src/main/java/org/apache/tomcat/util/net/SecureNio2Channel.java +++ b/core/src/main/java/org/apache/tomcat/util/net/SecureNio2Channel.java @@ -300,13 +300,20 @@ protected int handshakeInternal(boolean async) throws IOException { if (handshakeStatus == HandshakeStatus.NEED_TASK) handshakeStatus = tasks(); } else if (handshake.getStatus() == Status.BUFFER_UNDERFLOW) { - //read more data, reregister for OP_READ + if (netInBuffer.position() == netInBuffer.limit()) { + //clear the buffer if we have emptied it out on data + netInBuffer.clear(); + } + //read more data if (async) { sc.read(netInBuffer, socket, handshakeReadCompletionHandler); } else { try { - sc.read(netInBuffer).get(endpoint.getConnectionTimeout(), - TimeUnit.MILLISECONDS); + int read = sc.read(netInBuffer).get(endpoint.getConnectionTimeout(), + TimeUnit.MILLISECONDS).intValue(); + if (read == -1) { + throw new EOFException(); + } } catch (InterruptedException \| ExecutionException \| TimeoutException e) { throw new IOException(sm.getString("channel.nio.ssl.handshakeError")); } @@ -381,6 +388,12 @@ private int processSNI() throws IOException { hostName = endpoint.getDefaultSSLHostConfigName(); clientRequestedCiphers = Collections.emptyList(); break; + case NON_SECURE: + netOutBuffer.clear(); + netOutBuffer.put(TLSClientHelloExtractor.USE_TLS_RESPONSE); + netOutBuffer.flip(); + flush(); + throw new IOException(sm.getString("channel.nio.ssl.foundHttp")); } if (log.isDebugEnabled()) { @@ -449,8 +462,10 @@ public void rehandshake() throws IOException { } } } catch (IOException x) { + closeSilently(); throw x; } catch (Exception cx) { + closeSilently(); IOException x = new IOException(cx); throw x; } @@ -494,10 +509,6 @@ protected SSLEngineResult handshakeWrap() throws IOException { @throws IOException An IO error occurred / protected SSLEngineResult handshakeUnwrap() throws IOException { - if (netInBuffer.position() == netInBuffer.limit()) { - //clear the buffer if we have emptied it out on data - netInBuffer.clear(); - } SSLEngineResult result; boolean cont = false; //loop while we can perform pure SSLEngine data @@ -576,18 +587,31 @@ public void close() throws IOException { closed = (!netOutBuffer.hasRemaining() && (handshake.getHandshakeStatus() != HandshakeStatus.NEED_WRAP)); } + @Override public void close(boolean force) throws IOException { try { close(); } finally { - if ( force \|\| closed ) { + if (force \|\| closed) { closed = true; sc.close(); } } } + + private void closeSilently() { + try { + close(true); + } catch (IOException ioe) { + // This is expected - swallowing the exception is the reason this + // method exists. Log at debug in case someone is interested. + log.debug(sm.getString("channel.nio.ssl.closeSilentError"), ioe); + } + } + + private class FutureRead implements Future { private ByteBuffer dst; private Future integer; @@ -1115,10 +1139,4 @@ public SSLEngine getSslEngine() { public ByteBuffer getEmptyBuf() { return emptyBuf; } - - @Override - public AsynchronousSocketChannel getIOChannel() { - return sc; - } - } \ No newline at end of file diff --git a/src/main/java/org/apache/tomcat/util/net/SecureNioChannel.java b/core/src/main/java/org/apache/tomcat/util/net/SecureNioChannel.java similarity index 97% rename from src/main/java/org/apache/tomcat/util/net/SecureNioChannel.java rename to core/src/main/java/org/apache/tomcat/util/net/SecureNioChannel.java index a522e7b..f1e82c0 100644 --- a/src/main/java/org/apache/tomcat/util/net/SecureNioChannel.java +++ b/core/src/main/java/org/apache/tomcat/util/net/SecureNioChannel.java @@ -316,6 +316,12 @@ private int processSNI() throws IOException { hostName = endpoint.getDefaultSSLHostConfigName(); clientRequestedCiphers = Collections.emptyList(); break; + case NON_SECURE: + netOutBuffer.clear(); + netOutBuffer.put(TLSClientHelloExtractor.USE_TLS_RESPONSE); + netOutBuffer.flip(); + flushOutbound(); + throw new IOException(sm.getString("channel.nio.ssl.foundHttp")); } if (log.isDebugEnabled()) { @@ -395,8 +401,10 @@ public void rehandshake(long timeout) throws IOException { } } } catch (IOException x) { + closeSilently(); throw x; } catch (Exception cx) { + closeSilently(); IOException x = new IOException(cx); throw x; } finally { @@ -430,7 +438,7 @@ protected SSLEngineResult handshakeWrap(boolean doWrite) throws IOException { //so we can clear it here. netOutBuffer.clear(); //perform the wrap - getBufHandler().configureWriteBufferForWrite(); + getBufHandler().configureWriteBufferForRead(); SSLEngineResult result = sslEngine.wrap(getBufHandler().getWriteBuffer(), netOutBuffer); //prepare the results to be written netOutBuffer.flip(); @@ -526,8 +534,8 @@ public void close() throws IOException { public void close(boolean force) throws IOException { try { close(); - }finally { - if ( force \|\| closed ) { + } finally { + if (force \|\| closed) { closed = true; sc.socket().close(); sc.close(); @@ -535,6 +543,18 @@ public void close(boolean force) throws IOException { } } + + private void closeSilently() { + try { + close(true); + } catch (IOException ioe) { + // This is expected - swallowing the exception is the reason this + // method exists. Log at debug in case someone is interested. + log.debug(sm.getString("channel.nio.ssl.closeSilentError"), ioe); + } + } + + /* * Reads a sequence of bytes from this channel into the given buffer. * @@ -694,10 +714,4 @@ public SSLEngine getSslEngine() { public ByteBuffer getEmptyBuf() { return emptyBuf; } - - @Override - public SocketChannel getIOChannel() { - return sc; - } - } \ No newline at end of file diff --git a/src/main/java/org/apache/tomcat/util/net/SendfileDataBase.java b/core/src/main/java/org/apache/tomcat/util/net/SendfileDataBase.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SendfileDataBase.java rename to core/src/main/java/org/apache/tomcat/util/net/SendfileDataBase.java diff --git a/src/main/java/org/apache/tomcat/util/net/SendfileKeepAliveState.java b/core/src/main/java/org/apache/tomcat/util/net/SendfileKeepAliveState.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SendfileKeepAliveState.java rename to core/src/main/java/org/apache/tomcat/util/net/SendfileKeepAliveState.java diff --git a/src/main/java/org/apache/tomcat/util/net/SendfileState.java b/core/src/main/java/org/apache/tomcat/util/net/SendfileState.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SendfileState.java rename to core/src/main/java/org/apache/tomcat/util/net/SendfileState.java diff --git a/src/main/java/org/apache/tomcat/util/net/SocketBufferHandler.java b/core/src/main/java/org/apache/tomcat/util/net/SocketBufferHandler.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SocketBufferHandler.java rename to core/src/main/java/org/apache/tomcat/util/net/SocketBufferHandler.java diff --git a/src/main/java/org/apache/tomcat/util/net/SocketEvent.java b/core/src/main/java/org/apache/tomcat/util/net/SocketEvent.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SocketEvent.java rename to core/src/main/java/org/apache/tomcat/util/net/SocketEvent.java diff --git a/src/main/java/org/apache/tomcat/util/net/SocketProcessorBase.java b/core/src/main/java/org/apache/tomcat/util/net/SocketProcessorBase.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SocketProcessorBase.java rename to core/src/main/java/org/apache/tomcat/util/net/SocketProcessorBase.java diff --git a/src/main/java/org/apache/tomcat/util/net/SocketProperties.java b/core/src/main/java/org/apache/tomcat/util/net/SocketProperties.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/SocketProperties.java rename to core/src/main/java/org/apache/tomcat/util/net/SocketProperties.java diff --git a/src/main/java/org/apache/tomcat/util/net/SocketWrapperBase.java b/core/src/main/java/org/apache/tomcat/util/net/SocketWrapperBase.java similarity index 98% rename from src/main/java/org/apache/tomcat/util/net/SocketWrapperBase.java rename to core/src/main/java/org/apache/tomcat/util/net/SocketWrapperBase.java index 3b490ff..a84b898 100644 --- a/src/main/java/org/apache/tomcat/util/net/SocketWrapperBase.java +++ b/core/src/main/java/org/apache/tomcat/util/net/SocketWrapperBase.java @@ -185,9 +185,13 @@ public long getWriteTimeout() { return this.writeTimeout; } + public void setKeepAliveLeft(int keepAliveLeft) { + this.keepAliveLeft = keepAliveLeft; + } - public void setKeepAliveLeft(int keepAliveLeft) { this.keepAliveLeft = keepAliveLeft;} - public int decrementKeepAlive() { return (--keepAliveLeft);} + public int decrementKeepAlive() { + return --keepAliveLeft; + } public String getRemoteHost() { if (remoteHost == null) { @@ -755,8 +759,12 @@ public void processSocket(SocketEvent socketStatus, boolean dispatch) { * @param sslSupport The SSL/TLS support instance currently being used by * the connection that may need updating after the client * authentication + * + * @throws IOException If authentication is required then there will be I/O + * with the client and this exception will be thrown if + * that goes wrong / - public abstract void doClientAuth(SSLSupport sslSupport); + public abstract void doClientAuth(SSLSupport sslSupport) throws IOException; public abstract SSLSupport getSslSupport(String clientCertProvider); diff --git a/src/main/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java b/core/src/main/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java similarity index 78% rename from src/main/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java rename to core/src/main/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java index dcfeef0..00fbd89 100644 --- a/src/main/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java +++ b/core/src/main/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java @@ -16,6 +16,8 @@ / package org.apache.tomcat.util.net; +import java.io.IOException; +import java.nio.BufferUnderflowException; import java.nio.ByteBuffer; import java.nio.charset.StandardCharsets; import java.util.ArrayList; @@ -23,6 +25,7 @@ import org.apache.juli.logging.Log; import org.apache.juli.logging.LogFactory; +import org.apache.tomcat.util.http.parser.HttpParser; import org.apache.tomcat.util.net.openssl.ciphers.Cipher; import org.apache.tomcat.util.res.StringManager; @@ -45,6 +48,14 @@ public class TLSClientHelloExtractor { private static final int TLS_EXTENSION_SERVER_NAME = 0; private static final int TLS_EXTENSION_ALPN = 16; + public static byte[] USE_TLS_RESPONSE = ("HTTP/1.1 400 \r\n" + + "Content-Type: text/plain;charset=ISO-8859-1\r\n" + + "Connection: close\r\n" + + "\r\n" + + "Bad Request\r\n" + + "This combination of host and port requires TLS.\r\n").getBytes(StandardCharsets.ISO_8859_1); + + /** * Creates the instance of the parser and processes the provided buffer. The * buffer position and limit will be modified during the execution of this @@ -52,11 +63,9 @@ public class TLSClientHelloExtractor { * exits. * * @param netInBuffer The buffer containing the TLS data to process + * @throws IOException If the client hello message is malformed / - public TLSClientHelloExtractor(ByteBuffer netInBuffer) { - // TODO: Detect use of http on a secure connection and provide a simple - // error page. - + public TLSClientHelloExtractor(ByteBuffer netInBuffer) throws IOException { // Buffer is in write mode at this point. Record the current position so // the buffer state can be restored at the end of this method. int pos = netInBuffer.position(); @@ -77,6 +86,10 @@ public TLSClientHelloExtractor(ByteBuffer netInBuffer) { } if (!isTLSHandshake(netInBuffer)) { + // Is the client trying to use clear text HTTP? + if (isHttp(netInBuffer)) { + result = ExtractorResult.NON_SECURE; + } return; } @@ -143,6 +156,8 @@ public TLSClientHelloExtractor(ByteBuffer netInBuffer) { } } result = ExtractorResult.COMPLETE; + } catch (BufferUnderflowException \| IllegalArgumentException e) { + throw new IOException(sm.getString("sniExtractor.clientHelloInvalid"), e); } finally { this.result = result; this.clientRequestedCiphers = clientRequestedCiphers; @@ -186,6 +201,7 @@ public List getClientRequestedApplicationProtocols() { } } + private static ExtractorResult handleIncompleteRead(ByteBuffer bb) { if (bb.limit() == bb.capacity()) { // Buffer not big enough @@ -221,6 +237,67 @@ private static boolean isTLSHandshake(ByteBuffer bb) { } + private static boolean isHttp(ByteBuffer bb) { + // Based on code in Http11InputBuffer + // Note: The actual request is not important. This code only checks that + // the buffer contains a correctly formatted HTTP request line. + // The method, target and protocol are not validated. + byte chr = 0; + bb.position(0); + + // Skip blank lines + do { + if (!bb.hasRemaining()) { + return false; + } + chr = bb.get(); + } while (chr == '\r' \|\| chr == '\n'); + + // Read the method + do { + if (!HttpParser.isToken(chr) \|\| !bb.hasRemaining()) { + return false; + } + chr = bb.get(); + } while (chr != ' ' && chr != '\t'); + + // Whitespace between method and target + while (chr == ' ' \|\| chr == '\t') { + if (!bb.hasRemaining()) { + return false; + } + chr = bb.get(); + } + + // Read the target + while (chr != ' ' && chr != '\t') { + if (HttpParser.isNotRequestTarget(chr) \|\| !bb.hasRemaining()) { + return false; + } + chr = bb.get(); + } + + // Whitespace between target and protocol + while (chr == ' ' \|\| chr == '\t') { + if (!bb.hasRemaining()) { + return false; + } + chr = bb.get(); + } + + // Read protocol + do { + if (!HttpParser.isHttpProtocol(chr) \|\| !bb.hasRemaining()) { + return false; + } + chr = bb.get(); + + } while (chr != '\r' && chr != '\n'); + + return true; + } + + private static boolean isAllRecordAvailable(ByteBuffer bb) { // Next two bytes (unsigned) are the size of the record. We need all of // it. @@ -279,10 +356,11 @@ private static void readAlpnExtension(ByteBuffer bb, List protocolNames) } - public static enum ExtractorResult { + public enum ExtractorResult { COMPLETE, NOT_PRESENT, UNDERFLOW, - NEED_READ + NEED_READ, + NON_SECURE } } diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/JSSEImplementation.java b/core/src/main/java/org/apache/tomcat/util/net/jsse/JSSEImplementation.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/jsse/JSSEImplementation.java rename to core/src/main/java/org/apache/tomcat/util/net/jsse/JSSEImplementation.java diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/JSSEKeyManager.java b/core/src/main/java/org/apache/tomcat/util/net/jsse/JSSEKeyManager.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/jsse/JSSEKeyManager.java rename to core/src/main/java/org/apache/tomcat/util/net/jsse/JSSEKeyManager.java diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/JSSESSLContext.java b/core/src/main/java/org/apache/tomcat/util/net/jsse/JSSESSLContext.java similarity index 62% rename from src/main/java/org/apache/tomcat/util/net/jsse/JSSESSLContext.java rename to core/src/main/java/org/apache/tomcat/util/net/jsse/JSSESSLContext.java index c4ec83d..856fd8f 100644 --- a/src/main/java/org/apache/tomcat/util/net/jsse/JSSESSLContext.java +++ b/core/src/main/java/org/apache/tomcat/util/net/jsse/JSSESSLContext.java @@ -20,6 +20,9 @@ import java.security.KeyManagementException; import java.security.NoSuchAlgorithmException; import java.security.SecureRandom; +import java.security.cert.X509Certificate; +import java.util.HashSet; +import java.util.Set; import javax.net.ssl.KeyManager; import javax.net.ssl.SSLEngine; @@ -27,12 +30,17 @@ import javax.net.ssl.SSLServerSocketFactory; import javax.net.ssl.SSLSessionContext; import javax.net.ssl.TrustManager; +import javax.net.ssl.X509KeyManager; +import javax.net.ssl.X509TrustManager; import org.apache.tomcat.util.net.SSLContext; class JSSESSLContext implements SSLContext { private javax.net.ssl.SSLContext context; + private KeyManager[] kms; + private TrustManager[] tms; + JSSESSLContext(String protocol) throws NoSuchAlgorithmException { context = javax.net.ssl.SSLContext.getInstance(protocol); } @@ -40,6 +48,8 @@ class JSSESSLContext implements SSLContext { @Override public void init(KeyManager[] kms, TrustManager[] tms, SecureRandom sr) throws KeyManagementException { + this.kms = kms; + this.tms = tms; context.init(kms, tms, sr); } @@ -67,4 +77,34 @@ public SSLParameters getSupportedSSLParameters() { return context.getSupportedSSLParameters(); } + @Override + public X509Certificate[] getCertificateChain(String alias) { + X509Certificate[] result = null; + if (kms != null) { + for (int i = 0; i < kms.length && result == null; i++) { + if (kms[i] instanceof X509KeyManager) { + result = ((X509KeyManager) kms[i]).getCertificateChain(alias); + } + } + } + return result; + } + + @Override + public X509Certificate[] getAcceptedIssuers() { + Set certs = new HashSet<>(); + if (tms != null) { + for (TrustManager tm : tms) { + if (tm instanceof X509TrustManager) { + X509Certificate[] accepted = ((X509TrustManager) tm).getAcceptedIssuers(); + if (accepted != null) { + for (X509Certificate c : accepted) { + certs.add(c); + } + } + } + } + } + return certs.toArray(new X509Certificate[certs.size()]); + } } diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/JSSESupport.java b/core/src/main/java/org/apache/tomcat/util/net/jsse/JSSESupport.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/jsse/JSSESupport.java rename to core/src/main/java/org/apache/tomcat/util/net/jsse/JSSESupport.java diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java b/core/src/main/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java similarity index 79% rename from src/main/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java rename to core/src/main/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java index 0b5b366..5d24e41 100644 --- a/src/main/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java +++ b/core/src/main/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java @@ -18,6 +18,7 @@ import java.io.IOException; import java.io.InputStream; +import java.security.Key; import java.security.KeyManagementException; import java.security.KeyStore; import java.security.NoSuchAlgorithmException; @@ -96,13 +97,14 @@ public class JSSEUtil extends SSLUtilBase { String[] implementedProtocolsArray = context.getSupportedSSLParameters().getProtocols(); implementedProtocols = new HashSet<>(implementedProtocolsArray.length); - // Filter out all the SSL protocols (SSLv2 and SSLv3) from the list of - // implemented protocols since they are no longer considered secure but - // allow SSLv2Hello. This has the effect of making it impossible to use - // SSLv2 or SSLv3 without source code changes. + // Filter out SSLv2 from the list of implemented protocols (just in case + // we are running on a JVM that supports it) since it is no longer + // considered secure but allow SSLv2Hello. + // Note SSLv3 is allowed despite known insecurities because some users + // still have a requirement for it. for (String protocol : implementedProtocolsArray) { String protocolUpper = protocol.toUpperCase(Locale.ENGLISH); - if (!"SSLV2HELLO".equals(protocolUpper)) { + if (!"SSLV2HELLO".equals(protocolUpper) && !"SSLV3".equals(protocolUpper)) { if (protocolUpper.contains("SSL")) { log.debug(sm.getString("jsse.excludeProtocol", protocol)); continue; @@ -170,7 +172,6 @@ public SSLContext createSSLContext(List negotiableProtocols) throws NoSu @Override public KeyManager[] getKeyManagers() throws Exception { - String keystoreType = certificate.getCertificateKeystoreType(); String keyAlias = certificate.getCertificateKeyAlias(); String algorithm = sslHostConfig.getKeyManagerAlgorithm(); String keyPass = certificate.getCertificateKeyPassword(); @@ -180,16 +181,24 @@ public KeyManager[] getKeyManagers() throws Exception { keyPass = certificate.getCertificateKeystorePassword(); } - KeyManager[] kms = null; - KeyStore ks = certificate.getCertificateKeystore(); + KeyStore ksUsed = ks; + + / + * Use an in memory key store where possible. + * For PEM format keys and certificates, it allows them to be imported + * into the expected format. + * For Java key stores with PKCS8 encoded keys (e.g. JKS files), it + * enables Tomcat to handle the case where multiple keys exist in the + * key store, each with a different password. The KeyManagerFactory + * can't handle that so using an in memory key store with just the + * required key works around that. + * Other keys stores (hardware, MS, etc.) will be used as is. + / + + char[] keyPassArray = keyPass.toCharArray(); if (ks == null) { - // create an in-memory keystore and import the private key - // and the certificate chain from the PEM files - ks = KeyStore.getInstance("JKS"); - ks.load(null, null); - PEMFile privateKeyFile = new PEMFile(SSLHostConfig.adjustRelativePath (certificate.getCertificateKeyFile() != null ? certificate.getCertificateKeyFile() : certificate.getCertificateFile()), keyPass); @@ -205,25 +214,60 @@ public KeyManager[] getKeyManagers() throws Exception { if (keyAlias == null) { keyAlias = "tomcat"; } - ks.setKeyEntry(keyAlias, privateKeyFile.getPrivateKey(), keyPass.toCharArray(), chain.toArray(new Certificate[chain.size()])); - } - if (keyAlias != null && !ks.isKeyEntry(keyAlias)) { - throw new IOException(sm.getString("jsse.alias_no_key_entry", keyAlias)); + // Switch to in-memory key store + ksUsed = KeyStore.getInstance("JKS"); + ksUsed.load(null, null); + ksUsed.setKeyEntry(keyAlias, privateKeyFile.getPrivateKey(), keyPass.toCharArray(), + chain.toArray(new Certificate[chain.size()])); + } else { + if (keyAlias != null && !ks.isKeyEntry(keyAlias)) { + throw new IOException(sm.getString("jsse.alias_no_key_entry", keyAlias)); + } else if (keyAlias == null) { + Enumeration aliases = ks.aliases(); + if (!aliases.hasMoreElements()) { + throw new IOException(sm.getString("jsse.noKeys")); + } + while (aliases.hasMoreElements() && keyAlias == null) { + keyAlias = aliases.nextElement(); + if (!ks.isKeyEntry(keyAlias)) { + keyAlias = null; + } + } + if (keyAlias == null) { + throw new IOException(sm.getString("jsse.alias_no_key_entry", (Object) null)); + } + } + + Key k = ks.getKey(keyAlias, keyPassArray); + if (k != null && "PKCS#8".equalsIgnoreCase(k.getFormat())) { + // Switch to in-memory key store + String provider = certificate.getCertificateKeystoreProvider(); + if (provider == null) { + ksUsed = KeyStore.getInstance(certificate.getCertificateKeystoreType()); + } else { + ksUsed = KeyStore.getInstance(certificate.getCertificateKeystoreType(), + provider); + } + ksUsed.load(null, null); + ksUsed.setKeyEntry(keyAlias, k, keyPassArray, ks.getCertificateChain(keyAlias)); + } + // Non-PKCS#8 key stores will use the original key store } + KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm); - kmf.init(ks, keyPass.toCharArray()); + kmf.init(ksUsed, keyPassArray); - kms = kmf.getKeyManagers(); - if (kms == null) { - return kms; - } + KeyManager[] kms = kmf.getKeyManagers(); - if (keyAlias != null) { + // Only need to filter keys by alias if there are key managers to filter + // and the original key store was used. The in memory key stores only + // have a single key so don't need filtering + if (kms != null && ksUsed == ks) { String alias = keyAlias; // JKS keystores always convert the alias name to lower case - if ("JKS".equals(keystoreType)) { + if ("JKS".equals(certificate.getCertificateKeystoreType())) { alias = alias.toLowerCase(Locale.ENGLISH); } for(int i = 0; i < kms.length; i++) { @@ -246,7 +290,7 @@ public TrustManager[] getTrustManagers() throws Exception { throw new InstantiationException(sm.getString( "jsse.invalidTrustManagerClassName", className)); } - Object trustManagerObject = clazz.newInstance(); + Object trustManagerObject = clazz.getConstructor().newInstance(); TrustManager trustManager = (TrustManager) trustManagerObject; return new TrustManager[]{ trustManager }; } diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings.properties similarity index 98% rename from src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings.properties index e5b8190..55b172b 100644 --- a/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings.properties +++ b/core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings.properties @@ -22,6 +22,7 @@ jsse.unsupported_ciphers=Some specified SSL ciphers are not supported by the SSL jsse.excludeProtocol=The SSL protocol [{0}] which is supported in this JRE was excluded from the protocols available to Tomcat jsse.noDefaultCiphers=Unable to determine a default for ciphers for [{0}]. Set an explicit value to ensure the connector can start. jsse.noDefaultProtocols=Unable to determine a default for sslEnabledProtocols. Set an explicit value to ensure the connector can start. +jsse.noKeys=No aliases for private keys found in key store jsse.exceptionOnClose=Failure to close socket. jsse.pemParseError=Unable to parse the key from [{0}] diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_es.properties b/core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_es.properties similarity index 99% rename from src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_es.properties rename to core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_es.properties index 6606990..0baa7f7 100644 --- a/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_es.properties +++ b/core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_es.properties @@ -12,6 +12,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. + jsse.alias_no_key_entry = El nombre de Alias [{0}] no identifica una entrada de clave jsse.invalid_ssl_conf = La configuraci\u00F3n SSL no es v\u00E1lida debido a [{0}] jsse.invalidTrustManagerClassName = El trustManagerClassName suministrado [{0}] no implementa javax.net.ssl.TrustManager diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_fr.properties b/core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_fr.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_fr.properties rename to core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_fr.properties diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_ja.properties b/core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_ja.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_ja.properties rename to core/src/main/java/org/apache/tomcat/util/net/jsse/LocalStrings_ja.properties diff --git a/src/main/java/org/apache/tomcat/util/net/jsse/PEMFile.java b/core/src/main/java/org/apache/tomcat/util/net/jsse/PEMFile.java similarity index 95% rename from src/main/java/org/apache/tomcat/util/net/jsse/PEMFile.java rename to core/src/main/java/org/apache/tomcat/util/net/jsse/PEMFile.java index 0087d9c..cb36759 100644 --- a/src/main/java/org/apache/tomcat/util/net/jsse/PEMFile.java +++ b/core/src/main/java/org/apache/tomcat/util/net/jsse/PEMFile.java @@ -18,8 +18,10 @@ import java.io.BufferedReader; import java.io.ByteArrayInputStream; -import java.io.FileReader; +import java.io.FileInputStream; import java.io.IOException; +import java.io.InputStreamReader; +import java.nio.charset.StandardCharsets; import java.security.GeneralSecurityException; import java.security.InvalidKeyException; import java.security.KeyFactory; @@ -71,7 +73,8 @@ public PEMFile(String filename, String password) throws IOException, GeneralSecu this.filename = filename; List parts = new ArrayList<>(); - try (BufferedReader in = new BufferedReader(new FileReader(filename))) { + try (BufferedReader in = new BufferedReader(new InputStreamReader( + new FileInputStream(filename), StandardCharsets.US_ASCII))) { Part part = null; String line; while ((line = in.readLine()) != null) { diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/net/openssl/LocalStrings.properties similarity index 68% rename from src/main/java/org/apache/tomcat/util/net/openssl/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/util/net/openssl/LocalStrings.properties index 60e1c97..1919159 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/LocalStrings.properties +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/LocalStrings.properties @@ -19,6 +19,23 @@ openssl.doubleInit=SSL context already initialized, ignoring openssl.certificateVerificationFailed=Certificate verification failed openssl.keyManagerMissing=No key manager found openssl.trustManagerMissing=No trust manager found +openssl.addedClientCaCert=Added client CA cert: [{0}] +openssl.makeConf=Creating OpenSSLConf context +openssl.errMakeConf=Could not create OpenSSLConf context +openssl.checkConf=Checking OpenSSLConf +openssl.errCheckConf=Error during OpenSSLConf check +openssl.assignConf=Assigning SSL context to OpenSSLConfCmd context +openssl.applyConf=Applying OpenSSLConfCmd to SSL context +openssl.errApplyConf=Could not apply OpenSSLConf to SSL context + +opensslconf.checkCommand=OpenSSLConf checking command (name [{0}], value [{1}]) +opensslconf.checkFailed=Failure while checking OpenSSLConf +opensslconf.applyCommand=OpenSSLConf applying command (name [{0}], value [{1}]) +opensslconf.applyFailed=Failure while applying OpenSSLConf to SSL context +opensslconf.failedCommand=OpenSSLConf failed command (name [{0}], value [{1}]) with result [{2}] - will be ignored +opensslconf.failedFinish=OpenSSLConf finish failed with result [{2}] +opensslconf.noCommandName=OpenSSLConf no command name - will be ignored (command value [{0}]) +opensslconf.resultCommand=OpenSSLConf command (name [{0}], value [{1}]) returned [{2}] engine.engineClosed=Engine is closed engine.renegotiationUnsupported=Renegotiation is not supported diff --git a/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLConf.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLConf.java new file mode 100644 index 0000000..2c255f2 --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLConf.java @@ -0,0 +1,128 @@ +/ + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.util.net.openssl; + +import java.io.Serializable; +import java.util.ArrayList; +import java.util.List; + +import org.apache.juli.logging.Log; +import org.apache.juli.logging.LogFactory; +import org.apache.tomcat.jni.SSLConf; +import org.apache.tomcat.util.res.StringManager; + +public class OpenSSLConf implements Serializable { + + private static final long serialVersionUID = 1L; + + private static final Log log = LogFactory.getLog(OpenSSLConf.class); + private static final StringManager sm = StringManager.getManager(OpenSSLConf.class); + + private final List commands = new ArrayList<>(); + + public void addCmd(OpenSSLConfCmd cmd) { + commands.add(cmd); + } + + public List getCommands() { + return commands; + } + + public boolean check(long cctx) throws Exception { + boolean result = true; + OpenSSLConfCmd cmd; + String name; + String value; + int rc; + for (int i = 0; i < commands.size(); i++) { + cmd = commands.get(i); + name = cmd.getName(); + value = cmd.getValue(); + if (name == null) { + log.error(sm.getString("opensslconf.noCommandName", value)); + result = false; + continue; + } + if (log.isDebugEnabled()) { + log.debug(sm.getString("opensslconf.checkCommand", name, value)); + } + try { + rc = SSLConf.check(cctx, name, value); + } catch (Exception e) { + log.error(sm.getString("opensslconf.checkFailed")); + return false; + } + if (rc <= 0) { + log.error(sm.getString("opensslconf.failedCommand", name, value, + Integer.toString(rc))); + result = false; + } else if (log.isDebugEnabled()) { + log.debug(sm.getString("opensslconf.resultCommand", name, value, + Integer.toString(rc))); + } + } + if (!result) { + log.error(sm.getString("opensslconf.checkFailed")); + } + return result; + } + + public boolean apply(long cctx, long ctx) throws Exception { + boolean result = true; + SSLConf.assign(cctx, ctx); + OpenSSLConfCmd cmd; + String name; + String value; + int rc; + for (int i = 0; i < commands.size(); i++) { + cmd = commands.get(i); + name = cmd.getName(); + value = cmd.getValue(); + if (name == null) { + log.error(sm.getString("opensslconf.noCommandName", value)); + result = false; + continue; + } + if (log.isDebugEnabled()) { + log.debug(sm.getString("opensslconf.applyCommand", name, value)); + } + try { + rc = SSLConf.apply(cctx, name, value); + } catch (Exception e) { + log.error(sm.getString("opensslconf.applyFailed")); + return false; + } + if (rc <= 0) { + log.error(sm.getString("opensslconf.failedCommand", name, value, + Integer.toString(rc))); + result = false; + } else if (log.isDebugEnabled()) { + log.debug(sm.getString("opensslconf.resultCommand", name, value, + Integer.toString(rc))); + } + } + rc = SSLConf.finish(cctx); + if (rc <= 0) { + log.error(sm.getString("opensslconf.finishFailed", Integer.toString(rc))); + result = false; + } + if (!result) { + log.error(sm.getString("opensslconf.applyFailed")); + } + return result; + } +} diff --git a/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLConfCmd.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLConfCmd.java new file mode 100644 index 0000000..3706009 --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLConfCmd.java @@ -0,0 +1,43 @@ +/ + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.util.net.openssl; + +import java.io.Serializable; + +public class OpenSSLConfCmd implements Serializable { + + private static final long serialVersionUID = 1L; + + private String name = null; + private String value = null; + + public String getName() { + return name; + } + + public void setName(String name) { + this.name = name; + } + + public String getValue() { + return value; + } + + public void setValue(String value) { + this.value = value; + } +} diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java similarity index 64% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java index a6716d1..da0574e 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java @@ -44,6 +44,7 @@ import org.apache.tomcat.jni.CertificateVerifier; import org.apache.tomcat.jni.Pool; import org.apache.tomcat.jni.SSL; +import org.apache.tomcat.jni.SSLConf; import org.apache.tomcat.jni.SSLContext; import org.apache.tomcat.util.net.AbstractEndpoint; import org.apache.tomcat.util.net.Constants; @@ -67,6 +68,8 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { private final SSLHostConfig sslHostConfig; private final SSLHostConfigCertificate certificate; private OpenSSLSessionContext sessionContext; + private X509KeyManager x509KeyManager; + private X509TrustManager x509TrustManager; private final List negotiableProtocols; @@ -89,6 +92,9 @@ public void setEnabledProtocol(String protocol) { private final long aprPool; private final AtomicInteger aprPoolDestroyed = new AtomicInteger(0); + // OpenSSLConfCmd context + protected final long cctx; + // SSL context protected final long ctx; static final CertificateFactory X509_CERT_FACTORY; @@ -113,33 +119,48 @@ public OpenSSLContext(SSLHostConfigCertificate certificate, List negotia aprPool = Pool.create(0); boolean success = false; try { + // Create OpenSSLConfCmd context if used + OpenSSLConf openSslConf = sslHostConfig.getOpenSslConf(); + if (openSslConf != null) { + try { + if (log.isDebugEnabled()) + log.debug(sm.getString("openssl.makeConf")); + cctx = SSLConf.make(aprPool, + SSL.SSL_CONF_FLAG_FILE \| + SSL.SSL_CONF_FLAG_SERVER \| + SSL.SSL_CONF_FLAG_CERTIFICATE \| + SSL.SSL_CONF_FLAG_SHOW_ERRORS); + } catch (Exception e) { + throw new SSLException(sm.getString("openssl.errMakeConf"), e); + } + } else { + cctx = 0; + } + sslHostConfig.setOpenSslConfContext(Long.valueOf(cctx)); + // SSL protocol int value = SSL.SSL_PROTOCOL_NONE; - if (sslHostConfig.getProtocols().size() == 0) { - value = SSL.SSL_PROTOCOL_ALL; - } else { - for (String protocol : sslHostConfig.getEnabledProtocols()) { - if (Constants.SSL_PROTO_SSLv2Hello.equalsIgnoreCase(protocol)) { - // NO-OP. OpenSSL always supports SSLv2Hello - } else if (Constants.SSL_PROTO_SSLv2.equalsIgnoreCase(protocol)) { - value \|= SSL.SSL_PROTOCOL_SSLV2; - } else if (Constants.SSL_PROTO_SSLv3.equalsIgnoreCase(protocol)) { - value \|= SSL.SSL_PROTOCOL_SSLV3; - } else if (Constants.SSL_PROTO_TLSv1.equalsIgnoreCase(protocol)) { - value \|= SSL.SSL_PROTOCOL_TLSV1; - } else if (Constants.SSL_PROTO_TLSv1_1.equalsIgnoreCase(protocol)) { - value \|= SSL.SSL_PROTOCOL_TLSV1_1; - } else if (Constants.SSL_PROTO_TLSv1_2.equalsIgnoreCase(protocol)) { - value \|= SSL.SSL_PROTOCOL_TLSV1_2; - } else if (Constants.SSL_PROTO_ALL.equalsIgnoreCase(protocol)) { - value \|= SSL.SSL_PROTOCOL_ALL; - } else { - // Protocol not recognized, fail to start as it is safer than - // continuing with the default which might enable more than the - // is required - throw new Exception(netSm.getString( - "endpoint.apr.invalidSslProtocol", protocol)); - } + for (String protocol : sslHostConfig.getEnabledProtocols()) { + if (Constants.SSL_PROTO_SSLv2Hello.equalsIgnoreCase(protocol)) { + // NO-OP. OpenSSL always supports SSLv2Hello + } else if (Constants.SSL_PROTO_SSLv2.equalsIgnoreCase(protocol)) { + value \|= SSL.SSL_PROTOCOL_SSLV2; + } else if (Constants.SSL_PROTO_SSLv3.equalsIgnoreCase(protocol)) { + value \|= SSL.SSL_PROTOCOL_SSLV3; + } else if (Constants.SSL_PROTO_TLSv1.equalsIgnoreCase(protocol)) { + value \|= SSL.SSL_PROTOCOL_TLSV1; + } else if (Constants.SSL_PROTO_TLSv1_1.equalsIgnoreCase(protocol)) { + value \|= SSL.SSL_PROTOCOL_TLSV1_1; + } else if (Constants.SSL_PROTO_TLSv1_2.equalsIgnoreCase(protocol)) { + value \|= SSL.SSL_PROTOCOL_TLSV1_2; + } else if (Constants.SSL_PROTO_ALL.equalsIgnoreCase(protocol)) { + value \|= SSL.SSL_PROTOCOL_ALL; + } else { + // Protocol not recognized, fail to start as it is safer than + // continuing with the default which might enable more than the + // is required + throw new Exception(netSm.getString( + "endpoint.apr.invalidSslProtocol", protocol)); } } @@ -173,6 +194,9 @@ public synchronized void destroy() { if (ctx != 0) { SSLContext.free(ctx); } + if (cctx != 0) { + SSLConf.free(cctx); + } if (aprPool != 0) { Pool.destroy(aprPool); } @@ -257,10 +281,6 @@ public synchronized void init(KeyManager[] kms, TrustManager[] tms, SecureRandom // Set certificate chain file SSLContext.setCertificateChainFile(ctx, SSLHostConfig.adjustRelativePath(certificate.getCertificateChainFile()), false); - // Support Client Certificates - SSLContext.setCACertificate(ctx, - SSLHostConfig.adjustRelativePath(sslHostConfig.getCaCertificateFile()), - SSLHostConfig.adjustRelativePath(sslHostConfig.getCaCertificatePath())); // Set revocation SSLContext.setCARevocation(ctx, SSLHostConfig.adjustRelativePath( @@ -268,17 +288,17 @@ public synchronized void init(KeyManager[] kms, TrustManager[] tms, SecureRandom SSLHostConfig.adjustRelativePath( sslHostConfig.getCertificateRevocationListPath())); } else { - X509KeyManager keyManager = chooseKeyManager(kms); + x509KeyManager = chooseKeyManager(kms); String alias = certificate.getCertificateKeyAlias(); if (alias == null) { alias = "tomcat"; } - X509Certificate[] chain = keyManager.getCertificateChain(alias); + X509Certificate[] chain = x509KeyManager.getCertificateChain(alias); if (chain == null) { - alias = findAlias(keyManager, certificate); - chain = keyManager.getCertificateChain(alias); + alias = findAlias(x509KeyManager, certificate); + chain = x509KeyManager.getCertificateChain(alias); } - PrivateKey key = keyManager.getPrivateKey(alias); + PrivateKey key = x509KeyManager.getPrivateKey(alias); StringBuilder sb = new StringBuilder(BEGIN_KEY); sb.append(Base64.getMimeEncoder(64, new byte[] {'\n'}).encodeToString(key.getEncoded())); sb.append(END_KEY); @@ -306,13 +326,14 @@ public synchronized void init(KeyManager[] kms, TrustManager[] tms, SecureRandom SSLContext.setVerify(ctx, value, sslHostConfig.getCertificateVerificationDepth()); if (tms != null) { - final X509TrustManager manager = chooseTrustManager(tms); + // Client certificate verification based on custom trust managers + x509TrustManager = chooseTrustManager(tms); SSLContext.setCertVerifyCallback(ctx, new CertificateVerifier() { @Override public boolean verify(long ssl, byte[][] chain, String auth) { X509Certificate[] peerCerts = certificates(chain); try { - manager.checkClientTrusted(peerCerts, auth); + x509TrustManager.checkClientTrusted(peerCerts, auth); return true; } catch (Exception e) { log.debug(sm.getString("openssl.certificateVerificationFailed"), e); @@ -320,10 +341,24 @@ public boolean verify(long ssl, byte[][] chain, String auth) { return false; } }); + // Pass along the DER encoded certificates of the accepted client + // certificate issuers, so that their subjects can be presented + // by the server during the handshake to allow the client choosing + // an acceptable certificate + for (X509Certificate caCert : x509TrustManager.getAcceptedIssuers()) { + SSLContext.addClientCACertificateRaw(ctx, caCert.getEncoded()); + if (log.isDebugEnabled()) + log.debug(sm.getString("openssl.addedClientCaCert", caCert.toString())); + } + } else { + // Client certificate verification based on trusted CA files and dirs + SSLContext.setCACertificate(ctx, + SSLHostConfig.adjustRelativePath(sslHostConfig.getCaCertificateFile()), + SSLHostConfig.adjustRelativePath(sslHostConfig.getCaCertificatePath())); } if (negotiableProtocols != null && negotiableProtocols.size() > 0) { - ArrayList protocols = new ArrayList<>(); + List protocols = new ArrayList<>(); protocols.addAll(negotiableProtocols); protocols.add("http/1.1"); String[] protocolsArray = protocols.toArray(new String[0]); @@ -331,7 +366,62 @@ public boolean verify(long ssl, byte[][] chain, String auth) { SSLContext.setNpnProtos(ctx, protocolsArray, SSL.SSL_SELECTOR_FAILURE_NO_ADVERTISE); } - sessionContext = new OpenSSLSessionContext(ctx); + // Apply OpenSSLConfCmd if used + OpenSSLConf openSslConf = sslHostConfig.getOpenSslConf(); + if (openSslConf != null && cctx != 0) { + // Check OpenSSLConfCmd if used + if (log.isDebugEnabled()) + log.debug(sm.getString("openssl.checkConf")); + try { + if (!openSslConf.check(cctx)) { + log.error(sm.getString("openssl.errCheckConf")); + throw new Exception(sm.getString("openssl.errCheckConf")); + } + } catch (Exception e) { + throw new Exception(sm.getString("openssl.errCheckConf"), e); + } + if (log.isDebugEnabled()) + log.debug(sm.getString("openssl.applyConf")); + try { + if (!openSslConf.apply(cctx, ctx)) { + log.error(sm.getString("openssl.errApplyConf")); + throw new SSLException(sm.getString("openssl.errApplyConf")); + } + } catch (Exception e) { + throw new SSLException(sm.getString("openssl.errApplyConf"), e); + } + // Reconfigure the enabled protocols + int opts = SSLContext.getOptions(ctx); + List enabled = new ArrayList<>(); + // Seems like there is no way to explicitly disable SSLv2Hello + // in OpenSSL so it is always enabled + enabled.add(Constants.SSL_PROTO_SSLv2Hello); + if ((opts & SSL.SSL_OP_NO_TLSv1) == 0) { + enabled.add(Constants.SSL_PROTO_TLSv1); + } + if ((opts & SSL.SSL_OP_NO_TLSv1_1) == 0) { + enabled.add(Constants.SSL_PROTO_TLSv1_1); + } + if ((opts & SSL.SSL_OP_NO_TLSv1_2) == 0) { + enabled.add(Constants.SSL_PROTO_TLSv1_2); + } + if ((opts & SSL.SSL_OP_NO_SSLv2) == 0) { + enabled.add(Constants.SSL_PROTO_SSLv2); + } + if ((opts & SSL.SSL_OP_NO_SSLv3) == 0) { + enabled.add(Constants.SSL_PROTO_SSLv3); + } + sslHostConfig.setEnabledProtocols( + enabled.toArray(new String[enabled.size()])); + // Reconfigure the enabled ciphers + sslHostConfig.setEnabledCiphers(SSLContext.getCiphers(ctx)); + } + + sessionContext = new OpenSSLSessionContext(this); + // If client authentication is being used, OpenSSL requires that + // this is set so always set it in case an app is configured to + // require it + sessionContext.setSessionIdContext(SSLContext.DEFAULT_SESSION_ID_CONTEXT); sslHostConfig.setOpenSslContext(Long.valueOf(ctx)); initialized = true; } catch (Exception e) { @@ -393,11 +483,17 @@ private static X509TrustManager chooseTrustManager(TrustManager[] managers) { private static X509Certificate[] certificates(byte[][] chain) { X509Certificate[] peerCerts = new X509Certificate[chain.length]; for (int i = 0; i < peerCerts.length; i++) { - peerCerts[i] = new OpenSslX509Certificate(chain[i]); + peerCerts[i] = new OpenSSLX509Certificate(chain[i]); } return peerCerts; } + + long getSSLContextID() { + return ctx; + } + + @Override public SSLSessionContext getServerSessionContext() { return sessionContext; @@ -406,7 +502,7 @@ public SSLSessionContext getServerSessionContext() { @Override public SSLEngine createSSLEngine() { return new OpenSSLEngine(ctx, defaultProtocol, false, sessionContext, - (negotiableProtocols != null && negotiableProtocols.size() > 0)); + (negotiableProtocols != null && negotiableProtocols.size() > 0), initialized); } @Override @@ -419,4 +515,49 @@ public SSLParameters getSupportedSSLParameters() { throw new UnsupportedOperationException(); } + @Override + public X509Certificate[] getCertificateChain(String alias) { + X509Certificate[] chain = null; + if (x509KeyManager != null) { + if (alias == null) { + alias = "tomcat"; + } + chain = x509KeyManager.getCertificateChain(alias); + if (chain == null) { + alias = findAlias(x509KeyManager, certificate); + chain = x509KeyManager.getCertificateChain(alias); + } + } + + return chain; + } + + @Override + public X509Certificate[] getAcceptedIssuers() { + X509Certificate[] acceptedCerts = null; + if (x509TrustManager != null) { + acceptedCerts = x509TrustManager.getAcceptedIssuers(); + } + return acceptedCerts; + } + + @Override + protected void finalize() throws Throwable { + / + * When an SSLHostConfig is replaced at runtime, it is not possible to + * call destroy() on the associated OpenSSLContext since it is likely + * that there will be in-progress connections using the OpenSSLContext. + * A reference chain has been deliberately established (see + * OpenSSLSessionContext) to ensure that the OpenSSLContext remains + * ineligible for GC while those connections are alive. Once those + * connections complete, the OpenSSLContext will become eligible for GC + * and this method will ensure that the associated native resources are + * cleaned up. + / + try { + destroy(); + } finally { + super.finalize(); + } + } } diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java similarity index 89% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java index 5e1e11b..a87a591 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java @@ -38,8 +38,6 @@ import javax.net.ssl.SSLSessionBindingEvent; import javax.net.ssl.SSLSessionBindingListener; import javax.net.ssl.SSLSessionContext; -import javax.security.cert.CertificateException; -import javax.security.cert.X509Certificate; import org.apache.juli.logging.Log; import org.apache.juli.logging.LogFactory; @@ -151,7 +149,8 @@ enum ClientAuthMode { private volatile String applicationProtocol; private volatile Certificate[] peerCerts; - private volatile X509Certificate[] x509PeerCerts; + @Deprecated + private volatile javax.security.cert.X509Certificate[] x509PeerCerts; private volatile ClientAuthMode clientAuth = ClientAuthMode.NONE; // SSL Engine status variables @@ -164,6 +163,7 @@ enum ClientAuthMode { private final String fallbackApplicationProtocol; private final OpenSSLSessionContext sessionContext; private final boolean alpn; + private final boolean initialized; private String selectedProtocol = null; @@ -173,15 +173,38 @@ enum ClientAuthMode { Creates a new instance * * @param sslCtx an OpenSSL {@code SSL_CTX} object - * @param alloc the {@link ByteBufAllocator} that will be used by this - * engine + * @param fallbackApplicationProtocol the fallback application protocol * @param clientMode {@code true} if this is used for clients, {@code false} * otherwise * @param sessionContext the {@link OpenSslSessionContext} this * {@link SSLEngine} belongs to. + * @param alpn {@code true} if alpn should be used, {@code false} + * otherwise + / + OpenSSLEngine(long sslCtx, String fallbackApplicationProtocol, + boolean clientMode, OpenSSLSessionContext sessionContext, + boolean alpn) { + this(sslCtx, fallbackApplicationProtocol, clientMode, sessionContext, + alpn, false); + } + + /* + * Creates a new instance + * + * @param sslCtx an OpenSSL {@code SSL_CTX} object + * @param fallbackApplicationProtocol the fallback application protocol + * @param clientMode {@code true} if this is used for clients, {@code false} + * otherwise + * @param sessionContext the {@link OpenSslSessionContext} this + * {@link SSLEngine} belongs to. + * @param alpn {@code true} if alpn should be used, {@code false} + * otherwise + * @param initialized {@code true} if this instance gets its protocol, + * cipher and client verification from the {@code SSL_CTX} {@code sslCtx} / OpenSSLEngine(long sslCtx, String fallbackApplicationProtocol, - boolean clientMode, OpenSSLSessionContext sessionContext, boolean alpn) { + boolean clientMode, OpenSSLSessionContext sessionContext, boolean alpn, + boolean initialized) { if (sslCtx == 0) { throw new IllegalArgumentException(sm.getString("engine.noSSLContext")); } @@ -194,6 +217,7 @@ enum ClientAuthMode { this.clientMode = clientMode; this.sessionContext = sessionContext; this.alpn = alpn; + this.initialized = initialized; } @Override @@ -677,7 +701,10 @@ public String[] getSupportedCipherSuites() { } @Override - public String[] getEnabledCipherSuites() { + public synchronized String[] getEnabledCipherSuites() { + if (destroyed) { + return new String[0]; + } String[] enabled = SSL.getCiphers(ssl); if (enabled == null) { return new String[0]; @@ -693,22 +720,28 @@ public String[] getEnabledCipherSuites() { } @Override - public void setEnabledCipherSuites(String[] cipherSuites) { + public synchronized void setEnabledCipherSuites(String[] cipherSuites) { + if (initialized) { + return; + } if (cipherSuites == null) { throw new IllegalArgumentException(sm.getString("engine.nullCipherSuite")); } + if (destroyed) { + return; + } final StringBuilder buf = new StringBuilder(); for (String cipherSuite : cipherSuites) { if (cipherSuite == null) { break; } String converted = OpenSSLCipherConfigurationParser.jsseToOpenSSL(cipherSuite); - if (converted != null) { - cipherSuite = converted; - } if (!AVAILABLE_CIPHER_SUITES.contains(cipherSuite)) { logger.debug(sm.getString("engine.unsupportedCipher", cipherSuite, converted)); } + if (converted != null) { + cipherSuite = converted; + } buf.append(cipherSuite); buf.append(':'); @@ -733,7 +766,10 @@ public String[] getSupportedProtocols() { } @Override - public String[] getEnabledProtocols() { + public synchronized String[] getEnabledProtocols() { + if (destroyed) { + return new String[0]; + } List enabled = new ArrayList<>(); // Seems like there is no way to explicitly disable SSLv2Hello in OpenSSL so it is always enabled enabled.add(Constants.SSL_PROTO_SSLv2Hello); @@ -762,11 +798,17 @@ public String[] getEnabledProtocols() { } @Override - public void setEnabledProtocols(String[] protocols) { + public synchronized void setEnabledProtocols(String[] protocols) { + if (initialized) { + return; + } if (protocols == null) { // This is correct from the API docs throw new IllegalArgumentException(); } + if (destroyed) { + return; + } boolean sslv2 = false; boolean sslv3 = false; boolean tlsv1 = false; @@ -1041,12 +1083,14 @@ private class OpenSSLSession implements SSLSession { @Override public byte[] getId() { - // We don't cache that to keep memory usage to a minimum. - byte[] id = SSL.getSessionId(ssl); - if (id == null) { - // The id should never be null, if it was null then the SESSION itself was not valid. - throw new IllegalStateException(sm.getString("engine.noSession")); + byte[] id; + synchronized (OpenSSLEngine.this) { + if (destroyed) { + throw new IllegalStateException(sm.getString("engine.noSession")); + } + id = SSL.getSessionId(ssl); } + return id; } @@ -1058,7 +1102,14 @@ public SSLSessionContext getSessionContext() { @Override public long getCreationTime() { // We need to multiply by 1000 as OpenSSL uses seconds and we need milliseconds. - return SSL.getTime(ssl) 1000L; + long creationTime = 0; + synchronized (OpenSSLEngine.this) { + if (destroyed) { + throw new IllegalStateException(sm.getString("engine.noSession")); + } + creationTime = SSL.getTime(ssl); + } + return creationTime * 1000L; } @Override @@ -1140,19 +1191,22 @@ public Certificate[] getPeerCertificates() throws SSLPeerUnverifiedException { // these are lazy created to reduce memory overhead Certificate[] c = peerCerts; if (c == null) { - if (SSL.isInInit(ssl) != 0) { - throw new SSLPeerUnverifiedException(sm.getString("engine.unverifiedPeer")); - } - byte[][] chain = SSL.getPeerCertChain(ssl); byte[] clientCert; - if (!clientMode) { - // if used on the server side SSL_get_peer_cert_chain(...) will not include the remote peer certificate. - // We use SSL_get_peer_certificate to get it in this case and add it to our array later. - // - // See https://www.openssl.org/docs/ssl/SSL_get_peer_cert_chain.html - clientCert = SSL.getPeerCertificate(ssl); - } else { - clientCert = null; + byte[][] chain; + synchronized (OpenSSLEngine.this) { + if (destroyed \|\| SSL.isInInit(ssl) != 0) { + throw new SSLPeerUnverifiedException(sm.getString("engine.unverifiedPeer")); + } + chain = SSL.getPeerCertChain(ssl); + if (!clientMode) { + // if used on the server side SSL_get_peer_cert_chain(...) will not include the remote peer certificate. + // We use SSL_get_peer_certificate to get it in this case and add it to our array later. + // + // See https://www.openssl.org/docs/ssl/SSL_get_peer_cert_chain.html + clientCert = SSL.getPeerCertificate(ssl); + } else { + clientCert = null; + } } if (chain == null && clientCert == null) { return null; @@ -1167,14 +1221,14 @@ public Certificate[] getPeerCertificates() throws SSLPeerUnverifiedException { if (clientCert != null) { len++; certificates = new Certificate[len]; - certificates[i++] = new OpenSslX509Certificate(clientCert); + certificates[i++] = new OpenSSLX509Certificate(clientCert); } else { certificates = new Certificate[len]; } if (chain != null) { int a = 0; for (; i < certificates.length; i++) { - certificates[i] = new OpenSslX509Certificate(chain[a++]); + certificates[i] = new OpenSSLX509Certificate(chain[a++]); } } c = peerCerts = certificates; @@ -1188,23 +1242,29 @@ public Certificate[] getLocalCertificates() { return EMPTY_CERTIFICATES; } + @Deprecated @Override - public X509Certificate[] getPeerCertificateChain() throws SSLPeerUnverifiedException { + public javax.security.cert.X509Certificate[] getPeerCertificateChain() + throws SSLPeerUnverifiedException { // these are lazy created to reduce memory overhead - X509Certificate[] c = x509PeerCerts; + javax.security.cert.X509Certificate[] c = x509PeerCerts; if (c == null) { - if (SSL.isInInit(ssl) != 0) { - throw new SSLPeerUnverifiedException(sm.getString("engine.unverifiedPeer")); + byte[][] chain; + synchronized (OpenSSLEngine.this) { + if (destroyed \|\| SSL.isInInit(ssl) != 0) { + throw new SSLPeerUnverifiedException(sm.getString("engine.unverifiedPeer")); + } + chain = SSL.getPeerCertChain(ssl); } - byte[][] chain = SSL.getPeerCertChain(ssl); if (chain == null) { throw new SSLPeerUnverifiedException(sm.getString("engine.unverifiedPeer")); } - X509Certificate[] peerCerts = new X509Certificate[chain.length]; + javax.security.cert.X509Certificate[] peerCerts = + new javax.security.cert.X509Certificate[chain.length]; for (int i = 0; i < peerCerts.length; i++) { try { - peerCerts[i] = X509Certificate.getInstance(chain[i]); - } catch (CertificateException e) { + peerCerts[i] = javax.security.cert.X509Certificate.getInstance(chain[i]); + } catch (javax.security.cert.CertificateException e) { throw new IllegalStateException(e); } } @@ -1237,11 +1297,18 @@ private Principal principal(Certificate[] certs) { @Override public String getCipherSuite() { - if (!handshakeFinished) { - return INVALID_CIPHER; - } if (cipher == null) { - String c = OpenSSLCipherConfigurationParser.openSSLToJsse(SSL.getCipherForSSL(ssl)); + String ciphers; + synchronized (OpenSSLEngine.this) { + if (!handshakeFinished) { + return INVALID_CIPHER; + } + if (destroyed) { + return INVALID_CIPHER; + } + ciphers = SSL.getCipherForSSL(ssl); + } + String c = OpenSSLCipherConfigurationParser.openSSLToJsse(ciphers); if (c != null) { cipher = c; } @@ -1253,7 +1320,12 @@ public String getCipherSuite() { public String getProtocol() { String applicationProtocol = OpenSSLEngine.this.applicationProtocol; if (applicationProtocol == null) { - applicationProtocol = SSL.getNextProtoNegotiated(ssl); + synchronized (OpenSSLEngine.this) { + if (destroyed) { + throw new IllegalStateException(sm.getString("engine.noSession")); + } + applicationProtocol = SSL.getNextProtoNegotiated(ssl); + } if (applicationProtocol == null) { applicationProtocol = fallbackApplicationProtocol; } @@ -1263,7 +1335,13 @@ public String getProtocol() { OpenSSLEngine.this.applicationProtocol = applicationProtocol = ""; } } - String version = SSL.getVersion(ssl); + String version; + synchronized (OpenSSLEngine.this) { + if (destroyed) { + throw new IllegalStateException(sm.getString("engine.noSession")); + } + version = SSL.getVersion(ssl); + } if (applicationProtocol.isEmpty()) { return version; } else { diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLImplementation.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLImplementation.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLImplementation.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLImplementation.java diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLKeyManager.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLKeyManager.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLKeyManager.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLKeyManager.java diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLProtocols.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLProtocols.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLProtocols.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLProtocols.java diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionContext.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionContext.java similarity index 78% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionContext.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionContext.java index ef52079..d28fafb 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionContext.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionContext.java @@ -34,11 +34,18 @@ public class OpenSSLSessionContext implements SSLSessionContext { private static final Enumeration EMPTY = new EmptyEnumeration(); private final OpenSSLSessionStats stats; - private final long context; - - OpenSSLSessionContext(long context) { + // This is deliberately unused. The reference is retained so that a + // reference chain is established and maintained to the OpenSSLContext while + // there is a connection that is using the OpenSSLContext. Therefore, the + // OpenSSLContext can not be eligible for GC while it is in use. + @SuppressWarnings("unused") + private final OpenSSLContext context; + private final long contextID; + + OpenSSLSessionContext(OpenSSLContext context) { this.context = context; - stats = new OpenSSLSessionStats(context); + this.contextID = context.getSSLContextID(); + stats = new OpenSSLSessionStats(contextID); } @Override @@ -60,7 +67,7 @@ public void setTicketKeys(byte[] keys) { if (keys == null) { throw new IllegalArgumentException(sm.getString("sessionContext.nullTicketKeys")); } - SSLContext.setSessionTicketKeys(context, keys); + SSLContext.setSessionTicketKeys(contextID, keys); } /** @@ -70,7 +77,7 @@ public void setTicketKeys(byte[] keys) { / public void setSessionCacheEnabled(boolean enabled) { long mode = enabled ? SSL.SSL_SESS_CACHE_SERVER : SSL.SSL_SESS_CACHE_OFF; - SSLContext.setSessionCacheMode(context, mode); + SSLContext.setSessionCacheMode(contextID, mode); } /* @@ -78,7 +85,7 @@ public void setSessionCacheEnabled(boolean enabled) { * otherwise. / public boolean isSessionCacheEnabled() { - return SSLContext.getSessionCacheMode(context) == SSL.SSL_SESS_CACHE_SERVER; + return SSLContext.getSessionCacheMode(contextID) == SSL.SSL_SESS_CACHE_SERVER; } /* @@ -93,12 +100,12 @@ public void setSessionTimeout(int seconds) { if (seconds < 0) { throw new IllegalArgumentException(); } - SSLContext.setSessionCacheTimeout(context, seconds); + SSLContext.setSessionCacheTimeout(contextID, seconds); } @Override public int getSessionTimeout() { - return (int) SSLContext.getSessionCacheTimeout(context); + return (int) SSLContext.getSessionCacheTimeout(contextID); } @Override @@ -106,12 +113,12 @@ public void setSessionCacheSize(int size) { if (size < 0) { throw new IllegalArgumentException(); } - SSLContext.setSessionCacheSize(context, size); + SSLContext.setSessionCacheSize(contextID, size); } @Override public int getSessionCacheSize() { - return (int) SSLContext.getSessionCacheSize(context); + return (int) SSLContext.getSessionCacheSize(contextID); } /** @@ -124,7 +131,7 @@ public int getSessionCacheSize() { * @return {@code true} if success, {@code false} otherwise. / public boolean setSessionIdContext(byte[] sidCtx) { - return SSLContext.setSessionIdContext(context, sidCtx); + return SSLContext.setSessionIdContext(contextID, sidCtx); } private static final class EmptyEnumeration implements Enumeration { diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionStats.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionStats.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionStats.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLSessionStats.java diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLUtil.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLUtil.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLUtil.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLUtil.java diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java similarity index 97% rename from src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java index 54f8307..de33204 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java @@ -32,12 +32,12 @@ import java.util.Date; import java.util.Set; -final class OpenSslX509Certificate extends X509Certificate { +final class OpenSSLX509Certificate extends X509Certificate { private final byte[] bytes; private X509Certificate wrapped; - public OpenSslX509Certificate(byte[] bytes) { + public OpenSSLX509Certificate(byte[] bytes) { this.bytes = bytes; } diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Authentication.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Authentication.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Authentication.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Authentication.java diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Cipher.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Cipher.java similarity index 94% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Cipher.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Cipher.java index 5f38973..5dc0a24 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Cipher.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Cipher.java @@ -3706,9 +3706,291 @@ public enum Cipher { null ), - / ARIA ciphers 0xC03C to 0xC071 + /* ARIA ciphers 0xC03C to 0xC04F * Unsupported by both Java and OpenSSL / + + TLS_RSA_WITH_ARIA_128_GCM_SHA256( + 0xC050, + "ARIA128-GCM-SHA256", + KeyExchange.RSA, + Authentication.RSA, + Encryption.ARIA128GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 128, + 128, + null, + null + ), + TLS_RSA_WITH_ARIA_256_GCM_SHA384( + 0xC051, + "ARIA256-GCM-SHA384", + KeyExchange.RSA, + Authentication.RSA, + Encryption.ARIA256GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 256, + 256, + null, + null + ), + TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256( + 0xC052, + "DHE-RSA-ARIA128-GCM-SHA256", + KeyExchange.EDH, + Authentication.RSA, + Encryption.ARIA128GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 128, + 128, + null, + null + ), + TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384( + 0xC053, + "DHE-RSA-ARIA256-GCM-SHA384", + KeyExchange.EDH, + Authentication.RSA, + Encryption.ARIA256GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 256, + 256, + null, + null + ), + + / ARIA ciphers 0xC054 to 0xC055 + * Unsupported by both Java and OpenSSL + / + + TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256( + 0xC056, + "DHE-DSS-ARIA128-GCM-SHA256", + KeyExchange.EDH, + Authentication.DSS, + Encryption.ARIA128GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 128, + 128, + null, + null + ), + TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384( + 0xC057, + "DHE-DSS-ARIA256-GCM-SHA384", + KeyExchange.EDH, + Authentication.DSS, + Encryption.ARIA256GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 256, + 256, + null, + null + ), + + / ARIA ciphers 0xC058 to 0xC05B + * Unsupported by both Java and OpenSSL + / + + TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256( + 0xC05C, + "ECDHE-ECDSA-ARIA128-GCM-SHA256", + KeyExchange.EECDH, + Authentication.ECDSA, + Encryption.ARIA128GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 128, + 128, + null, + null + ), + TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384( + 0xC05D, + "ECDHE-ECDSA-ARIA256-GCM-SHA384", + KeyExchange.EECDH, + Authentication.ECDSA, + Encryption.ARIA256GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 256, + 256, + null, + null + ), + + / ARIA ciphers 0xC05E to 0xC05F + * Unsupported by both Java and OpenSSL + / + + TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256( + 0xC060, + "ECDHE-ARIA128-GCM-SHA256", + KeyExchange.EECDH, + Authentication.RSA, + Encryption.ARIA128GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 128, + 128, + null, + null + ), + TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384( + 0xC061, + "ECDHE-ARIA256-GCM-SHA384", + KeyExchange.EECDH, + Authentication.RSA, + Encryption.ARIA256GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 256, + 256, + null, + null + ), + + / ARIA ciphers 0xC062 to 0xC069 + * Unsupported by both Java and OpenSSL + / + + TLS_PSK_WITH_ARIA_128_GCM_SHA256( + 0xC06A, + "PSK-ARIA128-GCM-SHA256", + KeyExchange.PSK, + Authentication.PSK, + Encryption.ARIA128GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 128, + 128, + null, + null + ), + TLS_PSK_WITH_ARIA_256_GCM_SHA384( + 0xC06B, + "PSK-ARIA256-GCM-SHA384", + KeyExchange.PSK, + Authentication.PSK, + Encryption.ARIA256GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 256, + 256, + null, + null + ), + TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256( + 0xC06C, + "DHE-PSK-ARIA128-GCM-SHA256", + KeyExchange.DHEPSK, + Authentication.PSK, + Encryption.ARIA128GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 128, + 128, + null, + null + ), + TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384( + 0xC06D, + "DHE-PSK-ARIA256-GCM-SHA384", + KeyExchange.DHEPSK, + Authentication.PSK, + Encryption.ARIA256GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 256, + 256, + null, + null + ), + TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256( + 0xC06E, + "RSA-PSK-ARIA128-GCM-SHA256", + KeyExchange.RSAPSK, + Authentication.RSA, + Encryption.ARIA128GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 128, + 128, + null, + null + ), + TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384( + 0xC06F, + "RSA-PSK-ARIA256-GCM-SHA384", + KeyExchange.RSAPSK, + Authentication.RSA, + Encryption.ARIA256GCM, + MessageDigest.AEAD, + Protocol.TLSv1_2, + false, + EncryptionLevel.HIGH, + false, + 256, + 256, + null, + null + ), + + / ARIA ciphers 0xC070 to 0xC071 + * Unsupported by both Java and OpenSSL + / + // Cipher C072 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256( 0xC072, diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Encryption.