Apache Tomcat 9 (9.0.11) - Load Balancer HOW-TO

Date: Sat, 23 Feb 2019 15:00:46 +0000 (+0900) Subject: 프론트 zipexplore, 백엔드 zip파일생성 신규코딩 X-Git-Url: https://git.insang.kr/gitweb/?a=commitdiff_plain;h=b0fa3451db38d24f87ef715ad7678d0827b066f9;p=ZipProject.git 프론트 zipexplore, 백엔드 zip파일생성 신규코딩 프론트 디렉토리 생성후 전부 다 넣었을때 밖으로 안빠지는 문제 수정 백엔드 zip파일 생성 후 다운로드까지 코딩 서버단에 파일 저장되는것 지우는 코드 작성해야함 --- diff --git a/ZipProject/Views/WebZip/partial_zip.cshtml b/ZipProject/Views/WebZip/partial_zip.cshtml index c017ad3..0b42f18 100644 --- a/ZipProject/Views/WebZip/partial_zip.cshtml +++ b/ZipProject/Views/WebZip/partial_zip.cshtml @@ -14,7 +14,7 @@ @LanguagePack.GetText(lang, "editname") - + @@ -64,15 +64,17 @@

- - - - example - -

- + + + + example + +

+ +

Building Tomcat

Introduction
Download a Java Development Kit (JDK) version 8
Install Apache Ant 1.9.8 or later
Checkout or obtain the Tomcat source code
Configure download area
Building Tomcat
Building with Eclipse
Building with other IDEs

Introduction

+ +

+Building Apache Tomcat from source is very easy, and is the first step to +contributing to Tomcat. The complete and comprehensive instructions are +provided in the file BUILDING.txt. +The following is a quick step by step guide. +

+ +

Download a Java Development Kit (JDK) version 8

+ +

+Building Apache Tomcat requires a JDK (version 8) to be installed. You can download one from
+http://www.oracle.com/technetwork/java/javase/downloads/index.html
+http://openjdk.java.net/install/index.html
+or another JDK vendor. +

+ +

+IMPORTANT: Set an environment variable JAVA_HOME to the pathname of the +directory into which you installed the JDK release. +

+ +

Install Apache Ant 1.9.8 or later

+ +

+Download a binary distribution of Ant 1.9.8 or later from +here. +

+ +

+Unpack the binary distribution into a convenient location so that the +Ant release resides in its own directory (conventionally named +apache-ant-1.9.x). For the remainder of this guide, +the symbolic name ${ant.home} is used to refer to the full pathname of + the Ant installation directory. +

+ +

+IMPORTANT: Create an ANT_HOME environment variable to point the directory ${ant.home}, +and modify the PATH environment variable to include directory +${ant.home}/bin in its list. This makes the ant command line script +available, which will be used to actually perform the build. +

+ +

Checkout or obtain the Tomcat source code

+ +

+ Tomcat SVN repository URL: + https://svn.apache.org/repos/asf/tomcat/trunk/ +

+ Tomcat source packages: + https://tomcat.apache.org/download-90.cgi. +

+ +

+ Checkout the source using SVN, selecting a tag for released version or + trunk for the current development code, or download and unpack a + source package. For the remainder of this guide, the symbolic name + ${tomcat.source} is used to refer to the + location where the source has been placed. +

+ +

Configure download area

+ +

+ Building Tomcat involves downloading a number of libraries that it depends on. + It is strongly recommended to configure download area for those libraries. +

+ +

+ By default the build is configured to download the dependencies into the + ${user.home}/tomcat-build-libs directory. You can change this + (see below) but it must be an absolute path. +

+ +

+ The build is controlled by creating a + ${tomcat.source}/build.properties file. It can be used to + redefine any property that is present in build.properties.default + and build.xml files. The build.properties file + does not exist by default. You have to create it. +

+ +

+ The download area is defined by property base.path. For example: +

+ +

# ----- Default Base Path for Dependent Packages -----
+# Replace this path with the directory path where
+# dependencies binaries should be downloaded.
+base.path=/home/me/some-place-to-download-to

+ +

+ Different versions of Tomcat are allowed to share the same download area. +

+ +

+ Another example: +

+ +

base.path=${user.dir}/../libraries-tomcat9.0

+ +

+ Users who access the Internet through a proxy must use the properties + file to indicate to Ant the proxy configuration: +

+ +

# ----- Proxy setup -----
+proxy.host=proxy.domain
+proxy.port=8080
+proxy.use=on

+ +

Building Tomcat

+ +

+Use the following commands to build Tomcat: +

+ +

+cd ${tomcat.source}
+ant +

+ +

+Once the build has completed successfully, a usable Tomcat installation will have been +produced in the ${tomcat.source}/output/build directory, and can be started +and stopped with the usual scripts. +

Building with Eclipse

+ +

+IMPORTANT: This is not a supported means of building Tomcat; this information is +provided without warranty :-). +The only supported means of building Tomcat is with the Ant build described above. +However, some developers like to work on Java code with a Java IDE, +and the following steps have been used by some developers. +

+ +

+NOTE: This will not let you build everything under Eclipse; +the build process requires use of Ant for the many stages that aren't +simple Java compilations. +However, it will allow you to view and edit the Java code, +get warnings, reformat code, perform refactorings, run Tomcat +under the IDE, and so on. +

+ +

+WARNING: Do not forget to create and configure + ${tomcat.source}/build.properties file as described above + before running any Ant targets. +

+ +

+Sample Eclipse project files and launch targets are provided in the +res/ide-support/eclipse directory of the source tree. +The instructions below will automatically copy these into the required locations. +

+An Ant target is provided as a convenience to download all binary dependencies, and to create +the Eclipse project and classpath files in the root of the source tree. +

+ +

+cd ${tomcat.source}
+ant ide-eclipse +

+ +

+Start Eclipse and create a new Workspace. +

+ +

+Open the Preferences dialog and then select Java->Build Path->Classpath +Variables to add two new Classpath Variables: +

+ + + + + +

TOMCAT_LIBS_BASE	The same location as the `base.path` + setting in `build.properties`, where the binary dependencies have been downloaded
ANT_HOME	the base path of Ant 1.9.8 or later

+ + +

+Use File->Import and choose Existing Projects into Workspace. +From there choose the root directory of the Tomcat source tree (${tomcat.source}) +and import the Tomcat project located there. +

+ +

+start-tomcat and stop-tomcat launch configurations are provided in +res/ide-support/eclipse and will be available in the Run->Run Configurations +dialog. Use these to start and stop Tomcat from Eclipse. +If you want to configure these yourself (or are using a different IDE) +then use org.apache.catalina.startup.Bootstrap as the main class, +start/stop etc. as program arguments, and specify -Dcatalina.home=... +(with the name of your build directory) as VM arguments. +

+ +

+Tweaking a few formatting preferences will make it much easier to keep consistent with Tomcat +coding conventions (and have your contributions accepted): +

+ + + + + + + + +

Java -> Code Style -> Formatter -> Edit...	Tab policy: Spaces only Tab and Indentation size: 4
General -> Editors -> Text Editors	Displayed tab width: 2 Insert spaces for tabs Show whitespace characters (optional)
XML -> XML Files -> Editor	Indent using spaces Indentation size: 2
Ant -> Editor -> Formatter	Tab size: 2 Use tab character instead of spaces: unchecked

+ +

+The recommended configuration of Compiler Warnings is documented in +res/ide-support/eclipse/java-compiler-errors-warnings.txt file. +

+ +

Building with other IDEs

+The same general approach should work for most IDEs; it has been reported +to work in IntelliJ IDEA, for example. +

+ +

+ Comments +

Notice: This comments section collects your suggestions + on improving documentation for Apache Tomcat.

+ If you have trouble and need help, read + Find Help page + and ask your question on the tomcat-users + mailing list. + Do not ask such questions here. This is not a Q&A section.

+ The Apache Comments System is explained here. + Comments may be removed by our moderators if they are either + implemented or considered invalid/off-topic. +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509329980/new/balancer-howto.html b/ZipProject/wwwroot/zip/15509329980/new/balancer-howto.html new file mode 100644 index 0000000..ebef81c --- /dev/null +++ b/ZipProject/wwwroot/zip/15509329980/new/balancer-howto.html @@ -0,0 +1,61 @@ + +Apache Tomcat 9 (9.0.11) - Load Balancer HOW-TO

Load Balancer HOW-TO

Using the JK 1.2.x native connector
Using Apache HTTP Server 2.x with mod_proxy

Using the JK 1.2.x native connector

+ +Please refer to the JK 1.2.x documentation. + +

Using Apache HTTP Server 2.x with mod_proxy

+ +Please refer to the mod_proxy documentation for Apache HTTP Server 2.2. This supports either +HTTP or AJP load balancing. This new version of mod_proxy is also usable with +Apache HTTP Server 2.0, but mod_proxy will have to be compiled separately using the code +from Apache HTTP Server 2.2. + +

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509330470/1/balancer-howto.html b/ZipProject/wwwroot/zip/15509330470/1/balancer-howto.html new file mode 100644 index 0000000..ebef81c --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/1/balancer-howto.html @@ -0,0 +1,61 @@ + +Apache Tomcat 9 (9.0.11) - Load Balancer HOW-TO

Load Balancer HOW-TO

Using the JK 1.2.x native connector
Using Apache HTTP Server 2.x with mod_proxy

Using the JK 1.2.x native connector

+ +Please refer to the JK 1.2.x documentation. + +

Using Apache HTTP Server 2.x with mod_proxy

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509330470/1/building.html b/ZipProject/wwwroot/zip/15509330470/1/building.html new file mode 100644 index 0000000..2235920 --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/1/building.html @@ -0,0 +1,278 @@ + +Apache Tomcat 9 (9.0.11) - Building Tomcat

Building Tomcat

Introduction
Download a Java Development Kit (JDK) version 8
Install Apache Ant 1.9.8 or later
Checkout or obtain the Tomcat source code
Configure download area
Building Tomcat
Building with Eclipse
Building with other IDEs

Introduction

+ +

Download a Java Development Kit (JDK) version 8

+ +

+IMPORTANT: Set an environment variable JAVA_HOME to the pathname of the +directory into which you installed the JDK release. +

+ +

Install Apache Ant 1.9.8 or later

+ +

+Download a binary distribution of Ant 1.9.8 or later from +here. +

+ +

Checkout or obtain the Tomcat source code

+ +

+ Tomcat SVN repository URL: + https://svn.apache.org/repos/asf/tomcat/trunk/ +

+ Tomcat source packages: + https://tomcat.apache.org/download-90.cgi. +

+ +

Configure download area

+ +

+ Building Tomcat involves downloading a number of libraries that it depends on. + It is strongly recommended to configure download area for those libraries. +

+ +

+ By default the build is configured to download the dependencies into the + ${user.home}/tomcat-build-libs directory. You can change this + (see below) but it must be an absolute path. +

+ +

+ The download area is defined by property base.path. For example: +

+ +

# ----- Default Base Path for Dependent Packages -----
+# Replace this path with the directory path where
+# dependencies binaries should be downloaded.
+base.path=/home/me/some-place-to-download-to

+ +

+ Different versions of Tomcat are allowed to share the same download area. +

+ +

+ Another example: +

+ +

base.path=${user.dir}/../libraries-tomcat9.0

+ +

+ Users who access the Internet through a proxy must use the properties + file to indicate to Ant the proxy configuration: +

+ +

# ----- Proxy setup -----
+proxy.host=proxy.domain
+proxy.port=8080
+proxy.use=on

+ +

Building Tomcat

+ +

+Use the following commands to build Tomcat: +

+ +

+cd ${tomcat.source}
+ant +

+ +

Building with Eclipse

+ +

+WARNING: Do not forget to create and configure + ${tomcat.source}/build.properties file as described above + before running any Ant targets. +

+ +

+An Ant target is provided as a convenience to download all binary dependencies, and to create +the Eclipse project and classpath files in the root of the source tree. +

+ +

+cd ${tomcat.source}
+ant ide-eclipse +

+ +

+Start Eclipse and create a new Workspace. +

+ +

+Open the Preferences dialog and then select Java->Build Path->Classpath +Variables to add two new Classpath Variables: +

+ + + + + +

TOMCAT_LIBS_BASE	The same location as the `base.path` + setting in `build.properties`, where the binary dependencies have been downloaded
ANT_HOME	the base path of Ant 1.9.8 or later

+ + +

+Use File->Import and choose Existing Projects into Workspace. +From there choose the root directory of the Tomcat source tree (${tomcat.source}) +and import the Tomcat project located there. +

+ +

+Tweaking a few formatting preferences will make it much easier to keep consistent with Tomcat +coding conventions (and have your contributions accepted): +

+ + + + + + + + +

Java -> Code Style -> Formatter -> Edit...	Tab policy: Spaces only Tab and Indentation size: 4
General -> Editors -> Text Editors	Displayed tab width: 2 Insert spaces for tabs Show whitespace characters (optional)
XML -> XML Files -> Editor	Indent using spaces Indentation size: 2
Ant -> Editor -> Formatter	Tab size: 2 Use tab character instead of spaces: unchecked

+ +

+The recommended configuration of Compiler Warnings is documented in +res/ide-support/eclipse/java-compiler-errors-warnings.txt file. +

+ +

Building with other IDEs

+The same general approach should work for most IDEs; it has been reported +to work in IntelliJ IDEA, for example. +

+ +

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509330470/2/cgi-howto.html b/ZipProject/wwwroot/zip/15509330470/2/cgi-howto.html new file mode 100644 index 0000000..4cf2e98 --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/2/cgi-howto.html @@ -0,0 +1,154 @@ + +Apache Tomcat 9 (9.0.11) - CGI How To

Introduction

+ +

The CGI (Common Gateway Interface) defines a way for a web server to +interact with external content-generating programs, which are often +referred to as CGI programs or CGI scripts. +

+ +

Within Tomcat, CGI support can be added when you are using Tomcat as your +HTTP server and require CGI support. Typically this is done +during development when you don't want to run a web server like +Apache httpd. +Tomcat's CGI support is largely compatible with Apache httpd's, +but there are some limitations (e.g., only one cgi-bin directory). +

+ +

CGI support is implemented using the servlet class +org.apache.catalina.servlets.CGIServlet. Traditionally, +this servlet is mapped to the URL pattern "/cgi-bin/*".

+ +

By default CGI support is disabled in Tomcat.

Installation

+ +

CAUTION - CGI scripts are used to execute programs +external to the Tomcat JVM. If you are using the Java SecurityManager this +will bypass your security policy configuration in catalina.policy.

+ +

To enable CGI support:

+ +

There are commented-out sample servlet and servlet-mapping elements for +CGI servlet in the default $CATALINA_BASE/conf/web.xml file. +To enable CGI support in your web application, copy that servlet and +servlet-mapping declarations into WEB-INF/web.xml file of your +web application.
+ +
Uncommenting the servlet and servlet-mapping in +$CATALINA_BASE/conf/web.xml file enables CGI for all installed +web applications at once.
+
Set privileged="true" on the Context element for your +web application.
+ +
Only Contexts which are marked as privileged are allowed to use the +CGI servlet. Note that modifying the global $CATALINA_BASE/conf/context.xml +file affects all web applications. See +Context documentation for details.
+

+ +

Configuration

+ +

There are several servlet init parameters which can be used to +configure the behaviour of the CGI servlet.

cgiPathPrefix - The CGI search path will start at +the web application root directory + File.separator + this prefix. +By default there is no value, which results in the web application root +directory being used as the search path. The recommended value is +WEB-INF/cgi
enableCmdLineArguments - Are command line parameters +generated from the query string as per section 4.4 of 3875 RFC? The default is +false.
environment-variable- - An environment to be set for the +execution environment of the CGI script. The name of variable is taken from the +parameter name. To configure an environment variable named FOO, configure a +parameter named environment-variable-FOO. The parameter value is used as the +environment variable value. The default is no environment variables.
executable - The name of the executable to be used to +run the script. You may explicitly set this parameter to be an empty string +if your script is itself executable (e.g. an exe file). Default is +perl.
executable-arg-1, executable-arg-2, +and so on - additional arguments for the executable. These precede the +CGI script name. By default there are no additional arguments.
envHttpHeaders - A regular expression used to select the +HTTP headers passed to the CGI process as environment variables. Note that +headers are converted to upper case before matching and that the entire header +name must match the pattern. Default is +ACCEPT[-0-9A-Z]*|CACHE-CONTROL|COOKIE|HOST|IF-[-0-9A-Z]*|REFERER|USER-AGENT +
parameterEncoding - Name of the parameter encoding +to be used with the CGI servlet. Default is +System.getProperty("file.encoding","UTF-8"). That is the system +default encoding, or UTF-8 if that system property is not available.
passShellEnvironment - Should the shell environment +variables from Tomcat process (if any) be passed to the CGI script? Default is +false.
stderrTimeout - The time (in milliseconds) to wait for +the reading of stderr to complete before terminating the CGI process. Default +is 2000.

+ +

The CGI script executed depends on the configuration of the CGI Servlet and +how the request is mapped to the CGI Servlet. The CGI search path starts at the +web application root directory + File.separator + cgiPathPrefix. The +pathInfo is then searched unless it is null - in +which case the servletPath is searched.

+ +

The search starts with the first path segment and expands one path segment +at a time until no path segments are left (resulting in a 404) or a script is +found. Any remaining path segments are passed to the script in the +PATH_INFO environment variable.

+ +

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509330470/3/BUILDING.txt b/ZipProject/wwwroot/zip/15509330470/3/BUILDING.txt new file mode 100644 index 0000000..2544cfc --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/3/BUILDING.txt @@ -0,0 +1,561 @@ +================================================================================ + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +================================================================================ + + ==================================================== + Building The Apache Tomcat 9.0 Servlet/JSP Container + ==================================================== + +This subproject contains the source code for Tomcat 9.0, a container that +implements the Servlet 4.0, JSP 2.3, EL 3.0, WebSocket 1.1 and JASPIC 1.1 +specifications from the Java Community Process . + +Note: If you just need to run Apache Tomcat, it is not necessary to build +it. You may simply download a binary distribution. It is cross-platform. +Read RUNNING.txt for the instruction on how to run it. + +In order to build a binary distribution version of Apache Tomcat from a +source distribution, do the following: + + +(1) Download and Install a Java Development Kit + + 1. If the JDK is already installed, skip to (2). + + 2. Download a version 8 of Java Development Kit (JDK) release (use the + latest update available for your chosen version) from one of: + + http://www.oracle.com/technetwork/java/javase/downloads/index.html + http://openjdk.java.net/install/index.html + or another JDK vendor. + + Note regarding later versions of Java: + + As documented elsewhere, one of components in Apache Tomcat includes + a private copy of the Apache Commons DBCP library. + + The JDBC interfaces implemented by DBCP frequently change in non-backwards + compatible ways between versions of the Java SE specification. Therefore, + it is likely that DBCP will only compile with the specific version of Java + listed above and that compilation will fail if a later version of Java is + used. + + See Apache Commons DBCP project web site for more details on + available versions of the library and its requirements, + + https://commons.apache.org/dbcp/ + + 3. Install the JDK according to the instructions included with the release. + + 4. Set an environment variable JAVA_HOME to the pathname of the directory + into which you installed the JDK release. + + +(2) Install Apache Ant version 1.9.8 or later on your computer. + + 1. If Apache Ant version 1.9.8 or later is already installed on your + computer, skip to (3). + + 2. Download a binary distribution of Ant from: + + https://ant.apache.org/bindownload.cgi + + 3. Unpack the binary distribution into a convenient location so that the + Ant release resides in its own directory (conventionally named + "apache-ant-[version]"). + + For the purposes of the remainder of this document, the symbolic name + "${ant.home}" is used to refer to the full pathname of the release + directory. + + 4. Create an ANT_HOME environment variable to point the directory + ${ant.home}. + + 5. Modify the PATH environment variable to include the directory + ${ant.home}/bin in its list. This makes the "ant" command line script + available, which will be used to actually perform the build. + + +(3) Building Tomcat 9.0 + +(3.1) Checkout or obtain the source code for Tomcat 9.0 + +Checkout the source using SVN, selecting a tag for released version or +trunk for the current development code, or download and unpack a source +package. + + * Tomcat SVN repository URL: + + https://svn.apache.org/repos/asf/tomcat/tc9.0.x/trunk/ + + * Source packages can be downloaded from: + + https://tomcat.apache.org/download-90.cgi + +The location where the source has been placed will be further referred as +${tomcat.source}. + +The Tomcat local build process does not modify line-endings. The svn repository +is configured so that all files will be checked out with the line-ending +appropriate for the current platform. When using a source package you should +ensure that you use the source package that has the appropriate line-ending +for your platform: + + zip -> CRLF + tar.gz -> LF + +Note that the release build process does modify line-endings to ensure that +each release package has the appropriate line-endings. + +(3.2) Building + + 1. The build is controlled by creating a ${tomcat.source}/build.properties + file. + + It is recommended to always create the file, because of unfortunate + default value of base.path property. You may start with the following + content for the file: + + # ----- Default Base Path for Dependent Packages ----- + # Replace this path with the directory path where dependencies binaries + # should be downloaded + base.path=/home/me/some-place-to-download-to + + 2. Configure base.path property by adding it to the + ${tomcat.source}/build.properties file. + + The base.path property specifies the place where Tomcat dependencies + required by the build are downloaded. It is recommended to place this + directory outside of the source tree, so that you do not waste your + time re-downloading the libraries. + +* NOTE: The default value of the base.path property configures the build script + to download the libraries required to build Tomcat to the + ${user.home}/tomcat-build-libs directory. + +* NOTE: Users accessing the Internet through a proxy must use the properties + file to indicate to Ant the proxy configuration. + + The following properties should be added to the ${tomcat.source}/build.properties + file. + + proxy.use=true + proxy.host=proxy.domain + proxy.port=8080 + proxy.user=username + proxy.password=password + + See Apache Ant documentation for the task for details. + + 3. Go to the sources directory and run Ant: + + cd ${tomcat.source} + ant + + This will execute the "deploy" target in build.xml. + + Once the build has completed successfully, a usable Tomcat installation + will have been produced in the ${tomcat.source}/output/build directory, + and can be started and stopped with the usual scripts. + + Note that the build includes Tomcat documentation, which can be found + in the output/build/webapps/docs directory. + + The path of the output directory can be controlled by specifying the + "tomcat.output" property in the build.properties file. + +* NOTE: Do not run the build as the root user. Building and running Tomcat + does not require root privileges. + + +(4) Updating sources and rebuilding + +It is recommended that you regularly update the downloaded Tomcat 9.0 +sources using your SVN client. + +For a quick rebuild of only modified code you can use: + + cd ${tomcat.source} + ant + + +(5) Special builds + +There are several targets in Tomcat build files that are useful to be +called separately. They build components that you may want to build +quickly, or ones that are included in the full release and are not built +during the default "deploy" build. + +(5.1) Building documentation + +The documentation web application is built during the default "deploy" +build. + +It can be built quickly by using the following commands: + + cd ${tomcat.source} + ant build-docs + +The output of this command will be found in the following directory: + + output/build/webapps/docs + + +The API documentation (Javadoc) is built during a "release" build. It is +easy to build it separately by using the following commands: + + cd ${tomcat.source} + ant javadoc + +The output of this command will be found in the following directories: + + output/dist/webapps/docs/api + output/dist/webapps/docs/elapi + output/dist/webapps/docs/jspapi + output/dist/webapps/docs/servletapi + + +(5.2) Building the extras (commons-logging, webservices etc.) + +These components are documented on the "Additional Components" +(extras.html) page of documentation. They are built during a "release" +build. + +You can build them by using the following commands: + + cd ${tomcat.source} + ant extras + +(5.3) Building the embedded packages + +These are built during a "release" build. + +You can build them by using the following commands: + + cd ${tomcat.source} + ant embed + + +(6) Building a full release (as provided via the ASF download pages) + + A full release includes the Windows installer which requires a Windows + environment to be available to create it. If not building in a Windows + environment, the build scripts assume that Wine is available. If this is not + the case, the skip.installer property may be set to skip the creation of the + Windows installer. + + 1. Configure GPG, if needed + + If the released artifacts have to be cryptographically signed with a + PGP signature, like the official ASF releases are, the following + property can be added to the build.properties file: + + # Location of GPG executable (used only for releases) + gpg.exec=/path/to/gpg + + You do not need it if you do not plan to sign the release. + + If "gpg.exec" property does not point to an existing file, it will be + ignored and this feature will be disabled. + + You will be prompted for the GPG passphrase when the release build + starts, unless "gpg.passphrase" property is set. + + 2. If building the Windows installer + + If running the build in a UAC enabled environment, building the Windows + installer requires elevated privileges. The simplest way to do this is to + open the command prompt used for the build with the "Run as administrator" + option. + + 3. Configure the code signing service + + ASF committers performing official releases will need to configure the code + signing service so that the Windows installer is signed during the build + process. The following properties need to be added to the build.properties + file: + + # Location of GPG executable (used only for releases) + # Code signing of Windows installer + do.codesigning=true + codesigning.user=request-via-pmc + codesigning.pwd=request-via-pmc + codesigning.partnercode=request-via-pmc + codesigning.service=Microsoft Windows Signing + + Release managers will be provided with the necessary credentials by the PMC. + + 4. Build the release: + + cd ${tomcat.source} + ant release + + +(7) Tests + +(7.1) Running Tomcat tests + +Tomcat includes a number of junit tests. The tests are not run when a +release is built. There is separate command to run them. + +To run the testsuite use the following command: + + cd ${tomcat.source} + ant test + +It is advisable to redirect output of the above command to a file for later +inspection. + +The JUnit reports generated by the tests will be written to the following +directory: + + output/build/logs + +By default the testsuite is run three times to test 3 different +implementations of Tomcat connectors: NIO, NIO2 and APR. (If you are not +familiar with Tomcat connectors, see config/http.html in documentation for +details). + +The 3 runs are enabled and disabled individually by the following +properties, which all are "true" by default: + + execute.test.nio=true + execute.test.nio2=true + execute.test.apr=true + +The APR connector can be tested only if Tomcat-Native library binaries are +found by the testsuite. The "test.apr.loc" property specifies the directory +where the library binaries are located. + +By default the "test.apr.loc" property specifies the following location: + + output/build/bin/native/ + +If you are on Windows and want to test the APR connector you can put the +tcnative-1.dll file into ${tomcat.source}/bin/native/ and it will be copied +into the above directory when the build runs. + +The unit tests include tests of the clustering functionality which require +multicast to be enabled. There is a simple application provided in the Tomcat +test source (org.apache.catalina.tribes.TesterMulticast) that can be used to +check if a machine supports multicast. Notes on enabling multicast for different +operating systems are provided in the Javadoc for that class. + + +(7.2) Running a single test + +It is possible to run a single JUnit test class by adding the "test.entry" +property to the build.properties file. The property specifies the name of +the test class. + +For example: + + test.entry=org.apache.catalina.util.TestServerInfo + +It is possible to further limit such run to a number of selected test +methods by adding "test.entry.methods" property. The property specifies a +comma-separated list of test case methods. + +For example: + + test.entry=org.apache.el.lang.TestELArithmetic + test.entry.methods=testMultiply01,testMultiply02 + + +(7.3) Running a set of tests + +It is possible to run a set of JUnit test classes by adding the "test.name" +property to the build.properties file. The property specifies an Ant +includes pattern for the fileset of test class files to run. + +The default value is "**/Test*.java", so all test classes are being +executed (with few exceptions - see build.xml for several exclude patterns). + +You can include multiple patterns by concatenating them with a comma (",") +as the separator. + +For example: + + test.name=**/TestSsl.java,**/TestWebSocketFrameClientSSL.java + +You can exclude specific JUnit test classes by adding the "test.exclude" +property to the build.properties file. The property specifies an Ant +excludes pattern for the fileset of test class files to exclude form the run. +The default value is empty, so no classes are excluded. The syntax is the same +as for the property "test.name". + + +(7.4) Other configuration options + + 1. It is possible to configure the directory where JUnit reports are + written to. It is configured by "test.reports" property. The default + value is + + output/build/logs + + 2. It is possible to enable generation of access log file when the tests + are run. This is off by default and can be enabled by the following + property: + + test.accesslog=true + + The "access_log." file will be written to the same directory as + JUnit reports, + + output/build/logs + + 3. The testsuite respects logging configuration as configured by + ${tomcat.source}/conf/logging.properties + + The log files will be written to the temporary directory used by the + tests, + + output/test-tmp/logs + + 4. It is possible to configure formatter used by JUnit reports. + Configuration properties are "junit.formatter.type", + "junit.formatter.extension" and "junit.formatter.usefile". + + For example the following property disables generation of separate report + files: + + junit.formatter.usefile=false + + 5. It is possible to speed up testing by letting JUnit to run several + tests in parallel. + + This is configured by setting "test.threads" property. The recommended + value is one thread per core. + + 6. Optional support is provided for the Cobertura code coverage tool. + +NOTE: Cobertura is licensed under GPL v2 with parts of it being under + Apache License v1.1. See https://cobertura.github.io/cobertura/ for details. + Using it during Tomcat build is optional and is off by default. + + Cobertura can be enabled using the following properties: + + test.cobertura=true + test.threads=1 + + Using Cobertura currently requires setting test.threads configuration + property to the value of 1. Setting that property to a different value + will disable code coverage. + + The report files by default are written to + + output/coverage + + 7. The performance tests are written to run reasonably powerful machines (such + as a developer may use day to day) assuming no other resource hungry + processes are running. + + These assumptions are not always true (e.g. on CI systems running in a + virtual machine) so the performance tests may be disabled by using the + following property: + + test.excludePerformance=true + + 8. Some tests include checks that the access log valve entries are as expected. + These checks include timings. On slower / loaded systems these checks will + often fail. The checks may be relaxed by using the following property: + + test.relaxTiming=true + + 9. It is known that some platforms (e.g. OSX El Capitan) require IPv4 to + be the default for the multicast tests to work. This is configured by + the following property: + + java.net.preferIPv4Stack=true + + 10. It is possible to control whether the output of the tests is displayed + on the console or not. By default it is displayed and can be disabled + by the following property: + + test.verbose=true + +(8) Source code checks + +(8.1) Checkstyle + +NOTE: Checkstyle is licensed under LGPL. Using Checkstyle during Tomcat + build is optional and is off by default. + + See http://checkstyle.sourceforge.net/ for more information. + +Tomcat comes with a Checkstyle configuration that tests its source code +for certain conventions, like presence of the license header. + +To enable Checkstyle, add the following property to build.properties file: + + execute.validate=true + +Once Checkstyle is enabled, the check will be performed automatically +during the build. The check is run before compilation of the source code. + +To speed-up repeated runs of this check, a cache is configured. The cache +is located in the following directory: + + output/res/checkstyle + +It is possible to run the check separately by calling the "validate" +target. The command is: + + cd ${tomcat.source} + ant -Dexecute.validate=true validate + + +(8.2) FindBugs + +NOTE: FindBugs is licensed under LGPL. Using Findbugs during Tomcat build is + optional and is off by default. + + See http://findbugs.sourceforge.net/ for more information. + +To enable FindBugs, add the following property to build.properties file: + + execute.findbugs=true + +To compile Tomcat classes and generate a FindBugs report, call the +"findbugs" target. For example: + + cd ${tomcat.source} + ant -Dexecute.findbugs=true findbugs + +The report file by default is written to + + output/findbugs + + +(8.3) End-of-line conventions check + +You usually would not need to run this check. You can skip this section. + +Apache Tomcat project has convention that all of its textual source files, +stored in Subversion repository, are marked with Subversion property +"svn:eol-style" with value of "native". This convention makes the editing +of source code on different platforms easier. + +This test is used by developers to check that the source code adheres to +this convention. It verifies that the ends of lines in textual files are +appropriate for the operating system where it is run. The idea is to run +this check regularly on two different platforms and notify developers when +an inconsistency is detected. + +The command to run this test is: + + cd ${tomcat.source} + ant validate-eoln diff --git a/ZipProject/wwwroot/zip/15509330470/3/changelog.html b/ZipProject/wwwroot/zip/15509330470/3/changelog.html new file mode 100644 index 0000000..378ebd6 --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/3/changelog.html @@ -0,0 +1,5916 @@ + +Apache Tomcat 9 (9.0.11) - Changelog