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Encryption.java similarity index 96% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Encryption.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Encryption.java index 56d6bbc..09aa32f 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Encryption.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Encryption.java @@ -26,6 +26,8 @@ enum Encryption { AES256CCM, AES256CCM8, AES256GCM, + ARIA128GCM, + ARIA256GCM, CAMELLIA256, CAMELLIA128, CHACHA20POLY1305, @@ -37,5 +39,5 @@ enum Encryption { FZA, RC4, RC2, - eNULL; + eNULL } diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/EncryptionLevel.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/EncryptionLevel.java similarity index 98% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/EncryptionLevel.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/EncryptionLevel.java index f779df2..466828a 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/EncryptionLevel.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/EncryptionLevel.java @@ -24,5 +24,5 @@ enum EncryptionLevel { LOW, MEDIUM, HIGH, - FIPS; + FIPS } diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/KeyExchange.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/KeyExchange.java similarity index 99% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/KeyExchange.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/KeyExchange.java index 70ab0b7..945b63d 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/KeyExchange.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/KeyExchange.java @@ -32,5 +32,5 @@ enum KeyExchange { SRP / SSL_kSRP - SRP /, RSAPSK, ECDHEPSK, - DHEPSK; + DHEPSK } diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/LocalStrings.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/LocalStrings.properties diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/MessageDigest.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/MessageDigest.java similarity index 98% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/MessageDigest.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/MessageDigest.java index 718a002..967930a 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/MessageDigest.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/MessageDigest.java @@ -24,5 +24,5 @@ enum MessageDigest { GOST89MAC, SHA256, SHA384, - AEAD; + AEAD } diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java similarity index 91% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java index 80cbf48..60433db 100644 --- a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java +++ b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java @@ -263,6 +263,18 @@ public class OpenSSLCipherConfigurationParser { AES in Counter with CBC-MAC Mode and 8-byte authentication (CCM8). / private static final String AESCCM8 = "AESCCM8"; + /* + * Cipher suites using either 128 bit ARIA. + / + private static final String ARIA128 = "ARIA128"; + /* + * Cipher suites using either 256 bit ARIA. + / + private static final String ARIA256 = "ARIA256"; + /* + * Cipher suites using either 128 or 256 bit ARIA. + / + private static final String ARIA = "ARIA"; /* * Cipher suites using 128 bit CAMELLIA. / @@ -488,6 +500,9 @@ private static final void init() { addListAlias(AES128, filterByEncryption(allCiphers, new HashSet<>(Arrays.asList(Encryption.AES128, Encryption.AES128CCM, Encryption.AES128CCM8, Encryption.AES128GCM)))); addListAlias(AES256, filterByEncryption(allCiphers, new HashSet<>(Arrays.asList(Encryption.AES256, Encryption.AES256CCM, Encryption.AES256CCM8, Encryption.AES256GCM)))); addListAlias(AES, filterByEncryption(allCiphers, new HashSet<>(Arrays.asList(Encryption.AES128, Encryption.AES128CCM, Encryption.AES128CCM8, Encryption.AES128GCM, Encryption.AES256, Encryption.AES256CCM, Encryption.AES256CCM8, Encryption.AES256GCM)))); + addListAlias(ARIA128, filterByEncryption(allCiphers, Collections.singleton(Encryption.ARIA128GCM))); + addListAlias(ARIA256, filterByEncryption(allCiphers, Collections.singleton(Encryption.ARIA256GCM))); + addListAlias(ARIA, filterByEncryption(allCiphers, new HashSet<>(Arrays.asList(Encryption.ARIA128GCM, Encryption.ARIA256GCM)))); addListAlias(AESGCM, filterByEncryption(allCiphers, new HashSet<>(Arrays.asList(Encryption.AES128GCM, Encryption.AES256GCM)))); addListAlias(AESCCM, filterByEncryption(allCiphers, new HashSet<>(Arrays.asList(Encryption.AES128CCM, Encryption.AES128CCM8, Encryption.AES256CCM, Encryption.AES256CCM8)))); addListAlias(AESCCM8, filterByEncryption(allCiphers, new HashSet<>(Arrays.asList(Encryption.AES128CCM8, Encryption.AES256CCM8)))); @@ -524,7 +539,7 @@ private static final void init() { addListAlias(SRP, filterByKeyExchange(allCiphers, Collections.singleton(KeyExchange.SRP))); initialized = true; // Despite what the OpenSSL docs say, DEFAULT also excludes SSLv2 - addListAlias(DEFAULT, parse("ALL:!EXPORT:!eNULL:!aNULL:!SSLv2:!DES:!RC2:!RC4:!DSS:!SEED:!IDEA:!CAMELLIA:!AESCCM:!3DES")); + addListAlias(DEFAULT, parse("ALL:!EXPORT:!eNULL:!aNULL:!SSLv2:!DES:!RC2:!RC4:!DSS:!SEED:!IDEA:!CAMELLIA:!AESCCM:!3DES:!ARIA")); // COMPLEMENTOFDEFAULT is also not exactly as defined by the docs LinkedHashSet complementOfDefault = filterByKeyExchange(all, new HashSet<>(Arrays.asList(KeyExchange.EDH,KeyExchange.EECDH))); complementOfDefault = filterByAuthentication(complementOfDefault, Collections.singleton(Authentication.aNULL)); @@ -540,6 +555,7 @@ private static final void init() { complementOfDefault.addAll(aliases.get(IDEA)); complementOfDefault.addAll(aliases.get(CAMELLIA)); complementOfDefault.addAll(aliases.get(AESCCM)); + complementOfDefault.addAll(aliases.get(ARIA)); defaultSort(complementOfDefault); addListAlias(COMPLEMENTOFDEFAULT, complementOfDefault); } @@ -824,4 +840,76 @@ static String displayResult(Collection ciphers, boolean useJSSEFormat, S } return builder.toString().substring(0, builder.length() - 1); } + + public static void usage() { + System.out.println("Usage: java " + OpenSSLCipherConfigurationParser.class.getName() + " [options] cipherspec"); + System.out.println(); + System.out.println("Displays the TLS cipher suites matching the cipherspec."); + System.out.println(); + System.out.println(" --help,"); + System.out.println(" -h Print this help message"); + System.out.println(" --openssl Show OpenSSL cipher suite names instead of IANA cipher suite names."); + System.out.println(" --verbose,"); + System.out.println(" -v Provide detailed cipher listing"); + } + + public static void main(String[] args) throws Exception + { + boolean verbose = false; + boolean useOpenSSLNames = false; + int argindex; + for(argindex = 0; argindex < args.length; ++argindex) + { + String arg = args[argindex]; + if("--verbose".equals(arg) \|\| "-v".equals(arg)) + verbose = true; + else if("--openssl".equals(arg)) + useOpenSSLNames = true; + else if("--help".equals(arg) \|\| "-h".equals(arg)) { + usage(); + System.exit(0); + } + else if("--".equals(arg)) { + ++argindex; + break; + } else if(arg.startsWith("-")) { + System.out.println("Unknown option: " + arg); + usage(); + System.exit(1); + } else { + // Non-switch argument... probably the cipher spec + break; + } + } + + String cipherSpec; + if(argindex < args.length) { + cipherSpec = args[argindex]; + } else { + cipherSpec = "DEFAULT"; + } + Set ciphers = parse(cipherSpec); + boolean first = true; + if(null != ciphers && 0 < ciphers.size()) { + for(Cipher cipher : ciphers) + { + if(first) { + first = false; + } else { + if(!verbose) + System.out.print(','); + } + if(useOpenSSLNames) + System.out.print(cipher.getOpenSSLAlias()); + else + System.out.print(cipher.name()); + if(verbose) { + System.out.println("\t" + cipher.getProtocol() + "\tKx=" + cipher.getKx() + "\tAu=" + cipher.getAu() + "\tEnc=" + cipher.getEnc() + "\tMac=" + cipher.getMac()); + } + } + System.out.println(); + } else { + System.out.println("No ciphers match '" + cipherSpec + "'"); + } + } } diff --git a/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Protocol.java b/core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Protocol.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Protocol.java rename to core/src/main/java/org/apache/tomcat/util/net/openssl/ciphers/Protocol.java diff --git a/src/main/java/org/apache/tomcat/util/res/StringManager.java b/core/src/main/java/org/apache/tomcat/util/res/StringManager.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/res/StringManager.java rename to core/src/main/java/org/apache/tomcat/util/res/StringManager.java diff --git a/core/src/main/java/org/apache/tomcat/util/scan/AbstractInputStreamJar.java b/core/src/main/java/org/apache/tomcat/util/scan/AbstractInputStreamJar.java new file mode 100644 index 0000000..4d1d6ac --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/util/scan/AbstractInputStreamJar.java @@ -0,0 +1,282 @@ +/ + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.util.scan; + +import java.io.IOException; +import java.io.InputStream; +import java.net.URL; +import java.util.HashMap; +import java.util.Map; +import java.util.Map.Entry; +import java.util.jar.JarEntry; +import java.util.jar.Manifest; + +import org.apache.tomcat.Jar; +import org.apache.tomcat.util.compat.JreCompat; + +/* + * Base implementation of Jar for implementations that use a JarInputStream to + * access the JAR file. + / +public abstract class AbstractInputStreamJar implements Jar { + + private final URL jarFileURL; + + private NonClosingJarInputStream jarInputStream = null; + private JarEntry entry = null; + private Boolean multiRelease = null; + private Map mrMap = null; + + public AbstractInputStreamJar(URL jarFileUrl) { + this.jarFileURL = jarFileUrl; + } + + + @Override + public URL getJarFileURL() { + return jarFileURL; + } + + + @Override + public void nextEntry() { + if (jarInputStream == null) { + try { + reset(); + } catch (IOException e) { + entry = null; + return; + } + } + try { + entry = jarInputStream.getNextJarEntry(); + if (multiRelease.booleanValue()) { + // Skip base entries where there is a multi-release entry + // Skip multi-release entries that are not being used + while (entry != null && + (mrMap.keySet().contains(entry.getName()) \|\| + entry.getName().startsWith("META-INF/versions/") && + !mrMap.values().contains(entry.getName()))) { + entry = jarInputStream.getNextJarEntry(); + } + } else { + // Skip multi-release entries + while (entry != null && entry.getName().startsWith("META-INF/versions/")) { + entry = jarInputStream.getNextJarEntry(); + } + } + } catch (IOException ioe) { + entry = null; + } + } + + + @Override + public String getEntryName() { + // Given how the entry name is used, there is no requirement to convert + // the name for a multi-release entry to the corresponding base name. + if (entry == null) { + return null; + } else { + return entry.getName(); + } + } + + + @Override + public InputStream getEntryInputStream() throws IOException { + return jarInputStream; + } + + + @Override + public InputStream getInputStream(String name) throws IOException { + gotoEntry(name); + if (entry == null) { + return null; + } else { + // Clear the entry so that multiple calls to this method for the + // same entry will result in a new InputStream for each call + // (BZ 60798) + entry = null; + return jarInputStream; + } + } + + + @Override + public long getLastModified(String name) throws IOException { + gotoEntry(name); + if (entry == null) { + return -1; + } else { + return entry.getTime(); + } + } + + + @Override + public String getURL(String entry) { + StringBuilder result = new StringBuilder("jar:"); + result.append(getJarFileURL().toExternalForm()); + result.append("!/"); + result.append(entry); + + return result.toString(); + } + + + @Override + public Manifest getManifest() throws IOException { + reset(); + return jarInputStream.getManifest(); + } + + + @Override + public void reset() throws IOException { + closeStream(); + entry = null; + jarInputStream = createJarInputStream(); + // Only perform multi-release processing on first access + if (multiRelease == null) { + if (JreCompat.isJre9Available()) { + Manifest manifest = jarInputStream.getManifest(); + if (manifest == null) { + multiRelease = Boolean.FALSE; + } else { + String mrValue = manifest.getMainAttributes().getValue("Multi-Release"); + if (mrValue == null) { + multiRelease = Boolean.FALSE; + } else { + multiRelease = Boolean.valueOf(mrValue); + } + } + } else { + multiRelease = Boolean.FALSE; + } + if (multiRelease.booleanValue()) { + if (mrMap == null) { + populateMrMap(); + } + } + } + } + + + protected void closeStream() { + if (jarInputStream != null) { + try { + jarInputStream.reallyClose(); + } catch (IOException ioe) { + // Ignore + } + } + } + + + protected abstract NonClosingJarInputStream createJarInputStream() throws IOException; + + + private void gotoEntry(String name) throws IOException { + boolean needsReset = true; + if (multiRelease == null) { + reset(); + needsReset = false; + } + + // Need to convert requested name to multi-release name (if one exists) + if (multiRelease.booleanValue()) { + String mrName = mrMap.get(name); + if (mrName != null) { + name = mrName; + } + } else if (name.startsWith("META-INF/versions/")) { + entry = null; + return; + } + + if (entry != null && name.equals(entry.getName())) { + return; + } + if (needsReset) { + reset(); + } + + JarEntry jarEntry = jarInputStream.getNextJarEntry(); + while (jarEntry != null) { + if (name.equals(jarEntry.getName())) { + entry = jarEntry; + break; + } + jarEntry = jarInputStream.getNextJarEntry(); + } + } + + + private void populateMrMap() throws IOException { + int targetVersion = JreCompat.getInstance().jarFileRuntimeMajorVersion(); + + Map mrVersions = new HashMap<>(); + + JarEntry jarEntry = jarInputStream.getNextJarEntry(); + + // Tracking the base name and the latest valid version found is + // sufficient to be able to create the renaming map required + while (jarEntry != null) { + String name = jarEntry.getName(); + if (name.startsWith("META-INF/versions/") && name.endsWith(".class")) { + + // Get the base name and version for this versioned entry + int i = name.indexOf('/', 18); + if (i > 0) { + String baseName = name.substring(i + 1); + int version = Integer.parseInt(name.substring(18, i)); + + // Ignore any entries targeting for a later version than + // the target for this runtime + if (version <= targetVersion) { + Integer mappedVersion = mrVersions.get(baseName); + if (mappedVersion == null) { + // No version found for this name. Create one. + mrVersions.put(baseName, Integer.valueOf(version)); + } else { + // Ignore any entry for which we have already found + // a later version + if (version > mappedVersion.intValue()) { + // Replace the earlier version + mrVersions.put(baseName, Integer.valueOf(version)); + } + } + } + } + } + jarEntry = jarInputStream.getNextJarEntry(); + } + + mrMap = new HashMap<>(); + + for (Entry mrVersion : mrVersions.entrySet()) { + mrMap.put(mrVersion.getKey() , "META-INF/versions/" + mrVersion.getValue().toString() + + "/" + mrVersion.getKey()); + } + + // Reset stream back to the beginning of the JAR + closeStream(); + jarInputStream = createJarInputStream(); + } +} diff --git a/src/main/java/org/apache/tomcat/util/scan/Constants.java b/core/src/main/java/org/apache/tomcat/util/scan/Constants.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/scan/Constants.java rename to core/src/main/java/org/apache/tomcat/util/scan/Constants.java diff --git a/src/main/java/org/apache/tomcat/util/scan/JarFactory.java b/core/src/main/java/org/apache/tomcat/util/scan/JarFactory.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/scan/JarFactory.java rename to core/src/main/java/org/apache/tomcat/util/scan/JarFactory.java diff --git a/src/main/java/org/apache/tomcat/util/scan/JarFileUrlJar.java b/core/src/main/java/org/apache/tomcat/util/scan/JarFileUrlJar.java similarity index 63% rename from src/main/java/org/apache/tomcat/util/scan/JarFileUrlJar.java rename to core/src/main/java/org/apache/tomcat/util/scan/JarFileUrlJar.java index 11c8d8c..0611b0a 100644 --- a/src/main/java/org/apache/tomcat/util/scan/JarFileUrlJar.java +++ b/core/src/main/java/org/apache/tomcat/util/scan/JarFileUrlJar.java @@ -23,23 +23,28 @@ import java.net.URISyntaxException; import java.net.URL; import java.util.Enumeration; +import java.util.HashSet; +import java.util.Set; import java.util.jar.JarEntry; import java.util.jar.JarFile; import java.util.jar.Manifest; import java.util.zip.ZipEntry; import org.apache.tomcat.Jar; +import org.apache.tomcat.util.compat.JreCompat; /* * Implementation of {@link Jar} that is optimised for file based JAR URLs that * refer directly to a JAR file (e.g URLs of the form jar:file: ... .jar!/ or - * file:... .jar) . + * file:... .jar). / public class JarFileUrlJar implements Jar { private final JarFile jarFile; private final URL jarFileURL; + private final boolean multiRelease; private Enumeration entries; + private Set entryNamesSeen; private JarEntry entry = null; public JarFileUrlJar(URL url, boolean startsWithJar) throws IOException { @@ -57,9 +62,10 @@ public JarFileUrlJar(URL url, boolean startsWithJar) throws IOException { } catch (URISyntaxException e) { throw new IOException(e); } - jarFile = new JarFile(f); + jarFile = JreCompat.getInstance().jarFileNewInstance(f); jarFileURL = url; } + multiRelease = JreCompat.getInstance().jarFileIsMultiRelease(jarFile); } @@ -69,14 +75,9 @@ public URL getJarFileURL() { } - @Override - public boolean entryExists(String name) { - ZipEntry entry = jarFile.getEntry(name); - return entry != null; - } - @Override public InputStream getInputStream(String name) throws IOException { + // JarFile#getEntry() is multi-release aware ZipEntry entry = jarFile.getEntry(name); if (entry == null) { return null; @@ -87,6 +88,7 @@ public InputStream getInputStream(String name) throws IOException { @Override public long getLastModified(String name) throws IOException { + // JarFile#getEntry() is multi-release aware ZipEntry entry = jarFile.getEntry(name); if (entry == null) { return -1; @@ -118,13 +120,58 @@ public void close() { @Override public void nextEntry() { + // JarFile#entries() is NOT multi-release aware if (entries == null) { entries = jarFile.entries(); + if (multiRelease) { + entryNamesSeen = new HashSet<>(); + } } - if (entries.hasMoreElements()) { - entry = entries.nextElement(); + + if (multiRelease) { + // Need to ensure that: + // - the one, correct entry is returned where multiple versions + // are available + // - that the order of entries in the JAR doesn't prevent the + // correct entries being returned + // - the case where an entry appears in the versions location + // but not in the the base location is handled correctly + + // Enumerate the entries until one is reached that represents an + // entry that has not been seen before. + String name = null; + while (true) { + if (entries.hasMoreElements()) { + entry = entries.nextElement(); + name = entry.getName(); + // Get 'base' name + if (name.startsWith("META-INF/versions/")) { + int i = name.indexOf('/', 18); + if (i == -1) { + continue; + } + name = name.substring(i + 1); + } + if (name.length() == 0 \|\| entryNamesSeen.contains(name)) { + continue; + } + + entryNamesSeen.add(name); + + // JarFile.getJarEntry is version aware so use it + entry = jarFile.getJarEntry(entry.getName()); + break; + } else { + entry = null; + break; + } + } } else { - entry = null; + if (entries.hasMoreElements()) { + entry = entries.nextElement(); + } else { + entry = null; + } } } @@ -155,6 +202,7 @@ public Manifest getManifest() throws IOException { @Override public void reset() throws IOException { entries = null; + entryNamesSeen = null; entry = null; } } diff --git a/src/main/java/org/apache/tomcat/util/scan/JarFileUrlNestedJar.java b/core/src/main/java/org/apache/tomcat/util/scan/JarFileUrlNestedJar.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/scan/JarFileUrlNestedJar.java rename to core/src/main/java/org/apache/tomcat/util/scan/JarFileUrlNestedJar.java diff --git a/src/main/java/org/apache/tomcat/util/scan/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/scan/LocalStrings.properties similarity index 94% rename from src/main/java/org/apache/tomcat/util/scan/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/util/scan/LocalStrings.properties index 0dab4cb..29592ba 100644 --- a/src/main/java/org/apache/tomcat/util/scan/LocalStrings.properties +++ b/core/src/main/java/org/apache/tomcat/util/scan/LocalStrings.properties @@ -17,6 +17,7 @@ jarScan.classloaderFail=Failed to scan [{0}] from classloader hierarchy jarScan.classloaderStart=Scanning for JARs in classloader hierarchy jarScan.classloaderJarScan=Scanning JAR [{0}] from classpath jarScan.classloaderJarNoScan=Not scanning JAR [{0}] from classpath +jarScan.classPath.badEntry=The class path entry [{0}] could not be converted to a URL jarScan.jarUrlStart=Scanning JAR at URL [{0}] jarScan.webinfclassesFail=Failed to scan /WEB-INF/classes jarScan.webinflibFail=Failed to scan JAR [{0}] from /WEB-INF/lib diff --git a/src/main/java/org/apache/tomcat/util/scan/NonClosingJarInputStream.java b/core/src/main/java/org/apache/tomcat/util/scan/NonClosingJarInputStream.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/scan/NonClosingJarInputStream.java rename to core/src/main/java/org/apache/tomcat/util/scan/NonClosingJarInputStream.java diff --git a/src/main/java/org/apache/tomcat/util/scan/StandardJarScanFilter.java b/core/src/main/java/org/apache/tomcat/util/scan/StandardJarScanFilter.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/scan/StandardJarScanFilter.java rename to core/src/main/java/org/apache/tomcat/util/scan/StandardJarScanFilter.java diff --git a/src/main/java/org/apache/tomcat/util/scan/StandardJarScanner.java b/core/src/main/java/org/apache/tomcat/util/scan/StandardJarScanner.java similarity index 76% rename from src/main/java/org/apache/tomcat/util/scan/StandardJarScanner.java rename to core/src/main/java/org/apache/tomcat/util/scan/StandardJarScanner.java index 5238d3c..cb8d2fb 100644 --- a/src/main/java/org/apache/tomcat/util/scan/StandardJarScanner.java +++ b/core/src/main/java/org/apache/tomcat/util/scan/StandardJarScanner.java @@ -26,7 +26,6 @@ import java.util.Collections; import java.util.Deque; import java.util.HashSet; -import java.util.Iterator; import java.util.LinkedList; import java.util.Set; import java.util.jar.Attributes; @@ -43,6 +42,7 @@ import org.apache.tomcat.JarScannerCallback; import org.apache.tomcat.util.ExceptionUtils; import org.apache.tomcat.util.buf.UriUtil; +import org.apache.tomcat.util.compat.JreCompat; import org.apache.tomcat.util.res.StringManager; /* @@ -176,9 +176,7 @@ public void scan(JarScanType scanType, ServletContext context, // Scan WEB-INF/lib Set dirList = context.getResourcePaths(Constants.WEB_INF_LIB); if (dirList != null) { - Iterator it = dirList.iterator(); - while (it.hasNext()) { - String path = it.next(); + for (String path : dirList) { if (path.endsWith(Constants.JAR_EXT) && getJarScanFilter().check(scanType, path.substring(path.lastIndexOf('/')+1))) { @@ -228,76 +226,114 @@ public void scan(JarScanType scanType, ServletContext context, // Scan the classpath if (isScanClassPath()) { - if (log.isTraceEnabled()) { - log.trace(sm.getString("jarScan.classloaderStart")); - } + doScanClassPath(scanType, context, callback, processedURLs); + } + } - ClassLoader stopLoader = null; - if (!isScanBootstrapClassPath()) { - // Stop when we reach the bootstrap class loader - stopLoader = ClassLoader.getSystemClassLoader().getParent(); - } - ClassLoader classLoader = context.getClassLoader(); + protected void doScanClassPath(JarScanType scanType, ServletContext context, + JarScannerCallback callback, Set processedURLs) { + if (log.isTraceEnabled()) { + log.trace(sm.getString("jarScan.classloaderStart")); + } - // JARs are treated as application provided until the common class - // loader is reached. - boolean isWebapp = true; + ClassLoader stopLoader = null; + if (!isScanBootstrapClassPath()) { + // Stop when we reach the bootstrap class loader + stopLoader = ClassLoader.getSystemClassLoader().getParent(); + } - while (classLoader != null && classLoader != stopLoader) { - if (classLoader instanceof URLClassLoader) { - if (isWebapp) { - isWebapp = isWebappClassLoader(classLoader); - } + ClassLoader classLoader = context.getClassLoader(); - // Use a Deque so URLs can be removed as they are processed - // and new URLs can be added as they are discovered during - // processing. - Deque classPathUrlsToProcess = new LinkedList<>(); - classPathUrlsToProcess.addAll( - Arrays.asList(((URLClassLoader) classLoader).getURLs())); + // JARs are treated as application provided until the common class + // loader is reached. + boolean isWebapp = true; - while (!classPathUrlsToProcess.isEmpty()) { - URL url = classPathUrlsToProcess.pop(); + // Use a Deque so URLs can be removed as they are processed + // and new URLs can be added as they are discovered during + // processing. + Deque classPathUrlsToProcess = new LinkedList<>(); - if (processedURLs.contains(url)) { - // Skip this URL it has already been processed - continue; - } + while (classLoader != null && classLoader != stopLoader) { + if (classLoader instanceof URLClassLoader) { + if (isWebapp) { + isWebapp = isWebappClassLoader(classLoader); + } - // TODO: Java 9 support. Details are TBD. It will depend - // on the extent to which Java 8 supports the - // Java 9 file formats since this code MUST run on - // Java 8. - ClassPathEntry cpe = new ClassPathEntry(url); - - // JARs are scanned unless the filter says not to. - // Directories are scanned for pluggability scans or - // if scanAllDirectories is enabled unless the - // filter says not to. - if ((cpe.isJar() \|\| - scanType == JarScanType.PLUGGABILITY \|\| - isScanAllDirectories()) && - getJarScanFilter().check(scanType, - cpe.getName())) { - if (log.isDebugEnabled()) { - log.debug(sm.getString("jarScan.classloaderJarScan", url)); - } - try { - processedURLs.add(url); - process(scanType, callback, url, null, isWebapp, classPathUrlsToProcess); - } catch (IOException ioe) { - log.warn(sm.getString("jarScan.classloaderFail", url), ioe); - } - } else { - // JAR / directory has been skipped - if (log.isTraceEnabled()) { - log.trace(sm.getString("jarScan.classloaderJarNoScan", url)); - } - } - } + classPathUrlsToProcess.addAll( + Arrays.asList(((URLClassLoader) classLoader).getURLs())); + + processURLs(scanType, callback, processedURLs, isWebapp, classPathUrlsToProcess); + } + classLoader = classLoader.getParent(); + } + + if (JreCompat.isJre9Available()) { + // The application and platform class loaders are not + // instances of URLClassLoader. Use the class path in this + // case. + addClassPath(classPathUrlsToProcess); + // Also add any modules + JreCompat.getInstance().addBootModulePath(classPathUrlsToProcess); + processURLs(scanType, callback, processedURLs, false, classPathUrlsToProcess); + } + } + + + protected void processURLs(JarScanType scanType, JarScannerCallback callback, + Set processedURLs, boolean isWebapp, Deque classPathUrlsToProcess) { + while (!classPathUrlsToProcess.isEmpty()) { + URL url = classPathUrlsToProcess.pop(); + + if (processedURLs.contains(url)) { + // Skip this URL it has already been processed + continue; + } + + ClassPathEntry cpe = new ClassPathEntry(url); + + // JARs are scanned unless the filter says not to. + // Directories are scanned for pluggability scans or + // if scanAllDirectories is enabled unless the + // filter says not to. + if ((cpe.isJar() \|\| + scanType == JarScanType.PLUGGABILITY \|\| + isScanAllDirectories()) && + getJarScanFilter().check(scanType, + cpe.getName())) { + if (log.isDebugEnabled()) { + log.debug(sm.getString("jarScan.classloaderJarScan", url)); } - classLoader = classLoader.getParent(); + try { + processedURLs.add(url); + process(scanType, callback, url, null, isWebapp, classPathUrlsToProcess); + } catch (IOException ioe) { + log.warn(sm.getString("jarScan.classloaderFail", url), ioe); + } + } else { + // JAR / directory has been skipped + if (log.isTraceEnabled()) { + log.trace(sm.getString("jarScan.classloaderJarNoScan", url)); + } + } + } + } + + + protected void addClassPath(Deque classPathUrlsToProcess) { + String classPath = System.getProperty("java.class.path"); + + if (classPath == null \|\| classPath.length() == 0) { + return; + } + + String[] classPathEntries = classPath.split(File.pathSeparator); + for (String classPathEntry : classPathEntries) { + File f = new File(classPathEntry); + try { + classPathUrlsToProcess.add(f.toURI().toURL()); + } catch (MalformedURLException e) { + log.warn(sm.getString("jarScan.classPath.badEntry", classPathEntry), e); } } } @@ -326,7 +362,7 @@ private static boolean isWebappClassLoader(ClassLoader classLoader) { * Scan a URL for JARs with the optional extensions to look at all files * and all directories. / - private void process(JarScanType scanType, JarScannerCallback callback, + protected void process(JarScanType scanType, JarScannerCallback callback, URL url, String webappPath, boolean isWebapp, Deque classPathUrlsToProcess) throws IOException { diff --git a/src/main/java/org/apache/tomcat/util/scan/UrlJar.java b/core/src/main/java/org/apache/tomcat/util/scan/UrlJar.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/scan/UrlJar.java rename to core/src/main/java/org/apache/tomcat/util/scan/UrlJar.java diff --git a/src/main/java/org/apache/tomcat/util/scan/package.html b/core/src/main/java/org/apache/tomcat/util/scan/package.html similarity index 100% rename from src/main/java/org/apache/tomcat/util/scan/package.html rename to core/src/main/java/org/apache/tomcat/util/scan/package.html diff --git a/src/main/java/org/apache/tomcat/util/security/ConcurrentMessageDigest.java b/core/src/main/java/org/apache/tomcat/util/security/ConcurrentMessageDigest.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/security/ConcurrentMessageDigest.java rename to core/src/main/java/org/apache/tomcat/util/security/ConcurrentMessageDigest.java diff --git a/core/src/main/java/org/apache/tomcat/util/security/Escape.java b/core/src/main/java/org/apache/tomcat/util/security/Escape.java new file mode 100644 index 0000000..4f12983 --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/util/security/Escape.java @@ -0,0 +1,160 @@ +/ + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.util.security; + +/* + * Provides utility methods to escape content for different contexts. It is + * critical that the escaping used is correct for the context in which the data + * is to be used. + / +public class Escape { + + /* + * Escape content for use in HTML. This escaping is suitable for the + * following uses: + * + * Element content when the escaped data will be placed directly inside + * tags such as <p>, <td> etc. + * Attribute values when the attribute value is quoted with " or + * '. + * + * + * @param content The content to escape + * + * @return The escaped content or {@code null} if the content was + * {@code null} + / + public static String htmlElementContent(String content) { + if (content == null) { + return null; + } + + StringBuilder sb = new StringBuilder(); + + for (int i = 0; i < content.length(); i++) { + char c = content.charAt(i); + if (c == '<') { + sb.append("<"); + } else if (c == '>') { + sb.append(">"); + } else if (c == '\'') { + sb.append("'"); + } else if (c == '&') { + sb.append("&"); + } else if (c == '"') { + sb.append("""); + } else if (c == '/') { + sb.append("/"); + } else { + sb.append(c); + } + } + + return (sb.length() > content.length()) ? sb.toString() : content; + } + + + /* + * Convert the object to a string via {@link Object#toString()} and HTML + * escape the resulting string for use in HTML content. + * + * @param obj The object to convert to String and then escape + * + * @return The escaped content or `"?"` if obj is + * {@code null} + / + public static String htmlElementContext(Object obj) { + if (obj == null) { + return "?"; + } + + try { + return htmlElementContent(obj.toString()); + } catch (Exception e) { + return null; + } + } + + + /* + * Escape content for use in XML. + * + * @param content The content to escape + * + * @return The escaped content or {@code null} if the content was + * {@code null} + / + public static String xml(String content) { + return xml(null, content); + } + + + /* + * Escape content for use in XML. + * + * @param ifNull The value to return if content is {@code null} + * @param content The content to escape + * + * @return The escaped content or the value of {@code ifNull} if the + * content was {@code null} + / + public static String xml(String ifNull, String content) { + return xml(ifNull, false, content); + } + + + /* + * Escape content for use in XML. + * + * @param ifNull The value to return if content is {@code null} + * @param escapeCRLF Should CR and LF also be escaped? + * @param content The content to escape + * + * @return The escaped content or the value of ifNull if the content was + * {@code null} + / + public static String xml(String ifNull, boolean escapeCRLF, String content) { + if (content == null) { + return ifNull; + } + + StringBuilder sb = new StringBuilder(); + + for (int i = 0; i < content.length(); i++) { + char c = content.charAt(i); + if (c == '<') { + sb.append("<"); + } else if (c == '>') { + sb.append(">"); + } else if (c == '\'') { + sb.append("'"); + } else if (c == '&') { + sb.append("&"); + } else if (c == '"') { + sb.append("""); + } else if (escapeCRLF && c == '\r') { + sb.append(" "); + } else if (escapeCRLF && c == '\n') { + sb.append(" "); + } else { + sb.append(c); + } + } + + return (sb.length() > content.length()) ? sb.toString(): content; + } +} diff --git a/src/main/java/org/apache/tomcat/util/security/MD5Encoder.java b/core/src/main/java/org/apache/tomcat/util/security/MD5Encoder.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/security/MD5Encoder.java rename to core/src/main/java/org/apache/tomcat/util/security/MD5Encoder.java diff --git a/src/main/java/org/apache/tomcat/util/security/PermissionCheck.java b/core/src/main/java/org/apache/tomcat/util/security/PermissionCheck.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/security/PermissionCheck.java rename to core/src/main/java/org/apache/tomcat/util/security/PermissionCheck.java diff --git a/src/main/java/org/apache/tomcat/util/security/PrivilegedGetTccl.java b/core/src/main/java/org/apache/tomcat/util/security/PrivilegedGetTccl.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/security/PrivilegedGetTccl.java rename to core/src/main/java/org/apache/tomcat/util/security/PrivilegedGetTccl.java diff --git a/src/main/java/org/apache/tomcat/util/security/PrivilegedSetTccl.java b/core/src/main/java/org/apache/tomcat/util/security/PrivilegedSetTccl.java similarity index 82% rename from src/main/java/org/apache/tomcat/util/security/PrivilegedSetTccl.java rename to core/src/main/java/org/apache/tomcat/util/security/PrivilegedSetTccl.java index 2f70492..739d915 100644 --- a/src/main/java/org/apache/tomcat/util/security/PrivilegedSetTccl.java +++ b/core/src/main/java/org/apache/tomcat/util/security/PrivilegedSetTccl.java @@ -20,15 +20,22 @@ public class PrivilegedSetTccl implements PrivilegedAction { - private ClassLoader cl; + private final ClassLoader cl; + private final Thread t; public PrivilegedSetTccl(ClassLoader cl) { + this(Thread.currentThread(), cl); + } + + public PrivilegedSetTccl(Thread t, ClassLoader cl) { + this.t = t; this.cl = cl; } + @Override public Void run() { - Thread.currentThread().setContextClassLoader(cl); + t.setContextClassLoader(cl); return null; } } \ No newline at end of file diff --git a/src/main/java/org/apache/tomcat/util/threads/Constants.java b/core/src/main/java/org/apache/tomcat/util/threads/Constants.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/Constants.java rename to core/src/main/java/org/apache/tomcat/util/threads/Constants.java diff --git a/src/main/java/org/apache/tomcat/util/threads/InlineExecutorService.java b/core/src/main/java/org/apache/tomcat/util/threads/InlineExecutorService.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/InlineExecutorService.java rename to core/src/main/java/org/apache/tomcat/util/threads/InlineExecutorService.java diff --git a/src/main/java/org/apache/tomcat/util/threads/LimitLatch.java b/core/src/main/java/org/apache/tomcat/util/threads/LimitLatch.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/LimitLatch.java rename to core/src/main/java/org/apache/tomcat/util/threads/LimitLatch.java diff --git a/src/main/java/org/apache/tomcat/util/threads/ResizableExecutor.java b/core/src/main/java/org/apache/tomcat/util/threads/ResizableExecutor.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/ResizableExecutor.java rename to core/src/main/java/org/apache/tomcat/util/threads/ResizableExecutor.java diff --git a/src/main/java/org/apache/tomcat/util/threads/StopPooledThreadException.java b/core/src/main/java/org/apache/tomcat/util/threads/StopPooledThreadException.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/StopPooledThreadException.java rename to core/src/main/java/org/apache/tomcat/util/threads/StopPooledThreadException.java diff --git a/src/main/java/org/apache/tomcat/util/threads/TaskQueue.java b/core/src/main/java/org/apache/tomcat/util/threads/TaskQueue.java similarity index 98% rename from src/main/java/org/apache/tomcat/util/threads/TaskQueue.java rename to core/src/main/java/org/apache/tomcat/util/threads/TaskQueue.java index 7b5b339..2ba8763 100644 --- a/src/main/java/org/apache/tomcat/util/threads/TaskQueue.java +++ b/core/src/main/java/org/apache/tomcat/util/threads/TaskQueue.java @@ -32,7 +32,7 @@ public class TaskQueue extends LinkedBlockingQueue { private static final long serialVersionUID = 1L; - private volatile ThreadPoolExecutor parent = null; + private transient volatile ThreadPoolExecutor parent = null; // No need to be volatile. This is written and read in a single thread // (when stopping a context and firing the listeners) diff --git a/src/main/java/org/apache/tomcat/util/threads/TaskThread.java b/core/src/main/java/org/apache/tomcat/util/threads/TaskThread.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/TaskThread.java rename to core/src/main/java/org/apache/tomcat/util/threads/TaskThread.java diff --git a/src/main/java/org/apache/tomcat/util/threads/TaskThreadFactory.java b/core/src/main/java/org/apache/tomcat/util/threads/TaskThreadFactory.java similarity index 64% rename from src/main/java/org/apache/tomcat/util/threads/TaskThreadFactory.java rename to core/src/main/java/org/apache/tomcat/util/threads/TaskThreadFactory.java index 81daaf0..5601eda 100644 --- a/src/main/java/org/apache/tomcat/util/threads/TaskThreadFactory.java +++ b/core/src/main/java/org/apache/tomcat/util/threads/TaskThreadFactory.java @@ -45,28 +45,21 @@ public TaskThreadFactory(String namePrefix, boolean daemon, int priority) { @Override public Thread newThread(Runnable r) { - ClassLoader loader = Thread.currentThread().getContextClassLoader(); - try { - // Threads should not be created by the webapp classloader - if (Constants.IS_SECURITY_ENABLED) { - PrivilegedAction pa = new PrivilegedSetTccl( - getClass().getClassLoader()); - AccessController.doPrivileged(pa); - } else { - Thread.currentThread().setContextClassLoader( - getClass().getClassLoader()); - } - TaskThread t = new TaskThread(group, r, namePrefix + threadNumber.getAndIncrement()); - t.setDaemon(daemon); - t.setPriority(threadPriority); - return t; - } finally { - if (Constants.IS_SECURITY_ENABLED) { - PrivilegedAction pa = new PrivilegedSetTccl(loader); - AccessController.doPrivileged(pa); - } else { - Thread.currentThread().setContextClassLoader(loader); - } + TaskThread t = new TaskThread(group, r, namePrefix + threadNumber.getAndIncrement()); + t.setDaemon(daemon); + t.setPriority(threadPriority); + + // Set the context class loader of newly created threads to be the class + // loader that loaded this factory. This avoids retaining references to + // web application class loaders and similar. + if (Constants.IS_SECURITY_ENABLED) { + PrivilegedAction pa = new PrivilegedSetTccl( + t, getClass().getClassLoader()); + AccessController.doPrivileged(pa); + } else { + t.setContextClassLoader(getClass().getClassLoader()); } + + return t; } } diff --git a/src/main/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java b/core/src/main/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java rename to core/src/main/java/org/apache/tomcat/util/threads/ThreadPoolExecutor.java diff --git a/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/res/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings.properties diff --git a/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_es.properties b/core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_es.properties similarity index 99% rename from src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_es.properties rename to core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_es.properties index 5798de0..ebf58b9 100644 --- a/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_es.properties +++ b/core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_es.properties @@ -12,4 +12,5 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. + threadPoolExecutor.threadStoppedToAvoidPotentialLeak = Parando hilo [{0}] para evita fallos potenciales de memoria tras haberse parado un contexto. diff --git a/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_ja.properties b/core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_fr.properties similarity index 100% rename from src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_ja.properties rename to core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_fr.properties diff --git a/src/main/java/org/apache/catalina/core/RestrictedListeners.properties b/core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_ja.properties similarity index 99% rename from src/main/java/org/apache/catalina/core/RestrictedListeners.properties rename to core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_ja.properties index ae1e83e..09697dc 100644 --- a/src/main/java/org/apache/catalina/core/RestrictedListeners.properties +++ b/core/src/main/java/org/apache/tomcat/util/threads/res/LocalStrings_ja.properties @@ -12,3 +12,4 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. + diff --git a/src/main/java/org/apache/tomcat/websocket/AsyncChannelGroupUtil.java b/core/src/main/java/org/apache/tomcat/websocket/AsyncChannelGroupUtil.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/AsyncChannelGroupUtil.java rename to core/src/main/java/org/apache/tomcat/websocket/AsyncChannelGroupUtil.java diff --git a/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapper.java b/core/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapper.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapper.java rename to core/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapper.java diff --git a/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapperNonSecure.java b/core/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapperNonSecure.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapperNonSecure.java rename to core/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapperNonSecure.java diff --git a/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapperSecure.java b/core/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapperSecure.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapperSecure.java rename to core/src/main/java/org/apache/tomcat/websocket/AsyncChannelWrapperSecure.java diff --git a/core/src/main/java/org/apache/tomcat/websocket/AuthenticationException.java b/core/src/main/java/org/apache/tomcat/websocket/AuthenticationException.java new file mode 100644 index 0000000..7ac8d37 --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/websocket/AuthenticationException.java @@ -0,0 +1,35 @@ +/ + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.websocket; + +/* + * Exception thrown on authentication error connecting to a remote + * websocket endpoint. + / +public class AuthenticationException extends Exception { + + private static final long serialVersionUID = 5709887412240096441L; + + /* + * Create authentication exception. + * @param message the error message + / + public AuthenticationException(String message) { + super(message); + } + +} diff --git a/core/src/main/java/org/apache/tomcat/websocket/Authenticator.java b/core/src/main/java/org/apache/tomcat/websocket/Authenticator.java new file mode 100644 index 0000000..bc14d57 --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/websocket/Authenticator.java @@ -0,0 +1,71 @@ +/ + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.websocket; + +import java.util.HashMap; +import java.util.Map; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +/* + * Base class for the authentication methods used by the websocket client. + / +public abstract class Authenticator { + private static final Pattern pattern = Pattern + .compile("(\\w+)\\s=\\s(\"([^\"]+)\"\|([^,=\"]+))\\s,?"); + + /** + * Generate the authentication header that will be sent to the server. + * @param requestUri The request URI + * @param WWWAuthenticate The server auth challenge + * @param UserProperties The user information + * @return The auth header + * @throws AuthenticationException When an error occurs + / + public abstract String getAuthorization(String requestUri, String WWWAuthenticate, + Map UserProperties) throws AuthenticationException; + + /* + * Get the authentication method. + * @return the auth scheme + / + public abstract String getSchemeName(); + + /* + * Utility method to parse the authentication header. + * @param WWWAuthenticate The server auth challenge + * @return the parsed header + / + public Map parseWWWAuthenticateHeader(String WWWAuthenticate) { + + Matcher m = pattern.matcher(WWWAuthenticate); + Map challenge = new HashMap<>(); + + while (m.find()) { + String key = m.group(1); + String qtedValue = m.group(3); + String value = m.group(4); + + challenge.put(key, qtedValue != null ? qtedValue : value); + + } + + return challenge; + + } + +} diff --git a/core/src/main/java/org/apache/tomcat/websocket/AuthenticatorFactory.java b/core/src/main/java/org/apache/tomcat/websocket/AuthenticatorFactory.java new file mode 100644 index 0000000..0d28da4 --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/websocket/AuthenticatorFactory.java @@ -0,0 +1,68 @@ +/ + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.websocket; + +import java.util.Iterator; +import java.util.ServiceLoader; + +/* + * Utility method to return the appropriate authenticator according to + * the scheme that the server uses. + / +public class AuthenticatorFactory { + + /* + * Return a new authenticator instance. + * @param authScheme The scheme used + * @return the authenticator + / + public static Authenticator getAuthenticator(String authScheme) { + + Authenticator auth = null; + switch (authScheme.toLowerCase()) { + + case BasicAuthenticator.schemeName: + auth = new BasicAuthenticator(); + break; + + case DigestAuthenticator.schemeName: + auth = new DigestAuthenticator(); + break; + + default: + auth = loadAuthenticators(authScheme); + break; + } + + return auth; + + } + + private static Authenticator loadAuthenticators(String authScheme) { + ServiceLoader serviceLoader = ServiceLoader.load(Authenticator.class); + Iterator auths = serviceLoader.iterator(); + + while (auths.hasNext()) { + Authenticator auth = auths.next(); + if (auth.getSchemeName().equalsIgnoreCase(authScheme)) + return auth; + } + + return null; + } + +} diff --git a/src/main/java/org/apache/tomcat/websocket/BackgroundProcess.java b/core/src/main/java/org/apache/tomcat/websocket/BackgroundProcess.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/BackgroundProcess.java rename to core/src/main/java/org/apache/tomcat/websocket/BackgroundProcess.java diff --git a/src/main/java/org/apache/tomcat/websocket/BackgroundProcessManager.java b/core/src/main/java/org/apache/tomcat/websocket/BackgroundProcessManager.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/BackgroundProcessManager.java rename to core/src/main/java/org/apache/tomcat/websocket/BackgroundProcessManager.java diff --git a/core/src/main/java/org/apache/tomcat/websocket/BasicAuthenticator.java b/core/src/main/java/org/apache/tomcat/websocket/BasicAuthenticator.java new file mode 100644 index 0000000..49c58b0 --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/websocket/BasicAuthenticator.java @@ -0,0 +1,66 @@ +/ + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.websocket; + +import java.nio.charset.Charset; +import java.nio.charset.StandardCharsets; +import java.util.Base64; +import java.util.Map; + +/* + * Authenticator supporting the BASIC auth method. + / +public class BasicAuthenticator extends Authenticator { + + public static final String schemeName = "basic"; + public static final String charsetparam = "charset"; + + @Override + public String getAuthorization(String requestUri, String WWWAuthenticate, + Map userProperties) throws AuthenticationException { + + String userName = (String) userProperties.get(Constants.WS_AUTHENTICATION_USER_NAME); + String password = (String) userProperties.get(Constants.WS_AUTHENTICATION_PASSWORD); + + if (userName == null \|\| password == null) { + throw new AuthenticationException( + "Failed to perform Basic authentication due to missing user/password"); + } + + Map wwwAuthenticate = parseWWWAuthenticateHeader(WWWAuthenticate); + + String userPass = userName + ":" + password; + Charset charset; + + if (wwwAuthenticate.get(charsetparam) != null + && wwwAuthenticate.get(charsetparam).equalsIgnoreCase("UTF-8")) { + charset = StandardCharsets.UTF_8; + } else { + charset = StandardCharsets.ISO_8859_1; + } + + String base64 = Base64.getEncoder().encodeToString(userPass.getBytes(charset)); + + return " Basic " + base64; + } + + @Override + public String getSchemeName() { + return schemeName; + } + +} diff --git a/src/main/java/org/apache/tomcat/websocket/Constants.java b/core/src/main/java/org/apache/tomcat/websocket/Constants.java similarity index 83% rename from src/main/java/org/apache/tomcat/websocket/Constants.java rename to core/src/main/java/org/apache/tomcat/websocket/Constants.java index 6e75d7f..eeee8cc 100644 --- a/src/main/java/org/apache/tomcat/websocket/Constants.java +++ b/core/src/main/java/org/apache/tomcat/websocket/Constants.java @@ -73,6 +73,13 @@ public class Constants { public static final String IO_TIMEOUT_MS_PROPERTY = "org.apache.tomcat.websocket.IO_TIMEOUT_MS"; public static final long IO_TIMEOUT_MS_DEFAULT = 5000; + + // RFC 2068 recommended a limit of 5 + // Most browsers have a default limit of 20 + public static final String MAX_REDIRECTIONS_PROPERTY = + "org.apache.tomcat.websocket.MAX_REDIRECTIONS"; + public static final int MAX_REDIRECTIONS_DEFAULT = 20; + // HTTP upgrade header names and values public static final String HOST_HEADER_NAME = "Host"; public static final String UPGRADE_HEADER_NAME = "Upgrade"; @@ -80,12 +87,23 @@ public class Constants { public static final String ORIGIN_HEADER_NAME = "Origin"; public static final String CONNECTION_HEADER_NAME = "Connection"; public static final String CONNECTION_HEADER_VALUE = "upgrade"; + public static final String LOCATION_HEADER_NAME = "Location"; + public static final String AUTHORIZATION_HEADER_NAME = "Authorization"; + public static final String WWW_AUTHENTICATE_HEADER_NAME = "WWW-Authenticate"; public static final String WS_VERSION_HEADER_NAME = "Sec-WebSocket-Version"; public static final String WS_VERSION_HEADER_VALUE = "13"; public static final String WS_KEY_HEADER_NAME = "Sec-WebSocket-Key"; public static final String WS_PROTOCOL_HEADER_NAME = "Sec-WebSocket-Protocol"; public static final String WS_EXTENSIONS_HEADER_NAME = "Sec-WebSocket-Extensions"; + /// HTTP redirection status codes + public static final int MULTIPLE_CHOICES = 300; + public static final int MOVED_PERMANENTLY = 301; + public static final int FOUND = 302; + public static final int SEE_OTHER = 303; + public static final int USE_PROXY = 305; + public static final int TEMPORARY_REDIRECT = 307; + // Configuration for Origin header in client static final String DEFAULT_ORIGIN_HEADER_VALUE = System.getProperty("org.apache.tomcat.websocket.DEFAULT_ORIGIN_HEADER_VALUE"); @@ -101,6 +119,9 @@ public class Constants { "org.apache.tomcat.websocket.DEFAULT_PROCESS_PERIOD", 10) .intValue(); + public static final String WS_AUTHENTICATION_USER_NAME = "org.apache.tomcat.websocket.WS_AUTHENTICATION_USER_NAME"; + public static final String WS_AUTHENTICATION_PASSWORD = "org.apache.tomcat.websocket.WS_AUTHENTICATION_PASSWORD"; + / Configuration for extensions * Note: These options are primarily present to enable this implementation * to pass compliance tests. They are expected to be removed once @@ -117,8 +138,7 @@ public class Constants { Boolean.getBoolean("org.apache.tomcat.websocket.STREAMS_DROP_EMPTY_MESSAGES"); public static final boolean STRICT_SPEC_COMPLIANCE = - Boolean.getBoolean( - "org.apache.tomcat.websocket.STRICT_SPEC_COMPLIANCE"); + Boolean.getBoolean("org.apache.tomcat.websocket.STRICT_SPEC_COMPLIANCE"); public static final List INSTALLED_EXTENSIONS; diff --git a/src/main/java/org/apache/tomcat/websocket/DecoderEntry.java b/core/src/main/java/org/apache/tomcat/websocket/DecoderEntry.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/DecoderEntry.java rename to core/src/main/java/org/apache/tomcat/websocket/DecoderEntry.java diff --git a/core/src/main/java/org/apache/tomcat/websocket/DigestAuthenticator.java b/core/src/main/java/org/apache/tomcat/websocket/DigestAuthenticator.java new file mode 100644 index 0000000..021489f --- /dev/null +++ b/core/src/main/java/org/apache/tomcat/websocket/DigestAuthenticator.java @@ -0,0 +1,150 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + / +package org.apache.tomcat.websocket; + +import java.nio.charset.StandardCharsets; +import java.security.MessageDigest; +import java.security.NoSuchAlgorithmException; +import java.security.SecureRandom; +import java.util.Map; + +import org.apache.tomcat.util.security.MD5Encoder; + +/* + * Authenticator supporting the DIGEST auth method. + / +public class DigestAuthenticator extends Authenticator { + + public static final String schemeName = "digest"; + private SecureRandom cnonceGenerator; + private int nonceCount = 0; + private long cNonce; + + @Override + public String getAuthorization(String requestUri, String WWWAuthenticate, + Map userProperties) throws AuthenticationException { + + String userName = (String) userProperties.get(Constants.WS_AUTHENTICATION_USER_NAME); + String password = (String) userProperties.get(Constants.WS_AUTHENTICATION_PASSWORD); + + if (userName == null \|\| password == null) { + throw new AuthenticationException( + "Failed to perform Digest authentication due to missing user/password"); + } + + Map wwwAuthenticate = parseWWWAuthenticateHeader(WWWAuthenticate); + + String realm = wwwAuthenticate.get("realm"); + String nonce = wwwAuthenticate.get("nonce"); + String messageQop = wwwAuthenticate.get("qop"); + String algorithm = wwwAuthenticate.get("algorithm") == null ? "MD5" + : wwwAuthenticate.get("algorithm"); + String opaque = wwwAuthenticate.get("opaque"); + + StringBuilder challenge = new StringBuilder(); + + if (!messageQop.isEmpty()) { + if (cnonceGenerator == null) { + cnonceGenerator = new SecureRandom(); + } + + cNonce = cnonceGenerator.nextLong(); + nonceCount++; + } + + challenge.append("Digest "); + challenge.append("username =\"" + userName + "\","); + challenge.append("realm=\"" + realm + "\","); + challenge.append("nonce=\"" + nonce + "\","); + challenge.append("uri=\"" + requestUri + "\","); + + try { + challenge.append("response=\"" + calculateRequestDigest(requestUri, userName, password, + realm, nonce, messageQop, algorithm) + "\","); + } + + catch (NoSuchAlgorithmException e) { + throw new AuthenticationException( + "Unable to generate request digest " + e.getMessage()); + } + + challenge.append("algorithm=" + algorithm + ","); + challenge.append("opaque=\"" + opaque + "\","); + + if (!messageQop.isEmpty()) { + challenge.append("qop=\"" + messageQop + "\""); + challenge.append(",cnonce=\"" + cNonce + "\","); + challenge.append("nc=" + String.format("%08X", Integer.valueOf(nonceCount))); + } + + return challenge.toString(); + + } + + private String calculateRequestDigest(String requestUri, String userName, String password, + String realm, String nonce, String qop, String algorithm) + throws NoSuchAlgorithmException { + + StringBuilder preDigest = new StringBuilder(); + String A1; + + if (algorithm.equalsIgnoreCase("MD5")) + A1 = userName + ":" + realm + ":" + password; + + else + A1 = encodeMD5(userName + ":" + realm + ":" + password) + ":" + nonce + ":" + cNonce; + + / + * If the "qop" value is "auth-int", then A2 is: A2 = Method ":" + * digest-uri-value ":" H(entity-body) since we do not have an entity-body, A2 = + * Method ":" digest-uri-value for auth and auth_int + / + String A2 = "GET:" + requestUri; + + preDigest.append(encodeMD5(A1)); + preDigest.append(":"); + preDigest.append(nonce); + + if (qop.toLowerCase().contains("auth")) { + preDigest.append(":"); + preDigest.append(String.format("%08X", Integer.valueOf(nonceCount))); + preDigest.append(":"); + preDigest.append(String.valueOf(cNonce)); + preDigest.append(":"); + preDigest.append(qop); + } + + preDigest.append(":"); + preDigest.append(encodeMD5(A2)); + + return encodeMD5(preDigest.toString()); + + } + + private String encodeMD5(String value) throws NoSuchAlgorithmException { + byte[] bytesOfMessage = value.getBytes(StandardCharsets.ISO_8859_1); + MessageDigest md = MessageDigest.getInstance("MD5"); + byte[] thedigest = md.digest(bytesOfMessage); + + return MD5Encoder.encode(thedigest); + } + + @Override + public String getSchemeName() { + return schemeName; + } +} diff --git a/src/main/java/org/apache/tomcat/websocket/FutureToSendHandler.java b/core/src/main/java/org/apache/tomcat/websocket/FutureToSendHandler.java similarity index 87% rename from src/main/java/org/apache/tomcat/websocket/FutureToSendHandler.java rename to core/src/main/java/org/apache/tomcat/websocket/FutureToSendHandler.java index ce59ade..692cb59 100644 --- a/src/main/java/org/apache/tomcat/websocket/FutureToSendHandler.java +++ b/core/src/main/java/org/apache/tomcat/websocket/FutureToSendHandler.java @@ -21,6 +21,7 @@ import java.util.concurrent.Future; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; +import java.util.concurrent.atomic.AtomicReference; import javax.websocket.SendHandler; import javax.websocket.SendResult; @@ -37,7 +38,7 @@ class FutureToSendHandler implements Future, SendHandler { private final CountDownLatch latch = new CountDownLatch(1); private final WsSession wsSession; - private volatile SendResult result = null; + private volatile AtomicReference result = new AtomicReference<>(null); public FutureToSendHandler(WsSession wsSession) { this.wsSession = wsSession; @@ -48,8 +49,7 @@ public FutureToSendHandler(WsSession wsSession) { @Override public void onResult(SendResult result) { - - this.result = result; + this.result.compareAndSet(null, result); latch.countDown(); } @@ -82,8 +82,8 @@ public Void get() throws InterruptedException, } finally { wsSession.unregisterFuture(this); } - if (result.getException() != null) { - throw new ExecutionException(result.getException()); + if (result.get().getException() != null) { + throw new ExecutionException(result.get().getException()); } return null; } @@ -104,12 +104,9 @@ public Void get(long timeout, TimeUnit unit) throw new TimeoutException(sm.getString("futureToSendHandler.timeout", Long.valueOf(timeout), unit.toString().toLowerCase())); } - if (result.getException() != null) { - throw new ExecutionException(result.getException()); + if (result.get().getException() != null) { + throw new ExecutionException(result.get().getException()); } return null; } } - - - diff --git a/src/main/java/org/apache/tomcat/websocket/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/websocket/LocalStrings.properties similarity index 94% rename from src/main/java/org/apache/tomcat/websocket/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/websocket/LocalStrings.properties index 67d6671..b5ccb85 100644 --- a/src/main/java/org/apache/tomcat/websocket/LocalStrings.properties +++ b/core/src/main/java/org/apache/tomcat/websocket/LocalStrings.properties @@ -105,7 +105,7 @@ wsSession.doClose=Closing WebSocket session [{1}] wsSession.duplicateHandlerBinary=A binary message handler has already been configured wsSession.duplicateHandlerPong=A pong message handler has already been configured wsSession.duplicateHandlerText=A text message handler has already been configured -wsSession.invalidHandlerTypePong=A pong message handler must implement MessageHandler.Basic +wsSession.invalidHandlerTypePong=A pong message handler must implement MessageHandler.Whole wsSession.flushFailOnClose=Failed to flush batched messages on session close wsSession.messageFailed=Unable to write the complete message as the WebSocket connection has been closed wsSession.sendCloseFail=Failed to send close message for session [{0}] to remote endpoint @@ -121,18 +121,24 @@ wsSession.instanceDestroy=Endpoint instance unregistration failed # as many as 4 bytes. wsWebSocketContainer.shutdown=The web application is stopping -wsWebSocketContainer.asynchronousSocketChannelFail=Unable to open a connection to the server wsWebSocketContainer.defaultConfiguratorFail=Failed to create the default configurator wsWebSocketContainer.endpointCreateFail=Failed to create a local endpoint of type [{0}] +wsWebSocketContainer.maxBuffer=This implementation limits the maximum size of a buffer to Integer.MAX_VALUE +wsWebSocketContainer.missingAnnotation=Cannot use POJO class [{0}] as it is not annotated with @ClientEndpoint +wsWebSocketContainer.sessionCloseFail=Session with ID [{0}] did not close cleanly + +wsWebSocketContainer.asynchronousSocketChannelFail=Unable to open a connection to the server wsWebSocketContainer.httpRequestFailed=The HTTP request to initiate the WebSocket connection failed wsWebSocketContainer.invalidExtensionParameters=The server responded with extension parameters the client is unable to support wsWebSocketContainer.invalidHeader=Unable to parse HTTP header as no colon is present to delimit header name and header value in [{0}]. The header has been skipped. wsWebSocketContainer.invalidStatus=The HTTP response from the server [{0}] did not permit the HTTP upgrade to WebSocket wsWebSocketContainer.invalidSubProtocol=The WebSocket server returned multiple values for the Sec-WebSocket-Protocol header -wsWebSocketContainer.maxBuffer=This implementation limits the maximum size of a buffer to Integer.MAX_VALUE -wsWebSocketContainer.missingAnnotation=Cannot use POJO class [{0}] as it is not annotated with @ClientEndpoint wsWebSocketContainer.pathNoHost=No host was specified in URI wsWebSocketContainer.pathWrongScheme=The scheme [{0}] is not supported. The supported schemes are ws and wss wsWebSocketContainer.proxyConnectFail=Failed to connect to the configured Proxy [{0}]. The HTTP response code was [{1}] -wsWebSocketContainer.sessionCloseFail=Session with ID [{0}] did not close cleanly wsWebSocketContainer.sslEngineFail=Unable to create SSLEngine to support SSL/TLS connections +wsWebSocketContainer.missingLocationHeader=Failed to handle HTTP response code [{0}]. Missing Location header in response +wsWebSocketContainer.redirectThreshold=Cyclic Location header [{0}] detected / reached max number of redirects [{1}] of max [{2}] +wsWebSocketContainer.unsupportedAuthScheme=Failed to handle HTTP response code [{0}]. Unsupported Authentication scheme [{1}] returned in response +wsWebSocketContainer.failedAuthentication=Failed to handle HTTP response code [{0}]. Authentication header was not accepted by server. +wsWebSocketContainer.missingWWWAuthenticateHeader=Failed to handle HTTP response code [{0}]. Missing WWW-Authenticate header in response \ No newline at end of file diff --git a/src/main/java/org/apache/tomcat/websocket/MessageHandlerResult.java b/core/src/main/java/org/apache/tomcat/websocket/MessageHandlerResult.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/MessageHandlerResult.java rename to core/src/main/java/org/apache/tomcat/websocket/MessageHandlerResult.java diff --git a/src/main/java/org/apache/tomcat/websocket/MessageHandlerResultType.java b/core/src/main/java/org/apache/tomcat/websocket/MessageHandlerResultType.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/MessageHandlerResultType.java rename to core/src/main/java/org/apache/tomcat/websocket/MessageHandlerResultType.java diff --git a/src/main/java/org/apache/tomcat/websocket/MessagePart.java b/core/src/main/java/org/apache/tomcat/websocket/MessagePart.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/MessagePart.java rename to core/src/main/java/org/apache/tomcat/websocket/MessagePart.java diff --git a/src/main/java/org/apache/tomcat/websocket/PerMessageDeflate.java b/core/src/main/java/org/apache/tomcat/websocket/PerMessageDeflate.java similarity index 97% rename from src/main/java/org/apache/tomcat/websocket/PerMessageDeflate.java rename to core/src/main/java/org/apache/tomcat/websocket/PerMessageDeflate.java index 513cf08..e99303d 100644 --- a/src/main/java/org/apache/tomcat/websocket/PerMessageDeflate.java +++ b/core/src/main/java/org/apache/tomcat/websocket/PerMessageDeflate.java @@ -240,7 +240,7 @@ public TransformationResult getMoreData(byte opCode, boolean fin, int rsv, ByteB @Override public boolean validateRsv(int rsv, byte opCode) { if (Util.isControl(opCode)) { - if ((rsv & RSV_BITMASK) > 0) { + if ((rsv & RSV_BITMASK) != 0) { return false; } else { if (next == null) { @@ -251,7 +251,7 @@ public boolean validateRsv(int rsv, byte opCode) { } } else { int rsvNext = rsv; - if ((rsv & RSV_BITMASK) > 0) { + if ((rsv & RSV_BITMASK) != 0) { rsvNext = rsv ^ RSV_BITMASK; } if (next == null) { @@ -300,7 +300,7 @@ public void setNext(Transformation t) { @Override public boolean validateRsvBits(int i) { - if ((i & RSV_BITMASK) > 0) { + if ((i & RSV_BITMASK) != 0) { return false; } if (next == null) { @@ -315,16 +315,20 @@ public boolean validateRsvBits(int i) { public List sendMessagePart(List uncompressedParts) { List allCompressedParts = new ArrayList<>(); + // Flag to track if a message is completely empty + boolean emptyMessage = true; + for (MessagePart uncompressedPart : uncompressedParts) { byte opCode = uncompressedPart.getOpCode(); + boolean emptyPart = uncompressedPart.getPayload().limit() == 0; + emptyMessage = emptyMessage && emptyPart; if (Util.isControl(opCode)) { // Control messages can appear in the middle of other messages // and must not be compressed. Pass it straight through allCompressedParts.add(uncompressedPart); - } else if (uncompressedPart.getPayload().limit() == 0 && uncompressedPart.isFin() && - deflater.getBytesRead() == 0) { - // Zero length messages can't be compressed so pass them - // straight through. + } else if (emptyMessage && uncompressedPart.isFin()) { + // Zero length messages can't be compressed so pass the + // final (empty) part straight through. allCompressedParts.add(uncompressedPart); } else { List compressedParts = new ArrayList<>(); diff --git a/src/main/java/org/apache/tomcat/websocket/ReadBufferOverflowException.java b/core/src/main/java/org/apache/tomcat/websocket/ReadBufferOverflowException.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/ReadBufferOverflowException.java rename to core/src/main/java/org/apache/tomcat/websocket/ReadBufferOverflowException.java diff --git a/src/main/java/org/apache/tomcat/websocket/Transformation.java b/core/src/main/java/org/apache/tomcat/websocket/Transformation.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/Transformation.java rename to core/src/main/java/org/apache/tomcat/websocket/Transformation.java diff --git a/src/main/java/org/apache/tomcat/websocket/TransformationFactory.java b/core/src/main/java/org/apache/tomcat/websocket/TransformationFactory.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/TransformationFactory.java rename to core/src/main/java/org/apache/tomcat/websocket/TransformationFactory.java diff --git a/src/main/java/org/apache/tomcat/websocket/TransformationResult.java b/core/src/main/java/org/apache/tomcat/websocket/TransformationResult.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/TransformationResult.java rename to core/src/main/java/org/apache/tomcat/websocket/TransformationResult.java diff --git a/src/main/java/org/apache/tomcat/websocket/Util.java b/core/src/main/java/org/apache/tomcat/websocket/Util.java similarity index 99% rename from src/main/java/org/apache/tomcat/websocket/Util.java rename to core/src/main/java/org/apache/tomcat/websocket/Util.java index 228ac8c..63009a6 100644 --- a/src/main/java/org/apache/tomcat/websocket/Util.java +++ b/core/src/main/java/org/apache/tomcat/websocket/Util.java @@ -69,7 +69,7 @@ private Util() { static boolean isControl(byte opCode) { - return (opCode & 0x08) > 0; + return (opCode & 0x08) != 0; } @@ -342,8 +342,8 @@ public static List getDecoders( @SuppressWarnings("unused") Decoder instance; try { - instance = decoderClazz.newInstance(); - } catch (InstantiationException \| IllegalAccessException e) { + instance = decoderClazz.getConstructor().newInstance(); + } catch (ReflectiveOperationException e) { throw new DeploymentException( sm.getString("pojoMethodMapping.invalidDecoder", decoderClazz.getName()), e); diff --git a/src/main/java/org/apache/tomcat/websocket/WrappedMessageHandler.java b/core/src/main/java/org/apache/tomcat/websocket/WrappedMessageHandler.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WrappedMessageHandler.java rename to core/src/main/java/org/apache/tomcat/websocket/WrappedMessageHandler.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsContainerProvider.java b/core/src/main/java/org/apache/tomcat/websocket/WsContainerProvider.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsContainerProvider.java rename to core/src/main/java/org/apache/tomcat/websocket/WsContainerProvider.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsExtension.java b/core/src/main/java/org/apache/tomcat/websocket/WsExtension.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsExtension.java rename to core/src/main/java/org/apache/tomcat/websocket/WsExtension.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsExtensionParameter.java b/core/src/main/java/org/apache/tomcat/websocket/WsExtensionParameter.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsExtensionParameter.java rename to core/src/main/java/org/apache/tomcat/websocket/WsExtensionParameter.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsFrameBase.java b/core/src/main/java/org/apache/tomcat/websocket/WsFrameBase.java similarity index 99% rename from src/main/java/org/apache/tomcat/websocket/WsFrameBase.java rename to core/src/main/java/org/apache/tomcat/websocket/WsFrameBase.java index 4bbac7d..28cdc30 100644 --- a/src/main/java/org/apache/tomcat/websocket/WsFrameBase.java +++ b/core/src/main/java/org/apache/tomcat/websocket/WsFrameBase.java @@ -148,7 +148,7 @@ private boolean processInitialHeader() throws IOException { return false; } int b = inputBuffer.get(); - fin = (b & 0x80) > 0; + fin = (b & 0x80) != 0; rsv = (b & 0x70) >>> 4; opCode = (byte) (b & 0x0F); if (!transformation.validateRsv(rsv, opCode)) { @@ -688,7 +688,7 @@ protected Transformation getTransformation() { } - private static enum State { + private enum State { NEW_FRAME, PARTIAL_HEADER, DATA } diff --git a/src/main/java/org/apache/tomcat/websocket/WsFrameClient.java b/core/src/main/java/org/apache/tomcat/websocket/WsFrameClient.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsFrameClient.java rename to core/src/main/java/org/apache/tomcat/websocket/WsFrameClient.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsHandshakeResponse.java b/core/src/main/java/org/apache/tomcat/websocket/WsHandshakeResponse.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsHandshakeResponse.java rename to core/src/main/java/org/apache/tomcat/websocket/WsHandshakeResponse.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsIOException.java b/core/src/main/java/org/apache/tomcat/websocket/WsIOException.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsIOException.java rename to core/src/main/java/org/apache/tomcat/websocket/WsIOException.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsPongMessage.java b/core/src/main/java/org/apache/tomcat/websocket/WsPongMessage.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsPongMessage.java rename to core/src/main/java/org/apache/tomcat/websocket/WsPongMessage.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointAsync.java b/core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointAsync.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointAsync.java rename to core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointAsync.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointBase.java b/core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointBase.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointBase.java rename to core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointBase.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointBasic.java b/core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointBasic.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointBasic.java rename to core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointBasic.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java b/core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java similarity index 99% rename from src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java rename to core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java index 340e9bc..02d677d 100644 --- a/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java +++ b/core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplBase.java @@ -676,9 +676,9 @@ protected void setEncoders(EndpointConfig endpointConfig) endpointConfig.getEncoders()) { Encoder instance; try { - instance = encoderClazz.newInstance(); + instance = encoderClazz.getConstructor().newInstance(); instance.init(endpointConfig); - } catch (InstantiationException \| IllegalAccessException e) { + } catch (ReflectiveOperationException e) { throw new DeploymentException( sm.getString("wsRemoteEndpoint.invalidEncoder", encoderClazz.getName()), e); @@ -1142,7 +1142,7 @@ public Encoder getEncoder() { } - private static enum State { + private enum State { OPEN, STREAM_WRITING, WRITER_WRITING, diff --git a/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplClient.java b/core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplClient.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplClient.java rename to core/src/main/java/org/apache/tomcat/websocket/WsRemoteEndpointImplClient.java diff --git a/src/main/java/org/apache/tomcat/websocket/WsSession.java b/core/src/main/java/org/apache/tomcat/websocket/WsSession.java similarity index 92% rename from src/main/java/org/apache/tomcat/websocket/WsSession.java rename to core/src/main/java/org/apache/tomcat/websocket/WsSession.java index 0a34386..616a77f 100644 --- a/src/main/java/org/apache/tomcat/websocket/WsSession.java +++ b/core/src/main/java/org/apache/tomcat/websocket/WsSession.java @@ -648,28 +648,48 @@ protected static void appendCloseReasonWithTruncation(ByteBuffer msg, String rea @param f2sh The handler / protected void registerFuture(FutureToSendHandler f2sh) { - boolean fail = false; - synchronized (stateLock) { - // If the session has already been closed the any registered futures - // will have been processed so the failure result for this future - // needs to be set here. - if (state == State.OPEN) { - futures.put(f2sh, f2sh); - } else if (f2sh.isDone()) { - // NO-OP. The future completed before the session closed so no - // need to register in case the session closes before it - // completes. - } else { - // Construct the exception outside of the sync block - fail = true; - } + // Ideally, this code should sync on stateLock so that the correct + // action is taken based on the current state of the connection. + // However, a sync on stateLock can't be used here as it will create the + // possibility of a dead-lock. See BZ 61183. + // Therefore, a slightly less efficient approach is used. + + // Always register the future. + futures.put(f2sh, f2sh); + + if (state == State.OPEN) { + // The session is open. The future has been registered with the open + // session. Normal processing continues. + return; } - if (fail) { - IOException ioe = new IOException(sm.getString("wsSession.messageFailed")); - SendResult sr = new SendResult(ioe); - f2sh.onResult(sr); + // The session is closed. The future may or may not have been registered + // in time for it to be processed during session closure. + + if (f2sh.isDone()) { + // The future has completed. It is not known if the future was + // completed normally by the I/O layer or in error by doClose(). It + // doesn't matter which. There is nothing more to do here. + return; } + + // The session is closed. The Future had not completed when last checked. + // There is a small timing window that means the Future may have been + // completed since the last check. There is also the possibility that + // the Future was not registered in time to be cleaned up during session + // close. + // Attempt to complete the Future with an error result as this ensures + // that the Future completes and any client code waiting on it does not + // hang. It is slightly inefficient since the Future may have been + // completed in another thread or another thread may be about to + // complete the Future but knowing if this is the case requires the sync + // on stateLock (see above). + // Note: If multiple attempts are made to complete the Future, the + // second and subsequent attempts are ignored. + + IOException ioe = new IOException(sm.getString("wsSession.messageFailed")); + SendResult sr = new SendResult(ioe); + f2sh.onResult(sr); } @@ -787,7 +807,7 @@ private void checkState() { } } - private static enum State { + private enum State { OPEN, OUTPUT_CLOSED, CLOSED diff --git a/src/main/java/org/apache/tomcat/websocket/WsWebSocketContainer.java b/core/src/main/java/org/apache/tomcat/websocket/WsWebSocketContainer.java similarity index 81% rename from src/main/java/org/apache/tomcat/websocket/WsWebSocketContainer.java rename to core/src/main/java/org/apache/tomcat/websocket/WsWebSocketContainer.java index 846cd4f..ce61c35 100644 --- a/src/main/java/org/apache/tomcat/websocket/WsWebSocketContainer.java +++ b/core/src/main/java/org/apache/tomcat/websocket/WsWebSocketContainer.java @@ -26,6 +26,7 @@ import java.net.ProxySelector; import java.net.SocketAddress; import java.net.URI; +import java.net.URISyntaxException; import java.nio.ByteBuffer; import java.nio.channels.AsynchronousChannelGroup; import java.nio.channels.AsynchronousSocketChannel; @@ -36,7 +37,6 @@ import java.util.Collections; import java.util.HashMap; import java.util.HashSet; -import java.util.Iterator; import java.util.List; import java.util.Locale; import java.util.Map; @@ -76,8 +76,8 @@ public class WsWebSocketContainer implements WebSocketContainer, BackgroundProcess { private static final StringManager sm = StringManager.getManager(WsWebSocketContainer.class); - private static final Random random = new Random(); - private static final byte[] crlf = new byte[] {13, 10}; + private static final Random RANDOM = new Random(); + private static final byte[] CRLF = new byte[] { 13, 10 }; private static final byte[] GET_BYTES = "GET ".getBytes(StandardCharsets.ISO_8859_1); private static final byte[] ROOT_URI_BYTES = "/".getBytes(StandardCharsets.ISO_8859_1); @@ -131,8 +131,8 @@ public Session connectToServer(Object pojo, URI path) if (!ClientEndpointConfig.Configurator.class.equals( configuratorClazz)) { try { - configurator = configuratorClazz.newInstance(); - } catch (InstantiationException \| IllegalAccessException e) { + configurator = configuratorClazz.getConstructor().newInstance(); + } catch (ReflectiveOperationException e) { throw new DeploymentException(sm.getString( "wsWebSocketContainer.defaultConfiguratorFail"), e); } @@ -158,8 +158,8 @@ public Session connectToServer(Class annotatedEndpointClass, URI path) Object pojo; try { - pojo = annotatedEndpointClass.newInstance(); - } catch (InstantiationException \| IllegalAccessException e) { + pojo = annotatedEndpointClass.getConstructor().newInstance(); + } catch (ReflectiveOperationException e) { throw new DeploymentException(sm.getString( "wsWebSocketContainer.endpointCreateFail", annotatedEndpointClass.getName()), e); @@ -176,8 +176,8 @@ public Session connectToServer(Class clazz, Endpoint endpoint; try { - endpoint = clazz.newInstance(); - } catch (InstantiationException \| IllegalAccessException e) { + endpoint = clazz.getConstructor().newInstance(); + } catch (ReflectiveOperationException e) { throw new DeploymentException(sm.getString( "wsWebSocketContainer.endpointCreateFail", clazz.getName()), e); @@ -187,11 +187,17 @@ public Session connectToServer(Class clazz, } - @SuppressWarnings("resource") // socketChannel is closed @Override public Session connectToServer(Endpoint endpoint, ClientEndpointConfig clientEndpointConfiguration, URI path) throws DeploymentException { + return connectToServerRecursive(endpoint, clientEndpointConfiguration, path, new HashSet<>()); + } + + private Session connectToServerRecursive(Endpoint endpoint, + ClientEndpointConfig clientEndpointConfiguration, URI path, + Set redirectSet) + throws DeploymentException { boolean secure = false; ByteBuffer proxyConnect = null; @@ -256,13 +262,11 @@ public Session connectToServer(Endpoint endpoint, } // Create the initial HTTP request to open the WebSocket connection - Map> reqHeaders = createRequestHeaders(host, port, - clientEndpointConfiguration.getPreferredSubprotocols(), - clientEndpointConfiguration.getExtensions()); - clientEndpointConfiguration.getConfigurator(). - beforeRequest(reqHeaders); - if (Constants.DEFAULT_ORIGIN_HEADER_VALUE != null && - !reqHeaders.containsKey(Constants.ORIGIN_HEADER_NAME)) { + Map> reqHeaders = createRequestHeaders(host, port, + clientEndpointConfiguration); + clientEndpointConfiguration.getConfigurator().beforeRequest(reqHeaders); + if (Constants.DEFAULT_ORIGIN_HEADER_VALUE != null + && !reqHeaders.containsKey(Constants.ORIGIN_HEADER_NAME)) { List originValues = new ArrayList<>(1); originValues.add(Constants.DEFAULT_ORIGIN_HEADER_VALUE); reqHeaders.put(Constants.ORIGIN_HEADER_NAME, originValues); @@ -277,17 +281,18 @@ public Session connectToServer(Endpoint endpoint, "wsWebSocketContainer.asynchronousSocketChannelFail"), ioe); } + Map userProperties = clientEndpointConfiguration.getUserProperties(); + // Get the connection timeout long timeout = Constants.IO_TIMEOUT_MS_DEFAULT; - String timeoutValue = (String) clientEndpointConfiguration.getUserProperties().get( - Constants.IO_TIMEOUT_MS_PROPERTY); + String timeoutValue = (String) userProperties.get(Constants.IO_TIMEOUT_MS_PROPERTY); if (timeoutValue != null) { timeout = Long.valueOf(timeoutValue).intValue(); } // Set-up // Same size as the WsFrame input buffer - ByteBuffer response = ByteBuffer.allocate(maxBinaryMessageBufferSize); + ByteBuffer response = ByteBuffer.allocate(getDefaultMaxBinaryMessageBufferSize()); String subProtocol; boolean success = false; List extensionsAgreed = new ArrayList<>(); @@ -323,8 +328,7 @@ public Session connectToServer(Endpoint endpoint, // Regardless of whether a non-secure wrapper was created for a // proxy CONNECT, need to use TLS from this point on so wrap the // original AsynchronousSocketChannel - SSLEngine sslEngine = createSSLEngine( - clientEndpointConfiguration.getUserProperties()); + SSLEngine sslEngine = createSSLEngine(userProperties); channel = new AsyncChannelWrapperSecure(socketChannel, sslEngine); } else if (channel == null) { // Only need to wrap as this point if it wasn't wrapped to process a @@ -341,10 +345,95 @@ public Session connectToServer(Endpoint endpoint, writeRequest(channel, request, timeout); HttpResponse httpResponse = processResponse(response, channel, timeout); - // TODO: Handle redirects + + // Check maximum permitted redirects + int maxRedirects = Constants.MAX_REDIRECTIONS_DEFAULT; + String maxRedirectsValue = + (String) userProperties.get(Constants.MAX_REDIRECTIONS_PROPERTY); + if (maxRedirectsValue != null) { + maxRedirects = Integer.parseInt(maxRedirectsValue); + } + if (httpResponse.status != 101) { - throw new DeploymentException(sm.getString("wsWebSocketContainer.invalidStatus", - Integer.toString(httpResponse.status))); + if(isRedirectStatus(httpResponse.status)){ + List locationHeader = + httpResponse.getHandshakeResponse().getHeaders().get( + Constants.LOCATION_HEADER_NAME); + + if (locationHeader == null \|\| locationHeader.isEmpty() \|\| + locationHeader.get(0) == null \|\| locationHeader.get(0).isEmpty()) { + throw new DeploymentException(sm.getString( + "wsWebSocketContainer.missingLocationHeader", + Integer.toString(httpResponse.status))); + } + + URI redirectLocation = URI.create(locationHeader.get(0)).normalize(); + + if (!redirectLocation.isAbsolute()) { + redirectLocation = path.resolve(redirectLocation); + } + + String redirectScheme = redirectLocation.getScheme().toLowerCase(); + + if (redirectScheme.startsWith("http")) { + redirectLocation = new URI(redirectScheme.replace("http", "ws"), + redirectLocation.getUserInfo(), redirectLocation.getHost(), + redirectLocation.getPort(), redirectLocation.getPath(), + redirectLocation.getQuery(), redirectLocation.getFragment()); + } + + if (!redirectSet.add(redirectLocation) \|\| redirectSet.size() > maxRedirects) { + throw new DeploymentException(sm.getString( + "wsWebSocketContainer.redirectThreshold", redirectLocation, + Integer.toString(redirectSet.size()), + Integer.toString(maxRedirects))); + } + + return connectToServerRecursive(endpoint, clientEndpointConfiguration, redirectLocation, redirectSet); + + } + + else if (httpResponse.status == 401) { + + if (userProperties.get(Constants.AUTHORIZATION_HEADER_NAME) != null) { + throw new DeploymentException(sm.getString( + "wsWebSocketContainer.failedAuthentication", + Integer.valueOf(httpResponse.status))); + } + + List wwwAuthenticateHeaders = httpResponse.getHandshakeResponse() + .getHeaders().get(Constants.WWW_AUTHENTICATE_HEADER_NAME); + + if (wwwAuthenticateHeaders == null \|\| wwwAuthenticateHeaders.isEmpty() \|\| + wwwAuthenticateHeaders.get(0) == null \|\| wwwAuthenticateHeaders.get(0).isEmpty()) { + throw new DeploymentException(sm.getString( + "wsWebSocketContainer.missingWWWAuthenticateHeader", + Integer.toString(httpResponse.status))); + } + + String authScheme = wwwAuthenticateHeaders.get(0).split("\\s+", 2)[0]; + String requestUri = new String(request.array(), StandardCharsets.ISO_8859_1) + .split("\\s", 3)[1]; + + Authenticator auth = AuthenticatorFactory.getAuthenticator(authScheme); + + if (auth == null) { + throw new DeploymentException( + sm.getString("wsWebSocketContainer.unsupportedAuthScheme", + Integer.valueOf(httpResponse.status), authScheme)); + } + + userProperties.put(Constants.AUTHORIZATION_HEADER_NAME, auth.getAuthorization( + requestUri, wwwAuthenticateHeaders.get(0), userProperties)); + + return connectToServerRecursive(endpoint, clientEndpointConfiguration, path, redirectSet); + + } + + else { + throw new DeploymentException(sm.getString("wsWebSocketContainer.invalidStatus", + Integer.toString(httpResponse.status))); + } } HandshakeResponse handshakeResponse = httpResponse.getHandshakeResponse(); clientEndpointConfiguration.getConfigurator().afterResponse(handshakeResponse); @@ -391,7 +480,7 @@ public Session connectToServer(Endpoint endpoint, success = true; } catch (ExecutionException \| InterruptedException \| SSLException \| - EOFException \| TimeoutException e) { + EOFException \| TimeoutException \| URISyntaxException \| AuthenticationException e) { throw new DeploymentException( sm.getString("wsWebSocketContainer.httpRequestFailed"), e); } finally { @@ -449,6 +538,27 @@ private static void writeRequest(AsyncChannelWrapper channel, ByteBuffer request } + private static boolean isRedirectStatus(int httpResponseCode) { + + boolean isRedirect = false; + + switch (httpResponseCode) { + case Constants.MULTIPLE_CHOICES: + case Constants.MOVED_PERMANENTLY: + case Constants.FOUND: + case Constants.SEE_OTHER: + case Constants.USE_PROXY: + case Constants.TEMPORARY_REDIRECT: + isRedirect = true; + break; + default: + break; + } + + return isRedirect; + } + + private static ByteBuffer createProxyRequest(String host, int port) { StringBuilder request = new StringBuilder(); request.append("CONNECT "); @@ -467,7 +577,6 @@ private static ByteBuffer createProxyRequest(String host, int port) { return ByteBuffer.wrap(bytes); } - protected void registerSession(Endpoint endpoint, WsSession wsSession) { if (!wsSession.isOpen()) { @@ -518,10 +627,19 @@ Set getOpenSessions(Endpoint endpoint) { return result; } - private static Map> createRequestHeaders(String host, - int port, List subProtocols, List extensions) { + private static Map> createRequestHeaders(String host, int port, + ClientEndpointConfig clientEndpointConfiguration) { - Map> headers = new HashMap<>(); + Map> headers = new HashMap<>(); + List extensions = clientEndpointConfiguration.getExtensions(); + List subProtocols = clientEndpointConfiguration.getPreferredSubprotocols(); + Map userProperties = clientEndpointConfiguration.getUserProperties(); + + if (userProperties.get(Constants.AUTHORIZATION_HEADER_NAME) != null) { + List authValues = new ArrayList<>(1); + authValues.add((String) userProperties.get(Constants.AUTHORIZATION_HEADER_NAME)); + headers.put(Constants.AUTHORIZATION_HEADER_NAME, authValues); + } // Host header List hostValues = new ArrayList<>(1); @@ -590,7 +708,7 @@ private static List generateExtensionHeaders(List extensions) private static String generateWsKeyValue() { byte[] keyBytes = new byte[16]; - random.nextBytes(keyBytes); + RANDOM.nextBytes(keyBytes); return Base64.encodeBase64String(keyBytes); } @@ -613,14 +731,12 @@ private static ByteBuffer createRequest(URI uri, Map> reqHea result.put(HTTP_VERSION_BYTES); // Headers - Iterator>> iter = reqHeaders.entrySet().iterator(); - while (iter.hasNext()) { - Entry> entry = iter.next(); + for (Entry> entry : reqHeaders.entrySet()) { addHeader(result, entry.getKey(), entry.getValue()); } // Terminating CRLF - result.put(crlf); + result.put(CRLF); result.flip(); @@ -636,7 +752,7 @@ private static void addHeader(ByteBuffer result, String key, List values result.put(key.getBytes(StandardCharsets.ISO_8859_1)); result.put(": ".getBytes(StandardCharsets.ISO_8859_1)); result.put(StringUtils.join(values).getBytes(StandardCharsets.ISO_8859_1)); - result.put(crlf); + result.put(CRLF); } diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/Constants.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/Constants.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/Constants.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/Constants.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/websocket/pojo/LocalStrings.properties similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/websocket/pojo/LocalStrings.properties diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointBase.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointBase.java similarity index 98% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointBase.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointBase.java index 47f7603..47110da 100644 --- a/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointBase.java +++ b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointBase.java @@ -72,14 +72,11 @@ protected final void doOnOpen(Session session, EndpointConfig config) { "pojoEndpointBase.onOpenFail", pojo.getClass().getName()), e); handleOnOpenOrCloseError(session, e); - return; } catch (InvocationTargetException e) { Throwable cause = e.getCause(); handleOnOpenOrCloseError(session, cause); - return; } catch (Throwable t) { handleOnOpenOrCloseError(session, t); - return; } } } diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointClient.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointClient.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointClient.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointClient.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointServer.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointServer.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointServer.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoEndpointServer.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerBase.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerBase.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerBase.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerBase.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialBase.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialBase.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialBase.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialBase.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialBinary.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialBinary.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialBinary.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialBinary.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialText.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialText.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialText.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerPartialText.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBase.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBase.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBase.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBase.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBinary.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBinary.java similarity index 93% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBinary.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBinary.java index d91f5f1..e4756f6 100644 --- a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBinary.java +++ b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeBinary.java @@ -66,14 +66,13 @@ public PojoMessageHandlerWholeBinary(Object pojo, Method method, if (decoderClazzes != null) { for (Class decoderClazz : decoderClazzes) { if (Binary.class.isAssignableFrom(decoderClazz)) { - Binary decoder = - (Binary) decoderClazz.newInstance(); + Binary decoder = (Binary) decoderClazz.getConstructor().newInstance(); decoder.init(config); decoders.add(decoder); } else if (BinaryStream.class.isAssignableFrom( decoderClazz)) { - BinaryStream decoder = - (BinaryStream) decoderClazz.newInstance(); + BinaryStream decoder = (BinaryStream) + decoderClazz.getConstructor().newInstance(); decoder.init(config); decoders.add(decoder); } else { @@ -81,7 +80,7 @@ public PojoMessageHandlerWholeBinary(Object pojo, Method method, } } } - } catch (IllegalAccessException \| InstantiationException e) { + } catch (ReflectiveOperationException e) { throw new IllegalArgumentException(e); } this.isForInputStream = isForInputStream; diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholePong.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholePong.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholePong.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholePong.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeText.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeText.java similarity index 96% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeText.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeText.java index 27e1c54..3ec4bd7 100644 --- a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeText.java +++ b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMessageHandlerWholeText.java @@ -75,13 +75,13 @@ public PojoMessageHandlerWholeText(Object pojo, Method method, if (decoderClazzes != null) { for (Class decoderClazz : decoderClazzes) { if (Text.class.isAssignableFrom(decoderClazz)) { - Text decoder = (Text) decoderClazz.newInstance(); + Text decoder = (Text) decoderClazz.getConstructor().newInstance(); decoder.init(config); decoders.add(decoder); } else if (TextStream.class.isAssignableFrom( decoderClazz)) { TextStream decoder = - (TextStream) decoderClazz.newInstance(); + (TextStream) decoderClazz.getConstructor().newInstance(); decoder.init(config); decoders.add(decoder); } else { @@ -89,7 +89,7 @@ public PojoMessageHandlerWholeText(Object pojo, Method method, } } } - } catch (IllegalAccessException \| InstantiationException e) { + } catch (ReflectiveOperationException e) { throw new IllegalArgumentException(e); } } diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMethodMapping.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMethodMapping.java similarity index 99% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoMethodMapping.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMethodMapping.java index e7b8bd1..595e7f9 100644 --- a/src/main/java/org/apache/tomcat/websocket/pojo/PojoMethodMapping.java +++ b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoMethodMapping.java @@ -197,9 +197,9 @@ private void checkPublic(Method m) throws DeploymentException { private boolean isMethodOverride(Method method1, Method method2) { - return (method1.getName().equals(method2.getName()) + return method1.getName().equals(method2.getName()) && method1.getReturnType().equals(method2.getReturnType()) - && Arrays.equals(method1.getParameterTypes(), method2.getParameterTypes())); + && Arrays.equals(method1.getParameterTypes(), method2.getParameterTypes()); } @@ -722,7 +722,7 @@ public Set getMessageHandlers(Object pojo, } - private static enum MethodType { + private enum MethodType { ON_OPEN, ON_CLOSE, ON_ERROR diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/PojoPathParam.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/PojoPathParam.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/PojoPathParam.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/PojoPathParam.java diff --git a/src/main/java/org/apache/tomcat/websocket/pojo/package-info.java b/core/src/main/java/org/apache/tomcat/websocket/pojo/package-info.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/pojo/package-info.java rename to core/src/main/java/org/apache/tomcat/websocket/pojo/package-info.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/Constants.java b/core/src/main/java/org/apache/tomcat/websocket/server/Constants.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/Constants.java rename to core/src/main/java/org/apache/tomcat/websocket/server/Constants.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java b/core/src/main/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java similarity index 93% rename from src/main/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java rename to core/src/main/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java index 695fd44..75b8d70 100644 --- a/src/main/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java +++ b/core/src/main/java/org/apache/tomcat/websocket/server/DefaultServerEndpointConfigurator.java @@ -33,8 +33,10 @@ public class DefaultServerEndpointConfigurator public T getEndpointInstance(Class clazz) throws InstantiationException { try { - return clazz.newInstance(); - } catch (IllegalAccessException e) { + return clazz.getConstructor().newInstance(); + } catch (InstantiationException e) { + throw e; + } catch (ReflectiveOperationException e) { InstantiationException ie = new InstantiationException(); ie.initCause(e); throw ie; diff --git a/src/main/java/org/apache/tomcat/websocket/server/LocalStrings.properties b/core/src/main/java/org/apache/tomcat/websocket/server/LocalStrings.properties similarity index 99% rename from src/main/java/org/apache/tomcat/websocket/server/LocalStrings.properties rename to core/src/main/java/org/apache/tomcat/websocket/server/LocalStrings.properties index ca425e2..ae6f9ef 100644 --- a/src/main/java/org/apache/tomcat/websocket/server/LocalStrings.properties +++ b/core/src/main/java/org/apache/tomcat/websocket/server/LocalStrings.properties @@ -12,6 +12,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. + serverContainer.addNotAllowed=No further Endpoints may be registered once an attempt has been made to use one of the previously registered endpoints serverContainer.configuratorFail=Failed to create configurator of type [{0}] for POJO of type [{1}] serverContainer.duplicatePaths=Multiple Endpoints may not be deployed to the same path [{0}] : existing endpoint was [{1}] and new endpoint is [{2}] diff --git a/src/main/java/org/apache/tomcat/websocket/server/UpgradeUtil.java b/core/src/main/java/org/apache/tomcat/websocket/server/UpgradeUtil.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/UpgradeUtil.java rename to core/src/main/java/org/apache/tomcat/websocket/server/UpgradeUtil.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/UriTemplate.java b/core/src/main/java/org/apache/tomcat/websocket/server/UriTemplate.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/UriTemplate.java rename to core/src/main/java/org/apache/tomcat/websocket/server/UriTemplate.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsContextListener.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsContextListener.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/WsContextListener.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsContextListener.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsFilter.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsFilter.java similarity index 98% rename from src/main/java/org/apache/tomcat/websocket/server/WsFilter.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsFilter.java index 17f5651..4a13d2a 100644 --- a/src/main/java/org/apache/tomcat/websocket/server/WsFilter.java +++ b/core/src/main/java/org/apache/tomcat/websocket/server/WsFilter.java @@ -33,7 +33,7 @@ public class WsFilter extends GenericFilter { private static final long serialVersionUID = 1L; - private WsServerContainer sc; + private transient WsServerContainer sc; @Override diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsFrameServer.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsFrameServer.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/WsFrameServer.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsFrameServer.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsHandshakeRequest.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsHandshakeRequest.java similarity index 98% rename from src/main/java/org/apache/tomcat/websocket/server/WsHandshakeRequest.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsHandshakeRequest.java index 4bc7079..15f046f 100644 --- a/src/main/java/org/apache/tomcat/websocket/server/WsHandshakeRequest.java +++ b/core/src/main/java/org/apache/tomcat/websocket/server/WsHandshakeRequest.java @@ -79,7 +79,7 @@ public WsHandshakeRequest(HttpServletRequest request, Map pathPar for (Entry entry : pathParams.entrySet()) { newParameters.put(entry.getKey(), Collections.unmodifiableList( - Arrays.asList(entry.getValue()))); + Collections.singletonList(entry.getValue()))); } parameterMap = Collections.unmodifiableMap(newParameters); diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsHttpUpgradeHandler.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsHttpUpgradeHandler.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/WsHttpUpgradeHandler.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsHttpUpgradeHandler.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsMappingResult.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsMappingResult.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/WsMappingResult.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsMappingResult.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsPerSessionServerEndpointConfig.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsPerSessionServerEndpointConfig.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/WsPerSessionServerEndpointConfig.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsPerSessionServerEndpointConfig.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java similarity index 95% rename from src/main/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java index a473126..eb0cb91 100644 --- a/src/main/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java +++ b/core/src/main/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java @@ -74,29 +74,29 @@ protected void doWrite(SendHandler handler, long blockingWriteTimeoutExpiry, onWritePossible(true); } else { // Blocking - for (ByteBuffer buffer : buffers) { - long timeout = blockingWriteTimeoutExpiry - System.currentTimeMillis(); - if (timeout <= 0) { - SendResult sr = new SendResult(new SocketTimeoutException()); - handler.onResult(sr); - return; - } - socketWrapper.setWriteTimeout(timeout); - try { - socketWrapper.write(true, buffer); - timeout = blockingWriteTimeoutExpiry - System.currentTimeMillis(); + try { + for (ByteBuffer buffer : buffers) { + long timeout = blockingWriteTimeoutExpiry - System.currentTimeMillis(); if (timeout <= 0) { SendResult sr = new SendResult(new SocketTimeoutException()); handler.onResult(sr); return; } socketWrapper.setWriteTimeout(timeout); - socketWrapper.flush(true); - handler.onResult(SENDRESULT_OK); - } catch (IOException e) { - SendResult sr = new SendResult(e); + socketWrapper.write(true, buffer); + } + long timeout = blockingWriteTimeoutExpiry - System.currentTimeMillis(); + if (timeout <= 0) { + SendResult sr = new SendResult(new SocketTimeoutException()); handler.onResult(sr); + return; } + socketWrapper.setWriteTimeout(timeout); + socketWrapper.flush(true); + handler.onResult(SENDRESULT_OK); + } catch (IOException e) { + SendResult sr = new SendResult(e); + handler.onResult(sr); } } } diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsSci.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsSci.java similarity index 97% rename from src/main/java/org/apache/tomcat/websocket/server/WsSci.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsSci.java index 635414e..73dabd7 100644 --- a/src/main/java/org/apache/tomcat/websocket/server/WsSci.java +++ b/core/src/main/java/org/apache/tomcat/websocket/server/WsSci.java @@ -72,7 +72,7 @@ public void onStartup(Set> clazzes, ServletContext ctx) } if (ServerApplicationConfig.class.isAssignableFrom(clazz)) { serverApplicationConfigs.add( - (ServerApplicationConfig) clazz.newInstance()); + (ServerApplicationConfig) clazz.getConstructor().newInstance()); } if (Endpoint.class.isAssignableFrom(clazz)) { @SuppressWarnings("unchecked") @@ -84,7 +84,7 @@ public void onStartup(Set> clazzes, ServletContext ctx) scannedPojoEndpoints.add(clazz); } } - } catch (InstantiationException \| IllegalAccessException e) { + } catch (ReflectiveOperationException e) { throw new ServletException(e); } diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsServerContainer.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsServerContainer.java similarity index 98% rename from src/main/java/org/apache/tomcat/websocket/server/WsServerContainer.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsServerContainer.java index c0d474e..ae178cb 100644 --- a/src/main/java/org/apache/tomcat/websocket/server/WsServerContainer.java +++ b/core/src/main/java/org/apache/tomcat/websocket/server/WsServerContainer.java @@ -214,8 +214,8 @@ public void addEndpoint(Class pojo) throws DeploymentException { Configurator configurator = null; if (!configuratorClazz.equals(Configurator.class)) { try { - configurator = annotation.configurator().newInstance(); - } catch (InstantiationException \| IllegalAccessException e) { + configurator = annotation.configurator().getConstructor().newInstance(); + } catch (ReflectiveOperationException e) { throw new DeploymentException(sm.getString( "serverContainer.configuratorFail", annotation.configurator().getName(), @@ -416,8 +416,8 @@ private static void validateEncoders(Class[] encoders) @SuppressWarnings("unused") Encoder instance; try { - encoder.newInstance(); - } catch(InstantiationException \| IllegalAccessException e) { + encoder.getConstructor().newInstance(); + } catch(ReflectiveOperationException e) { throw new DeploymentException(sm.getString( "serverContainer.encoderFail", encoder.getName()), e); } diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsSessionListener.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsSessionListener.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/WsSessionListener.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsSessionListener.java diff --git a/src/main/java/org/apache/tomcat/websocket/server/WsWriteTimeout.java b/core/src/main/java/org/apache/tomcat/websocket/server/WsWriteTimeout.java similarity index 95% rename from src/main/java/org/apache/tomcat/websocket/server/WsWriteTimeout.java rename to core/src/main/java/org/apache/tomcat/websocket/server/WsWriteTimeout.java index 8b85b6c..273acd2 100644 --- a/src/main/java/org/apache/tomcat/websocket/server/WsWriteTimeout.java +++ b/core/src/main/java/org/apache/tomcat/websocket/server/WsWriteTimeout.java @@ -17,7 +17,6 @@ package org.apache.tomcat.websocket.server; import java.util.Comparator; -import java.util.Iterator; import java.util.Set; import java.util.concurrent.ConcurrentSkipListSet; import java.util.concurrent.atomic.AtomicInteger; @@ -48,9 +47,7 @@ public void backgroundProcess() { backgroundProcessCount = 0; long now = System.currentTimeMillis(); - Iterator iter = endpoints.iterator(); - while (iter.hasNext()) { - WsRemoteEndpointImplServer endpoint = iter.next(); + for (WsRemoteEndpointImplServer endpoint : endpoints) { if (endpoint.getTimeoutExpiry() < now) { // Background thread, not the thread that triggered the // write so no need to use a dispatch diff --git a/src/main/java/org/apache/tomcat/websocket/server/package-info.java b/core/src/main/java/org/apache/tomcat/websocket/server/package-info.java similarity index 100% rename from src/main/java/org/apache/tomcat/websocket/server/package-info.java rename to core/src/main/java/org/apache/tomcat/websocket/server/package-info.java diff --git a/core/tomcat-core.iml b/core/tomcat-core.iml new file mode 100644 index 0000000..841f038 --- /dev/null +++ b/core/tomcat-core.iml @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/output/LICENSE b/output/LICENSE old mode 100755 new mode 100644 diff --git a/output/NOTICE b/output/NOTICE old mode 100755 new mode 100644 index 1c2a208..d359afa --- a/output/NOTICE +++ b/output/NOTICE @@ -1,5 +1,5 @@ Apache Tomcat -Copyright 1999-2017 The Apache Software Foundation +Copyright 1999-2018 The Apache Software Foundation This product includes software developed at The Apache Software Foundation (http://www.apache.org/). diff --git a/output/RELEASE-NOTES b/output/RELEASE-NOTES old mode 100755 new mode 100644 index aaef689..0782607 --- a/output/RELEASE-NOTES +++ b/output/RELEASE-NOTES @@ -16,7 +16,7 @@ ================================================================================ - Apache Tomcat Version 9.0.0.M21 + Apache Tomcat Version 9.0.4 Release Notes @@ -93,7 +93,8 @@ or by placing them in JAR files in the "lib" directory. To override the XML parser implementation or interfaces, use the appropriate feature for your JVM. For Java <= 8 use the endorsed standards override -feature. For Java 9+ use the upgradeable modules feature. +feature. The default configuration defines JARs located in "endorsed" as endorsed. +For Java 9+ use the upgradeable modules feature. ================================================================ diff --git a/output/RUNNING.txt b/output/RUNNING.txt old mode 100755 new mode 100644 index d38796a..654d7af --- a/output/RUNNING.txt +++ b/output/RUNNING.txt @@ -272,6 +272,12 @@ In CATALINA_HOME: lib - Libraries and classes, as explained below + * endorsed - Libraries that override standard "Endorsed Standards" + libraries provided by JRE. See Classloading documentation + in the User Guide for details. + This is only supported for Java <= 8. + By default this "endorsed" directory is absent. + In the default configuration the JAR libraries and classes both in CATALINA_BASE/lib and in CATALINA_HOME/lib will be added to the common classpath, but the ones in CATALINA_BASE will be added first and thus will diff --git a/output/bin/bootstrap.jar b/output/bin/bootstrap.jar old mode 100755 new mode 100644 index bc1eba9..05a2a63 Binary files a/output/bin/bootstrap.jar and b/output/bin/bootstrap.jar differ diff --git a/output/bin/catalina-tasks.xml b/output/bin/catalina-tasks.xml old mode 100755 new mode 100644 diff --git a/output/bin/catalina.bat b/output/bin/catalina.bat old mode 100755 new mode 100644 index 1a40a34..99ef006 --- a/output/bin/catalina.bat +++ b/output/bin/catalina.bat @@ -63,6 +63,13 @@ rem should be used by Tomcat and also by the stop process, rem the version command etc. rem Most options should go into CATALINA_OPTS. rem +rem JAVA_ENDORSED_DIRS (Optional) Lists of of semi-colon separated directories +rem containing some jars in order to allow replacement of APIs +rem created outside of the JCP (i.e. DOM and SAX from W3C). +rem It can also be used to update the XML parser implementation. +rem This is only supported for Java <= 8. +rem Defaults to $CATALINA_HOME/endorsed. +rem rem JPDA_TRANSPORT (Optional) JPDA transport used when the "jpda start" rem command is executed. The default is "dt_socket". rem @@ -215,6 +222,23 @@ if not "%LOGGING_MANAGER%" == "" goto noJuliManager set LOGGING_MANAGER=-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager :noJuliManager +rem Configure JAVA 9 specific start-up parameters +set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.base/java.lang=ALL-UNNAMED" +set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED" + +rem Java 9 no longer supports the java.endorsed.dirs +rem system property. Only try to use it if +rem JAVA_ENDORSED_DIRS was explicitly set +rem or CATALINA_HOME/endorsed exists. +set ENDORSED_PROP=ignore.endorsed.dirs +if "%JAVA_ENDORSED_DIRS%" == "" goto noEndorsedVar +set ENDORSED_PROP=java.endorsed.dirs +goto doneEndorsed +:noEndorsedVar +if not exist "%CATALINA_HOME%\endorsed" goto doneEndorsed +set ENDORSED_PROP=java.endorsed.dirs +:doneEndorsed + rem ----- Execute The Requested Command --------------------------------------- echo Using CATALINA_BASE: "%CATALINA_BASE%" @@ -331,17 +355,17 @@ goto setArgs rem Execute Java with the applicable properties if not "%JPDA%" == "" goto doJpda if not "%SECURITY_POLICY_FILE%" == "" goto doSecurity -%_EXECJAVA% %LOGGING_CONFIG% %LOGGING_MANAGER% %JAVA_OPTS% %CATALINA_OPTS% %DEBUG_OPTS% -classpath "%CLASSPATH%" -Dcatalina.base="%CATALINA_BASE%" -Dcatalina.home="%CATALINA_HOME%" -Djava.io.tmpdir="%CATALINA_TMPDIR%" %MAINCLASS% %CMD_LINE_ARGS% %ACTION% +%_EXECJAVA% %LOGGING_CONFIG% %LOGGING_MANAGER% %JAVA_OPTS% %CATALINA_OPTS% %DEBUG_OPTS% -D%ENDORSED_PROP%="%JAVA_ENDORSED_DIRS%" -classpath "%CLASSPATH%" -Dcatalina.base="%CATALINA_BASE%" -Dcatalina.home="%CATALINA_HOME%" -Djava.io.tmpdir="%CATALINA_TMPDIR%" %MAINCLASS% %CMD_LINE_ARGS% %ACTION% goto end :doSecurity -%_EXECJAVA% %LOGGING_CONFIG% %LOGGING_MANAGER% %JAVA_OPTS% %CATALINA_OPTS% %DEBUG_OPTS% -classpath "%CLASSPATH%" -Djava.security.manager -Djava.security.policy=="%SECURITY_POLICY_FILE%" -Dcatalina.base="%CATALINA_BASE%" -Dcatalina.home="%CATALINA_HOME%" -Djava.io.tmpdir="%CATALINA_TMPDIR%" %MAINCLASS% %CMD_LINE_ARGS% %ACTION% +%_EXECJAVA% %LOGGING_CONFIG% %LOGGING_MANAGER% %JAVA_OPTS% %CATALINA_OPTS% %DEBUG_OPTS% -D%ENDORSED_PROP%="%JAVA_ENDORSED_DIRS%" -classpath "%CLASSPATH%" -Djava.security.manager -Djava.security.policy=="%SECURITY_POLICY_FILE%" -Dcatalina.base="%CATALINA_BASE%" -Dcatalina.home="%CATALINA_HOME%" -Djava.io.tmpdir="%CATALINA_TMPDIR%" %MAINCLASS% %CMD_LINE_ARGS% %ACTION% goto end :doJpda if not "%SECURITY_POLICY_FILE%" == "" goto doSecurityJpda -%_EXECJAVA% %LOGGING_CONFIG% %LOGGING_MANAGER% %JAVA_OPTS% %JPDA_OPTS% %CATALINA_OPTS% %DEBUG_OPTS% -classpath "%CLASSPATH%" -Dcatalina.base="%CATALINA_BASE%" -Dcatalina.home="%CATALINA_HOME%" -Djava.io.tmpdir="%CATALINA_TMPDIR%" %MAINCLASS% %CMD_LINE_ARGS% %ACTION% +%_EXECJAVA% %LOGGING_CONFIG% %LOGGING_MANAGER% %JAVA_OPTS% %JPDA_OPTS% %CATALINA_OPTS% %DEBUG_OPTS% -D%ENDORSED_PROP%="%JAVA_ENDORSED_DIRS%" -classpath "%CLASSPATH%" -Dcatalina.base="%CATALINA_BASE%" -Dcatalina.home="%CATALINA_HOME%" -Djava.io.tmpdir="%CATALINA_TMPDIR%" %MAINCLASS% %CMD_LINE_ARGS% %ACTION% goto end :doSecurityJpda -%_EXECJAVA% %LOGGING_CONFIG% %LOGGING_MANAGER% %JAVA_OPTS% %JPDA_OPTS% %CATALINA_OPTS% %DEBUG_OPTS% -classpath "%CLASSPATH%" -Djava.security.manager -Djava.security.policy=="%SECURITY_POLICY_FILE%" -Dcatalina.base="%CATALINA_BASE%" -Dcatalina.home="%CATALINA_HOME%" -Djava.io.tmpdir="%CATALINA_TMPDIR%" %MAINCLASS% %CMD_LINE_ARGS% %ACTION% +%_EXECJAVA% %LOGGING_CONFIG% %LOGGING_MANAGER% %JAVA_OPTS% %JPDA_OPTS% %CATALINA_OPTS% %DEBUG_OPTS% -D%ENDORSED_PROP%="%JAVA_ENDORSED_DIRS%" -classpath "%CLASSPATH%" -Djava.security.manager -Djava.security.policy=="%SECURITY_POLICY_FILE%" -Dcatalina.base="%CATALINA_BASE%" -Dcatalina.home="%CATALINA_HOME%" -Djava.io.tmpdir="%CATALINA_TMPDIR%" %MAINCLASS% %CMD_LINE_ARGS% %ACTION% goto end :end diff --git a/output/bin/catalina.sh b/output/bin/catalina.sh old mode 100755 new mode 100644 index e37a8b9..9e50e77 --- a/output/bin/catalina.sh +++ b/output/bin/catalina.sh @@ -58,6 +58,13 @@ # the version command etc. # Most options should go into CATALINA_OPTS. # +# JAVA_ENDORSED_DIRS (Optional) Lists of of colon separated directories +# containing some jars in order to allow replacement of APIs +# created outside of the JCP (i.e. DOM and SAX from W3C). +# It can also be used to update the XML parser implementation. +# This is only supported for Java <= 8. +# Defaults to $CATALINA_HOME/endorsed. +# # JPDA_TRANSPORT (Optional) JPDA transport used when the "jpda start" # command is executed. The default is "dt_socket". # @@ -233,6 +240,7 @@ if $cygwin; then CATALINA_BASE=`cygpath --absolute --windows "$CATALINA_BASE"` CATALINA_TMPDIR=`cygpath --absolute --windows "$CATALINA_TMPDIR"` CLASSPATH=`cygpath --path --windows "$CLASSPATH"` + JAVA_ENDORSED_DIRS=`cygpath --path --windows "$JAVA_ENDORSED_DIRS"` fi if [ -z "$JSSE_OPTS" ] ; then @@ -264,6 +272,18 @@ if [ -z "$UMASK" ]; then fi umask $UMASK +# Java 9 no longer supports the java.endorsed.dirs +# system property. Only try to use it if +# JAVA_ENDORSED_DIRS was explicitly set +# or CATALINA_HOME/endorsed exists. +ENDORSED_PROP=ignore.endorsed.dirs +if [ -n "$JAVA_ENDORSED_DIRS" ]; then + ENDORSED_PROP=java.endorsed.dirs +fi +if [ -d "$CATALINA_HOME/endorsed" ]; then + ENDORSED_PROP=java.endorsed.dirs +fi + # Uncomment the following line to make the umask available when using the # org.apache.catalina.security.SecurityListener #JAVA_OPTS="$JAVA_OPTS -Dorg.apache.catalina.security.SecurityListener.UMASK=`umask`" @@ -280,6 +300,11 @@ if [ "$USE_NOHUP" = "true" ]; then _NOHUP=nohup fi +# Add the JAVA 9 specific start-up parameters required by Tomcat +JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.lang=ALL-UNNAMED" +JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED" +export JDK_JAVA_OPTIONS + # ----- Execute The Requested Command ----------------------------------------- # Bugzilla 37848: only output this if we have a TTY @@ -327,6 +352,7 @@ if [ "$1" = "debug" ] ; then fi shift exec "$_RUNJDB" "$LOGGING_CONFIG" $LOGGING_MANAGER $JAVA_OPTS $CATALINA_OPTS \ + -D$ENDORSED_PROP="$JAVA_ENDORSED_DIRS" \ -classpath "$CLASSPATH" \ -sourcepath "$CATALINA_HOME"/../../java \ -Djava.security.manager \ @@ -337,6 +363,7 @@ if [ "$1" = "debug" ] ; then org.apache.catalina.startup.Bootstrap "$@" start else exec "$_RUNJDB" "$LOGGING_CONFIG" $LOGGING_MANAGER $JAVA_OPTS $CATALINA_OPTS \ + -D$ENDORSED_PROP="$JAVA_ENDORSED_DIRS" \ -classpath "$CLASSPATH" \ -sourcepath "$CATALINA_HOME"/../../java \ -Dcatalina.base="$CATALINA_BASE" \ @@ -355,6 +382,7 @@ elif [ "$1" = "run" ]; then fi shift eval exec "\"$_RUNJAVA\"" "\"$LOGGING_CONFIG\"" $LOGGING_MANAGER $JAVA_OPTS $CATALINA_OPTS \ + -D$ENDORSED_PROP="\"$JAVA_ENDORSED_DIRS\"" \ -classpath "\"$CLASSPATH\"" \ -Djava.security.manager \ -Djava.security.policy=="\"$CATALINA_BASE/conf/catalina.policy\"" \ @@ -364,6 +392,7 @@ elif [ "$1" = "run" ]; then org.apache.catalina.startup.Bootstrap "$@" start else eval exec "\"$_RUNJAVA\"" "\"$LOGGING_CONFIG\"" $LOGGING_MANAGER $JAVA_OPTS $CATALINA_OPTS \ + -D$ENDORSED_PROP="\"$JAVA_ENDORSED_DIRS\"" \ -classpath "\"$CLASSPATH\"" \ -Dcatalina.base="\"$CATALINA_BASE\"" \ -Dcatalina.home="\"$CATALINA_HOME\"" \ @@ -421,6 +450,7 @@ elif [ "$1" = "start" ] ; then fi shift eval $_NOHUP "\"$_RUNJAVA\"" "\"$LOGGING_CONFIG\"" $LOGGING_MANAGER $JAVA_OPTS $CATALINA_OPTS \ + -D$ENDORSED_PROP="\"$JAVA_ENDORSED_DIRS\"" \ -classpath "\"$CLASSPATH\"" \ -Djava.security.manager \ -Djava.security.policy=="\"$CATALINA_BASE/conf/catalina.policy\"" \ @@ -432,6 +462,7 @@ elif [ "$1" = "start" ] ; then else eval $_NOHUP "\"$_RUNJAVA\"" "\"$LOGGING_CONFIG\"" $LOGGING_MANAGER $JAVA_OPTS $CATALINA_OPTS \ + -D$ENDORSED_PROP="\"$JAVA_ENDORSED_DIRS\"" \ -classpath "\"$CLASSPATH\"" \ -Dcatalina.base="\"$CATALINA_BASE\"" \ -Dcatalina.home="\"$CATALINA_HOME\"" \ @@ -484,6 +515,7 @@ elif [ "$1" = "stop" ] ; then fi eval "\"$_RUNJAVA\"" $JAVA_OPTS \ + -D$ENDORSED_PROP="\"$JAVA_ENDORSED_DIRS\"" \ -classpath "\"$CLASSPATH\"" \ -Dcatalina.base="\"$CATALINA_BASE\"" \ -Dcatalina.home="\"$CATALINA_HOME\"" \ @@ -570,6 +602,7 @@ elif [ "$1" = "stop" ] ; then elif [ "$1" = "configtest" ] ; then eval "\"$_RUNJAVA\"" $LOGGING_MANAGER $JAVA_OPTS \ + -D$ENDORSED_PROP="\"$JAVA_ENDORSED_DIRS\"" \ -classpath "\"$CLASSPATH\"" \ -Dcatalina.base="\"$CATALINA_BASE\"" \ -Dcatalina.home="\"$CATALINA_HOME\"" \ diff --git a/output/bin/ciphers.bat b/output/bin/ciphers.bat new file mode 100644 index 0000000..914181b --- /dev/null +++ b/output/bin/ciphers.bat @@ -0,0 +1,58 @@ +@echo off +rem Licensed to the Apache Software Foundation (ASF) under one or more +rem contributor license agreements. See the NOTICE file distributed with +rem this work for additional information regarding copyright ownership. +rem The ASF licenses this file to You under the Apache License, Version 2.0 +rem (the "License"); you may not use this file except in compliance with +rem the License. You may obtain a copy of the License at +rem +rem http://www.apache.org/licenses/LICENSE-2.0 +rem +rem Unless required by applicable law or agreed to in writing, software +rem distributed under the License is distributed on an "AS IS" BASIS, +rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +rem See the License for the specific language governing permissions and +rem limitations under the License. + +rem --------------------------------------------------------------------------- +rem Script to digest password using the algorithm specified +rem --------------------------------------------------------------------------- + +setlocal + +rem Guess CATALINA_HOME if not defined +set "CURRENT_DIR=%cd%" +if not "%CATALINA_HOME%" == "" goto gotHome +set "CATALINA_HOME=%CURRENT_DIR%" +if exist "%CATALINA_HOME%\bin\tool-wrapper.bat" goto okHome +cd .. +set "CATALINA_HOME=%cd%" +cd "%CURRENT_DIR%" +:gotHome +if exist "%CATALINA_HOME%\bin\tool-wrapper.bat" goto okHome +echo The CATALINA_HOME environment variable is not defined correctly +echo This environment variable is needed to run this program +goto end +:okHome + +set "EXECUTABLE=%CATALINA_HOME%\bin\tool-wrapper.bat" + +rem Check that target executable exists +if exist "%EXECUTABLE%" goto okExec +echo Cannot find "%EXECUTABLE%" +echo This file is needed to run this program +goto end +:okExec + +rem Get remaining unshifted command line arguments and save them in the +set CMD_LINE_ARGS= +:setArgs +if ""%1""=="""" goto doneSetArgs +set CMD_LINE_ARGS=%CMD_LINE_ARGS% %1 +shift +goto setArgs +:doneSetArgs + +call "%EXECUTABLE%" org.apache.tomcat.util.net.openssl.ciphers.OpenSSLCipherConfigurationParser %CMD_LINE_ARGS% + +:end diff --git a/output/bin/ciphers.sh b/output/bin/ciphers.sh new file mode 100644 index 0000000..d4a87b5 --- /dev/null +++ b/output/bin/ciphers.sh @@ -0,0 +1,60 @@ +#!/bin/sh + +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# ----------------------------------------------------------------------------- +# Script to digest password using the algorithm specified +# ----------------------------------------------------------------------------- + +# Better OS/400 detection: see Bugzilla 31132 +os400=false +case "`uname`" in +OS400) os400=true;; +esac + +# resolve links - $0 may be a softlink +PRG="$0" + +while [ -h "$PRG" ] ; do + ls=`ls -ld "$PRG"` + link=`expr "$ls" : '.-> \(.\)$'` + if expr "$link" : '/.' > /dev/null; then + PRG="$link" + else + PRG=`dirname "$PRG"`/"$link" + fi +done + +PRGDIR=`dirname "$PRG"` +EXECUTABLE=tool-wrapper.sh + +# Check that target executable exists +if $os400; then + # -x will Only work on the os400 if the files are: + # 1. owned by the user + # 2. owned by the PRIMARY group of the user + # this will not work if the user belongs in secondary groups + eval +else + if [ ! -x "$PRGDIR"/"$EXECUTABLE" ]; then + echo "Cannot find $PRGDIR/$EXECUTABLE" + echo "The file is absent or does not have execute permission" + echo "This file is needed to run this program" + exit 1 + fi +fi + +exec "$PRGDIR"/"$EXECUTABLE" org.apache.tomcat.util.net.openssl.ciphers.OpenSSLCipherConfigurationParser "$@" diff --git a/output/bin/commons-daemon-native.tar.gz b/output/bin/commons-daemon-native.tar.gz old mode 100755 new mode 100644 index 6d25918..39cfff5 Binary files a/output/bin/commons-daemon-native.tar.gz and b/output/bin/commons-daemon-native.tar.gz differ diff --git a/output/bin/commons-daemon.jar b/output/bin/commons-daemon.jar old mode 100755 new mode 100644 index 2b6b9c6..173f67f Binary files a/output/bin/commons-daemon.jar and b/output/bin/commons-daemon.jar differ diff --git a/output/bin/configtest.bat b/output/bin/configtest.bat old mode 100755 new mode 100644 diff --git a/output/bin/configtest.sh b/output/bin/configtest.sh old mode 100755 new mode 100644 diff --git a/output/bin/daemon.sh b/output/bin/daemon.sh old mode 100755 new mode 100644 index 5808892..ef9f708 --- a/output/bin/daemon.sh +++ b/output/bin/daemon.sh @@ -94,6 +94,15 @@ test ".$TOMCAT_USER" = . && TOMCAT_USER=tomcat # if [ -z "$JAVA_HOME" ]; then JAVA_BIN="`which java 2>/dev/null \|\| type java 2>&1`" + while [ -h "$JAVA_BIN" ]; do + ls=`ls -ld "$JAVA_BIN"` + link=`expr "$ls" : '.-> \(.\)$'` + if expr "$link" : '/.' > /dev/null; then + JAVA_BIN="$link" + else + JAVA_BIN="`dirname $JAVA_BIN`/$link" + fi + done test -x "$JAVA_BIN" && JAVA_HOME="`dirname $JAVA_BIN`" test ".