Changelog

Tomcat 9.0.11 (markt)

Catalina

+ Make the isLocked() method of the LockOutRealm + public and expose the method via JMX. (markt) +
+ 53387: Add support for regular expression capture groups to + the SSI servlet and filter. (markt) +
+ 53411: Improve the handling of HTTP requests that do not + explicitly specify a host name when no default host is configured. Also + improve the tracking of changes to the default host as hosts are added + and removed while Tomcat is running. (markt) +
+ Ensure that the HTTP Vary header is set correctly when using the CORS + filter and improve the cacheability of requests that pass through the + COPRS filter. (markt) +
+ 62527: Revert restriction of JNDI to the java: + namespace. (remm) +
+ Introduce a new class - MultiThrowable - to report + exceptions when multiple actions are taken where each action may throw + an exception but all actions are taken before any errors are reported. + Use this new class when reporting multiple container (e.g. web + application) failures during start. (markt) +
+ Correctly decode URL paths (+ should not be decoded to a + space in the path) in the RequestDispatcher and the web + application class loader. (markt) +
+ Make logout more robust if JASPIC subject is unexpectedly unavailable. + (markt) +
+ 62547: JASPIC cleanSubject() was not called on + logout when the authenticator was configured to cache the authenticated + Principal. Patch provided by Guillermo González de Agüero. (markt) +
+ 62559: Add jaxb-*.jar to the list of JARs + ignored by StandardJarScanner. (markt) +
+ 62560: Add oraclepki.jar to the list of JARs + ignored by StandardJarScanner. (markt) +
+ 62607: Return a non-zero exit code from + catalina.[bat|sh] run if Tomcat fails to start. (markt) +
+ Use short circuit logic to prevent potential NPE in CorsFilter. (fschumacher) +
+ Simplify construction of appName from container name in JAASRealm. (fschumacher) +
+ Remove ServletException from declaration of + Tomcat.addWebapp(String,String) since it is never thrown. + Patch provided by Tzafrir. (markt) +

Coyote

+ Refactor HTTP date creation and parsing to reduce code duplication, + reduce the use of ThreadLocals and to increase the use of caching. + (markt) +
+ 56676: Add a default location for the native library, as + ${catalina.home}/bin, which the testsuite already uses. (remm) +
+ 60560: Add support for using an inherited channel to + the NIO connector. Based on a patch submitted by Thomas Meyer with + testing and suggestions by Coty Sutherland. (remm) +
+ 62507: Ensure that JSSE based TLS connectors work correctly + with a DKS keystore. (markt) +
+ Refactor code that adds an additional header name to the + Vary HTTP response header to use a common utility method + that addresses several additional edge cases. (markt) +
+ 62515: When a connector is configured (via setting + bindOnInit to false) to bind/unbind the server + socket during start/stop, close the socket earlier in the stop process + so new connections do not sit in the TCP backlog during the shutdown + process only to be dropped as stop completes. In this scenario new + connections will now be refused immediately. (markt) +
+ 62526: Correctly handle PKCS12 format key stores when the key + store password is configured to be the empty string. (markt) +
+ 62605: Ensure ReadListener.onDataAvailable() is + called when the initial request body data arrives after the request + headers when using asynchronous processing over HTTP/2. (markt) +
+ 62614: Ensure that + WriteListener.onWritePossible() is called after + isReady() returns false and the window size is + subsequently incremented when using asynchronous processing over HTTP/2. + (markt) +

Jasper

+ 53492: Make the Java file generation process multi-threaded. + By default, one thread will be used per core. Based on a patch by Dan + Fabulich. (markt) +
+ 62453: Add a performance optimisation for using expressions + in tags that depend on uninitialised tag attributes with implied scope. + Generally, using an explicit scope with tag attributes in EL is the best + way to avoid various potential performance issues. (markt) +
+ Correctly decode URL paths (+ should not be decoded to a + space in the path) in the Jasper class loader. (markt) +
+ 62603: Fix a potential race condition when development mode + is disabled and background compilation checks are enabled. It was + possible that some updates would not take effect and/or + ClassNotFoundExceptions would occur. (markt) +

WebSocket

+ 62596: Remove the limit on the size of the initial HTTP + upgrade request used to establish the web socket connection. (markt) +

Web applications

+ 62558: Add Russian translations for the Manager and Host + Manager web applications. Based on a patch by Ivan Krasnov. (markt) +
+ Add documents for Static Membership service. (kfujino) +
+ 62561: Add advanced class loader configuration information + regarding the use of the Server and Shared class loaders to the + documentation web application. (markt) +

Tribes

+ Ensures that the specified rxBufSize is correctly set to + receiver buffer size. (kfujino) +
+ Correct the stop order of the Channel components. It stops in the + reverse order to that at startup. (kfujino) +
+ Added new StaticMembership implementation. This implementation does not + require any additional configuration of other + ChannelInterceptors. It works only with membership service. + (kfujino) +

Other

+ Support building with Java 9+ while preserving the Java 8 compatibility + at runtime (requires Ant 1.9.8 or later). (ebourg) +
+ Update WSDL4J library to version 1.6.3 (from 1.6.2). (kkolinko) +
+ Update JUnit library to version 4.12 (from 4.11). (kkolinko) +
+ Downgrade CGLib library used for testing with EasyMock to version + 2.2.2 (from 2.2.3) as version 2.2.3 is not available from Maven Central. + (markt) +
+ Implement checksum checks when downloading dependencies that are used + to build Tomcat. (kkolinko) +
+ Fixed spelling. Patch provided by Jimmy Casey via GitHub. (violetagg) +
+ Update the internal fork of Apache Commons Pool 2 to 3e02523 + (2018-08-09) to pick up some bug fixes and enhancements. (markt) +
+ Update the internal fork of Apache Commons DBCP 2 to abc0484 + (2018-08-09) to pick up some bug fixes and enhancements. (markt) +
+ Correct various spelling errors throughout the source code and + documentation. Patch provided by Kazuhiro Sera. (markt) +

2018-06-25 Tomcat 9.0.10 (markt)

Catalina

+ 62476: Use GMT timezone for the value of + Expires header as required by HTTP specification + (RFC 7231, 7234). (kkolinko) +

not released Tomcat 9.0.9 (markt)

Catalina

+ Treat the <mapped-name> element of a + <env-entry> in web.xml in the same way as the + mappedName element of the equivalent @Resource + annotation. Both now attempt to set the mappedName property + of the resource. (markt) +
+ Correct the processing of resources with + <injection-target>s defined in web.xml. First look + for a match using JavaBean property names and then, only if a match is + not found, look for a match using fields. (markt) +
+ When restoring a saved request with a request body after FORM + authentication, ensure that calls to the HttpServletRequest + methods getRequestURI(), getQueryString() and + getProtocol() are not corrupted by the processing of the + saved request body. (markt) +
+ JNDI resources that are defined with injection targets but no value are + now treated as if the resource is not defined. (markt) +
+ Ensure that JNDI names used for <lookup-name> entries + in web.xml and for lookup elements of + @Resource annotations specify a name with an explicit + java: namespace. (markt) +
+ 50019: Add support for <lookup-name>. + Based on a patch by Gurkan Erdogdu. (markt) +
+ Add the AuthenticatedUserRealm for use with CLIENT-CERT and + SPNEGO when just the authenticated user name is required. (markt) +
+ 50175: Add a new attribute to the standard context + implementation, skipMemoryLeakChecksOnJvmShutdown, that + allows the user to configure Tomcat to skip the memory leak checks + usually performed during web application stop if that stop is triggered + by a JVM shutdown. (markt) +
+ 51497: Add an option, ipv6Canonical, to the + AccessLogValve that causes IPv6 addresses to be output in + canonical form defined by RFC 5952. (ognjen/markt) +
+ 51953: Add the RemoteCIDRFilter and + RemoteCIDRValve that can be used to allow/deny requests + based on IPv4 and/or IPv6 client address where the IP ranges are defined + using CIDR notation. Based on a patch by Francis Galiegue. (markt) +
+ 62343: Make CORS filter defaults more secure. This is the fix + for CVE-2018-8014. (markt) +
+ Ensure that the web application resources implementation does not + incorrectly cache results for resources that are only visible as class + loader resources. (markt) +
+ 62387: Do not log a warning message if the file based + persistent session store fails to delete the file for a session when the + session is invalidated because the file has not been created yet. + (markt) +
+ Make all loggers associated with Tomcat provided Filters non-static to + ensure that log messages are not lost when a web application is + reloaded. (markt) +
+ Correct the manifest for the annotations-api.jar. The JAR implements the + Common Annotations API 1.3 and the manifest should reflect that. (markt) +
+ Switch to non-static loggers where there is a possibility of a logger + becoming associated with a web application class loader causing log + messages to be lost if the web application is stopped. (markt) +
+ 62389: Add the IPv6 loopback address to the default + internalProxies regular expression. Patch by Craig Andrews. + (markt) +
+ In the RemoteIpValve and RemoteIpFilter, + correctly handle the case when the request passes through one or more + trustedProxies but no internalProxies. Based + on a patch by zhanhb. (markt) +
+ Correct the logic in MBeanFactory.removeConnector() to + ensure that the correct Connector is removed when there are multiple + Connectors using different addresses but the same port. (markt) +
+ Make JAASRealm mis-configuration more obvious by requiring + the authenticated Subject to include at least one Principal of a type + specified by userClassNames. (markt) +

Coyote

+ Correct a regression in the error page handling that prevented error + pages from issuing redirects or taking other action that required the + response status code to be changed. (markt) +
+ Consistent exception propagation for NIO2 SSL close. (remm) +
+ Followup sync fix for NIO2 async IO blocking read/writes. (remm) +
+ Log an error message if the AJP connector detects the the reverse proxy + is sending AJP messages that are too large for the configured + packetSize. (markt) +
+ Relax Host validation by removing the requirement that the final + component of a FQDN must be alphabetic. (markt) +
+ 62371: Improve logging of Host validation failures. (markt) +
+ Fix a couple of unlikely edge cases in the shutting down of the + APR/native connector. (markt) +
+ Add missing handshake timeout for NIO2. (remm) +
+ Correctly handle a digest authorization header when the user name + contains an escaped character. (markt) +
+ Correctly handle a digest authorization header when one of the hex + field values ends the header with in an invalid character. (markt) +
+ Correctly handle an invalid quality value in an + Accept-Language header. (markt) +
+ 62423: Fix SSL docs CRL attribute typo. (remm) +
+ Improve IPv6 validation by ensuring that IPv4-Mapped IPv6 addresses do + not contain leading zeros in the IPv4 part. Based on a patch by Katya + Stoycheva. (markt) +
+ Fix NullPointerException thrown from + replaceSystemProperties() when trying to log messages. (csutherl) +
+ Avoid unnecessary processing of async timeouts. (markt) +

Jasper

+ 50234: Add the capability to generate a web-fragment.xml file + to JspC. (markt) +
+ 62080: Ensure that all reads of the current thread's context + class loader made by the UEL API and implementation are performed via a + PrivilegedAction to ensure that a + SecurityException is not triggered when running under a + SecurityManager. (mark) +
+ 62350: Refactor + org.apache.jasper.runtime.BodyContentImpl so a + SecurityException is not thrown when running under a + SecurityManger and additional permissions are not required in the + catalina.policy file. This is a follow-up to the fix for + 43925. (kkolinko/markt) +
+ Enable JspC from Tomcat 9 to work with Maven JspC compiler plug-ins + written for Tomcat 8.5.x. Patch provided by Pavel Cibulka. (markt) +
+ Update web.xml, web-fragment.xml and web.xml extracts generated by JspC + to use the Servlet 4.0 version of the relevant schemas. (markt) +

Cluster

+ Remove duplicate calls when creating a replicated session to reduce the + time taken to create the session and thereby reduce the chances of a + subsequent session update message being ignored because the session does + not yet exist. (markt) +
+ Add the method to send a message with a specified sendOptions. (kfujino) +
+ When sending the GET_ALL_SESSIONS message, make sure that + sends with asynchronous option in order to avoid ack timeout. Waiting to + receive the ALL_SESSION_DATA message should be done with + waitForSendAllSessions instead of ACK. (kfujino) +

WebSocket

+ Use NIO2 API for websockets writes. (remm) +
+ When decoding of path parameter failed, make sure to throw + DecodeException instead of throwing + ArrayIndexOutOfBoundsException. (kfujino) +
+ Improve the handling of exceptions during TLS handshakes for the + WebSocket client. (markt) +
+ Enable host name verification when using TLS with the WebSocket client. + (markt) +

Web applications

+ 62395: Clarify the meaning of the connector attribute + minSpareThreads in the documentation web application. + (markt) +
+ Correct the documentation for the allowHostHeaderMismatch + attribute of the standard HTTP Connector implementations. (markt) +

Tribes

+ Ensure that the correct default value is returned when retrieve unset + properties in McastService. (kfujino) +
+ Make MembershipService more easily extensible. (kfujino) +

jdbc-pool

+ When logValidationErrors is set to true, the connection + validation error is logged as SEVERE instead of + WARNING. (kfujino) +

Other

+ Ensure that Apache Tomcat may be built from source with Java 11. (markt) +
+ 52381: Add OSGi metadata to JAR files. (markt) +
+ 62391: Remove references to javaw.exe as this + file is not required by Tomcat and the references prevent the use of the + Server JRE. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.17 to + pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL + 1.0.2o. (markt) +
+ 62458: Update the internal fork of Commons Pool 2 to dfef97b + (2018-06-18) to pick up some bug fixes and enhancements. (markt) +
+ Update the internal fork of Commons DBCP 2 to 2.4.0. (markt) +

2018-05-03 Tomcat 9.0.8 (markt)

Catalina

+ 62263: Avoid a NullPointerException when the + RemoteIpValve processes a request for which no Context can + be found. (markt) +
+ 62258: Don't trigger the standard error page mechanism when + the error has caused the connection to the client to be closed as no-one + will ever see the error page. (markt) +
+ Register MBean when DataSource Resource + type="javax.sql.XADataSource". Patch provided by Masafumi Miura. + (csutherl) +
+ Fix a rare edge case that is unlikely to occur in real usage. This edge + case meant that writing long streams of UTF-8 characters to the HTTP + response that consisted almost entirely of surrogate pairs could result + in one surrogate pair being dropped. (markt) +
+ Update the internal fork of Apache Commons BCEL to r1829827 to add early + access Java 11 support to the annotation scanning code. (markt) +
+ 62297: Enable the CrawlerSessionManagerValve to + correctly handle bots that crawl multiple hosts and/or web applications + when the Valve is configured on a Host or an Engine. (fschumacher) +
+ 62309: Fix a SecurityException when using JASPIC + under a SecurityManager when authentication is not + mandatory. (markt) +
+ 62329: Correctly list resources in JAR files when directories + do not have dedicated entries. Patch provided by Meelis Müür. (markt) +
+ Collapse multiple leading / characters to a single + / in the return value of + HttpServletRequest#getContextPath() to avoid issues if the + value is used with HttpServletResponse#sendRedirect(). This + behaviour is enabled by default and configurable via the new Context + attribute allowMultipleLeadingForwardSlashInPath. (markt) +
+ Improve handling of overflow in the UTF-8 decoder with supplementary + characters. (markt) +

Coyote

+ Correct off-by-one error in thread pool that allowed thread pools to + increase in size to one more than the configured limit. Patch provided + by usc. (markt) +
+ Prevent unexpected TLS handshake failures caused by errors during a + previous handshake that were not correctly cleaned-up when using the NIO + or NIO2 connector with the OpenSSLImplementation. (markt) +
+ 62273: Implement configuration options to work-around + specification non-compliant user agents (including all the major + browsers) that do not correctly %nn encode URI paths and query strings + as required by RFC 7230 and RFC 3986. (markt) +
+ Fix sync for NIO2 async IO blocking read/writes. (remm) +

Jasper

+ Update the Eclipse Compiler for Java to 4.7.3a. (markt) +
+ Allow 9 to be used to specify Java 9 as the compiler source + and/or compiler target for JSP compilation. The Early Access value of + 1.9 is still supported. (markt) +
+ Add support for specifying Java 10 (with the value 10) as + the compiler source and/or compiler target for JSP compilation. (markt) +
+ 62287: Do not rely on hash codes to test instances of + ValueExpressionImpl for equality. Patch provided by Mark + Struberg. (markt) +

WebSocket

+ 62301: Correct a regression in the fix for 61491 + that didn't correctly handle a final empty message part in all + circumstances when using PerMessageDeflate. (markt) +
+ 62332: Ensure WebSocket connections are closed after an I/O + error is experienced reading from the client. (markt) +

Other

+ Avoid warning when running under Cygwin when the + JAVA_ENDORSED_DIRS environment variable is not set. Patch + provided by Zemian Deng. (markt) +

2018-04-07 Tomcat 9.0.7 (markt)

Catalina

+ 51195: Avoid a false positive report of a web application + memory leak by clearing ObjectStreamClass$Caches of classes + loaded by the web application when the web application is stopped. + (markt) +
+ 52688: Add support for the maxDays attribute to + the AccessLogValve and ExtendedAccessLogValve. + This allows the maximum number of days for which rotated access logs + should be retained before deletion to be defined. (markt) +
+ Ensure the MBean names for the SSLHostConfig and + SSLHostConfigCertificate are correctly formed when the + Connector is bound to a specific IP address. (markt) +
+ 62168: When using the PersistentManager honor a + value of -1 for minIdleSwap and do not swap + out sessions to keep the number of active sessions under + maxActive. Patch provided by Holger Sunke. (markt) +
+ 62172: Improve Javadoc for + org.apache.catalina.startup.Constants and ensure that the + constants are correctly used. (markt) +
+ 62175: Avoid infinite recursion, when trying to validate + a session while loading it with PersistentManager. + (fschumacher) +
+ Ensure that NamingContextListener instances are only + notified once of property changes on the associated naming resources. + (markt) +
+ 62224: Disable the forkJoinCommonPoolProtection + of the JreMemoryLeakPreventionListener when running on Java + 9 and above since the underlying JRE bug has been fixed. (markt) +

Coyote

+ Avoid potential loop in APR/Native poller. (markt) +
+ Ensure streams that are received but not processed are excluded from the + tracking of maximum ID of processed streams. (markt) +
+ Refactor the check for a paused connector to consistently prevent new + streams from being created after the connector has been paused. (markt) +
+ Improve debug logging for HTTP/2 pushed streams. (markt) +
+ The OpenSSL engine SSL session will now ignore invalid accesses. (remm) +
+ 62177: Correct two protocol errors with HTTP/2 + PUSH_PROMISE frames. Firstly, the HTTP/2 protocol only + permits pushes to be sent on peer initiated requests. Secondly, pushes + must be sent in order of increasing stream ID. These restriction were + not being enforced leading to protocol errors at the client. (markt) +

Web applications

+ Add document for FragmentationInterceptor. (kfujino) +
+ Document how the roles for an authenticated user are determined when the + CombinedRealm is used. (markt) +
+ 62163: Correct the Tomcat Setup documentation that + incorrectly referred to Java 7 as the minimum version rather than Java + 8. (markt) +