$JAVA_HOME" != . && JAVA_HOME=`cd "$JAVA_HOME/.." >/dev/null; pwd` else @@ -172,6 +181,18 @@ if [ "$cygwin" = "false" ]; then fi fi +# Java 9 no longer supports the java.endorsed.dirs +# system property. Only try to use it if +# JAVA_ENDORSED_DIRS was explicitly set +# or CATALINA_HOME/endorsed exists. +ENDORSED_PROP=ignore.endorsed.dirs +if [ -n "$JAVA_ENDORSED_DIRS" ]; then + ENDORSED_PROP=java.endorsed.dirs +fi +if [ -d "$CATALINA_HOME/endorsed" ]; then + ENDORSED_PROP=java.endorsed.dirs +fi + # ----- Execute The Requested Command ----------------------------------------- case "$1" in run ) @@ -186,6 +207,7 @@ case "$1" in -errfile "&2" \ -classpath "$CLASSPATH" \ "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \ + -D$ENDORSED_PROP="$JAVA_ENDORSED_DIRS" \ -Dcatalina.base="$CATALINA_BASE" \ -Dcatalina.home="$CATALINA_HOME" \ -Djava.io.tmpdir="$CATALINA_TMP" \ @@ -202,6 +224,7 @@ case "$1" in -errfile "&1" \ -classpath "$CLASSPATH" \ "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \ + -D$ENDORSED_PROP="$JAVA_ENDORSED_DIRS" \ -Dcatalina.base="$CATALINA_BASE" \ -Dcatalina.home="$CATALINA_HOME" \ -Djava.io.tmpdir="$CATALINA_TMP" \ @@ -213,6 +236,7 @@ case "$1" in -stop \ -pidfile "$CATALINA_PID" \ -classpath "$CLASSPATH" \ + -D$ENDORSED_PROP="$JAVA_ENDORSED_DIRS" \ -Dcatalina.base="$CATALINA_BASE" \ -Dcatalina.home="$CATALINA_HOME" \ -Djava.io.tmpdir="$CATALINA_TMP" \ diff --git a/output/bin/digest.bat b/output/bin/digest.bat old mode 100755 new mode 100644 diff --git a/output/bin/digest.sh b/output/bin/digest.sh old mode 100755 new mode 100644 diff --git a/output/bin/setclasspath.bat b/output/bin/setclasspath.bat old mode 100755 new mode 100644 index 4cf6659..f67464a --- a/output/bin/setclasspath.bat +++ b/output/bin/setclasspath.bat @@ -15,8 +15,9 @@ rem See the License for the specific language governing permissions and rem limitations under the License. rem --------------------------------------------------------------------------- -rem Set JAVA_HOME or JRE_HOME if not already set and ensure any provided -rem settings are valid and consistent with the selected start-up options. +rem Set JAVA_HOME or JRE_HOME if not already set, ensure any provided settings +rem are valid and consistent with the selected start-up options and set up the +rem endorsed directory. rem --------------------------------------------------------------------------- rem Make sure prerequisite environment variables are set @@ -64,6 +65,14 @@ echo This environment variable is needed to run this program goto exit :okJava +rem Don't override the endorsed dir if the user has set it previously +if not "%JAVA_ENDORSED_DIRS%" == "" goto gotEndorseddir +rem Java 9 no longer supports the java.endorsed.dirs +rem system property. Only try to use it if +rem CATALINA_HOME/endorsed exists. +if not exist "%CATALINA_HOME%\endorsed" goto gotEndorseddir +set "JAVA_ENDORSED_DIRS=%CATALINA_HOME%\endorsed" +:gotEndorseddir rem Don't override _RUNJAVA if the user has set it previously if not "%_RUNJAVA%" == "" goto gotRunJava diff --git a/output/bin/setclasspath.sh b/output/bin/setclasspath.sh old mode 100755 new mode 100644 index ee8deb3..5232b8e --- a/output/bin/setclasspath.sh +++ b/output/bin/setclasspath.sh @@ -16,8 +16,9 @@ # limitations under the License. # ----------------------------------------------------------------------------- -# Set JAVA_HOME or JRE_HOME if not already set and ensure any provided -# settings are valid and consistent with the selected start-up options. +# Set JAVA_HOME or JRE_HOME if not already set, ensure any provided settings +# are valid and consistent with the selected start-up options and set up the +# endorsed directory. # ----------------------------------------------------------------------------- # Make sure prerequisite environment variables are set @@ -76,6 +77,16 @@ if [ "$1" = "debug" ] ; then fi fi +# Don't override the endorsed dir if the user has set it previously +if [ -z "$JAVA_ENDORSED_DIRS" ]; then + # Java 9 no longer supports the java.endorsed.dirs + # system property. Only try to use it if + # CATALINA_HOME/endorsed exists. + if [ -d "$CATALINA_HOME"/endorsed ]; then + JAVA_ENDORSED_DIRS="$CATALINA_HOME"/endorsed + fi +fi + # Set standard commands for invoking Java, if not already set. if [ -z "$_RUNJAVA" ]; then _RUNJAVA="$JRE_HOME"/bin/java @@ -84,4 +95,4 @@ if [ "$os400" != "true" ]; then if [ -z "$_RUNJDB" ]; then _RUNJDB="$JAVA_HOME"/bin/jdb fi -fi \ No newline at end of file +fi diff --git a/output/bin/shutdown.bat b/output/bin/shutdown.bat old mode 100755 new mode 100644 diff --git a/output/bin/shutdown.sh b/output/bin/shutdown.sh old mode 100755 new mode 100644 diff --git a/output/bin/startup.bat b/output/bin/startup.bat old mode 100755 new mode 100644 diff --git a/output/bin/startup.sh b/output/bin/startup.sh old mode 100755 new mode 100644 diff --git a/output/bin/tomcat-juli.jar b/output/bin/tomcat-juli.jar old mode 100755 new mode 100644 index 80da70c..a0fd219 Binary files a/output/bin/tomcat-juli.jar and b/output/bin/tomcat-juli.jar differ diff --git a/output/bin/tomcat-native.tar.gz b/output/bin/tomcat-native.tar.gz old mode 100755 new mode 100644 index 0f2e787..2b47ef1 Binary files a/output/bin/tomcat-native.tar.gz and b/output/bin/tomcat-native.tar.gz differ diff --git a/output/bin/tool-wrapper.bat b/output/bin/tool-wrapper.bat old mode 100755 new mode 100644 index 64f38a0..94de4fe --- a/output/bin/tool-wrapper.bat +++ b/output/bin/tool-wrapper.bat @@ -31,6 +31,13 @@ rem Defaults to JAVA_HOME if empty. If JRE_HOME and JAVA_HOME rem are both set, JRE_HOME is used. rem rem JAVA_OPTS (Optional) Java runtime options. +rem +rem JAVA_ENDORSED_DIRS (Optional) Lists of of semi-colon separated directories +rem containing some jars in order to allow replacement of APIs +rem created outside of the JCP (i.e. DOM and SAX from W3C). +rem It can also be used to update the XML parser implementation. +rem This is only supported for Java <= 8. +rem Defaults to $CATALINA_HOME/endorsed. rem --------------------------------------------------------------------------- setlocal @@ -76,6 +83,19 @@ set "CLASSPATH=%CLASSPATH%%CATALINA_HOME%\bin\bootstrap.jar;%CATALINA_HOME%\bin\ set JAVA_OPTS=%JAVA_OPTS% -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager +rem Java 9 no longer supports the java.endorsed.dirs +rem system property. Only try to use it if +rem JAVA_ENDORSED_DIRS was explicitly set +rem or CATALINA_HOME/endorsed exists. +set ENDORSED_PROP=ignore.endorsed.dirs +if "%JAVA_ENDORSED_DIRS%" == "" goto noEndorsedVar +set ENDORSED_PROP=java.endorsed.dirs +goto doneEndorsed +:noEndorsedVar +if not exist "%CATALINA_HOME%\endorsed" goto doneEndorsed +set ENDORSED_PROP=java.endorsed.dirs +:doneEndorsed + rem Get remaining unshifted command line arguments and save them in the set CMD_LINE_ARGS= :setArgs @@ -85,6 +105,6 @@ shift goto setArgs :doneSetArgs -%_RUNJAVA% %JAVA_OPTS% %TOOL_OPTS% -classpath "%CLASSPATH%" -Dcatalina.home="%CATALINA_HOME%" org.apache.catalina.startup.Tool %CMD_LINE_ARGS% +%_RUNJAVA% %JAVA_OPTS% %TOOL_OPTS% -D%ENDORSED_PROP%="%JAVA_ENDORSED_DIRS%" -classpath "%CLASSPATH%" -Dcatalina.home="%CATALINA_HOME%" org.apache.catalina.startup.Tool %CMD_LINE_ARGS% :end diff --git a/output/bin/tool-wrapper.sh b/output/bin/tool-wrapper.sh old mode 100755 new mode 100644 index 0262051..99dd209 --- a/output/bin/tool-wrapper.sh +++ b/output/bin/tool-wrapper.sh @@ -32,6 +32,13 @@ # are both set, JRE_HOME is used. # # JAVA_OPTS (Optional) Java runtime options. +# +# JAVA_ENDORSED_DIRS (Optional) Lists of of colon separated directories +# containing some jars in order to allow replacement of APIs +# created outside of the JCP (i.e. DOM and SAX from W3C). +# It can also be used to update the XML parser implementation. +# This is only supported for Java <= 8. +# Defaults to $CATALINA_HOME/endorsed. # ----------------------------------------------------------------------------- # OS specific support. $var _must_ be set to either true or false. @@ -120,6 +127,19 @@ if $cygwin; then JRE_HOME=`cygpath --absolute --windows "$JRE_HOME"` CATALINA_HOME=`cygpath --absolute --windows "$CATALINA_HOME"` CLASSPATH=`cygpath --path --windows "$CLASSPATH"` + JAVA_ENDORSED_DIRS=`cygpath --path --windows "$JAVA_ENDORSED_DIRS"` +fi + +# Java 9 no longer supports the java.endorsed.dirs +# system property. Only try to use it if +# JAVA_ENDORSED_DIRS was explicitly set +# or CATALINA_HOME/endorsed exists. +ENDORSED_PROP=ignore.endorsed.dirs +if [ -n "$JAVA_ENDORSED_DIRS" ]; then + ENDORSED_PROP=java.endorsed.dirs +fi +if [ -d "$CATALINA_HOME/endorsed" ]; then + ENDORSED_PROP=java.endorsed.dirs fi JAVA_OPTS="$JAVA_OPTS -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager" @@ -127,6 +147,7 @@ JAVA_OPTS="$JAVA_OPTS -Djava.util.logging.manager=org.apache.juli.ClassLoaderLog # ----- Execute The Requested Command ----------------------------------------- exec "$_RUNJAVA" $JAVA_OPTS $TOOL_OPTS \ + -D$ENDORSED_PROP="$JAVA_ENDORSED_DIRS" \ -classpath "$CLASSPATH" \ -Dcatalina.home="$CATALINA_HOME" \ org.apache.catalina.startup.Tool "$@" diff --git a/output/bin/version.bat b/output/bin/version.bat old mode 100755 new mode 100644 diff --git a/output/bin/version.sh b/output/bin/version.sh old mode 100755 new mode 100644 diff --git a/output/conf/catalina.policy b/output/conf/catalina.policy old mode 100755 new mode 100644 index e22fc97..ca48178 --- a/output/conf/catalina.policy +++ b/output/conf/catalina.policy @@ -72,7 +72,7 @@ grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { permission java.io.FilePermission "${catalina.base}${file.separator}logs", "read, write"; permission java.io.FilePermission - "${catalina.base}${file.separator}logs${file.separator}", "read, write"; + "${catalina.base}${file.separator}logs${file.separator}", "read, write, delete"; permission java.lang.RuntimePermission "shutdownHooks"; permission java.lang.RuntimePermission "getClassLoader"; @@ -193,8 +193,9 @@ grant { // The Manager application needs access to the following packages to support the -// session display functionality. These settings support the following -// configurations: +// session display functionality. It also requires the custom Tomcat +// DeployXmlPermission to enable the use of META-INF/context.xml +// These settings support the following configurations: // - default CATALINA_HOME == CATALINA_BASE // - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE // - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME @@ -204,6 +205,7 @@ grant codeBase "file:${catalina.base}/webapps/manager/-" { permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager"; permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util"; permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util"; + permission org.apache.catalina.security.DeployXmlPermission "manager"; }; grant codeBase "file:${catalina.home}/webapps/manager/-" { permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina"; @@ -211,8 +213,23 @@ grant codeBase "file:${catalina.home}/webapps/manager/-" { permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager"; permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util"; permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util"; + permission org.apache.catalina.security.DeployXmlPermission "manager"; }; +// The Host Manager application needs the custom Tomcat DeployXmlPermission to +// enable the use of META-INF/context.xml +// These settings support the following configurations: +// - default CATALINA_HOME == CATALINA_BASE +// - CATALINA_HOME != CATALINA_BASE, per instance Host Manager in CATALINA_BASE +// - CATALINA_HOME != CATALINA_BASE, shared Host Manager in CATALINA_HOME +grant codeBase "file:${catalina.base}/webapps/host-manager/-" { + permission org.apache.catalina.security.DeployXmlPermission "host-manager"; +}; +grant codeBase "file:${catalina.home}/webapps/host-manager/-" { + permission org.apache.catalina.security.DeployXmlPermission "host-manager"; +}; + + // You can assign additional permissions to particular web applications by // adding additional "grant" entries here, based on the code base for that // application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. diff --git a/output/conf/catalina.properties b/output/conf/catalina.properties old mode 100755 new mode 100644 diff --git a/output/conf/context.xml b/output/conf/context.xml old mode 100755 new mode 100644 index 64de61f..4f6fc0c --- a/output/conf/context.xml +++ b/output/conf/context.xml @@ -21,6 +21,7 @@ WEB-INF/web.xml + WEB-INF/tomcat-web.xml ${catalina.base}/conf/web.xml diff --git a/output/conf/jaspic-providers.xml b/output/conf/jaspic-providers.xml old mode 100755 new mode 100644 diff --git a/output/conf/jaspic-providers.xsd b/output/conf/jaspic-providers.xsd old mode 100755 new mode 100644 index 73a87aa..1004a11 --- a/output/conf/jaspic-providers.xsd +++ b/output/conf/jaspic-providers.xsd @@ -35,9 +35,9 @@ - - - + + + diff --git a/output/conf/logging.properties b/output/conf/logging.properties old mode 100755 new mode 100644 index a2ad9c2..39edff6 --- a/output/conf/logging.properties +++ b/output/conf/logging.properties @@ -25,18 +25,22 @@ handlers = 1catalina.org.apache.juli.AsyncFileHandler, 2localhost.org.apache.jul 1catalina.org.apache.juli.AsyncFileHandler.level = FINE 1catalina.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs 1catalina.org.apache.juli.AsyncFileHandler.prefix = catalina. +1catalina.org.apache.juli.AsyncFileHandler.maxDays = 90 2localhost.org.apache.juli.AsyncFileHandler.level = FINE 2localhost.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs 2localhost.org.apache.juli.AsyncFileHandler.prefix = localhost. +2localhost.org.apache.juli.AsyncFileHandler.maxDays = 90 3manager.org.apache.juli.AsyncFileHandler.level = FINE 3manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs 3manager.org.apache.juli.AsyncFileHandler.prefix = manager. +3manager.org.apache.juli.AsyncFileHandler.maxDays = 90 4host-manager.org.apache.juli.AsyncFileHandler.level = FINE 4host-manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs 4host-manager.org.apache.juli.AsyncFileHandler.prefix = host-manager. +4host-manager.org.apache.juli.AsyncFileHandler.maxDays = 90 java.util.logging.ConsoleHandler.level = FINE java.util.logging.ConsoleHandler.formatter = org.apache.juli.OneLineFormatter diff --git a/output/conf/server.xml b/output/conf/server.xml old mode 100755 new mode 100644 index 3bb2db4..fce8922 --- a/output/conf/server.xml +++ b/output/conf/server.xml @@ -66,9 +66,9 @@ APR (HTTP/AJP) Connector: /docs/apr.html Define a non-SSL/TLS HTTP/1.1 Connector on port 8080 --> - + redirectPort="8443" /> - + + + + + + @@ -232,8 +237,14 @@ - - + + + + + + + + @@ -335,6 +346,11 @@ + + + + + @@ -347,6 +363,15 @@ + + + + + + + + + @@ -2875,7 +2900,7 @@ otf - application/x-font-otf + font/otf @@ -3914,11 +3939,11 @@ ttc - application/x-font-ttf + font/collection ttf - application/x-font-ttf + font/ttf ttl @@ -4307,7 +4332,7 @@ woff - application/x-font-woff + font/woff woff2 diff --git a/output/lib/annotations-api.jar b/output/lib/annotations-api.jar index e69de29..376c264 100644 Binary files a/output/lib/annotations-api.jar and b/output/lib/annotations-api.jar differ diff --git a/output/lib/catalina-ant.jar b/output/lib/catalina-ant.jar index e69de29..a1837d8 100644 Binary files a/output/lib/catalina-ant.jar and b/output/lib/catalina-ant.jar differ diff --git a/output/lib/catalina-ha.jar b/output/lib/catalina-ha.jar index e69de29..f9ffd5f 100644 Binary files a/output/lib/catalina-ha.jar and b/output/lib/catalina-ha.jar differ diff --git a/output/lib/catalina-storeconfig.jar b/output/lib/catalina-storeconfig.jar index e69de29..2810c15 100644 Binary files a/output/lib/catalina-storeconfig.jar and b/output/lib/catalina-storeconfig.jar differ diff --git a/output/lib/catalina-tribes.jar b/output/lib/catalina-tribes.jar index e69de29..67fd70f 100644 Binary files a/output/lib/catalina-tribes.jar and b/output/lib/catalina-tribes.jar differ diff --git a/output/lib/catalina.jar b/output/lib/catalina.jar index e69de29..4b04e8d 100644 Binary files a/output/lib/catalina.jar and b/output/lib/catalina.jar differ diff --git a/output/lib/ecj-4.6.3.jar b/output/lib/ecj-4.6.3.jar index e69de29..04652f3 100644 Binary files a/output/lib/ecj-4.6.3.jar and b/output/lib/ecj-4.6.3.jar differ diff --git a/output/lib/el-api.jar b/output/lib/el-api.jar index e69de29..4e08498 100644 Binary files a/output/lib/el-api.jar and b/output/lib/el-api.jar differ diff --git a/output/lib/jasper-el.jar b/output/lib/jasper-el.jar index e69de29..84010c7 100644 Binary files a/output/lib/jasper-el.jar and b/output/lib/jasper-el.jar differ diff --git a/output/lib/jasper.jar b/output/lib/jasper.jar index e69de29..5bdbbf0 100644 Binary files a/output/lib/jasper.jar and b/output/lib/jasper.jar differ diff --git a/output/lib/jaspic-api.jar b/output/lib/jaspic-api.jar index e69de29..dedfab8 100644 Binary files a/output/lib/jaspic-api.jar and b/output/lib/jaspic-api.jar differ diff --git a/output/lib/jsp-api.jar b/output/lib/jsp-api.jar index e69de29..894b349 100644 Binary files a/output/lib/jsp-api.jar and b/output/lib/jsp-api.jar differ diff --git a/output/lib/servlet-api.jar b/output/lib/servlet-api.jar index e69de29..bbedf47 100644 Binary files a/output/lib/servlet-api.jar and b/output/lib/servlet-api.jar differ diff --git a/output/lib/tomcat-api.jar b/output/lib/tomcat-api.jar index e69de29..22b74e9 100644 Binary files a/output/lib/tomcat-api.jar and b/output/lib/tomcat-api.jar differ diff --git a/output/lib/tomcat-coyote.jar b/output/lib/tomcat-coyote.jar index e69de29..4d8bab1 100644 Binary files a/output/lib/tomcat-coyote.jar and b/output/lib/tomcat-coyote.jar differ diff --git a/output/lib/tomcat-dbcp.jar b/output/lib/tomcat-dbcp.jar index e69de29..a67cd6c 100644 Binary files a/output/lib/tomcat-dbcp.jar and b/output/lib/tomcat-dbcp.jar differ diff --git a/output/lib/tomcat-i18n-es.jar b/output/lib/tomcat-i18n-es.jar index e69de29..5fb180c 100644 Binary files a/output/lib/tomcat-i18n-es.jar and b/output/lib/tomcat-i18n-es.jar differ diff --git a/output/lib/tomcat-i18n-fr.jar b/output/lib/tomcat-i18n-fr.jar index e69de29..023529b 100644 Binary files a/output/lib/tomcat-i18n-fr.jar and b/output/lib/tomcat-i18n-fr.jar differ diff --git a/output/lib/tomcat-i18n-ja.jar b/output/lib/tomcat-i18n-ja.jar index e69de29..3f0a69f 100644 Binary files a/output/lib/tomcat-i18n-ja.jar and b/output/lib/tomcat-i18n-ja.jar differ diff --git a/output/lib/tomcat-jdbc.jar b/output/lib/tomcat-jdbc.jar index e69de29..ccbcd83 100644 Binary files a/output/lib/tomcat-jdbc.jar and b/output/lib/tomcat-jdbc.jar differ diff --git a/output/lib/tomcat-jni.jar b/output/lib/tomcat-jni.jar index e69de29..f97416a 100644 Binary files a/output/lib/tomcat-jni.jar and b/output/lib/tomcat-jni.jar differ diff --git a/output/lib/tomcat-util-scan.jar b/output/lib/tomcat-util-scan.jar index e69de29..019ac48 100644 Binary files a/output/lib/tomcat-util-scan.jar and b/output/lib/tomcat-util-scan.jar differ diff --git a/output/lib/tomcat-util.jar b/output/lib/tomcat-util.jar index e69de29..bbf86a9 100644 Binary files a/output/lib/tomcat-util.jar and b/output/lib/tomcat-util.jar differ diff --git a/output/lib/tomcat-websocket.jar b/output/lib/tomcat-websocket.jar index e69de29..3314bc2 100644 Binary files a/output/lib/tomcat-websocket.jar and b/output/lib/tomcat-websocket.jar differ diff --git a/output/lib/websocket-api.jar b/output/lib/websocket-api.jar index e69de29..192a2af 100644 Binary files a/output/lib/websocket-api.jar and b/output/lib/websocket-api.jar differ diff --git a/output/logs/catalina.2018-01-31.log b/output/logs/catalina.2018-01-31.log new file mode 100644 index 0000000..3239473 --- /dev/null +++ b/output/logs/catalina.2018-01-31.log @@ -0,0 +1,114 @@ +31-Jan-2018 17:01:51.508 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Server version: Apache Tomcat/9.0.0.M21 +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Server built: 9.0.0.M21 +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Server number: 9.0.0.M21 +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name: Mac OS X +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version: 10.13.2 +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture: x86_64 +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home: /Library/Java/JavaVirtualMachines/jdk1.8.0_92.jdk/Contents/Home/jre +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version: 1.8.0_92-b14 +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Vendor: Oracle Corporation +31-Jan-2018 17:01:51.514 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_BASE: /Users/wangbin/Documents/git/github/tomcat9/output +31-Jan-2018 17:01:51.515 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_HOME: /Users/wangbin/Documents/git/github/tomcat9/output +31-Jan-2018 17:01:51.516 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.base=/Users/wangbin/Documents/git/github/tomcat9/output +31-Jan-2018 17:01:51.516 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.home=/Users/wangbin/Documents/git/github/tomcat9/output +31-Jan-2018 17:01:51.516 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager +31-Jan-2018 17:01:51.516 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.config.file=${catalina.base}/conf/logging.properties +31-Jan-2018 17:01:51.516 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.library.path=/Users/wangbin/Documents/git/github/tomcat9/output/bin +31-Jan-2018 17:01:51.516 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -javaagent:/Applications/IntelliJ IDEA.app/Contents/lib/idea_rt.jar=61145:/Applications/IntelliJ IDEA.app/Contents/bin +31-Jan-2018 17:01:51.516 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dfile.encoding=UTF-8 +31-Jan-2018 17:01:51.516 信息 [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: [/Users/wangbin/Documents/git/github/tomcat9/output/bin] +31-Jan-2018 17:01:51.738 信息 [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8080"] +31-Jan-2018 17:01:51.807 信息 [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read +31-Jan-2018 17:01:51.809 信息 [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["ajp-nio-8009"] +31-Jan-2018 17:01:51.811 信息 [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read +31-Jan-2018 17:01:51.811 信息 [main] org.apache.catalina.startup.Catalina.load Initialization processed in 915 ms +31-Jan-2018 17:01:51.841 信息 [main] org.apache.catalina.core.StandardService.startInternal Starting service [Catalina] +31-Jan-2018 17:01:51.841 信息 [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/9.0.0.M21 +31-Jan-2018 17:01:51.851 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/docs] +31-Jan-2018 17:02:00.262 信息 [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time. +31-Jan-2018 17:02:00.293 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/docs] has finished in [8,442] ms +31-Jan-2018 17:02:00.293 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/manager] +31-Jan-2018 17:02:00.363 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/manager] has finished in [70] ms +31-Jan-2018 17:02:00.364 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/examples] +31-Jan-2018 17:02:03.939 信息 [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time. +31-Jan-2018 17:02:03.952 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/examples] has finished in [3,589] ms +31-Jan-2018 17:02:03.953 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/ROOT] +31-Jan-2018 17:02:07.154 信息 [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time. +31-Jan-2018 17:02:07.159 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/ROOT] has finished in [3,205] ms +31-Jan-2018 17:02:07.159 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/host-manager] +31-Jan-2018 17:02:07.247 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/host-manager] has finished in [88] ms +31-Jan-2018 17:02:07.249 信息 [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"] +31-Jan-2018 17:02:07.257 信息 [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["ajp-nio-8009"] +31-Jan-2018 17:02:07.258 信息 [main] org.apache.catalina.startup.Catalina.start Server startup in 15447 ms +31-Jan-2018 17:02:54.723 信息 [Thread-5] org.apache.coyote.AbstractProtocol.pause Pausing ProtocolHandler ["http-nio-8080"] +31-Jan-2018 17:02:56.731 信息 [Thread-5] org.apache.coyote.AbstractProtocol.pause Pausing ProtocolHandler ["ajp-nio-8009"] +31-Jan-2018 17:02:58.735 信息 [Thread-5] org.apache.catalina.core.StandardService.stopInternal Stopping service [Catalina] +31-Jan-2018 17:02:58.771 信息 [Thread-5] org.apache.coyote.AbstractProtocol.stop Stopping ProtocolHandler ["http-nio-8080"] +31-Jan-2018 17:02:59.879 信息 [Thread-5] org.apache.coyote.AbstractProtocol.stop Stopping ProtocolHandler ["ajp-nio-8009"] +31-Jan-2018 17:02:59.885 信息 [Thread-5] org.apache.coyote.AbstractProtocol.destroy Destroying ProtocolHandler ["http-nio-8080"] +31-Jan-2018 17:02:59.888 严重 [Thread-5] org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to destroy component [Connector[HTTP/1.1-8080]] + org.apache.catalina.LifecycleException: Protocol handler destroy failed + at org.apache.catalina.connector.Connector.destroyInternal(Connector.java:994) + at org.apache.catalina.util.LifecycleBase.destroy(LifecycleBase.java:322) + at org.apache.catalina.core.StandardService.destroyInternal(StandardService.java:543) + at org.apache.catalina.util.LifecycleBase.destroy(LifecycleBase.java:322) + at org.apache.catalina.core.StandardServer.destroyInternal(StandardServer.java:883) + at org.apache.catalina.util.LifecycleBase.destroy(LifecycleBase.java:322) + at org.apache.catalina.startup.Catalina.stop(Catalina.java:730) + at org.apache.catalina.startup.Catalina$CatalinaShutdownHook.run(Catalina.java:830) +Caused by: java.io.IOException: Unknown error: 316 + at sun.nio.ch.NativeThread.signal(Native Method) + at sun.nio.ch.ServerSocketChannelImpl.implCloseSelectableChannel(ServerSocketChannelImpl.java:292) + at java.nio.channels.spi.AbstractSelectableChannel.implCloseChannel(AbstractSelectableChannel.java:234) + at java.nio.channels.spi.AbstractInterruptibleChannel.close(AbstractInterruptibleChannel.java:115) + at sun.nio.ch.ServerSocketAdaptor.close(ServerSocketAdaptor.java:137) + at org.apache.tomcat.util.net.NioEndpoint.unbind(NioEndpoint.java:305) + at org.apache.tomcat.util.net.AbstractEndpoint.destroy(AbstractEndpoint.java:1018) + at org.apache.coyote.AbstractProtocol.destroy(AbstractProtocol.java:704) + at org.apache.catalina.connector.Connector.destroyInternal(Connector.java:990) + ... 7 more + +31-Jan-2018 17:02:59.889 信息 [Thread-5] org.apache.coyote.AbstractProtocol.destroy Destroying ProtocolHandler ["ajp-nio-8009"] +31-Jan-2018 17:05:01.753 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Server version: Apache Tomcat/9.0.4 +31-Jan-2018 17:05:01.759 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Server built: 9.0.4 +31-Jan-2018 17:05:01.759 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Server number: 9.0.4 +31-Jan-2018 17:05:01.760 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name: Mac OS X +31-Jan-2018 17:05:01.760 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version: 10.13.2 +31-Jan-2018 17:05:01.760 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture: x86_64 +31-Jan-2018 17:05:01.760 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home: /Library/Java/JavaVirtualMachines/jdk1.8.0_92.jdk/Contents/Home/jre +31-Jan-2018 17:05:01.760 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version: 1.8.0_92-b14 +31-Jan-2018 17:05:01.760 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Vendor: Oracle Corporation +31-Jan-2018 17:05:01.760 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_BASE: /Users/wangbin/Documents/git/github/tomcat9/output +31-Jan-2018 17:05:01.760 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_HOME: /Users/wangbin/Documents/git/github/tomcat9/output +31-Jan-2018 17:05:01.762 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.base=/Users/wangbin/Documents/git/github/tomcat9/output +31-Jan-2018 17:05:01.762 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.home=/Users/wangbin/Documents/git/github/tomcat9/output +31-Jan-2018 17:05:01.762 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager +31-Jan-2018 17:05:01.762 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.config.file=${catalina.base}/conf/logging.properties +31-Jan-2018 17:05:01.762 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.library.path=/Users/wangbin/Documents/git/github/tomcat9/output/bin +31-Jan-2018 17:05:01.762 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -javaagent:/Applications/IntelliJ IDEA.app/Contents/lib/idea_rt.jar=61224:/Applications/IntelliJ IDEA.app/Contents/bin +31-Jan-2018 17:05:01.762 信息 [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dfile.encoding=UTF-8 +31-Jan-2018 17:05:01.763 信息 [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: [/Users/wangbin/Documents/git/github/tomcat9/output/bin] +31-Jan-2018 17:05:02.045 信息 [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8080"] +31-Jan-2018 17:05:02.131 信息 [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read +31-Jan-2018 17:05:02.141 信息 [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["ajp-nio-8009"] +31-Jan-2018 17:05:02.142 信息 [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read +31-Jan-2018 17:05:02.143 信息 [main] org.apache.catalina.startup.Catalina.load Initialization processed in 820 ms +31-Jan-2018 17:05:02.176 信息 [main] org.apache.catalina.core.StandardService.startInternal Starting service [Catalina] +31-Jan-2018 17:05:02.176 信息 [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/9.0.4 +31-Jan-2018 17:05:02.195 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/docs] +31-Jan-2018 17:05:10.549 信息 [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time. +31-Jan-2018 17:05:10.573 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/docs] has finished in [8,379] ms +31-Jan-2018 17:05:10.574 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/manager] +31-Jan-2018 17:05:10.628 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/manager] has finished in [53] ms +31-Jan-2018 17:05:10.628 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/examples] +31-Jan-2018 17:05:14.107 信息 [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time. +31-Jan-2018 17:05:14.123 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/examples] has finished in [3,495] ms +31-Jan-2018 17:05:14.123 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/ROOT] +31-Jan-2018 17:05:17.435 信息 [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time. +31-Jan-2018 17:05:17.438 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/ROOT] has finished in [3,315] ms +31-Jan-2018 17:05:17.438 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/host-manager] +31-Jan-2018 17:05:17.501 信息 [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/Users/wangbin/Documents/git/github/tomcat9/output/webapps/host-manager] has finished in [63] ms +31-Jan-2018 17:05:17.575 信息 [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"] +31-Jan-2018 17:05:17.583 信息 [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["ajp-nio-8009"] +31-Jan-2018 17:05:17.585 信息 [main] org.apache.catalina.startup.Catalina.start Server startup in 15442 ms +31-Jan-2018 17:07:58.606 信息 [Thread-5] org.apache.coyote.AbstractProtocol.pause Pausing ProtocolHandler ["http-nio-8080"] diff --git a/output/logs/host-manager.2018-01-31.log b/output/logs/host-manager.2018-01-31.log new file mode 100644 index 0000000..e69de29 diff --git a/output/logs/localhost.2018-01-31.log b/output/logs/localhost.2018-01-31.log new file mode 100644 index 0000000..efa5c6c --- /dev/null +++ b/output/logs/localhost.2018-01-31.log @@ -0,0 +1,68 @@ +31-Jan-2018 17:02:03.947 信息 [main] org.apache.catalina.core.ApplicationContext.log ContextListener: contextInitialized() +31-Jan-2018 17:02:03.947 信息 [main] org.apache.catalina.core.ApplicationContext.log SessionListener: contextInitialized() +31-Jan-2018 17:02:03.948 信息 [main] org.apache.catalina.core.ApplicationContext.log ContextListener: attributeAdded('StockTicker', 'async.Stockticker@5691d295') +31-Jan-2018 17:02:58.758 信息 [Thread-5] org.apache.catalina.core.ApplicationContext.log SessionListener: contextDestroyed() +31-Jan-2018 17:02:58.758 信息 [Thread-5] org.apache.catalina.core.ApplicationContext.log ContextListener: contextDestroyed() +31-Jan-2018 17:05:14.116 信息 [main] org.apache.catalina.core.ApplicationContext.log ContextListener: contextInitialized() +31-Jan-2018 17:05:14.116 信息 [main] org.apache.catalina.core.ApplicationContext.log SessionListener: contextInitialized() +31-Jan-2018 17:05:14.118 信息 [main] org.apache.catalina.core.ApplicationContext.log ContextListener: attributeAdded('StockTicker', 'async.Stockticker@6c81ee61') +31-Jan-2018 17:05:22.919 严重 [http-nio-8080-exec-1] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [jsp] in context with path [] threw exception [java.lang.IllegalStateException: No Java compiler available for configuration options compilerClassName: [null] and compiler: [null]] with root cause + java.lang.IllegalStateException: No Java compiler available for configuration options compilerClassName: [null] and compiler: [null] + at org.apache.jasper.JspCompilationContext.createCompiler(JspCompilationContext.java:235) + at org.apache.jasper.JspCompilationContext.compile(JspCompilationContext.java:595) + at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:369) + at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:386) + at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:330) + at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) + at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) + at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) + at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) + at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) + at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) + at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) + at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) + at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) + at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) + at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:651) + at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) + at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) + at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:417) + at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) + at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:754) + at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1376) + at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) + at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) + at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) + at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) + at java.lang.Thread.run(Thread.java:745) + +31-Jan-2018 17:05:41.807 严重 [http-nio-8080-exec-4] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [jsp] in context with path [] threw exception [java.lang.IllegalStateException: No Java compiler available for configuration options compilerClassName: [null] and compiler: [null]] with root cause + java.lang.IllegalStateException: No Java compiler available for configuration options compilerClassName: [null] and compiler: [null] + at org.apache.jasper.JspCompilationContext.createCompiler(JspCompilationContext.java:235) + at org.apache.jasper.JspCompilationContext.compile(JspCompilationContext.java:595) + at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:369) + at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:386) + at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:330) + at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) + at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) + at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) + at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) + at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) + at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) + at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) + at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) + at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) + at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) + at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:651) + at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) + at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) + at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:417) + at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) + at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:754) + at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1376) + at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) + at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) + at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) + at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) + at java.lang.Thread.run(Thread.java:745) + diff --git a/output/logs/localhost_access_log.2018-01-31.txt b/output/logs/localhost_access_log.2018-01-31.txt new file mode 100644 index 0000000..46c872c --- /dev/null +++ b/output/logs/localhost_access_log.2018-01-31.txt @@ -0,0 +1,2 @@ +0:0:0:0:0:0:0:1 - - [31/Jan/2018:17:05:22 +0800] "GET / HTTP/1.1" 500 2627 +0:0:0:0:0:0:0:1 - - [31/Jan/2018:17:05:41 +0800] "GET / HTTP/1.1" 500 2627 diff --git a/output/logs/manager.2018-01-31.log b/output/logs/manager.2018-01-31.log new file mode 100644 index 0000000..e69de29 diff --git a/output/temp/safeToDelete.tmp b/output/temp/safeToDelete.tmp old mode 100755 new mode 100644 diff --git a/output/webapps/ROOT/RELEASE-NOTES.txt b/output/webapps/ROOT/RELEASE-NOTES.txt new file mode 100644 index 0000000..0782607 --- /dev/null +++ b/output/webapps/ROOT/RELEASE-NOTES.txt @@ -0,0 +1,173 @@ +================================================================================ + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +================================================================================ + + + Apache Tomcat Version 9.0.4 + Release Notes + + +========= +CONTENTS: +========= + + Dependency Changes +* API Stability +* Bundled APIs +* Web application reloading and static fields in shared libraries +* Security manager URLs +* Symlinking static resources +* Viewing the Tomcat Change Log +* Cryptographic software notice +* When all else fails + + +=================== +Dependency Changes: +=================== +Tomcat 9.0 is designed to run on Java SE 8 and later. + + +============== +API Stability: +============== + +The public interfaces for the following classes are fixed and will not be +changed at all during the remaining lifetime of the 9.x series: +- None + +The public interfaces for the following classes may be added to in order to +resolve bugs and/or add new features. No existing interface method will be +removed or changed although it may be deprecated. +- None + +Note: As Tomcat 9 matures, the above list will be added to. The list is not + considered complete at this time. + +The remaining classes are considered part of the Tomcat internals and may change +without notice between point releases. + + +============= +Bundled APIs: +============= +A standard installation of Tomcat 9.0 makes all of the following APIs available +for use by web applications (by placing them in "lib"): +* annotations-api.jar (Annotations package) +* catalina.jar (Tomcat Catalina implementation) +* catalina-ant.jar (Tomcat Catalina Ant tasks) +* catalina-ha.jar (High availability package) +* catalina-storeconfig.jar (Generation of XML configuration from current state) +* catalina-tribes.jar (Group communication) +* ecj-4.6.3.jar (Eclipse JDT Java compiler) +* el-api.jar (EL 3.0 API) +* jasper.jar (Jasper 2 Compiler and Runtime) +* jasper-el.jar (Jasper 2 EL implementation) +* jsp-api.jar (JSP 2.3 API) +* servlet-api.jar (Servlet 4.0 API) +* tomcat-api.jar (Interfaces shared by Catalina and Jasper) +* tomcat-coyote.jar (Tomcat connectors and utility classes) +* tomcat-dbcp.jar (package renamed database connection pool based on Commons DBCP) +* tomcat-jdbc.jar (Tomcat's database connection pooling solution) +* tomcat-jni.jar (Interface to the native component of the APR/native connector) +* tomcat-util.jar (Various utilities) +* tomcat-websocket.jar (WebSocket 1.1 implementation) +* websocket-api.jar (WebSocket 1.1 API) + +You can make additional APIs available to all of your web applications by +putting unpacked classes into a "classes" directory (not created by default), +or by placing them in JAR files in the "lib" directory. + +To override the XML parser implementation or interfaces, use the appropriate +feature for your JVM. For Java <= 8 use the endorsed standards override +feature. The default configuration defines JARs located in "endorsed" as endorsed. +For Java 9+ use the upgradeable modules feature. + + +================================================================ +Web application reloading and static fields in shared libraries: +================================================================ +Some shared libraries (many are part of the JDK) keep references to objects +instantiated by the web application. To avoid class loading related problems +(ClassCastExceptions, messages indicating that the classloader +is stopped, etc.), the shared libraries state should be reinitialized. + +Something which might help is to avoid putting classes which would be +referenced by a shared static field in the web application classloader, +and putting them in the shared classloader instead (JARs should be put in the +"lib" folder, and classes should be put in the "classes" folder). + + +====================== +Security manager URLs: +====================== +In order to grant security permissions to JARs located inside the +web application repository, use URLs of of the following format +in your policy file: + +file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar + + +============================ +Symlinking static resources: +============================ +By default, Unix symlinks will not work when used in a web application to link +resources located outside the web application root directory. + +This behavior is optional, and the "allowLinking" flag may be used to disable +the check. + + +============================== +Viewing the Tomcat Change Log: +============================== +The full change log is available from http://tomcat.apache.org and is also +included in the documentation web application. + + +============================= +Cryptographic software notice +============================= +This distribution includes cryptographic software. The country in +which you currently reside may have restrictions on the import, +possession, use, and/or re-export to another country, of +encryption software. BEFORE using any encryption software, please +check your country's laws, regulations and policies concerning the +import, possession, or use, and re-export of encryption software, to +see if this is permitted. See for more +information. + +The U.S. Government Department of Commerce, Bureau of Industry and +Security (BIS), has classified this software as Export Commodity +Control Number (ECCN) 5D002.C.1, which includes information security +software using or performing cryptographic functions with asymmetric +algorithms. The form and manner of this Apache Software Foundation +distribution makes it eligible for export under the License Exception +ENC Technology Software Unrestricted (TSU) exception (see the BIS +Export Administration Regulations, Section 740.13) for both object +code and source code. + +The following provides more details on the included cryptographic +software: + - Tomcat includes code designed to work with JSSE + - Tomcat includes code designed to work with OpenSSL + + +==================== +When all else fails: +==================== +See the FAQ +http://tomcat.apache.org/faq/ diff --git a/output/webapps/ROOT/WEB-INF/web.xml b/output/webapps/ROOT/WEB-INF/web.xml new file mode 100644 index 0000000..d94a86b --- /dev/null +++ b/output/webapps/ROOT/WEB-INF/web.xml @@ -0,0 +1,30 @@ + + + + + Welcome to Tomcat + + Welcome to Tomcat + + + diff --git a/output/webapps/ROOT/asf-logo-wide.svg b/output/webapps/ROOT/asf-logo-wide.svg new file mode 100644 index 0000000..5743c42 --- /dev/null +++ b/output/webapps/ROOT/asf-logo-wide.svg @@ -0,0 +1,295 @@ + + + + + diff --git a/output/webapps/ROOT/bg-button.png b/output/webapps/ROOT/bg-button.png new file mode 100644 index 0000000..b544bbf Binary files /dev/null and b/output/webapps/ROOT/bg-button.png differ diff --git a/output/webapps/ROOT/bg-middle.png b/output/webapps/ROOT/bg-middle.png new file mode 100644 index 0000000..0c95a82 Binary files /dev/null and b/output/webapps/ROOT/bg-middle.png differ diff --git a/output/webapps/ROOT/bg-nav.png b/output/webapps/ROOT/bg-nav.png new file mode 100644 index 0000000..d44b094 Binary files /dev/null and b/output/webapps/ROOT/bg-nav.png differ diff --git a/output/webapps/ROOT/bg-upper.png b/output/webapps/ROOT/bg-upper.png new file mode 100644 index 0000000..7d9ae7b Binary files /dev/null and b/output/webapps/ROOT/bg-upper.png differ diff --git a/output/webapps/ROOT/favicon.ico b/output/webapps/ROOT/favicon.ico new file mode 100644 index 0000000..6c5bd2c Binary files /dev/null and b/output/webapps/ROOT/favicon.ico differ diff --git a/output/webapps/ROOT/index.jsp b/output/webapps/ROOT/index.jsp new file mode 100644 index 0000000..c5d2293 --- /dev/null +++ b/output/webapps/ROOT/index.jsp @@ -0,0 +1,223 @@ +<%-- +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +--%> +<%@ page session="false" pageEncoding="UTF-8" contentType="text/html; charset=UTF-8" %> +<% +java.text.SimpleDateFormat sdf = new java.text.SimpleDateFormat("yyyy"); +request.setAttribute("year", sdf.format(new java.util.Date())); +request.setAttribute("tomcatUrl", "http://tomcat.apache.org/"); +request.setAttribute("tomcatDocUrl", "/docs/"); +request.setAttribute("tomcatExamplesUrl", "/examples/"); +%> + + + + + <%=request.getServletContext().getServerInfo() %> + + + + + + + + + Home + Documentation + Configuration + Examples + Wiki + Mailing Lists + Find Help + + + + ${pageContext.servletContext.serverInfo} + + + + If you're seeing this, you've successfully installed Tomcat. Congratulations! + + + + + Recommended Reading: + Security Considerations HOW-TO + Manager Application HOW-TO + Clustering/Session Replication HOW-TO + + + + + Server Status + + + Manager App + + + Host Manager + + + + + + + Developer Quick Start + + + Tomcat Setup + First Web Application + + + + + Realms & AAA + JDBC DataSources + + + + + Examples + + + + + Servlet Specifications + Tomcat Versions + + + + + + + + Managing Tomcat + For security, access to the manager webapp is restricted. + Users are defined in: + $CATALINA_HOME/conf/tomcat-users.xml + In Tomcat 9.0 access to the manager application is split between + different users. Read more... + + Release Notes + Changelog + Migration Guide + Security Notices + + + + + Documentation + Tomcat 9.0 Documentation + Tomcat 9.0 Configuration + Tomcat Wiki + Find additional important configuration information in: + $CATALINA_HOME/RUNNING.txt + Developers may be interested in: + + Tomcat 9.0 Bug Database + Tomcat 9.0 JavaDocs + Tomcat 9.0 SVN Repository + + + + + + Getting Help + FAQ and Mailing Lists + The following mailing lists are available: + + tomcat-announce + Important announcements, releases, security vulnerability notifications. (Low volume). + + tomcat-users + User support and discussion + + taglibs-user + User support and discussion for Apache Taglibs + + tomcat-dev + Development mailing list, including commit messages + + + + + + + + + + Other Downloads + + Tomcat Connectors + Tomcat Native + Taglibs + Deployer + + + + + + Other Documentation + + Tomcat Connectors + mod_jk Documentation + Tomcat Native + Deployer + + + + + + Get Involved + + Overview + SVN Repositories + Mailing Lists + Wiki + + + + + + Miscellaneous + + Contact + Legal + Sponsorship + Thanks + + + + + + Apache Software Foundation + + Who We Are + Heritage + Apache Home + Resources + + + + + + Copyright ©1999-${year} Apache Software Foundation. All Rights Reserved + + + + diff --git a/output/webapps/ROOT/tomcat-power.gif b/output/webapps/ROOT/tomcat-power.gif new file mode 100644 index 0000000..01c400b Binary files /dev/null and b/output/webapps/ROOT/tomcat-power.gif differ diff --git a/output/webapps/ROOT/tomcat.css b/output/webapps/ROOT/tomcat.css new file mode 100644 index 0000000..6995838 --- /dev/null +++ b/output/webapps/ROOT/tomcat.css @@ -0,0 +1,351 @@ +/* + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +/ +body { + margin: 10px 20px; + text-align: center; + font-family: Arial, sans-serif; +} + +h1, h2, h3, h4, h5, h6, p, ul, ol { + margin: 0 0 0.5em; +} +h1 { + font-size: 18pt; + margin: 0.5em 0 0; +} +h2 { + font-size: 16pt; +} +h3 { + font-size: 13pt; +} +h4 { + font-size: 12pt; +} +h5 { + font-size: 11pt; +} +p { + font-size: 11pt +} + +ul { + margin: 0; + padding: 0 0 0 0.25em; + text-indent: 0; + list-style: none; +} +li { + margin: 0; + padding: 0 0 0.25em; + text-indent: 0; + font-size: 80%; +} + +pre { + text-indent: 0.25em; + width: 90%; + font-size: 90%; +} + +br.separator { + margin: 0; + padding: 0; + clear: both; +} + +a img { + border: 0 none; +} + +.container { + padding: 10px; + margin: 0 0 10px; +} + +.col20 { + float: left; + width: 20%; +} + +.col25 { + float: left; + width: 25%; +} + +#wrapper { + display: block; + margin: 0 auto; + text-align: left; + min-width: 720px; + max-width: 1000px; +} +.curved { + border-radius: 10px; + -moz-border-radius: 10px; + -webkit-border-radius: 10px; + -khtml-border-radius: 10px; +} + +#navigation { + background: #eee url(bg-nav.png) repeat-x top left; + margin: 0 0 10px; + padding: 0; +} +#navigation span { + float: left; +} +#navigation span a { + display: block; + padding: 10px; + font-weight: bold; + text-shadow: 1px 1px 1px #fff; +} +#navigation span a:link, +#navigation span a:visited, +#navigation span a:hover, +#navigation span a:active { + color: #666; + text-decoration: none; +} +#navigation span#nav-help { + float: right; + margin-right: 0; +} + +#asf-box { + height: 40px; + background: #fff url(asf-logo-wide.svg) no-repeat top right;} +#asf-box h1 { + padding: 0; + margin: 0; +} + +#upper { + background: #fff url(bg-upper.png) repeat-x top left; +} + +#congrats { + text-align: center; + padding: 10px; + margin: 0 40px 20px; + background-color: #9c9; +} +#congrats h2 { + font-size: 14pt; + padding: 0; + margin: 0; + color: #fff; +} + +#notice { + float: left; + width: 560px; + color: #696; +} +#notice a:link, +#notice a:visited, +#notice a:hover, +#notice a:active { + color: #090; + text-decoration: none; +} +#notice img, +#notice #tasks { + float: left; +} +#tasks a:link, +#tasks a:visited, +#tasks a:hover, +#tasks a:active { + text-decoration: underline; +} +#notice img { + margin-right: 20px; +} + +#actions { + float: right; + width: 140px; +} + +#actions .button { + display: block; + padding: 0; + height: 36px; + background: url(bg-button.png) no-repeat top left; +} + +#actions .button a { + display: block; + padding: 0; +} + +#actions .button a:link, +#actions .button a:visited, +#actions .button a:hover, +#actions .button a:active { + color: #696; + text-decoration: none; +} + +#actions .button a span { + display: block; + padding: 6px 10px; + color: #666; + text-shadow: 1px 1px 1px #fff; + font-size: 10pt; + font-weight: bold; +} + +#middle { + background: #eef url(bg-middle.png) repeat-x top left; + margin: 20px 0; + padding: 1px 10px; +} +#middle h3 { + margin: 0 0 10px; + color: #033; +} +#middle p { + font-size: 10pt; +} +#middle a:link, +#middle a:visited, +#middle a:hover, +#middle a:active { + color: #366; + font-weight: bold; +} +#middle .col25 .container { + padding: 0 0 1px; +} + +#developers { + float: left; + width: 40%; +} +#security { + float: right; + width: 50%; +} + +#lower { + padding: 0; +} + +#lower a:link, +#lower a:visited, +#lower a:hover, +#lower a:active { + color: #600; +} + +#lower strong a:link, +#lower strong a:visited, +#lower strong a:hover, +#lower strong a:active { + color: #c00; +} + +#lower h3 { + color: #963; + font-size: 14pt; +} +#lower h4 { + font-size: 12pt; +} +#lower ul { + padding: 0; + margin: 0.5em 0; +} +#lower p, +#lower li { + font-size: 9pt; + color: #753; + margin: 0 0 0.1em; +} +#lower li { + padding: 3px 5px; +} +#lower li strong { + color: #a53; +} +#lower li#list-announce { + border: 1px solid #f90; + background-color: #ffe8c8; +} +#lower p { + font-size: 10.5pt; +} + +#low-manage, +#low-docs, +#low-help { + float: left; + width: 32%; +} +#low-docs { + margin: 0 0 0 2.2%; +} +#low-help { + float: right; +} + +#low-manage div, +#low-docs div, +#low-help div { + min-height: 280px; + border: 3px solid #ffdc75; + background-color: #fff1c8; + padding: 10px; +} + +#footer { + padding: 0; + margin: 20px 0; + color: #999; + background-color: #eee; +} +#footer h4 { + margin: 0 0 10px; + font-size: 10pt; +} +#footer p { + margin: 0 0 10px; + font-size: 10pt; +} +#footer ul { + margin: 6px 0 1px; + padding: 0; +} +#footer li { + margin: 0; + font-size: 9pt; +} + +#footer a:link, +#footer a:visited, +#footer a:hover, +#footer a:active { + color: #666; +} + +.copyright { + font-size: 10pt; + color: #666; +} \ No newline at end of file diff --git a/output/webapps/ROOT/tomcat.gif b/output/webapps/ROOT/tomcat.gif new file mode 100644 index 0000000..f2aa6f8 Binary files /dev/null and b/output/webapps/ROOT/tomcat.gif differ diff --git a/output/webapps/ROOT/tomcat.png b/output/webapps/ROOT/tomcat.png new file mode 100644 index 0000000..209b07f Binary files /dev/null and b/output/webapps/ROOT/tomcat.png differ diff --git a/output/webapps/ROOT/tomcat.svg b/output/webapps/ROOT/tomcat.svg new file mode 100644 index 0000000..8823f79 --- /dev/null +++ b/output/webapps/ROOT/tomcat.svg @@ -0,0 +1,967 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + 2006-05-09T08:17:21Z + 2006-05-09T08:37:38Z + Illustrator + + + + JPEG + 256 + 184 + /9j/4AAQSkZJRgABAgEASABIAAD/7QAsUGhvdG9zaG9wIDMuMAA4QklNA+0AAAAAABAASAAAAAEA +AQBIAAAAAQAB/+4ADkFkb2JlAGTAAAAAAf/bAIQABgQEBAUEBgUFBgkGBQYJCwgGBggLDAoKCwoK +DBAMDAwMDAwQDA4PEA8ODBMTFBQTExwbGxscHx8fHx8fHx8fHwEHBwcNDA0YEBAYGhURFRofHx8f +Hx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8f/8AAEQgAuAEAAwER +AAIRAQMRAf/EAaIAAAAHAQEBAQEAAAAAAAAAAAQFAwIGAQAHCAkKCwEAAgIDAQEBAQEAAAAAAAAA +AQACAwQFBgcICQoLEAACAQMDAgQCBgcDBAIGAnMBAgMRBAAFIRIxQVEGE2EicYEUMpGhBxWxQiPB +UtHhMxZi8CRygvElQzRTkqKyY3PCNUQnk6OzNhdUZHTD0uIIJoMJChgZhJRFRqS0VtNVKBry4/PE +1OT0ZXWFlaW1xdXl9WZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3OEhYaHiImKi4yNjo+Ck5SVlpeYmZ +qbnJ2en5KjpKWmp6ipqqusra6voRAAICAQIDBQUEBQYECAMDbQEAAhEDBCESMUEFURNhIgZxgZEy +obHwFMHR4SNCFVJicvEzJDRDghaSUyWiY7LCB3PSNeJEgxdUkwgJChgZJjZFGidkdFU38qOzwygp +0+PzhJSktMTU5PRldYWVpbXF1eX1RlZmdoaWprbG1ub2R1dnd4eXp7fH1+f3OEhYaHiImKi4yNjo ++DlJWWl5iZmpucnZ6fkqOkpaanqKmqq6ytrq+v/aAAwDAQACEQMRAD8A9U4q7FXYq7FXYq7FXYq7 +FXYq7FXYq7FXYq7FXYq7FXhH/OYHnWfQ/wAurfRLSUxXXmK49GQqaN9VtwJJqH3cxqfYnFXhP5Y/ +85O+f/JU0enaw769okbBJLS8ZvrUKg0IhnarDj/I9R2HHFX2F+Xn5neT/P8ApP6R8u3glKAfW7KS +iXNuzdFljqaezCqnsTirK8VdirsVdirsVdirsVdirC/zM/Nvyd+XemC71255Xcqk2WmQUa5nI2+F +CRxUd3ag+nbFXx1+Zf8Azkn+YvneaW1tLh9C0NgwXTrB2V3Sm/rzji8m3UDitP2cVfV//OOfmabz +D+T3l+6uHMl1aRPYTsxqSbVzEhJ7kxKhxV6VirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVd +irsVfHn/ADlxdSa7+bvlvyvGx4RW0EVARtNfXJVqf7BY+uRlKgT3JAt5r/zkD5ZGgfmfqSRR+nZ6 +gsd9agdOMq0f/ksj5h9nZvEwgnmNi2Z4cMiw/wAqebPMHlTXLfW9BvHstQtjVZEPwstQWjkXo6NT +4lOxzOan3v8Akl+cel/mX5a+tAJa69ZcU1fTlJojGvGWLluYpKbV6GqmtKlV6NirsVdirsVdirsV +eWfnr+eGl/lroywwBLzzPfox02wJqqL0+sT03EanoOrnYdyFXwh5i8x655j1i41jW7yS+1K6blNc +SmpPgABQKo6BVFB2xVnf5Q+SjrWh+d9Yli5w6XolylsadbqSNnTj8kiYf7IZg6zUeHKERzlIfL8U +3YoWCe4Pff8AnCfVTN5D1zTCamz1P11HcLcQIAPlWE5nNL6KxV2KuxV2KuxV2KuxV2KuxV2KuxV2 +KuxV2KuxV2KuxV2KvjD8wm/Sv/OX8UTGsdrqGnCMNUU+rW0Mp6f5ammY2sNYZ/1T9zZi+oe9m/8A +zkx+Xc/mPytFrunRepqehc3ljUVeS0cAyAU6mMqHA8OXfNB2PqhCfAeUvv8A2uZqcdix0fIedQ69 +m35OefrryN+YOla2kpjsjKttqqDo9nMwEoI78ftr/lKMVfaeqf8AOSH5KaaSs3meCZx0W1inuanf +YNDG69vHFWM3v/OYn5QW5YQ/pK8ArQwWqitPD1pIuvviqVT/APObH5cKR6GjaxIP2i8dqhB9qTvi +qmP+c2fIFd9C1Wnfa2/6q4qmFv8A85n/AJUSvxksdZtx/NJb25H/ACTuHOKp3bf85XfkpPBI7avN +BIisywS2lwGcqCeIZUdKmm1WGKvijzz5x1bzl5q1HzFqjlrm+lLrHWqxRDaOFP8AJjSij7+uKpNb +W1xdXMVtbRtNcTuscMKAszu54qqgbkkmgwE1uVfbHkL8uk8o/lTPoMiK+o3drPNqZHRrieIhlr4I +tEB9q5yWo1fi6gS/hBFfN2UMfDAjqwT/AJwdvyt/5usC20sVlOq77em0yMR2/wB2Cudc619ZYq7F +XYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXxZKTJ/zmFc+oedNTmA5b/ZtG49fCgpmH2h/ +cS9zbh+sPqDrsc4t2r57/Nf/AJxkGo3c+teSTFb3ExMlxo0hEcTMdybd/spU/sN8PgQNs3+i7Xoc +OX5/rcLLpusWIaF/zif56vFWTVr6y0pG6xgtczL81QLH90mZWTtnFH6bk1x0sjz2Z1pf/OIvlOIL ++lNbvrthSv1dYrZSe+zC4ND88wp9uTP0xA9+/wCptGkHUsms/wDnGf8AKS3AEunT3dOpmupxXam/ +pNFmPPtjOeRA+H67bBpoPDv+ch/yt03yXrdjeaFbG30HUouCQ8pJBFcQ0DqXkZ2+NSrCrfzeGbns +vWHNAiX1BxdRi4TtySH8jfJdn5u/MOy07UIfrGl28ct3fw1IDRxrxUEqQaGV0By7X6g4sRkOfRhh +hxSp9N3X/OO/5P3FSdBETGnxRXN0nT/JEvH8M50dq6gfxfYHOOnh3JDqP/OKn5a3NTazajYt+yIp +0dfpEsbn/hsvj21lHMRP497A6SPmwzW/+cQr9A76H5himO/CG9haL5AyxGT/AIhmXj7cifqiR7t/ +1NUtIehZh+S3/OP8Xk+5GveYXivNfTkLSKIloLYGqlwzBecjL3p8P45i9odqeIOCH09fNtw6fh3P +N7DfIz2VwijkzRuFA6klTmpxmpD3uRLk+bf+cJrrj+Yet2tT+90hpeP7J9O5hWp9/wB5tneunfZm +KuxV2KuxV2KuxV2KuxVZLNFDG0srrHGu7O5CqB7k4qks3nzyNC5jm8xaZHIOqPeW6nf2L4qmFhrW +j6iK6ff294KVrbypLt1r8BPjirAvzb/Pnyf+WrW9rqKS6hq90vqRaba8eaxVp6krMQEUkEL1JPbq +cVYFof8Azmp5BupVj1fR9Q0wNsZo/SuY1/1qGN6fJDir2Xyf+Yfkrzjam48taxb6iqgGSKNisyA9 +PUhcLKn+yXFWRYq7FXYq7FXxRrBNj/zl/NVwC+rL8XtcWw+Hf/jJTMXXC8M/6pbMP1h9SZxLtnYq +7FWG+afzg/LnyvdNZ6vrUSXqGj2sKvcSofB1hV+B/wBamZmHs/NkFxjt8mqWaMeZRPk78zvI/nF5 +ItA1RLm5hHKS1dXhmC1pyEcoRmXputRkdRosuLeQ2TDLGXJCfm/5JXzj5D1HSo05X8a/WtNPcXMI +JUD/AFxVP9lk+z9R4WUE8jsWOaHFGnl3/OI/lpodN1zzFMlGuJUsLcsKELCPUlpXsWkQfNc2Xbmb +eMPj+r9LRpI8y+hc0DmuxV2KuxV2Kvl//nClHP5oas4B4Lok6luwLXdqQPpoc9AdK+08VdirsVdi +rsVdiqXeYPMOi+XtIudY1q7jsdNtF5z3EpooHQAd2ZjsqjcnYYq+VfPf/OV3nXzNqp0D8stPlto5 +mMcF0IfrGoT+8UIDrGD8mbvVcVSqz/5xn/Pjzs66h5t1RbUueX+5W7kurgA/yxx+sq/6pZaeGKsj +h/5wanMYM3nNUk7qmml1/wCCN0n6sVQt7/zhDr8B56Z5stppEIMZntZLfcb1qkk9KHFXzr5mtdUs +tfv9O1S5a7vtOuJbKaZndwWt3MZ4mSjcartUDFUsxVFabqeo6XfQ3+m3UtlfW7c4Lq3dopUbxV1I +IxV9Sfkr/wA5aNcT2+gfmG6K8hWO18wqAi1OwF2q0Vf+Mi0H8w6tir6lVlZQykMrCqsNwQe4xVvF +XYq+Kfzzro3/ADlLa6oxKJLdaReFiaApGsMLeG1ISMqzw4sco94LKBogvqPOEdw7FXkf55/mBrlj +Jp3kbykX/wAVeYSFE0Zo8FuzFOSt+wzlW+P9lQx2NDm27N0sZXlyfRFxs+Qj0jmUd5B/IHyP5bsI +31Oyh1zWnAa6vb1BMnqHciKKSqKAehI5e+Q1XamTIfSeGPlzTj08YjfcsJ/PDy5pXkHX/LH5geW7 +WPTGhvlt9Rt7RBFHKpBk+wgCjnGkiPQbg5m9m5jnhLFM3s1Z4iBEg+hOu4zn3NQOkaLpuj20ltp8 +IghlnnunRe8tzK0sh/4JzQdhtlmXLKZuXdXyYxiByR2VsnYqxjV/zO/L3SJWh1DzDYQzoaPD66PI +p/ykQsw+kZlY9Dmnyifu+9qOWI6pvoOvaRr+kwato9yt3p1zz9C4UMob03MbbMFOzoR0ynLiljkY +yFEM4yBFhV1WVYdLvJWJCxwSOxHWioTjhFzA8wsuRfPn/OEVoX83eZLzekOnxQnpSsswb/mVneOn +fYOKuxV2KuxV2KqF9e2lhZT315KsFpaxtNcTuaKkcYLMzHwAFcVfFHnPzR50/wCchPzJi8veXlaH +y7aO5sYnqsUUCkK97dU/bYdB2qFXcklV9U/lj+UnlH8u9IWz0a2WS+dQL7VpVBuLhh1q37KV+yg2 +Huakqs1xV2KuxV8v/nf/AM4patrnmG+80eSp4Xn1GR7m/wBIuW9ImdyWd4JSOH7xjUq9KGvxb0Cr +5/1j8mPzX0iRkvfKepgL9qSC3e5jG9P7yASJ1PjiqRjyb5vMvpDQ9QMtePpi1m5culKca1xVPtG/ +JT82dYdUsvKepUf7MlxA1rGe395cekn44q+zf+cffKv5m+VvJ50bzvPbzRwFf0RFHK01xbxU+KCV +6cCqmnDizU3FaUAVeo4q7FXx5/zmxpD2vnTy7rcdUN5YPbh12POzmL1qO4FyuKsl/Lz/AJyc8ra2 +sNj5mUaHqZAU3TGtnI3Qnn1ir1o/wj+bOY1XY8474/UO7r+1z8epB2Oz2iKWKaJJYnWSKQBkkQhl +ZTuCCNiDmnIINFygVGXTNOmvYb6W1hkvbbkLe6eNWljDgq3ByOS1UkGhwjJIDhs0ei0LtE5FLxD/ +AJyycP5F0ezQcp59WjaNdt+NvMp/GQZuuxI/vJH+j+lxNWfSPe9rgiEMEcQNRGoQE9+IpmmlKyS5 +QCpgSsllihieWVxHFGpeR2NFVVFSST0AGEAk0EEvn2fVfOv5269e6foN9Jof5e6fIYbm9QMst2af +ZIBUtyG4QkKqkFqmgzfiGLRQBkOLKfx+C4ZMspobRZzof/OOv5U6VCiyaUdSnUUa4vZZJGb5opSL +7kzBydrZ5HY8PuDbHTQDP9G0XStE02HTNJtks9Pt+Xo20Qoi83LtQe7MTmBkyynLikbJboxAFBJv +zO1Aaf8Al35lu60ZNNuljP8AlvEyJ/wzDL9FDizQH9IfYxymol59/wA4P6S0eg+adXI+G6ura0Vv +e2jeRgP+kkZ2zqX01irsVdirsVdir50/5zJ/MGbSfK1j5PspOFxrrGa/KmhFpAwon/PWWn0KR3xV +mf8Azjd+WEPkj8vrae5iA17XES91KQijorrWG333HpI24/mLYq9YxV2KuxV2KuxV2KuxV2KuxV2K +obUdT03TbR7zUbuGytI/7y4uJFijX5u5VRir5U/5yz/MX8tfNfl7S7DQtZh1LW9NvS5W2V3iFvJG +yyUnC+kfjVPsscVSv8i/yi/LTzn5Ij1XVLSafU4J5rW9C3EkaFlIdCFQrT926980XaOuy4cnDGqI +vk5eDDGQsvdvKXkby35StXtdBgmtrZ6Vge6uZ4wf5ljmkkRCe5UCuaPPqp5Tc9/gHLhjEeSN8x3+ +o6foGoX2m2hv9QtoJJbWyFazSKpKxjjv8R22yOCEZTAkaBZTJAsPHv8AlcP53/8Altpv+BuP+ac3 +H8n6X/VPti4vjZP5rzz8wfPP5i+bfNvluw1Dyq1rqWjzG+g0ROZmuRVZDVGHPjxgbcDpXNhpdNiw +wkYy9Mutj8dWnJOUiAQ9D/5XD+d//ltpv+BuP+ac1/8AJ+l/1T7Yt3jZP5rv+Vw/nf8A+W2m/wCB +uP8AmnH+T9L/AKp9sV8bJ/NYp+ZX5v8A5qXnli40LVfKbaCutAWkdyxlWRwWXnHGrheRdfhI8DmV +pNBgE+KMuLh9zXkzTIoirR/kbzf+bvlHy1Y+XtO/LedobYENM6zK0kjtyeRzxoOTH6BtkNTp9Plm +ZyyfaEwnOIoRej+RPO35o6xr62fmPyf+hdNMTub71C1HWnFaV/azX6rS4IQuE+KXds348kyaIZ7q +jaqthKdKSCS/pSBbp3jhr4uY1kbbwA38Rmux8PF6r4fJuldbPlv8+YvzstdPS483apafoO7nEEVh +pcjJbl6NIA0bKkjgenWsnKhpnTdnHTH+7HqHfz+f6nAz8f8AFyfQ3/OLHl06N+TWkyOnCfVpJ9Rm +Hj6r+nEfphiQ5t3GeuYq7FXYq7FXYq+MfzQhXzz/AM5YWmgz1lsLe7sbB4zvW3gRbi5TvSrNLir7 +OxV2KuxV2KuxV2KuxV2KuxV5j59/5yM/K7yb6kFxqQ1TU0qP0dpvG4cMO0kgIij36hn5e2KvAvMv +/OWP5p+arl9P8laWukxtXiYIzfXvHpUuy+mg+UdR/NkJ5IwFyIA80xiSaDF/+VT/AJo+b7sah5w1 +h1kavx3sz3k617KgYoo9uYp4ZptR7QYIbRuZ8uXzP7XMx6GcuezJYf8AnH3yrBptwjXFxd6g8LrB +NIwSNJSpCOEQA7NvRmOak+0eQzGwjCxfU11/FOT/ACfEDnZYH+S+sfmZZeajoHlC8htrq6ZnubC/ +K/VnMAPLkrAtyUdfT+Kg8BnSa7HhMOLINg6/CZA1F9k6KdbOmw/pxbZdTp/pH1IyNAW8U9UK9Pnn +I5eDi9F8PnzdlG63R2VsmndUUu5CooJZiaAAdSTiBaHhP5N8/On5r+bPzEkBbT7dv0do7EGhWgUM +tRswgjUsP+LM3vaH7nBDCOZ5/j3/AHOJh9UzJ7vmicx2KvEf+clQLS78i63cEjT9O1cC6O3H4mjl +FR/qwPm77G3GSPUj9f63E1XQvbQQQCDUHoc0jlN4pSXzN5z8q+V7ZLjX9Tg0+OSvpLK37x+PXhGv +J3pXfiMuw6bJlNQFsJ5BHmXzJ+dn5haf+Z/mby75e8qtLPbLN6EbyI0YluruRI0oh+KigChIHU50 +/ZmilhieL6i4GoyiZ2fbWh6Ra6Noun6PaClpp1tFaW4/4rgQRr+C5s3HR2KuxV2KuxV2KvjfymCP ++c0p/rdK/pTU+POlKfUp/S/4144q+yMVdirsVdirsVdirsVeQfmX/wA5Ofl55MaaxtZv0/rcdVNl +ZMDEj+E1x8SL4ELyYdxir5W/Mf8A5yD/ADJ88GSC6vjpmjyVC6VYFoYmQ1FJXr6kte/I8fADFXme +Kvpj8jdTtb3yJBFFGkdxYyyW9zwVU5MDzRzTqSjipPU1zhvaDHKOosk8Mht5d/6/i7rQSBh5h6Fm +ic12Kvnvz6l35B/Nqz8z2CEQyzLqMSqeIY143UVf8upr7Pnedl5RqdLwS5gcJ/R9n2uj1MPDyWPe ++wdL1Ky1TTbXUrGQTWd5Ek9vKOjJIoZT9xznMkDCRieYc2JsWisgyYZ+b1p5vvfIGqWPlSFZ9Tu0 +9F1LiN/q77TelXYuV+EAkddt6A5vZ8sccoMzsPv6NOYSMdnzl+Wn5m/mVoKR+RtEtNLsrmGWSsOp +q1vM87t8Su8ssS+p0UKaGgAGdDqtHhyfvJ2fd3fBwseWUfSHq36V/wCcqf8AqzaN/wAGn/ZRms4N +B/OP2/qci83c79K/85U/9WbRv+DT/sox4NB/OP2/qW83c8o/Mj8z/wAy/MAm8i6zaaZfXU0sY9HT +Ea4lSdGqqxvFLKvqbFSBXqQc2el0eHH+8jY2693xcfJllL0l9KflXb+bbXyJpVp5riWLV7aIQsqu +JGMSbRGUio9ThQNQnx70znNccZyk4+R+9zsIkIi2W5iNqB1xdH/RF2+sxQy6XFE8t4tyiyRelGpZ +i6uCpAAyzFxcQ4D6ixlVb8nzj/zjB5UtfNn5xal5tisltNE0Rpbu1tEUCOOa6ZktYgBt+7j5tt3U +Z3UIkRAJt1BO77PySHYq7FXYq7FXYq+M/wAyX/wb/wA5b2WsP+7s7q90+7Zz8NILlEt7htqV3EmK +vszFXYq7FXYq7FWGfmR+bnkn8vrD6xr16PrkilrXS4KPdTdacY6jitRTmxC++Kvjz80/+clPPvnk +TWVq50Py45KfULRj6kqntcTjiz1H7K8V8QeuKsQ/KyLyvP5wtbTzFbC4trn91bc2IjW4JBj9QAjk +G+zQ7VIrmB2mcowE4jUh93Vv0wiZgS5Po7zD5J8ta/pa6bf2UfoQrxtWiAjeDbb0io+Hp06eIzht +N2jmwz4oyu+d7373dZNPCYoh8/effyj17yuZLu3B1DRgSRdRr8cS9f3yD7P+sPh+XTOz7P7Wxajb +6Z936u90+fSyx78wnP8Azj5r4s/M11o8jUi1OHlED/v63qwA+cbP92YvtDp+PCJjnA/Ydv1NugyV +Ou99C5xDuWDeefKvnzV9WiufL+v/AKKskt1jkt+Ui8pQ7sX+AEbqyj6M3XZ2t02LGRlhxyvnQO23 +e4eow5JSuJoe8sD81/lL+ZF9pj3Go65Hq7WKPLBbMZGc7VZY+S9WC9O+bnSdsaQTEYQ4OLyAHxou +Jl0mWrJuvel/5Q/8rK80ySeXdA85S6P9Qh9W2spZ51RouXx+kEDD4CwqPfbvmz1pw4xxzhxX5Bxc +XFLYGnv35Y+RfzR0DXri881+af03p0lq8MVp6s0nGZpI2WSkiqNkRh9OaLW6rBkgBjjwm+4D7nMx +Y5g7m3p2axyGGfmF+U3k/wA82pGq23paii8bfVIAFuEpWgLU+NN/st9FDvmZpddkwnbePc1ZMMZ+ +95R/iv8AMz8lbm20/wAzMPMvk2Z/Ssr5XpcIBvxXmSwKr/ut6r2Vxm28HDrAZQ9OTr+P0uNxzxbH +cNSeb/zJ/Om9uNM8pk+XPJ0Lelf6g7D13DD7L8DyJZf91oafzNTEYMOjAlP1ZOn7P1qZyymhsHrH +5d/lN5R8i2gXS7f1tRdaXGqTgNcPXqAeiJ/kr9NTvmq1euyZjvtHucjHhEPezPMJuePedvy3/OXV +fNF/qGg+c/0ZpM7KbWx9a4X0wI1VhxRSoqwJ2zc6fWaaMAJQuXuDizxZCbB2eNfm7F+Z3lQQaDr3 +nKXV21SJmm0+GedgIQwCmVXC7OwIUd6HNtopYcvrhDhrrQcbKJR2JeieSv8AnHD8+9H0SJtG83Q+ +XlvlS5udPinuonSR0Hwy+nHxLqPhO5zYtD2r8mvJH5m+V/0x/jjzN/iL659W/R/76eb0PS9X1f75 +Vpz5p08MVel4q7FXYq7FXYq+Xv8AnNjya81joXnG3Sv1Vm0y/YCp4SEy25PgquJB82GKva/yY87J +5z/LXRNbaTneNALfUfEXVv8Au5SR25leY9mGKs2xV2KrZJI4o2kkYJGgLO7EBVUCpJJ6AYq+aPzm +/wCctrTTWn0L8vmjvL1ax3GvOA9vEehFsh2lYH9tvg8A1cVeMfl95AvPzCvLrzP5l1SW6iNwUueT +tJdTyqqsQ7tXgvFgPGmwp1zS9rdrflqjEXMj4OZpdL4m5Oz3O18seXrXSP0PDp0C6ZSjWhjVkb3c +NXk3ud842etzSyeIZHi73bDDAR4a2eaeb/yBsLlmvPK9x9QuQeX1OYs0JPX4JN3j/EfLN9ovaIj0 +5hfmP0j9XycLNoBzh8noHku+1y50OKLXrV7XWLT9xeB6FZGUCkyOvwsHG549DUds03aOLHHJxYiD +jluPLy8v1OXp5SMakPUE9IBBBFQdiDmCDTe841/8pLaHW7bzL5U42OqWkyzvYfZt5+JqyrT+6LrV +f5fl1zoNL21xQOLPvGQri6j39/3+9wMujo8UOY6PSB06U9s54uewnzt5H8z69qsV5pXme60W3jgW +F7WAyhWcO7GQ+nLGKkMB07Zt9BrsGGBjkxiZvnt5d7iZ8M5m4ypj/wDyqbz9/wBT/f8A/BXP/ZRm +d/K+k/1CPyj+pp/K5f55+15z518keZ/y91G01W01SZ2nLiPVrYyW8qTMDzQurFgXQnfl8Qrm90Pa +GLVxIrl/CXCz4JYiHv8A+Qeia/NDH5tufO155k0u+s3gGm3Tzt9XufUjZuQkmlUPHwZdh0NQaHfV +9qTgP3YgIyB57bhv04PO7eyZp3KYZ+afm/zN5Z0KGby5okmtanezC1gVAXSF3UlXkRPjYbdqDxYd +83Q6eGWR45cIG7TmmYjYMC8p/kVrGu6ovmj81b1tV1Njyi0YODBEOoWQp8FB/vuP4fEtXM7P2nGE +eDAKHf8Aj7y1QwEm5orzX+Rd9pepP5n/ACuvm0HWlq0mlhqWc46lFBqqV/kYFP8AVyODtMSHBnHF +Hv8Ax9/NM8BBuGxZB+VP5j+ZPMs9/ovmbQJ9J13R1Q3s3ErbPzNEoGPJWehIA5KQKhu2Ua7RwxgT +hK4yZYcplsRuHo2a1yHh35u+SvN1nNrXnD/lYl/omiIFli0yB7gBSEVFiiC3EacpHGwAG5zd6HPi +lw4/DEpd+3z5OJmhIXLi2eW/lJ+UXnn829Svtdl1ue0XTjGo127MtzM9ytDHHG5dXrGg5E8vh+Hx +zo4QERQFBwSSeb2z/oXX86P/AC8Gq/8AI2+/7Kskh6L+UP5dedPJv6W/xN5wu/Nf1/6v9U+tvO/1 +f0fV9Th68s3956i1pT7OKvRcVdirsVdirsVY/wCf/J9l5x8nar5bvKLFqMDRpKRX05R8UUlP8iRV +b6MVfLf/ADiz50vvJX5han+XXmGtsmoztDHE/SLU4Dw4jt++Qca9yEpir7ExVK/MnmbQvLOjXGs6 +5eR2Om2q8pZ5TT5KoG7M3RVUVJ6Yq+M/zS/PHzr+bWrnyv5Vt5rPy67fDZoaS3CqaerduDRU/wAi +vEd+RplWbNDFEymaiGUIGRoc0Nc/846uugI1vqXPX1BaRGFLVtv7tTTmtP5z18BnOw9pInLRj+77 ++vv/AB9rsD2eeHY+pV/Io6rofmDWPK2rwSWlzJEl3FBIKCsbem5UjZuYddxUHjke34xy4YZYGwDW +3n/YuhJjMxL2rOSdq7FXYq7FXYq7FXYq7FUt8w6Bp2v6Pc6VqCc7a5XiSPtIw3V0J6Mp3GZGl1M8 +GQTjzH2+TXlxicaLxryB5w1r8nPPM+i63yl8v3rKbrgCVKE0ju4V8R0ZR13HUDO3ywx67CJw59P1 +H8ebpgZYZ0X1xZXlpfWkN5ZyrPa3CLLBNGQyOjiqspHUEZzE4mJo8w54N7q2RS7FXYq73xVTuLi3 +treS4uJFht4VMk00hCoiKKszMdgAOpwxiSaHNBNPlfzv5j8wfnh+Yll5O8qBhoVtKTFKwIQqvwzX +047IgNEB33p9p6Z13Z2iGGNn6zz/AFOtz5eM+T7B8j+TdG8m+V7Hy7o8fCzso+Jc/blkO8ksh7s7 +bn7htTNi0J9irsVdirsVdirsVdirsVfLP/OXf5WXENxb/mXoKNHNCY4tbMNVdWQhbe7BG9RtGx/1 +PfFWefl3/wA5I+VdQ/KqTzN5mu0ttV0YLbavarT1Z7gqfSaCPbl9YCkgdFIb9la4q+cvNPm3z/8A +nr5uCUNnolo1YLRSxtrOIkgSSdPUmYd+p7cV6Yms1mPTw4pn3DqW3FhlkNB695O8l6J5U00Wemx/ +vHAN1duB6szDux8B2XoM4LXdoZNTK5cug7vx3u7w4I4xQT/MFvUJbGzluYbqSFGubfl6ExA5oHFG +AbrQjqMsjmkImIPplzDEwBIPUNahew2Nhc3s54wWsTzSt4JGpZj9wxw4zOYiP4iB81nLhBPc8w/J +Tzn5v8y3mqHV7oXFlaIhjHpojLJKxIAZQtQFQ9a50XbujwYYRMI8MifsH4DgaLNOZNmwHq+cy7F2 +KuxV2KuxV2KuxVjXnzyLpnm/SDZ3P7m7hq9leAVaJyO/ijftL/EDNj2d2jLTTsbxPMfjq4+o04yD +zeb/AJZ/mj5g/KrXZPKnmyKSTQS9QFq5t+Z/v7c/txP1ZR8x8VQet1Gmx6vGMmM+r8bF1UJyxS4Z +PqrTNT0/VLCDUNOuI7qyuVDwXETBkZT3BGczkxygeGQohzgQRYRWRZOxVSurq2tLaW6upUgtoVLz +TSMEREUVLMxoABhjEyNDcoJp8v8A5n/mrr/5n65D5E8hQTTadcy+kxQcZL1lNeTV+xbpTl8VNvia +nTOp7O7OGL1S+v7v2uvz5+LYcn0j+SX5N6V+Wvlv6uCl1r96FfV9RUGjMKlYoq7iKOu38x+I+A2z +jPR8VdirsVdirsVdirsVdirsVSDz3rvlfQ/KWp6h5oaMaGsDx3kUgDCZJFK+iqEjm0leIXvir81d +SfTpdTupdPhkt9MedzawyMJJI4WYmNGeihmCbV74q+q/y8tfLEHlOyPlsV06VefqGnqvJ0czH/fl +RQ+HQbUzzrtWeY5z4v1D5V5eTv8ATCAgOFkma5yHYq7FWIfm3qBsfy81mRftSxLbge08ixN/wrHN +r2Jj4tVHys/Z+txdZKsZSD/nH3TRb+S5rwj4767kYH/IjVYwP+CDZm+0mQnNGPQR+/8AAauz4+gn +zenZzrnuxV2KuxV2KuxV2KuxVjnnbyLovm3Tfqt+np3MYJtL1APUiY+Feqn9pe/zocz9B2jk00rj +vHqPx1aM+njkG/N4/ovmf8xfyX1w2rr9b0W4fkbVyxtLgDq8T0Jikp12r4gimdkPA12PiHP7R7/x +7nUETwyovpX8vvzc8m+eLZf0ZdCDUgKzaVcEJcKR1KitJF/ykr70O2aHVaDJhO4uPf8Ajk5ePNGX +vTXzl578seTtMOoa9eLboa+hAPimmYfsxRjdj+A7kZVp9LPMaiP1Mp5BEbvmXzJ54/Mb87vMcflj +y1ZyQ6SzhksENFCKf96L2YbcV60+yDQAM1Cep0eghgF85d/6nX5cxn7n1H+S35IaB+Wmkkxlb3zD +eIo1LVGHyJhgrukQbfxbqewGe0vSsVdirsVdirsVdirsVdirsVQup6np+l6fc6jqNwlrY2kbTXNx +KeKJGgqzMfYYq+HfzQ/MTzL+dvnmHSNFR4PLtm7fo+2eoUIKh7y5pX42BoB+yPhG5JajU6mGGBnM +7BnjxmZoPQ4Pyv8AK8fk1vK5i5W8g5yXVAJjcU2nr/MO3am3TOGl2xmOfxfs6V3ft73dDSQ4OH7X +kehaz5g/KfzbLpWqK0+jXLB5VQfDJGaqlxDU7MKfEv0HsR0uowYu0MAlA+ocvI9x/HmHXY5ywTo8 +n0Fp2o2OpWMN9YzLcWlwoeGZDUEH/Pcds4jNhljkYyFSDuYTEhY5KzTQoaPIqnwJAOCOOR3AKmQH +VyzQueKyKx8AQTiccgLIKiQPV5t/zkDctD5FijHS5voYm37BJJP1x5vPZwf4Qf6h+8OH2h/dj3p3 ++UNt9X/LnRkoQXjklNRQ/vJnf9TbZjdtyvVT+H3Bs0Y/dBmOalynYq7FXYq7FXYq7FXYq7FUHq+j +6ZrFhLYanbJdWkwo8Tjb2II3Vh2I3GXYNRPFLigaLCeMSFF4R50/JTXdCnOq+VpJby1ib1FjjJF5 +ARuCvGhenYr8Xt3zstB25jzenJ6Z/Yf1fF1OfRShvHcJFJ5F/M7zRY3PmTUI7m8eKMFHvZHa6mRe +0SvV2CjcdK/s1OZsu0NNimMVgHy5D39zQMGSQ4qfTP8AziV518hXnlX/AA3p1lBpPmi0XnqUIr6l +6F2+sq7lnfr8SV+A9AFIzYtD6BxV2KuxV2KuxV2KuxV2KuxV2KvjX/nI7847/wA+eYk/L/ye7XGj +QTiO4kgNRfXSnswNDBEeh6Egt0CnIZMkYRMpGgExiSaDJvy88h2PlDRRbJxl1G4o9/dAfbcDZVPX +gn7P3988/wC0+0Zamd8oDkP0+93um04xx82vOP5meVvKoMV7OZ7+lVsLejy+3PcKg/1j8q4dF2Tm +1G4HDDvP6O9c2qhj25l47r/mfzt+ak6aXovlxrmO3f1I47SF7meOuxLzAURT32UZ1/Z/ZcNNdEkn +n3fJ1OfUnJzDFvNXl7z35Lu/8P8AmCG60uQoLhbNpaxMsg+2nps0TVpQkHqKHcZseEXdbtFsbySH +Yqu9ST0/T5H068uFTx5UpWnjir2HyZ+T/wCfGr+U9O1/yreSS6VdKzWkEOo+iQI5HRlMcjxoPjjI +pXKMmmxT+qMT7wGcckhyJCOudA/5yq0IfvtM1G4VDuscNvqFadqwidj07HMXJ2Tpp84D4bfc2x1W +QdUvl/Oj8y9CmEPmHQ0iPQpc209pKT1/aNP+FzCyezunly4o/H9bbHX5Bzop1pv/ADkboslBqWkX +FsfG3dJx8/j9HNfl9mZfwTB94r9bkR7RHUMv0r82/wAvtSoserx28ndLoNb0/wBlIFT7mzWZuxdT +D+HiHlv9nP7HIhrMcutMst7i3uIlmt5Umib7MkbBlPyIqM1s8coGpAg+bkxkDuFTIJdirsVdirsV +dirH/PXm608q+XZ9Umo8391ZwH/dk7A8V+Qpyb2GZ/Z2iOoyiP8AD19zRqMwxxvq+cfL9n+Yf19/ +Omi29ytzYytfnU41CgPyLOyhqCTqeSqDt1FM7+WoxYyIGQBOwDoxjlIE0+1/yK/O7S/zJ0IpP6dp +5nsVA1LT1OzrsPrEAO5jYncdVOx/ZJyGt6jirsVdirsVdirsVdirsVfO/wDzlT+dh8vaa/kfQJ6a +7qUf+5S4jPxWtrINoxTpJMD8wm/7SnFWA/k3+W48v6eNZ1OL/c1ep8EbDe3hbfhQ9Hbq3h08a8V2 +52n4svCgfRHn5n9Q/HR3Gi03COI8yl/5qfm5LYTt5d8sP6mqM3pXd3GOZiY7elFStZa9T+z0+10v +7I7G4gMmUbdI/pP6mGr1demPzZX+UH/OJcl6I/MP5lNKZJj6sehB2EjV35XkoPKp68FNfFuq51wF +OqfT2j6Jo+i2Een6RZQafYxf3dtbRrFGPfigAqe5xVj35mflh5Y/MLy++k61CBKgLWGoIB69tKf2 +o2PY0HJejD6CFXwV+Z35WeaPy715tL1qHlbyFmsNRjB9C4jBoGU/st/Mh3X5UJVYdirsVfb3/OHX +mKPUfyrfSS9Z9EvpovTrUiK4/wBIRvYM7yD6MVe7YqsmhhniaKaNZYnFHjcBlI8CDtirDde/JX8q +Ne5HUvK1g0j15zQRC1lJPcyW/pOT9OKvMfMn/OF/5eXwZ9D1K+0aY/ZRit3AP9g/CT/krirzTVv+ +cTvzh8tSPdeVNVh1EDoLS4exuWp4rIVj/wCSpyGTHGYqQBHmmMiNwxq58/fnT5ImW382aVMYgeIO +oWzRch0pHcRhUfp1+LNVn7C02TcDhPl+rk5UNbkj1tlGgf8AOQHlS94x6rBNpUx6uR68P/BIOf8A +wmaPUezmWO+MiX2H9X2uZj7QifqFPRNK1vR9Wg9fTL2G9iHVoHV6V7NQ7H2OaTPpsmI1OJi5sMkZ +cjaNyhm7FXYqlGq+VNC1fULe91S2F69opW2hn+OFCxqzekfhLGg3avTbMzDrsuKBhA8N8yOfz/U0 +zwRlKzumyqqqFUAKBQKNgAO2YhJJttp84edta0nyl+Y0Gu+Qr/0NQtH9W4WAfuI5wfiRSDxdJBUO +lOPUd6D0PsqWc4R4w36d5Hm6HUiAn6H2P+TH5xaN+ZXlwXcIW11u0ATVdM5VMbnpJHXcxP8Asnt0 +PTNk470PFXYq7FXYq7FXYqwf84fzP078uvJtxrU/GXUJawaTZMf765YbVA34IPic+G3UjFXyR+U/ +lPUvNnmK589+ZXa65XDzRPKB/pF2Wq0h7cIz0AFK7D7NM5/tztLwo+HA+uXPyH6z+OjnaLT8R4jy +DOPzf89t5Y8v+hZScdX1HlHbEdY0A/eS/MVovufbNJ2J2f4+TikPRD7T3fr/AGubrM/BGhzKf/8A +OK/5HQWtjb/mF5ltxLqV3+90K2mBPoxHpdMD1kk6x+C/F1O3dukfTGKuxV2KpL5v8neXfN+hz6J5 +gs0vLCffi2zxuPsyROPiR17EfqxV8N/nR/zj/wCZfy5umvYeep+VpXpb6mq/FFyPwx3Kj7Ddg32W +7UO2KvKcVeu/84z/AJoQeRvPwi1KX0tC11Vs7+RjRIpA1YJ29kZipJ6KxPbFX3sCCKjcHocVbxV2 +KuxV2Kqc9vBcQvBcRrNDIOMkUihlYHsVNQcVeX+cP+cZ/wAovM3OQ6QNIvH/AOPrSmFsQf8AjDRo +D/yLrirw/wA0f84fef8AQZ21DyRrKal6dTHEWNhejwVH5GJvmXT5ZGURIURYSCRyYf8A8rL/ADW8 +jXo03zjpUslK8Y7+JreVlXasU6rxdf8AKo3zzT6rsHBk3j6D5cvl+qnLx62cee7P/LX5zeSdbKxS +XJ0y7bb0byiKT/kygmP5VIPtnO6rsLPi3iOOPlz+X6rc/HrYS57FnSsrKGUhlIqCNwRmmIINFywW +8CWLebfLnmTzCG0+PVV0jRm2n+rK0lzOpG6s7FFjXtRa17nembXRavBp/VwmeTz2A93P5uLmxTnt +dRSjR/yO8g6cVea2l1GVTUPdyEiv+pH6aEfMHL83tBqJ/TUfcP12whocY57sS80+XfMH5YeaLfz3 +5JdorSKStxbAExxBz8UUigjlbydP8n58Tm97H7WGccE/7wf7L9vf8/dhavS8BsfT9z6x/Kf81NB/ +MbyzHq2nEQXsVI9U0xmDSW03genJHpVHpuPAggb1wmbYq7FXYq7FVK6ure0tprq5lWG2gRpZ5nIV +ERByZmJ2AAFTir4W89eZtV/PD81xHas8Xlyw5RWXb0bJGHqTsDt6s7U/4Vei1zE12rjp8Rmfh5lt +w4jOVB7Zp2n2enWMFjZxiG1tkWKGMdAqig655xmyyyTM5G5F6CEREUOTxPS9Gb81/wA/YNJlLNo1 +tMUuKbUsrEky0I6es9QD25jPQ+zNL4OCMevM+8/inQ6nJxzJfdcUUUUSRRIscUahY41AVVVRQAAb +AAZntC/FXYq7FXYqo3dnaXtrLaXkKXFrOpjnglUOjowoVZWqCD74q+T/AM7f+cTri0a48wfl7E09 +pvJdeX6lpY+5NqTu6/8AFZ+Ifs16BV8xyRyRSNHIpSRCVdGBDBgaEEHoRiqLv9b1nUEjS/v7m7SF +VjhWeV5QiIOKqocmgUbADFU/8k/mp588l38N1oOrzwxREcrCR2ktJFH7MkDHgRTaoow7EYq/Qb8v +POFv5y8laR5mt4/RXUoBI8NeXpyqxjlQNtULIjCuKsixV2KuxV2KuxVB6rpGlavZSWGq2cF/ZS7S +W1zGssbfNHBGKvD/AD5/zh75B1r1Lny1PL5cvmqREtbizY/8YnYOlT/K9B/LirxDWPy7/Pr8pmea +GKW90OI8nuLOt5ZcQakvERzhHixVfnmJqdDhzj1xvz6/Ntx5pw5FNvKv/OQWi3fCDzDbNp0/Q3UI +aWAmnUqKyJv2+L55zWr9nJDfEeLyPP58vudhi7QB2kKepWGo6fqNst1YXMd1bP8AZmhcOp+lSc57 +LhnjPDMGJ83YRmJCwbROVMlk0MU8LwzIJIZVKSRsKqysKEEHqCMlCZiQRsQggEUXiepWHmf8m/OM +PnDyiS+jSH07i3erxhHYFrafuY2oOD9QadwCe77J7UGojwy2yD7fN0mq0xxmx9L7C/Lr8wvL/n3y +zBr+iyExSfBc2z/3tvOAC8Ug8RXY9CNxm5cRk+KuxV2Kvm7/AJzA/NOTTNHg8haVKRf6ugn1ZkJ5 +JacqJDt3mdTyH8op0bFUg/KjyOvlfy2n1iMDVr8LNfsaVXb4Ia/8Vg7/AOVXOB7Z1/j5aH0R5fpL +vNJg4I2eZZRr1/8Ao/Q9Rv8A/lktZp/+RUZf+Ga7SwE8sInkZAfa35ZVEnyYp/zg/o0Ump+atccV +mghtbKJu/Gd3ll/GBM9PecfWeKuxV2KuxV2KuxV2KvOfPf5Aflj521UatrGmtHqRFJ7m0kMDTdKG +Xjs7CmzUr+GKsb/6FD/Jv/lmvv8ApLb+mKu/6FD/ACb/AOWa+/6S2/pir0/yZ5Q0byf5as/LmirI +mmWPqfV1lcyOPWleZ6sevxyHFU7xV2KuxV2KuxV2KuxV2KvMfzC/5x1/LLzr6lzcaf8AovVn3/Se +ncYJGbrWSOhikr3LLy9xir5080f846/nH+XVzJqnlK6k1nT1NTLpwYXHFenrWR58/kvMZTmwQyx4 +ZgSDKEzE2DSH8r/85ABZRZea7IwSoeD3lup+FgaH1YT8Qp34/wDA5zes9nBzwn4H9B/X83Y4u0Ok +w9b0nWdK1e0W80y7iu7ZukkTBgD4Hup9jvnM59PkxS4ZgxLsYZIyFg2q31jaX9pNZ3kKz2s6lJoX +FVZT2ORxZZY5CUTUgmURIUeTxy2svzN/KLzbcaj5Eil1DS9RRkNuIZLqMqDVUnij35Rk/A+3z3YZ +3Wg7YxZYXOQhMc7NfK/wHS59JKMthYZVB/zlL+eWlMZNc8owTWiEmRzaXlsaClaS83jp/sTmxx6r +FM1GUZe4guPLHIcwQ9C8jf8AOYH5ea7NFaa9bzeW7uUhRLMwns+RNADOgVl+bxhR3OXsHulvcW9z +BHcW0qTW8yh4Zo2Do6MKqysKggjoRir849U/MZtX/M6688azZnUTNdNcxWTSekFVPhtk5cZPhhVV +FKb0yjU4pZMZjE8JPVnjkIyBItnP/Qyn/fuf9Pv/AF4zm/8AQx/tn+x/487D+Uv6P2/sQWuf85A/ +pXRNQ0z9A+j9etprb1vrfLh60ZTlx9Fa05VpXLcHs74eSM+O+Eg/T3f5zGev4okcPPz/AGPU/wDn +B7UUbTvNmmkgPFNaXCjuRIsqH7vTH350zrn1DirsVdirsVdirsVdirsVdirsVdirsVdirsVdirsV +dirsVdirsVdirBPzB/JP8uvPivJremKmpFaJqtofQul2oKuopJTsJFYYq+afOP8AzjN+afkK7fWP +JF7LrNjGeX+iVjvVUb0ktqlZh/qcq/yjK8uKGSPDIAjzZRkYmwl/lf8AP1opf0f5vsmgnjb05LyB +CCrA0PqwH4lI78f+BzmtZ7OA74T8D+g/r+bsMPaHSfzet6TrOlavZreaZdR3ds3SSJgwB8D3B9jv +nMZ9PkxS4ZgxLsoZIyFg2jMpZsJ87flR5Z8zxSTLCthqxBKX0Kgcm/4uQUEg9/te+bjQds5cBAke +KHcf0H8BxM+kjPlsWPfkJ+aPmL8t/PS+QfNEjHQbycWyo7FktbiZh6U8LH/dMpYcxsN+WxBr3OHN +HLATibiXSzgYmjzfWP8AyrzyB/1LOlf9INt/zRlrF3/KvPIH/Us6V/0g23/NGKu/5V55A/6lnSv+ +kG2/5oxVHaV5Z8uaRJJJpOlWenySgLK9rbxQMyg1AYxqtRiqZYq7FXYq7FXYq7FXYq7FXYq7FXYq +7FXYq7FXYq7FXYq7FXYq7FXYq7FXYqwT8xvyU/L/AM/xFtbsBHqQXjFq1pSG6XsKuARIB2EisB2x +V856t/ziZ+bHl/VpT5M1qO4sZhtcpcPYT0B2SVFJBp4hj8hleTFCYqQEh5i2UZGPI0of9C+f85Nf +9XeT/uLS/wDNWUfkNP8A6nD/AEo/Uz8ef84/N3/Qvn/OTX/V3k/7i0v/ADVj+Q0/+pw/0o/Uvjz/ +AJx+aX3n/OK/576ldpcalLBdTgKguLi/MzqoNQAzVagqTTMjHijAVECI8tmEpEmybf/Z + + + + + + + image/svg+xml + + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + eJzdffle8sqy6H0B3gFUFGQwEyEBB2YHUEFwwJlJRJlkWGuv88d59lvVSUgICWmQ75x1716/7aed +Tnd1dXXN1fF6iuVQsjmot0J8mHG7vN70qFWbDEYxN2l1n3e70/FkhE2+G7+bZcMMdEqeS29qx7vW +aNwZ9GPkEXmYw7d951e565vTrN/t80NbpTPptqB1Mug1apPw+K+2X5sLXs7UJvAwciAfMKKbZWJ8 +1J28hOepwbTf7PTbqcF/YPyo6OYZzi3AU0GKwuOzzk1rbO4TjrK8jB3DnAy/CLwYluBNQYInDL6V +GTSmvVZ/UhwNGq3xOD3oDkbjmDv9T63vvqy14UnNXW11u4O/3alurfHtgtVG3nKdbgsW1qtN3FFc +ZfKcfyOv3o7hHXgdf8fm6Nt5D1rKrckEoIKBESXpy2reOB9Aqv7ne7pptTsEw4CIF78ycqXVG3YB +KWRRPCCFl0XtX7UHwEOehqJsmJdlGfAmhiMy9BMlPiwwjAC/RMgj5Q193a2/Oq2/Y+6rQb+lLC45 +mpQ7/9XCqRg3xzBK68202xrd9jsTWASHTbKy4stBs9VVm8i7uW6NLJT8x+o/lQ6V2qjdmsBODbrT +CaEUSZvhator1P5pjfQJroetfmVwR+ALiUJYFMWIWxQY5Rc2HHFLouyOMoA6ScEgC8tUp2TJtKwy +No6E42gTRHHvi7Az16NOu9OPsYLoDnHYint2Ouo09S2Lcm5J+UHWEZYM/5e1/ysAw9onk1Zf2eZs +v5ke9BDJY6Re2Ng+7Hp30FaezX4nT2C66VCBlfz9BvtRHHX6CIPrijyR3ordKTw6HQ2mw/P+x8Dl +U05lEScd9a/78MunOzWajj/dlcGgC6dtroP6SBkFH44mxt5L54C+9uPrA601drrW7Xbao9rws9Ow +Gt7i+Wweu3eXTgjbNGrpY5A/Z/8ufbPcIKi0gnL+0WxwizeWz/BPrz7odsY9fWBDi/67E0XARnVb +/eZ4Nozypw5YofOX1rh8sEzrA1idYWtJa7b/V6s7GBrQOGup9Zvu+9poaDcsQvfR6TcBK+VpZ9LS +N3rQGyIDd5c/a0NsXuipnBA4PcbzEQotPzgrvyArT5ARTv7ptsaug3x/8Hef/OGOuXxPgJLatDt5 +8bsPrmq9ljvoOih3gEm3tC6M+9rFqDzwG367cWn8MO/SuCLjfvgH/riAX76g6W+34L50P70w7ia0 +Pty4kIE9NF0HxRoA54673AcwLfxLAIQV6eA5rrFY6wI7axEginWXnbhBkMauhdZiY/bGt+XTYmoG +gjbTKvgtwHBGpC6skHRYZyNZRnmkHBsc5v+ozTCQqdFmcBVWTV6CclJzed8OtL9hr/GvTgOxURv9 +o/z9cFm4ArlI/vBtN9W+QC3lCQzedvv+0+v2oUMIf/SBgvxAQt436+d/1bpTtYPsPjiHOeceT/4Z +qk8PkqNRzQqCXmtSawLgvweAXQ+Av2qjTq3eRT1o/G8A4n8dhv9JLMT1Po3PTrc5avXVPiayNXQE +mTXq1KcTBDRIHgUX1xIb15Dn4ZH4H95Y6iXNQ4zvOIPp2+2P3xpg5wx6cZvOBpi5/9lt0NawuB3k +QewvuuUBHY7/rYvDNQRpyHFNKoC1A7leEYQ44areIeYk++9DlXEVi8TQHTS+W03n9fXB6vv3rU2D +/k9SwQq84N98WCiRNL/28cff/2sScNztNP6/EH9kIeXBdNRoEa/Tv3JN8yD/4wjizFN2cNOqdf81 +pP6PpcBzXM3MAfjvWs1/rFbzd6c5+XRcEScyYVbk2H/ZilTgF1f12eq0P53VbVYSwgLL/9uWpUG/ +uK76YALqYaH1MVEciM4rdB+kBoN/z9IWF/AvEbYgm/4fl7WbEzgbAt7ggMAWRsVd8pxl3TM/BnFA +uwu1fntaa7fcxcFwOjSRLnmhOGqNW6O/Wu5K6z8Td7bZmdTqnW5norJoMRLhI7MJZHdtNKkPaqOm +u4HBAjfrHmmKnWPP9qilrdexb31GGRFO4CT7rpwOgGNPAwCOfesLQnyx2zzp4vPJqNYfD2uwr41/ +YLpO0z3u/Fdrtk0a2mX3sDZsjeBhb9olfjdNWjMax8RO19PJcDpx39TGk9ao81+ko1sPtajgRebe +uWyNPx3eYOb2X6Mldwd61SYtWHmL2EhLO3/3QaUfAHBtdAOrx/3pstXsTHuGCV8MJ9+KPNX4CqCC +kOHEbbB/TEdCIxfAvIr4qIb55rATNkFb63bGpqZebfytolnUMDasNXWzJHnuTk4ngxn2tP1nDAeM +cX/MQB6RfqG/Wo0JkEy91q31G4t7PfcKYKzb6bfcEzhrdD3Hk9HgWzv7rE3nRrczBJJE581/4Dy0 +AW0Obwy1Uz/4qzUaooN0xl4ANY3BqNlqLm6D++BqMJl7vCrvcRhOp5YDne8djJqjcVhx4JgV74Vu +tX5/MJmtXdnlhU4aHsbjeQ662HHabzh0AXkHJ6ZJdQSML/9nGNYlpdXo0GEwbE4dOoydRmgM5tmY +qQOSzvIOgz6QyEShw6VzqT112iasyaonMOJ5lsQzNj1H5p7RiHXHueNnufNDZd+X7zp0AjY038/A +lc1dP2vN1qi1fLwuiyezNlnaCXA3Ia6bpX16eGzHRkZu1a/fagPj/2v5YPUOnsF5CWYGvPVXq2s/ +yEd/Eh5P6+MlC8Muze5w9DGY8RcrKlO69UDbUbUDS3S3e9/hXm30PR58fIQVdZe6+0jX+yl6TwZD +6r5d0LhnCLDpDPyh1TRDTdHdADVF7xnUFH3noF7ce+xLNJx6bbSMuLHfyBA9dOg6BGHQ6X8MnGYe +GVZi3YUsRO0T5iK2C262PlCKGsxZa2ZMOn8N6hNMZHLsqIiij0532RHDjmMMdjr0mZMfVr0ao2Z4 +Ahq5ppFZnSDsM240+ssOo9Jn2G38Y9BrFvGmdKt1W+G/KPt9LiE77DUYtbWxlvZRx7Fi8NhlOBh3 +lhMZ9oL9Hn4ORv+lcraoXb/BqIO5YA4DdkfhmYJUx3Sx5X01WTkcTJYcG+ypMztrOgNadFAPsEe9 +M+nVhmYRadebrKI2Vl6i6DpYTuGzfnXVW7qsY7M17rT7TugeDkdhYkItoxbs9AlMbNxaxhtJt7/p +uhndQksGc2Qi0Enfs2iUDwuWjAm6dTCJcE4cROSIU3eDOGClsLVsmnWeSQNWdOqqC4OozNl1NeJI +ZG27GZBkxaewS1NJC1nCFqGTs7Y/nnTVXsNh035G7KbOOOtnPyB0wZPZtfLxL/RF2m+N5lyCS6dX ++muGgiHlyGoGEL/dFjGVdJM4PnPZYAJRUuvsRpuKyryyO504WW3icNZHoA6Oxi0cbWS/YOw5/u4M +gVv2v504HCoEcNzbluu7GNQxvcywOt0TA52yxbL72mS8zvlP1D4FtKIxexGz2IiPa6kHRX3rdFRr +ooAgbyk+FTtDZPaO4jc4uFP8ASk7f4AKumrfV3RrybZP2c4HoHRLo/WfVq3/G6P1T+ORwRGWuGFY +o9eqP9D9Be5On7gcUCpbuWwWqc/3ZEg3d69B/1Z2Cq6hmMm9pYmN1TG6Lq3IU+uueT0NEKHrE8BI +14aKA7TTWmKyaOOcItbg6FQ+p716v9bpLpGD2juYtwz/5pZKV61zDojqvlXHd5yhIQncmcHffSWR +J9/pNw0kTvuamdI5zkols3mZpMcn64O/dFtu+atp3arV4V2+0/NvlaY1fc+5iOOEmFtf1r17yzZ3 +VPtndWzOv7UaMuffXQWX+ObKqDS9tAIm8U16RF4O+oPG52jQa1mh09r5s+xdM1KFpRuCI9gjVaCa +2xK1y4+i8gJIHudDXhl1epfoUXDuCvydsich9tRSA37GDQEl50sNc51vEiUGQajMwnN2Jrh5efct +BzeM9sI1UdtzgHhA39+D0XdhpqKu9l7KyU1k++bNuqBWlrphtNdS6MAoLPcdzfW9cTBR5jqvAIMR +Q8voWQG4019iAWtds716q3meThdHxILUpOjSU16e1hGNg/7kBo1EZ3hmqh+FCFW0m4ohNkelHi0Z +C54rmtKVIdNmKbLNL17W/rNED6UaodO31Ulp3lf01JTJb079OmqdqtKp6JyrD6Hqt2WH0ILD6xVj +LM1R4Us2RoN6baLUjc3MDuihrmqmdppNDtkc3hrW+pp7XJOx5btTJGGFmCcLHjv1cWHQqC3OAA/J +wVGsCJWm9GcAXqOju/4NM2b7jYEerxX0B6TUQufSM00eHpHyHKRdOBANi+daheLik2L7Y7HxoWZO +LcDpu53GDKz4ojmgF77M12Lgjik1Griz2jMX2UljC5oYyXL6/FyKZGDcJlbteAPHYmgnMfY/bGXy +F42PnL/EJRM/qVefcHL9fhy955lmvBXz9smf8fPx4CP3Xpju5TyBJ8bUFji5qx8wXHcSSd5UcpVE +bPgii49i79HlPQy95wZkMJgvPk6Wp7e+ZL/eHqvvHP/0kvn77PZodFzrn3bvvuqp98tSMhnssy/x +E/ZOymw3p9lM+uz5hQwVOD4aeoUxv1MKnHxOeAKIy0sBygqAHNWTweHVRSIvj4+ls8P7cG7wKNy5 +vNnR8yOTecxVK7mj5FHDCp7jof9wCBOchdLcztF7JjxN3Cajz29VsTpki7nd0kNXna+R3M18DP1s +snIxmeptLq/Smn/wT2Cci2kmfP15OBoJmQ7DiVvDxN1eeUfpzjLFWs4/2a1lgy9XBykxyG2p47wP +EqNRfFwBeIPnDBv6iunIiqdu0i2XdyzlJnfc6+B7Vyy19gMRT9p/LRyWYpXA0Y34OXphxodhviBz +geNTz64w5saXAM2dFD4YS6eC9BP/gj/9fqa5W83MT/o8erl8LpFJgcbmp4V3o6+R2Plr2HLS152r +gu2kYid/6rWa1OUdjQ49vtGY9Y6s1jqWiuyzsMXF9q0mHe8FL0M2k0Y+fbW9apZM6vIurFXwPwcO +uXbJctKt3KuwfTvsFqwmZXKpfMJqUpcXphW3d/oj/5E1goXqK5P7uCpbT3rqOdxlL94qlpOennEV +Mime/UUEc4/HlXcyKbufrGfnd/V+9Dw9LuCk8cU99VX5py7rh0lDQX1SmEUhpQKTUtda3NszTRqJ +9N6GdpO+jV4++xWbSRM1MZrbYV1e07QqKZ2839hNerbD++LP1pMeel7G25+tG9OkwGGUaUtp//HP +Tq9gNWkg3o0d20wa+dw/eUxcW08qVKtMTmaugMas1rqVa0d3bnrctdWkTO7lJWczqbjt/e5fpk2T +wizatDXmNPh+Zz3pKZPca/miVUv0TraDJ+qk1ZDPhN6TK+Ho2aWcVTb7/J2bW+vjIVOIhlic9HBh +0rPWQLyphTiYlAmZV1p4eqyZJiWzqGuNfjdzr3aTZpjL/RfZetLzn1jia3R1YzlpOb7Hw6m0Xqu4 +nW+VecZm0qcQU37zb1lPmj9rXT09+n36pC6vYdq7vX7bdtLyZ+m9bjfpKXOXHx5aTw== + + + WuC9Lu9tLnF4ZLnWu+HFlu2kd2+nWxO7Sa+Z+5N8Rp8U1mKY9vI4+/ZaenmxnPTl+vvcdtKvaqSZ +s5n0Gbgl8zLuhqzXevU17F3LEm856dt5qG876chbDnj0SVGKGc/qLZPt9C4sJ5WuQluexEsoC5Py +YfOhmb5F39RJ67zfdGhcXv9jobZPpuX2jn1n82stMO/7sSROemyaFIb9+tGYvnhgnnQ82D1SJ52c +BGBf5tfqea49+ZVJU1X2fJ4VBkfj22MPTppY5EnnIW2lh6xpUsBY/GxLVKY9YfMhEysMDoUrRdLw +O7F0fn7SndGoVu/jpCnzSkfJ1kCj3hTQmFmUR75iqqQ5iZXCJgRvDVrvFUWmtmpv4jxIZ7e7r4OY +1VMikSNn1RLbu7N7+5M5e/dObZ8C683s2jyFHdgNpL0qt2RaX62o6bkosW8a3ONvyfy0/7n1YPs0 +WjyPPetPF3Zf4vZv3m3flj5rr3u2T5Pc7mPD6qmqwxQC/RPO9u1C/fojbvv0eqtRP7N5Kp3tnh3e +jjWMfez9yKa3bwMdTT39YLdi5qf1i3Lf9uldJvA90p8uYOzeWz/w2L59/5yJHdk+ffe+RnesnqoY ++5oUh2e2b3/fcamS7dPed+741e4poKoUj8wwtvj8ghOOH2yfNvr1csHu6a5n9/x53x5ju9nkZb1l ++/YFd7LF2j1Nergdf8wWY5EzJnu0r6065oubznSgUhqfqE/T4UPT08r76X7S+FQI3iBDKSnGXDq0 +nwbdcjJ8fUm3Pyvo1EseHctnO0hZ9z7VWj5pxGzMvvFD4u7jtpysVLz3hEUlK5dNIVsbPXkDqcH4 +Sm8Du7I2etwjfC7GSp4rwsw8+/k46wlmbu49wbvXsif41qx4fE/+Kf5WBBL8TntC+bfIolFYbSdL +fFkCqNMBsE4H3+JOVP5AS3yf82h25YuUe5s81xLxIbuVuQhsR7Sl7faSg8wrkOm2vMXtHRWPM639 +rJecOzRnnjQsWvdzKT3R2pKX9yT9jmPpp6pjPzDD6js333o/l9e257730DNwHFHcpl0L2GLRG/8L +xYg7fT7+RtHPe925rFGsRdxGod6gGHHvvB5ua/22e7n0x4V0cHnRisKf+9vJ6GOXV2xkPwjHj0OF +Tpgx101Wkv0ccxER9hWyQfcHWMsRThe84lZVuMw+Nn4+DjpHdb/4KBbOVLs5ujuaCeB0cvBz60cO +s7glft/JU3c5eGhLv9AAt5WrhY1eBVvwmFz+sGgCz3I3hKvMuxVwhFvq4FXfqMA73RFpgDstbT8a +dH478KSzOWKxxV31ZjlwQGPK1l7l72jAy2ZvczPcZZLl4PcODFCqHnS2Y8G5CQKHZhqLGUBh9yKv +mY9KhkeQBVzaob5SNnjLhvRJR1M+zVBMCjr//LREO15z0kBsMMnipEOCFoabJj7Tn8Kbui+gah4P +M9lGsSJqbsX2NNuoth6UNo2P5zPnzSPQlHLTbjReui6ib5GbPb3B38AI/5bPAergdy59EiuTbTdY +FuPA8XF2D6At7yOMYbLq46GvOVZdNfMORmWlbW83ebt9hFoBs5Usdz2jXFa6OVAHvWr8BI6LuwOY +BYWZOPGxp+qLO82MojYDZKmDz1bGq/wAOriHwYqiam3BfLMtIcvIoJMhN7+MjMGrQJbhNfzAmWPv +P8WYQbTOgfezEnDkVC4Fr86fWYFnAdy+LXC4FhW8MQ14hEIJVaojXkh2y53q42m7b7tg+HGjLFfx +3VgsF4yrwvLlulbZjb2tNUlF5ckLu3Fa7CERt/EgbStcR7wgauyddCyf3hbBctr1kh/c3glzjoCc +z4YqaZyvKELnpwzsCxhId5T7S0F8A3Y/9ZVjWDnyleATj6jB7fpmvosK04Rd9Xq1H8K+eiCJy2Au +AhF7H43rsE3xEC0CXXSn7fT55zcI1LVxFYWoJz/++oDoCORSj/IF+i3nULgSAi042o0VR5udympw +aMYyM3xNr8fRsgjNqY4RVSJb4+Q0v4sz31jufvb5emLaq8jwQC6a9oqwd5fXlsHPjXjnoRhR/VF7 +yCCCzmx3/zXL78Tzhbm92t6z3KtWMbyr7osFxk5ipcvNYCwToNzJXZfKD615w2sWHQX3Jvm6Okgu +LwIVpgXKASSwWatWIFnISic8MU4gDQJHugpBWIFyXi6WgJcOPy3F2K6uihhPL3FeamC6vBbnt7xE +I6lzCyLf+fSSfbE8vzkrxcpi43Xd6omMqAbW5sZzeZURT3zZPBUpGYTMpWzNI2G5CmOenTqiw5jO +nU+yVv3mUG2giNrWJbcci3he5mhCXzq8PTmdLX2ojy1VdvcuTyvPX02GTT23M+Gb26Ae7iczw1C3 +I50nqbLSSiYtV2PnRnwYL5dxLu8cITrrWd/SZHW9zeVdOuJ0M5rgTIp9yx6qEY/q+/o5sKJa7HyK +3v0LM082SXYa82JuXz63N70v8s6m90Wmsm5W2RdppMhSJ5UGjVCCVFXtOrXhtM1TXWt1eZeqXTRM +St3u07uB7eYAT17nGN4tCJmlqHR5nY/hiK3t7J39BpUmHQaQSafBroLK+hilmKOWvbJhfmsSgzN7 +n2BnckxlXNKpsWe6GutAY7pqb6lscKmHT7PSaYUMl8HosN79yQmVNbn0aJowdkLFPuiM5zPdeP4t +xqpbu5vB2PGYjvXMrKlFDV3RYYAcTsv9lSxHW5BWtpGtzQYEqTpcCSQlwmsNFBVfoQDpbUR19uct +bDulun1moVQv8Y/NLOxyfD70dKMNe+hLRl89Ye5lXE+lP6Nnw0w+/5PSgjVk0q9zprlXyxJkuLz0 +RjjJFrIg55dx34EBuLwWODmzwcnX+Yp7pQHnMqd5auBNHNSSleSey8u9TLzUJGBlZpuWu2hk0/iU +bHdjEtijBc5FsxuYg3C7qgfIaN3M8eQTX2ZixSDWJ75PbhZ7XUUu2nD58+UuNKOmREvOq7vQiAZr +YyAiAokT7TcIJAxu5k9WtY97eyP8hL1YMGcoXWiWnt4LkxNtTe8LvxPz7ZC9Aj7m7ESjON0wYtgs +m/XxFnbf8XT3LlZ3odlgbN6JtjbG5B9m8bys46/qXVC40Fy0QPG/caGpUR4FKDsn2sp4iphAAilG +QfNzvpI5igezgcI561qmOqgpJ9eGIOJJrDixCyLmkc6zlB5FZ/89UOD2SttkoOR52hnmTT4um2NB +ZTKTUwkjvkxTeZqDhj+WSxX+5DbmM+0V6JbWrnT/LuECdhjzbwpjFnJ4HcI+ufXyixHedRgAgPSx +9/NgC9JcJNERKPNpowXJZO8jUAvi1tYba61Pz+2fxypiZUtZ1j5vC1MfyWc7btLQdT72ULY9uusE +3k6LPTb7Mj416fxrBHPSALdg1o+s+RitzEXCPqDWLubtdEtZiTAe0YTWHE4voo0/uatc0u2+E9r8 +PmcPPM25I7Sx4M2jXd+8hwRWuPwQ0x5h3ES/brj9msb8C4FxC4pw0UpfMiJtlM48noHGLGIfrz9L +Ylen5T6toHN5KUQd7n7lN+GmmY08B+MqLNPrwDJxPDgvjrFCpxEtnBqob/p1Xcflndd20sARYpTH +giJ95OGWGCmEJ//2bIy/HRjcjJJpIyPAAFZXeHAtNioPwugQIaTkTrd4XjZhqyBIgUX/prpIrLBb +gaVgrk1w9fXNPIomwlj0TK4lX+4GxFzZEI0FFnmN0S9AMiHnA8eOfBPR5hjlmQsbu+hNF8SibeAY +xZL9hilnf6WIRxoenI9W2jU7fzLAvWn75eFuo1kEAKHJ8WCVRUB3crLPz2YHqi3aXN5l5A7bvREj +BuULUMeiH3HN9Vkn8Gj1lSvwvjsr7+HaNLZW7p21WCYV3DiiTbThN7EGZGEBIpZdXqtMZmAuBUqc +0IhlktO7Ce8hws3ScRh6sfz8s5JYdjl4IhBG4ddiWeEw9xsSywBSyEos28Qslh++2tblatlzth4S +WN+mxPLzD3KYTfgRCbJsxbKuw6wqlq3yuezEMkpkLcePTiy/jZaI5ZiPnlvSiGUA7snJWG9Nbg8s +rSS7wOrDg0Vm/9JsRf1sl+O2PPlttHG5/7BZuf82WkHu2/mr5rdb3KgljnlDNLa9YTw7Xx9usrMj +ZEY7NA4/Jb7vfPZpMl2tvH5c6qGaJF4/l3cxMv9Q3azXD/OUdL+fDcGumEqKKoSZ9VhERqhSSY1k +kXr43lq+k2pkhNqtCIDSOpUNbkXAmE1oGGGcmAP/zoqMJYtSzn6VXiLTkG59bFKvl2baL0tRQtwd +OKrXKuXMPL3OZz/18OboZFhMTCdYnJf7qtjSdYpUrPMafEiWgw+D5E2/nk+FpMH1Ap5md2iZb8vi +xm1PqF96c3mxejrrCSX5V0/oQs6qhdMXctUT/Pyq4I8wtuWw1DpN6q3xBonDZPm795Ft3J80cC1Z +rMisZmrl40LOPzpD9+rOXi7zHdrCKmpB1ZSUAuviWaWYDYz5XV3Sikdf9fNsPZRYLLa9OrnR92pJ +v+IBM1f3at+zFCtS9BtN38Mhq34u72LPGEsz81bu1XLExX7NA7q1bOW+KGce8lRrwQuyIlQjnoZk +Qz+7StnROBYYG+4hsS/kFR4+C7P7CewKeQ+3fLaFvBizMGwJG6YAL3AY7904Aidub/+I02c98m5f +Z/xEV6PdcyggV28GY3KDSoUCvN1C67PpXATdMgEH1qtlfftV6YECd0z26umUYmNd3rnCf3vwSmsX +Ru8fHRhojLoeG6ux4ytN6vIa1o/3Da0zqeAvKpOqroXCQyKW89ZUGJRYktgflhOHnckDjn2bDew3 +w8lr9uQe2qZbJhVrSTgmNx052vu6OWCvwVsZTcXdnl0aRkbX6hwyh/cpyygX6hnnbT9DJNEYMLWv +Gl1wp9AAZ2clFXcXsOxcqGILHHKYhYKt3yTwZywMroy5sn4Fk6u4R12XQ1fDu6gTrkYq8xHe4u6A +LkccmB5dyXJghXxLGuKjrUyZVwjtq74tAtoOCCT5lsuqvqkSkp0QiLOoKFyIBv7igJgSy5ZU2C1B +oBVHqwb7dhwtq9wISmGp0nG0atCSMa/ugX/Nru6gUSq57OLtMOJGEsu03c8+Vx3sXCofZTVkmYq3 +DsZWj8lYZ9pjIIXWs+NYCQ1HeANRUQSJMvJOA5RTloS9V8geY/YRiOX2sNXpVXZfO791bmB3fnO/ +Ob0WOSR1jio9nDqMUue3qHMUKUq3csSvZ3Xq1PtgLTyFzj7mWo62It5lsXTHCh7QtxM2FTzNU72C +Z3nNCH3NqWNRhjqUGk2gKpSkUist9TbLvL5Tytt6qEs5qXXL+XNgX1tsWcA4x5NpzIu5fVmUPr/e +F+dLgFbdFzqVdaV9obsJaJVqZXPYCj0kv7mcCauVnSuZXKsdQ0rl1YzK2W3zVoeG7k4gClSqOgwi +0zH6uCoq9Zqm5TWJKxvmk+MfKzGo172aBeH6hvnk2CwG7Whsptpb00H7bCWTY3anyg== + + + wu6fUTK4oKJdvHOv77ZHU8OYhfm8tvE8OTGL+bUxRjK1N4IxOtaj62N2xDDGU7kop5dYjvYgrWwj +2wK1GBCkAsngUZwBRcVXKEDSbbblZ3/ewrYJUGKQaSFlxto/ZrKwna65GX7YX3PzMm6bkxhcXmcj +fEkRNOU2uSjLZH/MVudKwJki71/ny1NNV1U/YTxUc2jvhXOq3+JeJj77GxbsfUpLarRXYS5OudZY +tLyOB8jCulF48vlyBrH6ck1aiOXtQBZycUnJMoU8cy0e8SUIdDjitgi01GDPraozV0TgnO7h8qrV +mezF2M4Iv/i1C22+sp7NL5gf69X1Utw/ttLphhGdXWgu+urMnRhrvuJgreonwJhDSRZ9JTR93oVT +2TF1FcbyGw6xEnoThV0uLwL1+xxUFSQbF9oKt50Y9+9iungVwpJct1m2rVOe1oN9EBFLQilreaj8 +9/k1k5mNGRFaES1Lk51EfRXCyW10b+Gum5XuEzVV5tpehbBaLU9+zTxmK4x5Hd2vlJXQs6sQDBHe +Ncuzac6ai648+5cpzKq9j0DRJIFSpoDmrSNWK2bSWSYuF3u2GjreBV17o6rGpzu4WFMaNitda90S +gHCvFLYy1FjZlomWf51XvFApvJHbgBFtiSnt7juhjTZ25aIqX/5tPZGijZNiY+p7ih0rvReM7LVp +bKWbEVzOhb44In2Zr6U0V2ZZLPT9avlsv4zANHePaOr4dEE3k/u2NxB8tRwvTHYMNyla3wxGjr7e +XB/Rtn4dxjugvrfHdkSr+vWRla4zu90US1QXfFhWx4IqfQTFpCFErHGY9eqMaS9ypo6MYLVrYbqm +wmNTKbwYa1mzuJffzK1NpHh5wb9pnWlPU77sfAWU7fpUzq+XLzuWKlBXeoc3R2M2gWNT2NgQ5XHO +08eqb6c6TMtUApRijiUmoK8cH9sEjkmBqpPPwbVCxOO0Olxz18z+5PRK30Ogqv/Y++E2mUWQts3d +mcsioDo51eGiR3Gte+HSK30UwbF4+W5Aa/E5rW9Td0Mpld4L3sO1acz5ywj0lgwZj13re0mOYnkS +WHYXNGiFmxTLYCjSaxfLqeieQizPqjgpxXJt640yZ84olpdVCm9GLAPaIpu5S40ULy8Ry6abJ53K +l9cUywseElK+vCGxXNu63NDNkwRZTmIZ7f3VKj8BbSuLZWqPYnFZPhcpZF0ill1GK4pKLL+NVq/7 +tF7LfC3watmKVnWfCzwZetZpvlpEL/djPmGjch8g/N6hlfsUt35jzfcKdZ8UlvjbiD6J16buU/X1 +kfp+2spP6rrPvaM71vnsr5DpOuf1q49NXr85ywJLWTfo9eNSD82p453DK6aSYuG3zXUFhsiI/YUF +NmRRH9O6Falvn6tu+va5+pjarUhzXUE6HF3h7NOVLK9834X9Jq96XQHF2Qfq/+11BarcV8SWzhuO +xRKfvBkkaqluNN87DDCZV4tjMftQ9eInqX03O1GsmC5jxXTB5fWEpNCb5Yeq9ytJcc0PVZs+U+3y +/pEPVZs+U004/+Y/VG3q5/L+kQ9Vmz5TvXwta3+o2nYtG/1Qtekz1XgTxR/4ULXVl743/6FqE3Au +7x/5UHVg/jPVsJY/8aFqE3DEB7v5D1WbPlOt1b5t+EPVps9UY5baH/hQtWlS/Dr2H/hQNcJg+Ez1 +zKuw2Q9Vz0sfowd+kx+qXjVz2KGM0uZD1RaRRINm88sPVdsBZ7aSaD9UTVtAPqar4V3vQ9Wm8Rbv +6nQ0uWg+VL1SDS/dh6qdSUVZC/WHqqlLluc/U22fb0lLfJYfqnbOt/zth6otEGj7pe8Vk8eXIxDv +7KK6LJP2gAysvrFjVWFHjcAF14nTLQEOZu+y8uwNR3lsyrMp/HYLX5Te4P15enE27dcZnDJLlxdn +r+KDtSnPXgdjm7ky11Sc/ZuoqFqevYGsG4rybAqQyL78rjybojjbDmNrOq1sirO1L0pv8nKFxeJs +my8ZrVKeTZ2j+KvybAqPmm2Uh748m6I4Wz+Va5dnU3A527XQl2dTf7X8V+XZFptoLs6212FWGNGx +dtFKiq1Ynm2gWrvi7CX7QluevcK+/KI82xKL87GGjeyLo/a74l2dVuXZv/8CO015NoWyoX+Vae3y +bIribGM04beV7vbF2evdaj5Xnk2BSrv85BXKsymKs1eOii6WZ1OUGlvl9a1Ynk1RnO1wLxxNeTZF +cfZ81s1a5dlrY2zFCkrH4myn80JRdkwhpV2UQK1YfWkCaZZtu3559iJIFnnjvy7Ppqys/2V5tnNx +tjHXGtfaMicOUq/U6uad2bezre7oNn49m75Wfdm3s6m+J05dNm7HmEw1VrTgrfjtbKdM+818O1uX +yNZfz157N+a+nU19k96vvp1tpcEuq6OmUmkWlmv7bfRPuotcHAvRSRU1sffX8Out9u1sy7s6qRFI +p8jQ36vwuVAZR319CahDBj9//s9VjNvc1LrhinEKL9wGKsYXa0X/RMW4PcY2WTG+gRsOKSrGaW84 +/F3FuDHn6s9VjNN80eD3FeMuh4SjzVSML2YQ/YmK8VmFnWWx8aYqxvVK4SjlQVunYnzdb9itVjG+ +HGObqhjH/OT1a6doK8bNsdc/UzFuWVm/8Ypx+rsIflMxPl+V9qcqxpfljm6uYnyluwfXrhi3/VrW +RivGN1OX5FQxvkJd0i8qxhdy4P9IxfgGaIyiYtxFL31/UTE+R2N/rGJ8lW/Wr18xbvPN+g1XjJMb +QTna6Oq6FeMu7+I3zzdfMb6hGiuHinEDJdOXpq1cMa74+uxUnk1VjCvaBb8ptNmUpq1e97pOxbi1 +72LTFeObo7HFWPbi3YMrlqatWDHuWsl0Wbdi3Hxn15+pGLe/qXWTFeOz6qc96vvX1qgY/81dN/QV +4y6KD17/XtnQvlpOUdLyi4pxu+/ybLZifDmNLVaMr1rfPXc7kOVHHzZXMY7f4LbKl95sxbjyjdTf +524trxg3c5g/UzHucvZEbKBifMZh2C3ar5KuUTG+5t1QK1aML/GQbLBiHLTxWc34H6kYJ2LZ/gsg +m6wY178AssK3gleuGKeIjGygYtzCSvoDFeNk923LiTdVMW6oeqZ1WK9RMb7eDYerVoyvZImvXTFu +cUfEH6gYJxVDd5v8NtKc10+tGHd5rT9xv9mKcVjLrGb8z1WMW0ZGNl4xrkdGqN2Ka1SMk7w+20/c +b6pifHb20+Hon6sYd8i031DF+Er3j61dMW5z/9jyivFFPC2pGMfacPwG95+qDtdrw+Hs/7HqcL0f +YuxPVYfr/VzeP1cdvnwtm6oO1/u5vH+uOlwvtl380vfmqsP12nC9amDz1eE6cHNfYd5wdThdZf1v +q8NNlfV/qDrcsbJ+I9Xhepk26Px/rDpcrw3X5MufqA5XRUK3PQWM/bHqcF0xVK2kP1IdbpcDv9nq +cJMO84eqw80+pT9THb65L+Utqw5fo15sjerwpV8v3Vh1uF4bvkZOL3V1uL5cy69mbKg63CKj+w9U +h1tmdG+8OlwPYzvUWfyqOtzKStpYdbiGO6s6iz9QHa4jw+VIT+tXhy/U8P6R6nC6/LHfVocbswj+ +XHX4YtXzn6gOX5ajuLnqcKcI72aqw/XacIds219Vh9thbLPV4XptOE3m8LrV4TbZgxuuDtdlvVrN +8Ueqw3VEm+5V2Gh1uJ6M5PL+uepw27VstDpcrw0309gmq8PtdZhNVodbSbHNV4cv2ZcNVofrteGb +3Re7T3f/Yl9W+HT3Eovv19Xh+mZb6Pwbqw7XNxtj4n+qOtypinMz1eFzttgfqw6nuleB+SgIz0tR +afAbqAs3xpENCRIur5Yi0WvZf8A39fC6+gdAz23PfvtsU4W8lLdq6NLeUsOD9X1TfQH4nXtFz1Wn ++MA6kFLq4cd8K/ZKpZwLGFuxlNMOY7T3XThjbPHm3xXu7Jpbmq0JvxJIJJL4RpWO5Py9dFtmZZ/X +Z4unFYtI56xXE1Br3OJmF+giX2Cnrfek0PlxpQu5O7jSOZ3fwlK31/RPfJmRnaZ/brLTf/0V5uxC +GZoN56er9l3L6Wh7EziAt2AU/8bpCON5V/gyi6PT8dzW6bg8D9Z+N/ZWOjQOVtL5eldSLqust0gJ ++90nwGcC0eXdxM0Jnwvp7fMItPkO7xIELknctkWgrQ6DxetOyWHUCMRZsHjdyZ5QcWchIS0yRsft +JbVv/I48pKlsoPPB9i6sdn+NrMCLjX/172KzXzQALrFwsNcrfdbzvX+LMccP/tH5LbF6ekPfSL0g +Gd+/zxsnIFmkelvd1EqBJ0c/03zKnlLLY5eihcXrv/w86sw7Olfsxp9UJhkb79Iwv2aWt7UPlj+5 +DZhvgFlnm2IlLSrqlFNHK95jJftjtsaN0/nVE7xtMXbk3wjGPFq92C8TqfMUSWR0X/xEoH6T222I +8eWtfBtr4skUNVoe5XFS8rF0nSYd0LV6gcZwScIClsZaHNy1b5zGuBB1kY/L61RTTCdzl0vcue8j +n73HzO6W9S+KwNJ17fQaIrxrfWm39kZzwYOLshSbSvDakrj+FWasW9/EbRFK1fr8EV73Vg1StR7c +HI2tKn2tZK9uv5AR69Q0tkLyeLmPPNnGj4iOHqoybmdBp+9+uW97HdLqYWyEcF9nmY66pWFEuzIP +MuLSa3VcXooRLWtT95ORI7simFtLD8n6sVAQkxTizUVzNgDuHA3x2TruF+ssgAHQ3j1DVZu6nywu +3j24VvnY3WB5berc7juWYu+vaT6Z/MmEOjZTm4rl15qz9LfyBavWnWtTaWksvpAgYXYiLctAsPlm +vQXfNDtCKArlZoFxwpO1ezoAj/u2yaJs9jlNYxRa+Rws13K30lVZSyuKKb9dSx01A/N3o3fcIYyr +3fdg/33ku5Xuy1peiK1V1/76kga7FCVLi8/5S+freB+svl+JdetrXZplhSyrexStXKSUH8PEEe3C +H1Y0tsKVEbWt0xM7sXyvi2UHbkkplp9/lovlFeRLbeuBxqtpJZZt7iGB3ac9dzRimdS91jfgc0G0 +2Yrlxd13/Hg3taavHz1Lnny/MbGM5dcgljdwi6ZStb5ULK9EY5eOFzzYiOVl36zfnFhe8Chi2DVo +K5YBxlsa08wklu3X8uAslqkrV3Ur6W3kqFgtfPPcuX6d27TcfxttWO7HfLQXSnjnIolLyuv7v7xq +cd4Sf1jBEaKOaIs7kxuEourZWUxi/brz2aepYLfw+r15lnn96oaPECy3xOm8fh/psIONiH4YmysX +lpU0fzpduDCfgeuiuNOg+mu34sI9ilY5Sb9wK1Yt8y3Xvn2YlK7TS2S6z50fUKvXWi2PjdiyTC1a +48KF+bNfpfHzr2JN6kIL8y0LQthebL2M2w7Xg6nLWPZdiHnr9TZ2YDsfRcTcdr7ZjTqqxxHxWKhk +6weNXrLfCA2Ske700iQDyFSpbktkEoff18+5/d1rjbk0kruZj6GfTebvHwuzfQYrSQ== + + + r7xXT5G5+/uV3l3vrNRqqTgpXKe6kodNX92XWrnD7HMY1nfvy/lLXDLxk3r1YWWKYg7MWk8aORyx +mIhXSlOsjz6TQp7dafY+de+ZP1zFTCNWa2Yb79niaMSNk5799qh0EPLGdvn7y0gyIgbGn+cHg2nN +5d07a0ny/snTzuOW53zi9yRzNwdb1VcxtlO+3854v/vlwl7rcxgSy4Wft+h3s9BOfL9ffeZbZVm+ +ej77uSuzw/xH+bPU6d6eHlxO795O/b63t3TA/1WNfF33ioH4h8s7DDwmJiNv2bc3GvE7nq1Ba3Dg +ZXY+4/7HQuMuIAcufcc/O71CjHu/OUoyh4dbo9FJrOjZfzm99HCp624g3hASTI45OWZylfscc7o9 +uGJOr68+R6POSWg0/TwGbjneC17Vw3xBjiXL2+09UkIO63vOhqKF3S8pepLOp7rRUoAUb8NKKxWA +odUMWFy4YJHnoOyky2t55YK/05U9ga5Qwul5nXRjXG2vlDgMnQlKQfte6ufGGsddVih/3u78jBJ9 +8crl9dxf5QMOKJq+h3f2d70PxR0p3k15i+XTi7338vmRIO9eirCqlCdZOaifYIF8JXB0ELpH4KKJ ++MtrN3Ph852Qr2NXS0z2Lvo2Grcvthmu9LydjL4kWpnz3slDIjZ8OTR58oFHXv5kg9I4LBcvSp3Z +6TXQOciFYlo/FC6vdixeLnXxznDdyWH6U7yuwl6NX5OwF/dz4zx5rcY2433/JTf1BD+/HvC+i7vX +rCd4ef/g8YVqW3jLxQX+iHtCSb7oCR3svuI2HXtC/dKzJ9AIy4iOSPKm8ryXrTPxKBk7es8zTXLz +Bfkt3notfgL3vffBqrYP8Tbgs4+XTGs0CiZ7g8IYVnX/g23NXDrl2Up8bSe76U7tgGWY8ftupn79 +dpWUgsNBIHv3cAadH7ZgvsA7ov+ceztrBhn2ddub6l2/SLl0clpLDMdsXfvi57HYCGYbje39RPzi +G459Pj8hRhPDTSfbidF2c5QKSd0rht3zt5Plxt40WdqX7pKDQbiAiuqOWM3384nYdfor+x5qTxKH +J4I3kyrcNXAtUZc39/52PUxWMo8ckHvwKPPBVPFaD5kla8U/3xOHomeEx8I/a+sd+hOFcqrb3wvh +YLe4k5HU90/Mmyold8SUMAk85XyDdzbzEXq6Jpz/XQCiak5wnGrm4+U+muomujyOSOJBnvTnU2Ma +uwzwT0gHeQI8kFfoIpe9vJNynuBNLvfmf8qLk+FrEfbqJAiAeHynk7dhHVb1ICBPvpgGEvGCB+/V +3d/O5PNnUXh7Ozw3jm9P25zMCBc+zqVboaeUEOn7CQloe/rgTX+Gzptn22FvVN9nPPvv51sAfI8N +ZILeac53dn4eu0pNnzLn54ldvS3e5qrfqbPb/o8yHzethmCRzS29i/gofj0lbz7ao8zHwc5btrH9 +fUKmgrUAAP5c9uc5ltv3BwPiduyhnG0ED0Nzi7ziYNJUn7iOdBhT35c3B0AHzyO8iyBNeFvmI3Uv +5TKRRw4IqVrIZTk/6DAGdHDbb98JPnXwpfzJtqMDgDa9bVhQ/vF0YAD+KPdzRnYNtuSplBhNc3tA +DNU7hvdsSZnw9WeGbCLoYx+9+E6y5Km2YRnRi8zF+3gX5N3RC8MFW92UmLj/IfKVYQfVLrCmh0ny +mg2V1c1pDktkf9UuqXorcfdxew8Mda+QKlVPGYIMQmMfsIM3vXLu+azQSl6nU9VM/txzt/CgzVyQ +033kCwXfxWrhNpF7be1UM+fdwFXmYzA6VhgXHy/vptqPpbv4x7SYRsJ9hrOPh1PRrggLm3U68k25 +99PDoa+We/fHMhhuu1ZhfNr/zgY6jxNxO339tgCS2JzAvpzswMjnfTwvd2Qtzy9HL/nsQaYd8tWT +khgN5zLVShDQFn1iuEk8KRe97Yf4RapxnzsZnxZz73fVJChTFQGPVCpZDu1cpi+P+mmVWzQK41Sp +dH2bavSnr+q+SP32M5+tlx5QF8yHxRPx4TSdvREmKgnkq9108z54n/kojd+QCd/msuxoJxOs/eAK +HkOZg9rhbqzd37sFuCK+TGt8Iqi48wgyUYJAt+S5wiT3FryLoRpbMpoNVr4prnAPxBmXcP+KtDOD +fLGYe+WZc+nPaF710CJHAz6dq6AElMXbI7wVMHm7G38nnfAukXt85yLV9VYq6XZ77AG4LyUET8o2 +Iu/+6F23cKqfl+hd6akCP3q13OHp0ylhZqQtdtWOd2KdV+kDHrCwFvVAAgCZVmfwdOo9ff7K1ivZ +iD4YcLTUrfhQG96R7UbiLGdaD35+9ud76ps78mhC5GwPr35pprrhmwBYQS9+QmPZXaB5IZvztU5e +koPP633VAtMfNL+esrVaRD6Wz7mBgtnLs7vvxOi0B/qD/7WUCd80OPJ0XudPI59+gbW0PytvoFsn +jyx02ZjBLQ5MagtY6+1OIj7oVVPXk9o43op5+4oFdj4efOTeC9M9PUtAb5vd1nj80yNX1YDiGN2L +7Q44ARTjn7vEwWQ/E5AjwiH8dniROBgPT+DB5UVmWitew4Ojk5y8c9NMv1xsnxEFK3oX2rrMvV/u +RlWn4zAJVtL8Mb0GkLlptvF4RITjDUixwxGezw7uwTnoAjxPfBd44ivkyEXjjYeQqV82sC9+iEdf +9fNsPZQ4V7I7duIfZweV5DUzvERCO1dE+bTH12HPfyrkphhyKxdwgYc0UWjhnAs+YKg/DaJsHIbe +cwP99i5JHhx8JMuT4TSZf/RLsBYkP0PrTf/7OVvf3X87O3rm7xV1+PrH30hdT/d8yMzOMh+vW99n +2zenYeDyz/d4MdBPznfx5QO0DBh1qGmJUCAcXCZ44PKysOXHMJjMAQNsbwMf37uA/f3ZBUWm6kve +dIf72cb3jwwaUDKEU3WIiILDEHwE9p/YIlRCrhc68t8HOgQtZLnECsTPI4XVbFv29DWMBS/ZrVw2 +44+aepqdFWyl4wOQmE9QjbY+U6FYZkdhlLMfYBS2PDDAzVaydNX6grMvtKeNeRLA+wKkQeZi/2kH +hmgNDVpfIwVSG9EvC29PN4fBx8xzLhMUAwb5eXJzeJ/z7b50svVyfpoNFMJKpXDKm8mn3vncc3On +TXYf21hgAPEJKMHXHrmbazzHW7f+TqrxszVSucXO1jjnL3ZigePo3Vn6/Tu1n2m9Tx9zb5PPbiKW +89ZmD7ZcXmApL8cKD3kU28+gj+UN2gxYP2I0l+kGFUGIBzslTvKTo9xb98CTiGXjxaQcz4e03Q0O +QPdoT3PJXiyo3X7Uvp73Wq9iNhivwQvtJMb+h61M/uLxPc3e9sY5z345pD/AL0tefLRhzyPRlBhk +H3DEi9Q3W2tkcs+X7Wzg8/URT+A78TilO1/iAehM99PoiD/rpAqPgwc4i7FnEOSfO8Ajr4RE7Opb +Tl0Xhx1QaWK78tfI8+TyqqSksLAPJtXtDUPK0dUV7MdGixmNjg6wyzZoLh95llC8PphisOxGBvr1 +WFWQcjdbOX+1OAEau06HjomCiRufRMM9hBYKo8O9ON8ooHuzjnzdeAfw2fYkfpLbicRhsNkkl34R +X8H2jzi9dHkNyuTifEXDDVx2OFHuvkrvnGRtVwq7r6z1kbuwWqvFzNuOKx3sm1ZK/DBWawXb3pva +ySxdaYl2pWBX8udPPaPF0GyXTLhlcw+n7MztlIpx9YMO2mw1NCC+iDwj/EB7UM+bpB2efXgeb3u8 +X9lG9Z1LdS8OemAWHkfQ45jCjwsUcu+xgZDzyaI/GwoMhrqNddAJxvAsPsqJ+5J3y/Ld1w+s5AJG +ko/GOunMJ+G1KPJ9yDyD8Y/g6DHdvLu/VC3e42wQDTcZTIlTwGKd2cl8fJT4mR3rz4TD58E4c/Lh +gS4Hr7psdnnl67v2de71eaAIodgV030Tpzf8Pdj7500Ypxgh3hC8bxF08OHTa/K6cPaIqn0p984l +IwqNHcZ7Nwx3dj3NnE6irVQkE7rTnwLG4o3rS5BExQFIIrkGnLgxVuAhasD0nTXc9mcECeSnPUhP +I5CzM5BA5zcDlRmXbYEKxLu3V6uDhLtf3O3ZAKXcI3lli6f52wqvwIZ6207ExqEBbvxZNnA1qIBh +cwUWX7LYK7dz6cZNGv0+j3jkuHTnKBWwnPSmx71qzuLMOHMR2N9OCfdcCk1PJlke98tAVAfTufUl +eCLF/FOQKhcPZNq5Sf3PhnNnNAA7JQWpuWSmYYlyBanntQcyKdiVxmljrPVOT45/aHd6YVKuXTJE +RgxoxS8bF3S0Lq7PFqkwaeJ+v0ZAgmMWfCVP0T+mPce7Sp8VoEr78Wcr8rICCXSh70s7kF4JSGhZ +2AGFmDABpT/FOzhfaEGC86IDdVKZXC0Hak2QXN6VgNJBwrinn5YdWZz9ZQxpTXZEfH3V4UrUbzpy +6oGc5J4tJ8XjiDT2ctFWVNq5jajaHMiX2rJzDgfO4pRjnpI6LF7IKh/j7jcsJn3Qd9+O5LoWrOcE +bwS6ACm2ucNne/RA66Mlqo90OLQmm4Hd/xMCBUjqc6qTlI0UW0JUR5z1sMVne0rV1rJkWDs+XXz7 +oT0AQGP00LbGtsMyuZR4bQuryzveyrUZm2EHnvWPK8A6O654e7bNgV31uL63bY8rruX0LLVMLFf7 +NsM23myHBQR9GbgAcpiFYV/smMuLDdWW+9YnrCAc6XFkI0fgT24LBQt0vNpsXXVgqSkFC4G4znDI +rebKBAkuVWXPLSZozaLHX9n6wQfGNkqvROlW3kD/fOr7MjQBdf/5PtvYFncUV/j1q3hMwhHogVfM +WX6XuInU3y4+vtEPc8MGvqN7DJtP9k4fTo7qSeb4oqc5Z6Gtuu9ppD+fUt6Z77+L8ZwfLb7kF4l3 +BTO7NL8QrL8bRhfNceajUsJgzuN++uPos4iGu+KwP6yL8X7q23fzEW/tiUXcqyd84wIMlrO+4myC +P6VZXOgZzDrf9uyrGaL/Z2YbfQEXzDJKqIfkTighsVz1VQkVsPnvSS7BXNwCHsKP6p97mXsllKV4 +/LEtefotkKgRWuJq3OgcgxhcsnJ3GwC6ewkYbRowOQ5Pu8fVbH1wFkoWm/GmIVjF+/vbYMfd7mTO +u7e3JscnCQShlcTEo5pDNzhGk8urhE8OQ/et1Hfha6T4B+eCObXk7e7hMWz33fViQOm+q9u2JCKF +33ycj0lxZ+mhQiL5armv7fTkSwmu5E9+BD3yg9vZSXde3zit7TEOW7LvnwWw9mHNzD5Sss/vM8TF +Lr62f8haovf8Yc04PYnHPo2F1PfeaU4z631eY6ArffyilmvNXmPzVZT775feLkasRMXi67xe9IHG +RiLG6bbk72QW0ObnZzHTBw8cvvxohp2JEj0ddRp+DdZ7KfHA+MPan7tg7+d8ecaLzulLOHK1XYUY +mrvBfG6fO+a0bXyU0Oru5N738i9wAo+2SWQE3ZgZA0sBGkqA/f3QS1Yus3l9c1xezQ== + + + /+uVsVMcWj1fydIVaJkY6tHRMYsgyXgOCkrwCO24+QfFRLx3nDYEfV74bBdsZOKA04JCxEFV1UJG +4ihRTudvQA/xn5MoHjpBJQw4PGldUl9JqfH4kDl4KEWVcNosGAXblPlIxJ+TF4Qnm4GKYrToKNmv +196V84K35xzujVvtrG/rrp3JeT8u5gNKF+J9zz9IDobDekqYpkqmiJTCYT5zJ+Pnu8Dx9uE2vnMG +mA/siNssc39wWf5GHfVkB/Sj/SfVEfJ+fgyc6mRsiFx2vZWSIZQzH4QBi6/16v8A7SqHmTPbEvqg +B7MY0d3Z9s1RHInhEihmb0LcEYpD15wHqmVuzYIs1/qkuJa5aTc+Kbt3gRbfee27uBjb8l9IJVk6 +BS7YqpDAuPoOCcaNIoVUKB6PEe89MArvNF0YTK4RzKF2Srhp+nN6U8HARA45jMLCSGvvK1lJ336Q +ZcyOoV8JtxWfLp6zb8PmF9DiVkQbjASC2Ex2J/R5z3Ah3yRZDHUraswf/yxdle8wMuJvXish++/W +C4xTYGup7vd5WQvjA51PfOHLxfi++kDc/vGUT4c7hyL63bcQqYVovHF7Q4QWSfZAWQm41aJFC6I1 +1u6nSing0lupwmMpqbJWRbqeMBhFD6NQ68/kx2Gq+yzHCAx6nGYWf+metnOJduJZOQJkG9lU/dMU +0VHjNPL4hHwyQOmH9/wnfhKjQ+IdVN+VO57sXn+3BCCxTy6vOTfk+DTvI9GLROzB10lxX2E1Jq70 +C4Z7Sngk3SjHzCGTdGtag+mTLVX3eKgWsvVws4VWUqe9rTiWQDiO1SDN6O5UTZBIpTygMBwntFCP +b5cczePdcqwTOK4OFE1BCfoQl+xD7eeC8Omzo9c7hhAX0cf0AI/gzZxWE/Vk/8QzyJw/idtKyi1/ +6BOSkebpbeLno91XL/h6mISVQodOMBZAPWqQrNzv7GffxWHD0M/iTntxB4DK/aAH/gsTaUZqoHP2 +A0OQmon31MzWvc26iQQQTxktEUqVj2QtO3u5zHfw9Oj+I51guO3vj6z/tdYGPaMyzj62Jruq0Nv7 +8CYOI18dZMcvChcAZCW1lL5sH/NdSMpQEiQJxyditUI/9fl+iXZlJ/n8nq2XqjPZpgV97t+PK6nu +Vj9HojyyeOpvYDgGtbCHDHkQPbwX3zDtpYMh8lI2WPk4MMCFn6AA6v0Za7qlwj7k5Hvi8CwdxsHi +amhY3d9YshxMgLLRqUxIsgtqzJdaduT4v49dAsMKbiHKiu6Dm2m3NboeddqdvjvoirsOkucse9tv +DnKjVqvS+s8kM2hMe63+xB1zHyTL6fNzCfhrY9BsQXfvXDyn8aFnOuppV7QxX8sg/aPYe3R5SehT +zeES42PMMPWBrGuPF6LEx7X+affuq556vywlk8E++xI/Ye+kzHZzms2kz55ftCjq0FyxBKLIGZQV +AAHdPji8ukjk5fGxdHZ4H84NHgVgrNnR8yOTecxVK7mj5FHDCh6NISo6z9dKkfOZwFseORfqB6ks +d5YgQfPEx23lKnkmvl9RRc5Re1dVBEWT7/a30KR4UyLit6+5GvD8pytDogS2SZXn1H3qe1eaaCcE +j+VXp6bwx5kQ1APgbLDdPlaYkS9br3QOM/n84d68CVMAtb8XxByeoprIo6RHvEQTsWtfCznJKVE0 +NTWz9pT6zpwxKg9nMi8khIRhp/RTCxihvK9EX0h8ngTkhffQi/IlF9x4NVyvpRLqOVN6WyzPHhzo +gRwlf6ReOdxGsRp8ieTejpM1+4w5e6PncXAJyziVVaEU8vWUPKrKxVRWRYh8+ePyJkaNMFGkJ9lm +7LhnYbj00UwMn748+2LpVrl4OxtnlohmCAKWrYwjlzd2WSudKOaBvtP3l8NzAvycDXSHcfeTH2Nb +z7eX8zWeZ+zyBZTP4uOBIeqO6QioVPWOMDmvWwWB+CIbktfQqkp1Wyk20bseltQw3selrKf7YZxw +V8lHNybtFB7A0mC+CWtE5OfwEz6RgYRZmSJIxZNbEA3j4JzhkhxlznOPW9qfhwB3/uHDuKDGjxfU +ndeQJky07M3rglgiGYGouIeeMOVd+diaoOkWJGW20Mrkdv2lVOSuNNEyygw+EYwEHqN0vP/J+c4f +bmabc6mmuoYS6J5gdmD3MTdAswwq9Rk6QpqZ4XlDFfBmMauNPDg6U3TDxWS5C80weQ7PJeeh7UOU +Lu1oPj5ye8e+M2OXe/kj0w7kaxa2y2G2cfyyDasPPphAArFaehx2zGL+ZVwvgfWSDYPpIbfErdxb +CbpIrOZveX45er5KH+WSjXYDU+Su0vxR5ZjYuEoCByba6VYMWct9kFhBhgQ7dvBzBiRXJCSSydQu +Lm4T8ZPpZE4rP79Pd46OYwoTBu39OxEvT4qpkPQVSHXD7f1ksfFRQLjK5FNkzcfsY/MCY7Avx5ge +gihq+NKd8SFL6iTmy2FN18KkNPPg+9p2UnSmzE3760nF41vhKskcTscqHzt4BEpW0unZg+3xYeA2 +PlI6oXZE3lET4zBZbhZZVlMAX/NZ4xFXbKDgI1ZonKksDNtaA6EBp3LBelET8UwJduoJROvlOtXL +qZuMVsDgIvui/4kZna3UWWX7Ffc0jSkfQWK0n2DKSLo3S7W7RLfLQ7J/tv8zy+vSH1zMvvU10JBa +64FmXPlBsVVNxCs3Y+Xp3AUcqyfMcIUK+t0+QUQNt+OtyvsNCNtaz1yaUrmYTGdyXy9YUT7seDHF +xN3D0Yib7Hr8h1eCJ3Swd4cp9BnPTkY6nGXUn+CDC0/wZ3iND04wwb7pCV4+nHn2f7ZHsC+XLyYX +J70RtroJhqkzqxphq5tgcF5WNsJWN8HURJCVjLDVTTDtoodVjLDVTTDislnRCFvdBMOSjFWNsNVN +MCUpfzUjbHUTzOVdNMK0mljiifZXR6TqoZ87zDVZs0Kv2AbG4rezTMszDOIZaiTuKue1XFYqtZRy +39zsURv3PEw+5KoU3UrcbS5ZnmyVcZObWPNxrBTKGzKq2qXXWXrdrVVaHGoXmL71Vpm8ZANjfnfG +wpZngiUcM8Eau0ZbbHnWG36is7Q0E+yOIhNMS2jzTHzj5ZlgzPlzMKxFkpalCk7rxR/TSkHuO2e9 +2a50a+v45HTpSm/nPnW5NOuNyR5eZx1W2tqKHNiuVNt9ZRmpg0untMiz3TNjcdjJaSATDouPxGhQ +5JlS/aA+uCfSjhTkaPJOed7bAuMk86Vkus1y2fb53fgTO59e92Wwqy4i4bieJ2d61+VV3gbl9gvs +pdhuLlnqjWcxpQZ7+tpmQOa8jlDNO8/6b8/HimoL6ucNBu5bWAHYIlFivZgJU+7ec8kn1gPyI/WK +7lq9sH2+NsY+2sy1S7TRZhJrNiVOhUNrRZtfLpcHwNHe/2XGCgVIJPBgCMlerRnsXxLqrwZBVm48 +L6+2dXpuymExpM44pUYZP1JtMPvSy/PyDGlAq+TldW9WT3UgsnJZvgdGnH6dFApr2VwWFl6BPbYC +yeWlShb8ZQ6P8ZpCI1Cx4mTt/MVFkDBM+/vEorvBcna0/OwvMKQ12ZHp7L+8U1C/He2/2uaqkQJp +Mu062WpW59wqVw3k/m+z1Shy1VAik1yamC/4RzKyydGb7f5qRFW3T9SiSP/dlECZJ6kW8fasS1R2 +qU/vZkq1Wsvq+dPvS9M1HdOybaFtLMv/ah6YBjWnmD/ZDfvxG8wCT16WXLrmcU2Y8pXNa+ktT5dH +dvxjMWwSTbysDReoPitrsR8W7Zd31SF06x0ky4+eSYp7v/wislmpNrlKH7wSp/l83cmLfrOBegH6 +8rsNfn2zAWDM+W6DX99soAbpl99t8OubDVxeirsNAr+92YAU4TvdbfDrmw3UhLbldxv8+mYDl5fi +boNf32wANOZ8t8GvbzZweSnuNvj1zQbouXK82yDw25sNMC7meLfBr282wFJMx7sNAr+92QB23/lu +g1/fbABrcbrbAAxgh/sFHC81QHt/tQsVVptUuc9gVh6/eKPBBu8zUEvKrW402OB9Bvq1OAs3GgQ2 +d58BXryl3mhgIVoNlZsF081B0jDIjVPfmb3PmTC6RWob5fZ9/g7AkL4HWVHdJnC5lExV9Au9zF8K +EM+cN47u9J7Yj/jopGQ5+L1DHEuGywO2qsJl9rHpbRNXMuxVXxV0IPck5YqfWUq47+ygs1XcnaVN +vM2c5kRg9vQwgybU78d6W1LknzvJSJNrq36B0vM2iWjgqVRiGiUmt783muphDxQE7yAIvv2pXmC3 +qgyWPxmWofMgljn/+jnjMqGngDGW0mxfZAPj7G7685kPJpnjaZQQl8ur31iAQraRhR0ZAPqDUzWO +fFS8IUEYY1TiOBuaRSXUT3ZwwZEHyed7vp93ti/aB8qUKvGr3e/qLBSSnt3Nu6uFQuDgoslBrihY +JIHPJ4Z9ufxMRfziyJgRQfJFMOuWI/EJvK/sKdPKPuwBEvQ06fte7r0w4MFw2/pMdfKJseoO1Or9 +UUDf4+5Xoe00DIpKqJ3zfUivWP5fx5i4d7hvOGiRA7meaX1dHDKRev4ED1Ioze0cvWfC0/EDSJ/K +VHvABJOV7G5HzWzeO+NzvnxSVyH2E7HsAXDQVP1E0S0vSbRBi2Tc1xOVG6mMmaEldX+1AIia4Y4R +R/2GgMF/H7viQEbnLPuW7TeNuWQurxdayq3JdIgdIm+pVrvTL9T+aY1crFv5j4H/WDfnjspuLhLB +fxg3D/8v1F2+xqA7GI397kLf5X07SI4mmU5j0hn0a6N/3DFsergs3J5n3DH3rGvc7QNImDfoDE/8 +mLz2BtC9uRh3Ev7/8LdrfwpzZ+D3axcTZjg+4mbCLCcL8E+EkSWY+tvFqIDBC//AHxfwyxc0/e0W +3JfupxfG3cSxblwCK4R5GcAWInyYkeDtntIWjUKTFGZFRnRjQ1SGhQnRaDgiwUwCy4Yl8prEhwWZ +4dxpl8AIAI0IDyUAxM3LXDjKiCym74UlkHxuXpLDgihIbkFkw5gCBC/xUT4s8xzMIQphjmOjbj4i +hAWOg8lEeCREeTfPywCaQF7jZFguvMaL4QjHRsjgcoQX3TwnhMWIDFBH5TDLsvAaQC1HRAXGKBPF +11gmLIk8QBAVwxLDYCc2zETgF5wtKokiaYmwLC6fA0AkjrzHwioFVmljYd2kJRpRWxgYkrREohHS +wsusSN7jw1wEloC4EWVWgLXwAGaUcwOCw7LMwS+48IgIA0RkpQXekyPhKC/xSi+JgUHZCKBHgl8Y +QIYgSWRT+EhUIDsHC5ZwC8jOMazSxghKJwkXjNsr46YubHja9QETQn+YXMGxBLvWI22wgIjSJsJa +sUXgcBBsEQSlJSLwSgP8z91wKZ0krRMfdSsDCbOBRPfidA0AggGiBsTBS6zyROQEAgduiCiSpoiE +hAQtUVmQlRYetxGIjYmyCiCw3wIBZLEXjiSpI0UlZaS56RCO/Vvrw0pOoXb4wiyMzA== + + + IPBw1sNSVMLjx8Ay4fBxoFlGOaQlwDEflWRcBeCdY4AKeUEGJCBa4HiJER7pmwHqwpPCSHBSgKp5 +IBegdDwgAg/HgQFUzdoKpC0aZZR+oN5ESFtEwSTPiGExipvEc2FJ4pAykT/g8YWJGFw/0iXP424J +XAQQF4XXWJhbJCQjKQTCs3Bco4h3eJ8nYEELJ/HaYQfCBrA4EagPVyHKYZ6JwuBwklgBtrvqQtqO +EMKOIow8TAa/8BKLrUDRPJwVNxx2RAgH/Tl8EoFfkUphRs7NCZEwnGGBkIyMZMVxeKwFmCfKAb9D +YIBvhCWYi8DAsTATxwHIwK2gJRoWETwOliUzEraIsE+AKGA2wEMAoQilIMEpbbhYOHiiRHYJUCVE +ZDcL7AQISybwwiRzLSpXSLv0Njie5GQADAycDQ4OmKmN4QSln8wqsDLALqMRmBMQIUUA8xwTBUaJ +x59H/gHUzOGGMQJH4OJkgKLhQvgJqQMWYbGMRFCj8KIIo5x2DqkCuQ3wpGiEENQicRacaL6QUoQf +iEIi+kKhtYThZNBr1CZUwlDrSiUMiSB0t1eQeVGNBQq6zIuqMk/WZF5ElXkozRSZx2kyT9RlXkST +eTyReYwm83hN5kU1mcfrMo/VZJ64IPMiZpnHW8g8XpN5vCrzJE6Tebwm80RN5gGlqTJPVmUesBmT +zIOWBZkHbSaZhy3zMg9bFmQeYy/zhAWZJ1rIPEGTeZIq81hGk3lRTeYJusyLajJPUGVeVJN5gibz +zBuuyDxWE0K8LvNYTebxmsxjNZnHazKPVWUer8s8VpN5vCbzWE3m8ZrMM083k3mSrAkhXpN50KTK +PF6VedCiSjNek2aMJvP4mcxb7EVGktSRiMwzT4dwIHELMuKMCYtAKeRI8ApDR/TLEYmwYCaCHB4o +CTghS/YxCoyHsHxRIrsv4mmRCOETKQBDANkCBxeEqCInkZNGeZacLAGJFV8DkmR5RCD8AhySMEMg +OlwdSC+ZQTICBHKIUiAaEJ4CvofgImkRlVKAo4AaUwQXIIiEJHG/kGgiynuyQtx4bkVCLNBL5nBX +NNkrgFgBquHIsiMRWSRwskyUSGNAU1RAARVl8OiwbgVxiE0CCse7F1CZduKvU3K2EYG8DP/KcHh6 +5NzKHApWra1gbOPIlhQMby62zN77mDXCsQ3LUZCehglmbQVjG6yPFwTDeJZNszfxPAE9inxkBgqS +kKjqBDPoDE36svQ3rdq0Vw1TzGAxzGGAz9CmL01/16pt9u4HbgfsuETYAHBYVuIJa4jgaRH1poJC +fUwkMtfGAwELeAIt20D3kGUydQQYRASp2dgGS5WRunhU6YncRtUZGR7IA4kTUFSwirAXBGQ/ArIR +hANoH4hRAJYbxbMCSiacF2xRtSzQhsKiGNUb4DXUcfA8651gX4Fjw2t8FMSOzJOWqERAEhXJogii +qBTR2mSi2oFKysC5I2/KyIyUNo5lUO+UUF7gaHjM4QVBANYuskaw1AZlNaAyCoZOEdT0WMJBQNuV +CVok5ABkwShj8DUQpiIyOgHPLbK+CAhTCTkPoJOXREXOwmAGpKM0jhJJqTaR/cLtZ/Dko/rECgo3 +4ySJJfsQAWUayBKMYxaPu9aCImzWBlwQeQiOBaQYlWW9DWQTTITyiVdsDpwO6JHVQUgrVpQEG2Ak +D2xTCVCWOA3QOTolupxiovCgFER5lKPA2qISCKqe0oaESJoiZAxg5qh5ALeXJNRCo7AIGeUbil8B +dWHoIQqMYWbEGlgZojxP5lFgqjzqOmAnSBLuN/RiCC9EWxwsFTJ6RJYUoSICTnAs2GdgOpLephyt +KIeUgnZTBAWKonQocImipFDB3IlMW59INLhA8qmWTZTQHEgunqwZ9CeOaNDA9QRiXcvAEQhUAop5 +BVeirFC0iDJc5MnuE9JWDrLEsaoNilZVgfAK2DhJkb6oguC7qABGFH4eYSKyijGOVfuBbCNNomrb +oZohs4Sjo56IG4jTMqgN4NaDwBNV8ECdB4YqabIJNxctzDuVBiReaSPDkhY8FKQFjaYFOklrigmA +LEWJwQ1oifJEakTQRANyB8qAHZIi2sZzgtrEaaudf1W1Mm5dstvndz/cu5ZJRK0Ph4pVhKiAcGii +HApGMKlQj5VUHQtW0HVxUcQpSm+wfjng5Ni28G4XQLCfkxMRUlRv0XCLAP5gLmAOIOUVNUqG0wHD +ossCSJNsBuEqXYtXHaYCWgazQVaEG2jvOFUE7UtBUa4icNpgWCBB0CZEhf3wUVzB4qvLp0IHGyIB +2WOEiaJURnKKsGhBC7hvcIi7hAswHE6vyZfu4qsOM0mCIkN5kEwysapwBKJO88hIQVTgqBJaNsjE +gXEC5ZAm05sOExGjAfmliLiAXcc1RZQTh2IRrG6ewI/ePpRT0I8YUV2Ldx3mQncZw0pEFBDeDHNx +ILPwBHBwGkEq4LCg0ooiylt4xrEcWejCq05TgeYqEi0BmJhEDhs6TDhUldHW59RhkVsSLhuBbZTJ +qsyvLp9J0WKRXDkZLVFclMAAGxNR7YU5QQ1EaJEfS0TX4HhFu+5avOswF4NMl0eGDxKDEYkvDHkC +4V3o5kEGDOPCwY2KaIKybDjKsjJpM7+7fC5V8KG4n3Nzwepwq2zcXBxrdnNxrIWbS1LdXGC8L7q5 +ZDRaoIlRLCvQQBn0I6C1CFsDz4jbDu0oBjUAaGPRVIA2dF2xqGihBSSJskpVHDrIOFSyZYJpURkL +IOTRT4WePEmUOGKBy+iDRGUClKYosbeiRNxBi4xuCvQIRlVvInE7RfQmlFUo/1nF18QSrzlxcxG5 +xqMfh7jQ0JeG+pQiHBUnEqpmcIyEKJxiOHthiZhbyAtZ0c0BouDoKwoFx0RY8hpOi2tDJicR4cYR +7xu6xMhxBV7LEZNZVjGM/jD8BRBEOBF6z2CkCApgVlaYUxQ9hRFeUxRgEjTUOaI/otNMa2kQlspw +6GDRezEKmnliVgLj5UBTg8MkkwWjcgrT8cAtRBRnuMXoSOOQIEgngB+1EHS+SRySmIiCNYLmKScg +USP5yKjqwUpA1spIh3iMiJwiXEIhSPTTRKNq2EB1jQqKaxTQBBhTXaOi5hrlFlyj7IJrFOYBjosi +JIKyBNaLvh5CKKCHMKiHKO5GpBiM4PACKuEcg5qbdkRBhSDvCSIwaWQGQjQCK4ZHgog8F6hRBnMD +34OHircJoBPRaObQlGAjCmcGUgYwQUkDBRNb0KJnRLKfwLii2AtMBOLcIr1ERlGcJVDHoQU1LZkl +DJUokQ0iNVEnBgg4Hl7n0HkUVZkzUfU5UMBFDq0HHmMVMiHfqKS4YdHyAWQAMmFfRRZ1woga2MGR +0Y0gYDhJIjhBB5PMysQw4XmwylAYK6cPNlpGjxi2sCKgXiAqJfH3gdmGDjTSiZFYluxcFIQPaYmi +3sfxsuo0gxYRthIxGVUIDJvIatHhSxyR8DqPh59DhiKyioEDFEe8wgxhqVGVj+PSgLMD61HCeBLL +oH8ZGST6LOAXYLKc+l6EHAwZNw5sKw4dh1FB8dezHJIOMk+Dnz1NfNBmP3tkwc8uWPjZuQU/u6h5 +1XnNzy7qPvWZn33WFtV96hHNzz7Xtuhn51H9jxBWSyw2JHJRwBYOYzLYMvOzEwPY7GfnzH52IAST +n52Z+dmB04DOAfwAqJwHBgK0gfChps6rMoSLomcN0QAnV0RhAu/JnGKdzNoKxjYeScDUJoaBAGA0 +9DAyRKRhZAnIEpQTVbrA+WAjxE7mkBGAugRtOABuGViRsEkCacHzzEWRVyBeAFCGJxYBgioJguIj +YDmF4cObPEGLwn70yAKrRBbSxrBX1Bz24qSFsBenh71ELezF6WEv0SLsFV0Ie0UWwl68Oeyl2DeE +wnlZIFSIZlhPDdDwircRaE5ws6CskOOD+8FEyYFCZiMpwWMiQ4AwgbEz6GuYtRWgDf2caCkAaxcx +ukDeRCUHcSZE8HDAoMSYAP01wiiEg5FscoCA3eHZQk4gS0TWgcxB1zOHngMGhS0GDnji58eRMPSA +yFdpGTkB8E0SH4oi3zGv1zHaaRX58RZr7VZlVOt0WyNXe1z7q+Wu9fuDSW3SGsITd3vUGk8Go5Z7 +/Dn4G1vgFa2715u9zrn+L1T7Dxc= + + + TM + \ No newline at end of file diff --git a/output/webapps/docs/BUILDING.txt b/output/webapps/docs/BUILDING.txt old mode 100755 new mode 100644 index 05ac284..63e7ca3 --- a/output/webapps/docs/BUILDING.txt +++ b/output/webapps/docs/BUILDING.txt @@ -20,7 +20,7 @@ ==================================================== This subproject contains the source code for Tomcat 9.0, a container that -implements the Servlet 4.0, JSP 2.4?, EL 3.1?, WebSocket 1.2? and JASPIC 1.1 +implements the Servlet 4.0, JSP 2.3, EL 3.0, WebSocket 1.1 and JASPIC 1.1 specifications from the Java Community Process . Note: If you just need to run Apache Tomcat, it is not necessary to build diff --git a/output/webapps/docs/RELEASE-NOTES.txt b/output/webapps/docs/RELEASE-NOTES.txt old mode 100755 new mode 100644 index aaef689..0782607 --- a/output/webapps/docs/RELEASE-NOTES.txt +++ b/output/webapps/docs/RELEASE-NOTES.txt @@ -16,7 +16,7 @@ ================================================================================ - Apache Tomcat Version 9.0.0.M21 + Apache Tomcat Version 9.0.4 Release Notes @@ -93,7 +93,8 @@ or by placing them in JAR files in the "lib" directory. To override the XML parser implementation or interfaces, use the appropriate feature for your JVM. For Java <= 8 use the endorsed standards override -feature. For Java 9+ use the upgradeable modules feature. +feature. The default configuration defines JARs located in "endorsed" as endorsed. +For Java 9+ use the upgradeable modules feature. ================================================================ diff --git a/output/webapps/docs/RUNNING.txt b/output/webapps/docs/RUNNING.txt old mode 100755 new mode 100644 index d38796a..654d7af --- a/output/webapps/docs/RUNNING.txt +++ b/output/webapps/docs/RUNNING.txt @@ -272,6 +272,12 @@ In CATALINA_HOME: lib - Libraries and classes, as explained below + * endorsed - Libraries that override standard "Endorsed Standards" + libraries provided by JRE. See Classloading documentation + in the User Guide for details. + This is only supported for Java <= 8. + By default this "endorsed" directory is absent. + In the default configuration the JAR libraries and classes both in CATALINA_BASE/lib and in CATALINA_HOME/lib will be added to the common classpath, but the ones in CATALINA_BASE will be added first and thus will diff --git a/output/webapps/docs/WEB-INF/web.xml b/output/webapps/docs/WEB-INF/web.xml old mode 100755 new mode 100644 diff --git a/output/webapps/docs/aio.html b/output/webapps/docs/aio.html old mode 100755 new mode 100644 index efee709..42f4cc3 --- a/output/webapps/docs/aio.html +++ b/output/webapps/docs/aio.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Advanced IO and Tomcat Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Advanced IO and Tomcat Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Advanced IO and Tomcat Table of Contents Introduction Asynchronous writes Introduction @@ -93,5 +93,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/api/index.html b/output/webapps/docs/api/index.html old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/build.xml.txt b/output/webapps/docs/appdev/build.xml.txt old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/deployment.html b/output/webapps/docs/appdev/deployment.html old mode 100755 new mode 100644 index ad9563e..c69a357 --- a/output/webapps/docs/appdev/deployment.html +++ b/output/webapps/docs/appdev/deployment.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Deployment Application Developer's Guide - Version 9.0.0.M21, - May 4 2017 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Deployment Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Deployment Table of Contents Background Standard Directory Layout Shared Library Files Web Application Deployment Descriptor Tomcat Context Descriptor Deployment With Tomcat Background @@ -240,5 +240,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/appdev/index.html b/output/webapps/docs/appdev/index.html old mode 100755 new mode 100644 index ed1b0d4..d5ce473 --- a/output/webapps/docs/appdev/index.html +++ b/output/webapps/docs/appdev/index.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Table of Contents Application Developer's Guide - Version 9.0.0.M21, - May 4 2017 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Table of Contents Preface + Version 9.0.4, + Jan 18 2018 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Table of Contents Preface This manual includes contributions from many members of the Tomcat Project developer community. The following authors have provided significant content: @@ -83,5 +83,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/appdev/installation.html b/output/webapps/docs/appdev/installation.html old mode 100755 new mode 100644 index 02238e6..94ad019 --- a/output/webapps/docs/appdev/installation.html +++ b/output/webapps/docs/appdev/installation.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Installation Application Developer's Guide - Version 9.0.0.M21, - May 4 2017 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Installation Installation + Version 9.0.4, + Jan 18 2018 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Installation Installation In order to use Tomcat for developing web applications, you must first install it (and the software it depends on). The required steps are outlined @@ -39,7 +39,7 @@ JDK - Tomcat 9.0 was designed to run on Java SE 7. + Tomcat 9.0 was designed to run on Java SE 8 or later. Compatible JDKs for many platforms (or links to where they can be found) @@ -111,5 +111,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/appdev/introduction.html b/output/webapps/docs/appdev/introduction.html old mode 100755 new mode 100644 index cf41870..10cbf77 --- a/output/webapps/docs/appdev/introduction.html +++ b/output/webapps/docs/appdev/introduction.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Introduction Application Developer's Guide - Version 9.0.0.M21, - May 4 2017 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Introduction Overview + Version 9.0.4, + Jan 18 2018 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Introduction Overview Congratulations! You've decided to (or been told to) learn how to build web applications using servlets and JSP pages, and picked the @@ -70,9 +70,8 @@ and packaging JSP pages (Appendix A) is useful. The Javadoc API Documentation is included in the specification, and with the Tomcat download. - - http://jcp.org/aboutJava/communityprocess/final/jsr340/index.html - - Servlet API Specification, Version 3.1. Describes the + https://jcp.org/aboutJava/communityprocess/final/jsr369/index.html - + Servlet API Specification, Version 4.0. Describes the programming environment that must be provided by all servlet containers conforming to this specification. In particular, you will need this document to understand the web application @@ -97,5 +96,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/appdev/processes.html b/output/webapps/docs/appdev/processes.html old mode 100755 new mode 100644 index 6f25c0e..ee76ec5 --- a/output/webapps/docs/appdev/processes.html +++ b/output/webapps/docs/appdev/processes.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Development Processes Application Developer's Guide - Version 9.0.0.M21, - May 4 2017 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Development Processes Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Development Processes Table of Contents Development Processes One-Time Setup of Ant and Tomcat for Development Create Project Source Code Directory Edit Source Code and Pages Build the Web Application Test Your Web Application Creating a Release Development Processes @@ -311,5 +311,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/appdev/sample/build.xml b/output/webapps/docs/appdev/sample/build.xml old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/docs/README.txt b/output/webapps/docs/appdev/sample/docs/README.txt old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/index.html b/output/webapps/docs/appdev/sample/index.html old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/sample.war b/output/webapps/docs/appdev/sample/sample.war old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/src/mypackage/Hello.java b/output/webapps/docs/appdev/sample/src/mypackage/Hello.java old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/web/WEB-INF/web.xml b/output/webapps/docs/appdev/sample/web/WEB-INF/web.xml old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/web/hello.jsp b/output/webapps/docs/appdev/sample/web/hello.jsp old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/web/images/tomcat.gif b/output/webapps/docs/appdev/sample/web/images/tomcat.gif old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/web/index.html b/output/webapps/docs/appdev/sample/web/index.html old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/source.html b/output/webapps/docs/appdev/source.html old mode 100755 new mode 100644 index d9fd350..e3352f9 --- a/output/webapps/docs/appdev/source.html +++ b/output/webapps/docs/appdev/source.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Source Organization Application Developer's Guide - Version 9.0.0.M21, - May 4 2017 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Source Organization Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home App Dev Guide Home FAQ User Comments Contents Contents Introduction Installation Deployment Source Code Processes Example App Source Organization Table of Contents Directory Structure External Dependencies Source Code Control BUILD.XML Configuration File Directory Structure @@ -317,5 +317,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/appdev/web.xml.txt b/output/webapps/docs/appdev/web.xml.txt old mode 100755 new mode 100644 diff --git a/output/webapps/docs/apr.html b/output/webapps/docs/apr.html old mode 100755 new mode 100644 index d127c9b..11cceab --- a/output/webapps/docs/apr.html +++ b/output/webapps/docs/apr.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Apache Portable Runtime (APR) based Native library for Tomcat Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Apache Portable Runtime (APR) based Native library for Tomcat Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Apache Portable Runtime (APR) based Native library for Tomcat Table of Contents Introduction Installation Windows Linux APR Components APR Lifecycle Listener Configuration APR Connectors Configuration HTTP/HTTPS AJP Introduction @@ -169,5 +169,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/architecture/index.html b/output/webapps/docs/architecture/index.html old mode 100755 new mode 100644 index 53ed490..bafe2a6 --- a/output/webapps/docs/architecture/index.html +++ b/output/webapps/docs/architecture/index.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Architecture (9.0.0.M21) - Table of Contents Apache Tomcat 9 Architecture - Version 9.0.0.M21, - May 4 2017 Links Docs Home Architecture Home FAQ User Comments Contents Contents Overview Server Startup Request Process Table of Contents Preface + Version 9.0.4, + Jan 18 2018 Links Docs Home Architecture Home FAQ User Comments Contents Contents Overview Server Startup Request Process Table of Contents Preface This section of the Tomcat documentation attempts to explain the architecture and design of the Tomcat server. It includes significant @@ -73,5 +73,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/architecture/overview.html b/output/webapps/docs/architecture/overview.html old mode 100755 new mode 100644 index 687f5bc..df070ab --- a/output/webapps/docs/architecture/overview.html +++ b/output/webapps/docs/architecture/overview.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Architecture (9.0.0.M21) - Architecture Overview Apache Tomcat 9 Architecture - Version 9.0.0.M21, - May 4 2017 Links Docs Home Architecture Home FAQ User Comments Contents Contents Overview Server Startup Request Process Architecture Overview Overview + Version 9.0.4, + Jan 18 2018 Links Docs Home Architecture Home FAQ User Comments Contents Contents Overview Server Startup Request Process Architecture Overview Overview This page provides an overview of the Tomcat server architecture. @@ -142,5 +142,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/architecture/requestProcess.html b/output/webapps/docs/architecture/requestProcess.html old mode 100755 new mode 100644 index 83920f5..ff0b00d --- a/output/webapps/docs/architecture/requestProcess.html +++ b/output/webapps/docs/architecture/requestProcess.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Architecture (9.0.0.M21) - Request Process Flow Apache Tomcat 9 Architecture - Version 9.0.0.M21, - May 4 2017 Links Docs Home Architecture Home FAQ User Comments Contents Contents Overview Server Startup Request Process Request Process Flow Request Process Flow + Version 9.0.4, + Jan 18 2018 Links Docs Home Architecture Home FAQ User Comments Contents Contents Overview Server Startup Request Process Request Process Flow Request Process Flow This page describes the process used by Tomcat to handle @@ -81,5 +81,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/architecture/requestProcess/authentication-process.png b/output/webapps/docs/architecture/requestProcess/authentication-process.png old mode 100755 new mode 100644 diff --git a/output/webapps/docs/architecture/requestProcess/request-process.png b/output/webapps/docs/architecture/requestProcess/request-process.png old mode 100755 new mode 100644 diff --git a/output/webapps/docs/architecture/startup.html b/output/webapps/docs/architecture/startup.html old mode 100755 new mode 100644 index 7fec6b5..316de37 --- a/output/webapps/docs/architecture/startup.html +++ b/output/webapps/docs/architecture/startup.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Architecture (9.0.0.M21) - Startup Apache Tomcat 9 Architecture - Version 9.0.0.M21, - May 4 2017 Links Docs Home Architecture Home FAQ User Comments Contents Contents Overview Server Startup Request Process Startup Server Startup + Version 9.0.4, + Jan 18 2018 Links Docs Home Architecture Home FAQ User Comments Contents Contents Overview Server Startup Request Process Startup Server Startup This page describes how the Tomcat server starts up. There are several @@ -80,5 +80,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/architecture/startup/serverStartup.pdf b/output/webapps/docs/architecture/startup/serverStartup.pdf old mode 100755 new mode 100644 diff --git a/output/webapps/docs/architecture/startup/serverStartup.txt b/output/webapps/docs/architecture/startup/serverStartup.txt old mode 100755 new mode 100644 diff --git a/output/webapps/docs/balancer-howto.html b/output/webapps/docs/balancer-howto.html old mode 100755 new mode 100644 index 0827edb..7ca8ac2 --- a/output/webapps/docs/balancer-howto.html +++ b/output/webapps/docs/balancer-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Load Balancer HOW-TO Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Load Balancer HOW-TO Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Load Balancer HOW-TO Table of Contents Using the JK 1.2.x native connector Using Apache HTTP Server 2.x with mod_proxy Using the JK 1.2.x native connector @@ -57,5 +57,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/building.html b/output/webapps/docs/building.html old mode 100755 new mode 100644 index eb30537..082140f --- a/output/webapps/docs/building.html +++ b/output/webapps/docs/building.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Building Tomcat Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Building Tomcat Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Building Tomcat Table of Contents Introduction Download a Java Development Kit (JDK) version 8 Install Apache Ant 1.9.5 or later Checkout or obtain the Tomcat source code Configure download area Building Tomcat Building with Eclipse Building with other IDEs Introduction @@ -274,5 +274,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/cgi-howto.html b/output/webapps/docs/cgi-howto.html old mode 100755 new mode 100644 index 1c17ad2..437a65c --- a/output/webapps/docs/cgi-howto.html +++ b/output/webapps/docs/cgi-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - CGI How To Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes CGI How To Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes CGI How To Table of Contents Introduction Installation Configuration Introduction @@ -93,6 +93,14 @@ By default there is no value, which results in the web application root directory being used as the search path. The recommended value is `WEB-INF/cgi` + enableCmdLineArguments - Are command line parameters +generated from the query string as per section 4.4 of 3875 RFC? The default is +`false`. + environment-variable- - An environment to be set for the +execution environment of the CGI script. The name of variable is taken from the +parameter name. To configure an environment variable named FOO, configure a +parameter named environment-variable-FOO. The parameter value is used as the +environment variable value. The default is no environment variables. executable - The name of the executable to be used to run the script. You may explicitly set this parameter to be an empty string if your script is itself executable (e.g. an exe file). Default is @@ -118,6 +126,16 @@ is `2000`. + The CGI script executed depends on the configuration of the CGI Servlet and +how the request is mapped to the CGI Servlet. The CGI search path starts at the +web application root directory + File.separator + cgiPathPrefix. The +pathInfo is then searched unless it is `null` - in +which case the servletPath is searched. + + The search starts with the first path segment and expands one path segment +at a time until no path segments are left (resulting in a 404) or a script is +found. Any remaining path segments are passed to the script in the +PATH_INFO environment variable. Comments @@ -132,5 +150,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/changelog.html b/output/webapps/docs/changelog.html old mode 100755 new mode 100644 index 3202f03..445cbca --- a/output/webapps/docs/changelog.html +++ b/output/webapps/docs/changelog.html @@ -1,7 +1,1358 @@ -Apache Tomcat 9 (9.0.0.M21) - Changelog Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Changelog Tomcat 9.0.0.M21 (markt) +Apache Tomcat 9 (9.0.4) - Changelog Apache Tomcat 9 + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Changelog Tomcat 9.0.4 (markt) + Catalina + + + Correct a regression in the previous fix for 61916 that meant + that any call to `addHeader()` would have been replaced with + a call to `setHeader()` for all requests mapped to the + `AddDefaultCharsetFilter`. (markt) + + + 61999: maxSavePostSize set to 0 should disable saving POST + data during authentication. (remm) + + + + Coyote + + + Fix NIO2 HTTP/2 sendfile. (remm) + + + 61993: Improve handling for `ByteChunk` and + `CharChunk` instances that grow close to the maximum size + allowed by the JRE. (markt) + + + + Jasper + + + 43925: Add a new system property + (`org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE`) to + control the size of the buffer used by Jasper when buffering tag bodies. + (markt) + + + + Web applications + + + 62006: Document the new `JvmOptions9` command line + parameter for `tomcat9.exe`. (markt) + + + + not released Tomcat 9.0.3 (markt) + Catalina + + + 57619: Implement a small optimisation to how JAR URLs are + processed to reduce the storage of duplicate String objects in memory. + Patch provided by Dmitri Blinov. (markt) + + + Add some missing NPEs to ServletContext. (remm) + + + Update the Java EE 8 XML schema to the released versions. (markt) + + + Minor HTTP/2 push fixes. (remm) + + + 61916: Extend the `AddDefaultCharsetFilter` to add + a character set when the content type is set via + `setHeader()` or `addHeader()` as well as when it + is set via `setContentType()`. (markt) + + + When using WebDAV to copy a file resource to a destination that requires + a collection to be overwritten, ensure that the operation succeeds + rather than fails (with a 500 response). This enables Tomcat to pass two + additional tests from the Litmus WebDAV test suite. (markt) + + + Modify the Default and WebDAV Servlets so that a 405 status code is + returned for `PUT` and `DELETE` requests when + disabled via the `readonly` initialisation parameter. + + + Align the contents of the `Allow` header with the response + code for the Default and WebDAV Servlets. For any given resource a + method that returns a 405 status code will not be listed in the + `Allow` header and a method listed in the `Allow` + header will not return a 405 status code. (markt) + + + + Coyote + + + 60276: Implement GZIP compression support for responses + served over HTTP/2. (markt) + + + Do not call onDataAvailable without any data to read. (remm) + + + Correctly handle EOF when `ServletInputStream.isReady()` is + called. (markt) + + + 61886: Log errors on non-container threads at + `DEBUG` rather than `INFO`. The exception will be + made available to the application via the asynchronous error handling + mechanism. (markt) + + + 61914: Possible NPE with Java 9 when creating a SSL engine. + Patch submitted by Evgenij Ryazanov. (remm) + + + 61918: Fix connectionLimitLatch counting when closing an + already closed socket. Based on a patch by Ryan Fong. (remm) + + + Add support for the OpenSSL ARIA ciphers to the OpenSSL to JSSE + cipher mapping. (markt) + + + 61932: Allow a call to `AsyncContext.dispatch()` + to terminate non-blocking I/O. (markt) + + + 61948: Improve the handling of malformed ClientHello messages + in the code that extracts the SNI information from a TLS handshake for + the JSSE based NIO and NIO2 connectors. (markt) + + + Fix NIO2 handshaking with a full input buffer. (remm) + + + Return a simple, plain text error message if a client attempts to make a + plain text HTTP connection to a TLS enabled NIO or NIO2 Connector. + (markt) + + + + Jasper + + + 61854: When using sets and/or maps in EL expressions, ensure + that Jasper correctly parses the expression. Patch provided by Ricardo + Martin Camarero. (markt) + + + Improve the handling of methods with varargs in EL expressions. In + particular, the calling of a varargs method with no parameters now works + correctly. Based on a patch by Nitkalya (Ing) Wiriyanuparb. (markt) + + + 61945: Fix prototype mode used to compile tags. (remm) + + + + Web applications + + + 61223: Add the mbeans-descriptors.dtd file to the custom + MBean documentation so users have a reference to use when constructing + mbeans-descriptors.xml files for custom components. (markt) + + + 61565: Add the ability to trigger a reloading of TLS host + configuration (certificate and key files, server.xml is not re-parsed) + via the Manager web application. (markt) + + + 61566: Expose the currently in use certificate chain and list + of trusted certificates for all virtual hosts configured using the JSSE + style (keystore) TLS configuration via the Manager web application. + (markt) + + + Partial fix for 61886. Ensure that multiple threads do not + attempt to complete the `AsyncContext` if an I/O error occurs + in the stock ticker example Servlet. (markt) + + + 61886: Prevent `ConcurrentModificationException` + when running the asynchronous stock ticker in the examples web + application. (markt) + + + 61886: Prevent `NullPointerException` and other + errors if the stock ticker example is running when the examples web + application is stopped. (markt) + + + 61910: Clarify the meaning of the `allowLinking` + option in the documentation web application. (markt) + + + Add OCSP configuration information to the SSL How-To. Patch provided by + Marek Czernek. (markt) + + + + jdbc-pool + + + 61312: Prevent `NullPointerException`n when using + the statement cache of connection that has been closed. (kfujino) + + + + Other + + + Add an additional system property for the system property replacement. + (remm) + + + Add missing SHA-512 hash for release artifacts to the build script. + (markt) + + + Update the internal fork of Commons Pool 2 to 2.4.3. (markt) + + + Update the internal fork of Commons DBCP 2 to 8a71764 (2017-10-18) to + pick up some bug fixes and enhancements. (markt) + + + Update the internal fork of Commons FileUpload to 6c00d57 (2017-11-23) + to pick up some code clean-up. (markt) + + + Update the internal fork of Commons Codec to r1817136 to pick up some + code clean-up. (markt) + + + The native source bundles (for Commons Daemon and Tomcat Native) are no + longer copied to the bin directory for the deploy target. They are now + only copied to the bin directory for the release target. (markt) + + + + 2017-11-30 Tomcat 9.0.2 (markt) + Catalina + + + Fix possible `SecurityException` when using TLS related + request attributes. (markt) + + + 61597: Extend the `StandardJarScanner` to scan + JARs on the module path when running on Java 9 and class path scanning + is enabled. (markt) + + + 61601: Add support for multi-release JARs in JAR scanning and + web application class loading. (markt) + + + 61681: Allow HTTP/2 push when using request wrapping. (remm) + + + Provide the `SessionInitializerFilter` that can be used to + ensure that an HTTP session exists when initiating a WebSocket + connection. Patch provided by isapir. (markt) + + + 61682: When re-prioritising HTTP/2 streams, ensure that both + parent and children fields are correctly updated to avoid a possible + `StackOverflowError`. (markt) + + + Improve concurrency by reducing the scope of the synchronisation for + `javax.security.auth.message.config.AuthConfigFactory` in the + JASPIC API implementation. Based on a patch by Pavan Kumar. (markt) + + + Avoid a possible `NullPointerException` when timing out + `AsyncContext` instances during shut down. (markt) + + + 61777: Avoid a `NullPointerException` when + detaching a JASPIC `RegistrationListener`. Patch provided by + Lazar. (markt) + + + 61778: Correct the return value when detaching a JASPIC + `RegistrationListener`. Patch provided by Lazar. (markt) + + + 61779: Avoid a `NullPointerException` when a + `null` `RegistrationListener` is passed to + `AuthConfigFactory.getConfigProvider()`. Patch provided by + Lazar. (markt) + + + 61780: Only include the default JASPIC registration ID in the + return value for a call to + `AuthConfigFactory.getRegistrationIDs()` if a + `RegistrationContext` has been registered using the default + registration ID. Patch provided by Lazar. (markt) + + + 61781: Enable JASPIC provider registrations to be persisted + when the layer and/or application context are `null`. Patch + provided by Lazar. (markt) + + + 61782: When calling + `AuthConfigFactory.doRegisterConfigProvider()` and the + requested JASPIC config provider class is found by the web application + class loader, do not attempt to load the class with the class loader + that loaded the JASPIC API. Patch provided by Lazar. (markt) + + + 61783: When calling + `AuthConfigFactory.removeRegistration()` and the registration + is persistent, it should be removed from the persistent store. Patch + provided by Lazar. (markt) + + + 61784: Correctly handle the case when + `AuthConfigFactoryImpl.registerConfigProvider()` is called + with a provider name of `null`. Patch provided by Lazar. + (markt) + + + 61795: Add a property to the `Authenticator` + implementations to enable a custom JASPIC `CallbackHandler` + to be specified. Patch provided by Lazar. (markt) + + + + Coyote + + + 61568: Avoid a potential `SecurityException` when + using the NIO2 connector and a new thread is added to the pool. (markt) + + + 61583: Correct a further regression in the fix to enable the + use of Java key stores that contained multiple keys that did not all + have the same password. This fixes PKCS11 key store handling with + multiple keys selected with an alias. (markt) + + + Improve NIO2 syncing for async IO operations. (remm) + + + Sendfile support for HTTP/2 and NIO2. (remm) + + + Reduce default HTTP/2 stream concurrent execution within a connection + from 200 to 20. (remm) + + + 61668: Avoid a possible NPE when calling + `AbstractHttp11Protocol.getSSLProtocol()`. (markt) + + + 61673: Avoid a possible + `ConcurrentModificationException` when working with the + streams associated with a connection. (markt) + + + 61719: Avoid possible NPE calling + InputStream.setReadListener with HTTP/2. (remm) + + + 61736: Improve performance of NIO connector when clients + leave large time gaps between network packets. Patch provided by Zilong + Song. (markt) + + + 61740: Correct an off-by-one error in the Hpack header index + validation that caused intermittent request failures when using HTTP/2. + (markt) + + + + Jasper + + + 61604: Fix SMAP generation for JSPs that generate no output. + (markt) + + + 61816: Invalid expressions in attribute values or template + text should trigger a translation (compile time) error, not a run time + error. (markt) + + + + WebSocket + + + 61604: Add support for authentication in the websocket + client. Patch submitted by J Fernandez. (remm) + + + + Web applications + + + Correct Javadoc links to point to Java SE 8 and Java EE 8. (markt) + + + Enable Javadoc to be built with Java 9. (markt) + + + 61603: Add XML filtering for the status servlet output where + needed. (remm) + + + Correct the description of how the CGI servlet maps a request to a + script in the CGI How-To. (markt) + + + + Tribes + + + Fix incorrect behavior that attempts to resend channel messages more + than the actual setting value of `maxRetryAttempts`. + (kfujino) + + + Ensure that the remaining Sender can send channel messages by avoiding + unintended `ChannelException` caused by comparing the number + of failed members and the number of remaining Senders. (kfujino) + + + Ensure that remaining SelectionKeys that were not handled by throwing a + `ChannelException` during SelectionKey processing are + handled. (kfujino) + + + + Other + + + Improve the fix for 61439 and exclude the JPA, JAX-WS and EJB + annotations completely from the Tomcat distributions. (markt) + + + Improve handling of endorsed directories. The endorsed directory + mechanism will only be used if the `JAVA_ENDORSED_DIRS` + system property is explicitly set or if + `$CATALINA_HOME/endorsed` exists. When running on Java 9, any + such attempted use of the endorsed directory mechanism will trigger an + error and Tomcat will fail to start. (rjung) + + + 51496: When using the Windows installer, check if the + requested service name already exists and, if it does, prompt the user + to select an alternative service name. Patch provided by Ralph + Plawetzki. (markt) + + + 61590: Enable `service.bat` to recognise when + `JAVA_HOME` is configured for a Java 9 JDK. (markt) + + + 61598: Update the Windows installer to search the new (as of + Java 9) registry locations when looking for a JRE. (markt) + + + Add generation of a SHA-512 hash for release artifacts to the build + script. (markt) + + + 61658: Update MIME mappings for fonts to use + `font/` as per RFC8081. (markt) + + + Update the packaged version of the Tomcat Native Library to 1.2.16 to + pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL + 1.0.2m. (markt) + + + Update the NSIS Installer used to build the Windows installer to version + 3.02.1. (kkolinko) + + + Update the Windows installer to use "The Apache Software Foundation" as + the Publisher when Tomcat is displayed in the list of installed + applications in Microsoft Windows. (kkolinko) + + + 61803: Remove outdated SSL information from the Security + documentation. (remm) + + + + 2017-09-30 Tomcat 9.0.1 (markt) + Catalina + + + Use the correct path when loading the JVM `logging.properties` + file for Java 9. (rjung) + + + Add additional validation to the resource handling required to fix + CVE-2017-12617 on Windows. The checks were being performed elsewhere but + adding them to the resource handling ensures that the checks are always + performed. (markt) + + + + Other + + + 61563: Correct typos in Spanish translation. Patch provided by + Gonzalo Vásquez. (csutherl) + + + + not released Tomcat 9.0.0 (markt) + Catalina + + + 61542: Fix CVE-2017-12617 and prevent JSPs from being + uploaded via a specially crafted request when HTTP PUT was enabled. + (markt) + + + 61554: Exclude test files in unusual encodings and markdown + files intended for display in GitHub from RAT analysis. Patch provided + by Chris Thistlethwaite. (markt) + + + + Coyote + + + 60762: Add the ability to make changes to the TLS + configuration of a connector at runtime without having to restart the + Connector. (markt) + + + Add an option to reject requests that contain HTTP headers with invalid + (non-token) header names with a 400 response and reject such requests by + default. (markt) + + + Implement the requirements of RFC 7230 (and RFC 2616) that HTTP/1.1 + requests must include a `Host` header and any request that + does not must be rejected with a 400 response. (markt) + + + Implement the requirements of RFC 7230 that any HTTP/1.1 request that + specifies a host in the request line, must specify the same host in the + `Host` header and that any such request that does not, must + be rejected with a 400 response. This check is optional but enabled by + default. It may be disabled with the + `allowHostHeaderMismatch` attribute of the Connector. (markt) + + + Implement the requirements of RFC 7230 that any HTTP/1.1 request that + contains multiple `Host` headers is rejected with a 400 + response. (markt) + + + Add a way to set the property source in embedded mode. (remm) + + + 61557: Correct a further regression in the fix to enable the + use of Java key stores that contain multiple keys that do not all have + the same password. The regression broke support for some FIPS compliant + key stores. (markt) + + + + jdbc-pool + + + 61545: Correctly handle invocations of methods defined in the + `PooledConnection` interface when using pooled XA + connections. Patch provided by Nils Winkler. (markt) + + + + Other + + + Update fix for 59904 so that values less than zero are accepted + instead of throwing a NegativeArraySizeException. (remm) + + + Complete the implementation of the Servlet 4.0 specification. (markt) + + + + 2017-09-19 Tomcat 9.0.0.M27 (markt) + Catalina + + + Before generating an error page in the `ErrorReportValve`, + check to see if I/O is still permitted for the associated connection + before generating the error page so that the page generation can be + skipped if the page is never going to be sent. (markt) + + + 61189: Add the ability to set environment variables for + individual CGI scripts. Based on a patch by jm009. (markt) + + + 61210: When running under a SecurityManager, do not print a + warning about not being able to read a logging configuration file when + that file does not exist. (markt) + + + 61280: Add RFC 7617 support to the + `BasicAuthenticator`. Note that the default configuration + does not change the existing behaviour. (markt) + + + 61424: Avoid a possible `StackOverflowError` when + running under a `SecurityManager` and using + `Subject.doAs()`. (markt) + + + When running under Java 9 or later, and the + `urlCacheProtection` option of the + `JreMemoryLeakPreventionListener` is enabled, use the API + added in Java 9 to only disable the caching for JAR URL connections. + (markt) + + + 61489: When using the CGI servlet, make the generation of + command line arguments from the query string (as per section 4.4 of RFC + 3875) optional and disabled by default. Based on a patch by jm009. + (markt) + + + 61503: This corrects a potential regression in the fix for + 60940 with an alternative solution that adds the + `JarEntry` objects normally skipped by a + `JarInputStream` only if those entries exist. (markt) + + + + Coyote + + + The minimum required Tomcat Native version has been increased to 1.2.14. + This version includes a new API needed for correct client certificate + support when using a Java connector with OpenSSL TLS implementation and + support for the `SSL_CONF` OpenSSL API. (rjung) + + + Add support for the OpenSSL `SSL_CONF` API when using + TLS with OpenSSL implementation. It can be used by adding + `OpenSSLConf` elements underneath `SSLHostConfig`. + The new element contains a list of `OpenSSLConfCmd` elements, + each with the attributes `name` and `value`. + (rjung) + + + When using a Java connector in combination with the OpenSSL TLS + implementation, do not configure each SSL connection object via + the OpenSSLEngine. For OpenSSL the SSL object inherits its + settings from the SSL_CTX which we have already configured. + (rjung) + + + When using JSSE TLS configuration with the OpenSSL implementation and + client certificates: include client CA subjects in the TLS handshake + so that the client can choose an appropriate client certificate to + present. (rjung) + + + If an invalid option is specified for the + `certificateVerification` attribute of an + `SSLHostConfig` element, treat it as `required` + which is the most secure / restrictive option in addition to reporting + the configuration error. (markt) + + + Improve the handling of client disconnections during the TLS + renegotiation handshake. (markt) + + + Prevent exceptions being thrown during normal shutdown of NIO + connections. This enables TLS connections to close cleanly. (markt) + + + Fix possible race condition when setting IO listeners on an upgraded + connection. (remm) + + + Ensure that the APR/native connector uses blocking I/O for TLS + renegotiation. (markt) + + + 48655: Enable Tomcat to shutdown cleanly when using sendfile, + the APR/native connector and a multi-part download is in progress. + (markt) + + + 58244: Handle the case when OpenSSL resumes a TLS session + using a ticket and the full client certificate chain is not available. + In this case the client certificate without the chain will be presented + to the application. (markt) + + + Improve the warning message when JSSE and OpenSSL configuration styles + are mixed on the same `SSLHostConfig`. (markt) + + + 61415: Fix TLS renegotiation with OpenSSL based connections + and session caching. (markt) + + + Delay checking that the configured attributes for an + `SSLHostConfig` instance are consistent with the configured + SSL implementation until `Connector` start to avoid incorrect + warnings when the SSL implementation changes during initialisation. + (markt) + + + 61450: Fix default key alias algorithm. (remm) + + + 61451: Correct a regression in the fix to enable the use of + Java key stores that contained multiple keys that did not all have the + same password. The regression broke support for any key store that did + not store keys in PKCS #8 format such as hardware key stores and Windows + key stores. (markt) + + + + WebSocket + + + 60523: Reduce the number of packets used to send WebSocket + messages by not flushing between the header and the payload when the + two are written together. (markt) + + + 61491: When using the `permessage-deflate` + extension, correctly handle the sending of empty messages after + non-empty messages to avoid the `IllegalArgumentException`. + (markt) + + + + Web applications + + + Show connector cipher list in the manager web application in the + correct cipher order. (rjung) + + + + Tribes + + + To avoid unexpected session timeout notification from backup session, + update the access time when receiving the map member notification + message. (kfujino) + + + Add member info to the log message when the failure detection check + fails in `TcpFailureDetector`. (kfujino) + + + Avoid Ping timeout until the added map member by receiving + `MSG_START` message is completely started. (kfujino) + + + When sending a channel message, make sure that the Sender has connected. + (kfujino) + + + Correct the backup node selection logic that node 0 is returned twice + consecutively. (kfujino) + + + Fix race condition of `responseMap` in + `RpcChannel`. (kfujino) + + + + jdbc-pool + + + 61391: Ensure that failed queries are logged if the + `SlowQueryReport` interceptor is configured to do so and the + connection has been abandoned. Patch provided by Craig Webb. (markt) + + + 61425: Ensure that transaction of idle connection has + terminated when the `testWhileIdle` is set to + `true` and `defaultAutoCommit` is set to + `false`. Patch provided by WangZheng. (kfujino) + + + + Other + + + 61419: Replace a Unix style comment in the DOS bat file + `catalina.bat` with the correct `rem` markup. + (rjung) + + + 61439: Remove the Java Annotation API classes from + tomcat-embed-core.jar and package them in a separate JAR in the + embedded distribution to provide end users with greater flexibility to + handle potential conflicts with the JRE and/or other JARs. (markt) + + + 61441: Improve the detection of `JAVA_HOME` by the + `daemon.sh` script when running on a platform where Java has + been installed from an RPM. (rjung) + + + Update the packaged version of the Tomcat Native Library to 1.2.14 to + pick up the latest Windows binaries built with APR 1.6.2 and OpenSSL + 1.0.2l. (markt) + + + 61599: Update to Commons Daemon 1.1.0 for improved Java 9 + support. (markt) + + + + 2017-08-08 Tomcat 9.0.0.M26 (markt) + Catalina + + + Correct multiple regressions in the fix for 49464 that could + corrupt static content served by the `DefaultServlet`.