Tribes

+ Add JMX support for FragmentationInterceptor in order to + prevent warning of startup. (kfujino) +

jdbc-pool

+ Ensure that SQLWarning has been cleared when connection + returns to the pool. (kfujino) +
+ Enable clearing of SQLWarning via JMX. (kfujino) +
+ Ensure that parameters have been cleared when + PreparedStatement and/or CallableStatement are + cached. (kfujino) +
+ Enable PoolCleaner to be started even if validationQuery + is not set. (kfujino) +

Other

+ Update the build script so MD5 hashes are no longer generated for + releases as per the change in the ASF distribution policy. (markt) +
+ 62164: Switch the build script to use TLS for downloads from + SourceForge and Maven Central to avoid failures due to HTTP to HTTPS + redirects. (markt) +
+ Always report the OS's umask when launching the JVM. (schultz) +
+ Add managed connections package to the package renamed DBCP2 to provide + a complete DBCP2 in Tomcat. (remm) +

2018-03-08 Tomcat 9.0.6 (markt)

Catalina

+ 43866: Add additional attributes to the Manager to provide + control over which listeners are called when an attribute is added to + the session when it has already been added under the same name. This is + to aid clustering scenarios where setAttribute() is often + called to signal that the attribute value has been mutated and needs to + be replicated but it may not be required, or even desired, for the + associated listeners to be triggered. The default behaviour has not been + changed. (markt) +
+ Minor optimization when calling class transformers. (rjung) +
+ Pass errors triggered by invalid requests or unavailable services to the + application provided error handling and/or the container provided error + handling (ErrorReportValve) as appropriate. (markt) +
+ 41007: Add the ability to specify static HTML responses for + specific error codes and/or exception types with the + ErrorReportValve. (markt) +
+ Prevent Tomcat from applying gzip compression to content that is already + compressed with brotli compression. Based on a patch provided by burka. + (markt) +
+ 62090: Null container names are not allowed. (remm) +
+ 62104: Fix programmatic login regression as the + NonLoginAuthenticator has to be set for it to work (if no login method + is specified). (remm) +
+ 62117: Improve error message in catalina.sh when + calling kill -0 <pid> fails. Based on a suggestion + from Mark Morschhaeuser. (markt) +
+ 62118: Correctly create a JNDI ServiceRef using + the specified interface rather than the concrete type. Based on a + suggestion by Ángel Álvarez Páscua. (markt) +
+ Fix for RequestDumperFilter log attribute. Patch provided + by Kirill Romanov via Github. (violetagg) +
+ 62123: Avoid ConcurrentModificationException + when attempting to clean up application triggered RMI memory leaks on + web application stop. (markt) +
+ When a deployment descriptor is deployed that includes a + path attribute, log a warning that the path + attribute will be ignored. (markt) +
+ When a deployment descriptor is deployed that references an external + docBase and, as a result, a docBase under the + appBase will be ignored, log a warning. (markt) +
+ Correct a regression in the fix for 60276 that meant that + compression was applied to all MIME types. Patch provided by Stefan + Knoblich. (markt) +

Coyote

+ Add async HTTP/2 parser for NIO2. (remm) +
+ Add minor HPACK fixes, based on fixes by Stuart Douglas. (remm) +
+ 61751: Follow up fix so that OpenSSL engine returns + underflow when unwrapping if no bytes were produced and the input is + empty. (remm) +
+ Minor OpenSSL engine cleanups. (remm) +
+ NIO SSL handshake should throw an exception on overflow status, like + NIO2 SSL. (remm) +

Web applications

+ 47467: When deploying a web application via the manager + application and a path is not explicitly specified, derive it from the + provided deployment descriptor or, if that is not present, the WAR or + DIR. (markt) +
+ 48672: Add documentation for the Host Manager web + application. Patch provided by Marek Czernek. (markt) +
+ Add support for specifying the application version when deploying an + application via the Manager application HTML interface. (markt) +
+ Work-around a known, non-specification compliant behaviour in some + versions of IE that can allow XSS when the Manager application generates + a plain text response. Based on a suggestion from Muthukumar Marikani. + (markt) +

2018-02-11 Tomcat 9.0.5 (markt)

Catalina

+ Prevent a stack trace being written to standard out when running on Java + 10 due to changes in the LogManager implementation. (markt) +
+ Avoid duplicate load attempts if one has been made already. (remm) +
+ Avoid NPE in ThreadLocalLeakPreventionListener if there is no Engine. + (remm) +
+ 62000: When a JNDI reference cannot be resolved, ensure that + the root cause exception is reported rather than swallowed. (markt) +
+ 62036: When caching an authenticated user Principal in the + session when the web application is configured with the + NonLoginAuthenticator, cache the internal Principal object + rather than the user facing Principal object as Tomcat requires the + internal object to correctly process later authorization checks. (markt) +
+ Refactor error handling to enable errors that occur before processing is + passed to the application to be handled by the application provided + error handling and/or the container provided error handling + (ErrorReportValve) as appropriate. (markt) +
+ Pass 404 errors triggered by a missing ROOT web application to the + container error handling to generate the response body. (markt) +
+ Pass 400 errors triggered by invalid request targets to the container + error handling to generate the response body. (markt) +
+ Provide a correct Allow header when responding to an HTTP + TRACE request for a JSP with a 405 status code. (markt) +
+ When using Tomcat embedded, only perform Authenticator configuration + once during web application start. (markt) +
+ 62067: Correctly apply security constraints mapped to the + context root using a URL pattern of "". (markt) +
+ Process all ServletSecurity annotations at web application + start rather than at servlet load time to ensure constraints are applied + consistently. (markt) +

Coyote

+ 61751: Fix truncated request input streams when using NIO2 + with TLS. (markt) +
+ 62023: Log error reporting multiple SSLHostConfig elements + when using the APR Connector instead of crashing Tomcat. (csutherl) +
+ 62032: Fix NullPointerException when certificateFile is not + defined on an SSLHostConfig and unify the behavior when a + certificateFile is defined but the file does not exist for both + JKS and PEM file types. (csutherl) +
+ Ensure that the toString() method behaves consistently for + ByteChunk and CharChunk and that + null is returned when toString() is called + both on newly created objects and immediately after a call to + recycle(). This should not impact typical Tomcat users. It + may impact users who use these classes directly in their own code. + (markt) +
+ Ensure that the toString(), toBytes() and + toChars() methods of MessageBytes behave + consistently and do not throw a NullPointerException both + on newly created objects and immediately after a call to + recycle(). This should not impact typical Tomcat users. It + may impact users who use these classes directly in their own code. + (markt) +
+ When processing an HTTP 1.0 request in the HTTP connector and no host + information is provided in the request, obtain the server port from the + local port rather than the connector configuration since the configured + value maybe zero. (markt) +
+ Enable strict validation of the provided host name and port for all + connectors. Requests with invalid host names and/or ports will be + rejected with a 400 response. (markt) +
+ Update the host validation to permit host names and components of domain + names (excluding top-level domains) to start with a number and to ensure + that top-level domains are fully alphabetic. (markt) +
+ 62053: Fix NPE when writing push headers with HTTP/2 NIO2. + Patch submitted by Holger Sunke. (remm) +

Jasper

+ Include an HTTP Allow header when a JSP generates a + 405 response due to a request with an unsupported method. (markt) +
+ Add support for the HTTP OPTION method to JSPs. The + JSP specification explicitly states that the behaviour for this + method is undefined for JSPs so this is a Tomcat specific + behaviour. (markt) +

WebSocket

+ 62024: When closing a connection with an abnormal close, + close the socket immediately rather than waiting for a close message + from the client that may never arrive. (markt) +

Webapps

+ 62049: Fix missing class from manager 404 JSP error page. + (remm) +

jdbc-pool

+ Enhance the JMX support for jdbc-pool in order to expose + PooledConnection and JdbcInterceptors. + (kfujino) +
+ Add MBean for PooledConnection. (kfujino) +
+ 62011: Add MBean for StatementCache. (kfujino) +
+ Expose the cache size for each connection via JMX in + StatementCache. (kfujino) +
+ Add MBean for ResetAbandonedTimer. (kfujino) +

Other

+ Update the list with the public interfaces in the RELEASE-NOTES. + (violetagg) +
+ Update the NSIS Installer used to build the Windows installer to version + 3.03. (kkolinko) +

2018-01-22 Tomcat 9.0.4 (markt)

Catalina

+ Correct a regression in the previous fix for 61916 that meant + that any call to addHeader() would have been replaced with + a call to setHeader() for all requests mapped to the + AddDefaultCharsetFilter. (markt) +
+ 61999: maxSavePostSize set to 0 should disable saving POST + data during authentication. (remm) +

Coyote

+ Fix NIO2 HTTP/2 sendfile. (remm) +
+ 61993: Improve handling for ByteChunk and + CharChunk instances that grow close to the maximum size + allowed by the JRE. (markt) +

Jasper

+ 43925: Add a new system property + (org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE) to + control the size of the buffer used by Jasper when buffering tag bodies. + (markt) +

Web applications

+ 62006: Document the new JvmOptions9 command line + parameter for tomcat9.exe. (markt) +

not released Tomcat 9.0.3 (markt)

Catalina

+ 57619: Implement a small optimisation to how JAR URLs are + processed to reduce the storage of duplicate String objects in memory. + Patch provided by Dmitri Blinov. (markt) +
+ Add some missing NPEs to ServletContext. (remm) +
+ Update the Java EE 8 XML schema to the released versions. (markt) +
+ Minor HTTP/2 push fixes. (remm) +
+ 61916: Extend the AddDefaultCharsetFilter to add + a character set when the content type is set via + setHeader() or addHeader() as well as when it + is set via setContentType(). (markt) +
+ When using WebDAV to copy a file resource to a destination that requires + a collection to be overwritten, ensure that the operation succeeds + rather than fails (with a 500 response). This enables Tomcat to pass two + additional tests from the Litmus WebDAV test suite. (markt) +
+ Modify the Default and WebDAV Servlets so that a 405 status code is + returned for PUT and DELETE requests when + disabled via the readonly initialisation parameter. +
+ Align the contents of the Allow header with the response + code for the Default and WebDAV Servlets. For any given resource a + method that returns a 405 status code will not be listed in the + Allow header and a method listed in the Allow + header will not return a 405 status code. (markt) +

Coyote

+ 60276: Implement GZIP compression support for responses + served over HTTP/2. (markt) +
+ Do not call onDataAvailable without any data to read. (remm) +
+ Correctly handle EOF when ServletInputStream.isReady() is + called. (markt) +
+ 61886: Log errors on non-container threads at + DEBUG rather than INFO. The exception will be + made available to the application via the asynchronous error handling + mechanism. (markt) +
+ 61914: Possible NPE with Java 9 when creating a SSL engine. + Patch submitted by Evgenij Ryazanov. (remm) +
+ 61918: Fix connectionLimitLatch counting when closing an + already closed socket. Based on a patch by Ryan Fong. (remm) +
+ Add support for the OpenSSL ARIA ciphers to the OpenSSL to JSSE + cipher mapping. (markt) +
+ 61932: Allow a call to AsyncContext.dispatch() + to terminate non-blocking I/O. (markt) +
+ 61948: Improve the handling of malformed ClientHello messages + in the code that extracts the SNI information from a TLS handshake for + the JSSE based NIO and NIO2 connectors. (markt) +
+ Fix NIO2 handshaking with a full input buffer. (remm) +
+ Return a simple, plain text error message if a client attempts to make a + plain text HTTP connection to a TLS enabled NIO or NIO2 Connector. + (markt) +

Jasper

+ 61854: When using sets and/or maps in EL expressions, ensure + that Jasper correctly parses the expression. Patch provided by Ricardo + Martin Camarero. (markt) +
+ Improve the handling of methods with varargs in EL expressions. In + particular, the calling of a varargs method with no parameters now works + correctly. Based on a patch by Nitkalya (Ing) Wiriyanuparb. (markt) +
+ 61945: Fix prototype mode used to compile tags. (remm) +

Web applications

+ 61223: Add the mbeans-descriptors.dtd file to the custom + MBean documentation so users have a reference to use when constructing + mbeans-descriptors.xml files for custom components. (markt) +
+ 61565: Add the ability to trigger a reloading of TLS host + configuration (certificate and key files, server.xml is not re-parsed) + via the Manager web application. (markt) +
+ 61566: Expose the currently in use certificate chain and list + of trusted certificates for all virtual hosts configured using the JSSE + style (keystore) TLS configuration via the Manager web application. + (markt) +
+ Partial fix for 61886. Ensure that multiple threads do not + attempt to complete the AsyncContext if an I/O error occurs + in the stock ticker example Servlet. (markt) +
+ 61886: Prevent ConcurrentModificationException + when running the asynchronous stock ticker in the examples web + application. (markt) +
+ 61886: Prevent NullPointerException and other + errors if the stock ticker example is running when the examples web + application is stopped. (markt) +
+ 61910: Clarify the meaning of the allowLinking + option in the documentation web application. (markt) +
+ Add OCSP configuration information to the SSL How-To. Patch provided by + Marek Czernek. (markt) +

jdbc-pool

+ 61312: Prevent NullPointerExceptionn when using + the statement cache of connection that has been closed. (kfujino) +

Other

+ Add an additional system property for the system property replacement. + (remm) +
+ Add missing SHA-512 hash for release artifacts to the build script. + (markt) +
+ Update the internal fork of Commons Pool 2 to 2.4.3. (markt) +
+ Update the internal fork of Commons DBCP 2 to 8a71764 (2017-10-18) to + pick up some bug fixes and enhancements. (markt) +
+ Update the internal fork of Commons FileUpload to 6c00d57 (2017-11-23) + to pick up some code clean-up. (markt) +
+ Update the internal fork of Commons Codec to r1817136 to pick up some + code clean-up. (markt) +
+ The native source bundles (for Commons Daemon and Tomcat Native) are no + longer copied to the bin directory for the deploy target. They are now + only copied to the bin directory for the release target. (markt) +

2017-11-30 Tomcat 9.0.2 (markt)

Catalina

+ Fix possible SecurityException when using TLS related + request attributes. (markt) +
+ 61597: Extend the StandardJarScanner to scan + JARs on the module path when running on Java 9 and class path scanning + is enabled. (markt) +
+ 61601: Add support for multi-release JARs in JAR scanning and + web application class loading. (markt) +
+ 61681: Allow HTTP/2 push when using request wrapping. (remm) +
+ Provide the SessionInitializerFilter that can be used to + ensure that an HTTP session exists when initiating a WebSocket + connection. Patch provided by isapir. (markt) +
+ 61682: When re-prioritising HTTP/2 streams, ensure that both + parent and children fields are correctly updated to avoid a possible + StackOverflowError. (markt) +
+ Improve concurrency by reducing the scope of the synchronisation for + javax.security.auth.message.config.AuthConfigFactory in the + JASPIC API implementation. Based on a patch by Pavan Kumar. (markt) +
+ Avoid a possible NullPointerException when timing out + AsyncContext instances during shut down. (markt) +
+ 61777: Avoid a NullPointerException when + detaching a JASPIC RegistrationListener. Patch provided by + Lazar. (markt) +
+ 61778: Correct the return value when detaching a JASPIC + RegistrationListener. Patch provided by Lazar. (markt) +
+ 61779: Avoid a NullPointerException when a + null RegistrationListener is passed to + AuthConfigFactory.getConfigProvider(). Patch provided by + Lazar. (markt) +
+ 61780: Only include the default JASPIC registration ID in the + return value for a call to + AuthConfigFactory.getRegistrationIDs() if a + RegistrationContext has been registered using the default + registration ID. Patch provided by Lazar. (markt) +
+ 61781: Enable JASPIC provider registrations to be persisted + when the layer and/or application context are null. Patch + provided by Lazar. (markt) +
+ 61782: When calling + AuthConfigFactory.doRegisterConfigProvider() and the + requested JASPIC config provider class is found by the web application + class loader, do not attempt to load the class with the class loader + that loaded the JASPIC API. Patch provided by Lazar. (markt) +
+ 61783: When calling + AuthConfigFactory.removeRegistration() and the registration + is persistent, it should be removed from the persistent store. Patch + provided by Lazar. (markt) +
+ 61784: Correctly handle the case when + AuthConfigFactoryImpl.registerConfigProvider() is called + with a provider name of null. Patch provided by Lazar. + (markt) +
+ 61795: Add a property to the Authenticator + implementations to enable a custom JASPIC CallbackHandler + to be specified. Patch provided by Lazar. (markt) +

Coyote

+ 61568: Avoid a potential SecurityException when + using the NIO2 connector and a new thread is added to the pool. (markt) +
+ 61583: Correct a further regression in the fix to enable the + use of Java key stores that contained multiple keys that did not all + have the same password. This fixes PKCS11 key store handling with + multiple keys selected with an alias. (markt) +
+ Improve NIO2 syncing for async IO operations. (remm) +
+ Sendfile support for HTTP/2 and NIO2. (remm) +
+ Reduce default HTTP/2 stream concurrent execution within a connection + from 200 to 20. (remm) +
+ 61668: Avoid a possible NPE when calling + AbstractHttp11Protocol.getSSLProtocol(). (markt) +
+ 61673: Avoid a possible + ConcurrentModificationException when working with the + streams associated with a connection. (markt) +
+ 61719: Avoid possible NPE calling + InputStream.setReadListener with HTTP/2. (remm) +
+ 61736: Improve performance of NIO connector when clients + leave large time gaps between network packets. Patch provided by Zilong + Song. (markt) +
+ 61740: Correct an off-by-one error in the Hpack header index + validation that caused intermittent request failures when using HTTP/2. + (markt) +

Jasper

+ 61604: Fix SMAP generation for JSPs that generate no output. + (markt) +
+ 61816: Invalid expressions in attribute values or template + text should trigger a translation (compile time) error, not a run time + error. (markt) +

WebSocket

+ 61604: Add support for authentication in the websocket + client. Patch submitted by J Fernandez. (remm) +

Web applications

+ Correct Javadoc links to point to Java SE 8 and Java EE 8. (markt) +
+ Enable Javadoc to be built with Java 9. (markt) +
+ 61603: Add XML filtering for the status servlet output where + needed. (remm) +
+ Correct the description of how the CGI servlet maps a request to a + script in the CGI How-To. (markt) +

Tribes

+ Fix incorrect behavior that attempts to resend channel messages more + than the actual setting value of maxRetryAttempts. + (kfujino) +
+ Ensure that the remaining Sender can send channel messages by avoiding + unintended ChannelException caused by comparing the number + of failed members and the number of remaining Senders. (kfujino) +
+ Ensure that remaining SelectionKeys that were not handled by throwing a + ChannelException during SelectionKey processing are + handled. (kfujino) +

Other

+ Improve the fix for 61439 and exclude the JPA, JAX-WS and EJB + annotations completely from the Tomcat distributions. (markt) +
+ Improve handling of endorsed directories. The endorsed directory + mechanism will only be used if the JAVA_ENDORSED_DIRS + system property is explicitly set or if + $CATALINA_HOME/endorsed exists. When running on Java 9, any + such attempted use of the endorsed directory mechanism will trigger an + error and Tomcat will fail to start. (rjung) +
+ 51496: When using the Windows installer, check if the + requested service name already exists and, if it does, prompt the user + to select an alternative service name. Patch provided by Ralph + Plawetzki. (markt) +
+ 61590: Enable service.bat to recognise when + JAVA_HOME is configured for a Java 9 JDK. (markt) +
+ 61598: Update the Windows installer to search the new (as of + Java 9) registry locations when looking for a JRE. (markt) +
+ Add generation of a SHA-512 hash for release artifacts to the build + script. (markt) +
+ 61658: Update MIME mappings for fonts to use + font/* as per RFC8081. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.16 to + pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL + 1.0.2m. (markt) +
+ Update the NSIS Installer used to build the Windows installer to version + 3.02.1. (kkolinko) +
+ Update the Windows installer to use "The Apache Software Foundation" as + the Publisher when Tomcat is displayed in the list of installed + applications in Microsoft Windows. (kkolinko) +
+ 61803: Remove outdated SSL information from the Security + documentation. (remm) +

2017-09-30 Tomcat 9.0.1 (markt)

Catalina

+ Use the correct path when loading the JVM logging.properties + file for Java 9. (rjung) +
+ Add additional validation to the resource handling required to fix + CVE-2017-12617 on Windows. The checks were being performed elsewhere but + adding them to the resource handling ensures that the checks are always + performed. (markt) +

Other

+ 61563: Correct typos in Spanish translation. Patch provided by + Gonzalo Vásquez. (csutherl) +

not released Tomcat 9.0.0 (markt)

Catalina

+ 61542: Fix CVE-2017-12617 and prevent JSPs from being + uploaded via a specially crafted request when HTTP PUT was enabled. + (markt) +
+ 61554: Exclude test files in unusual encodings and markdown + files intended for display in GitHub from RAT analysis. Patch provided + by Chris Thistlethwaite. (markt) +

Coyote

+ 60762: Add the ability to make changes to the TLS + configuration of a connector at runtime without having to restart the + Connector. (markt) +
+ Add an option to reject requests that contain HTTP headers with invalid + (non-token) header names with a 400 response and reject such requests by + default. (markt) +
+ Implement the requirements of RFC 7230 (and RFC 2616) that HTTP/1.1 + requests must include a Host header and any request that + does not must be rejected with a 400 response. (markt) +
+ Implement the requirements of RFC 7230 that any HTTP/1.1 request that + specifies a host in the request line, must specify the same host in the + Host header and that any such request that does not, must + be rejected with a 400 response. This check is optional but enabled by + default. It may be disabled with the + allowHostHeaderMismatch attribute of the Connector. (markt) +
+ Implement the requirements of RFC 7230 that any HTTP/1.1 request that + contains multiple Host headers is rejected with a 400 + response. (markt) +
+ Add a way to set the property source in embedded mode. (remm) +
+ 61557: Correct a further regression in the fix to enable the + use of Java key stores that contain multiple keys that do not all have + the same password. The regression broke support for some FIPS compliant + key stores. (markt) +

jdbc-pool

+ 61545: Correctly handle invocations of methods defined in the + PooledConnection interface when using pooled XA + connections. Patch provided by Nils Winkler. (markt) +

Other

+ Update fix for 59904 so that values less than zero are accepted + instead of throwing a NegativeArraySizeException. (remm) +
+ Complete the implementation of the Servlet 4.0 specification. (markt) +

2017-09-19 Tomcat 9.0.0.M27 (markt)

Catalina

+ Before generating an error page in the ErrorReportValve, + check to see if I/O is still permitted for the associated connection + before generating the error page so that the page generation can be + skipped if the page is never going to be sent. (markt) +
+ 61189: Add the ability to set environment variables for + individual CGI scripts. Based on a patch by jm009. (markt) +
+ 61210: When running under a SecurityManager, do not print a + warning about not being able to read a logging configuration file when + that file does not exist. (markt) +
+ 61280: Add RFC 7617 support to the + BasicAuthenticator. Note that the default configuration + does not change the existing behaviour. (markt) +
+ 61424: Avoid a possible StackOverflowError when + running under a SecurityManager and using + Subject.doAs(). (markt) +
+ When running under Java 9 or later, and the + urlCacheProtection option of the + JreMemoryLeakPreventionListener is enabled, use the API + added in Java 9 to only disable the caching for JAR URL connections. + (markt) +
+ 61489: When using the CGI servlet, make the generation of + command line arguments from the query string (as per section 4.4 of RFC + 3875) optional and disabled by default. Based on a patch by jm009. + (markt) +
+ 61503: This corrects a potential regression in the fix for + 60940 with an alternative solution that adds the + JarEntry objects normally skipped by a + JarInputStream only if those entries exist. (markt) +

Coyote

+ The minimum required Tomcat Native version has been increased to 1.2.14. + This version includes a new API needed for correct client certificate + support when using a Java connector with OpenSSL TLS implementation and + support for the SSL_CONF OpenSSL API. (rjung) +
+ Add support for the OpenSSL SSL_CONF API when using + TLS with OpenSSL implementation. It can be used by adding + OpenSSLConf elements underneath SSLHostConfig. + The new element contains a list of OpenSSLConfCmd elements, + each with the attributes name and value. + (rjung) +
+ When using a Java connector in combination with the OpenSSL TLS + implementation, do not configure each SSL connection object via + the OpenSSLEngine. For OpenSSL the SSL object inherits its + settings from the SSL_CTX which we have already configured. + (rjung) +
+ When using JSSE TLS configuration with the OpenSSL implementation and + client certificates: include client CA subjects in the TLS handshake + so that the client can choose an appropriate client certificate to + present. (rjung) +
+ If an invalid option is specified for the + certificateVerification attribute of an + SSLHostConfig element, treat it as required + which is the most secure / restrictive option in addition to reporting + the configuration error. (markt) +
+ Improve the handling of client disconnections during the TLS + renegotiation handshake. (markt) +
+ Prevent exceptions being thrown during normal shutdown of NIO + connections. This enables TLS connections to close cleanly. (markt) +
+ Fix possible race condition when setting IO listeners on an upgraded + connection. (remm) +
+ Ensure that the APR/native connector uses blocking I/O for TLS + renegotiation. (markt) +
+ 48655: Enable Tomcat to shutdown cleanly when using sendfile, + the APR/native connector and a multi-part download is in progress. + (markt) +
+ 58244: Handle the case when OpenSSL resumes a TLS session + using a ticket and the full client certificate chain is not available. + In this case the client certificate without the chain will be presented + to the application. (markt) +
+ Improve the warning message when JSSE and OpenSSL configuration styles + are mixed on the same SSLHostConfig. (markt) +
+ 61415: Fix TLS renegotiation with OpenSSL based connections + and session caching. (markt) +
+ Delay checking that the configured attributes for an + SSLHostConfig instance are consistent with the configured + SSL implementation until Connector start to avoid incorrect + warnings when the SSL implementation changes during initialisation. + (markt) +
+ 61450: Fix default key alias algorithm. (remm) +
+ 61451: Correct a regression in the fix to enable the use of + Java key stores that contained multiple keys that did not all have the + same password. The regression broke support for any key store that did + not store keys in PKCS #8 format such as hardware key stores and Windows + key stores. (markt) +