(markt) + + + Correct a bug in the `PushBuilder` implementation that + meant push URLs containing `%nn` sequences were not correctly + decoded. Identified by FindBugs. (markt) + + + 61164: Add support for the `%X` pattern in the + `AccessLogValve` that reports the connection status at the + end of the request. Patch provided by Zemian Deng. (markt) + + + 61351: Correctly handle %nn decoding of URL patterns in + web.xml and similar locations that may legitimately contain characters + that are not permitted by RFC 3986. (markt) + + + 61366: Add a new attribute, `localDataSource`, to + the `JDBCStore` that allows the Store to be configured to use + a DataSource defined by the web application rather than the default of + using a globally defined DataSource. Patch provided by Jonathan + Horowitz. (markt) + + + + Coyote + + + 61086: Ensure to explicitly signal an empty request body for + HTTP 205 responses. Additional fix to r1795278. Based on a patch + provided by Alexandr Saperov. (violetagg) + + + 61345: Add a server listener that can be used to do system + property replacement from the property source configured in the + digester. (remm) + + + Add additional logging to record problems that occur while waiting for + the NIO pollers to stop during the Connector stop process. (markt) + + + + Jasper + + + 61364: Ensure that files are closed after detecting encoding + of JSPs so that files do not remain locked by the file system. (markt) + + + + WebSocket + + + 57767: Add support to the WebSocket client for following + redirects when attempting to establish a WebSocket connection. Patch + provided by J Fernandez. (markt) + + + + 2017-07-28 Tomcat 9.0.0.M25 (markt) + Catalina + + + Performance improvements for service loader look-ups (and look-ups of + other class loader resources) when the web application is deployed in a + packed WAR file. (markt) + + + 60963: Add `ExtractingRoot`, a new + `WebResourceRoot` implementation that extracts JARs to the + work directory for improved performance when deploying packed WAR files. + (markt) + + + 61253: Add warn message when Digester.updateAttributes + throws an exception instead of ignoring it. (csutherl) + + + Correct a further regression in the fix for 49464 that could + cause an byte order mark character to appear at the start of content + included by the `DefaultServlet`. (markt) + + + 61313: Make the read timeout configurable in the + `JNDIRealm` and ensure that a read timeout will result in an + attempt to fail over to the alternateURL. Based on patches by Peter + Maloney and Felix Schumacher. (markt) + + + + Web applications + + + Correct the documentation for how `StandardRoot` is + configured. (markt) + + + + Other + + + 61316: Fix corruption of UTF-16 encoded source files in + released source distributions. (markt) + + + + not released Tomcat 9.0.0.M24 (markt) + Catalina + + + 52924: Add support for a Tomcat specific deployment + descriptor, `/WEB-INF/tomcat-web.xml`. This descriptor has an + identical format to `/WEB-INF/web.xml`. The Tomcat descriptor + takes precedence over any settings in `conf/web.xml` but does + not take precedence over any settings in `/WEB-INF/web.xml`. + (markt) + + + 61232: When log rotation is disabled only one separator will + be used when generating the log file name. For example if the prefix is + `catalina.` and the suffix is `.log` then the log + file name will be `catalina.log` instead of + `catalina..log`. Patch provided by Katya Stoycheva. + (violetagg) + + + 61264: Correct a regression in the refactoring to use + `Charset` rather than `String` to store request + character encoding that prevented `getReader()` throwing an + `UnsupportedEncodingException` if the user agent specifies + an unsupported character encoding. (markt) + + + Correct a regression in the fix for 49464 that could cause an + incorrect `Content-Length` header to be sent by the + `DefaultServlet` if the encoding of a static is not + consistent with the encoding of the response. (markt) + + + + Coyote + + + Enable TLS connectors to use Java key stores that contain multiple keys + where each key has a separate password. Based on a patch by Frank + Taffelt. (markt) + + + Improve the handling of HTTP/2 stream resets due to excessive headers + when a continuation frame is used. (markt) + + + + Jasper + + + 53031: Add support for the `fork` option when + compiling JSPs with the Jasper Ant task and javac. (markt) + + + + Other + + + 52791: Add the ability to set the defaults used by the + Windows installer from a configuration file. Patch provided by Sandra + Madden. (markt) + + + + not released Tomcat 9.0.0.M23 (markt) + Catalina + + + 49464: Improve the Default Servlet's handling of static files + when the file encoding is not compatible with the required response + encoding. (markt) + + + 61214: Remove deleted attribute `servlets` from + the Context MBean description. Patch provided by Alexis Hassler. (markt) + + + 61215: Correctly define `addConnectorPort` and + `invalidAuthenticationWhenDeny` in the + `mbean-descriptors.xml` file for the + `org.apache.catalina.valves` package so that the attributes + are accessible via JMX. (markt) + + + 61216: Improve layout for `CompositeData` and + `TabularData` when viewing via the JMX proxy servlet. Patch + provided by Alexis Hassler. (markt) + + + Additional permission for deleting files is granted to JULI as it is + required by FileHandler when running under a Security Manager. The + thread that cleans the log files is marked as daemon thread. + (violetagg) + + + 61229: Correct a regression in 9.0.0.M21 that broke WebDAV + handling for resources with names that included a `&` + character. (markt) + + + + Coyote + + + Restore the ability to configure support for SSLv3. Enabling this + protocol will trigger a warning in the logs since it is known to be + insecure. (markt) + + + Add LoadBalancerDrainingValve, a Valve designed to reduce the amount of + time required for a node to drain its authenticated users. (schultz) + + + Do not log a warning when a `null` session is returned for an + OpenSSL based TLS session since this is expected when session tickets + are enabled. (markt) + + + When the access log valve logs a TLS related request attribute and the + NIO2 connector is used with OpenSSL, ensure that the TLS attributes are + available to the access log valve when the connection is closing. + (markt) + + + 60461: Sync SSL session access for the APR connector. (remm) + + + 61224: Make the `GlobalRequestProcessor` MBean + attributes read-only. Patch provided by Alexis Hassler. (markt) + + + + Jasper + + + 49176: When generating JSP runtime error messages that quote + the relevant JSP source code, switch from using the results of the JSP + page parsing process to using the JSR 045 source map data to identify + the correct part of the JSP source from the stack trace. This + significantly reduces the memory footprint of Jasper in development + mode, provides a small performance improvement for error page generation + and enables source quotes to continue to be provided after a Tomcat + restart. (markt) + + + + Web applications + + + Remove references to the Loader attribute + `searchExternalFirst` from the documentation since the + attribute is no longer supported. (markt) + + + + Tribes + + + 51513: Add support for the `compressionMinSize` + attribute to the `GzipInterceptor`, add optional statistics + collection and expose the Interceptor over JMX. Based on a patch by + Christian Stöber. (markt) + + + 61127Allow human-readable names for channelSendOptions and + mapSendOptions. Patch provided by Igal Sapir. (schultz) + + + + Other + + + Restore the local definition of the web service annotations since the + JRE provided versions are deprecated and Java 9 does not provide them by + default. (markt) + + + Add necessary Java 9 configuration options to the startup scripts to + prevent warnings being generated on web application stop. (markt) + + + + 2017-06-26 Tomcat 9.0.0.M22 (markt) + Catalina + + + 48543: Add the option to specify an alternative file name for + the `catalina.config` system property. Also document that + relative, as well as absolute, URLs are permitted. (markt) + + + 61072: Respect the documentation statements that allow + using the platform default secure random for session id generation. + (remm) + + + Correct the javadoc for + `o.a.c.connector.CoyoteAdapter#parseSessionCookiesId`. + Patch provided by John Andrew (XUZHOUWANG) via Github. (violetagg) + + + 61101: CORS filter should set Vary header in response. + Submitted by Rick Riemer. (remm) + + + 61105: Add a new JULI FileHandler configuration for + specifying the maximum number of days to keep the log files. By default + the log files will be kept 90 days as configured in + `logging.properties`. (violetagg) + + + Update the Servlet 4.0 implementation to add support for setting + trailer fields for HTTP responses. (markt) + + + 61125: Ensure that `WarURLConnection` returns the + correct value for calls to `getLastModified()` as this is + required for the correct detection of JSP modifications when the JSP is + packaged in a WAR file. (markt) + + + Improve the `SSLValve` so it is able to handle client + certificate headers from Nginx. Based on a patch by Lucas Ventura Carro. + (markt) + + + 61134: Do not use '[' and ']' symbols around substituted + text fragments when generating the default error pages. Patch provided + by Katya Todorova. (violetagg) + + + 61154: Allow the Manager and Host Manager web applications to + start by default when running under a security manager. This was + accomplished by adding a custom permission, + `org.apache.catalina.security.DeployXmlPermission`, that + permits an application to use a `META-INF/context.xml` file + and then granting that permission to the Manager and Host Manager. + (markt) + + + 61173: Polish the javadoc for + `o.a.catalina.startup.Tomcat`. Patch provided by + peterhansson_se. (violetagg) + + + A new configuration property `crawlerIps` is added to the + `o.a.catalina.valves.CrawlerSessionManagerValve`. Using this + property one can specify a regular expression that will be used to + identify crawlers based on their IP address. Based on a patch provided + by Tetradeus. (violetagg) + + + 61180: Log a warning message rather than an information + message if it takes more than 100ms to initialised a + `SecureRandom` instance for a web application to use to + generate session identifiers. Patch provided by Piotr Chlebda. (markt) + + + 61185: When an asynchronous request is dispatched via + `AsyncContext.dispatch()` ensure that + `getRequestURI()` for the dispatched request matches that of + the original request. (markt) + + + 61197: Ensure that the charset name used in the + `Content-Type` header has exactly the same form as that + provided by the application. This reverts a behavioural change in + 9.0.0.M21 that caused problems for some clients. (markt) + + + 61201: Ensure that the `SCRIPT_NAME` environment + variable for CGI executables is populated in a consistent way regardless + of how the CGI servlet is mapped to a request. (markt) + + + Ensure to send a space between trailer field name and field value + for HTTP responses trailer fields. (huxing) + + + + Coyote + + + 61086: Explicitly signal an empty request body for HTTP 205 + responses. (markt) + + + 61120: Do not ignore path parameters when processing HTTP/2 + requests. (markt) + + + Revert a change introduced in the fix for bug 60718 that + changed the status code recorded in the access log when the client + dropped the connection from 200 to 500. (markt) + + + Make asynchronous error handling more robust. In particular ensure that + `onError()` is called for any registered + `AsyncListener`s after an I/O error on a non-container + thread. (markt) + + + Add additional syncs to the SSL session object provided by the OpenSSL + engine so that a concurrent destruction cannot cause a JVM crash. + (remm) + + + + Jasper + + + 44787: Improve error message when JSP compiler configuration + options are not valid. (markt) + + + 45931: Extend Jasper's `timeSpaces` option to add + support for `single` which replaces template text that + consists entirely of whitespace with a single space character. Based on + a patch by Meetesh Karia. (markt) + + + 53011: When pre-compiling with JspC, report all compilation + errors rather than stopping after the first error. A new option + `-failFast` can be used to restore the previous behaviour of + stopping after the first error. Based on a patch provided by Marc Pompl. + (markt) + + + 61137: `j.s.jsp.tagext.TagLibraryInfo#uri` and + `j.s.jsp.tagext.TagLibraryInfo#prefix` fields should not be + final. Patch provided by Katya Todorova. (violetagg) + + + + WebSocket + + + Correct the log message when a `MessageHandler` for + `PongMessage` does not implement + `MessageHandler.Whole`. (rjung) + + + Improve thread-safety of `Future`s used to report the result + of sending WebSocket messages. (markt) + + + 61183: Correct a regression in the previous fix for + 58624 that could trigger a deadlock depending on the locking + strategy employed by the client code. (markt) + + + + Web applications + + + Better document the meaning of the trimSpaces option for Jasper. (markt) + + + 61150: Configure the Manager and Host-Manager web + applications to permit serialization and deserialization of + CRSFPreventionFilter related session objects to avoid warning messages + and/or stack traces on web application stop and/or start when running + under a security manager. (markt) + + + Correct the TLS configuration documentation to remove SSLv2 and SSLv3 + from the list of supported protocols. (markt) + + + + Other + + + 45832: Add HTTP DIGEST authentication support to the Catalina + Ant tasks used to communicate with the Manager application. (markt) + + + 45879: Add the `RELEASE-NOTES` file to the root of + the installation created by the Tomcat installer for Windows to make it + easier for users to identify the installed Tomcat version. (markt) + + + 61055: Clarify the code comments in the rewrite valve to make + clear that there are no plans to provide proxy support for this valve + since Tomcat does not have proxy capabilities. (markt) + + + 61076: Document the `altDDName` attribute for the + `Context` element. (markt) + + + Correct typo in Jar Scan Filter Configuration Reference. + Issue reported via comments.apache.org. (violetagg) + + + Correct the requirement for the minimum Java SE version in Application + Developer's Guide. Issue reported via comments.apache.org. (violetagg) + + + 61145: Add missing `@Documented` annotation to + annotations in the annotations API. Patch provided by Katya Todorova. + (markt) + + + 61146: Add missing `lookup()` method to + `@EJB` annotation in the annotations API. Patch provided by + Katya Todorova. (markt) + + + Correct typo in Context Container Configuration Reference. + Patch provided by Katya Todorova. (violetagg) + + + + 2017-05-10 Tomcat 9.0.0.M21 (markt) General @@ -35,10 +1386,10 @@ (markt) - Start to switch to using `Charset` rather than - `String` to store encoding configuration settings to reduce - the number of places the associated `Charset` needs to be - looked up. (markt) + Switch to using `Charset` rather than `String` to + store encoding settings (including for configuration and for the + `Content-Type header`) to reduce the number of places the + associated `Charset` needs to be looked up. (markt) Use a more reliable mechanism for the `DefaultServlet` when @@ -156,8 +1507,8 @@ in order to expose to JMX. (kfujino) - Add JMX support for `Channel Interceptors`.　The Interceptors - that implement jmx support are `TcpFailureDetector`, + Add JMX support for `Channel Interceptors`. The Interceptors + that implement JMX support are `TcpFailureDetector`, `ThroughputInterceptor`, `TcpPingInterceptor`, `StaticMembershipInterceptor`, `MessageDispatchInterceptor` and @@ -2494,7 +3845,7 @@ (markt) - Work around a + Work around a known issue in OpenSSL that does not permit the TLS handshake to be failed if the ALPN negotiation fails. (markt) @@ -3459,5 +4810,5 @@ - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/class-loader-howto.html b/output/webapps/docs/class-loader-howto.html old mode 100755 new mode 100644 index 4797e6c..0426daf --- a/output/webapps/docs/class-loader-howto.html +++ b/output/webapps/docs/class-loader-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Class Loader HOW-TO Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Class Loader HOW-TO Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Class Loader HOW-TO Table of Contents Overview Class Loader Definitions XML Parsers and Java Running under a security manager Overview @@ -225,6 +225,21 @@ http://docs.oracle.com/javase/1.5.0/docs/guide/standards/index.html. For Java 9+, use the upgradeable modules feature. + Tomcat utilizes the endorsed mechanism by including the system property setting +`-Djava.endorsed.dirs=$JAVA_ENDORSED_DIRS` in the +command line that starts the container. The default value of this option is +$CATALINA_HOME/endorsed. This endorsed* directory is not +created by default. Note that the endorsed feature is no longer supported +with Java 9 and the above system property will only be set if either the +directory $CATALINA_HOME/endorsed exists, or the variable +`JAVA_ENDORSED_DIRS` has been set. + + + Note that overriding any JRE component carries risk. If the overriding +component does not provide a 100% compatible API (e.g. the API provided by +Xerces is not 100% compatible with the XML API provided by the JRE) then there +is a risk that Tomcat and/or the deployed application will experience errors. + Running under a security manager When running under a security manager the locations from which classes @@ -245,5 +260,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/cluster-howto.html b/output/webapps/docs/cluster-howto.html old mode 100755 new mode 100644 index ff82446..baf9b1b --- a/output/webapps/docs/cluster-howto.html +++ b/output/webapps/docs/cluster-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Clustering/Session Replication HOW-TO Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Clustering/Session Replication HOW-TO Important Note + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Clustering/Session Replication HOW-TO Important Note You can also check the configuration reference documentation. Table of Contents @@ -198,10 +198,22 @@ sent over the wire and reinstantiated on all the other cluster nodes. Synchronous vs. asynchronous is configured using the `channelSendOptions` flag and is an integer value. The default value for the `SimpleTcpCluster/DeltaManager` combo is - 8, which is asynchronous. You can read more on the send flag(overview) or the - send flag(javadoc). - During async replication, the request is returned before the data has been replicated. async replication yields shorter - request times, and synchronous replication guarantees the session to be replicated before the request returns. + 8, which is asynchronous. + + + For convenience, `channelSendOptions` can be set by name(s) rather than integer, + which are then translated to their integer value upon startup. The valid option names are: + "asynchronous" (alias "async"), "byte_message" (alias "byte"), "multicast", "secure", + "synchronized_ack" (alias "sync"), "udp", "use_ack". Use comma to separate multiple names, + e.g. pass "async, multicast" for the options + `SEND_OPTIONS_ASYNCHRONOUS \| SEND_OPTIONS_MULTICAST`. + + + You can read more on the send flag(overview) or the + send flag(javadoc). + During async replication, the request is returned before the data has been replicated. async + replication yields shorter request times, and synchronous replication guarantees the session + to be replicated before the request returns. Bind session after crash to failover node @@ -665,5 +677,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/comments.html b/output/webapps/docs/comments.html old mode 100755 new mode 100644 index 6e5d510..c3b8b2b --- a/output/webapps/docs/comments.html +++ b/output/webapps/docs/comments.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Documentation User Comments Apache Tomcat 9 - Version 9.0.0.M21, - May 4 2017 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Documentation User Comments Introduction + Version 9.0.4, + Jan 18 2018 Links Docs Home FAQ User Comments User Guide 1) Introduction 2) Setup 3) First webapp 4) Deployer 5) Manager 6) Realms and AAA 7) Security Manager 8) JNDI Resources 9) JDBC DataSources 10) Classloading 11) JSPs 12) SSL/TLS 13) SSI 14) CGI 15) Proxy Support 16) MBeans Descriptors 17) Default Servlet 18) Clustering 19) Load Balancer 20) Connectors 21) Monitoring and Management 22) Logging 23) APR/Native 24) Virtual Hosting 25) Advanced IO 26) Additional Components 27) Mavenized 28) Security Considerations 29) Windows Service 30) Windows Authentication 31) Tomcat's JDBC Pool 32) WebSocket 33) Rewrite Reference Release Notes Configuration Tomcat Javadocs Servlet Javadocs JSP 2.3 Javadocs EL 3.0 Javadocs WebSocket 1.1 Javadocs JK 1.2 Documentation Apache Tomcat Development Building Changelog Status Developers Architecture Functional Specs. Tribes Documentation User Comments Introduction The Tomcat documentation integrates the Apache Comments System. @@ -118,5 +118,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/ajp.html b/output/webapps/docs/config/ajp.html old mode 100755 new mode 100644 index 48d6d27..4cd7d78 --- a/output/webapps/docs/config/ajp.html +++ b/output/webapps/docs/config/ajp.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The AJP Connector Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The AJP Connector Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The AJP Connector Table of Contents Introduction Attributes Common Attributes Standard Implementations Java TCP socket attributes NIO specific configuration NIO2 specific configuration APR/native specific configuration Nested Components Special Features Proxy Support Connector Comparison Introduction @@ -730,5 +730,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/automatic-deployment.html b/output/webapps/docs/config/automatic-deployment.html old mode 100755 new mode 100644 index a21326f..c06eaab --- a/output/webapps/docs/config/automatic-deployment.html +++ b/output/webapps/docs/config/automatic-deployment.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - Automatic Deployment - Use cases Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC Automatic Deployment - Use cases Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC Automatic Deployment - Use cases Table of Contents Introduction Key New files Deleted files Modified files Added files Notes Introduction @@ -536,5 +536,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-channel.html b/output/webapps/docs/config/cluster-channel.html old mode 100755 new mode 100644 index cec8ae0..a780690 --- a/output/webapps/docs/config/cluster-channel.html +++ b/output/webapps/docs/config/cluster-channel.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Channel object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Channel object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Channel object Table of Contents Introduction Nested Components Attributes Common Attributes org.apache.catalina.tribes.group.GroupChannel Attributes Introduction The cluster channel is the main component of a small framework we've nicknamed Apache Tribes. @@ -136,5 +136,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-deployer.html b/output/webapps/docs/config/cluster-deployer.html old mode 100755 new mode 100644 index 757bafc..79cb836 --- a/output/webapps/docs/config/cluster-deployer.html +++ b/output/webapps/docs/config/cluster-deployer.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Deployer object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Deployer object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Deployer object Table of Contents Introduction org.apache.catalina.ha.deploy.FarmWarDeployer Attributes Introduction The Farm War Deployer can deploy and undeploy web applications on the other @@ -103,5 +103,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-interceptor.html b/output/webapps/docs/config/cluster-interceptor.html old mode 100755 new mode 100644 index 2eabc3e..a66f8c3 --- a/output/webapps/docs/config/cluster-interceptor.html +++ b/output/webapps/docs/config/cluster-interceptor.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Channel Interceptor object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Channel Interceptor object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Channel Interceptor object Table of Contents Introduction Available Interceptors Static Membership Attributes Common Attributes org.apache.catalina.tribes.group.interceptors.DomainFilterInterceptor Attributes org.apache.catalina.tribes.group.interceptors.MessageDispatchInterceptor Attributes org.apache.catalina.tribes.group.interceptors.TcpFailureDetector Attributes org.apache.catalina.tribes.group.interceptors.TcpPingInterceptor Attributes org.apache.catalina.tribes.group.interceptors.ThroughputInterceptor Attributes Nested Components StaticMember Attributes Introduction @@ -57,7 +57,7 @@ In addition to dynamic discovery, Apache Tribes also supports static membership, with membership verification. To achieve this add the `org.apache.catalina.tribes.group.interceptors.StaticMembershipInterceptor` - underneath the `org.apache.catalina.tribes.group.interceptors.TcpFailureDetector` interceptor. + after the `org.apache.catalina.tribes.group.interceptors.TcpFailureDetector` interceptor. Inside the `StaticMembershipInterceptor` you can add the static members you wish to have. The `TcpFailureDetector` will do a health check on the static members,and also monitor them for crashes so they will have the same level of notification mechanism as the members that are automatically discovered. @@ -258,5 +258,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-listener.html b/output/webapps/docs/config/cluster-listener.html old mode 100755 new mode 100644 index 7479d42..0bf8a1f --- a/output/webapps/docs/config/cluster-listener.html +++ b/output/webapps/docs/config/cluster-listener.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The ClusterListener object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The ClusterListener object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The ClusterListener object Table of Contents Introduction org.apache.catalina.ha.session.ClusterSessionListener Attributes Common Attributes Introduction @@ -73,5 +73,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-manager.html b/output/webapps/docs/config/cluster-manager.html old mode 100755 new mode 100644 index f9988b9..0e34a76 --- a/output/webapps/docs/config/cluster-manager.html +++ b/output/webapps/docs/config/cluster-manager.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The ClusterManager object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The ClusterManager object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The ClusterManager object Table of Contents Introduction The <Manager> Attributes Common Attributes org.apache.catalina.ha.session.DeltaManager Attributes org.apache.catalina.ha.session.BackupManager Attributes Nested Components Introduction A cluster manager is an extension to Tomcat's session manager interface, @@ -279,5 +279,5 @@ All Manager Implementations Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-membership.html b/output/webapps/docs/config/cluster-membership.html old mode 100755 new mode 100644 index f3024ed..a27330f --- a/output/webapps/docs/config/cluster-membership.html +++ b/output/webapps/docs/config/cluster-membership.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Membership object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Membership object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Membership object Table of Contents Introduction Default Implementation Attributes Multicast Attributes Introduction @@ -159,5 +159,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-receiver.html b/output/webapps/docs/config/cluster-receiver.html old mode 100755 new mode 100644 index 3d0c615..ec7f6ff --- a/output/webapps/docs/config/cluster-receiver.html +++ b/output/webapps/docs/config/cluster-receiver.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Receiver object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Receiver object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Receiver object Table of Contents Introduction Blocking vs Non-Blocking Receiver Attributes Common Attributes NioReceiver BioReceiver Introduction @@ -155,5 +155,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-sender.html b/output/webapps/docs/config/cluster-sender.html old mode 100755 new mode 100644 index 70a96e8..cebea92 --- a/output/webapps/docs/config/cluster-sender.html +++ b/output/webapps/docs/config/cluster-sender.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Sender object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Sender object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Sender object Table of Contents Introduction Concurrent Parallel Delivery Nested Elements Attributes Common Sender Attributes Common Transport Attributes Common PooledSender Attributes Introduction @@ -171,5 +171,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster-valve.html b/output/webapps/docs/config/cluster-valve.html old mode 100755 new mode 100644 index ed4b22e..796bbd5 --- a/output/webapps/docs/config/cluster-valve.html +++ b/output/webapps/docs/config/cluster-valve.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Valve object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Valve object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster Valve object Table of Contents Introduction org.apache.catalina.ha.tcp.ReplicationValve Attributes org.apache.catalina.ha.session.JvmRouteBinderValve Attributes org.apache.catalina.ha.authenticator.ClusterSingleSignOn Attributes Introduction @@ -164,5 +164,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cluster.html b/output/webapps/docs/config/cluster.html old mode 100755 new mode 100644 index b254897..6fd2f9a --- a/output/webapps/docs/config/cluster.html +++ b/output/webapps/docs/config/cluster.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster object Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster object Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cluster object Table of Contents Introduction Security Engine vs Host placement Context Attribute Replication Nested Components Deprecated configuration options Attributes SimpleTcpCluster Attributes Introduction @@ -136,7 +136,15 @@ Note that if you use ASYNC messaging it is possible for update messages for a session to be processed by the receiving nodes in a different order - to the order in which they were sent. + to the order in which they were sent. + + + You may also set these options as a comma separated string, e.g. "async, multicast", which + will be translated into `Channel.SEND_OPTIONS_ASYNCHRONOUS \| Channel.SEND_OPTIONS_MULTICAST` + + The valid option names are "asynchronous" (alias "async"), "byte_message" (alias "byte") + , "multicast", "secure", "synchronized_ack" (alias "sync"), "udp", "use_ack" +
`channelStartOptions`	Sets the start and stop flags for the <Channel> object used by the cluster. The default is `Channel.DEFAULT` which starts all the channel services, such as @@ -172,5 +180,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/context.html b/output/webapps/docs/config/context.html old mode 100755 new mode 100644 index 4f3306c..a55982f --- a/output/webapps/docs/config/context.html +++ b/output/webapps/docs/config/context.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Context Container Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Context Container Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Context Container Table of Contents Introduction Parallel deployment Naming Defining a context Attributes Common Attributes Standard Implementation Nested Components Special Features Logging Access Logs Automatic Context Configuration Context Parameters Environment Entries Lifecycle Listeners Request Filters Resource Definitions Resource Links Transaction Introduction @@ -266,6 +266,10 @@ Note that any setting other than `false` causes Tomcat to behave in a way that is not technically spec-compliant. The default is `false` +
`altDDName`	+ The absolute path to the alternative deployment descriptor for this + context. This overrides the default deployment descriptor located at + `/WEB-INF/web.xml`.
`backgroundProcessorDelay`	This value represents the delay in seconds between the invocation of the backgroundProcess method on this context and @@ -549,21 +553,21 @@ Context. If not specified, a standard default value will be used.
`xmlBlockExternal`	If the value of this flag is `true`, the parsing of - `web.xml`, `web-fragment.xml`, `.tld`, - `.jspx`, `.tagx` and `tagPlugins.xml` - files for this web application will not permit external entities to be - loaded. If not specified, the default value of `true` will - be used. + `web.xml`, `web-fragment.xml`, + `tomcat-web.xml`, `.tld`, `.jspx`, + `.tagx` and `tagPlugins.xml` files for this web + application will not permit external entities to be loaded. If not + specified, the default value of `true` will be used.
`xmlNamespaceAware`	If the value of this flag is `true`, the parsing of - `web.xml` and `web-fragment.xml` files for this - web application will be namespace-aware. Note that `.tld`, - `.jspx` and `.tagx` files are always parsed - using a namespace-aware parser and that the `tagPlugins.xml` - file (if any) is never parsed using a namespace-aware parser. Note also - that if you turn this flag on, you should probably also turn - `xmlValidation` on. If the - `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` + `web.xml`, `web-fragment.xml` and + `tomcat-web.xml` files for this web application will be + namespace-aware. Note that `.tld`, `.jspx` and + `.tagx` files are always parsed using a namespace-aware + parser and that the `tagPlugins.xml` file (if any) is never + parsed using a namespace-aware parser. Note also that if you turn this + flag on, you should probably also turn `xmlValidation` on. If + the `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` system property is set to `true`, the default value of this attribute will be `true`, else the default value will be `false`. @@ -571,8 +575,9 @@ penalty.
`xmlValidation`	If the value of this flag is `true`, the parsing of - `web.xml` and `web-fragment.xml` files for this - web application will use a validating parser. If the + `web.xml`, `web-fragment.xml` and + `tomcat-web.xml` files for this web application will use a + validating parser. If the `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` system property is set to `true`, the default value of this attribute will be @@ -676,7 +681,7 @@ createSubContext(), destroySubContext() or close() will trigger a `javax.naming.OperationNotSupportedException` as required by section EE.5.3.4 of the Java EE specification. This exception can be - disabled by setting this attribute to true in which case any calls to + disabled by setting this attribute to false in which case any calls to modify the JNDI context will return without making any changes and methods that return values will return `null`. If not specified, the specification compliant default of `true` will @@ -818,6 +823,10 @@ to establish default mappings (such as mapping the `.jsp` extension to the corresponding JSP servlet), and other standard features that apply to all web applications. + The web application properties listed in the + `/WEB-INF/tomcat-web.xml` resource for this web application + will be processed (if this resource exists), taking precedence over the + defaults. The web application properties listed in the `/WEB-INF/web.xml` resource for this web application will be processed (if this resource exists). @@ -1215,5 +1224,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/cookie-processor.html b/output/webapps/docs/config/cookie-processor.html old mode 100755 new mode 100644 index fb75b77..dc60cae --- a/output/webapps/docs/config/cookie-processor.html +++ b/output/webapps/docs/config/cookie-processor.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cookie Processor Component Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cookie Processor Component Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Cookie Processor Component Table of Contents Introduction Attributes Common Attributes Standard Implementation Legacy Cookie Processor - org.apache.tomcat.util.http.LegacyCookieProcessor Nested Components Special Features Introduction @@ -170,5 +170,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/credentialhandler.html b/output/webapps/docs/config/credentialhandler.html old mode 100755 new mode 100644 index dd3c3d6..af8be1f --- a/output/webapps/docs/config/credentialhandler.html +++ b/output/webapps/docs/config/credentialhandler.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The CredentialHandler Component Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The CredentialHandler Component Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The CredentialHandler Component Table of Contents Introduction Attributes Common Attributes MessageDigestCredentialHandler NestedCredentialHandler SecretKeyCredentialHandler Nested Components Special Features Introduction @@ -205,5 +205,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/engine.html b/output/webapps/docs/config/engine.html old mode 100755 new mode 100644 index f5c8049..1d28c69 --- a/output/webapps/docs/config/engine.html +++ b/output/webapps/docs/config/engine.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Engine Container Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Engine Container Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Engine Container Table of Contents Introduction Attributes Common Attributes Standard Implementation Nested Components Special Features Logging Access Logs Lifecycle Listeners Request Filters Introduction @@ -257,5 +257,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/executor.html b/output/webapps/docs/config/executor.html old mode 100755 new mode 100644 index cc58bee..6a0189b --- a/output/webapps/docs/config/executor.html +++ b/output/webapps/docs/config/executor.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Executor (thread pool) Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Executor (thread pool) Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Executor (thread pool) Table of Contents Introduction Attributes Common Attributes Standard Implementation Introduction @@ -123,5 +123,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/filter.html b/output/webapps/docs/config/filter.html old mode 100755 new mode 100644 index 5e02a73..ebb1251 --- a/output/webapps/docs/config/filter.html +++ b/output/webapps/docs/config/filter.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - Container Provided Filters Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC Container Provided Filters Table of Contents - Introduction Add Default Character Set Filter Introduction Filter Class Name Initialisation parameters CORS Filter Introduction Filter Class Name Initialisation parameters CORS Filter and HttpServletRequest attributes CSRF Prevention Filter Introduction Filter Class Name Initialisation parameters CSRF Prevention Filter for REST APIs Introduction Basic configuration sample RestCsrfPreventionFilter and HttpServletRequest parameters Filter Class Name Initialisation parameters Expires Filter Introduction Basic configuration sample Alternate Syntax Expiration headers generation eligibility Expiration configuration selection Filter Class Name Initialisation parameters Troubleshooting Failed Request Filter Introduction Filter Class Name Initialisation parameters HTTP Header Security Filter Introduction Filter Class Name Initialisation parameters Remote Address Filter Introduction Filter Class Name Initialisation parameters Example Remote Host Filter Introduction Filter Class Name Initialisation parameters Remote IP Filter Introduction Filter Class Name Basic configuration to handle 'x-forwarded-for' Basic configuration to handle 'x-forwarded-for' and 'x-forwarded-proto' Advanced configuration with internal proxies Advanced configuration with trusted proxies Advanced configuration with internal and trusted proxies Advanced configuration with an untrusted proxy Initialisation parameters Request Dumper Filter Introduction Filter Class Name Initialisation parameters Sample Configuration Set Character Encoding Filter Introduction Filter Class Name Initialisation parameters WebDAV Fix Filter Introduction Filter Class Name Initialisation parameters + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC Container Provided Filters Table of Contents + Introduction Add Default Character Set Filter Introduction Filter Class Name Initialisation parameters CORS Filter Introduction Filter Class Name Initialisation parameters CORS Filter and HttpServletRequest attributes CSRF Prevention Filter Introduction Filter Class Name Initialisation parameters CSRF Prevention Filter for REST APIs Introduction Basic configuration sample RestCsrfPreventionFilter and HttpServletRequest parameters Filter Class Name Initialisation parameters Expires Filter Introduction Basic configuration sample Alternate Syntax Expiration headers generation eligibility Expiration configuration selection Filter Class Name Initialisation parameters Troubleshooting Failed Request Filter Introduction Filter Class Name Initialisation parameters HTTP Header Security Filter Introduction Filter Class Name Initialisation parameters Remote Address Filter Introduction Filter Class Name Initialisation parameters Example Remote Host Filter Introduction Filter Class Name Initialisation parameters Remote IP Filter Introduction Filter Class Name Basic configuration to handle 'x-forwarded-for' Basic configuration to handle 'x-forwarded-for' and 'x-forwarded-proto' Advanced configuration with internal proxies Advanced configuration with trusted proxies Advanced configuration with internal and trusted proxies Advanced configuration with an untrusted proxy Initialisation parameters Request Dumper Filter Introduction Filter Class Name Initialisation parameters Sample Configuration Session Initializer Filter Introduction Filter Class Name Initialisation parameters Sample Configuration Set Character Encoding Filter Introduction Filter Class Name Initialisation parameters WebDAV Fix Filter Introduction Filter Class Name Initialisation parameters Introduction Tomcat provides a number of Filters* which may be @@ -1473,7 +1473,7 @@ - Sample Configuration + Sample Configuration The following entries in a web application's web.xml would enable the Request Dumper filter for all requests for that web application. If the @@ -1502,6 +1502,45 @@ org.apache.catalina.filters.RequestDumperFilter.handlers = \ 1request-dumper.org.apache.juli.FileHandler + Session Initializer Filter + + Introduction + The Session Initializer Filter initializes the `javax.servlet.http.HttpSession` + before the Request is processed. This is required for JSR-356 compliant WebSocket implementations, + if the `HttpSession` is needed during the HandShake phase. + + The Java API for WebSocket does not mandate that an `HttpSession` would + be initialized upon request, and thus `javax.servlet.http.HttpServletRequest`'s + `getSession()` returns `null` if the `HttpSession` was not + initialized in advance. + + This filter solves that problem by initializing the HttpSession for any `HttpServletRequest` + that matches its `url-pattern`. + + + Filter Class Name + The filter class name for the Session Initializer Filter is + `org.apache.catalina.filters.SessionInitializerFilter`. + + + Initialisation parameters + The Session Initializer Filter does not support any initialization parameters. + + + Sample Configuration + The following entries in the Web Application Deployment Descriptor, web.xml, + would enable the Session Initializer Filter for requests that match the given URL pattern + (in this example, "/ws/"). + + `<filter> + <filter-name>SessionInitializer</filter-name> + <filter-class>org.apache.catalina.filters.SessionInitializerFilter</filter-class> +</filter> +<filter-mapping> + <filter-name>SessionInitializer</filter-name> + <url-pattern>/ws/</url-pattern> +</filter-mapping>` + Set Character Encoding Filter Introduction @@ -1590,5 +1629,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/globalresources.html b/output/webapps/docs/config/globalresources.html old mode 100755 new mode 100644 index b65e465..5199b02 --- a/output/webapps/docs/config/globalresources.html +++ b/output/webapps/docs/config/globalresources.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The GlobalNamingResources Component Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The GlobalNamingResources Component Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The GlobalNamingResources Component Table of Contents Introduction Attributes Nested Components Special Features Environment Entries Resource Definitions Resource Links Transaction Introduction @@ -167,7 +167,7 @@ it is no longer required. This is intended to speed up clean-up of resources that would otherwise happen as part of garbage collection. This attribute is ignored if the `singleton` attribute is - false. If not specificed, no default is defined and no close method will + false. If not specified, no default is defined and no close method will be called. For Apache Commons DBCP and Apache Tomcat JDBC connection pools you can use `closeMethod="close"`. @@ -254,5 +254,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/host.html b/output/webapps/docs/config/host.html old mode 100755 new mode 100644 index 0682faa..3f39eea --- a/output/webapps/docs/config/host.html +++ b/output/webapps/docs/config/host.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Host Container Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Host Container Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Host Container Table of Contents Introduction Attributes Common Attributes Standard Implementation Nested Components Special Features Logging Access Logs Automatic Application Deployment Host Name Aliases Lifecycle Listeners Request Filters Single Sign On User Web Applications Introduction @@ -234,7 +234,13 @@ fail to start in case the descriptor contains necessary configuration for secure deployment (such as a RemoteAddrValve) which should not be ignored. The flag's value defaults to `true` unless a - security manager is enabled when the default is `false`. + security manager is enabled when the default is `false`. + When running under a security manager this may be enabled on a per web + application basis by granting the + `org.apache.catalina.security.DeployXmlPermission` to the web + application. The Manager and Host Manager applications are granted this + permission by default so that they continue to work when running under a + security manager.
`errorReportValveClass`	Java class name of the error reporting valve which will be used by this Host. The responsibility of this valve is to output error @@ -258,6 +264,12 @@ is not running. Any such change will trigger the deletion of the expanded directory and the deployment of the updated WAR file when Tomcat next starts. + Note: Running with this option set to `false` will incur + a performance penalty. To avoid a significant performance penalty, the + web application should be configured such that class scanning for + Servlet 3.0+ pluggability features is not required. Users may also wish + to consider the ExtractingRoot + Resources implementation.
`workDir`	Pathname to a scratch directory to be used by applications for this Host. Each application will have its own sub directory with @@ -614,5 +626,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/http.html b/output/webapps/docs/config/http.html old mode 100755 new mode 100644 index 9d5ed5c..5a9bf31 --- a/output/webapps/docs/config/http.html +++ b/output/webapps/docs/config/http.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The HTTP Connector Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The HTTP Connector Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The HTTP Connector Table of Contents Introduction Attributes Common Attributes Standard Implementation Java TCP socket attributes NIO specific configuration NIO2 specific configuration APR/native specific configuration Nested Components Special Features HTTP/1.1 and HTTP/1.0 Support HTTP/2 Support Proxy Support SSL Support SSL Support - SSLHostConfig SSL Support - Certificate SSL Support - Connector - NIO and NIO2 SSL Support - Connector - NIO and NIO2 (deprecated) SSL Support - Connector - APR/Native (deprecated) Connector Comparison Introduction @@ -275,6 +275,11 @@ `0.0.0.0` and will listen on IPv6 addresses (and optionally IPv4 addresses depending on the setting of ipv6onlyv6) if configured with `::`. +
`allowHostHeaderMismatch`	+ By default Tomcat will reject requests that specify a host in the + request line but specify a different host in the host header. This + chekc can be disabled by setting this attribute to `false`. If + not specified, the default is `true`.
`allowedTrailerHeaders`	By default Tomcat will ignore all trailer headers when processing chunked input. For a header to be processed, it must be added to this @@ -447,6 +452,12 @@ the maxThreads setting. If using Servlet 3.0 asynchronous processing, a good default is to use the larger of maxThreads and the maximum number of expected concurrent requests (synchronous and asynchronous). +
`rejectIllegalHeaderName`	+ If an HTTP request is received that contains an illegal header name + (i.e. the header name is not a token) this setting determines if the + request will be rejected with a 400 response (`true`) or if the + illegal header be ignored (`false`). The default value is + `true` which will cause the request to be rejected.
`restrictedUserAgents`	The value is a regular expression (using `java.util.regex`) matching the `user-agent` header of HTTP clients for which @@ -998,8 +1009,12 @@ compression then the default for that OpenSSL version will be used.
`disableSessionTickets`	OpenSSL only. - Disables use of TLS Session Tickets (RFC 4507) if set to - `true`. Default is `false`. + Disables use of TLS session tickets (RFC 5077) if set to + `true`. Default is `false`. Note that when TLS + session tickets are in use, the full peer certificate chain will only be + available on the first connection. Subsequent connections (that use a + ticket to estrablish the TLS session) will only have the peer certificate, + not the full chain.
`honorCipherOrder`	Set to `true` to enforce the server's cipher order (from the `ciphers` setting) instead of allowing @@ -1026,8 +1041,8 @@ The names of the protocols to support when communicating with clients. This should be a list of any combination of the following: - SSLv2Hello SSLv2 SSLv3 TLSv1 - TLSv1.1 TLSv1.2 all + SSLv2Hello SSLv3 TLSv1 TLSv1.1 + TLSv1.2 all Each token in the list can be prefixed with a plus sign ("+") or a minus sign ("-"). A plus sign adds the protocol, a minus sign removes it form the current list. The list is built starting from @@ -1542,5 +1557,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/http2.html b/output/webapps/docs/config/http2.html old mode 100755 new mode 100644 index 019b5fc..2be52dd --- a/output/webapps/docs/config/http2.html +++ b/output/webapps/docs/config/http2.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The HTTP2 Upgrade Protocol Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The HTTP2 Upgrade Protocol Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The HTTP2 Upgrade Protocol Table of Contents Introduction Attributes Common Attributes Standard Implementation Nested Components Special Features Introduction @@ -75,6 +75,40 @@ By default Tomcat will ignore all trailer headers when processing HTTP/2 connections. For a header to be processed, it must be added to this comma-separated list of header names. +
`compressibleMimeType`	+ The value is a comma separated list of MIME types for which HTTP + compression may be used. + The default value is + `+ text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml +`. + +
`compression`	+ The HTTP/2 protocol may use compression in an attempt to save server + bandwidth. The acceptable values for the parameter is "off" (disable + compression), "on" (allow compression, which causes text data to be + compressed), "force" (forces compression in all cases), or a numerical + integer value (which is equivalent to "on", but specifies the minimum + amount of data before the output is compressed). If the content-length is + not known and compression is set to "on" or more aggressive, the output + will also be compressed. If not specified, this attribute is set to + "off". + Note: There is a tradeoff between using compression (saving + your bandwidth) and using the sendfile feature (saving your CPU cycles). + If the connector supports the sendfile feature, e.g. the NIO2 connector, + using sendfile will take precedence over compression. The symptoms will + be that static files greater that 48 Kb will be sent uncompressed. + You can turn off sendfile by setting `useSendfile` attribute + of the protocol, as documented below, or change the sendfile usage + threshold in the configuration of the + DefaultServlet in the default + `conf/web.xml` or in the `web.xml` of your web + application. + +
`compressionMinSize`	+ If compression is set to "on" then this attribute + may be used to specify the minimum amount of data before the output is + compressed. If not specified, this attribute is defaults to "2048".
`initialWindowSize`	Controls the initial size of the flow control window for streams that Tomcat advertises to clients. If not specified, the default value of @@ -121,11 +155,21 @@ header. A request that contains a set of trailer headers that requires more than the specified limit will be rejected. A value of less than 0 means no limit. If not specified, a default of 8192 is used. +
`noCompressionUserAgents`	+ The value is a regular expression (using `java.util.regex`) + matching the `user-agent` header of HTTP clients for which + compression should not be used, + because these clients, although they do advertise support for the + feature, have a broken implementation. + The default value is an empty String (regexp matching disabled).
`readTimeout`	The time, in milliseconds, that Tomcat will wait for additional data when a partial HTTP/2 frame has been received. Negative values will be treated as an infinite timeout. If not specified, a default value of `10000` will be used. +
`useSendfile`	+ Use this boolean attribute to enable or disable sendfile capability. + The default value is `true`.
`writeTimeout`	The time, in milliseconds, that Tomcat will wait to write additional data when an HTTP/2 frame has been partially written. Negative values will @@ -166,5 +210,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/index.html b/output/webapps/docs/config/index.html old mode 100755 new mode 100644 index 4069815..544655a --- a/output/webapps/docs/config/index.html +++ b/output/webapps/docs/config/index.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - Overview Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC Overview Overview + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC Overview Overview This manual contains reference information about all of the configuration directives that can be included in a `conf/server.xml` file to @@ -103,5 +103,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/jar-scan-filter.html b/output/webapps/docs/config/jar-scan-filter.html old mode 100755 new mode 100644 index 129ad69..e4d9ad3 --- a/output/webapps/docs/config/jar-scan-filter.html +++ b/output/webapps/docs/config/jar-scan-filter.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Jar Scan Filter Component Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Jar Scan Filter Component Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Jar Scan Filter Component Table of Contents Introduction Attributes Common Attributes Standard Implementation Nested Components Special Features Introduction @@ -161,10 +161,10 @@ Nested Components - No components may be nested inside a Jar Scanner element. + No components may be nested inside a Jar Scan Filter element. Special Features - No special features are associated with a Jar Scanner + No special features are associated with a Jar Scan Filter element. Comments @@ -179,5 +179,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic. - Copyright © 1999-2017, The Apache Software Foundation + Copyright © 1999-2018, The Apache Software Foundation \ No newline at end of file diff --git a/output/webapps/docs/config/jar-scanner.html b/output/webapps/docs/config/jar-scanner.html old mode 100755 new mode 100644 index 51bd975..3290d7c --- a/output/webapps/docs/config/jar-scanner.html +++ b/output/webapps/docs/config/jar-scanner.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Jar Scanner Component Apache Tomcat 9 Configuration Reference - Version 9.0.0.M21, - May 4 2017 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Jar Scanner Component Table of Contents + Version 9.0.4, + Jan 18 2018 Links Docs Home Config Ref. Home FAQ User Comments Top Level Elements Server Service Executors Executor Connectors HTTP/1.1 HTTP/2 AJP Containers Context Engine Host Cluster Nested Components CookieProcessor CredentialHandler Global Resources JarScanner JarScanFilter Listeners Loader Manager Realm Resources SessionIdGenerator Valve Cluster Elements Cluster Manager Channel Channel/Membership Channel/Sender Channel/Receiver Channel/Interceptor Valve Deployer ClusterListener web.xml Filter Other System properties JASPIC The Jar Scanner Component Table of Contents Introduction Attributes Common Attributes Standard Implementation Nested Components Special Features Introduction @@ -111,7 +111,7 @@ files. The default is `false`.
`scanManifest`	If `true`, the Manifest files of any JARs found will be - scanned for additional class path entires and those entries will be added + scanned for additional class path entries and those entries will be added to the URLs to scan. The default is `true`.

+ +

${pageContext.servletContext.serverInfo}

If you're seeing this, you've successfully installed Tomcat. Congratulations!

Developer Quick Start

Tomcat Setup

First Web Application

Realms & AAA

JDBC DataSources

Examples

Servlet Specifications

Tomcat Versions

+
+

Managing Tomcat

For security, access to the manager webapp is restricted. + Users are defined in:

$CATALINA_HOME/conf/tomcat-users.xml

In Tomcat 9.0 access to the manager application is split between + different users. Read more...

+
+

Documentation

Getting Help

FAQ and Mailing Lists

The following mailing lists are available:

tomcat-announce
+ Important announcements, releases, security vulnerability notifications. (Low volume). +
tomcat-users
+ User support and discussion +
taglibs-user
+ User support and discussion for Apache Taglibs +
tomcat-dev
+ Development mailing list, including commit messages +

+
+

Other Downloads

Get Involved

Miscellaneous

Apache Software Foundation

+
+

Deployment

+ Version 9.0.4, + Jan 18 2018

Background

@@ -240,5 +240,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Preface

+ Version 9.0.4, + Jan 18 2018

Preface

This manual includes contributions from many members of the Tomcat Project developer community. The following authors have provided significant content: @@ -83,5 +83,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Installation

+ Version 9.0.4, + Jan 18 2018

Installation

In order to use Tomcat for developing web applications, you must first install it (and the software it depends on). The required steps are outlined @@ -39,7 +39,7 @@

JDK

Tomcat 9.0 was designed to run on Java SE 7. +

Tomcat 9.0 was designed to run on Java SE 8 or later.

Compatible JDKs for many platforms (or links to where they can be found) @@ -111,5 +111,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/appdev/introduction.html b/output/webapps/docs/appdev/introduction.html old mode 100755 new mode 100644 index cf41870..10cbf77 --- a/output/webapps/docs/appdev/introduction.html +++ b/output/webapps/docs/appdev/introduction.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Introduction

Introduction

Overview

+ Version 9.0.4, + Jan 18 2018

Introduction

Overview

Congratulations! You've decided to (or been told to) learn how to build web applications using servlets and JSP pages, and picked the @@ -70,9 +70,8 @@ and packaging JSP pages (Appendix A) is useful. The Javadoc API Documentation is included in the specification, and with the Tomcat download.

- -

http://jcp.org/aboutJava/communityprocess/final/jsr340/index.html - - Servlet API Specification, Version 3.1. Describes the +

https://jcp.org/aboutJava/communityprocess/final/jsr369/index.html - + Servlet API Specification, Version 4.0. Describes the programming environment that must be provided by all servlet containers conforming to this specification. In particular, you will need this document to understand the web application @@ -97,5 +96,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/appdev/processes.html b/output/webapps/docs/appdev/processes.html old mode 100755 new mode 100644 index 6f25c0e..ee76ec5 --- a/output/webapps/docs/appdev/processes.html +++ b/output/webapps/docs/appdev/processes.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Development Processes

Development Processes

+ Version 9.0.4, + Jan 18 2018

Development Processes

Development Processes

Development Processes

@@ -311,5 +311,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/appdev/sample/build.xml b/output/webapps/docs/appdev/sample/build.xml old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/docs/README.txt b/output/webapps/docs/appdev/sample/docs/README.txt old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/index.html b/output/webapps/docs/appdev/sample/index.html old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/sample.war b/output/webapps/docs/appdev/sample/sample.war old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/src/mypackage/Hello.java b/output/webapps/docs/appdev/sample/src/mypackage/Hello.java old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/web/WEB-INF/web.xml b/output/webapps/docs/appdev/sample/web/WEB-INF/web.xml old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/web/hello.jsp b/output/webapps/docs/appdev/sample/web/hello.jsp old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/web/images/tomcat.gif b/output/webapps/docs/appdev/sample/web/images/tomcat.gif old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/sample/web/index.html b/output/webapps/docs/appdev/sample/web/index.html old mode 100755 new mode 100644 diff --git a/output/webapps/docs/appdev/source.html b/output/webapps/docs/appdev/source.html old mode 100755 new mode 100644 index d9fd350..e3352f9 --- a/output/webapps/docs/appdev/source.html +++ b/output/webapps/docs/appdev/source.html @@ -1,5 +1,5 @@ -Application Developer's Guide (9.0.0.M21) - Source Organization

Source Organization

+ Version 9.0.4, + Jan 18 2018

Source Organization

Directory Structure
1. External Dependencies
Source Code Control
BUILD.XML Configuration File

Directory Structure

@@ -317,5 +317,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/appdev/web.xml.txt b/output/webapps/docs/appdev/web.xml.txt old mode 100755 new mode 100644 diff --git a/output/webapps/docs/apr.html b/output/webapps/docs/apr.html old mode 100755 new mode 100644 index d127c9b..11cceab --- a/output/webapps/docs/apr.html +++ b/output/webapps/docs/apr.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Apache Portable Runtime (APR) based Native library for Tomcat

Apache Portable Runtime (APR) based Native library for Tomcat

+ Version 9.0.4, + Jan 18 2018

Apache Portable Runtime (APR) based Native library for Tomcat

Introduction
Installation
1. Windows
2. Linux
APR Components
APR Lifecycle Listener Configuration
APR Connectors Configuration
1. HTTP/HTTPS
2. AJP

Introduction

@@ -169,5 +169,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/architecture/index.html b/output/webapps/docs/architecture/index.html old mode 100755 new mode 100644 index 53ed490..bafe2a6 --- a/output/webapps/docs/architecture/index.html +++ b/output/webapps/docs/architecture/index.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Architecture (9.0.0.M21) - Table of Contents

Preface

+ Version 9.0.4, + Jan 18 2018

Preface

This section of the Tomcat documentation attempts to explain the architecture and design of the Tomcat server. It includes significant @@ -73,5 +73,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/architecture/overview.html b/output/webapps/docs/architecture/overview.html old mode 100755 new mode 100644 index 687f5bc..df070ab --- a/output/webapps/docs/architecture/overview.html +++ b/output/webapps/docs/architecture/overview.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Architecture (9.0.0.M21) - Architecture Overview

Architecture Overview

Overview

+ Version 9.0.4, + Jan 18 2018

Architecture Overview

Overview

This page provides an overview of the Tomcat server architecture.

@@ -142,5 +142,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/architecture/requestProcess.html b/output/webapps/docs/architecture/requestProcess.html old mode 100755 new mode 100644 index 83920f5..ff0b00d --- a/output/webapps/docs/architecture/requestProcess.html +++ b/output/webapps/docs/architecture/requestProcess.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Architecture (9.0.0.M21) - Request Process Flow

Request Process Flow

+ Version 9.0.4, + Jan 18 2018

Request Process Flow

This page describes the process used by Tomcat to handle @@ -81,5 +81,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/architecture/requestProcess/authentication-process.png b/output/webapps/docs/architecture/requestProcess/authentication-process.png old mode 100755 new mode 100644 diff --git a/output/webapps/docs/architecture/requestProcess/request-process.png b/output/webapps/docs/architecture/requestProcess/request-process.png old mode 100755 new mode 100644 diff --git a/output/webapps/docs/architecture/startup.html b/output/webapps/docs/architecture/startup.html old mode 100755 new mode 100644 index 7fec6b5..316de37 --- a/output/webapps/docs/architecture/startup.html +++ b/output/webapps/docs/architecture/startup.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Architecture (9.0.0.M21) - Startup

Startup

Server Startup

+ Version 9.0.4, + Jan 18 2018

Startup

Server Startup

This page describes how the Tomcat server starts up. There are several @@ -80,5 +80,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/architecture/startup/serverStartup.pdf b/output/webapps/docs/architecture/startup/serverStartup.pdf old mode 100755 new mode 100644 diff --git a/output/webapps/docs/architecture/startup/serverStartup.txt b/output/webapps/docs/architecture/startup/serverStartup.txt old mode 100755 new mode 100644 diff --git a/output/webapps/docs/balancer-howto.html b/output/webapps/docs/balancer-howto.html old mode 100755 new mode 100644 index 0827edb..7ca8ac2 --- a/output/webapps/docs/balancer-howto.html +++ b/output/webapps/docs/balancer-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Load Balancer HOW-TO

Load Balancer HOW-TO

+ Version 9.0.4, + Jan 18 2018

Load Balancer HOW-TO

Using the JK 1.2.x native connector
Using Apache HTTP Server 2.x with mod_proxy

Using the JK 1.2.x native connector

@@ -57,5 +57,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/building.html b/output/webapps/docs/building.html old mode 100755 new mode 100644 index eb30537..082140f --- a/output/webapps/docs/building.html +++ b/output/webapps/docs/building.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Building Tomcat

Building Tomcat

+ Version 9.0.4, + Jan 18 2018

Building Tomcat

Introduction
Download a Java Development Kit (JDK) version 8
Install Apache Ant 1.9.5 or later
Checkout or obtain the Tomcat source code
Configure download area
Building Tomcat
Building with Eclipse
Building with other IDEs

Introduction

@@ -274,5 +274,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/cgi-howto.html b/output/webapps/docs/cgi-howto.html old mode 100755 new mode 100644 index 1c17ad2..437a65c --- a/output/webapps/docs/cgi-howto.html +++ b/output/webapps/docs/cgi-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - CGI How To

CGI How To

+ Version 9.0.4, + Jan 18 2018

CGI How To

Introduction
Installation
Configuration

Introduction

@@ -93,6 +93,14 @@ By default there is no value, which results in the web application root directory being used as the search path. The recommended value is WEB-INF/cgi +

enableCmdLineArguments - Are command line parameters +generated from the query string as per section 4.4 of 3875 RFC? The default is +false.

environment-variable- - An environment to be set for the +execution environment of the CGI script. The name of variable is taken from the +parameter name. To configure an environment variable named FOO, configure a +parameter named environment-variable-FOO. The parameter value is used as the +environment variable value. The default is no environment variables.

executable - The name of the executable to be used to run the script. You may explicitly set this parameter to be an empty string if your script is itself executable (e.g. an exe file). Default is @@ -118,6 +126,16 @@ is 2000.

Changelog

Tomcat 9.0.0.M21 (markt)

+Apache Tomcat 9 (9.0.4) - Changelog

Changelog

Tomcat 9.0.4 (markt)

Catalina

+ Correct a regression in the previous fix for 61916 that meant + that any call to addHeader() would have been replaced with + a call to setHeader() for all requests mapped to the + AddDefaultCharsetFilter. (markt) +
+ 61999: maxSavePostSize set to 0 should disable saving POST + data during authentication. (remm) +

Coyote

+ Fix NIO2 HTTP/2 sendfile. (remm) +
+ 61993: Improve handling for ByteChunk and + CharChunk instances that grow close to the maximum size + allowed by the JRE. (markt) +

Jasper

+ 43925: Add a new system property + (org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE) to + control the size of the buffer used by Jasper when buffering tag bodies. + (markt) +

Web applications

+ 62006: Document the new JvmOptions9 command line + parameter for tomcat9.exe. (markt) +

not released Tomcat 9.0.3 (markt)

Catalina

+ 57619: Implement a small optimisation to how JAR URLs are + processed to reduce the storage of duplicate String objects in memory. + Patch provided by Dmitri Blinov. (markt) +
+ Add some missing NPEs to ServletContext. (remm) +
+ Update the Java EE 8 XML schema to the released versions. (markt) +
+ Minor HTTP/2 push fixes. (remm) +
+ 61916: Extend the AddDefaultCharsetFilter to add + a character set when the content type is set via + setHeader() or addHeader() as well as when it + is set via setContentType(). (markt) +
+ When using WebDAV to copy a file resource to a destination that requires + a collection to be overwritten, ensure that the operation succeeds + rather than fails (with a 500 response). This enables Tomcat to pass two + additional tests from the Litmus WebDAV test suite. (markt) +
+ Modify the Default and WebDAV Servlets so that a 405 status code is + returned for PUT and DELETE requests when + disabled via the readonly initialisation parameter. +
+ Align the contents of the Allow header with the response + code for the Default and WebDAV Servlets. For any given resource a + method that returns a 405 status code will not be listed in the + Allow header and a method listed in the Allow + header will not return a 405 status code. (markt) +

Coyote

+ 60276: Implement GZIP compression support for responses + served over HTTP/2. (markt) +
+ Do not call onDataAvailable without any data to read. (remm) +
+ Correctly handle EOF when ServletInputStream.isReady() is + called. (markt) +
+ 61886: Log errors on non-container threads at + DEBUG rather than INFO. The exception will be + made available to the application via the asynchronous error handling + mechanism. (markt) +
+ 61914: Possible NPE with Java 9 when creating a SSL engine. + Patch submitted by Evgenij Ryazanov. (remm) +
+ 61918: Fix connectionLimitLatch counting when closing an + already closed socket. Based on a patch by Ryan Fong. (remm) +
+ Add support for the OpenSSL ARIA ciphers to the OpenSSL to JSSE + cipher mapping. (markt) +
+ 61932: Allow a call to AsyncContext.dispatch() + to terminate non-blocking I/O. (markt) +
+ 61948: Improve the handling of malformed ClientHello messages + in the code that extracts the SNI information from a TLS handshake for + the JSSE based NIO and NIO2 connectors. (markt) +
+ Fix NIO2 handshaking with a full input buffer. (remm) +
+ Return a simple, plain text error message if a client attempts to make a + plain text HTTP connection to a TLS enabled NIO or NIO2 Connector. + (markt) +

Jasper

+ 61854: When using sets and/or maps in EL expressions, ensure + that Jasper correctly parses the expression. Patch provided by Ricardo + Martin Camarero. (markt) +
+ Improve the handling of methods with varargs in EL expressions. In + particular, the calling of a varargs method with no parameters now works + correctly. Based on a patch by Nitkalya (Ing) Wiriyanuparb. (markt) +
+ 61945: Fix prototype mode used to compile tags. (remm) +

Web applications

+ 61223: Add the mbeans-descriptors.dtd file to the custom + MBean documentation so users have a reference to use when constructing + mbeans-descriptors.xml files for custom components. (markt) +
+ 61565: Add the ability to trigger a reloading of TLS host + configuration (certificate and key files, server.xml is not re-parsed) + via the Manager web application. (markt) +
+ 61566: Expose the currently in use certificate chain and list + of trusted certificates for all virtual hosts configured using the JSSE + style (keystore) TLS configuration via the Manager web application. + (markt) +
+ Partial fix for 61886. Ensure that multiple threads do not + attempt to complete the AsyncContext if an I/O error occurs + in the stock ticker example Servlet. (markt) +
+ 61886: Prevent ConcurrentModificationException + when running the asynchronous stock ticker in the examples web + application. (markt) +
+ 61886: Prevent NullPointerException and other + errors if the stock ticker example is running when the examples web + application is stopped. (markt) +
+ 61910: Clarify the meaning of the allowLinking + option in the documentation web application. (markt) +
+ Add OCSP configuration information to the SSL How-To. Patch provided by + Marek Czernek. (markt) +

jdbc-pool

+ 61312: Prevent NullPointerExceptionn when using + the statement cache of connection that has been closed. (kfujino) +

Other

+ Add an additional system property for the system property replacement. + (remm) +
+ Add missing SHA-512 hash for release artifacts to the build script. + (markt) +
+ Update the internal fork of Commons Pool 2 to 2.4.3. (markt) +
+ Update the internal fork of Commons DBCP 2 to 8a71764 (2017-10-18) to + pick up some bug fixes and enhancements. (markt) +
+ Update the internal fork of Commons FileUpload to 6c00d57 (2017-11-23) + to pick up some code clean-up. (markt) +
+ Update the internal fork of Commons Codec to r1817136 to pick up some + code clean-up. (markt) +
+ The native source bundles (for Commons Daemon and Tomcat Native) are no + longer copied to the bin directory for the deploy target. They are now + only copied to the bin directory for the release target. (markt) +

2017-11-30 Tomcat 9.0.2 (markt)

Catalina

+ Fix possible SecurityException when using TLS related + request attributes. (markt) +
+ 61597: Extend the StandardJarScanner to scan + JARs on the module path when running on Java 9 and class path scanning + is enabled. (markt) +
+ 61601: Add support for multi-release JARs in JAR scanning and + web application class loading. (markt) +
+ 61681: Allow HTTP/2 push when using request wrapping. (remm) +
+ Provide the SessionInitializerFilter that can be used to + ensure that an HTTP session exists when initiating a WebSocket + connection. Patch provided by isapir. (markt) +
+ 61682: When re-prioritising HTTP/2 streams, ensure that both + parent and children fields are correctly updated to avoid a possible + StackOverflowError. (markt) +
+ Improve concurrency by reducing the scope of the synchronisation for + javax.security.auth.message.config.AuthConfigFactory in the + JASPIC API implementation. Based on a patch by Pavan Kumar. (markt) +
+ Avoid a possible NullPointerException when timing out + AsyncContext instances during shut down. (markt) +
+ 61777: Avoid a NullPointerException when + detaching a JASPIC RegistrationListener. Patch provided by + Lazar. (markt) +
+ 61778: Correct the return value when detaching a JASPIC + RegistrationListener. Patch provided by Lazar. (markt) +
+ 61779: Avoid a NullPointerException when a + null RegistrationListener is passed to + AuthConfigFactory.getConfigProvider(). Patch provided by + Lazar. (markt) +
+ 61780: Only include the default JASPIC registration ID in the + return value for a call to + AuthConfigFactory.getRegistrationIDs() if a + RegistrationContext has been registered using the default + registration ID. Patch provided by Lazar. (markt) +
+ 61781: Enable JASPIC provider registrations to be persisted + when the layer and/or application context are null. Patch + provided by Lazar. (markt) +
+ 61782: When calling + AuthConfigFactory.doRegisterConfigProvider() and the + requested JASPIC config provider class is found by the web application + class loader, do not attempt to load the class with the class loader + that loaded the JASPIC API. Patch provided by Lazar. (markt) +
+ 61783: When calling + AuthConfigFactory.removeRegistration() and the registration + is persistent, it should be removed from the persistent store. Patch + provided by Lazar. (markt) +
+ 61784: Correctly handle the case when + AuthConfigFactoryImpl.registerConfigProvider() is called + with a provider name of null. Patch provided by Lazar. + (markt) +
+ 61795: Add a property to the Authenticator + implementations to enable a custom JASPIC CallbackHandler + to be specified. Patch provided by Lazar. (markt) +

Coyote

+ 61568: Avoid a potential SecurityException when + using the NIO2 connector and a new thread is added to the pool. (markt) +
+ 61583: Correct a further regression in the fix to enable the + use of Java key stores that contained multiple keys that did not all + have the same password. This fixes PKCS11 key store handling with + multiple keys selected with an alias. (markt) +
+ Improve NIO2 syncing for async IO operations. (remm) +
+ Sendfile support for HTTP/2 and NIO2. (remm) +
+ Reduce default HTTP/2 stream concurrent execution within a connection + from 200 to 20. (remm) +
+ 61668: Avoid a possible NPE when calling + AbstractHttp11Protocol.getSSLProtocol(). (markt) +
+ 61673: Avoid a possible + ConcurrentModificationException when working with the + streams associated with a connection. (markt) +
+ 61719: Avoid possible NPE calling + InputStream.setReadListener with HTTP/2. (remm) +
+ 61736: Improve performance of NIO connector when clients + leave large time gaps between network packets. Patch provided by Zilong + Song. (markt) +
+ 61740: Correct an off-by-one error in the Hpack header index + validation that caused intermittent request failures when using HTTP/2. + (markt) +

Jasper

+ 61604: Fix SMAP generation for JSPs that generate no output. + (markt) +
+ 61816: Invalid expressions in attribute values or template + text should trigger a translation (compile time) error, not a run time + error. (markt) +

WebSocket

+ 61604: Add support for authentication in the websocket + client. Patch submitted by J Fernandez. (remm) +

Web applications

+ Correct Javadoc links to point to Java SE 8 and Java EE 8. (markt) +
+ Enable Javadoc to be built with Java 9. (markt) +
+ 61603: Add XML filtering for the status servlet output where + needed. (remm) +
+ Correct the description of how the CGI servlet maps a request to a + script in the CGI How-To. (markt) +

Tribes

+ Fix incorrect behavior that attempts to resend channel messages more + than the actual setting value of maxRetryAttempts. + (kfujino) +
+ Ensure that the remaining Sender can send channel messages by avoiding + unintended ChannelException caused by comparing the number + of failed members and the number of remaining Senders. (kfujino) +
+ Ensure that remaining SelectionKeys that were not handled by throwing a + ChannelException during SelectionKey processing are + handled. (kfujino) +

Other

+ Improve the fix for 61439 and exclude the JPA, JAX-WS and EJB + annotations completely from the Tomcat distributions. (markt) +
+ Improve handling of endorsed directories. The endorsed directory + mechanism will only be used if the JAVA_ENDORSED_DIRS + system property is explicitly set or if + $CATALINA_HOME/endorsed exists. When running on Java 9, any + such attempted use of the endorsed directory mechanism will trigger an + error and Tomcat will fail to start. (rjung) +
+ 51496: When using the Windows installer, check if the + requested service name already exists and, if it does, prompt the user + to select an alternative service name. Patch provided by Ralph + Plawetzki. (markt) +
+ 61590: Enable service.bat to recognise when + JAVA_HOME is configured for a Java 9 JDK. (markt) +
+ 61598: Update the Windows installer to search the new (as of + Java 9) registry locations when looking for a JRE. (markt) +
+ Add generation of a SHA-512 hash for release artifacts to the build + script. (markt) +
+ 61658: Update MIME mappings for fonts to use + font/* as per RFC8081. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.16 to + pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL + 1.0.2m. (markt) +
+ Update the NSIS Installer used to build the Windows installer to version + 3.02.1. (kkolinko) +
+ Update the Windows installer to use "The Apache Software Foundation" as + the Publisher when Tomcat is displayed in the list of installed + applications in Microsoft Windows. (kkolinko) +
+ 61803: Remove outdated SSL information from the Security + documentation. (remm) +

2017-09-30 Tomcat 9.0.1 (markt)

Catalina

+ Use the correct path when loading the JVM logging.properties + file for Java 9. (rjung) +
+ Add additional validation to the resource handling required to fix + CVE-2017-12617 on Windows. The checks were being performed elsewhere but + adding them to the resource handling ensures that the checks are always + performed. (markt) +

Other

+ 61563: Correct typos in Spanish translation. Patch provided by + Gonzalo Vásquez. (csutherl) +

not released Tomcat 9.0.0 (markt)

Catalina

+ 61542: Fix CVE-2017-12617 and prevent JSPs from being + uploaded via a specially crafted request when HTTP PUT was enabled. + (markt) +
+ 61554: Exclude test files in unusual encodings and markdown + files intended for display in GitHub from RAT analysis. Patch provided + by Chris Thistlethwaite. (markt) +

Coyote

+ 60762: Add the ability to make changes to the TLS + configuration of a connector at runtime without having to restart the + Connector. (markt) +
+ Add an option to reject requests that contain HTTP headers with invalid + (non-token) header names with a 400 response and reject such requests by + default. (markt) +
+ Implement the requirements of RFC 7230 (and RFC 2616) that HTTP/1.1 + requests must include a Host header and any request that + does not must be rejected with a 400 response. (markt) +
+ Implement the requirements of RFC 7230 that any HTTP/1.1 request that + specifies a host in the request line, must specify the same host in the + Host header and that any such request that does not, must + be rejected with a 400 response. This check is optional but enabled by + default. It may be disabled with the + allowHostHeaderMismatch attribute of the Connector. (markt) +
+ Implement the requirements of RFC 7230 that any HTTP/1.1 request that + contains multiple Host headers is rejected with a 400 + response. (markt) +
+ Add a way to set the property source in embedded mode. (remm) +
+ 61557: Correct a further regression in the fix to enable the + use of Java key stores that contain multiple keys that do not all have + the same password. The regression broke support for some FIPS compliant + key stores. (markt) +

jdbc-pool

+ 61545: Correctly handle invocations of methods defined in the + PooledConnection interface when using pooled XA + connections. Patch provided by Nils Winkler. (markt) +

Other

+ Update fix for 59904 so that values less than zero are accepted + instead of throwing a NegativeArraySizeException. (remm) +
+ Complete the implementation of the Servlet 4.0 specification. (markt) +

2017-09-19 Tomcat 9.0.0.M27 (markt)

Catalina

+ Before generating an error page in the ErrorReportValve, + check to see if I/O is still permitted for the associated connection + before generating the error page so that the page generation can be + skipped if the page is never going to be sent. (markt) +
+ 61189: Add the ability to set environment variables for + individual CGI scripts. Based on a patch by jm009. (markt) +
+ 61210: When running under a SecurityManager, do not print a + warning about not being able to read a logging configuration file when + that file does not exist. (markt) +
+ 61280: Add RFC 7617 support to the + BasicAuthenticator. Note that the default configuration + does not change the existing behaviour. (markt) +
+ 61424: Avoid a possible StackOverflowError when + running under a SecurityManager and using + Subject.doAs(). (markt) +
+ When running under Java 9 or later, and the + urlCacheProtection option of the + JreMemoryLeakPreventionListener is enabled, use the API + added in Java 9 to only disable the caching for JAR URL connections. + (markt) +
+ 61489: When using the CGI servlet, make the generation of + command line arguments from the query string (as per section 4.4 of RFC + 3875) optional and disabled by default. Based on a patch by jm009. + (markt) +
+ 61503: This corrects a potential regression in the fix for + 60940 with an alternative solution that adds the + JarEntry objects normally skipped by a + JarInputStream only if those entries exist. (markt) +

Coyote

+ The minimum required Tomcat Native version has been increased to 1.2.14. + This version includes a new API needed for correct client certificate + support when using a Java connector with OpenSSL TLS implementation and + support for the SSL_CONF OpenSSL API. (rjung) +
+ Add support for the OpenSSL SSL_CONF API when using + TLS with OpenSSL implementation. It can be used by adding + OpenSSLConf elements underneath SSLHostConfig. + The new element contains a list of OpenSSLConfCmd elements, + each with the attributes name and value. + (rjung) +
+ When using a Java connector in combination with the OpenSSL TLS + implementation, do not configure each SSL connection object via + the OpenSSLEngine. For OpenSSL the SSL object inherits its + settings from the SSL_CTX which we have already configured. + (rjung) +
+ When using JSSE TLS configuration with the OpenSSL implementation and + client certificates: include client CA subjects in the TLS handshake + so that the client can choose an appropriate client certificate to + present. (rjung) +
+ If an invalid option is specified for the + certificateVerification attribute of an + SSLHostConfig element, treat it as required + which is the most secure / restrictive option in addition to reporting + the configuration error. (markt) +
+ Improve the handling of client disconnections during the TLS + renegotiation handshake. (markt) +
+ Prevent exceptions being thrown during normal shutdown of NIO + connections. This enables TLS connections to close cleanly. (markt) +
+ Fix possible race condition when setting IO listeners on an upgraded + connection. (remm) +
+ Ensure that the APR/native connector uses blocking I/O for TLS + renegotiation. (markt) +
+ 48655: Enable Tomcat to shutdown cleanly when using sendfile, + the APR/native connector and a multi-part download is in progress. + (markt) +
+ 58244: Handle the case when OpenSSL resumes a TLS session + using a ticket and the full client certificate chain is not available. + In this case the client certificate without the chain will be presented + to the application. (markt) +
+ Improve the warning message when JSSE and OpenSSL configuration styles + are mixed on the same SSLHostConfig. (markt) +
+ 61415: Fix TLS renegotiation with OpenSSL based connections + and session caching. (markt) +
+ Delay checking that the configured attributes for an + SSLHostConfig instance are consistent with the configured + SSL implementation until Connector start to avoid incorrect + warnings when the SSL implementation changes during initialisation. + (markt) +
+ 61450: Fix default key alias algorithm. (remm) +
+ 61451: Correct a regression in the fix to enable the use of + Java key stores that contained multiple keys that did not all have the + same password. The regression broke support for any key store that did + not store keys in PKCS #8 format such as hardware key stores and Windows + key stores. (markt) +

WebSocket

+ 60523: Reduce the number of packets used to send WebSocket + messages by not flushing between the header and the payload when the + two are written together. (markt) +
+ 61491: When using the permessage-deflate + extension, correctly handle the sending of empty messages after + non-empty messages to avoid the IllegalArgumentException. + (markt) +

Web applications

+ Show connector cipher list in the manager web application in the + correct cipher order. (rjung) +

Tribes

+ To avoid unexpected session timeout notification from backup session, + update the access time when receiving the map member notification + message. (kfujino) +
+ Add member info to the log message when the failure detection check + fails in TcpFailureDetector. (kfujino) +
+ Avoid Ping timeout until the added map member by receiving + MSG_START message is completely started. (kfujino) +
+ When sending a channel message, make sure that the Sender has connected. + (kfujino) +
+ Correct the backup node selection logic that node 0 is returned twice + consecutively. (kfujino) +
+ Fix race condition of responseMap in + RpcChannel. (kfujino) +

jdbc-pool

+ 61391: Ensure that failed queries are logged if the + SlowQueryReport interceptor is configured to do so and the + connection has been abandoned. Patch provided by Craig Webb. (markt) +
+ 61425: Ensure that transaction of idle connection has + terminated when the testWhileIdle is set to + true and defaultAutoCommit is set to + false. Patch provided by WangZheng. (kfujino) +

Other

+ 61419: Replace a Unix style comment in the DOS bat file + catalina.bat with the correct rem markup. + (rjung) +
+ 61439: Remove the Java Annotation API classes from + tomcat-embed-core.jar and package them in a separate JAR in the + embedded distribution to provide end users with greater flexibility to + handle potential conflicts with the JRE and/or other JARs. (markt) +
+ 61441: Improve the detection of JAVA_HOME by the + daemon.sh script when running on a platform where Java has + been installed from an RPM. (rjung) +
+ Update the packaged version of the Tomcat Native Library to 1.2.14 to + pick up the latest Windows binaries built with APR 1.6.2 and OpenSSL + 1.0.2l. (markt) +
+ 61599: Update to Commons Daemon 1.1.0 for improved Java 9 + support. (markt) +

2017-08-08 Tomcat 9.0.0.M26 (markt)

Catalina

+ Correct multiple regressions in the fix for 49464 that could + corrupt static content served by the DefaultServlet.(markt) +
+ Correct a bug in the PushBuilder implementation that + meant push URLs containing %nn sequences were not correctly + decoded. Identified by FindBugs. (markt) +
+ 61164: Add support for the %X pattern in the + AccessLogValve that reports the connection status at the + end of the request. Patch provided by Zemian Deng. (markt) +
+ 61351: Correctly handle %nn decoding of URL patterns in + web.xml and similar locations that may legitimately contain characters + that are not permitted by RFC 3986. (markt) +
+ 61366: Add a new attribute, localDataSource, to + the JDBCStore that allows the Store to be configured to use + a DataSource defined by the web application rather than the default of + using a globally defined DataSource. Patch provided by Jonathan + Horowitz. (markt) +

Coyote

+ 61086: Ensure to explicitly signal an empty request body for + HTTP 205 responses. Additional fix to r1795278. Based on a patch + provided by Alexandr Saperov. (violetagg) +
+ 61345: Add a server listener that can be used to do system + property replacement from the property source configured in the + digester. (remm) +
+ Add additional logging to record problems that occur while waiting for + the NIO pollers to stop during the Connector stop process. (markt) +

Jasper

+ 61364: Ensure that files are closed after detecting encoding + of JSPs so that files do not remain locked by the file system. (markt) +

WebSocket

+ 57767: Add support to the WebSocket client for following + redirects when attempting to establish a WebSocket connection. Patch + provided by J Fernandez. (markt) +

2017-07-28 Tomcat 9.0.0.M25 (markt)

Catalina

+ Performance improvements for service loader look-ups (and look-ups of + other class loader resources) when the web application is deployed in a + packed WAR file. (markt) +
+ 60963: Add ExtractingRoot, a new + WebResourceRoot implementation that extracts JARs to the + work directory for improved performance when deploying packed WAR files. + (markt) +
+ 61253: Add warn message when Digester.updateAttributes + throws an exception instead of ignoring it. (csutherl) +
+ Correct a further regression in the fix for 49464 that could + cause an byte order mark character to appear at the start of content + included by the DefaultServlet. (markt) +
+ 61313: Make the read timeout configurable in the + JNDIRealm and ensure that a read timeout will result in an + attempt to fail over to the alternateURL. Based on patches by Peter + Maloney and Felix Schumacher. (markt) +

Web applications

+ Correct the documentation for how StandardRoot is + configured. (markt) +

Other

+ 61316: Fix corruption of UTF-16 encoded source files in + released source distributions. (markt) +

not released Tomcat 9.0.0.M24 (markt)

Catalina

+ 52924: Add support for a Tomcat specific deployment + descriptor, /WEB-INF/tomcat-web.xml. This descriptor has an + identical format to /WEB-INF/web.xml. The Tomcat descriptor + takes precedence over any settings in conf/web.xml but does + not take precedence over any settings in /WEB-INF/web.xml. + (markt) +
+ 61232: When log rotation is disabled only one separator will + be used when generating the log file name. For example if the prefix is + catalina. and the suffix is .log then the log + file name will be catalina.log instead of + catalina..log. Patch provided by Katya Stoycheva. + (violetagg) +
+ 61264: Correct a regression in the refactoring to use + Charset rather than String to store request + character encoding that prevented getReader() throwing an + UnsupportedEncodingException if the user agent specifies + an unsupported character encoding. (markt) +
+ Correct a regression in the fix for 49464 that could cause an + incorrect Content-Length header to be sent by the + DefaultServlet if the encoding of a static is not + consistent with the encoding of the response. (markt) +

Coyote

+ Enable TLS connectors to use Java key stores that contain multiple keys + where each key has a separate password. Based on a patch by Frank + Taffelt. (markt) +
+ Improve the handling of HTTP/2 stream resets due to excessive headers + when a continuation frame is used. (markt) +

Jasper

+ 53031: Add support for the fork option when + compiling JSPs with the Jasper Ant task and javac. (markt) +

Other

+ 52791: Add the ability to set the defaults used by the + Windows installer from a configuration file. Patch provided by Sandra + Madden. (markt) +

not released Tomcat 9.0.0.M23 (markt)

Catalina

+ 49464: Improve the Default Servlet's handling of static files + when the file encoding is not compatible with the required response + encoding. (markt) +
+ 61214: Remove deleted attribute servlets from + the Context MBean description. Patch provided by Alexis Hassler. (markt) +
+ 61215: Correctly define addConnectorPort and + invalidAuthenticationWhenDeny in the + mbean-descriptors.xml file for the + org.apache.catalina.valves package so that the attributes + are accessible via JMX. (markt) +
+ 61216: Improve layout for CompositeData and + TabularData when viewing via the JMX proxy servlet. Patch + provided by Alexis Hassler. (markt) +
+ Additional permission for deleting files is granted to JULI as it is + required by FileHandler when running under a Security Manager. The + thread that cleans the log files is marked as daemon thread. + (violetagg) +
+ 61229: Correct a regression in 9.0.0.M21 that broke WebDAV + handling for resources with names that included a & + character. (markt) +

Coyote

+ Restore the ability to configure support for SSLv3. Enabling this + protocol will trigger a warning in the logs since it is known to be + insecure. (markt) +
+ Add LoadBalancerDrainingValve, a Valve designed to reduce the amount of + time required for a node to drain its authenticated users. (schultz) +
+ Do not log a warning when a null session is returned for an + OpenSSL based TLS session since this is expected when session tickets + are enabled. (markt) +
+ When the access log valve logs a TLS related request attribute and the + NIO2 connector is used with OpenSSL, ensure that the TLS attributes are + available to the access log valve when the connection is closing. + (markt) +
+ 60461: Sync SSL session access for the APR connector. (remm) +
+ 61224: Make the GlobalRequestProcessor MBean + attributes read-only. Patch provided by Alexis Hassler. (markt) +

Jasper

+ 49176: When generating JSP runtime error messages that quote + the relevant JSP source code, switch from using the results of the JSP + page parsing process to using the JSR 045 source map data to identify + the correct part of the JSP source from the stack trace. This + significantly reduces the memory footprint of Jasper in development + mode, provides a small performance improvement for error page generation + and enables source quotes to continue to be provided after a Tomcat + restart. (markt) +

Web applications

+ Remove references to the Loader attribute + searchExternalFirst from the documentation since the + attribute is no longer supported. (markt) +

Tribes

+ 51513: Add support for the compressionMinSize + attribute to the GzipInterceptor, add optional statistics + collection and expose the Interceptor over JMX. Based on a patch by + Christian Stöber. (markt) +
+ 61127Allow human-readable names for channelSendOptions and + mapSendOptions. Patch provided by Igal Sapir. (schultz) +

Other

+ Restore the local definition of the web service annotations since the + JRE provided versions are deprecated and Java 9 does not provide them by + default. (markt) +
+ Add necessary Java 9 configuration options to the startup scripts to + prevent warnings being generated on web application stop. (markt) +

2017-06-26 Tomcat 9.0.0.M22 (markt)

Catalina

+ 48543: Add the option to specify an alternative file name for + the catalina.config system property. Also document that + relative, as well as absolute, URLs are permitted. (markt) +
+ 61072: Respect the documentation statements that allow + using the platform default secure random for session id generation. + (remm) +
+ Correct the javadoc for + o.a.c.connector.CoyoteAdapter#parseSessionCookiesId. + Patch provided by John Andrew (XUZHOUWANG) via Github. (violetagg) +
+ 61101: CORS filter should set Vary header in response. + Submitted by Rick Riemer. (remm) +
+ 61105: Add a new JULI FileHandler configuration for + specifying the maximum number of days to keep the log files. By default + the log files will be kept 90 days as configured in + logging.properties. (violetagg) +
+ Update the Servlet 4.0 implementation to add support for setting + trailer fields for HTTP responses. (markt) +
+ 61125: Ensure that WarURLConnection returns the + correct value for calls to getLastModified() as this is + required for the correct detection of JSP modifications when the JSP is + packaged in a WAR file. (markt) +
+ Improve the SSLValve so it is able to handle client + certificate headers from Nginx. Based on a patch by Lucas Ventura Carro. + (markt) +
+ 61134: Do not use '[' and ']' symbols around substituted + text fragments when generating the default error pages. Patch provided + by Katya Todorova. (violetagg) +
+ 61154: Allow the Manager and Host Manager web applications to + start by default when running under a security manager. This was + accomplished by adding a custom permission, + org.apache.catalina.security.DeployXmlPermission, that + permits an application to use a META-INF/context.xml file + and then granting that permission to the Manager and Host Manager. + (markt) +
+ 61173: Polish the javadoc for + o.a.catalina.startup.Tomcat. Patch provided by + peterhansson_se. (violetagg) +
+ A new configuration property crawlerIps is added to the + o.a.catalina.valves.CrawlerSessionManagerValve. Using this + property one can specify a regular expression that will be used to + identify crawlers based on their IP address. Based on a patch provided + by Tetradeus. (violetagg) +
+ 61180: Log a warning message rather than an information + message if it takes more than 100ms to initialised a + SecureRandom instance for a web application to use to + generate session identifiers. Patch provided by Piotr Chlebda. (markt) +
+ 61185: When an asynchronous request is dispatched via + AsyncContext.dispatch() ensure that + getRequestURI() for the dispatched request matches that of + the original request. (markt) +
+ 61197: Ensure that the charset name used in the + Content-Type header has exactly the same form as that + provided by the application. This reverts a behavioural change in + 9.0.0.M21 that caused problems for some clients. (markt) +
+ 61201: Ensure that the SCRIPT_NAME environment + variable for CGI executables is populated in a consistent way regardless + of how the CGI servlet is mapped to a request. (markt) +
+ Ensure to send a space between trailer field name and field value + for HTTP responses trailer fields. (huxing) +

Coyote

+ 61086: Explicitly signal an empty request body for HTTP 205 + responses. (markt) +
+ 61120: Do not ignore path parameters when processing HTTP/2 + requests. (markt) +
+ Revert a change introduced in the fix for bug 60718 that + changed the status code recorded in the access log when the client + dropped the connection from 200 to 500. (markt) +
+ Make asynchronous error handling more robust. In particular ensure that + onError() is called for any registered + AsyncListeners after an I/O error on a non-container + thread. (markt) +
+ Add additional syncs to the SSL session object provided by the OpenSSL + engine so that a concurrent destruction cannot cause a JVM crash. + (remm) +

Jasper

+ 44787: Improve error message when JSP compiler configuration + options are not valid. (markt) +
+ 45931: Extend Jasper's timeSpaces option to add + support for single which replaces template text that + consists entirely of whitespace with a single space character. Based on + a patch by Meetesh Karia. (markt) +
+ 53011: When pre-compiling with JspC, report all compilation + errors rather than stopping after the first error. A new option + -failFast can be used to restore the previous behaviour of + stopping after the first error. Based on a patch provided by Marc Pompl. + (markt) +
+ 61137: j.s.jsp.tagext.TagLibraryInfo#uri and + j.s.jsp.tagext.TagLibraryInfo#prefix fields should not be + final. Patch provided by Katya Todorova. (violetagg) +

WebSocket

+ Correct the log message when a MessageHandler for + PongMessage does not implement + MessageHandler.Whole. (rjung) +
+ Improve thread-safety of Futures used to report the result + of sending WebSocket messages. (markt) +
+ 61183: Correct a regression in the previous fix for + 58624 that could trigger a deadlock depending on the locking + strategy employed by the client code. (markt) +

Web applications

+ Better document the meaning of the trimSpaces option for Jasper. (markt) +
+ 61150: Configure the Manager and Host-Manager web + applications to permit serialization and deserialization of + CRSFPreventionFilter related session objects to avoid warning messages + and/or stack traces on web application stop and/or start when running + under a security manager. (markt) +
+ Correct the TLS configuration documentation to remove SSLv2 and SSLv3 + from the list of supported protocols. (markt) +

Other

+ 45832: Add HTTP DIGEST authentication support to the Catalina + Ant tasks used to communicate with the Manager application. (markt) +
+ 45879: Add the RELEASE-NOTES file to the root of + the installation created by the Tomcat installer for Windows to make it + easier for users to identify the installed Tomcat version. (markt) +
+ 61055: Clarify the code comments in the rewrite valve to make + clear that there are no plans to provide proxy support for this valve + since Tomcat does not have proxy capabilities. (markt) +
+ 61076: Document the altDDName attribute for the + Context element. (markt) +
+ Correct typo in Jar Scan Filter Configuration Reference. + Issue reported via comments.apache.org. (violetagg) +
+ Correct the requirement for the minimum Java SE version in Application + Developer's Guide. Issue reported via comments.apache.org. (violetagg) +
+ 61145: Add missing @Documented annotation to + annotations in the annotations API. Patch provided by Katya Todorova. + (markt) +
+ 61146: Add missing lookup() method to + @EJB annotation in the annotations API. Patch provided by + Katya Todorova. (markt) +
+ Correct typo in Context Container Configuration Reference. + Patch provided by Katya Todorova. (violetagg) +

2017-05-10 Tomcat 9.0.0.M21 (markt)

General

@@ -35,10 +1386,10 @@ (markt)
- Start to switch to using Charset rather than - String to store encoding configuration settings to reduce - the number of places the associated Charset needs to be - looked up. (markt) + Switch to using Charset rather than String to + store encoding settings (including for configuration and for the + Content-Type header) to reduce the number of places the + associated Charset needs to be looked up. (markt)
Use a more reliable mechanism for the DefaultServlet when @@ -156,8 +1507,8 @@ in order to expose to JMX. (kfujino)
- Add JMX support for Channel Interceptors.　The Interceptors - that implement jmx support are TcpFailureDetector, + Add JMX support for Channel Interceptors. The Interceptors + that implement JMX support are TcpFailureDetector, ThroughputInterceptor, TcpPingInterceptor, StaticMembershipInterceptor, MessageDispatchInterceptor and @@ -2494,7 +3845,7 @@ (markt)
- Work around a + Work around a known issue in OpenSSL that does not permit the TLS handshake to be failed if the ALPN negotiation fails. (markt)

\ No newline at end of file diff --git a/output/webapps/docs/class-loader-howto.html b/output/webapps/docs/class-loader-howto.html old mode 100755 new mode 100644 index 4797e6c..0426daf --- a/output/webapps/docs/class-loader-howto.html +++ b/output/webapps/docs/class-loader-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Class Loader HOW-TO

Class Loader HOW-TO

+ Version 9.0.4, + Jan 18 2018

Class Loader HOW-TO

Overview
Class Loader Definitions
XML Parsers and Java
Running under a security manager

Overview

@@ -225,6 +225,21 @@ http://docs.oracle.com/javase/1.5.0/docs/guide/standards/index.html. For Java 9+, use the upgradeable modules feature.

Tomcat utilizes the endorsed mechanism by including the system property setting +-Djava.endorsed.dirs=$JAVA_ENDORSED_DIRS in the +command line that starts the container. The default value of this option is +$CATALINA_HOME/endorsed. This endorsed directory is not +created by default. Note that the endorsed feature is no longer supported +with Java 9 and the above system property will only be set if either the +directory $CATALINA_HOME/endorsed exists, or the variable +JAVA_ENDORSED_DIRS has been set. +

+ +

Note that overriding any JRE component carries risk. If the overriding +component does not provide a 100% compatible API (e.g. the API provided by +Xerces is not 100% compatible with the XML API provided by the JRE) then there +is a risk that Tomcat and/or the deployed application will experience errors.

Running under a security manager

When running under a security manager the locations from which classes @@ -245,5 +260,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/cluster-howto.html b/output/webapps/docs/cluster-howto.html old mode 100755 new mode 100644 index ff82446..baf9b1b --- a/output/webapps/docs/cluster-howto.html +++ b/output/webapps/docs/cluster-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Clustering/Session Replication HOW-TO

Clustering/Session Replication HOW-TO

Important Note

+ Version 9.0.4, + Jan 18 2018

Clustering/Session Replication HOW-TO

Important Note

You can also check the configuration reference documentation.

@@ -198,10 +198,22 @@ sent over the wire and reinstantiated on all the other cluster nodes. Synchronous vs. asynchronous is configured using the channelSendOptions flag and is an integer value. The default value for the SimpleTcpCluster/DeltaManager combo is - 8, which is asynchronous. You can read more on the send flag(overview) or the - send flag(javadoc). - During async replication, the request is returned before the data has been replicated. async replication yields shorter - request times, and synchronous replication guarantees the session to be replicated before the request returns. + 8, which is asynchronous. +

+ For convenience, channelSendOptions can be set by name(s) rather than integer, + which are then translated to their integer value upon startup. The valid option names are: + "asynchronous" (alias "async"), "byte_message" (alias "byte"), "multicast", "secure", + "synchronized_ack" (alias "sync"), "udp", "use_ack". Use comma to separate multiple names, + e.g. pass "async, multicast" for the options + SEND_OPTIONS_ASYNCHRONOUS | SEND_OPTIONS_MULTICAST. +

+ You can read more on the send flag(overview) or the + send flag(javadoc). + During async replication, the request is returned before the data has been replicated. async + replication yields shorter request times, and synchronous replication guarantees the session + to be replicated before the request returns.

Bind session after crash to failover node

@@ -665,5 +677,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/comments.html b/output/webapps/docs/comments.html old mode 100755 new mode 100644 index 6e5d510..c3b8b2b --- a/output/webapps/docs/comments.html +++ b/output/webapps/docs/comments.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Documentation User Comments

Documentation User Comments

Introduction

+ Version 9.0.4, + Jan 18 2018

Documentation User Comments

Introduction

The Tomcat documentation integrates the Apache Comments System. @@ -118,5 +118,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/ajp.html b/output/webapps/docs/config/ajp.html old mode 100755 new mode 100644 index 48d6d27..4cd7d78 --- a/output/webapps/docs/config/ajp.html +++ b/output/webapps/docs/config/ajp.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The AJP Connector

The AJP Connector

+ Version 9.0.4, + Jan 18 2018

The AJP Connector

Introduction
Attributes
Nested Components
Special Features
1. Proxy Support
2. Connector Comparison

Introduction

@@ -730,5 +730,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/automatic-deployment.html b/output/webapps/docs/config/automatic-deployment.html old mode 100755 new mode 100644 index a21326f..c06eaab --- a/output/webapps/docs/config/automatic-deployment.html +++ b/output/webapps/docs/config/automatic-deployment.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - Automatic Deployment - Use cases

Automatic Deployment - Use cases

+ Version 9.0.4, + Jan 18 2018

Automatic Deployment - Use cases

Introduction
Key
New files
Deleted files
Modified files
Added files
Notes

Introduction

@@ -536,5 +536,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-channel.html b/output/webapps/docs/config/cluster-channel.html old mode 100755 new mode 100644 index cec8ae0..a780690 --- a/output/webapps/docs/config/cluster-channel.html +++ b/output/webapps/docs/config/cluster-channel.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Channel object

The Cluster Channel object

+ Version 9.0.4, + Jan 18 2018

The Cluster Channel object

Introduction
Nested Components
Attributes
1. Common Attributes
2. org.apache.catalina.tribes.group.GroupChannel Attributes

Introduction

The cluster channel is the main component of a small framework we've nicknamed Apache Tribes.
@@ -136,5 +136,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-deployer.html b/output/webapps/docs/config/cluster-deployer.html old mode 100755 new mode 100644 index 757bafc..79cb836 --- a/output/webapps/docs/config/cluster-deployer.html +++ b/output/webapps/docs/config/cluster-deployer.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Deployer object

The Cluster Deployer object

+ Version 9.0.4, + Jan 18 2018

The Cluster Deployer object

Introduction
org.apache.catalina.ha.deploy.FarmWarDeployer
1. Attributes

Introduction

The Farm War Deployer can deploy and undeploy web applications on the other @@ -103,5 +103,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-interceptor.html b/output/webapps/docs/config/cluster-interceptor.html old mode 100755 new mode 100644 index 2eabc3e..a66f8c3 --- a/output/webapps/docs/config/cluster-interceptor.html +++ b/output/webapps/docs/config/cluster-interceptor.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Channel Interceptor object

The Channel Interceptor object

+ Version 9.0.4, + Jan 18 2018

The Channel Interceptor object

Introduction
Available Interceptors
Static Membership
Attributes
Nested Components
1. StaticMember Attributes

Introduction

@@ -57,7 +57,7 @@

In addition to dynamic discovery, Apache Tribes also supports static membership, with membership verification. To achieve this add the org.apache.catalina.tribes.group.interceptors.StaticMembershipInterceptor - underneath the org.apache.catalina.tribes.group.interceptors.TcpFailureDetector interceptor. + after the org.apache.catalina.tribes.group.interceptors.TcpFailureDetector interceptor. Inside the StaticMembershipInterceptor you can add the static members you wish to have. The TcpFailureDetector will do a health check on the static members,and also monitor them for crashes so they will have the same level of notification mechanism as the members that are automatically discovered.

@@ -258,5 +258,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-listener.html b/output/webapps/docs/config/cluster-listener.html old mode 100755 new mode 100644 index 7479d42..0bf8a1f --- a/output/webapps/docs/config/cluster-listener.html +++ b/output/webapps/docs/config/cluster-listener.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The ClusterListener object

The ClusterListener object

+ Version 9.0.4, + Jan 18 2018

The ClusterListener object

Introduction
org.apache.catalina.ha.session.ClusterSessionListener
Attributes
1. Common Attributes

Introduction

@@ -73,5 +73,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-manager.html b/output/webapps/docs/config/cluster-manager.html old mode 100755 new mode 100644 index f9988b9..0e34a76 --- a/output/webapps/docs/config/cluster-manager.html +++ b/output/webapps/docs/config/cluster-manager.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The ClusterManager object

The ClusterManager object

+ Version 9.0.4, + Jan 18 2018

The ClusterManager object

Introduction
The <Manager>
Attributes
Nested Components

Introduction

A cluster manager is an extension to Tomcat's session manager interface, @@ -279,5 +279,5 @@

All Manager Implementations

Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-membership.html b/output/webapps/docs/config/cluster-membership.html old mode 100755 new mode 100644 index f3024ed..a27330f --- a/output/webapps/docs/config/cluster-membership.html +++ b/output/webapps/docs/config/cluster-membership.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Membership object

The Cluster Membership object

+ Version 9.0.4, + Jan 18 2018

The Cluster Membership object

Introduction
Default Implementation
Attributes
1. Multicast Attributes

Introduction

@@ -159,5 +159,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-receiver.html b/output/webapps/docs/config/cluster-receiver.html old mode 100755 new mode 100644 index 3d0c615..ec7f6ff --- a/output/webapps/docs/config/cluster-receiver.html +++ b/output/webapps/docs/config/cluster-receiver.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Receiver object

The Cluster Receiver object

+ Version 9.0.4, + Jan 18 2018

The Cluster Receiver object

Introduction
Blocking vs Non-Blocking Receiver
Attributes

Introduction

@@ -155,5 +155,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-sender.html b/output/webapps/docs/config/cluster-sender.html old mode 100755 new mode 100644 index 70a96e8..cebea92 --- a/output/webapps/docs/config/cluster-sender.html +++ b/output/webapps/docs/config/cluster-sender.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Sender object

The Cluster Sender object

+ Version 9.0.4, + Jan 18 2018

The Cluster Sender object

Introduction
Concurrent Parallel Delivery
Nested Elements
Attributes

Introduction

@@ -171,5 +171,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster-valve.html b/output/webapps/docs/config/cluster-valve.html old mode 100755 new mode 100644 index ed4b22e..796bbd5 --- a/output/webapps/docs/config/cluster-valve.html +++ b/output/webapps/docs/config/cluster-valve.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster Valve object

The Cluster Valve object

+ Version 9.0.4, + Jan 18 2018

The Cluster Valve object

Introduction
org.apache.catalina.ha.tcp.ReplicationValve
1. Attributes
org.apache.catalina.ha.session.JvmRouteBinderValve
1. Attributes
org.apache.catalina.ha.authenticator.ClusterSingleSignOn
1. Attributes

Introduction

@@ -164,5 +164,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/cluster.html b/output/webapps/docs/config/cluster.html old mode 100755 new mode 100644 index b254897..6fd2f9a --- a/output/webapps/docs/config/cluster.html +++ b/output/webapps/docs/config/cluster.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Cluster object

The Cluster object

+ Version 9.0.4, + Jan 18 2018

The Cluster object

Introduction
Security
Engine vs Host placement
Context Attribute Replication
Nested Components
Deprecated configuration options
Attributes
1. SimpleTcpCluster Attributes

Introduction

@@ -136,7 +136,15 @@
Note that if you use ASYNC messaging it is possible for update messages for a session to be processed by the receiving nodes in a different order - to the order in which they were sent.

+ to the order in which they were sent. +

+ You may also set these options as a comma separated string, e.g. "async, multicast", which + will be translated into Channel.SEND_OPTIONS_ASYNCHRONOUS | Channel.SEND_OPTIONS_MULTICAST +
+ The valid option names are "asynchronous" (alias "async"), "byte_message" (alias "byte") + , "multicast", "secure", "synchronized_ack" (alias "sync"), "udp", "use_ack" +

The Cookie Processor Component

+ Version 9.0.4, + Jan 18 2018

The Cookie Processor Component

Introduction
Attributes
Nested Components
Special Features

Introduction

@@ -170,5 +170,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The CredentialHandler Component

+ Version 9.0.4, + Jan 18 2018

The CredentialHandler Component

Introduction
Attributes
Nested Components
Special Features

Introduction

@@ -205,5 +205,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Engine Container

+ Version 9.0.4, + Jan 18 2018

The Engine Container

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features

Introduction

@@ -257,5 +257,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Executor (thread pool)

+ Version 9.0.4, + Jan 18 2018

The Executor (thread pool)

Introduction
Attributes
1. Common Attributes
2. Standard Implementation

Introduction

@@ -123,5 +123,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Container Provided Filters

Introduction
Add Default Character Set Filter
CORS Filter
CSRF Prevention Filter
CSRF Prevention Filter for REST APIs
Expires Filter
Failed Request Filter
HTTP Header Security Filter
Remote Address Filter
Remote Host Filter
Remote IP Filter
Request Dumper Filter
Set Character Encoding Filter
WebDAV Fix Filter

+ Version 9.0.4, + Jan 18 2018

Container Provided Filters

Introduction
Add Default Character Set Filter
CORS Filter
CSRF Prevention Filter
CSRF Prevention Filter for REST APIs
Expires Filter
Failed Request Filter
HTTP Header Security Filter
Remote Address Filter
Remote Host Filter
Remote IP Filter
Request Dumper Filter
Session Initializer Filter
Set Character Encoding Filter
WebDAV Fix Filter

Introduction

Tomcat provides a number of Filters which may be @@ -1473,7 +1473,7 @@

Sample Configuration

The following entries in a web application's web.xml would enable the Request Dumper filter for all requests for that web application. If the @@ -1502,6 +1502,45 @@ org.apache.catalina.filters.RequestDumperFilter.handlers = \ 1request-dumper.org.apache.juli.FileHandler

Session Initializer Filter

+ +

Introduction

The Session Initializer Filter initializes the javax.servlet.http.HttpSession + before the Request is processed. This is required for JSR-356 compliant WebSocket implementations, + if the HttpSession is needed during the HandShake phase.

+ +

The Java API for WebSocket does not mandate that an HttpSession would + be initialized upon request, and thus javax.servlet.http.HttpServletRequest's + getSession() returns null if the HttpSession was not + initialized in advance.

+ +

This filter solves that problem by initializing the HttpSession for any HttpServletRequest + that matches its url-pattern.

+ +

Filter Class Name

The filter class name for the Session Initializer Filter is + org.apache.catalina.filters.SessionInitializerFilter.

+ +

Initialisation parameters

The Session Initializer Filter does not support any initialization parameters.

+ +

Sample Configuration

The following entries in the Web Application Deployment Descriptor, web.xml, + would enable the Session Initializer Filter for requests that match the given URL pattern + (in this example, "/ws/*").

+ +

<filter>
+    <filter-name>SessionInitializer</filter-name>
+    <filter-class>org.apache.catalina.filters.SessionInitializerFilter</filter-class>
+</filter>
+<filter-mapping>
+    <filter-name>SessionInitializer</filter-name>
+    <url-pattern>/ws/*</url-pattern>
+</filter-mapping>

Set Character Encoding Filter

Introduction

@@ -1590,5 +1629,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/globalresources.html b/output/webapps/docs/config/globalresources.html old mode 100755 new mode 100644 index b65e465..5199b02 --- a/output/webapps/docs/config/globalresources.html +++ b/output/webapps/docs/config/globalresources.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The GlobalNamingResources Component

The GlobalNamingResources Component

+ Version 9.0.4, + Jan 18 2018

The GlobalNamingResources Component

Introduction
Attributes
Nested Components
Special Features

Introduction

@@ -167,7 +167,7 @@ it is no longer required. This is intended to speed up clean-up of resources that would otherwise happen as part of garbage collection. This attribute is ignored if the singleton attribute is - false. If not specificed, no default is defined and no close method will + false. If not specified, no default is defined and no close method will be called.

For Apache Commons DBCP and Apache Tomcat JDBC connection pools you can use closeMethod="close".

@@ -254,5 +254,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/config/host.html b/output/webapps/docs/config/host.html old mode 100755 new mode 100644 index 0682faa..3f39eea --- a/output/webapps/docs/config/host.html +++ b/output/webapps/docs/config/host.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 Configuration Reference (9.0.0.M21) - The Host Container

The Host Container

+ Version 9.0.4, + Jan 18 2018

The Host Container

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features

Introduction

@@ -234,7 +234,13 @@ fail to start in case the descriptor contains necessary configuration for secure deployment (such as a RemoteAddrValve) which should not be ignored. The flag's value defaults to true unless a - security manager is enabled when the default is false.

+ security manager is enabled when the default is false. + When running under a security manager this may be enabled on a per web + application basis by granting the + org.apache.catalina.security.DeployXmlPermission to the web + application. The Manager and Host Manager applications are granted this + permission by default so that they continue to work when running under a + security manager.

The HTTP2 Upgrade Protocol

+ Version 9.0.4, + Jan 18 2018

The HTTP2 Upgrade Protocol

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features

Introduction

@@ -75,6 +75,40 @@

By default Tomcat will ignore all trailer headers when processing HTTP/2 connections. For a header to be processed, it must be added to this comma-separated list of header names.