WebSocket

+ 60523: Reduce the number of packets used to send WebSocket + messages by not flushing between the header and the payload when the + two are written together. (markt) +
+ 61491: When using the permessage-deflate + extension, correctly handle the sending of empty messages after + non-empty messages to avoid the IllegalArgumentException. + (markt) +

Web applications

+ Show connector cipher list in the manager web application in the + correct cipher order. (rjung) +

Tribes

+ To avoid unexpected session timeout notification from backup session, + update the access time when receiving the map member notification + message. (kfujino) +
+ Add member info to the log message when the failure detection check + fails in TcpFailureDetector. (kfujino) +
+ Avoid Ping timeout until the added map member by receiving + MSG_START message is completely started. (kfujino) +
+ When sending a channel message, make sure that the Sender has connected. + (kfujino) +
+ Correct the backup node selection logic that node 0 is returned twice + consecutively. (kfujino) +
+ Fix race condition of responseMap in + RpcChannel. (kfujino) +

jdbc-pool

+ 61391: Ensure that failed queries are logged if the + SlowQueryReport interceptor is configured to do so and the + connection has been abandoned. Patch provided by Craig Webb. (markt) +
+ 61425: Ensure that transaction of idle connection has + terminated when the testWhileIdle is set to + true and defaultAutoCommit is set to + false. Patch provided by WangZheng. (kfujino) +

Other

+ 61419: Replace a Unix style comment in the DOS bat file + catalina.bat with the correct rem markup. + (rjung) +
+ 61439: Remove the Java Annotation API classes from + tomcat-embed-core.jar and package them in a separate JAR in the + embedded distribution to provide end users with greater flexibility to + handle potential conflicts with the JRE and/or other JARs. (markt) +
+ 61441: Improve the detection of JAVA_HOME by the + daemon.sh script when running on a platform where Java has + been installed from an RPM. (rjung) +
+ Update the packaged version of the Tomcat Native Library to 1.2.14 to + pick up the latest Windows binaries built with APR 1.6.2 and OpenSSL + 1.0.2l. (markt) +
+ 61599: Update to Commons Daemon 1.1.0 for improved Java 9 + support. (markt) +

2017-08-08 Tomcat 9.0.0.M26 (markt)

Catalina

+ Correct multiple regressions in the fix for 49464 that could + corrupt static content served by the DefaultServlet.(markt) +
+ Correct a bug in the PushBuilder implementation that + meant push URLs containing %nn sequences were not correctly + decoded. Identified by FindBugs. (markt) +
+ 61164: Add support for the %X pattern in the + AccessLogValve that reports the connection status at the + end of the request. Patch provided by Zemian Deng. (markt) +
+ 61351: Correctly handle %nn decoding of URL patterns in + web.xml and similar locations that may legitimately contain characters + that are not permitted by RFC 3986. (markt) +
+ 61366: Add a new attribute, localDataSource, to + the JDBCStore that allows the Store to be configured to use + a DataSource defined by the web application rather than the default of + using a globally defined DataSource. Patch provided by Jonathan + Horowitz. (markt) +

Coyote

+ 61086: Ensure to explicitly signal an empty request body for + HTTP 205 responses. Additional fix to r1795278. Based on a patch + provided by Alexandr Saperov. (violetagg) +
+ 61345: Add a server listener that can be used to do system + property replacement from the property source configured in the + digester. (remm) +
+ Add additional logging to record problems that occur while waiting for + the NIO pollers to stop during the Connector stop process. (markt) +

Jasper

+ 61364: Ensure that files are closed after detecting encoding + of JSPs so that files do not remain locked by the file system. (markt) +

WebSocket

+ 57767: Add support to the WebSocket client for following + redirects when attempting to establish a WebSocket connection. Patch + provided by J Fernandez. (markt) +

2017-07-28 Tomcat 9.0.0.M25 (markt)

Catalina

+ Performance improvements for service loader look-ups (and look-ups of + other class loader resources) when the web application is deployed in a + packed WAR file. (markt) +
+ 60963: Add ExtractingRoot, a new + WebResourceRoot implementation that extracts JARs to the + work directory for improved performance when deploying packed WAR files. + (markt) +
+ 61253: Add warn message when Digester.updateAttributes + throws an exception instead of ignoring it. (csutherl) +
+ Correct a further regression in the fix for 49464 that could + cause an byte order mark character to appear at the start of content + included by the DefaultServlet. (markt) +
+ 61313: Make the read timeout configurable in the + JNDIRealm and ensure that a read timeout will result in an + attempt to fail over to the alternateURL. Based on patches by Peter + Maloney and Felix Schumacher. (markt) +

Web applications

+ Correct the documentation for how StandardRoot is + configured. (markt) +

Other

+ 61316: Fix corruption of UTF-16 encoded source files in + released source distributions. (markt) +

not released Tomcat 9.0.0.M24 (markt)

Catalina

+ 52924: Add support for a Tomcat specific deployment + descriptor, /WEB-INF/tomcat-web.xml. This descriptor has an + identical format to /WEB-INF/web.xml. The Tomcat descriptor + takes precedence over any settings in conf/web.xml but does + not take precedence over any settings in /WEB-INF/web.xml. + (markt) +
+ 61232: When log rotation is disabled only one separator will + be used when generating the log file name. For example if the prefix is + catalina. and the suffix is .log then the log + file name will be catalina.log instead of + catalina..log. Patch provided by Katya Stoycheva. + (violetagg) +
+ 61264: Correct a regression in the refactoring to use + Charset rather than String to store request + character encoding that prevented getReader() throwing an + UnsupportedEncodingException if the user agent specifies + an unsupported character encoding. (markt) +
+ Correct a regression in the fix for 49464 that could cause an + incorrect Content-Length header to be sent by the + DefaultServlet if the encoding of a static is not + consistent with the encoding of the response. (markt) +

Coyote

+ Enable TLS connectors to use Java key stores that contain multiple keys + where each key has a separate password. Based on a patch by Frank + Taffelt. (markt) +
+ Improve the handling of HTTP/2 stream resets due to excessive headers + when a continuation frame is used. (markt) +

Jasper

+ 53031: Add support for the fork option when + compiling JSPs with the Jasper Ant task and javac. (markt) +

Other

+ 52791: Add the ability to set the defaults used by the + Windows installer from a configuration file. Patch provided by Sandra + Madden. (markt) +

not released Tomcat 9.0.0.M23 (markt)

Catalina

+ 49464: Improve the Default Servlet's handling of static files + when the file encoding is not compatible with the required response + encoding. (markt) +
+ 61214: Remove deleted attribute servlets from + the Context MBean description. Patch provided by Alexis Hassler. (markt) +
+ 61215: Correctly define addConnectorPort and + invalidAuthenticationWhenDeny in the + mbean-descriptors.xml file for the + org.apache.catalina.valves package so that the attributes + are accessible via JMX. (markt) +
+ 61216: Improve layout for CompositeData and + TabularData when viewing via the JMX proxy servlet. Patch + provided by Alexis Hassler. (markt) +
+ Additional permission for deleting files is granted to JULI as it is + required by FileHandler when running under a Security Manager. The + thread that cleans the log files is marked as daemon thread. + (violetagg) +
+ 61229: Correct a regression in 9.0.0.M21 that broke WebDAV + handling for resources with names that included a & + character. (markt) +

Coyote

+ Restore the ability to configure support for SSLv3. Enabling this + protocol will trigger a warning in the logs since it is known to be + insecure. (markt) +
+ Add LoadBalancerDrainingValve, a Valve designed to reduce the amount of + time required for a node to drain its authenticated users. (schultz) +
+ Do not log a warning when a null session is returned for an + OpenSSL based TLS session since this is expected when session tickets + are enabled. (markt) +
+ When the access log valve logs a TLS related request attribute and the + NIO2 connector is used with OpenSSL, ensure that the TLS attributes are + available to the access log valve when the connection is closing. + (markt) +
+ 60461: Sync SSL session access for the APR connector. (remm) +
+ 61224: Make the GlobalRequestProcessor MBean + attributes read-only. Patch provided by Alexis Hassler. (markt) +

Jasper

+ 49176: When generating JSP runtime error messages that quote + the relevant JSP source code, switch from using the results of the JSP + page parsing process to using the JSR 045 source map data to identify + the correct part of the JSP source from the stack trace. This + significantly reduces the memory footprint of Jasper in development + mode, provides a small performance improvement for error page generation + and enables source quotes to continue to be provided after a Tomcat + restart. (markt) +

Web applications

+ Remove references to the Loader attribute + searchExternalFirst from the documentation since the + attribute is no longer supported. (markt) +

Tribes

+ 51513: Add support for the compressionMinSize + attribute to the GzipInterceptor, add optional statistics + collection and expose the Interceptor over JMX. Based on a patch by + Christian Stöber. (markt) +
+ 61127Allow human-readable names for channelSendOptions and + mapSendOptions. Patch provided by Igal Sapir. (schultz) +

Other

+ Restore the local definition of the web service annotations since the + JRE provided versions are deprecated and Java 9 does not provide them by + default. (markt) +
+ Add necessary Java 9 configuration options to the startup scripts to + prevent warnings being generated on web application stop. (markt) +

2017-06-26 Tomcat 9.0.0.M22 (markt)

Catalina

+ 48543: Add the option to specify an alternative file name for + the catalina.config system property. Also document that + relative, as well as absolute, URLs are permitted. (markt) +
+ 61072: Respect the documentation statements that allow + using the platform default secure random for session id generation. + (remm) +
+ Correct the javadoc for + o.a.c.connector.CoyoteAdapter#parseSessionCookiesId. + Patch provided by John Andrew (XUZHOUWANG) via Github. (violetagg) +
+ 61101: CORS filter should set Vary header in response. + Submitted by Rick Riemer. (remm) +
+ 61105: Add a new JULI FileHandler configuration for + specifying the maximum number of days to keep the log files. By default + the log files will be kept 90 days as configured in + logging.properties. (violetagg) +
+ Update the Servlet 4.0 implementation to add support for setting + trailer fields for HTTP responses. (markt) +
+ 61125: Ensure that WarURLConnection returns the + correct value for calls to getLastModified() as this is + required for the correct detection of JSP modifications when the JSP is + packaged in a WAR file. (markt) +
+ Improve the SSLValve so it is able to handle client + certificate headers from Nginx. Based on a patch by Lucas Ventura Carro. + (markt) +
+ 61134: Do not use '[' and ']' symbols around substituted + text fragments when generating the default error pages. Patch provided + by Katya Todorova. (violetagg) +
+ 61154: Allow the Manager and Host Manager web applications to + start by default when running under a security manager. This was + accomplished by adding a custom permission, + org.apache.catalina.security.DeployXmlPermission, that + permits an application to use a META-INF/context.xml file + and then granting that permission to the Manager and Host Manager. + (markt) +
+ 61173: Polish the javadoc for + o.a.catalina.startup.Tomcat. Patch provided by + peterhansson_se. (violetagg) +
+ A new configuration property crawlerIps is added to the + o.a.catalina.valves.CrawlerSessionManagerValve. Using this + property one can specify a regular expression that will be used to + identify crawlers based on their IP address. Based on a patch provided + by Tetradeus. (violetagg) +
+ 61180: Log a warning message rather than an information + message if it takes more than 100ms to initialised a + SecureRandom instance for a web application to use to + generate session identifiers. Patch provided by Piotr Chlebda. (markt) +
+ 61185: When an asynchronous request is dispatched via + AsyncContext.dispatch() ensure that + getRequestURI() for the dispatched request matches that of + the original request. (markt) +
+ 61197: Ensure that the charset name used in the + Content-Type header has exactly the same form as that + provided by the application. This reverts a behavioural change in + 9.0.0.M21 that caused problems for some clients. (markt) +
+ 61201: Ensure that the SCRIPT_NAME environment + variable for CGI executables is populated in a consistent way regardless + of how the CGI servlet is mapped to a request. (markt) +
+ Ensure to send a space between trailer field name and field value + for HTTP responses trailer fields. (huxing) +

Coyote

+ 61086: Explicitly signal an empty request body for HTTP 205 + responses. (markt) +
+ 61120: Do not ignore path parameters when processing HTTP/2 + requests. (markt) +
+ Revert a change introduced in the fix for bug 60718 that + changed the status code recorded in the access log when the client + dropped the connection from 200 to 500. (markt) +
+ Make asynchronous error handling more robust. In particular ensure that + onError() is called for any registered + AsyncListeners after an I/O error on a non-container + thread. (markt) +
+ Add additional syncs to the SSL session object provided by the OpenSSL + engine so that a concurrent destruction cannot cause a JVM crash. + (remm) +

Jasper

+ 44787: Improve error message when JSP compiler configuration + options are not valid. (markt) +
+ 45931: Extend Jasper's timeSpaces option to add + support for single which replaces template text that + consists entirely of whitespace with a single space character. Based on + a patch by Meetesh Karia. (markt) +
+ 53011: When pre-compiling with JspC, report all compilation + errors rather than stopping after the first error. A new option + -failFast can be used to restore the previous behaviour of + stopping after the first error. Based on a patch provided by Marc Pompl. + (markt) +
+ 61137: j.s.jsp.tagext.TagLibraryInfo#uri and + j.s.jsp.tagext.TagLibraryInfo#prefix fields should not be + final. Patch provided by Katya Todorova. (violetagg) +

WebSocket

+ Correct the log message when a MessageHandler for + PongMessage does not implement + MessageHandler.Whole. (rjung) +
+ Improve thread-safety of Futures used to report the result + of sending WebSocket messages. (markt) +
+ 61183: Correct a regression in the previous fix for + 58624 that could trigger a deadlock depending on the locking + strategy employed by the client code. (markt) +

Web applications

+ Better document the meaning of the trimSpaces option for Jasper. (markt) +
+ 61150: Configure the Manager and Host-Manager web + applications to permit serialization and deserialization of + CRSFPreventionFilter related session objects to avoid warning messages + and/or stack traces on web application stop and/or start when running + under a security manager. (markt) +
+ Correct the TLS configuration documentation to remove SSLv2 and SSLv3 + from the list of supported protocols. (markt) +

Other

+ 45832: Add HTTP DIGEST authentication support to the Catalina + Ant tasks used to communicate with the Manager application. (markt) +
+ 45879: Add the RELEASE-NOTES file to the root of + the installation created by the Tomcat installer for Windows to make it + easier for users to identify the installed Tomcat version. (markt) +
+ 61055: Clarify the code comments in the rewrite valve to make + clear that there are no plans to provide proxy support for this valve + since Tomcat does not have proxy capabilities. (markt) +
+ 61076: Document the altDDName attribute for the + Context element. (markt) +
+ Correct typo in Jar Scan Filter Configuration Reference. + Issue reported via comments.apache.org. (violetagg) +
+ Correct the requirement for the minimum Java SE version in Application + Developer's Guide. Issue reported via comments.apache.org. (violetagg) +
+ 61145: Add missing @Documented annotation to + annotations in the annotations API. Patch provided by Katya Todorova. + (markt) +
+ 61146: Add missing lookup() method to + @EJB annotation in the annotations API. Patch provided by + Katya Todorova. (markt) +
+ Correct typo in Context Container Configuration Reference. + Patch provided by Katya Todorova. (violetagg) +

2017-05-10 Tomcat 9.0.0.M21 (markt)

General

+ Allow to exclude JUnit test classes using the build property + test.exclude and document the property in + BUILDING.txt. (rjung) +

Catalina

+ Review those places where Tomcat re-encodes a URI or URI component and + ensure that that correct encoding (path differs from query string) is + applied and that the encoding is applied consistently. (markt) +
+ Avoid a NullPointerException when reading attributes for a + initialised HTTP connector where TLS is enabled. (markt) +
+ Always quote the hostName of an SSLHostConfig + element when using it as part of the JMX object name to avoid errors that + prevent the associated TLS connector from starting if a wild card + hostName is configured (because * is a + reserved character for JMX object names). (markt) +
+ Update the default URIEncoding for a Connector + to UTF-8 as required by the Servlet 4.0 specification. + (markt) +
+ Switch to using Charset rather than String to + store encoding settings (including for configuration and for the + Content-Type header) to reduce the number of places the + associated Charset needs to be looked up. (markt) +
+ Use a more reliable mechanism for the DefaultServlet when + determining if the current request is for custom error page or not. + (markt) +
+ Ensure that when the Default or WebDAV servlets process an error + dispatch that the error resource is processed via the + doGet() method irrespective of the method used for the + original request that triggered the error. (markt) +
+ If a static custom error page is specified that does not exist or cannot + be read, ensure that the intended error status is returned rather than a + 404 or 403. (markt) +
+ When the WebDAV servlet is configured and an error dispatch is made to a + custom error page located below WEB-INF, ensure that the + target error page is displayed rather than a 404 response. (markt) +
+ Update the Servlet 4.0 implementation to add support for obtaining + trailer fields from chunked HTTP requests. (markt) +
+ 61047: Add MIME mapping for woff2 fonts in the default + web.xml. Patch provided by Justin Williamson. (violetagg) +
+ Correct the logic that selects the encoding to use to decode the query + string in the SSIServletExternalResolver so that the + useBodyEncodingForURI attribute of the + Connector is correctly taken into account. (markt) +
+ Within the Expires filter, make the content type value specified with the + ExpiresByType parameter, case insensitive. (markt) +

Coyote

+ When a TrustManager is configured that does not support + certificateVerificationDepth only log a warning about that + lack of support when certificateVerificationDepth has been + explicitly set. (markt) +
+ 60970: Extend the fix for large headers to push requests. + (markt) +
+ Do not include a Date header in HTTP/2 responses with + status codes less than 200. (markt) +
+ When sending an HTTP/2 push promise with the NIO2 connector, the pushed + stream ID should only be included with the initial push promise frame + and not any subsequent continuation frames. (markt) +

Jasper

+ When no BOM is present and an encoding is detected, do not skip the + bytes used to detect the encoding since they are not part of a BOM. + (markt) +
+ 61057: Update to Eclipse JDT Compiler 4.6.3. (violetagg) +
+ 61065: Ensure that once the class is resolved by + javax.el.ImportHandler#resolveClass it will be cached with + the proper name. (violetagg) +

WebSocket

+ Introduce new API o.a.tomcat.websocket.WsSession#suspend/ + o.a.tomcat.websocket.WsSession#resume that can be used to + suspend/resume reading of the incoming messages. (violetagg) +
+ 61003: Ensure the flags for reading/writing in + o.a.t.websocket.AsyncChannelWrapperSecure are correctly + reset even if some exceptions occurred during processing. (markt/violetagg) +

Web Applications

+ Add documents for maxIdleTime attribute to Channel Receiver + docs. (kfujino) +

Tribes

+ Add features to get the statistics of the thread pool of the + Receiver component and + MessageDispatchInterceptor. These statistics information + can be acquired via JMX. (kfujino) +
+ Add maxIdleTime attribute to NioReceiverMBean + in order to expose to JMX. (kfujino) +
+ Add JMX support for Channel Interceptors. The Interceptors + that implement JMX support are TcpFailureDetector, + ThroughputInterceptor, TcpPingInterceptor, + StaticMembershipInterceptor, + MessageDispatchInterceptor and + DomainFilterInterceptor. (kfujino) +

Other

+ Modify the Ant build script used to publish to a Maven repository so + that it no longer requires artifacts to be GPG signed. This is make it + possible for the CI system to upload snapshot builds to the ASF Maven + repository. (markt) +

2017-04-18 Tomcat 9.0.0.M20 (markt)

Catalina

+ Update the Servlet 4.0 API implementation to reflect the change in + method name from getPushBuilder() to + newPushBuilder(). (markt) +
+ Correct various edge cases in the new HTTP Host header validation + parser. Patch provided by Katya Todorova. (martk) +
+ Correct a regression in the X to comma refactoring that broke JMX + operations that take parameters. (markt) +
+ Avoid a NullPointerException when reading attributes for a + running HTTP connector where TLS is not enabled. (markt) +
+ 47214: Refactor code so that explicitly referenced inner + classes are given explicit names rather than being anonymous. (markt) +
+ 59825: Log a message that lists the components in the + processing chain that do not support async processing when a call to + ServletRequest.startAsync() fails. (markt) +
+ 60940: Improve the handling of the META-INF/ and + META-INF/MANIFEST.MF entries for Jar files located in + /WEB-INF/lib when running a web application from a packed + WAR file. (markt) +
+ Pre-load the ExceptionUtils class. Since the class is used + extensively in error handling, it is prudent to pre-load it to avoid any + failure to load this class masking the true problem during error + handling. (markt) +
+ Avoid potential NullPointerExceptions related to access + logging during shutdown, some of which have been observed when running + the unit tests. (markt) +
+ When there is no javax.servlet.WriteListener registered + then a call to javax.servlet.ServletOutputStream#isReady + will return false instead of throwing + IllegalStateException. (violetagg) +
+ When there is no javax.servlet.ReadListener registered + then a call to javax.servlet.ServletInputStream#isReady + will return false instead of throwing + IllegalStateException. (violetagg) +

Coyote

+ Align cipher configuration parsing with current OpenSSL master. (markt) +
+ 60970: Fix infinite loop if application tries to write a + large header to the response when using HTTP/2. (markt) +

Jasper

+ 47214: Refactor code so that explicitly referenced inner + classes are given explicit names rather than being anonymous. (markt) +
+ 60925: Improve the handling of access to properties defined + by interfaces when a BeanELResolver is used under a + SecurityManager. (markt) +

Tribes

+ Add JMX support for Tribes components. (kfujino) +

jdbc-pool

+ Refactor the creating a constructor for a proxy class to reduce + duplicate code. (kfujino) +
+ In StatementFacade, the method call on the statements that + have been closed throw SQLException rather than + NullPointerException. (kfujino) +

Other

+ 60932: Correctly escape single quotes when used in i18n + messages. Based on a patch by Michael Osipov. (markt) +
+ Review i18n property files, remove unnecessary escaping and consistently + use [...] to delimit inserted values. (markt) +
+ Update the custom Ant task that integrates with the Symantec code + signing service to use the now mandatory 2-factor authentication. + (markt) +
+ Refactoring in preparation for Java 9. Refactor to avoid using some + methods that will be deprecated in Java 9 onwards. (markt) +

2017-03-30 Tomcat 9.0.0.M19 (markt)

Catalina

+ 54618: Add support to the + HttpHeaderSecurityFilter for the HSTS preload parameter. + (markt) +
+ Correct a bug in the implementation of the Servlet 4.0 feature that + allows specifying a default request and/or response character encoding + per web application. null values passed via the + programmatic interface no longer trigger a + NullPointerException. (markt) +
+ Correct a potential exception during shutdown when one or more + Containers are configured with a value of 1 for startStopThreads. + (markt) +
+ 60853: Expose the SSLHostConfig and + SSLHostConfigCertificate objects via JMX. (markt) +
+ 60876: Ensure that Set-Cookie headers generated + by the Rfc6265CookieProcessor are aligned with the + specification. Patch provided by Jim Griswold. (markt) +
+ 60882: Fix a NullPointerException when obtaining + a RequestDispatcher for a request that will not have any + pathInfo associated with it. This was a regression in the changes in + 9.0.0.M18 for the Servlet 4.0 API changes. (markt) +
+ Align PushBuilder API with changes from the Servlet expert + group. (markt) +
+ Align web.xml parsing rules with changes from the Servlet expert group + for <request-character-encoding> and + <response-character-encoding>. (markt) +
+ Refactor the various implementations of X to comma separated list to a + single utility class and update the code to use the new utility class. + (markt) +
+ 60911: Ensure NPE will not be thrown when looking for SSL + session ID. Based on a patch by Didier Gutacker. (violetagg) +

Coyote

+ Add async based IO groundwork for HTTP/2. (remm) +
+ Fix HTTP/2 incorrect input unblocking on EOF. (remm) +
+ Close the connection sooner if an event occurs for a current connection + that is not consistent with the current state of that connection. + (markt) +
+ Speed up shutdown when using multiple acceptor threads by ensuring that + the code that unlocks the acceptor threads correctly handles the case + where there are multiple threads. (markt) +
+ 60851: Add application/xml and + application/json to the default list of compressible MIME + types. Patch by Michael Osipov. (markt) +
+ 60852: Correctly spell compressible when used in + configuration attributes and internal code. Based on a patch by Michael + Osipov. (markt) +
+ 60900: Avoid a NullPointerException in the APR + Poller if a connection is closed at the same time as new data arrives on + that connection. (markt) +
+ Improve HPACK specification compliance by fixing some test failures + reported by the h2spec tool written by Moto Ishizawa. (markt) +
+ Improve HTTP/2 specification compliance by fixing some test failures + reported by the h2spec tool written by Moto Ishizawa. (markt) +
+ 60918: Fix sendfile processing error that could lead to + subsequent requests experiencing an IllegalStateException. + (markt) +
+ Improve sendfile handling when requests are pipelined. (markt) +

Jasper

+ 60844: Correctly handle the error when fewer parameter values + than required by the method are used to invoke an EL method expression. + Patch provided by Daniel Gray. (markt) +

jdbc-pool

+ 60764: Implement equals() and + hashCode() in the StatementFacade in order to + enable these methods to be called on the closed statements if any + statement proxy is set. This behavior can be changed with + useStatementFacade attribute. (kfujino) +