Overview

+ Version 9.0.4, + Jan 18 2018

Overview

This manual contains reference information about all of the configuration directives that can be included in a conf/server.xml file to @@ -103,5 +103,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Jar Scan Filter Component

+ Version 9.0.4, + Jan 18 2018

The Jar Scan Filter Component

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features

Introduction

@@ -161,10 +161,10 @@

Nested Components

No components may be nested inside a Jar Scanner element. +

No components may be nested inside a Jar Scan Filter element.

Special Features

No special features are associated with a Jar Scanner +

No special features are associated with a Jar Scan Filter element.

Comments @@ -179,5 +179,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

JASPIC

+ Version 9.0.4, + Jan 18 2018

JASPIC

Introduction
Static configuration
1. AuthConfigProvider
2. ServerAuthModule
Dynamic configuration
3rd party modules
1. Philip Green II's module for Google OAuth 2

Introduction

@@ -187,5 +187,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The LifeCycle Listener Component

+ Version 9.0.4, + Jan 18 2018

The LifeCycle Listener Component

Introduction
Attributes
1. Common Attributes
Nested Components
Standard Implementations
Additional Implementations
1. JMX Remote Lifecycle Listener - org.apache.catalina.mbeans.JmxRemoteLifecycleListener

Introduction

@@ -193,7 +193,7 @@ The protection is enabled by setting the java.util.concurrent.ForkJoinPool.common.threadFactory system property. If this property is set when Tomcat starts, Tomcat will - not over-ride it even if this protection is explictly enabled. The + not over-ride it even if this protection is explicitly enabled. The default is true.

gcDaemonProtection

Enables protection so that calls to @@ -530,5 +530,5 @@

Using JAAS

Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Loader Component

+ Version 9.0.4, + Jan 18 2018

The Loader Component

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features
1. Logging

Introduction

@@ -128,10 +128,6 @@ A non-parallel capable loaderClass is available and can be used by specifying org.apache.catalina.loader.WebappClassLoader.

- searchExternalFirst -

Set to true if you want repositories outside - of WEB-INF/classes and WEB-INF/lib to - be searched first. Default value is false.

@@ -161,5 +157,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Manager Component

+ Version 9.0.4, + Jan 18 2018

The Manager Component

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features
1. Persistence Across Restarts
2. Disable Session Persistence

Introduction

@@ -367,6 +367,10 @@

JDBC Based Store

HOW-TO.

driverName

Java class name of the JDBC driver to be used.

+ localDataSource +

This allows the Store to use a DataSource defined for the Context + rather than a global DataSource. If not specified, the default is + false: use a global DataSource.

sessionAppCol

Name of the database column, contained in the specified session table, that contains the Engine, Host, and Web Application Context name in the @@ -484,5 +488,5 @@

JDBC Based Store

Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Realm Component

+ Version 9.0.4, + Jan 18 2018

The Realm Component

Introduction
Attributes
Nested Components
Special Features

Introduction

@@ -399,6 +399,10 @@ protocol

A string specifying the security protocol to use. If not given the providers default is used.

+ readTimeout +

The timeout, in milliseconds, to use when trying to read from a + connection to the directory. If not specified, the default of 5000 + (5 seconds) is used.

referrals

How do we handle JNDI referrals? Allowed values are "ignore", "follow", or "throw" (see javax.naming.Context.REFERRAL @@ -996,5 +1000,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Resources Component

+ Version 9.0.4, + Jan 18 2018

The Resources Component

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features

Introduction

@@ -68,9 +68,9 @@ Description allowLinking

If the value of this flag is true, symlinks will be - allowed inside the web application, pointing to resources outside the - web application base path. If not specified, the default value - of the flag is false.

+ allowed inside the web application, pointing to resources inside or + outside the web application base path. If not specified, the default + value of the flag is false.

NOTE: This flag MUST NOT be set to true on the Windows platform (or any other OS which does not have a case sensitive filesystem), as it will disable case sensitivity checks, allowing JSP source code @@ -135,9 +135,27 @@

Standard Implementation

+
Standard Root Implementation
+
The standard implementation of Resources is - org.apache.catalina.webresources.StandardRoot, and - is configured by its parent Context element.
+ org.apache.catalina.webresources.StandardRoot. It does not + support any additional attributes.
+ +
Extracting Root Implementation
+ +
The extracting implementation of Resources is + org.apache.catalina.webresources.ExtractingRoot. It does not + support any additional attributes.
+ +
When deploying web applications as packed WAR files, the extracting root + will extract any JAR files from /WEB-INF/lib to a + application-jars directory located in the web + application's working directory. These extracted JARs will be removed + when the web application stops.
+ +
Extracting JAR files from a packed WAR may provide a performance + improvement, particularly at web application start when JAR scanning is + required by the application.

@@ -298,5 +316,5 @@
Ordering
Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Server Component

+ Version 9.0.4, + Jan 18 2018

The Server Component

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features

Introduction

@@ -119,5 +119,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Service Component

+ Version 9.0.4, + Jan 18 2018

The Service Component

Introduction
Attributes
1. Common Attributes
2. Standard Implementation
Nested Components
Special Features

Introduction

@@ -106,5 +106,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The SessionIdGenerator Component

+ Version 9.0.4, + Jan 18 2018

The SessionIdGenerator Component

Introduction
Attributes
1. Common Attributes
2. Standard Implementation

Introduction

@@ -127,5 +127,5 @@

Standard SessionIdGenerator Implementation

Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

System Properties

+ Version 9.0.4, + Jan 18 2018

System Properties

Introduction
Property replacements
Clustering
Expression Language
Jasper
Security
Specifications
Sessions
Logging
JAR Scanning
Websockets
Other

Introduction

The following sections list the system properties that may be set to modify @@ -47,6 +47,13 @@ Required to have a public constructor with no arguments.

Use this to add a property source, that will be invoked when ${parameter} denoted parameters are found in the XML files that Tomcat parses.

Property replacement from the specified property source on the JVM + system properties can also be done using the + REPLACE_SYSTEM_PROPERTIES system property.

+ org.apache.tomcat.util.digester. REPLACE_SYSTEM_PROPERTIES +

Set this boolean system property to true to cause + property replacement from the digester property source on the JVM + system properties.

Clustering

@@ -127,10 +134,15 @@ cause an error.

If not specified, the specification compliant default of true will be used.

+ org.apache.jasper.runtime. BodyContentImpl.BUFFER_SIZE +

The size (in characters) to use when creating a tag buffer.

If not specified, the default value of + org.apache.jasper.Constants.DEFAULT_TAG_BUFFER_SIZE (512) + will be used.

org.apache.jasper.runtime. BodyContentImpl.LIMIT_BUFFER

If true, any tag buffer that expands beyond - org.apache.jasper.Constants.DEFAULT_TAG_BUFFER_SIZE will be - destroyed and a new buffer created of the default size.

+ org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE will be + destroyed and a new buffer created.

If not specified, the default value of false will be used.

org.apache.jasper.runtime. JspFactoryImpl.USE_POOL

If true, a ThreadLocal PageContext pool will @@ -469,7 +481,11 @@ Engine element. It does not override the value configured on the Engine element.

catalina.config -

The URL for the catalina.properties configuration file.

The location from which to load the catalina.properties configuration + file. This may be an absolute URL, a relative (to the current working + directory) URL or an alternative file name in which case Tomcat will + attempt to load the file from the default location of + $CATALINA_BASE/conf/.

tomcat.util.buf.StringCache.byte.enabled

If true, the String cache is enabled for ByteChunk.

@@ -529,5 +545,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

The Valve Component

Introduction
Access Logging
1. Access Log Valve
  1. Introduction
  2. Attributes
2. Extended Access Log Valve
  1. Introduction
  2. Attributes
Access Control
1. Remote Address Valve
2. Remote Host Valve
  1. Introduction
  2. Attributes
Proxies Support
1. Remote IP Valve
  1. Introduction
  2. Attributes
2. SSL Valve
  1. Introduction
  2. Attributes
Single Sign On Valve
1. Introduction
2. Attributes
Authentication
Error Report Valve
1. Introduction
2. Attributes
Crawler Session Manager Valve
1. Introduction
2. Attributes
Stuck Thread Detection Valve
1. Introduction
2. Attributes
Semaphore Valve
1. Introduction
2. Attributes

+ Version 9.0.4, + Jan 18 2018

The Valve Component

Introduction
Access Logging
1. Access Log Valve
  1. Introduction
  2. Attributes
2. Extended Access Log Valve
  1. Introduction
  2. Attributes
Access Control
1. Remote Address Valve
2. Remote Host Valve
  1. Introduction
  2. Attributes
Proxies Support
Single Sign On Valve
1. Introduction
2. Attributes
Authentication
Error Report Valve
1. Introduction
2. Attributes
Crawler Session Manager Valve
1. Introduction
2. Attributes
Stuck Thread Detection Valve
1. Introduction
2. Attributes
Semaphore Valve
1. Introduction
2. Attributes

Introduction

A Valve element represents a component that will be @@ -257,6 +257,13 @@

%T - Time taken to process the request, in seconds

%F - Time taken to commit the response, in millis

%I - Current request thread name (can compare later with stacktraces)

%X - Connection status when response is completed: +

X = Connection aborted before the response completed.
+ = Connection may be kept alive after the response is sent.
- = Connection will be closed after the response is sent.

@@ -636,6 +643,77 @@

Proxies Support

Load Balancer Draining Valve

Introduction

+ When using mod_jk or mod_proxy_ajp, the client's session id is used to + determine which back-end server will be used to serve the request. If the + target node is being "drained" (in mod_jk, this is the DISABLED + state; in mod_proxy_ajp, this is the Drain (N) state), requests + for expired sessions can actually cause the draining node to fail to + drain. +

+ Unfortunately, AJP-based load-balancers cannot prove whether the + client-provided session id is valid or not and therefore will send any + requests for a session that appears to be targeted to that node to the + disabled (or "draining") node, causing the "draining" process to take + longer than necessary. +

+ This Valve detects requests for invalid sessions, strips the session + information from the request, and redirects back to the same URL, where + the load-balancer should choose a different (active) node to handle the + request. This will accelerate the "draining" process for the disabled + node(s). +

+ +

+ The activation state of the node is sent by the load-balancer in the + request, so no state change on the node being disabled is necessary. Simply + configure this Valve in your valve pipeline and it will take action when + the activation state is set to "disabled". +

+ +

+ You should take care to register this Valve earlier in the Valve pipeline + than any authentication Valves, because this Valve should be able to + redirect a request before any authentication Valve saves a request to a + protected resource. If this happens, a new session will be created and + the draining process will stall because a new, valid session will be + established. +

+ +

Attributes

The Load Balancer Draining Valve supports the + following configuration attributes:

+ +

+ Attribute +	+ Description +
`className`	+ Java class name of the implementation to use. This MUST be set to + org.apache.catalina.valves.LoadBalancerDrainingValve. + +
`redirectStatusCode`	+ Allows setting a custom redirect code to be used when the client + is redirected to be re-balanced by the load-balancer. The default is + 307 TEMPORARY_REDIRECT. +
`ignoreCookieName`	+ When used with `ignoreCookieValue`, a client can present + this cookie (and accompanying value) that will cause this Valve to + do nothing. This will allow you to probe your disabled node + before re-enabling it to make sure that it is working as expected. +
`ignoreCookieValue`	+ When used with `ignoreCookieName`, a client can present + a cookie (and accompanying value) that will cause this Valve to + do nothing. This will allow you to probe your disabled node + before re-enabling it to make sure that it is working as expected. +

Remote IP Valve

@@ -908,6 +986,17 @@ point where users are authenticated. This is to prevent session fixation attacks. If not set, the default value of true will be used.

+ charset +

Controls if the WWW-Authenticate HTTP header includes a + charset authentication parameter as per RFC 7617. The only + permitted options are null, the empty string and + UTF-8. If UTF-8 is specified then the + charset authentication parameter will be sent with that + value and the provided user name and optional password will be converted + from bytes to characters using UTF-8. Otherwise, no charset + authentication parameter will be sent and the provided user name and + optional password will be converted from bytes to characters using + ISO-8859-1. The default value is null

className

Java class name of the implementation to use. This MUST be set to org.apache.catalina.authenticator.BasicAuthenticator.

@@ -947,6 +1036,12 @@ session IDs. If an invalid algorithm and/or provider is specified, the platform default provider and the default algorithm will be used. If not specified, the platform default provider will be used.

+ jaspicCallbackHandlerClass +

Name of the Java class of the + javax.security.auth.callback.CallbackHandler implementation + which should be used by JASPIC. If none is specified the default + org.apache.catalina.authenticator.jaspic.CallbackHandlerImpl + will be used.

@@ -1065,6 +1160,12 @@ normally only be set when Tomcat is located behind a reverse proxy and the proxy is modifying the URI passed to Tomcat such that DIGEST authentication always fails.

+ jaspicCallbackHandlerClass +

@@ -1154,6 +1255,12 @@ session IDs. If an invalid algorithm and/or provider is specified, the platform default provider and the default algorithm will be used. If not specified, the platform default provider will be used.

+ jaspicCallbackHandlerClass +

@@ -1232,6 +1339,12 @@ session IDs. If an invalid algorithm and/or provider is specified, the platform default provider and the default algorithm will be used. If not specified, the platform default provider will be used.

+ jaspicCallbackHandlerClass +

@@ -1358,6 +1471,12 @@ services) via the org.apache.catalina.realm.GSS_CREDENTIAL request attribute. If not set, the default value of true will be used.

+ jaspicCallbackHandlerClass +

Default Servlet Reference

+ Version 9.0.4, + Jan 18 2018

Default Servlet Reference

What is the DefaultServlet
Where is it declared?
What can I change?
How do I customize directory listings?
How do I secure directory listings?

What is the DefaultServlet

@@ -66,8 +66,19 @@ <url-pattern>/</url-pattern> </servlet-mapping>

-So by default, the default servlet is loaded at webapp startup and -directory listings are disabled and debugging is turned off. +

So by default, the default servlet is loaded at webapp startup and directory +listings are disabled and debugging is turned off.

+ +

If you need to change the DefaultServlet settings for an application you can +override the default configuration by re-defining the DefaultServlet in +/WEB-INF/web.xml. However, this will cause problems if you attempt +to deploy the application on another container as the DefaultServlet class will +not be recognised. You can work-around this problem by using the Tomact specific +/WEB-INF/tomcat-web.xml deployment descriptor. The format is +identical to /WEB-INF/web.xml. It will override any default +settings but not those in /WEB-INF/web.xml. Since it is Tomcat +specific, it will only be processed when the application is deployed on +Tomcat.

What can I change?

The DefaultServlet allows the following initParamters: @@ -155,6 +166,9 @@ fileEncoding File encoding to be used when reading static resources. [platform default] + useBomIfPresent + If a static file contains a byte order mark (BOM), should this be used + to determine the file encoding in preference to fileEncoding. [true] sendfileSize If the connector used supports sendfile, this represents the minimal file size in KB for which sendfile will be used. Use a negative value @@ -298,5 +312,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Administrative Apps - Overall Requirements

+ Version 9.0.4, + Jan 18 2018

Administrative Apps - Overall Requirements

Overview
Dependencies
Functionality
Testable Assertions

Overview

@@ -295,5 +295,5 @@

HTML-Based Web Application

Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Administrative Apps - Administered Objects

+ Version 9.0.4, + Jan 18 2018

Administrative Apps - Administered Objects

Administered Objects Overview
Access Logger
Connector
Context
Default Context
Default Deployment Descriptor
Engine
Environment Entry
Host
JDBC Resource
Loader
Manager
Realm
Request Filter
Server
Service

Administered Objects Overview

@@ -446,5 +446,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Administrative Apps - Supported Operations

+ Version 9.0.4, + Jan 18 2018

Administrative Apps - Supported Operations

Supported Operations Overview
Access Logger
Connector
Context
Default Context
Engine
Environment Entry
Host
JDBC Resource
Loader
Manager
Realm
Request Filter
Server
Service

Supported Operations Overview

@@ -305,5 +305,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Default Servlet

+ Version 9.0.4, + Jan 18 2018

Default Servlet

Overview
Dependencies
1. Environmental Dependencies
2. Container Dependencies
Functionality
Testable Assertions

Overview

@@ -266,5 +266,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

JDBCRealm

+ Version 9.0.4, + Jan 18 2018

JDBCRealm

Overview
Dependencies
1. Environmental Dependencies
2. Container Dependencies
Functionality
1. Overview of Operation
2. Detailed Functional Requirements
Testable Assertions

Overview

@@ -262,5 +262,5 @@

Method hasRole() Functionality

Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

JNDIRealm

+ Version 9.0.4, + Jan 18 2018

JNDIRealm

Overview
Dependencies
1. Environmental Dependencies
2. Container Dependencies
Functionality
Testable Assertions

Overview

@@ -413,5 +413,5 @@

Method hasRole() Functionality

Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

MemoryRealm

+ Version 9.0.4, + Jan 18 2018

MemoryRealm

Overview
Dependencies
1. Environmental Dependencies
2. Container Dependencies
Functionality
1. Overview of Operation
2. Detailed Functional Requirements
Testable Assertions

Overview

@@ -249,5 +249,5 @@

Method hasRole() Functionality

Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Catalina Functional Specifications

+ Version 9.0.4, + Jan 18 2018

Catalina Functional Specifications

This documentation area includes functional specifications for many features supported by the Catalina servlet container @@ -76,5 +76,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Tomcat MBean Names

+ Version 9.0.4, + Jan 18 2018

Tomcat MBean Names

Background
Catalina Object Hierarchy
MBean Groups and Names
JSR-88 Cross Reference

Background

@@ -697,5 +697,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Jasper 2 JSP Engine How To

+ Version 9.0.4, + Jan 18 2018

Jasper 2 JSP Engine How To

Introduction
Configuration
Known issues
Production Configuration
Web Application Compilation
Optimisation

Introduction

@@ -188,8 +188,12 @@ debugging be suppressed? true or false, default false. -

trimSpaces - Should white spaces in template text between -actions or directives be trimmed ?, default false.

trimSpaces - Should template text that consists entirely of +whitespace be removed from the output (true), replaced with a +single space (single) or left unchanged (false)? Note +that if a JSP page or tag file specifies a trimDirectiveWhitespaces +value of true, that will take precedence over this configuration +setting for that page/tag. Default false.

xpoweredBy - Determines whether X-Powered-By response header is added by generated servlet. true or false, @@ -216,6 +220,17 @@ of the new compiler by configuring the compiler attribute as explained above.

If you need to change the JSP Servlet settings for an application you can +override the default configuration by re-defining the JSP Servlet in +/WEB-INF/web.xml. However, this may cause problems if you attempt +to deploy the application on another container as the JSP Servlet class may +not be recognised. You can work-around this problem by using the Tomact specific +/WEB-INF/tomcat-web.xml deployment descriptor. The format is +identical to /WEB-INF/web.xml. It will override any default +settings but not those in /WEB-INF/web.xml. Since it is Tomcat +specific, it will only be processed when the application is deployed on +Tomcat.

Known issues

As described in @@ -404,5 +419,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Logging in Tomcat

+ Version 9.0.4, + Jan 18 2018

Logging in Tomcat

Introduction
Using java.util.logging (default)
1. Documentation references
2. Considerations for production usage

Introduction

@@ -284,6 +284,12 @@ boolean value.

The root logger can define its set of handlers using the .handlers property.

By default the log files will be kept on the file system + 90 days. This may be changed per handler using the + handlerName.maxDays property. If the specified value for the + property is <=0 then the log files will be kept on the + file system forever, otherwise they will be kept the specified maximum + days.

There are several additional implementation classes, that can be used @@ -414,5 +420,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

Manager App HOW-TO

Introduction
Configuring Manager Application Access
HTML User-friendly Interface
Supported Manager Commands
Server Status
Using the JMX Proxy Servlet
Executing Manager Commands With Ant
1. Tasks output capture

+ Version 9.0.4, + Jan 18 2018

Manager App HOW-TO

Introduction
Configuring Manager Application Access
HTML User-friendly Interface
Supported Manager Commands
Server Status
Using the JMX Proxy Servlet
Executing Manager Commands With Ant
1. Tasks output capture

Introduction

In many production environments, it is very useful to have the capability @@ -845,7 +845,7 @@

Connector SSL/TLS diagnostics

Connector SSL/TLS cipher information

http://localhost:8080/manager/text/sslConnectorCiphers

@@ -866,6 +866,61 @@

Connector SSL/TLS certificate chain information

+ +

http://localhost:8080/manager/text/sslConnectorCerts

+ +

The SSL Connector/Certs diagnostic lists the certificate chain that is +currently configured for each virtual host.

+ +

The response will look something like this:

OK - Connector / Certificate Chain information
+Connector[HTTP/1.1-8080]
+SSL is not enabled for this connector
+Connector[HTTP/1.1-8443]-_default_-RSA
+[
+[
+  Version: V3
+  Subject: CN=localhost, OU=Apache Tomcat PMC, O=The Apache Software Foundation, L=Wakefield, ST=MA, C=US
+  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
+  ...

+ +

Connector SSL/TLS trusted certificate information

+ +

http://localhost:8080/manager/text/sslConnectorTrustedCerts

+ +

The SSL Connector/Certs diagnostic lists the trusted certificates that are +currently configured for each virtual host.

+ +

The response will look something like this:

OK - Connector / Trusted Certificate information
+Connector[HTTP/1.1-8080]
+SSL is not enabled for this connector
+Connector[AJP/1.3-8009]
+SSL is not enabled for this connector
+Connector[HTTP/1.1-8443]-_default_
+[
+[
+  Version: V3
+  Subject: CN=Apache Tomcat Test CA, OU=Apache Tomcat PMC, O=The Apache Software Foundation, L=Wakefield, ST=MA, C=US
+  ...

+ +

Reload TLS configuration

+ +

http://localhost:8080/manager/text/sslReload?tlsHostName=name

+ +

Reload the TLS configuration files (the certificate and key files, this does +not trigger a re-parsing of server.xml). To reload the files for all hosts don't +specify the tlsHostName parameter.

+ +

OK - Reloaded TLS configuration for [_default_]

+ +

Thread Dump

http://localhost:8080/manager/text/threaddump

@@ -1401,5 +1456,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/maven-jars.html b/output/webapps/docs/maven-jars.html old mode 100755 new mode 100644 index 74c5a7b..ec69374 --- a/output/webapps/docs/maven-jars.html +++ b/output/webapps/docs/maven-jars.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - Apache Tomcat - Using Tomcat libraries with Maven

Apache Tomcat - Using Tomcat libraries with Maven

+ Version 9.0.4, + Jan 18 2018

Apache Tomcat - Using Tomcat libraries with Maven

Using Tomcat libraries With Maven
1. Tomcat Snapshots
2. Tomcat Releases

Using Tomcat libraries With Maven

Tomcat Snapshots

@@ -65,5 +65,5 @@ Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

\ No newline at end of file diff --git a/output/webapps/docs/mbeans-descriptors-howto.html b/output/webapps/docs/mbeans-descriptors-howto.html old mode 100755 new mode 100644 index 628b391..285153a --- a/output/webapps/docs/mbeans-descriptors-howto.html +++ b/output/webapps/docs/mbeans-descriptors-howto.html @@ -1,5 +1,5 @@ -Apache Tomcat 9 (9.0.0.M21) - MBeans Descriptors How To

MBeans Descriptors How To

+ Version 9.0.4, + Jan 18 2018

MBeans Descriptors How To

Introduction
Adding MBean descriptions

Introduction

@@ -50,6 +50,11 @@ a mbeans-descriptors.xml file, located in the same package as the class files it describes.

The permitted syntax for the mbeans-descriptors.xml is defined by +the DTD file.

+ +

The entries for a custom LDAP authentication Realm may look like this:

  <mbean         name="LDAPRealm"
             className="org.apache.catalina.mbeans.ClassNameMBean"
           description="Custom LDAPRealm"
@@ -85,5 +90,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.


\ No newline at end of file
diff --git a/output/webapps/docs/mbeans-descriptors.dtd b/output/webapps/docs/mbeans-descriptors.dtd
new file mode 100644
index 0000000..f12b8fe
--- /dev/null
+++ b/output/webapps/docs/mbeans-descriptors.dtd
@@ -0,0 +1,247 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/output/webapps/docs/monitoring.html b/output/webapps/docs/monitoring.html
old mode 100755
new mode 100644
index b4cd74f..d0124a4
--- a/output/webapps/docs/monitoring.html
+++ b/output/webapps/docs/monitoring.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Monitoring and Managing Tomcat
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Monitoring and Managing Tomcat
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Monitoring and Managing Tomcat
Table of Contents

 Introduction
Enabling JMX Remote
Manage Tomcat with JMX remote Ant Tasks
JMXAccessorOpenTask - JMX open connection task
JMXAccessorGetTask:  get attribute value Ant task
JMXAccessorSetTask:  set attribute value Ant task
JMXAccessorInvokeTask:  invoke MBean operation Ant task
JMXAccessorQueryTask:  query MBean Ant task
JMXAccessorCreateTask:  remote create MBean Ant task
JMXAccessorUnregisterTask:  remote unregister MBean Ant task
JMXAccessorCondition:  express condition
JMXAccessorEqualsCondition:  equals MBean Ant condition
Using the JMXProxyServlet
 
Introduction

 
@@ -1132,5 +1132,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/proxy-howto.html b/output/webapps/docs/proxy-howto.html
old mode 100755
new mode 100644
index 7d95e2a..19cea52
--- a/output/webapps/docs/proxy-howto.html
+++ b/output/webapps/docs/proxy-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Proxy Support HOW-TO
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Proxy Support HOW-TO
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Proxy Support HOW-TO
Table of Contents

 Introduction
Apache 1.3 Proxy Support
Apache 2.0 Proxy Support
 
Introduction

 
@@ -151,5 +151,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/realm-howto.html b/output/webapps/docs/realm-howto.html
old mode 100755
new mode 100644
index 8ce8e96..3df1103
--- a/output/webapps/docs/realm-howto.html
+++ b/output/webapps/docs/realm-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Realm Configuration HOW-TO
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Realm Configuration HOW-TO
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Realm Configuration HOW-TO
Table of Contents

 Quick Start
OverviewWhat is a Realm?
Configuring a Realm
Common FeaturesDigested Passwords
Example Application
Manager Application
Realm Logging
Standard Realm ImplementationsJDBCRealm
DataSourceRealm
JNDIRealm
UserDatabaseRealm
MemoryRealm
JAASRealm
CombinedRealm
LockOutRealm
 
Quick Start

 
@@ -1219,5 +1219,5 @@ Example
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/rewrite.html b/output/webapps/docs/rewrite.html
old mode 100755
new mode 100644
index 04349e5..44ae04d
--- a/output/webapps/docs/rewrite.html
+++ b/output/webapps/docs/rewrite.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - The rewrite Valve
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
The rewrite Valve
Introduction

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
The rewrite Valve
Introduction

 
   The rewrite valve implements URL rewrite functionality in a way that is
   very similar to mod_rewrite from Apache HTTP Server.
@@ -713,5 +713,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/security-howto.html b/output/webapps/docs/security-howto.html
old mode 100755
new mode 100644
index e09935a..388ffbe
--- a/output/webapps/docs/security-howto.html
+++ b/output/webapps/docs/security-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Security Considerations
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Security Considerations
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Security Considerations
Table of Contents

 Introduction
Non-Tomcat settingsJMX
Default web applicationsGeneral
ROOT
Documentation
Examples
Manager
Host Manager
Securing Management Applications
Security manager
server.xmlGeneral
Server
Listeners
Connectors
Host
Context
Valves
Realms
Manager
Cluster
System Properties
web.xml
General
 
Introduction

     Tomcat is configured to be reasonably secure for most use cases by
@@ -293,26 +293,6 @@
       proxy uses AJP then the SSL attributes of the client connection are
       passed via the AJP protocol and separate connectors are not needed.
 
-      The sslEnabledProtocols attribute determines which
-      versions of the SSL/TLS protocol are used.  Since the POODLE attack in
-      2014, all SSL protocols are considered unsafe and a secure setting for
-      this attribute in a standalone Tomcat setup might be
-      sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
-
-      The ciphers attribute controls the ciphers used for
-      SSL connections. By default, the default ciphers for the JVM will be used.
-      This usually means that the weak export grade ciphers will be included in
-      the list of available ciphers. Secure environments will normally want to
-      configure a more limited set of ciphers.  This attribute accepts the
-      
-      OpenSSL syntax for including/excluding cipher suites.
-      As of 2014-11-19, with standalone Tomcat 8 and Java 8, Forward Secrecy
-      can be achieved by specifying only TLS protocols using
-      the sslEnabledProtocols attribute (above) and excluding non-DH ciphers,
-      and weak/broken ciphers.  The
-      Qualys SSL/TLS test is a useful tool for
-      configuring these settings.
-
       The tomcatAuthentication and
       tomcatAuthorization attributes are used with the
       AJP connectors to determine if Tomcat should handle all authentication and
@@ -469,9 +449,9 @@
     that are safe for ISO-8859-1 but trigger an XSS vulnerability if interpreted
     as UTF-7.
   
web.xml

-    This applies to the default conf/web.xml file and
-    WEB-INF/web.xml files in web applications if they define
-    the components mentioned here.
+    This applies to the default conf/web.xml file, the
+    /WEB-INF/tomcat-web.xml and the /WEB-INF/web.xml
+    files in web applications if they define the components mentioned here.
 
     The DefaultServlet is configured
     with readonly set to
@@ -539,5 +519,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/security-manager-howto.html b/output/webapps/docs/security-manager-howto.html
old mode 100755
new mode 100644
index 05f9f9d..89d0c1f
--- a/output/webapps/docs/security-manager-howto.html
+++ b/output/webapps/docs/security-manager-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Security Manager HOW-TO
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Security Manager HOW-TO
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Security Manager HOW-TO
Table of Contents

 Background
PermissionsStandard Permissions
Configuring Tomcat With A SecurityManagerPermissions for packed WAR files
Configuring Package Protection in Tomcat
Troubleshooting
 
Background

 
@@ -209,7 +209,7 @@ The Default Policy File
         permission java.io.FilePermission
          "${catalina.base}${file.separator}logs", "read, write";
         permission java.io.FilePermission
-         "${catalina.base}${file.separator}logs${file.separator}*", "read, write";
+         "${catalina.base}${file.separator}logs${file.separator}*", "read, write, delete";
 
         permission java.lang.RuntimePermission "shutdownHooks";
         permission java.lang.RuntimePermission "getClassLoader";
@@ -330,8 +330,9 @@ The Default Policy File
 
 
 // The Manager application needs access to the following packages to support the
-// session display functionality. These settings support the following
-// configurations:
+// session display functionality. It also requires the custom Tomcat
+// DeployXmlPermission to enable the use of META-INF/context.xml
+// These settings support the following configurations:
 // - default CATALINA_HOME == CATALINA_BASE
 // - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
 // - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
@@ -341,6 +342,7 @@ The Default Policy File
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
+    permission org.apache.catalina.security.DeployXmlPermission "manager";
 };
 grant codeBase "file:${catalina.home}/webapps/manager/-" {
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
@@ -348,8 +350,23 @@ The Default Policy File
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
+    permission org.apache.catalina.security.DeployXmlPermission "manager";
 };
 
+// The Host Manager application needs the custom Tomcat DeployXmlPermission to
+// enable the use of META-INF/context.xml
+// These settings support the following configurations:
+// - default CATALINA_HOME == CATALINA_BASE
+// - CATALINA_HOME != CATALINA_BASE, per instance Host Manager in CATALINA_BASE
+// - CATALINA_HOME != CATALINA_BASE, shared Host Manager in CATALINA_HOME
+grant codeBase "file:${catalina.base}/webapps/host-manager/-" {
+    permission org.apache.catalina.security.DeployXmlPermission "host-manager";
+};
+grant codeBase "file:${catalina.home}/webapps/host-manager/-" {
+    permission org.apache.catalina.security.DeployXmlPermission "host-manager";
+};
+
+
 // You can assign additional permissions to particular web applications by
 // adding additional "grant" entries here, based on the code base for that
 // application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
@@ -498,5 +515,5 @@ The Default Properties File
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/servletapi/index.html b/output/webapps/docs/servletapi/index.html
old mode 100755
new mode 100644
diff --git a/output/webapps/docs/setup.html b/output/webapps/docs/setup.html
old mode 100755
new mode 100644
index f213473..34e6277
--- a/output/webapps/docs/setup.html
+++ b/output/webapps/docs/setup.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Tomcat Setup
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Tomcat Setup
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Tomcat Setup
Table of Contents

 Introduction
Windows
Unix daemon
 
Introduction

     
@@ -69,6 +69,31 @@
             will not be any tray icon present when Tomcat is running. Note that
             when choosing to run Tomcat at the end of installation, the tray
             icon will be used even if Tomcat was installed as a service.
+        
Defaults: The defaults used by the installer may be
+            overridden by use of the /C=<config file> command
+            line argument. The configuration file uses the format
+            name=value with each pair on a separate line. The names
+            of the available configuration options are:
+            
+            JavaHome
+            TomcatPortShutdown
+            TomcatPortHttp
+            TomcatPortAjp
+            TomcatMenuEntriesEnable
+            TomcatShortcutAllUsers
+            TomcatServiceDefaultName
+            TomcatServiceName
+            TomcatServiceFileName
+            TomcatServiceManagerFileName
+            TomcatAdminEnable
+            TomcatAdminUsername
+            TomcatAdminPassword
+            TomcatAdminRoles
+            
+            By using /C=... along with /S and
+            /D= it is possible to perform fully configured
+            unattended installs of Apache Tomact.
+        
         Refer to the
             Windows Service HOW-TO
             for information on how to manage Tomcat as a Windows service.
@@ -104,7 +129,7 @@
 
 cd $CATALINA_HOME/bin
 tar xvfz commons-daemon-native.tar.gz
-cd commons-daemon-1.0.x-native-src/unix
+cd commons-daemon-1.1.x-native-src/unix
 ./configure
 make
 cp jsvc ../..
@@ -124,6 +149,14 @@
     -Djava.util.logging.config.file=$CATALINA_BASE/conf/logging.properties \
     org.apache.catalina.startup.Bootstrap
 
+    When runnong on Java 9 you will need to additionally specify the
+    following when starting jsvc to avoid warnings on shutdown.
+...
+--add-opens=java.base/java.lang=ALL-UNNAMED \
+--add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED \
+...
+
+
     You may also need to specify -jvm server if the JVM defaults
        to using a server VM rather than a client VM. This has been observed on
        OSX.
@@ -164,5 +197,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/ssi-howto.html b/output/webapps/docs/ssi-howto.html
old mode 100755
new mode 100644
index c14fe05..e48d344
--- a/output/webapps/docs/ssi-howto.html
+++ b/output/webapps/docs/ssi-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - SSI How To
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
SSI How To
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
SSI How To
Table of Contents

 Introduction
Installation
Servlet Configuration
Filter Configuration
Directives
Variables
 
Introduction

 
@@ -394,5 +394,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/ssl-howto.html b/output/webapps/docs/ssl-howto.html
old mode 100755
new mode 100644
index 1383883..17994a6
--- a/output/webapps/docs/ssl-howto.html
+++ b/output/webapps/docs/ssl-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - SSL/TLS Configuration HOW-TO
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
SSL/TLS Configuration HOW-TO
Table of Contents

-Quick Start
Introduction to SSL/TLS
SSL/TLS and Tomcat
Certificates
General Tips on Running SSL
ConfigurationPrepare the Certificate Keystore
Edit the Tomcat Configuration File
Installing a Certificate from a Certificate AuthorityCreate a local Certificate Signing Request (CSR)
Importing the Certificate
Troubleshooting
Using the SSL for session tracking in your application
Miscellaneous Tips and Bits
+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
SSL/TLS Configuration HOW-TO
Table of Contents

+Quick Start
Introduction to SSL/TLS
SSL/TLS and Tomcat
Certificates
General Tips on Running SSL
ConfigurationPrepare the Certificate Keystore
Edit the Tomcat Configuration File
Installing a Certificate from a Certificate AuthorityCreate a local Certificate Signing Request (CSR)
Importing the Certificate
Using OCSP CertificatesGenerating OCSP-Enabled Certificates
Configuring OCSP Connector
Starting OCSP Responder
Troubleshooting
Using the SSL for session tracking in your application
Miscellaneous Tips and Bits
 
Quick Start

 
     The description below uses the variable name $CATALINA_BASE to refer the
@@ -409,6 +409,114 @@
 
 
 

+
Using OCSP Certificates

+To use Online Certificate Status Protocol (OCSP) with Apache Tomcat, ensure
+  you have downloaded, installed, and configured the
+  
+    Tomcat Native Connector.
+Furthermore, if you use the Windows platform, ensure you download the
+ocsp-enabled connector.
+To use OCSP, you require the following:
+
+
+  OCSP-enabled certificates
+  Tomcat with SSL APR connector
+  Configured OCSP responder
+
+
+Generating OCSP-Enabled Certificates

+Apache Tomcat requires the OCSP-enabled certificate to have the OCSP
+  responder location encoded in the certificate. The basic OCSP-related
+  certificate authority settings in the openssl.cnf file could look
+  as follows:
+
+
+#... omitted for brevity
+
+[x509]
+x509_extensions = v3_issued
+
+[v3_issued]
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+# The address of your responder
+authorityInfoAccess = OCSP;URI:http://127.0.0.1:8088
+keyUsage = critical,digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment,keyAgreement,keyCertSign,cRLSign,encipherOnly,decipherOnly
+basicConstraints=critical,CA:FALSE
+nsComment="Testing OCSP Certificate"
+
+#... omitted for brevity
+
+
+The settings above encode the OCSP responder address
+  127.0.0.1:8088 into the certificate. Note that for the following
+   steps, you must have openssl.cnf and other configuration of
+   your CA ready. To generate an OCSP-enabled certificate:
+
+
+  
+    Create a private key:
+    openssl genrsa -aes256 -out ocsp-cert.key 4096
+  
+  
+    Create a signing request (CSR):
+    openssl req -config openssl.cnf -new -sha256 \
+  -key ocsp-cert.key -out ocsp-cert.csr
+  
+    Sign the CSR:
+    openssl ca -openssl.cnf -extensions ocsp -days 375 -notext \
+  -md sha256 -in ocsp-cert.csr -out ocsp-cert.crt
+  
+  
+    You may verify the certificate:
+    openssl x509 -noout -text -in ocsp-cert.crt
+  
+
+
+
+Configuring OCSP Connector

+
+To configure the OCSP connector, first verify that you are loading the Tomcat
+   APR library. Check the 
+   Apache Portable Runtime (APR) based Native library for Tomcat
+for more information about installation of APR. A basic OCSP-enabled connector
+ definition in the server.xml file looks as follows:
+
+<Connector
+    port="8443"
+    protocol="org.apache.coyote.http11.Http11AprProtocol"
+    secure="true"
+    scheme="https"
+    SSLEnabled="true"
+  <SSLHostConfig
+      caCertificateFile="/path/to/ca.pem"
+      certificateVerification="require"
+      certificateVerificationDepth="10" >
+    <Certificate
+        certificateFile="/path/to/ocsp-cert.crt"
+        certificateKeyFile="/path/to/ocsp-cert.key" />
+  </SSLHostConfig>
+
+
+
+Starting OCSP Responder

+  Apache Tomcat will query an OCSP responder server to get the certificate
+  status. When testing, an easy way to create an OCSP responder is by executing
+   the following:
+  
openssl ocsp -port 127.0.0.1:8088 \
+    -text -sha256 -index index.txt \
+    -CA ca-chain.cert.pem -rkey ocsp-cert.key \
+    -rsigner ocsp-cert.crt
 
+
+ Do note that when using OCSP, the responder encoded in the connector
+   certificate must be running. For further information, see
+   
+     OCSP documentation
+   .
+ 
+
+
+
 
Troubleshooting

 
 Here is a list of common problems that you may encounter when setting up
@@ -575,5 +683,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.


\ No newline at end of file
diff --git a/output/webapps/docs/tribes/developers.html b/output/webapps/docs/tribes/developers.html
old mode 100755
new mode 100644
index ffc5e07..233155a
--- a/output/webapps/docs/tribes/developers.html
+++ b/output/webapps/docs/tribes/developers.html
@@ -1,5 +1,5 @@
 
-Apache Tribes - The Tomcat Cluster Communication Module (9.0.0.M21) - Apache Tribes - Developers
Apache Tribes - The Tomcat Cluster Communication Module

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Developers
Developers

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Developers
Developers

     TODO
 

                   Comments
@@ -46,5 +46,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/tribes/faq.html b/output/webapps/docs/tribes/faq.html
old mode 100755
new mode 100644
index cced8e9..72625b7
--- a/output/webapps/docs/tribes/faq.html
+++ b/output/webapps/docs/tribes/faq.html
@@ -1,5 +1,5 @@
 
-Apache Tribes - The Tomcat Cluster Communication Module (9.0.0.M21) - Apache Tribes - Frequently Asked Questions
Apache Tribes - The Tomcat Cluster Communication Module

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Frequently Asked Questions
Frequently Asked Questions

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Frequently Asked Questions
Frequently Asked Questions

     TODO
 

                   Comments
@@ -46,5 +46,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/tribes/interceptors.html b/output/webapps/docs/tribes/interceptors.html
old mode 100755
new mode 100644
index 015c16b..2d1d057
--- a/output/webapps/docs/tribes/interceptors.html
+++ b/output/webapps/docs/tribes/interceptors.html
@@ -1,5 +1,5 @@
 
-Apache Tribes - The Tomcat Cluster Communication Module (9.0.0.M21) - Apache Tribes - Interceptors
Apache Tribes - The Tomcat Cluster Communication Module

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Interceptors
Interceptors

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Interceptors
Interceptors

     TODO
 

                   Comments
@@ -46,5 +46,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/tribes/introduction.html b/output/webapps/docs/tribes/introduction.html
old mode 100755
new mode 100644
index 3bdc24a..31633cc
--- a/output/webapps/docs/tribes/introduction.html
+++ b/output/webapps/docs/tribes/introduction.html
@@ -1,5 +1,5 @@
 
-Apache Tribes - The Tomcat Cluster Communication Module (9.0.0.M21) - Apache Tribes - Introduction
Apache Tribes - The Tomcat Cluster Communication Module

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Introduction
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Introduction
Table of Contents

 Quick Start
What is Tribes
Why another messaging framework
Feature Overview
Where can I get Tribes
 
Quick Start

 
@@ -273,5 +273,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/tribes/membership.html b/output/webapps/docs/tribes/membership.html
old mode 100755
new mode 100644
index f32255c..698d0c8
--- a/output/webapps/docs/tribes/membership.html
+++ b/output/webapps/docs/tribes/membership.html
@@ -1,5 +1,5 @@
 
-Apache Tribes - The Tomcat Cluster Communication Module (9.0.0.M21) - Apache Tribes - Membership
Apache Tribes - The Tomcat Cluster Communication Module

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Membership
Membership

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Membership
Membership

     TODO
 

                   Comments
@@ -46,5 +46,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/tribes/setup.html b/output/webapps/docs/tribes/setup.html
old mode 100755
new mode 100644
index fec94ec..1586614
--- a/output/webapps/docs/tribes/setup.html
+++ b/output/webapps/docs/tribes/setup.html
@@ -1,5 +1,5 @@
 
-Apache Tribes - The Tomcat Cluster Communication Module (9.0.0.M21) - Apache Tribes - Configuration
Apache Tribes - The Tomcat Cluster Communication Module

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Configuration
Configuration Overview

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Configuration
Configuration Overview

     TODO
 

                   Comments
@@ -46,5 +46,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/tribes/status.html b/output/webapps/docs/tribes/status.html
old mode 100755
new mode 100644
index 767ae74..ada5239
--- a/output/webapps/docs/tribes/status.html
+++ b/output/webapps/docs/tribes/status.html
@@ -1,5 +1,5 @@
 
-Apache Tribes - The Tomcat Cluster Communication Module (9.0.0.M21) - Apache Tribes - Status
Apache Tribes - The Tomcat Cluster Communication Module

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Status
Status

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Status
Status

     TODO
 

                   Comments
@@ -46,5 +46,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/tribes/transport.html b/output/webapps/docs/tribes/transport.html
old mode 100755
new mode 100644
index 0fbe0bc..db3a28a
--- a/output/webapps/docs/tribes/transport.html
+++ b/output/webapps/docs/tribes/transport.html
@@ -1,5 +1,5 @@
 
-Apache Tribes - The Tomcat Cluster Communication Module (9.0.0.M21) - Apache Tribes - Transport
Apache Tribes - The Tomcat Cluster Communication Module

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Transport
Transport

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Transport
Transport

     TODO
 

                   Comments
@@ -46,5 +46,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/virtual-hosting-howto.html b/output/webapps/docs/virtual-hosting-howto.html
old mode 100755
new mode 100644
index 33a0c7b..7d3adba
--- a/output/webapps/docs/virtual-hosting-howto.html
+++ b/output/webapps/docs/virtual-hosting-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Virtual Hosting and Tomcat
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Virtual Hosting and Tomcat
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Virtual Hosting and Tomcat
Table of Contents

 Assumptions
server.xml
Webapps Directory
Configuring Your ContextsGeneral
context.xml - approach #1
context.xml - approach #2
Further Information
 
Assumptions

     
@@ -136,5 +136,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/web-socket-howto.html b/output/webapps/docs/web-socket-howto.html
old mode 100755
new mode 100644
index a19b93e..5e77963
--- a/output/webapps/docs/web-socket-howto.html
+++ b/output/webapps/docs/web-socket-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - WebSocket How-To
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
WebSocket How-To
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
WebSocket How-To
Table of Contents

 Overview
Application development
Tomcat WebSocket specific configuration
 
Overview

 Tomcat provides support for WebSocket as defined by
@@ -108,6 +108,14 @@
       set then the org.apache.tomcat.websocket.SSL_TRUSTSTORE and
       org.apache.tomcat.websocket.SSL_TRUSTSTORE_PWD properties
       will be ignored.
+
+When using the WebSocket client to connect to server endpoints, the number of
+   HTTP redirects that the client will follow is controlled by the
+   userProperties of the provided
+   javax.websocket.ClientEndpointConfig. The property is
+   org.apache.tomcat.websocket.MAX_REDIRECTIONS. The default value
+   is 20. Redirection support can be disabled by configuring a value of zero.
+
 

                   Comments
                 
Notice: This comments section collects your suggestions
@@ -121,5 +129,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/websocketapi/index.html b/output/webapps/docs/websocketapi/index.html
old mode 100755
new mode 100644
diff --git a/output/webapps/docs/windows-auth-howto.html b/output/webapps/docs/windows-auth-howto.html
old mode 100755
new mode 100644
index 9fe4f4b..d739556
--- a/output/webapps/docs/windows-auth-howto.html
+++ b/output/webapps/docs/windows-auth-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Windows Authentication How-To
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Windows Authentication How-To
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Windows Authentication How-To
Table of Contents

 Overview
Built-in Tomcat supportDomain Controller
Tomcat instance (Windows server)
Tomcat instance (Linux server)
Web application
Client
References
Third party librariesWaffle
Spring Security - Kerberos Extension
SPNEGO project at SourceForge
Jespa
Reverse proxiesMicrosoft IIS
Apache httpd
 
Overview

 Integrated Windows authentication is most frequently used within intranet
@@ -193,7 +193,7 @@
   changes:
   
   The Linux server does not have to be part of the Windows domain.
-  The path to the keytab file in krb5.ini and jass.conf should be updated
+  
The path to the keytab file in krb5.ini and jaas.conf should be updated
       to reflect the path to the keytab file on the Linux server using Linux
       style file paths (e.g. /usr/local/tomcat/...).
   
@@ -336,5 +336,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/docs/windows-service-howto.html b/output/webapps/docs/windows-service-howto.html
old mode 100755
new mode 100644
index c73fb85..e777977
--- a/output/webapps/docs/windows-service-howto.html
+++ b/output/webapps/docs/windows-service-howto.html
@@ -1,5 +1,5 @@
 
-Apache Tomcat 9 (9.0.0.M21) - Windows service HOW-TO
Apache Tomcat 9

-          Version 9.0.0.M21,
-          May 4 2017
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Windows service HOW-TO
Table of Contents

+          Version 9.0.4,
+          Jan 18 2018
Links
Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Realms and AAA
7) Security Manager
8) JNDI Resources
9) JDBC DataSources
10) Classloading
11) JSPs
12) SSL/TLS
13) SSI
14) CGI
15) Proxy Support
16) MBeans Descriptors
17) Default Servlet
18) Clustering
19) Load Balancer
20) Connectors
21) Monitoring and Management
22) Logging
23) APR/Native
24) Virtual Hosting
25) Advanced IO
26) Additional Components
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Functional Specs.
Tribes
Windows service HOW-TO
Table of Contents

 Tomcat service application
Tomcat monitor application
Command line arguments
Command line parameters
Installing services
Updating services
Removing services
Debugging services
Multiple Instances
 
Tomcat service application

 
@@ -94,9 +94,9 @@
 
 
Command line parameters

 
-    Each command parameter is prefixed with --.
-    If the command line is prefixed with ++ then it's value will
-    be appended to the existing option.
+    Each command line parameter is prefixed with --. If the command line
+    parameter is prefixed with ++ then it's value will be appended to the
+    existing option.
     If the environment variable with the same name as command line parameter but
     prefixed with PR_ exists it will take precedence.
     For example:
@@ -133,13 +133,13 @@
     Service startup mode can be either auto or manual
     
     
-    ++DependsOn
+    --DependsOn
     
     List of services that this service depend on. Dependent services
         are separated using either # or ; characters
     
     
-    ++Environment
+    --Environment
     
     List of environment variables that will be provided to the service
         in the form key=value. They are separated using either
@@ -173,11 +173,22 @@
         You can use the environment variable expansion here.
     
     
-    ++JvmOptions
+    --JvmOptions
     -Xrs
     List of options in the form of -D or -X that will be
         passed to the JVM. The options are separated using either
-        # or ; characters. (Not used in exe mode.)
+        # or ; characters. If you need to embed either # or
+        ; characters, put them inside single quotes. (Not used in
+        exe mode.)
+    
+    
+    --JvmOptions9
+    
+    List of options in the form of -D or -X that will be
+        passed to the JVM when running on Java 9 or later. The options are
+        separated using either # or ; characters. If you need to
+        embed either # or ; characters, put them inside single
+        quotes. (Not used in exe mode.)
     
     
     --Classpath
@@ -236,7 +247,7 @@
     Method name if differs then main
     
     
-    ++StartParams
+    --StartParams
     
     List of parameters that will be passed to either StartImage or
         StartClass. Parameters are separated using either # or
@@ -272,7 +283,7 @@
     Method name if differs then main
     
     
-    ++StopParams
+    --StopParams
     
     List of parameters that will be passed to either StopImage or
         StopClass. Parameters are separated using either # or
@@ -468,5 +479,5 @@
                     Comments may be removed by our moderators if they are either
                     implemented or considered invalid/off-topic.
                   

-    Copyright © 1999-2017, The Apache Software Foundation
+    Copyright © 1999-2018, The Apache Software Foundation
   
\ No newline at end of file
diff --git a/output/webapps/examples/WEB-INF/classes/CookieExample.class b/output/webapps/examples/WEB-INF/classes/CookieExample.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/CookieExample.java b/output/webapps/examples/WEB-INF/classes/CookieExample.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/HelloWorldExample.class b/output/webapps/examples/WEB-INF/classes/HelloWorldExample.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/HelloWorldExample.java b/output/webapps/examples/WEB-INF/classes/HelloWorldExample.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/LocalStrings.properties b/output/webapps/examples/WEB-INF/classes/LocalStrings.properties
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/LocalStrings_en.properties b/output/webapps/examples/WEB-INF/classes/LocalStrings_en.properties
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/LocalStrings_es.properties b/output/webapps/examples/WEB-INF/classes/LocalStrings_es.properties
old mode 100755
new mode 100644
index e843d25..025a3ff
--- a/output/webapps/examples/WEB-INF/classes/LocalStrings_es.properties
+++ b/output/webapps/examples/WEB-INF/classes/LocalStrings_es.properties
@@ -12,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
 helloworld.title = Hola Mundo!
 requestinfo.title = Ejemplo de Informacion de Requerimiento:
 requestinfo.label.method = M\u00E9todo:
diff --git a/output/webapps/examples/WEB-INF/classes/LocalStrings_fr.properties b/output/webapps/examples/WEB-INF/classes/LocalStrings_fr.properties
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/LocalStrings_pt.properties b/output/webapps/examples/WEB-INF/classes/LocalStrings_pt.properties
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/RequestHeaderExample.class b/output/webapps/examples/WEB-INF/classes/RequestHeaderExample.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/RequestHeaderExample.java b/output/webapps/examples/WEB-INF/classes/RequestHeaderExample.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/RequestInfoExample.class b/output/webapps/examples/WEB-INF/classes/RequestInfoExample.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/RequestInfoExample.java b/output/webapps/examples/WEB-INF/classes/RequestInfoExample.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/RequestParamExample.class b/output/webapps/examples/WEB-INF/classes/RequestParamExample.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/RequestParamExample.java b/output/webapps/examples/WEB-INF/classes/RequestParamExample.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/ServletToJsp.class b/output/webapps/examples/WEB-INF/classes/ServletToJsp.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/ServletToJsp.java b/output/webapps/examples/WEB-INF/classes/ServletToJsp.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/SessionExample.class b/output/webapps/examples/WEB-INF/classes/SessionExample.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/SessionExample.java b/output/webapps/examples/WEB-INF/classes/SessionExample.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async0$1.class b/output/webapps/examples/WEB-INF/classes/async/Async0$1.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async0.class b/output/webapps/examples/WEB-INF/classes/async/Async0.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async0.java b/output/webapps/examples/WEB-INF/classes/async/Async0.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async1$1.class b/output/webapps/examples/WEB-INF/classes/async/Async1$1.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async1.class b/output/webapps/examples/WEB-INF/classes/async/Async1.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async1.java b/output/webapps/examples/WEB-INF/classes/async/Async1.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async2$1.class b/output/webapps/examples/WEB-INF/classes/async/Async2$1.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async2.class b/output/webapps/examples/WEB-INF/classes/async/Async2.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async2.java b/output/webapps/examples/WEB-INF/classes/async/Async2.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async3.class b/output/webapps/examples/WEB-INF/classes/async/Async3.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/Async3.java b/output/webapps/examples/WEB-INF/classes/async/Async3.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.java b/output/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.java
new file mode 100644
index 0000000..685ac23
--- /dev/null
+++ b/output/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.java
@@ -0,0 +1,44 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  See the NOTICE file distributed with
+ *  this work for additional information regarding copyright ownership.
+ *  The ASF licenses this file to You under the Apache License, Version 2.0
+ *  (the "License"); you may not use this file except in compliance with
+ *  the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package async;
+
+import javax.servlet.ServletContext;
+import javax.servlet.ServletContextEvent;
+import javax.servlet.ServletContextListener;
+
+/*
+ * Ensures the Stockticker is shut down cleanly when the context stops. This
+ * also covers the case when the server shuts down.
+ */
+public class AsyncStockContextListener implements ServletContextListener {
+
+    public static final String STOCK_TICKER_KEY = "StockTicker";
+
+    @Override
+    public void contextInitialized(ServletContextEvent sce) {
+        Stockticker stockticker = new Stockticker();
+        ServletContext sc = sce.getServletContext();
+        sc.setAttribute(STOCK_TICKER_KEY, stockticker);
+    }
+
+    @Override
+    public void contextDestroyed(ServletContextEvent sce) {
+        ServletContext sc = sce.getServletContext();
+        Stockticker stockticker = (Stockticker) sc.getAttribute(STOCK_TICKER_KEY);
+        stockticker.shutdown();
+    }
+}
diff --git a/output/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.class b/output/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.class
old mode 100755
new mode 100644
index 903cd1f..c0ee6ae
Binary files a/output/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.class and b/output/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.class differ
diff --git a/output/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.java b/output/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.java
old mode 100755
new mode 100644
index adaa72b..8b3ac15
--- a/output/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.java
+++ b/output/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.java
@@ -25,6 +25,7 @@
 import javax.servlet.AsyncContext;
 import javax.servlet.AsyncEvent;
 import javax.servlet.AsyncListener;
+import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
@@ -45,7 +46,6 @@ public class AsyncStockServlet extends HttpServlet implements TickListener, Asyn
     private static final ConcurrentLinkedQueue clients =
             new ConcurrentLinkedQueue<>();
     private static final AtomicInteger clientcount = new AtomicInteger(0);
-    private static final Stockticker ticker = new Stockticker();
 
     public AsyncStockServlet() {
         log.info("AsyncStockServlet created");
@@ -63,6 +63,8 @@ protected void service(HttpServletRequest req, HttpServletResponse resp)
             resp.setContentType("text/plain");
             clients.add(actx);
             if (clientcount.incrementAndGet()==1) {
+                Stockticker ticker = (Stockticker) req.getServletContext().getAttribute(
+                        AsyncStockContextListener.STOCK_TICKER_KEY);
                 ticker.addTickListener(this);
             }
         } else {
@@ -85,29 +87,46 @@ public void tick(Stock stock) {
         }
     }
 
-    public void writeStock(AsyncContext actx, Stock stock) {
+
+    public void writeStock(AsyncContext actx, Stock stock) throws IOException {
         HttpServletResponse response = (HttpServletResponse)actx.getResponse();
-        try {
-            PrintWriter writer = response.getWriter();
-            writer.write("STOCK#");//make client parsing easier
-            writer.write(stock.getSymbol());
-            writer.write("#");
-            writer.write(stock.getValueAsString());
-            writer.write("#");
-            writer.write(stock.getLastChangeAsString());
-            writer.write("#");
-            writer.write(String.valueOf(stock.getCnt()));
-            writer.write("\n");
-            writer.flush();
-            response.flushBuffer();
-        }catch (IOException x) {
-            try {actx.complete();}catch (Exception ignore){/* Ignore */}
+        PrintWriter writer = response.getWriter();
+        writer.write("STOCK#");//make client parsing easier
+        writer.write(stock.getSymbol());
+        writer.write("#");
+        writer.write(stock.getValueAsString());
+        writer.write("#");
+        writer.write(stock.getLastChangeAsString());
+        writer.write("#");
+        writer.write(String.valueOf(stock.getCnt()));
+        writer.write("\n");
+        writer.flush();
+        response.flushBuffer();
+    }
+
+
+    @Override
+    public void shutdown() {
+        // The web application is shutting down. Complete any AsyncContexts
+        // associated with an active client.
+        Iterator it = clients.iterator();
+        while (it.hasNext()) {
+            AsyncContext actx = it.next();
+            try {
+                actx.complete();
+            } catch (Exception e) {
+                // Ignore. The async error handling will deal with this.
+            }
         }
     }
 
+
     @Override
     public void onComplete(AsyncEvent event) throws IOException {
         if (clients.remove(event.getAsyncContext()) && clientcount.decrementAndGet()==0) {
+            ServletContext sc = event.getAsyncContext().getRequest().getServletContext();
+            Stockticker ticker = (Stockticker) sc.getAttribute(
+                    AsyncStockContextListener.STOCK_TICKER_KEY);
             ticker.removeTickListener(this);
         }
     }
diff --git a/output/webapps/examples/WEB-INF/classes/async/Stockticker$Stock.class b/output/webapps/examples/WEB-INF/classes/async/Stockticker$Stock.class
old mode 100755
new mode 100644
index ea96b91..28b82bb
Binary files a/output/webapps/examples/WEB-INF/classes/async/Stockticker$Stock.class and b/output/webapps/examples/WEB-INF/classes/async/Stockticker$Stock.class differ
diff --git a/output/webapps/examples/WEB-INF/classes/async/Stockticker$TickListener.class b/output/webapps/examples/WEB-INF/classes/async/Stockticker$TickListener.class
old mode 100755
new mode 100644
index 9ed0d75..3b67fbb
Binary files a/output/webapps/examples/WEB-INF/classes/async/Stockticker$TickListener.class and b/output/webapps/examples/WEB-INF/classes/async/Stockticker$TickListener.class differ
diff --git a/output/webapps/examples/WEB-INF/classes/async/Stockticker.class b/output/webapps/examples/WEB-INF/classes/async/Stockticker.class
old mode 100755
new mode 100644
index a88c4cc..c3235e6
Binary files a/output/webapps/examples/WEB-INF/classes/async/Stockticker.class and b/output/webapps/examples/WEB-INF/classes/async/Stockticker.class differ
diff --git a/output/webapps/examples/WEB-INF/classes/async/Stockticker.java b/output/webapps/examples/WEB-INF/classes/async/Stockticker.java
old mode 100755
new mode 100644
index 8965b60..e87744e
--- a/output/webapps/examples/WEB-INF/classes/async/Stockticker.java
+++ b/output/webapps/examples/WEB-INF/classes/async/Stockticker.java
@@ -17,14 +17,15 @@
 package async;
 
 import java.text.DecimalFormat;
-import java.util.ArrayList;
+import java.util.List;
 import java.util.Random;
+import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.atomic.AtomicInteger;
 
 public class Stockticker implements Runnable {
         public volatile boolean run = true;
         protected final AtomicInteger counter = new AtomicInteger(0);
-        final ArrayList listeners = new ArrayList<>();
+        final List listeners = new CopyOnWriteArrayList<>();
         protected volatile Thread ticker = null;
         protected volatile int ticknr = 0;
 
@@ -36,6 +37,12 @@ public synchronized void start() {
         }
 
         public synchronized void stop() {
+            // On context stop this can be called multiple times.
+            // NO-OP is the ticker thread is not set
+            // (i.e. stop() has already completed)
+            if (ticker == null) {
+                return;
+            }
             run = false;
             try {
                 ticker.join();
@@ -46,6 +53,17 @@ public synchronized void stop() {
             ticker = null;
         }
 
+        public void shutdown() {
+            // Notify each listener of the shutdown. This enables them to
+            // trigger any necessary clean-up.
+            for (TickListener l : listeners) {
+                l.shutdown();
+            }
+            // Wait for the thread to stop. This prevents warnings in the logs
+            // that the thread is still active when the context stops.
+            stop();
+        }
+
         public void addTickListener(TickListener listener) {
             if (listeners.add(listener)) {
                 if (counter.incrementAndGet()==1) start();
@@ -97,6 +115,7 @@ public void run() {
 
     public static interface TickListener {
         public void tick(Stock stock);
+        public void shutdown();
     }
 
     public static final class Stock implements Cloneable {
diff --git a/output/webapps/examples/WEB-INF/classes/cal/Entries.class b/output/webapps/examples/WEB-INF/classes/cal/Entries.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/cal/Entries.java b/output/webapps/examples/WEB-INF/classes/cal/Entries.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/cal/Entry.class b/output/webapps/examples/WEB-INF/classes/cal/Entry.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/cal/Entry.java b/output/webapps/examples/WEB-INF/classes/cal/Entry.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/cal/JspCalendar.class b/output/webapps/examples/WEB-INF/classes/cal/JspCalendar.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/cal/JspCalendar.java b/output/webapps/examples/WEB-INF/classes/cal/JspCalendar.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/cal/TableBean.class b/output/webapps/examples/WEB-INF/classes/cal/TableBean.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/cal/TableBean.java b/output/webapps/examples/WEB-INF/classes/cal/TableBean.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/checkbox/CheckTest.class b/output/webapps/examples/WEB-INF/classes/checkbox/CheckTest.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/checkbox/CheckTest.java b/output/webapps/examples/WEB-INF/classes/checkbox/CheckTest.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/colors/ColorGameBean.class b/output/webapps/examples/WEB-INF/classes/colors/ColorGameBean.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/colors/ColorGameBean.java b/output/webapps/examples/WEB-INF/classes/colors/ColorGameBean.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.class b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.class
old mode 100755
new mode 100644
index 1fd6745..1d4f513
Binary files a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.class and b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.class differ
diff --git a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.java b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.java
old mode 100755
new mode 100644
index 6d98e7d..fbba3c7
--- a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.java
+++ b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.java
@@ -45,17 +45,18 @@ public class CompressionFilter extends GenericFilter {
     /**
      * Minimal reasonable threshold.
      */
-    private final int minThreshold = 128;
+    private static final int MIN_THRESHOLD = 128;
 
     /**
-     * The threshold number to compress.
+     * Minimal reasonable buffer.
      */
-    protected int compressionThreshold = 0;
+    // 8KB is what tomcat would use by default anyway
+    private static final int MIN_BUFFER = 8192;
 
     /**
-     * Minimal reasonable buffer.
+     * The threshold number to compress.
      */
-    private final int minBuffer = 8192;  // 8KB is what tomcat would use by default anyway
+    protected int compressionThreshold = 0;
 
     /**
      * The compression buffer size to avoid chunking.
@@ -82,24 +83,24 @@ public void init() {
         str = getInitParameter("compressionThreshold");
         if (str != null) {
             compressionThreshold = Integer.parseInt(str);
-            if (compressionThreshold != 0 && compressionThreshold < minThreshold) {
+            if (compressionThreshold != 0 && compressionThreshold < MIN_THRESHOLD) {
                 if (debug > 0) {
-                    System.out.println("compressionThreshold should be either 0 - no compression or >= " + minThreshold);
-                    System.out.println("compressionThreshold set to " + minThreshold);
+                    System.out.println("compressionThreshold should be either 0 - no compression or >= " + MIN_THRESHOLD);
+                    System.out.println("compressionThreshold set to " + MIN_THRESHOLD);
                 }
-                compressionThreshold = minThreshold;
+                compressionThreshold = MIN_THRESHOLD;
             }
         }
 
         str = getInitParameter("compressionBuffer");
         if (str != null) {
             compressionBuffer = Integer.parseInt(str);
-            if (compressionBuffer < minBuffer) {
+            if (compressionBuffer < MIN_BUFFER) {
                 if (debug > 0) {
-                    System.out.println("compressionBuffer should be >= " + minBuffer);
-                    System.out.println("compressionBuffer set to " + minBuffer);
+                    System.out.println("compressionBuffer should be >= " + MIN_BUFFER);
+                    System.out.println("compressionBuffer set to " + MIN_BUFFER);
                 }
-                compressionBuffer = minBuffer;
+                compressionBuffer = MIN_BUFFER;
             }
         }
 
diff --git a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.class b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.java b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.class b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.java b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.class b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.class
old mode 100755
new mode 100644
index 61032ea..626c503
Binary files a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.class and b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.class differ
diff --git a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.java b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.java
old mode 100755
new mode 100644
index 60413c5..e12859d
--- a/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.java
+++ b/output/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.java
@@ -229,8 +229,7 @@ public ServletOutputStream getOutputStream() throws IOException {
             System.out.println("stream is set to "+stream+" in getOutputStream");
         }
 
-        return (stream);
-
+        return stream;
     }
 
     /**
@@ -244,7 +243,7 @@ public ServletOutputStream getOutputStream() throws IOException {
     public PrintWriter getWriter() throws IOException {
 
         if (writer != null)
-            return (writer);
+            return writer;
 
         if (stream != null)
             throw new IllegalStateException("getOutputStream() has already been called for this response");
@@ -257,15 +256,9 @@ public PrintWriter getWriter() throws IOException {
         if (debug > 1) {
             System.out.println("character encoding is " + charEnc);
         }
-        // HttpServletResponse.getCharacterEncoding() shouldn't return null
-        // according the spec, so feel free to remove that "if"
-        if (charEnc != null) {
-            writer = new PrintWriter(new OutputStreamWriter(stream, charEnc));
-        } else {
-            writer = new PrintWriter(stream);
-        }
+        writer = new PrintWriter(new OutputStreamWriter(stream, charEnc));
 
-        return (writer);
+        return writer;
     }
 
     @Override
diff --git a/output/webapps/examples/WEB-INF/classes/dates/JspCalendar.class b/output/webapps/examples/WEB-INF/classes/dates/JspCalendar.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/dates/JspCalendar.java b/output/webapps/examples/WEB-INF/classes/dates/JspCalendar.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/error/Smart.class b/output/webapps/examples/WEB-INF/classes/error/Smart.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/error/Smart.java b/output/webapps/examples/WEB-INF/classes/error/Smart.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.class b/output/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.java b/output/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/FooTag.class b/output/webapps/examples/WEB-INF/classes/examples/FooTag.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/FooTag.java b/output/webapps/examples/WEB-INF/classes/examples/FooTag.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.class b/output/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.java b/output/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/LogTag.class b/output/webapps/examples/WEB-INF/classes/examples/LogTag.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/LogTag.java b/output/webapps/examples/WEB-INF/classes/examples/LogTag.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/ShowSource.class b/output/webapps/examples/WEB-INF/classes/examples/ShowSource.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/ShowSource.java b/output/webapps/examples/WEB-INF/classes/examples/ShowSource.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/ValuesTag.class b/output/webapps/examples/WEB-INF/classes/examples/ValuesTag.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/examples/ValuesTag.java b/output/webapps/examples/WEB-INF/classes/examples/ValuesTag.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/filters/ExampleFilter.class b/output/webapps/examples/WEB-INF/classes/filters/ExampleFilter.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/filters/ExampleFilter.java b/output/webapps/examples/WEB-INF/classes/filters/ExampleFilter.java
old mode 100755
new mode 100644
index 56272de..3e0123b
--- a/output/webapps/examples/WEB-INF/classes/filters/ExampleFilter.java
+++ b/output/webapps/examples/WEB-INF/classes/filters/ExampleFilter.java
@@ -96,7 +96,7 @@ public String toString() {
         StringBuilder sb = new StringBuilder("TimingFilter(");
         sb.append(getFilterConfig());
         sb.append(")");
-        return (sb.toString());
+        return sb.toString();
     }
 }
 
diff --git a/output/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.class b/output/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.java b/output/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.class b/output/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.java b/output/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.class b/output/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.java b/output/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.class b/output/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.java b/output/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.class b/output/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.class
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.java b/output/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.java
old mode 100755
new mode 100644
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.class b/output/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.class
old mode 100755
new mode 100644
index 715ae01..61c5868
Binary files a/output/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.class and b/output/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.class differ
diff --git a/output/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.java b/output/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.java
old mode 100755
new mode 100644
index 8cdd48c..c34237d
--- a/output/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.java
+++ b/output/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.java
@@ -20,6 +20,7 @@
 
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.List;
 
 import javax.servlet.jsp.JspException;
 import javax.servlet.jsp.JspWriter;
@@ -33,8 +34,8 @@ public class EchoAttributesTag
     extends SimpleTagSupport
     implements DynamicAttributes
 {
-    private final ArrayList keys = new ArrayList<>();
-    private final ArrayList

"); - writer.print(filter(name)); + writer.print(Escape.htmlElementContext(name)); writer.print("

QuickStart

Overview

Buffers and Encodings

Digester Configuration Properties

Digester Configuration Properties

Digester Configuration Properties

Digester Configuration Properties

Digester Configuration Properties

Digester Configuration Properties

Element Matching Patterns

Logging

Usage Examples

Creating a Simple Object Tree

Creating a Simple Object Tree

Creating a Simple Object Tree

Processing A Struts Configuration File

Processing A Struts Configuration File

Processing A Struts Configuration File

Parsing Body Text In XML Files

Parsing Body Text In XML Files

RegexRules

RegexMatchers

RegexMatchers

Using Named Stacks For Inter-Rule Communication

External Entity Resolution Using Digester

Debugging Exceptions

Diagnosing SAX Exceptions

Diagnosing SAX Exceptions

Diagnosing SAX Exceptions

Frequently Asked Questions

Frequently Asked Questions

${pageContext.servletContext.serverInfo}

If you're seeing this, you've successfully installed Tomcat. Congratulations!

Recommended Reading:

Developer Quick Start

Managing Tomcat

Documentation

Getting Help

FAQ and Mailing Lists

Other Downloads

Other Documentation

Get Involved

Miscellaneous

Apache Software Foundation

Advanced IO and Tomcat

Table of Contents

Advanced IO and Tomcat

Table of Contents

Introduction

Deployment

Table of Contents

Deployment

Table of Contents

Background

Table of Contents

Preface

Table of Contents

Preface

Installation

Installation

Installation

Installation

JDK

Introduction

Overview

Introduction

Overview

Development Processes

Table of Contents

Development Processes

Table of Contents

Development Processes

Source Organization

Table of Contents

Source Organization

Table of Contents

Directory Structure

Apache Portable Runtime (APR) based Native library for Tomcat

Table of Contents