Other

+ Refactor the build script and the NSIS installer script so that either + NSIS 2.x or NSIS 3.x can be used to build the installer. This is + primarily to re-enable building the installer on the Linux based CI + system where the combination of NSIS 3.x and wine leads to failed + installer builds. (markt) +

2017-03-13 Tomcat 9.0.0.M18 (markt)

Catalina

+ 60469: Refactor RealmBase for better code re-use + when implementing Realms that use a custom Principal. + (markt) +
+ 60490: Various formatting and layout improvements for the + ErrorReportValve. Patch provided by Michael Osipov. (markt) +
+ 60573: Remove the reason phrase when sending a + 100 response status for consistency with other response + status lines. Patch provided by Michael Osipov. (markt) +
+ 60596: Improve performance of DefaultServlet when sendfile + feature is disabled on connector. (kkolinko) +
+ Make it easier for sub-classes of Tomcat to modify the + default web.xml settings by over-riding + getDefaultWebXmlListener(). Patch provided by Aaron + Anderson. (markt) +
+ Reduce the contention in the default InstanceManager + implementation when multiple threads are managing objects and need to + reference the annotation cache. (markt) +
+ 60623: When startStopThreads is 1 (or a special value that + is equivalent to 1) then rather than using an + ExecutorService to start the children of the current + component, the children will be started on the current thread. (markt) +
+ 60674: Remove final marker from + CorsFilter to enable sub-classing. (markt) +
+ 60683: Security manager failure causing NPEs when doing IO + on some JVMs. (csutherl) +
+ 60688: Update the internal fork of Apache Commons BCEL to + r1782855 to add early access Java 9 support to the annotation scanning + code. (markt) +
+ 60694: Prevent NPE during authentication when no JASPIC + AuthConfigFactory is available. (markt) +
+ 60697: When HTTP TRACE requests are disabled on the + Connector, ensure that the HTTP OPTIONS response from custom servlets + does not include TRACE in the returned Allow header. (markt) +
+ 60718: Improve error handling for asynchronous processing and + correct a number of cases where the requestDestroyed() + event was not being fired and an entry wasn't being made in the access + logs. (markt) +
+ 60720: Replace "WWW-Authenticate" literal with static final + AUTH_HEADER_NAME in SpnegoAuthenticator. Patch provided by Michael + Osipov. (violetagg) +
+ The default JASPIC AuthConfigFactory now correctly notifies + registered RegistrationListeners when a new + AuthConfigProvider is registered. (markt) +
+ Improve the performance of AuthenticatorBase when there is + no JASPIC configuration available. (violetagg) +
+ When HTTP TRACE requests are disabled on the Connector, ensure that the + HTTP OPTIONS response from the WebDAV servlet does not include + TRACE in the returned Allow header. (markt) +
+ 60722: Take account of the + dispatchersUseEncodedPaths setting on the current + Context when generating paths for dispatches triggered + by AsyncContext.dispatch(). (markt) +
+ 60728: Make the separator Tomcat uses in the Tomcat specific + war:file:... URL protocol customizable via a system + property. The separator is equivalent to the use of the ! + character in jar:file:... URLs. The default separator of + * remains unchanged. (markt) +
+ Update the Servlet 4.0 API implementation to align with the latest + proposals from the Servlet 4.0 expert group. This includes updates to + the new Servlet mapping API, new methods on the + ServletContext to make the available API more equivalent to + the deployment descriptor, updates to the HTTP push API and the ability + to set default request and response character encoding per web + application. Note that the Servlet 4.0 API is still a work in progress + and further changes are likely. (markt) +
+ 60798: Correct a bug in the handling of JARs in unpacked WARs + that meant multiple attempts to read the same entry from a JAR in + succession would fail for the second and subsequent attempts. (markt) +
+ 60808: Ensure that the Map returned by + ServletRequest.getParameterMap() is fully immutable. Based + on a patch provided by woosan. (markt) +
+ 60824: Correctly cache the Subject in the + session - if there is a session - when running under a + SecurityManager. Patch provided by Jan Engehausen. (markt) +
+ Ensure request and response facades are used when firing application + listeners. (markt/remm) +

Coyote

+ Improve handling of case when an HTTP/2 client sends more data that is + subject to flow control than the current window size allows. (markt) +
+ Improve NIO2 look-ahead parsing of TLS client hello for SNI with large + client hello messages. (markt) +
+ Enable ALPN and also, therefore, HTTP/2 for the NIO and NIO2 HTTP + connectors when using the JSSE implementation for TLS when running on + Java 9. (markt) +
+ Restore Java 9 direct byte buffer compatibility. (remm) +
+ 59807: Provide a better error message when there is no + SSLHostConfig defined with a hostName that + matches the defaultSSLHostConfigName for the associated + Connector. (markt) +
+ 60627: Modify the Rfc6265CookieProcessor so that + in addition to cookie headers that start with an explicit RFC 2109 + $Version=1, cookies that start with $Version=0 + are also parsed as RFC 2109 cookies. (markt) +
+ Include the value of SslHostConfig.truststoreAlgorithm when + warning that the algorithm does not support the + certificateVerificationDepth configuration option. (markt) +
+ Ensure that executor thread pools used with connectors pre-start the + configured minimum number of idle threads. (markt) +
+ 60716: Add a new JSSE specific attribute, + revocationEnabled, to SSLHostConfig to permit + JSSE provider revocation checks to be enabled when no + certificateRevocationListFile has been configured. The + expectation is that configuration will be performed via a JSSE provider + specific mechanisms. (markt) +
+ Modify the cookie header generated by the + Rfc6265CookieProcessor so it always sends an + Expires attribute as well as a Max-Age + attribute to avoid problems with Microsoft browsers that do not support + the Max-Age attribute. (markt) +
+ 60761: Expose a protected getter and setter for + NioEndpoint.stopLatch to make the class easier to extend. + (markt) +
+ Prevent blocking reads after a stream exception occurs with HTTP/2. + (remm) +

Jasper

+ Follow up to the fix for 58178. When creating the + ELContext for a tag file, ensure that any registered + ELContextListeners are fired. (markt) +
+ Refactor code generated for JSPs to reduce the size of the code required + for tags. (markt) +
+ Improve the error handling for simple tags to ensure that the tag is + released and destroyed once used. (remm, violetagg) +
+ 60769: Correct a regression in the XML encoding detection + refactoring carried out for 9.0.0.M16 that incorrectly always used the + detected BOM encoding in preference to any encoding specified in the + prolog. (markt) +

Cluster

+ Make the accessTimeout configurable in + BackupManager and ClusterSingleSignOn. The + accessTimeout is used as a timeout period for PING in + replication map. (kfujino) +
+ 60806: To avoid ClassNotFoundException, make + sure that the web application class loader is passed to + ReplicatedContext. (kfujino) +

WebSocket

+ 60617: Correctly create a CONNECT request when + establishing a WebSocket connection via a proxy. Patch provided by + Svetlin Zarev. (markt) +

Tribes

+ Add log message that PING message has received beyond the timeout + period. (kfujino) +
+ When a PING message that beyond the time-out period has been received, + make sure that valid member is added to the map membership. (kfujino) +
+ Ensure that NoRpcChannelReply messages are not received on + RpcCallback. (kfujino) +

Web Applications

+ Add Specification and Javadoc references for JASPIC to the Docs + application. (csutherl) +

Other

+ Spelling corrections provided by Josh Soref. (violetagg) +
+ Remove local definition of web service annotations since these are + provided by the JRE. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.12 to + pick up the latest Windows binaries built with OpenSSL 1.0.2k. (violetagg) +
+ 60784: Update all unit tests that test the HTTP status line + to check for the required space after the status code. Patch provided by + Michael Osipov. (markt) +

2017-01-16 Tomcat 9.0.0.M17 (markt)

Catalina

+ 60620: + Extend the JreMemoryLeakPreventionListener to provide + protection against ForkJoinPool.commonPool() related memory + leaks. (markt) +

Coyote

+ Ensure UpgradeProcessor instances associated with closed connections are + removed from the map of current connections to Processors. (markt) +
+ Remove a workaround for a problem previously reported with WebSocket, + TLS and APR that treated some error conditions as not errors. The + original problem cannot be reproduced with the current code and the + work-around is now causing problems. (markt) +

Jasper

+ 60497: Follow up fix using a better variable name for the + tag reuse flag. (remm) +
+ Revert use of try/finally for simple tags. (remm) +

WebSocket

+ Prevent potential processing loop on unexpected WebSocket connection + closure. (markt) +

jdbc-pool

+ Enable reset the statistics without restarting the pool. (kfujino) +

Other

+ Update the NSIS Installer used to build the Windows installer to version + 3.01. (markt) +
+ Spelling corrections provided by Josh Soref. (violetagg) +

not released Tomcat 9.0.0.M16 (markt)

Catalina

+ 53602: Add HTTP status code 451 (RFC 7725) to the list of + HTTP status codes recognised by the ErrorReportValve. (markt) +
+ 60446: Handle the case where the stored user credential uses + a different key length than the length currently configured for the + CredentialHandler. Based on a patch by Niklas Holm. (markt) +
+ Update the warnings that reference required options for running on Java + 9 to use the latest syntax for those options. (markt) +
+ 60513: Fix thread safety issue with RMI cleanup code. (remm) +

Coyote

+ Expand the search process for a server certificate when OpenSSL is used + with a JSSE connector and an explicit alias has not been configured. + (markt) +
+ Extract the common Acceptor code from each Endpoint into a new Acceptor + class that is used by all Endpoints. (markt) +
+ 60450: Improve the selection algorithm for the default trust + store type for a TLS Virtual Host. In particular, don't use + PKCS12 as a default trust store type. Better document how + the default trust store type is selected for a TLS virtual host. (markt) +
+ 60451: Correctly handle HTTP/2 header values that contain + characters with unicode code points in the range 128 to 255. Reject + with a clear error message HTTP/2 header values that contain characters + with unicode code points above 255. (markt) +
+ Improve the logic that selects an address to use to unlock the Acceptor + to take account of platforms what do not listen on all local addresses + when configured with an address of 0.0.0.0 or + ::. (markt) +
+ Correct a regression in the refactoring to make wider use of + ByteBuffer that caused an intermittent failure in the unit + tests. (markt) +
+ 60482: HTTP/2 shouldn't do URL decoding on the query string. + (remm) +
+ Fix an HTTP/2 compression error. Once a new size has been agreed for the + dynamic HPACK table, the next header block must begin with a dynamic + table update. (markt) +
+ 60508: Set request start time for HTTP/2. (remm) +
+ The default output buffer size for AJP connectors is now based on the + configured AJP packet size rather than the minimum permitted AJP packet + size. (markt) +

Jasper

+ Implement a simpler JSP file encoding detector that delegates XML prolog + encoding detection to the JRE rather than using a custom XML parser. + (markt) +
+ 60497: Restore previous tag reuse behavior following the use + of try/finally. (remm) +
+ Improve the error handling for simple tags to ensure that the tag is + released and destroyed once used. (remm) +

WebSocket

+ Correctly handle blocking WebSocket writes when the write times out just + before the write is attempted. (markt) +

Web Applications

+ 60344: Add a note to BUILDING.txt regarding using the source + bundle with the correct line endings. (markt) +
+ 60467: remove problematic characters from XML documentation. + Based upon a patch by Michael Osipov. (schultz) +
+ In the documentation web application, be explicit that clustering + requires a secure network for all of the cluster network traffic. + (markt) +
+ Update the ASF logos to the new versions. +
+ 60468: Correct the format of the sample ISO-8601 date used + to report the build date for the documentation. Patch provided by + Michael Osipov. (markt) +

Other

+ Update the ASF logos used in the Apache Tomcat installer for Windows to + use the new versions. +

2016-12-08 Tomcat 9.0.0.M15 (markt)

Other

+ Increment version due a local build configuration error with 9.0.0.M14 + that wasn't caught until after digital signing had been completed + Signing requires unique names so a new tag was required. (markt) +

not released Tomcat 9.0.0.M14 (markt)

Catalina

+ 60202: Add an available flag to realms, to indicate the + state, or the realm backend. Update lockout realm to only register + auth failures if the realm is available. (remm) +
+ 60340: Readability improvements for CSS used in + DefaultServlet and ErrorReportValve. Patch provided by Michael + Osipov. (violetagg) +
+ 60351: Delay creating META-INF/war-tracker file + until after the WAR has been expanded to address the case where the + Tomcat process terminates during the expansion. (markt) +
+ Correctly generate URLs for resources located inside JARs that are + themselves located inside a packed WAR file. (markt) +
+ Correctly handle the configClass attribute of a Host when + embedding Tomcat. (markt) +
+ 60368: Stop creating a default connector on start in + embedded mode. (remm) +
+ 60379: Dispose of the GSS credential once it is no longer + required. Patch provided by Michael Osipov. (markt) +
+ 60380: Ensure that a call to + HttpServletRequest#logout() triggers a call to + TomcatPrincipal#logout(). Based on a patch by Michael + Osipov. (markt) +
+ 60381: Provide a standard toString() + implementation for components that implement Contained. + (markt) +
+ 60387: Correct the javadoc for + o.a.catalina.AccessLog.setRequestAttributesEnabled. + The default value is different for the different implementations. + (violetagg) +
+ 60393: Use consistent parameter naming in implementations of + Realm#authenticate(GSSContext, boolean). (markt) +
+ Refactor the org.apache.naming package to reduce duplicate + code. Duplicate code identified by the Simian tool. (markt) +
+ Refactor the implementations of + HttpServletRequest#getRequestURL() to reduce duplicate + code. Duplicate code identified by the Simian tool. (markt) +
+ Refactor Catalina interfaces to make wider use of the + Contained interface and reduce duplication. (markt) +
+ Remove the getName() method from RealmBase + along with the various constants used by the sub-classes to store the + return value. (markt) +
+ 60395: Log when an Authenticator passes an + incomplete GSSContext to a Realm since it indicates a bug + in the Authenticator. Patch provided by Michael Osipov. + (markt) +
+ 60400: When expanding the buffer used for reading the + request body, ensure the read position will be restored to the + original one. (violetagg) +
+ Refactor the MBean implementations for the internal Tomcat components + to reduce code duplication. (markt) +
+ 60410: Ensure that multiple calls to + JarInputStreamWrapper#close() do not incorrectly trigger + the closure of the underlying JAR or WAR file. (markt) +
+ 60411: Implement support in the RewriteValve for + symbolic names to specify the redirect code to use when returning a + redirect response to the user agent. Patch provided by Michael Osipov. + (markt) +
+ 60413: In the RewriteValve write empty capture + groups as the empty string rather than as "null" + when generating the re-written URL. Based on a patch by Michael Osipov. + (markt) +

Coyote

+ 60372: Ensure the response headers' buffer limit is reset to + the capacity of this buffer when IOException occurs while writing the + headers to the socket. (violetagg) +
+ Ensure that the availability of configured upgrade protocols that + require ALPN is correctly reported during Tomcat start. (markt) +
+ 60386: Implement a more sophisticated pruning algorithm for + removing closed streams from the priority tree to ensure that the tree + does not grow too large. (markt) +
+ 60409: When unable to complete sendfile request, ensure the + Processor will be added to the cache only once. (markt/violetagg) +
+ Ensure that the endpoint is able to unlock the acceptor thread during + shutdown if the endpoint is configured to listen to any local address + of a specific type such as 0.0.0.0 or ::. + (markt) +
+ Add a new configuration option, ipv6v6only to the APR + connectors that allows them to be configure to only accept IPv6 + connections when configured with an IPv6 address rather than the + default which is to accept IPv4 connections as well if the operating + system uses a dual network stack. (markt) +
+ Improve the logic that unlocks the acceptor thread so a better choice is + made for the address to connect to when a connector is configured for + any local port. This reduces the likelihood of the unlock failing. + (markt) +
+ 60436: Avoid a potential NPE when processing async timeouts. + (markt) +
+ Reduce the window in which an async request that has just started + processing on a container thread remains eligible for an async timeout. + (markt) +

Jasper

+ 60431: Improve handling of varargs in UEL expressions. Based + on a patch by Ben Wolfe. (markt) +

Web applications

+ Correct a typo in Host Configuration Reference. + Issue reported via comments.apache.org. (violetagg) +
+ 60412: Add information on the comment syntax for the + RewriteValve configuration. (markt) +

Tribes

+ Reduce the warning logs for a message received from a different domain + in order to avoid excessive log outputs. (kfujino) +

WebSocket

+ 60437: Avoid possible handshake overflows in the websocket + client. (remm) +

jdbc-pool

+ 58816: Implement the statistics of jdbc-pool. The stats infos + are borrowedCount, returnedCount, + createdCount, releasedCount, + reconnectedCount, releasedIdleCount and + removeAbandonedCount. (kfujino) +
+ 60194: If validationQuery is not specified, + connection validation is done by calling the isValid() + method. (kfujino) +
+ 60398: Fix testcase of TestSlowQueryReport. + (kfujino) +

Other

+ Allow customization of service.bat, such as heap memory size, service + startup mode and JVM args. Patch provided by isapir via Github. + (violetagg) +
+ 60366: Change catalina.bat to use directly + LOGGING_MANAGER and LOGGING_CONFIG variables + in order to configure logging, instead of modifying + JAVA_OPTS. Patch provided by Petter Isberg. (violetagg) +
+ 60383: JASPIC API is added as a dependency to the + org.apache.tomcat:tomcat-catalina maven artifact. + (violetagg) +
+ Update the comments associated with the TLS Connector examples in + server.xml. (markt) +
+ New property is added test.verbose in order to control + whether the output of the tests is displayed on the console or not. + Patch provided by Emmanuel Bourg. (violetagg) +
+ TestOpenSSLCipherConfigurationParser.testSpecification + - if there are test failures, provide more detailed information. Patch + provided by Emmanuel Bourg. (violetagg) +

2016-11-08 Tomcat 9.0.0.M13 (markt)

Coyote

+ Check that threadPriority values used in AbstractProtocol are valid. + (fschumacher) +

not released Tomcat 9.0.0.M12 (markt)

Catalina

+ When creating a new Connector via JMX, ensure that both HTTP/1.1 and + AJP/1.3 connectors can be created. (markt) +
+ Reduce multiple error messages when Connector fails to instantiate the + associated ProtocolHandler. (markt) +
+ 60152: Provide an option for Connector Lifecycle exceptions + to be re-thrown rather than logged. This is controlled by the new + throwOnFailure attribute of the Connector. (markt) +
+ Include the Context name in the log message when an item cannot be + added to the cache. (markt) +
+ Exclude JAR files in /WEB-INF/lib from the static resource + cache. (markt) +
+ When calling getResourceAsStream() on a directory, ensure + that null is returned. (markt) +
+ 60161: Allow creating subcategories of the container logger, + and use it for the rewrite valve. (remm) +
+ Correctly test for control characters when reading the provided shutdown + password. (markt) +
+ 60297: Simplify connector creation in embedded mode. (remm) +
+ Refactor creation of containers in embedded mode for more consistency + and flexibility. (remm) +
+ Log a warning if running on Java 9 with the ThreadLocal memory leak + detection enabled (the default) but without the command line option it + now requires. (markt) +
+ When a Connector is configured to use an executor, ensure that the + StoreConfig component includes the executor name when writing the + Connector configuration. (markt) +
+ When configuring the JMX remote listener, specify the allowed types for + the credentials. (markt) +

Coyote

+ Correct the HPACK header table size configuration that transposed the + client and server table sizes when creating the encoder and decoder. + (markt) +
+ Review HTTP/2 implementation removing unused code, reducing visibility + where possible and using final where appropriate. (markt) +
+ Don't continue to process an HTTP/2 stream if it is reset during header + parsing. (markt) +
+ HTTP/2 uses separate headers for each Cookie. As required by RFC 7540, + merge these into a single Cookie header before processing continues. + (markt) +
+ Align the HTTP/2 implementation with the HTTP/1.1 implementation and + return a 500 response when an unhandled exception occurs during request + processing. (markt) +
+ Correct the HTTP header parser so that DEL is not treated as a valid + token character. (markt) +
+ Add checks around the handling of HTTP/2 pseudo headers. (markt) +
+ Add support for trailer headers to the HTTP/2 implementation. (markt) +
+ 60232: When processing headers for an HTTP/2 stream, ensure + that the read buffer is large enough for the header being processed. + (markt) +
+ Add configuration options to the HTTP/2 implementation to control the + maximum number of headers allowed, the maximum size of headers allowed, + the maximum number of trailer headers allowed, the maximum size of + trailer headers allowed and the maximum number of cookies allowed. + (markt) +
+ Correctly differentiate between sending and receiving a reset frame when + tracking the state of an HTTP/2 stream. (markt) +
+ Remove the undocumented support for using the old Connector attribute + names backlog, soLinger and + soTimeout that were renamed several major versions ago. + (markt) +
+ 60319: When using an Executor, disconnect it from the + Connector attributes maxThreads, + minSpareThreads and threadPriority to enable + the configuration settings to be consistently reported. These Connector + attributes will be reported as -1 when an Executor is in + use. The values used by the executor may be set and obtained via the + Executor. (markt) +
+ If an I/O error occurs during async processing on a non-container + thread, ensure that the onError() event is triggered. + (markt) +
+ Improve detection of I/O errors during async processing on non-container + threads and trigger async error handling when they are detected. (markt) +
+ Add additional checks for valid characters to the HTTP request line + parsing so invalid request lines are rejected sooner. (markt) +

Jasper

+ Update to the Eclipse JDT Compiler 4.6.1. (markt) +

Web applications

+ Add HTTP/2 configuration information to the documentation web + application. (markt) +
+ Fix default value of validationInterval attribute in + jdbc-pool. (kfujino) +
+ Correct a typo in CGI How-To. + Issue reported via comments.apache.org. (violetagg) +

Tribes

+ When the proxy node sends a backup retrieve message, ensure that using + the channelSendOptions that has been set rather than the + default channelSendOptions. (kfujino) +

Other

+ Add the JASPIC API jar to the Maven Central publication script. (markt) +
+ Remove classes from tomcat-util-scan.jar that are duplicates of those in + tomcat-util.jar. (markt) +
+ Update the NSIS Installer used to build the Windows installer to version + 3.0. (markt) +

2016-10-10 Tomcat 9.0.0.M11 (markt)

Catalina

+ 59961: Add an option to the StandardJarScanner + to control whether or not JAR Manifests are scanned for additional + class path entries. (markt) +
+ 60013: Refactor the previous fix to align the behaviour of + the Rewrite Valve with mod_rewrite. As part of this, provide an + implementation for the B and NE flags and + improve the handling for the QSA flag. Includes multiple + test cases by Santhana Preethiand a patch by Tiago Oliveira. (markt) +
+ 60087: Refactor the web resources handling to use the Tomcat + specific war:file:... URL protocol to refer to WAR files + and their contents rather than the standard jar:file:... + form since some components of the JRE, such as JAR verification, give + unexpected results when the standard form is used. A side-effect of the + refactoring is that when using packed WARs, it is now possible to + reference a WAR and/or specific JARs within a WAR in the security policy + file used when running under a SecurityManager. (markt) +
+ 60116: Fix a problem with the rewrite valve that caused back + references evaluated in conditions to be forced to lower case when using + the NC flag. (markt) +
+ Ensure Digester.useContextClassLoader is considered in + case the class loader is used. (violetagg) +
+ 60117: Ensure that the name of LogLevel is + localized when using OneLineFormatter. Patch provided by + Tatsuya Bessho. (kfujino) +
+ 60138: Fix the SSLHostConfig so that the + protocols attribute is limited to the protocols supported + by the current JSSE implementation rather than the default protocols + used by the implementation. (markt) +
+ 60146: Improve performance for resource retrieval by making + calls to WebResource.getInputStream() trigger caching if the resource is + small enough. Patch provided by mohitchugh. (markt) +
+ 60151: Improve the exception error messages when a + ResourceLink fails to specify the type, specifies an + unknown type or specifies the wrong type. (markt) +
+ 60167: Ignore empty lines in /etc/passwd files + when using the PasswdUserDatabase. (markt) +
+ 60170: Exclude the compressed test file + index.html.br from RAT analysis. Patch provided by Gavin + McDonald. (markt) +
+ When starting web resources, ensure that class resources are only + started once. (markt) +
+ Improve the access checks for linked global resources to handle the case + where the current class loader is a child of the web application class + loader. (markt) +
+ 60196: Ensure that the isMandatory flag is + correctly set when using JASPIC authentication. (markt) +
+ 60199: Log a warning if deserialization issues prevent a + session attribute from being loaded. (markt) +
+ 60208: When using RFC6265 compliant cookies, the + / character should not be allowed in a cookie name since + the RFC6265 will drop such cookies as invalid. (markt) +
+ Introduce new methods read(ByteBuffer)/ + write(ByteBuffer) in + o.a.catalina.connector.CoyoteInputStream/ + o.a.catalina.connector.CoyoteOutputStream. (violetagg) +

Coyote

+ Refactor the code that implements the requirement that a call to + complete() or dispatch() made from a + non-container thread before the container initiated thread that called + startAsync() completes must be delayed until the container + initiated thread has completed. Rather than implementing this by + blocking the non-container thread, extend the internal state machine to + track this. This removes the possibility that blocking the non-container + thread could trigger a deadlock. (markt) +
+ Fail earlier if the client closes the connection during SNI processing. + (markt) +
+ 60123: Avoid potential threading issues that could cause + excessively large values to be returned for the processing time of + a current request. (markt) +
+ 60174: Log instances of HeadersTooLargeException + during request processing. (markt) +
+ 60173: Allow up to 64kB HTTP/2 header table size limit. (remm) +
+ Java 9 compatibility of direct ByteBuffer cleaner. (remm) +

Jasper

+ 60101: Remove preloading of the class that was deleted. + (violetagg) +

Web applications

+ Expand the documentation for the nested elements within a + Resources element to clarify the behaviour of different + configuration options with respect to the order in which resources are + searched. (markt) +
+ Add an example of using the classesToInitialize attribute + of the JreMemoryLeakPreventionListener to the documentation + web application. Based on a patch by Cris Berneburg. (markt) +
+ 60192: Correct a typo in the status output of the Manager + application. Patch provided by Radhakrishna Pemmasani. (markt) +

jdbc-pool

+ Notify jmx when returning the connection that has been marked suspect. + (kfujino) +
+ Ensure that the POOL_EMPTY notification has been added to + the jmx notification types. (kfujino) +
+ 60099: Ensure that use all method arguments as a cache key + when using StatementCache. (kfujino) +

Other

+ Update the download location for Objenesis. (violetagg) +
+ 60164: Replace log4j-core*.jar with + log4j-web*.jar since it is log4j-web*.jar that + contains the ServletContainerInitializer. (markt) +
+ Add documentation to the bin/catalina.bat script to remind users that + environment variables don't affect the configuration of Tomcat when + run as a Windows Service. Based upon a documentation patch by + James H.H. Lampert. (schultz) +
+ Update the packaged version of the Tomcat Native Library to 1.2.10 to + pick up the latest Windows binaries built with OpenSSL 1.0.2j. (markt) +

2016-09-05 Tomcat 9.0.0.M10 (markt)

Catalina

+ 59813: Ensure that circular relations of the Class-Path + attribute from JAR manifests will be processed correctly. (violetagg) +
+ Ensure that reading the singleThreadModel attribute of a + StandardWrapper via JMX does not trigger initialisation of + the associated servlet. With some frameworks this can trigger an + unexpected initialisation thread and if initialisation is not thread-safe + the initialisation can then fail. (markt) +
+ Compatibility with rewrite from httpd for non existing headers. + (jfclere) +
+ By default, treat paths used to obtain a request dispatcher as encoded. + This behaviour can be changed per web application via the + dispatchersUseEncodedPaths attribute of the Context. + (markt) +
+ Provide a mechanism that enables the container to check if a component + (typically a web application) has been granted a given permission when + running under a SecurityManager without the current execution stack + having to have passed through the component. Use this new mechanism to + extend SecurityManager protection to the system property replacement + feature of the digester. (markt) +
+ When retrieving an object via a ResourceLink, ensure that + the object obtained is of the expected type. (markt) +
+ 59823: Ensure that JASPIC configuration is taken into account + when calling HttpServletRequest.authenticate(). (markt) +
+ 59824: Mark the RewriteValve as supporting async + processing by default. (markt) +
+ 59839: Apply roleSearchAsUser to all nested + searches in JNDIRealm. (fschumacher) +
+ 59859: Fix resource leak in WebDAV servlet. Based on patch by + Coty Sutherland. (fschumacher) +
+ 59862: Allow nested jar files scanning to be filtered with + the system property + tomcat.util.scan.StandardJarScanFilter.jarsToSkip. Patch + is provided by Terence Bandoian. (violetagg) +
+ 59866: When scanning WEB-INF/classes for + annotations, don't scan the contents of + WEB-INF/classes/META-INF (if present) since classes will + never be loaded from that location. (markt) +
+ 59888: Correctly handle tabs and spaces in quoted version one + cookies when using the Rfc6265CookieProcessor. (markt) +
+ A number of the JRE memory leaks addressed by the + JreMemoryLeakPreventionListener have been fixed in Java 9 + so the associated protection is now disabled when running on Java 9 + onwards. (markt) +
+ 59912: Fix an edge case in input stream handling where an + IOException could be thrown when reading a POST body. + (markt) +
+ 59913: Correct a regression introduced with the support for + the Servlet 4 HttpServletRequest.getMapping() API that + caused the attributes for forwarded requests to be lost if requested + from within a subsequent include. (markt) +
+ 59966: Do not start the web application if the error page + configuration in web.xml is invalid. (markt) +
+ Switch the CGI servlet to the standard logging mechanism and remove + support for the debug attribute. (markt) +
+ 60012: Improvements in the log messages. Based on + suggestions by Nemo Chen. (violetagg) +
+ Changes to the allowLinking attribute of a + StandardRoot instance now invalidate the cache if caching + is enabled. (markt) +
+ Add a new initialisation parameter, envHttpHeaders, to + the CGI Servlet to mitigate httpoxy + (CVE-2016-5388) by default and to provide a mechanism that can be + used to mitigate any future, similar issues. (markt) +
+ When adding and removing ResourceLinks dynamically, ensure + that the global resource is only visible via the + ResourceLinkFactory when it is meant to be. (markt) +
+ 60008: When processing CORs requests, treat any origin with a + URI scheme of file as a valid origin. (markt) +
+ Improve handling of exceptions during a Lifecycle events triggered by a + state transition. The exception is now caught and the component is now + placed into the FAILED state. (markt) +
+ 60013: Fix encoding issues when using the RewriteValve with + UTF-8 query strings or UTF-8 redirect URLs. (markt) +
+ 60022: Improve handling when a WAR file and/or the associated + exploded directory are symlinked into the appBase. (markt) +
+ Fix a file descriptor leak when reading the global web.xml. (markt) +
+ Consistently decode URL patterns provided via web.xml using the encoding + of the web.xml file where specified or UTF-8 where no explicit encoding + is specified. (markt) +
+ Make timing attacks against the Realm implementations harder. (schultz) +

Coyote

+ Correct a regression in refactoring to enable injection of custom + keystores that broke the automatic conversion of OpenSSL style PEM + key and certificate files for use with JSSE TLS connectors. (markt) +
+ 59910: Don't hardcode key alias value to "tomcat" for JSSE. + When using a keystore, OpenSSL will still default to it. (remm) +
+ 59904: Add a limit (default 200) for the number of cookies + allowed per request. Based on a patch by gehui. (markt) +
+ 59925: Correct regression in r1628368 and ensure that HTTP + separators are handled as configured in the + LegacyCookieProcessor. Patch provided by Kyohei Nakamura. + (markt) +
+ 59950: Correct log message when reporting that the current + number of HTTP/2 streams for a connection could not be pruned to below + the limit. (markt) +
+ Ensure that Semaphore.release is called in all cases. Even + when there is an exception. (violetagg) +
+ 60030: Correct a potential infinite loop in the SNI parsing + code triggered by failing to handle an end of stream condition. (markt) +
+ Refactor the JSSE client certificate validation so that the + effectiveness of the certificateVerificationDepth + configuration attribute does not depend on the presence of a certificate + revocation list. (markt) +
+ Small logging optimization in the Rfc6265CookieProcessor. + Patch provided by Svetlin Zarev. (markt) +
+ OpenSSL now disables 3DES by default so reflect this when using OpenSSL + syntax to select ciphers. (markt) +
+ Use the proper ERROR socket status code for async errors with NIO2. + (remm) +
+ 60035: Fix a potential connection leak if the client drops a + TLS connection before the handshake completes. (markt) +
+ Log a warning at start up if a JSSE TLS connector is configured with + a trusted certificate that is either not yet valid or has expired. + (markt) +

Jasper

+ When writing out a full web.xml file with JspC ensure that the encoding + used in the XML prolog matches the encoding used to write the contents + of the file. (markt) +
+ Improve the error handling for custom tags to ensure that the tag is + returned to the pool or released and destroyed once used. (markt) +
+ 60032: Fix handling of method calls that use varargs within + EL value expressions. (markt) +
+ Ignore engineOptionsClass and scratchdir when + running under a security manager. (markt) +
+ Fixed StringIndexOutOfBoundsException. Based on a patch provided by + wuwen via Github. (violetagg) +

WebSocket

+ 59908: Ensure that a reason phrase is included in the close + message if a session is closed due to a timeout. (markt) +

Web applications

+ 59867: Correct the documentation provided by Manager's + 403.jsp. (violetagg) +
+ 59868: Clarify the documentation for the Manager web + application to make clearer that the host name and IP address in the + server section are the primary host name and IP address. (markt) +
+ 59940: Correct the name of the + truststorePassword attribute of the + SSLHostConfig element in the configuration documentation. + (markt) +
+ MBeans Descriptors How-To is moved to + mbeans-descriptors-howto.html. Patch provided by Radoslav + Husar. (violetagg) +
+ Update NIO Connector configuration documentation with an information + about socket.directSslBuffer. (violetagg) +
+ 60034: Correct a typo in the Manager How-To page of the + documentation web application. (markt) +
+ Correct the name of the CRL location configuration attributes in the + documentation web application. (markt) +

jdbc-pool

+ In order to avoid the unintended skip of PoolCleaner, + remove the check code of the execution interval in the task that has + been scheduled. (kfujino) +
+ 59850: Ensure that the ResultSet is closed when + enabling the StatementCache interceptor. (kfujino) +
+ 59923: Reduce the default value of + validationInterval in order to avoid the potential issue + that continues to return an invalid connection after database restart. + (kfujino) +
+ Ensure that the ResultSet is returned as Proxy object when + enabling the StatementDecoratorInterceptor. (kfujino) +
+ 60043: Ensure that the suspectTimeout works + without removing connection when the removeAbandoned is + disabled. (kfujino) +
+ Add log message of when returning the connection that has been marked + suspect. (kfujino) +
+ Correct Javadoc for ConnectionPool.suspect(). Based on a + patch by Yahya Cahyadi. (markt) +

Other

+ 59871: Add a property (timeFormat) to + JULI's OneLineFormatter to enable the format of the + time stamp used in log messages to be configured. (markt) +
+ 59899: Update Tomcat's copy of the Java Persistence + annotations to include the changes made in 2.1 / JavaEE 7. (markt) +
+ Fixed typos in mbeans-descriptors.xml files. (violetagg) +
+ Update the internal fork of Commons BCEL to r1757132 to align with the + BCEL 6 release. (markt) +
+ Update the internal fork of Commons DBCP2 to r1757164 to pick up a + couple of bug fixes. (markt) +
+ Update the internal fork of Commons Codec to r1757174. Code formatting + changes only. (markt) +
+ Update the internal fork of Commons FileUpload to afdedc9. This pulls in + a fix to improve the performance with large multipart boundaries. + (markt) +

2016-07-12 Tomcat 9.0.0.M9 (markt)

Catalina

+ 18500: Add limited support for wildcard host names and host + aliases. Names of the form *.domainname are now permitted. + Note that an exact host name match takes precedence over a wild card + host name match. (markt) +
+ 57705: Add debug logging for requests denied by the remote + host and remote address valves and filters. Based on a patch by Graham + Leggett. (markt) +
+ Correct a regression in the fix for 58588 that removed the + entire org.apache.juli package from the embedded JARs + rendering them unusable. (markt) +
+ 59399: Add a new option to the Realm implementations that + ship with Tomcat that allows the HTTP status code used for HTTP -> HTTPS + redirects to be controlled per Realm. (markt) +
+ 59708: Modify the LockOutRealm logic. Valid authentication + attempts during the lock out period will no longer reset the lock out + timer to zero. (markt) +
+ Change the default of the + sessionCookiePathUsesTrailingSlash attribute of the + Context element to false since the problems + caused when a Servlet is mapped to /* are more significant + than the security risk of not enabling this option by default. (markt) +
+ Follow-up to 59655. Improve the documentation for configuring + permitted cookie names. Patch provided by Kyohei Nakamura. (markt) +
+ Do not attempt to start web resources during a web application's + initialisation phase since the web application is not fully configured + at that point and the web resources may not be correctly configured. + (markt) +
+ Improve error handling around user code prior to calling + InstanceManager.destroy() to ensure that the method is + executed. (markt) +

Coyote

+ Fix a cause of multiple attempts to close the same socket. (markt) +
+ Refactor the certificate keystore and trust store generation to make it + easier for embedded users to inject their own key stores. (markt) +
+ Add a maxConcurrentStreamExecution on the HTTP/2 + protocol handler to allow restricting the amount of concurrent stream + that are being executed in a single connection. The default is to + not limit it. (remm) +
+ 59233: Add the ability to add TLS virtual hosts dynamically. + (markt) +
+ Correct a problem with ServletRequest.getServerPort() for + secure HTTP/2 connections that meant an incorrect value was returned when + using the default port. (markt) +
+ Improve error handling around user code prior to calling + InstanceManager.destroy() to ensure that the method is + executed. (markt) +

Jasper

+ Improve error handling around user code prior to calling + InstanceManager.destroy() to ensure that the method is + executed. (markt) +

WebSocket

+ Now the WebSocket implementation is not built directly on top of the + Servlet API and can use Tomcat internals, there is no need for the + dedicated WebSocket Executor. It has been replaced by the use of the + Connector/Endpoint provided Executor. (markt) +
+ Improve error handling around user code prior to calling + InstanceManager.destroy() to ensure that the method is + executed. (markt) +

Web Applications

+ Do not log an additional case of IOExceptions in the + error handler for the Drawboard WebSocket example when the root cause is + the client disconnecting since the logs add no value. (markt) +
+ 59642: Mention the localDataSource in the + DataSourceRealm section of the Realm How-To. (markt) +
+ 59672: Update the security considerations page of the + documentation web application to take account of the fact that the + Manager and HostManager applications now have a + RemoteAddrValve configured by default. (markt) +
+ Follow-up to the fix for 59399. Ensure that the new attribute + transportGuaranteeRedirectStatus is documented for all + Realms. Also document the NullRealm and + when it is automatically created for an Engine. (markt) +
+ Fix the description of maxAge attribute in jdbc-pool doc. + This attribute works both when a connection is returned and when a + connection is borrowed. (kfujino) +
+ 59774: Correct the prefix values in the + documented examples for configuring the AccessLogValve. + Patch provided by Mike Noordermeer. (markt) +

Tribes

+ Add log message when the ping has timed-out. (kfujino) +
+ If the ping message has been received at the + AbstractReplicatedMap#leftOver method, ensure that notify + the member is alive than ignore it. (kfujino) +

jdbc-pool

+ Fix the duplicated connection release when connection verification + failed. (kfujino) +
+ Ensure that do not remove the abandoned connection that has been already + released. (kfujino) +

Other

+ Remove JULI plus log4j extras and embedded artifacts from Maven release + script. (markt) +
+ Use the mirror network rather than the ASF master site to download the + current ASF dependencies. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.8 to + pick up the latest fixes and make 1.2.8 the minimum recommended version. + (markt) +

2016-06-13 Tomcat 9.0.0.M8 (markt)

Coyote

+ Remove accidentally committed debug code. (markt) +

not released Tomcat 9.0.0.M7 (markt)

Catalina

+ RMI Target related memory leaks are avoidable which makes them an + application bug that needs to be fixed rather than a JRE bug to work + around. Therefore, start logging RMI Target related memory leaks on web + application stop. Add an option that controls if the check for these + leaks is made. Log a warning if running on Java 9 with this check + enabled but without the command line option it requires. (markt) +
+ Ensure NPE will not be thrown during deployment when scanning jar files + without MANIFEST.MF file. (violetagg) +
+ Remove the clearReferencesStatic option from + StandardContext. It was known to cause problems with some + libraries (such as log4j) and was only linked to suspected memory leaks + rather than known memory leaks. It had been disabled by default with no + increase in the reports of memory leaks for some time. (markt) +
+ 59604: Correct the assumption made in the URL decoding that + the default platform encoding is always compatible with ISO-8859-1. This + assumption is not always valid, e.g. on z/OS. (markt) +
+ 59608: Skip over any invalid Class-Path attribute + from JAR manifests. Log errors at debug level due to many bad libraries. + (remm) +
+ Fix error message when failed to register MBean. (kfujino) +
+ 59655: Configure the cookie name validation to use RFC6265 + rules by default to align it with the default cookie parser. Document + the impact system properties have on cookie name validation. (mark) +

Coyote

+ Ensure that requests with HTTP method names that are not tokens (as + required by RFC 7231) are rejected with a 400 response. (markt) +
+ When an asynchronous request is processed by the AJP connector, ensure + that request processing has fully completed before starting the next + request. (markt) +
+ Improve handling of HTTP/2 stream resets. (markt) +
+ 58750: The HTTP Server header is no longer set by default. A + Server header may be configured by setting the server + attribute on the Connector. A new Connector + attribute, serverRemoveAppProvidedValues may be used to + remove any Server header set by a web application. (markt) +
+ 59564: Correct offset when reading into HTTP/2 input buffer + that could cause problems reading request bodies. (violetagg/markt) +
+ Modify the handling of read/write timeouts so that the appropriate error + handling (ReadListener.onError(), + WriteListener.onError() or + AsyncListener.onError()) is called. (markt) +
+ If an async dispatch results in the completion of request processing, + ensure that any remaining request body is swallowed before starting the + processing of the next request else the remaining body may be read as the + start of the next request leading to a 400 response. (markt) +

Jasper

+ 59567: Fix NPE scanning webapps for TLDs when an exploded + JAR has an empty WEB-INF/classes/META-INF folder. (remm) +
+ Fix a memory leak in the expression language implementation that caused + the class loader of the first web application to use expressions to be + pinned in memory. (markt) +
+ 59654: Improve error message when attempting to use a TLD + file from an invalid location. Patch provided by Huxing Zhang. (markt) +

WebSocket

+ 59659: Fix possible memory leak in WebSocket handling of + unexpected client disconnects. (markt) +

Web applications

+ 58891: Update the SSL how-to. Based on a suggestion by + Alexander Kjäll. (markt) +

Extras

+ 58588: Remove the JULI extras package from the distribution. + It was only useful for switching Tomcat's internal logging to log4j + 1.2.x and that version of log4j is no longer supported. No additional + Tomcat code is required if switching Tomcat's internal logging to log + via log4j 2.x. (markt) +

jdbc-pool

+ Fix a memory leak with the pool cleaner thread that retained a reference + to the web application class loader for the first web application to use + a connection pool. (markt) +

Other

+ Update the internal fork of Commons DBCP 2 to r1743696 (2.1.1 plus + additional fixes). (markt) +
+ Update the internal fork of Commons Pool 2 to r1743697 (2.4.2 plus + additional fixes). (markt) +
+ Update the internal fork of Commons File Upload to r1743698 (1.3.1 plus + additional fixes). (markt) +
+ Use UTF-8 with a standard prolog for all XML files. (markt) +
+ 58626: Add support for a new environment variable + (USE_NOHUP) that causes nohup to be used when + starting Tomcat. It is disabled by default except on HP-UX where it is + enabled by default since it is required when starting Tomcat at boot on + HP-UX. (markt) +

2016-05-16 Tomcat 9.0.0.M6 (markt)

Catalina

+ Ensure that annotated web components packed in web fragments will be + processed when unpackWARs is enabled. (violetagg) +

not released Tomcat 9.0.0.M5 (markt)

Catalina

+ 48922: Apply a very small performance improvement to the + date formatting in Tomcat's internal request object. Based on a patch + provided by Ondrej Medek. (markt) +
+ 59206: Ensure NPE will not be thrown by + o.a.tomcat.util.file.ConfigFileLoader when + catalina.base is not specified. (violetagg) +
+ 59217: Remove duplication in the recycling of the path in + o.a.tomcat.util.http.ServerCookie. Patch is provided by + Kyohei Nakamura. (violetagg) +
+ Fixed possible NPE in + o.a.catalina.loader.WebappClassLoaderBase.getResourceAsStream + (violetagg) +
+ 59213: Async dispatches should be based off a wrapped + request. (remm) +
+ Ensure that javax.servlet.ServletRequest and + javax.servlet.ServletResponse provided during + javax.servlet.AsyncListener registration are made + available via javax.servlet.AsyncEvent.getSuppliedRequest + and javax.servlet.AsyncEvent.getSuppliedResponse + (violetagg) +
+ 59219: Ensure AsyncListener.onError() is called + if an Exception is thrown during async processing. (markt) +
+ 59220: Ensure that AsyncListener.onComplete() is + called if the async request times out and the response is already + committed. (markt) +
+ 59226: Process the Class-Path attribute from + JAR manifests for JARs on the class path excluding JARs packaged in + WEB-INF/lib. (markt) +
+ 59255: Fix possible NPE in mapper. (kkolinko/remm) +
+ 59256: slf4j-taglib*.jar should not be excluded + from the standard JAR scanning by default. (violetagg) +
+ Clarify the log message that specifying both urlPatterns and value + attributes in @WebServlet and @WebFilter annotations is not allowed. + (violetagg) +
+ Ensure the exceptions caused by Valves will be available in the log + files so that they can be evaluated when + o.a.catalina.valves.ErrorReportValve.showReport is + disabled. Patch is provided by Svetlin Zarev. (violetagg) +
+ Remove unused distributable attribute that is defined as + TransientAttribute of Manager in StoreConfig. + (kfujino) +
+ Fix handling of Cluster Receiver in StoreConfig. The bind + and host attributes define as + TransientAttribute. (kfujino) +
+ 59261: ServletRequest.getAsyncContext() now + throws an IllegalStateException as required by the Servlet + specification if the request is not in asynchronous mode when called. + (markt) +
+ 59269: Correct the implementation of + PersistentManagerBase so that minIdleSwap + functions as designed and sessions are swapped out to keep the active + session count below maxActiveSessions. (markt) +
+ Update the implementation of the proposed Servlet 4.0 API to provide + mapping type information for the current request to reflect discussions + within the EG. (markt) +
+ Correctly configure the base path for a resources directory provided by + an expanded JAR file. Patch provided by hengyunabc. (markt) +
+ When multiple compressed formats are available and the client does not + express a preference, use the server order to determine the preferred + format. Based on a patch by gmokki. (markt) +
+ 59284: Allow the Tomcat provided JASPIC + SimpleServerAuthConfig to pick up module configuration + properties from either the property set passed to its constructor or + from the properties passed in the call to getAuthContext. + Based on a patch by Thomas Maslen. (markt) +
+ 59310: Do not add a Content-Length: 0 header for + custom responses to HEAD requests that do not set a + Content-Length value. (markt) +
+ When normalizing paths, improve the handling when paths end with + /. or /.. and ensure that input and output are + consistent with respect to whether or not they end with /. + (markt) +
+ 59317: Ensure that + HttpServletRequest.getRequestURI() returns an encoded URI + rather than a decoded URI after a dispatch. (markt) +
+ Use the correct URL for the fragment when reporting errors processing + a web-fragment.xml file from a JAR located in an unpacked + WAR. (markt) +
+ Ensure that JarScanner only uses the explicit call-back to + process WEB-INF/classes and only when configured to treat + the contents of WEB-INF/classes as a possible exploded JAR. + (markt) +
+ Remove the java2DDisposerProtection option from the + JreMemoryLeakPreventionListener. The leak is fixed in Java + 7 onwards and Tomcat 9 requires Java 8 so the option is unnecessary. + (markt) +
+ Remove the securityPolicyProtection option from the + JreMemoryLeakPreventionListener. The leak is fixed in Java + 8 onwards and Tomcat 9 requires Java 8 so the option is unnecessary. + (markt) +
+ Remove the securityLoginConfigurationProtection option from + the JreMemoryLeakPreventionListener. The leak is fixed in + Java 8 onwards and Tomcat 9 requires Java 8 so the option is + unnecessary. (markt) +
+ Ensure that the value for the header X-Frame-Options is + constructed correctly according to the specification when + ALLOW-FROM option is used. (violetagg) +
+ Fix an IllegalArgumentException if the first use of an + internal Response object requires JASPIC authentication. + (markt) +
+ Do not trigger unnecessary session ID changes when using JASPIC and the + user is authenticated using cached credentials. (markt) +
+ 59437: Ensure that the JASPIC CallbackHandler is + thread-safe. (markt) +
+ 59449: In ContainerBase, ensure that the process + to remove a child container is the reverse of the process to add one. + Patch provided by Huxing Zhang. (markt) +

Coyote

+ Improves OpenSSL engine robustness when SSL allocation fails for + some reason. (remm) +
+ OpenSSL engine code cleanups. (remm) +
+ Align cipher configuration parsing with current OpenSSL master. (markt) +
+ Change the default for honorCipherOrder to + false. With the current default TLS configuration, it is no + longer necessary for this to be true for a reasonably + secure configuration. (markt) +
+ Add a new environment variable JSSE_OPTS that is intended + to be used to pass JVM wide configuration to the JSSE implementation. + The default value is -Djdk.tls.ephemeralDHKeySize=2048 + which protects against weak Diffie-Hellman keys. (markt) +
+ 58970: Fix a connection counting bug in the NIO connector + that meant some dropped connections were not removed from the current + connection count. (markt) +
+ 59289: Do not recycle upgrade processors in unexpected close + situations. (remm) +
+ 59295: Use Locale.toLanguageTag() to construct + the Content-Language HTTP header to ensure the locale is + correctly represented. Patch provided by zikfat. (markt) +
+ 59295: Add support for using pem encoded certificates with + JSSE SSL. Submitted by Emmanuel Bourg with additional tweaks. (remm) +
+ Make the TLS certificate chain available to clients when using + JSSE+OpenSSL with the certificate chain stored in a Java KeyStore. + (markt) +
+ Work around a + known issue in OpenSSL that does not permit the TLS handshake to be + failed if the ALPN negotiation fails. (markt) +
+ 59421: Add direct HTTP/2 connection support. (remm) +
+ Correctly handle a call to AsyncContext.complete() from a + non-container thread when non-blocking I/O is being used. (markt) +
+ 59451: Correct Javadoc for MessageBytes. Patch + provided by Kyohei Nakamura. (markt) +
+ 59450: Correctly handle the case where the + LegacyCookieProcessor is configured with + allowHttpSepsInV0 set to false and + forwardSlashIsSeparator set to true. Patch + provided by Kyohei Nakamura. (markt) +

Jasper

+ When scanning JARs for TLDs, correctly handle the (rare) case where a + JAR has been exploded into WEB-INF/classes and the web + application is deployed as a packed WAR. (markt) +
+ 59640: NPEs with not found TLDs. (remm) +

WebSocket

+ 59189: Explicitly release the native memory held by the + Inflater and Deflater when using + PerMessageDeflate and the WebSocket session ends. Based on a patch by + Henrik Olsson. (markt) +
+ Restore the WsServerContainer.doUpgrade() method which was + accidentally removed since it is not used by Tomcat. (markt) +
+ Fix a regression caused by the connector refactoring and ensure that the + thread context class loader is set to the web application + classloader when processing WebSocket messages on the server. (markt) +
+ Ensure that a client disconnection triggers the error handling for the + associated WebSocket end point. (markt) +
+ Make WebSocket client more robust when handling errors during the close + of a WebSocket session. (markt) +

Web applications

+ 59218: Correct the path to jaspic-providers.xml + in Jaspic How-To. Patch is provided by Tatsuya Bessho. (violetagg) +
+ Remove button that has accidentally been added to the host manager. + Submitted by Coty Sutherland. (remm) +
+ Update in the documentation the link to the maven repository where + Tomcat snapshot artifacts are deployed. (markt/violetagg) +
+ Clarify in the documentation that calls to + ServletContext.log(String, Throwable) or + GenericServlet.log(String, Throwable) are logged at the + SEVERE level. (violetagg) +
+ Correct a typo in SSL/TLS Configuration How-To. + Issue reported via comments.apache.org. (violetagg) +

Tribes

+ Avoid NPE when a proxy node failed to retrieve a backup entry. (kfujino) +
+ Add the flag indicating that member is a localMember. (kfujino) +
+ Fix potential NPE that depends on the setting order of attributes of + static member when using the static cluster. (kfujino) +
+ Add get/set method for the channel that is related to + ChannelInterceptor. (kfujino) +
+ As with the multicast cluster environment, in the static cluster + environment, the local member inherits properties from the cluster + receiver. (kfujino) +
+ Add get/set method for the channel that is related to each Channel + services. (kfujino) +
+ Add name to channel in order to identify channels. In tomcat cluster + environment, it is set the cluster name + "-Channel" as default value. + (kfujino) +
+ Add the channel name to the thread which is invoked by channel services + in order to identify the associated channel. (kfujino) +
+ Ensure that clear the channel instance from channel services when + stopping channel. (kfujino) +
+ Implement map state in the replication map. (kfujino) +
+ Ensure that the ping is not executed during the start/stop of the + replication map. (kfujino) +
+ In ping processing in the replication map, send not the + INIT message but the newly introduced PING + message. (kfujino) +

Other

+ 59211: Add hamcrest to Eclipse classpath. Patch is provided + by Huxing Zhang. (violetagg) +
+ 59276: Update optional Checkstyle library to 6.17. + (kkolinko) +
+ 59280: Update the NSIS Installer used to build the + Windows Installers to version 2.51. (kkolinko) +
+ Update the packaged version of the Tomcat Native Library to 1.2.7 to + pick up the Windows binaries that are based on OpenSSL 1.0.2h and APR + 1.5.2. (markt) +

2016-03-16 Tomcat 9.0.0.M4 (markt)

Catalina

+ Ensure that /WEB-INF/classes is never processed as a web + fragment. (markt) +
+ Switch default connector when native is installed. Unless configured + otherwise, the NIO endpoint will be used by default. If SSL is + configured, OpenSSL will be used rather than JSSE. (remm) +
+ Correct a regression in the fix for 58867. When configuring a + Context to use an external directory for the docBase, and + that directory happens to be located along side the original WAR, use + the directory as the docBase rather than expanding the + WAR into the appBase and using the newly created expanded + directory as the docBase. (markt) +
+ 58351: Make the server build date and server version number + accessible via JMX. Patch provided by Huxing Zhang. (markt) +
+ 58988: Special characters in the substitutions for the + RewriteValve can now be quoted with a backslash. (fschumacher) +
+ 58999: Fix class and resource name filtering in + WebappClassLoader. It throws a StringIndexOutOfBoundsException if the + name is exactly "org" or "javax". (rjung) +
+ Add JASPIC (JSR-196) support. (markt) +
+ Make checking for var and map replacement in RewriteValve a bit stricter + and correct detection of colon in var replacement. (fschumacher) +
+ Refactor the web application class loader to reduce the impact of JAR + scanning on the memory footprint of the web application. (markt) +
+ Fix some resource leaks in the error handling for accessing files from + JARs and WARs. (markt) +
+ Refactor the JAR and JAR-in-WAR resource handling to reduce the memory + footprint of the web application. (markt) +
+ Refactor the web.xml parsing so a new parser is created every time the + web application starts rather than creating and caching the parser when + the Context is created. This enables the parser to take account of + modified Context configuration parameters and reduces (slightly) the + memory footprint of a running Tomcat instance. (markt) +
+ Switch the web application class loader to the + ParallelWebappClassLoader by default. (markt) +
+ 57809: Remove the custom context attribute that held the + effective web.xml. Components needing access to configuration + information may access it via the Servlet API. (markt) +
+ Refactor JAR scanning to reduce memory footprint. (markt) +
+ 59001: Correctly handle the case when Tomcat is installed on + a path where one of the segments ends in an exclamation mark. (markt) +
+ Expand the fix for 59001 to cover the special sequences used + in Tomcat's custom jar:war: URLs. (markt) +
+ 59043: Avoid warning while expiring sessions associated with + a single sign on if HttpServletRequest.logout() is used. + (markt) +
+ 59054: Ensure that using the + CrawlerSessionManagerValve in a distributed environment + does not trigger an error when the Valve registers itself in the + session. (markt) +
+ Add socket properties support to storeconfig. (remm) +
+ Fix incorrect parsing of the NE and NC flags in rewrite rules. (remm) +
+ 59065: Correct the timing of the check for colons in paths + on non-Windows systems implemented in catalina.sh so it + works correctly with Cygwin. Patch provided by Ed Randall. (markt) +
+ When a Host is configured with an appBase that does not exist, create + the appBase before trying to expand an external WAR file into it. + (markt) +
+ 59115: When using the Servlet 3.0 file upload, the submitted + file name may be provided as a token or a quoted-string. If a + quoted-string, unquote the string before returning it to the user. + (markt) +
+ 59123: Close NamingEnumeration objects used by + the JNDIRealm once they are no longer required. + (fschumacher/markt) +
+ Implement the proposed Servlet 4.0 API to provide mapping type + information for the current request. (markt) +
+ 59138: Correct a false positive warning for ThreadLocal + related memory leaks when the key class but not the value class has been + loaded by the web application class loader. (markt) +
+ 59017: Make the pre-compressed file support in the Default + Servlet generic so any compression may be used rather than just gzip. + Patch provided by Mikko Tiihonen. (markt) +
+ 59145: Don't log an invalid warning when a user logs out of + a session associated with SSO. (markt) +
+ 59150: Add an additional flag on APR listener to allow + disabling automatic use of OpenSSL. (remm) +
+ 59151: Fix a regression in the fix for 56917 that + added additional (and arguably unnecessary) validation to the provided + redirect location. (markt) +
+ 59154: Fix a NullPointerException in the + JAASMemoryLoginModule resulting from the introduction of + the CredentialHandler to Realms. + (schultz/markt) +

Coyote

+ Handle the case in the NIO2 connector where the required TLS buffer + sizes increase after the connection has been initiated. (markt/remm) +
+ Bad processing of handshake errors in NIO2. (remm) +
+ Use JSSE session configuration options with OpenSSL. (remm) +
+ 59015: Fix potential cause of endless APR Poller loop during + shutdown if the Poller experiences an error during the shutdown process. + (markt) +
+ Align cipher aliases for kECDHE and ECDHE with + the current OpenSSL implementation. (markt) +
+ 59081: Retain the user defined cipher order when defining + ciphers. (markt) +
+ 59089: Correctly ignore HTTP headers that include non-token + characters in the header name. (markt) +

Jasper

+ Update to the Eclipse JDT Compiler 4.5.1. (markt) +
+ 57583: Improve the performance of + javax.servlet.jsp.el.ScopedAttributeELResolver when + resolving attributes that do not exist. This improvement only works when + Jasper is used with Tomcat's EL implementation. (markt) +

WebSocket

+ Fix a timing issue on session close that could result in an exception + being thrown for an incomplete message even through the message was + completed. (markt) +
+ Correctly handle compression of partial messages when the final message + fragment has a zero length payload. (markt) +
+ 59119: Correct read logic for WebSocket client when using + secure connections. (markt) +
+ 59134: Correct client connect logic for secure connections + made through a proxy. (markt) +

Web applications

+ Correct an error in the documentation of the expected behaviour for + automatic deployment. If a WAR is updated and an expanded directory is + present, the directory will always be deleted and recreated by expanding + the WAR if unpackWARs is true. (markt) +
+ 48674: Implement an option within the Host Manager web + application to persist the current configuration. Based on a patch by + Coty Sutherland. (markt) +
+ 58935: Remove incorrect references in the documentation to + using jar:file: URLs with the Manager application. (markt) +
+ Correct the description of the + ServletRequest.getServerPort() in Proxy How-To. + Issue reported via comments.apache.org. (violetagg) +
+ The Manager and Host Manager applications are now only accessible via + localhost by default. (markt) +

Tribes

+ If promoting a proxy node to a primary node when getting a session, + notify the change of the new primary node to the original backup node. + (kfujino) +

Other

+ 58283: Change the default download location for libraries + during the build process from /usr/share/java to + ${user.home}/temp. Patch provided by Ahmed Hosni. (markt) +
+ 59031: When using the Windows uninstaller, do not remove the + contents of any directories that have been symlinked into the Tomcat + directory structure. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.5 to + pick up the Windows binaries that are based on OpenSSL 1.0.2g and APR + 1.5.1. (markt) +
+ Modify the default tomcat-users.xml file to make it harder + for users to configure the entries intended for use with the examples + web application for the Manager application. (markt) +

2016-02-05 Tomcat 9.0.0.M3 (markt)

General

+ Allow to configure multiple JUnit test class patterns with the build + property test.name and document the property in + BUILDING.txt. (rjung) +

Catalina

+ Protect initialization of ResourceLinkFactory when + running with a SecurityManager. (kkolinko) +
+ Correct a thread safety issue in the filtering of session attributes + based on the implementing class name of the value object. (markt) +
+ Fix class loader decision on the delegation for class loading and + resource lookup and make it faster too. (rjung) +
+ 58768: Log a warning if a redirect fails because of an + invalid location. (markt) +
+ 58827: Remove remains of JSR-77 implementation. (markt) +
+ 58946: Ensure that the request parameter map remains + immutable when processing via a RequestDispatcher. (markt) +
+ 58905: Ensure that Tomcat.silence() silences the + correct logger and respects the current setting. (markt) +

Coyote

+ Correct a regression in the connector refactoring in 9.0.0.M2 that broke + TLS support for the APR/native connector. (remm) +
+ Correct an NPE when listing the enabled ciphers (e.g. via the Manager + web application) for a TLS enabled APR/native connector. (markt) +
+ New configuration option ajpFlush for the AJP connectors + to disable the sending of AJP flush packets. (rjung) +
+ Handle the case in the NIO connector where the required TLS buffer sizes + increase after the connection has been initiated. (markt) +

not released Tomcat 9.0.0.M2 (markt)

Catalina

+ Refactor creation of MapperListener to ensure that the + Mapper used is the Mapper associated with the + Service for which the listener was created. (markt) +
+ Move the functionality that provides redirects for context roots and + directories where a trailing / is added from the Mapper to + the DefaultServlet. This enables such requests to be + processed by any configured Valves and Filters before the redirect is + made. This behaviour is configurable via the + mapperContextRootRedirectEnabled and + mapperDirectoryRedirectEnabled attributes of the Context + which may be used to restore the previous behaviour. (markt) +
+ Refactor Service.getContainer() to return an + Engine rather than a Container. (markt) +
+ 34319: Only load those keys in StoreBase.processExpire + from JDBCStore, that are old enough, to be expired. Based on a patch + by Tom Anderson. (fschumacher) +
+ 56917: As per RFC7231 (HTTP/1.1), allow HTTP/1.1 and later + redirects to use relative URIs. This is controlled by a new attribute + useRelativeRedirects on the Context and + defaults to true. (markt) +
+ 58629: Allow an embedded Tomcat instance to start when the + Service has no Engine configured. (markt) +
+ Correctly notify the MapperListener associated with a Service if the + Engine for that Service is changed. (markt) +
+ Make a web application's CredentialHandler available through a context + attribute. This allows a web application to use the same algorithm + for validating or generating new stored credentials from cleartext + ones. (schultz) +
+ 58635: Enable break points to be set within agent code when + running Tomcat with a Java agent. Based on a patch by Huxing Zhang. + (markt) +
+ Fixed potential NPE in HostConfig while deploying an + application. Issue reported by coverity scan. (violetagg) +
+ 58655: Fix an IllegalStateException when + calling HttpServletResponse.sendRedirect() with the + RemoteIpFilter. This was caused by trying to correctly + generate the absolute URI for the redirect. With the fix for + 56917, redirects may now be relative making the + sendRedirect() implementation for the + RemoteIpFilter much simpler. This also addresses issues + where the redirect may not have behaved as expected when redirecting + from http to https to from https to http. (markt) +
+ 58657: Exceptions in a Servlet 3.1 ReadListener + or WriteListener do not need to be immediately fatal to the + connection. Allow an error response to be written. (markt) +
+ Correct implementation of + validateClientProvidedNewSessionId so client provided + session IDs may be rejected if validation is enabled. (markt) +
+ 58701: Reset the instanceInitialized field in + StandardWrapper when unloading a Servlet so that a new + instance may be correctly initialized. (markt) +
+ Add a new flag aprPreferred to the Apr listener. if set to + false, when using the connector defaults, it will use + NIO + OpenSSL if tomcat-native is available, rather than the APR + connector. (remm) +
+ Add path parameter handling to + HttpServletRequest.getContextPath(). This is a follow-up to + the fix for 57215. (markt) +
+ 58692: Make StandardJarScanner more robust. Log + a warning if a class path entry cannot be scanned rather than triggering + the failure of the web application. Includes a test case written by + Derek Abdine. (markt) +
+ 58702: Ensure an access log entry is generated if the client + aborts the connection. (markt) +
+ Fixed various issues reported by Findbugs. (violetagg) +
+ 58735: Add support for the X-XSS-Protection + header to the HttpHeaderSecurityFilter. Patch provided by + Jacopo Cappellato. (markt) +
+ Add the StatusManagerServlet to the list of Servlets that + can only be loaded by privileged applications. (markt) +
+ Simplify code and fix messages in + org.apache.catalina.core.DefaultInstanceManager class. + (kkolinko) +
+ 58751: Correctly handle the case where an + AsyncListener dispatches to a Servlet on an asynchronous + timeout and the Servlet uses sendError() to trigger an + error page. Includes a test case based on code provided by Andy + Wilkinson.(markt) +
+ Ensure that the proper file encoding if specified will be used when + a readme file is served by DefaultServlet. (violetagg) +
+ Fix declaration of localPort attribute of Connector MBean: + it is read-only. (kkolinko) +
+ 58766: Make skipping non-class files during annotation + scanning faster by checking the file name first. Improve debug logging. + (kkolinko) +
+ 58836: Correctly merge query string parameters when + processing a forwarded request where the target includes a query string + that contains a parameter with no value. (markt/kkolinko) +
+ Make sure that shared Digester is reset in an unlikely error case + in HostConfig.deployWAR(). (kkolinko) +
+ Extend the feature available in the cluster session manager + implementations that enables session attribute replication to be + filtered based on attribute name to all session manager implementations. + Note that configuration attribute name has changed from + sessionAttributeFilter to + sessionAttributeNameFilter. Apply the filter on load as + well as unload to ensure that configuration changes made while the web + application is stopped are applied to any persisted data. (markt) +
+ Extend the session attribute filtering options to include filtering + based on the implementation class of the value and optional + WARN level logging if an attribute is filtered. These + options are available for all of the Manager implementations that ship + with Tomcat. When a SecurityManager is used filtering will + be enabled by default. (markt) +
+ Remove distributable and maxInactiveInterval + from the Manager interface because the attributes are never + used. The equivalent attributes from the Context always + take precedence. (markt) +
+ 58867: Improve checking on Host start for WAR files that have + been modified while Tomcat has stopped and re-expand them if + unpackWARs is true. (markt) +
+ 58900: Correctly undeploy symlinked resources and prevent an + infinite cycle of deploy / undeploy. (markt) +

Coyote

+ 58621: The certificate chain cannot be set using the main + certificate attribute, so restore the certificate chain property. (remm) +
+ Allow a new SSL config type where a connector can use either JSSE or + OpenSSL. Both could be allowed, but it would likely create support + issues. This type is used by the OpenSSL implementation for NIOx. (remm) +
+ Improve upgrade context classloader handling by using Context.bind and + unbind. (remm) +
+ Improve OpenSSL keystore/truststore configuration by using the code + from the JSSE implementation. (remm, jfclere) +
+ Fix a potential loop when a client drops the connection unexpectedly. + (markt) +
+ OpenSSL renegotiation support for client certificate authentication. + (remm) +
+ Fix NIO connector renegotiation. (remm) +
+ 58659: Fix a potential deadlock during HTTP/2 processing when + the connection window size is limited. (markt) +

Jasper

+ 57136#c25: Change default value of + quoteAttributeEL setting in Jasper to be true + for better compatibility with other implementations and older versions + of Tomcat. Add command line option -no-quoteAttributeEL in + JspC. (kkolinko) +
+ Fix handling of missing messages in + org.apache.el.util.MessageFactory. (violetagg) +

Cluster

+ Enable an explicit configuration of local member in the static cluster + membership. (kfujino) +
+ Fix potential integer overflow in DeltaSession. + Reported by coverity scan. (fschumacher) +
+ In order to avoid that the heartbeat thread and the background thread to + run Channel.heartbeat simultaneously, if + heartbeatBackgroundEnabled of SimpleTcpCluster + set to true, ensure that the heartbeat thread does not + start. (kfujino) +

WebSocket

+ 55006: The WebSocket client now honors the + java.net.java.net.ProxySelector configuration (using the + HTTP type) when establishing WebSocket connections to servers. Based on + a patch by Niki Dokovski. (markt) +
+ 58624: Correct a potential deadlock if the WebSocket + connection is closed when a message write is in progress. (markt) +
+ 57489: Ensure onClose() is called when a + WebSocket connection is closed even if the sending of the close message + fails. Includes test cases by Barry Coughlan. (markt) +

Web Applications

+ 58631: Correct the continuation character use in the Windows + Service How-To page of the documentation web application. (markt) +
+ Correct the SSL documentation for deprecated attributes to point to the + correct, new location for attributes related to individual certificates. + (markt) +
+ Correct some typos in the JNDI resources How-To. (markt) +
+ Don't create session unnecessarily in the Manager application. (markt) +
+ Don't create session unnecessarily in the Host Manager application. + (markt) +
+ 58723: Clarify documentation and error messages for the text + interface of the manager to make clear that version must be used with + path when referencing contexts deployed using parallel deployment. + (markt) +
+ Document test.threads option in BUILDING.txt. (kkolinko) +

Tribes

+ Ensure that the static member is registered to the add suspect list even + if the static member that is registered to the remove suspect list has + disappeared. (kfujino) +
+ When using a static cluster, add the members that have been cached in + the membership service to the map members list in order to ensure that + the map member is a static member. (kfujino) +
+ Add support for the startup notification of local members in the static + cluster. (kfujino) +
+ Ignore the unnecessary member remove operation from different domain. + (kfujino) +
+ Add support for the shutdown notification of local members in the static + cluster. (kfujino) +

jdbc-pool

+ Correct evaluation of system property + org.apache.tomcat.jdbc.pool.onlyAttemptCurrentClassLoader. + It was basically ignored before. Reported by coverity scan. (fschumacher) +
+ Fix potential integer overflow in ConnectionPool and + PooledConnection. Reported by coverity scan. (fschumacher) +

Other

+ Update optional Checkstyle library to 6.14.1. (kkolinko) +
+ Update the packaged version of the Tomcat Native Library to 1.2.4 to + pick up the Windows binaries that are based on OpenSSL 1.0.2e and APR + 1.5.1. (markt) +
+ Update the NSIS Installer used to build the Windows Installers to + version 2.50. (markt/kkolinko) +
+ Update the internal fork of Commons BCEL to r1725718 to align with the + refactoring for BCEL 6, the next major BCEL release. (markt) +
+ Update the internal fork of Commons DBCP 2 to r1725730 (2.1.1 plus + additional fixes). (markt) +
+ Update the internal fork of Commons Pool 2 to r1725738 (2.4.2 plus + additional fixes). (markt) +
+ Update the internal fork of Commons Codec to r1725746 (1.9 plus + additional fixes). (markt) +

2015-11-17 Tomcat 9.0.0.M1 (markt)

General

+ Make Java 8 the minimum required version to build and run Tomcat 9. + (markt) +
+ Remove support for Comet. (markt) +
+ Tighten up the default file permissions for the .tar.gz + distribution so no files or directories are world readable by default. + Configure Tomcat to run with a default umask of 0027 which + may be overridden by setting UMASK in + setenv.sh. (markt) +
+ Remove native code (Windows Service Wrapper, APR/native connector) + support for Windows Itanium. (markt) +

Catalina

+ The default HTTP cookie parser has been changed to + org.apache.tomcat.util.http.Rfc6265CookieProcessor. (markt) +

Coyote

+ Remove support for the HTTP BIO and AJP BIO connectors. (markt) +
+ Refactor HTTP upgrade and AJP implementations to reduce duplication. + (markt) +
+ Add support for HPACK header encoding and decoding, contributed + by Stuart Douglas. (remm) +
+ 57108: Add support for Server Name Indication (SNI). There + has been significant changes to the SSL configuration in server.xml to + support this. (markt) +
+ Add SSL engine for JSSE backed by OpenSSL. Includes ALPN support. + Based on code contributed by Numa de Montmollin and derived from code + developed by Twitter and Netty. (remm) +
+ RFC 7230 states that clients should ignore reason phrases in HTTP/1.1 + response messages. Since the reason phrase is optional, Tomcat no longer + sends it. As a result the system property + org.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER is no + longer used and has been removed. (markt) +
+ The minimum required Tomcat Native version has been increased to 1.2.2. + The 1.2.x branch includes ALPN and SNI support which are required for + HTTP/2. (markt) +
+ Add support for HTTP/2 including server push. (markt) +

Tribes

+ Clarify the handling of Copy message and Copy nodes. (kfujino) +

Other

+ Support the use of the threads attribute on Ant's + junit task. Note that using this with a value of greater than one will + disable Cobertura code coverage. (markt) +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509330470/3/class-loader-howto.html b/ZipProject/wwwroot/zip/15509330470/3/class-loader-howto.html new file mode 100644 index 0000000..4ebb3d9 --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/3/class-loader-howto.html @@ -0,0 +1,291 @@ + +Apache Tomcat 9 (9.0.11) - Class Loader HOW-TO

Class Loader HOW-TO

Overview
Class Loader Definitions
XML Parsers and Java
Running under a security manager
Advanced configuration

Overview

+ +

Like many server applications, Tomcat installs a variety of class loaders +(that is, classes that implement java.lang.ClassLoader) to allow +different portions of the container, and the web applications running on the +container, to have access to different repositories of available classes and +resources. This mechanism is used to provide the functionality defined in the +Servlet Specification, version 2.4 — in particular, Sections 9.4 +and 9.6.

+ +

In a Java environment, class loaders are +arranged in a parent-child tree. Normally, when a class loader is asked to +load a particular class or resource, it delegates the request to a parent +class loader first, and then looks in its own repositories only if the parent +class loader(s) cannot find the requested class or resource. Note, that the +model for web application class loaders differs slightly from this, +as discussed below, but the main principles are the same.

+ +

When Tomcat is started, it creates a set of class loaders that are +organized into the following parent-child relationships, where the parent +class loader is above the child class loader:

+ +

      Bootstrap
+          |
+       System
+          |
+       Common
+       /     \
+  Webapp1   Webapp2 ...

+ +

The characteristics of each of these class loaders, including the source +of classes and resources that they make visible, are discussed in detail in +the following section.

+ +

Class Loader Definitions

+ +

As indicated in the diagram above, Tomcat creates the following class +loaders as it is initialized:

Bootstrap — This class loader contains the basic + runtime classes provided by the Java Virtual Machine, plus any classes from + JAR files present in the System Extensions directory + ($JAVA_HOME/jre/lib/ext). Note: some JVMs may + implement this as more than one class loader, or it may not be visible + (as a class loader) at all.
System — This class loader is normally initialized + from the contents of the CLASSPATH environment variable. All + such classes are visible to both Tomcat internal classes, and to web + applications. However, the standard Tomcat startup scripts + ($CATALINA_HOME/bin/catalina.sh or + %CATALINA_HOME%\bin\catalina.bat) totally ignore the contents + of the CLASSPATH environment variable itself, and instead + build the System class loader from the following repositories: +
+
- $CATALINA_HOME/bin/bootstrap.jar — Contains the + main() method that is used to initialize the Tomcat server, and the + class loader implementation classes it depends on.
- $CATALINA_BASE/bin/tomcat-juli.jar or + $CATALINA_HOME/bin/tomcat-juli.jar — Logging + implementation classes. These include enhancement classes to + java.util.logging API, known as Tomcat JULI, + and a package-renamed copy of Apache Commons Logging library + used internally by Tomcat. + See logging documentation for more + details.
  +
  If tomcat-juli.jar is present in + $CATALINA_BASE/bin, it is used instead of the one in + $CATALINA_HOME/bin. It is useful in certain logging + configurations
- $CATALINA_HOME/bin/commons-daemon.jar — The classes + from Apache Commons + Daemon project. + This JAR file is not present in the CLASSPATH built by + catalina.bat|.sh scripts, but is referenced + from the manifest file of bootstrap.jar.
+
Common — This class loader contains additional + classes that are made visible to both Tomcat internal classes and to all + web applications.
+
Normally, application classes should NOT + be placed here. The locations searched by this class loader are defined by + the common.loader property in + $CATALINA_BASE/conf/catalina.properties. The default setting will search the + following locations in the order they are listed:
+
- unpacked classes and resources in $CATALINA_BASE/lib
- JAR files in $CATALINA_BASE/lib
- unpacked classes and resources in $CATALINA_HOME/lib
- JAR files in $CATALINA_HOME/lib
+
By default, this includes the following:
+
- annotations-api.jar — JavaEE annotations classes.
- catalina.jar — Implementation of the Catalina servlet + container portion of Tomcat.
- catalina-ant.jar — Tomcat Catalina Ant tasks.
- catalina-ha.jar — High availability package.
- catalina-storeconfig.jar — Generation of XML + configuration files from current state
- catalina-tribes.jar — Group communication package.
- ecj-*.jar — Eclipse JDT Java compiler.
- el-api.jar — EL 3.0 API.
- jasper.jar — Tomcat Jasper JSP Compiler and Runtime.
- jasper-el.jar — Tomcat Jasper EL implementation.
- jsp-api.jar — JSP 2.3 API.
- servlet-api.jar — Servlet 4.0 API.
- tomcat-api.jar — Several interfaces defined by Tomcat.
- tomcat-coyote.jar — Tomcat connectors and utility classes.
- tomcat-dbcp.jar — Database connection pool + implementation based on package-renamed copy of Apache Commons Pool + and Apache Commons DBCP.
- tomcat-i18n-**.jar — Optional JARs containing resource bundles + for other languages. As default bundles are also included in each + individual JAR, they can be safely removed if no internationalization + of messages is needed.
- tomcat-jdbc.jar — An alternative database connection pool + implementation, known as Tomcat JDBC pool. See + documentation for more details.
- tomcat-util.jar — Common classes used by various components of + Apache Tomcat.
- tomcat-websocket.jar — WebSocket 1.1 implementation
- websocket-api.jar — WebSocket 1.1 API
WebappX — A class loader is created for each web + application that is deployed in a single Tomcat instance. All unpacked + classes and resources in the /WEB-INF/classes directory of + your web application, plus classes and resources in JAR files + under the /WEB-INF/lib directory of your web application, + are made visible to this web application, but not to other ones.

+ +

As mentioned above, the web application class loader diverges from the +default Java delegation model (in accordance with the recommendations in the +Servlet Specification, version 2.4, section 9.7.2 Web Application Classloader). +When a request to load a +class from the web application's WebappX class loader is processed, +this class loader will look in the local repositories first, +instead of delegating before looking. There are exceptions. Classes which are +part of the JRE base classes cannot be overridden. There are some exceptions +such as the XML parser components which can be overridden using the appropriate +JVM feature which is the endorsed standards override feature for Java <= 8 +and the upgradeable modules feature for Java 9+. +Lastly, the web application class loader will always delegate first for JavaEE +API classes for the specifications implemented by Tomcat +(Servlet, JSP, EL, WebSocket). All other class loaders in Tomcat follow the +usual delegation pattern.

+ +

Therefore, from the perspective of a web application, class or resource +loading looks in the following repositories, in this order:

Bootstrap classes of your JVM
/WEB-INF/classes of your web application
/WEB-INF/lib/*.jar of your web application
System class loader classes (described above)
Common class loader classes (described above)

+ +

If the web application class loader is +configured with +<Loader delegate="true"/> +then the order becomes:

Bootstrap classes of your JVM
System class loader classes (described above)
Common class loader classes (described above)
/WEB-INF/classes of your web application
/WEB-INF/lib/*.jar of your web application

+ +

XML Parsers and Java

+ +

Starting with Java 1.4 a copy of JAXP APIs and an XML parser are packed +inside the JRE. This has impacts on applications that wish to use their own +XML parser.

+ +

In old versions of Tomcat, you could simply replace the XML parser +in the Tomcat libraries directory to change the parser +used by all web applications. However, this technique will not be effective +when you are running modern versions of Java, because the usual class loader +delegation process will always choose the implementation inside the JDK in +preference to this one.

+ +

Java <= 8 supports a mechanism called the "Endorsed Standards Override +Mechanism" to allow replacement of APIs created outside of the JCP +(i.e. DOM and SAX from W3C). It can also be used to update the XML parser +implementation. For more information, see: + +http://docs.oracle.com/javase/1.5.0/docs/guide/standards/index.html. For +Java 9+, use the upgradeable modules feature.

+ +

Tomcat utilizes the endorsed mechanism by including the system property setting +-Djava.endorsed.dirs=$JAVA_ENDORSED_DIRS in the +command line that starts the container. The default value of this option is +$CATALINA_HOME/endorsed. This endorsed directory is not +created by default. Note that the endorsed feature is no longer supported +with Java 9 and the above system property will only be set if either the +directory $CATALINA_HOME/endorsed exists, or the variable +JAVA_ENDORSED_DIRS has been set. +

+ +

Note that overriding any JRE component carries risk. If the overriding +component does not provide a 100% compatible API (e.g. the API provided by +Xerces is not 100% compatible with the XML API provided by the JRE) then there +is a risk that Tomcat and/or the deployed application will experience errors.

+ +

Running under a security manager

+ +

When running under a security manager the locations from which classes +are permitted to be loaded will also depend on the contents of your policy +file. See Security Manager HOW-TO +for further information.

+ +

Advanced configuration

+ +

A more complex class loader hierarchy may also be configured. See the diagram +below. By default, the Server and Shared +class loaders are not defined and the simplifed hierarchy shown above is used. +This more complex hierarchy may be use by defining values for the +server.loader and/or shared.loader properties in +conf/catalina.properties.

+ +


+  Bootstrap
+      |
+    System
+      |
+    Common
+     /  \
+Server  Shared
+         /  \
+   Webapp1  Webapp2 ...

+ +

The Server class loader is only visible to Tomcat internals +and is completely invisible to web applications.

+ +

The Shared class loader is visible to all web applications +and may be used to shared code across all web applications. However, any updates +to this shared code will require a Tomcat restart.

+ +

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509330470/3/cluster-howto.html b/ZipProject/wwwroot/zip/15509330470/3/cluster-howto.html new file mode 100644 index 0000000..6e88ecd --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/3/cluster-howto.html @@ -0,0 +1,680 @@ + +Apache Tomcat 9 (9.0.11) - Clustering/Session Replication HOW-TO

Clustering/Session Replication HOW-TO

Important Note

You can also check the configuration reference documentation. +

For the impatient
Security
Cluster Basics
Overview
Cluster Information
Bind session after crash to failover node
Configuration Example
Cluster Architecture
How it Works
Monitoring your Cluster with JMX
FAQ

For the impatient

+ Simply add +

<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>

+ to your <Engine> or your <Host> element to enable clustering. +

+ Using the above configuration will enable all-to-all session replication + using the DeltaManager to replicate session deltas. By all-to-all we mean that the session gets replicated to all the other + nodes in the cluster. This works great for smaller cluster but we don't recommend it for larger clusters(a lot of Tomcat nodes). + Also when using the delta manager it will replicate to all nodes, even nodes that don't have the application deployed.
+ To get around this problem, you'll want to use the BackupManager. This manager only replicates the session data to one backup + node, and only to nodes that have the application deployed. Downside of the BackupManager: not quite as battle tested as the delta manager. +

+ Here are some of the important default values: +

Multicast address is 228.0.0.4
Multicast port is 45564 (the port and the address together determine cluster membership.
The IP broadcasted is java.net.InetAddress.getLocalHost().getHostAddress() (make sure you don't broadcast 127.0.0.1, this is a common error)
The TCP port listening for replication messages is the first available server socket in range 4000-4100
Listener is configured ClusterSessionListener
Two interceptors are configured TcpFailureDetector and MessageDispatchInterceptor

+ The following is the default cluster configuration: +

        <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
+                 channelSendOptions="8">
+
+          <Manager className="org.apache.catalina.ha.session.DeltaManager"
+                   expireSessionsOnShutdown="false"
+                   notifyListenersOnReplication="true"/>
+
+          <Channel className="org.apache.catalina.tribes.group.GroupChannel">
+            <Membership className="org.apache.catalina.tribes.membership.McastService"
+                        address="228.0.0.4"
+                        port="45564"
+                        frequency="500"
+                        dropTime="3000"/>
+            <Receiver className="org.apache.catalina.tribes.transport.nio.NioReceiver"
+                      address="auto"
+                      port="4000"
+                      autoBind="100"
+                      selectorTimeout="5000"
+                      maxThreads="6"/>
+
+            <Sender className="org.apache.catalina.tribes.transport.ReplicationTransmitter">
+              <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
+            </Sender>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.TcpFailureDetector"/>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.MessageDispatchInterceptor"/>
+          </Channel>
+
+          <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
+                 filter=""/>
+          <Valve className="org.apache.catalina.ha.session.JvmRouteBinderValve"/>
+
+          <Deployer className="org.apache.catalina.ha.deploy.FarmWarDeployer"
+                    tempDir="/tmp/war-temp/"
+                    deployDir="/tmp/war-deploy/"
+                    watchDir="/tmp/war-listen/"
+                    watchEnabled="false"/>
+
+          <ClusterListener className="org.apache.catalina.ha.session.ClusterSessionListener"/>
+        </Cluster>

Will cover this section in more detail later in this document.

Security

+ +

The cluster implementation is written on the basis that a secure, trusted +network is used for all of the cluster related network traffic. It is not safe +to run a cluster on a insecure, untrusted network.

+ +

There are many options for providing a secure, trusted network for use by a +Tomcat cluster. These include:

private LAN
a Virtual Private Network (VPN)
IPSEC

+ +

Cluster Basics

+ +

To run session replication in your Tomcat 9 container, the following steps +should be completed:

All your session attributes must implement java.io.Serializable
Uncomment the Cluster element in server.xml
If you have defined custom cluster valves, make sure you have the ReplicationValve defined as well under the Cluster element in server.xml
If your Tomcat instances are running on the same machine, make sure the Receiver.port + attribute is unique for each instance, in most cases Tomcat is smart enough to resolve this on it's own by autodetecting available ports in the range 4000-4100
Make sure your web.xml has the + <distributable/> element
If you are using mod_jk, make sure that jvmRoute attribute is set at your Engine <Engine name="Catalina" jvmRoute="node01" > + and that the jvmRoute attribute value matches your worker name in workers.properties
Make sure that all nodes have the same time and sync with NTP service!
Make sure that your loadbalancer is configured for sticky session mode.

Load balancing can be achieved through many techniques, as seen in the +Load Balancing chapter.

Note: Remember that your session state is tracked by a cookie, so your URL must look the same from the out + side otherwise, a new session will be created.

The Cluster module uses the Tomcat JULI logging framework, so you can configure logging + through the regular logging.properties file. To track messages, you can enable logging on the key: org.apache.catalina.tribes.MESSAGES

Overview

+ +

To enable session replication in Tomcat, three different paths can be followed to achieve the exact same thing:

Using session persistence, and saving the session to a shared file system (PersistenceManager + FileStore)
Using session persistence, and saving the session to a shared database (PersistenceManager + JDBCStore)
Using in-memory-replication, using the SimpleTcpCluster that ships with Tomcat (lib/catalina-tribes.jar + lib/catalina-ha.jar)

+ +

In this release of session replication, Tomcat can perform an all-to-all replication of session state using the DeltaManager or + perform backup replication to only one node using the BackupManager. + The all-to-all replication is an algorithm that is only efficient when the clusters are small. For larger clusters, to use + a primary-secondary session replication where the session will only be stored at one backup server simply setup the BackupManager.
+ Currently you can use the domain worker attribute (mod_jk > 1.2.8) to build cluster partitions + with the potential of having a more scalable cluster solution with the DeltaManager(you'll need to configure the domain interceptor for this). + In order to keep the network traffic down in an all-to-all environment, you can split your cluster + into smaller groups. This can be easily achieved by using different multicast addresses for the different groups. + A very simple setup would look like this: +

+ +

        DNS Round Robin
+               |
+         Load Balancer
+          /           \
+      Cluster1      Cluster2
+      /     \        /     \
+  Tomcat1 Tomcat2  Tomcat3 Tomcat4

+ +

What is important to mention here, is that session replication is only the beginning of clustering. + Another popular concept used to implement clusters is farming, i.e., you deploy your apps only to one + server, and the cluster will distribute the deployments across the entire cluster. + This is all capabilities that can go into with the FarmWarDeployer (s. cluster example at server.xml)

In the next section will go deeper into how session replication works and how to configure it.

+ +

Cluster Information

Membership is established using multicast heartbeats. + Hence, if you wish to subdivide your clusters, you can do this by + changing the multicast IP address or port in the <Membership> element. +

+ The heartbeat contains the IP address of the Tomcat node and the TCP port that + Tomcat listens to for replication traffic. All data communication happens over TCP. +

+ The ReplicationValve is used to find out when the request has been completed and initiate the + replication, if any. Data is only replicated if the session has changed (by calling setAttribute or removeAttribute + on the session). +

+ One of the most important performance considerations is the synchronous versus asynchronous replication. + In a synchronous replication mode the request doesn't return until the replicated session has been + sent over the wire and reinstantiated on all the other cluster nodes. + Synchronous vs. asynchronous is configured using the channelSendOptions + flag and is an integer value. The default value for the SimpleTcpCluster/DeltaManager combo is + 8, which is asynchronous. +

+ For convenience, channelSendOptions can be set by name(s) rather than integer, + which are then translated to their integer value upon startup. The valid option names are: + "asynchronous" (alias "async"), "byte_message" (alias "byte"), "multicast", "secure", + "synchronized_ack" (alias "sync"), "udp", "use_ack". Use comma to separate multiple names, + e.g. pass "async, multicast" for the options + SEND_OPTIONS_ASYNCHRONOUS | SEND_OPTIONS_MULTICAST. +

+ You can read more on the send flag(overview) or the + send flag(javadoc). + During async replication, the request is returned before the data has been replicated. async + replication yields shorter request times, and synchronous replication guarantees the session + to be replicated before the request returns. +

Bind session after crash to failover node

+ If you are using mod_jk and not using sticky sessions or for some reasons sticky session don't + work, or you are simply failing over, the session id will need to be modified as it previously contained + the worker id of the previous tomcat (as defined by jvmRoute in the Engine element). + To solve this, we will use the JvmRouteBinderValve. +

+ The JvmRouteBinderValve rewrites the session id to ensure that the next request will remain sticky + (and not fall back to go to random nodes since the worker is no longer available) after a fail over. + The valve rewrites the JSESSIONID value in the cookie with the same name. + Not having this valve in place, will make it harder to ensure stickiness in case of a failure for the mod_jk module. +

+ Remember, if you are adding your own valves in server.xml then the defaults are no longer valid, + make sure that you add in all the appropriate valves as defined by the default. +

+ Hint:
+ With attribute sessionIdAttribute you can change the request attribute name that included the old session id. + Default attribute name is org.apache.catalina.ha.session.JvmRouteOrignalSessionID. +

+ Trick:
+ You can enable this mod_jk turnover mode via JMX before you drop a node to all backup nodes! + Set enable true on all JvmRouteBinderValve backups, disable worker at mod_jk + and then drop node and restart it! Then enable mod_jk Worker and disable JvmRouteBinderValves again. + This use case means that only requested session are migrated. +

+ + +

Configuration Example

        <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
+                 channelSendOptions="6">
+
+          <Manager className="org.apache.catalina.ha.session.BackupManager"
+                   expireSessionsOnShutdown="false"
+                   notifyListenersOnReplication="true"
+                   mapSendOptions="6"/>
+          <!--
+          <Manager className="org.apache.catalina.ha.session.DeltaManager"
+                   expireSessionsOnShutdown="false"
+                   notifyListenersOnReplication="true"/>
+          -->
+          <Channel className="org.apache.catalina.tribes.group.GroupChannel">
+            <Membership className="org.apache.catalina.tribes.membership.McastService"
+                        address="228.0.0.4"
+                        port="45564"
+                        frequency="500"
+                        dropTime="3000"/>
+            <Receiver className="org.apache.catalina.tribes.transport.nio.NioReceiver"
+                      address="auto"
+                      port="5000"
+                      selectorTimeout="100"
+                      maxThreads="6"/>
+
+            <Sender className="org.apache.catalina.tribes.transport.ReplicationTransmitter">
+              <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
+            </Sender>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.TcpFailureDetector"/>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.MessageDispatchInterceptor"/>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.ThroughputInterceptor"/>
+          </Channel>
+
+          <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
+                 filter=".*\.gif|.*\.js|.*\.jpeg|.*\.jpg|.*\.png|.*\.htm|.*\.html|.*\.css|.*\.txt"/>
+
+          <Deployer className="org.apache.catalina.ha.deploy.FarmWarDeployer"
+                    tempDir="/tmp/war-temp/"
+                    deployDir="/tmp/war-deploy/"
+                    watchDir="/tmp/war-listen/"
+                    watchEnabled="false"/>
+
+          <ClusterListener className="org.apache.catalina.ha.session.ClusterSessionListener"/>
+        </Cluster>

+ Break it down!! +

        <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
+                 channelSendOptions="6">

+ The main element, inside this element all cluster details can be configured. + The channelSendOptions is the flag that is attached to each message sent by the + SimpleTcpCluster class or any objects that are invoking the SimpleTcpCluster.send method. + The description of the send flags is available at + our javadoc site + The DeltaManager sends information using the SimpleTcpCluster.send method, while the backup manager + sends it itself directly through the channel. +
For more info, Please visit the reference documentation +

          <Manager className="org.apache.catalina.ha.session.BackupManager"
+                   expireSessionsOnShutdown="false"
+                   notifyListenersOnReplication="true"
+                   mapSendOptions="6"/>
+          <!--
+          <Manager className="org.apache.catalina.ha.session.DeltaManager"
+                   expireSessionsOnShutdown="false"
+                   notifyListenersOnReplication="true"/>
+          -->

+ This is a template for the manager configuration that will be used if no manager is defined in the <Context> + element. In Tomcat 5.x each webapp marked distributable had to use the same manager, this is no longer the case + since Tomcat you can define a manager class for each webapp, so that you can mix managers in your cluster. + Obviously the managers on one node's application has to correspond with the same manager on the same application on the other node. + If no manager has been specified for the webapp, and the webapp is marked <distributable/> Tomcat will take this manager configuration + and create a manager instance cloning this configuration. +
For more info, Please visit the reference documentation +

          <Channel className="org.apache.catalina.tribes.group.GroupChannel">

+ The channel element is Tribes, the group communication framework + used inside Tomcat. This element encapsulates everything that has to do with communication and membership logic. +
For more info, Please visit the reference documentation +

            <Membership className="org.apache.catalina.tribes.membership.McastService"
+                        address="228.0.0.4"
+                        port="45564"
+                        frequency="500"
+                        dropTime="3000"/>

+ Membership is done using multicasting. Please note that Tribes also supports static memberships using the + StaticMembershipInterceptor if you want to extend your membership to points beyond multicasting. + The address attribute is the multicast address used and the port is the multicast port. These two together + create the cluster separation. If you want a QA cluster and a production cluster, the easiest config is to + have the QA cluster be on a separate multicast address/port combination than the production cluster.
+ The membership component broadcasts TCP address/port of itself to the other nodes so that communication between + nodes can be done over TCP. Please note that the address being broadcasted is the one of the + Receiver.address attribute. +
For more info, Please visit the reference documentation +

            <Receiver className="org.apache.catalina.tribes.transport.nio.NioReceiver"
+                      address="auto"
+                      port="5000"
+                      selectorTimeout="100"
+                      maxThreads="6"/>

+ In tribes the logic of sending and receiving data has been broken into two functional components. The Receiver, as the name suggests + is responsible for receiving messages. Since the Tribes stack is thread less, (a popular improvement now adopted by other frameworks as well), + there is a thread pool in this component that has a maxThreads and minThreads setting.
+ The address attribute is the host address that will be broadcasted by the membership component to the other nodes. +
For more info, Please visit the reference documentation +

            <Sender className="org.apache.catalina.tribes.transport.ReplicationTransmitter">
+              <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
+            </Sender>

+ The sender component, as the name indicates is responsible for sending messages to other nodes. + The sender has a shell component, the ReplicationTransmitter but the real stuff done is done in the + sub component, Transport. + Tribes support having a pool of senders, so that messages can be sent in parallel and if using the NIO sender, + you can send messages concurrently as well.
+ Concurrently means one message to multiple senders at the same time and Parallel means multiple messages to multiple senders + at the same time. +
For more info, Please visit the reference documentation +

            <Interceptor className="org.apache.catalina.tribes.group.interceptors.TcpFailureDetector"/>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.MessageDispatchInterceptor"/>
+            <Interceptor className="org.apache.catalina.tribes.group.interceptors.ThroughputInterceptor"/>
+          </Channel>

+ Tribes uses a stack to send messages through. Each element in the stack is called an interceptor, and works much like the valves do + in the Tomcat servlet container. + Using interceptors, logic can be broken into more manageable pieces of code. The interceptors configured above are:
+ TcpFailureDetector - verifies crashed members through TCP, if multicast packets get dropped, this interceptor protects against false positives, + ie the node marked as crashed even though it still is alive and running.
+ MessageDispatchInterceptor - dispatches messages to a thread (thread pool) to send message asynchronously.
+ ThroughputInterceptor - prints out simple stats on message traffic.
+ Please note that the order of interceptors is important. The way they are defined in server.xml is the way they are represented in the + channel stack. Think of it as a linked list, with the head being the first most interceptor and the tail the last. +
For more info, Please visit the reference documentation +

          <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
+                 filter=".*\.gif|.*\.js|.*\.jpeg|.*\.jpg|.*\.png|.*\.htm|.*\.html|.*\.css|.*\.txt"/>

+ The cluster uses valves to track requests to web applications, we've mentioned the ReplicationValve and the JvmRouteBinderValve above. + The <Cluster> element itself is not part of the pipeline in Tomcat, instead the cluster adds the valve to its parent container. + If the <Cluster> elements is configured in the <Engine> element, the valves get added to the engine and so on. +
For more info, Please visit the reference documentation +

          <Deployer className="org.apache.catalina.ha.deploy.FarmWarDeployer"
+                    tempDir="/tmp/war-temp/"
+                    deployDir="/tmp/war-deploy/"
+                    watchDir="/tmp/war-listen/"
+                    watchEnabled="false"/>

+ The default tomcat cluster supports farmed deployment, ie, the cluster can deploy and undeploy applications on the other nodes. + The state of this component is currently in flux but will be addressed soon. There was a change in the deployment algorithm + between Tomcat 5.0 and 5.5 and at that point, the logic of this component changed to where the deploy dir has to match the + webapps directory. +
For more info, Please visit the reference documentation +

          <ClusterListener className="org.apache.catalina.ha.session.ClusterSessionListener"/>
+        </Cluster>

+ Since the SimpleTcpCluster itself is a sender and receiver of the Channel object, components can register themselves as listeners to + the SimpleTcpCluster. The listener above ClusterSessionListener listens for DeltaManager replication messages + and applies the deltas to the manager that in turn applies it to the session. +
For more info, Please visit the reference documentation +

+ +

Cluster Architecture

+ +

Component Levels:

         Server
+           |
+         Service
+           |
+         Engine
+           |  \
+           |  --- Cluster --*
+           |
+         Host
+           |
+         ------
+        /      \
+     Cluster    Context(1-N)
+        |             \
+        |             -- Manager
+        |                   \
+        |                   -- DeltaManager
+        |                   -- BackupManager
+        |
+     ---------------------------
+        |                       \
+      Channel                    \
+    ----------------------------- \
+        |                          \
+     Interceptor_1 ..               \
+        |                            \
+     Interceptor_N                    \
+    -----------------------------      \
+     |          |         |             \
+   Receiver    Sender   Membership       \
+                                         -- Valve
+                                         |      \
+                                         |       -- ReplicationValve
+                                         |       -- JvmRouteBinderValve
+                                         |
+                                         -- LifecycleListener
+                                         |
+                                         -- ClusterListener
+                                         |      \
+                                         |       -- ClusterSessionListener
+                                         |
+                                         -- Deployer
+                                                \
+                                                 -- FarmWarDeployer
+
+

+ + +

How it Works

To make it easy to understand how clustering works, We are gonna take you through a series of scenarios. + In the scenario we only plan to use two tomcat instances TomcatA and TomcatB. + We will cover the following sequence of events:

+ +

TomcatA starts up
TomcatB starts up (Wait that TomcatA start is complete)
TomcatA receives a request, a session S1 is created.
TomcatA crashes
TomcatB receives a request for session S1
TomcatA starts up
TomcatA receives a request, invalidate is called on the session (S1)
TomcatB receives a request, for a new session (S2)
TomcatA The session S2 expires due to inactivity.

+ +

Ok, now that we have a good sequence, we will take you through exactly what happens in the session replication code

+ +

TomcatA starts up +
+ Tomcat starts up using the standard start up sequence. When the Host object is created, a cluster object is associated with it. + When the contexts are parsed, if the distributable element is in place in web.xml + Tomcat asks the Cluster class (in this case SimpleTcpCluster) to create a manager + for the replicated context. So with clustering enabled, distributable set in web.xml + Tomcat will create a DeltaManager for that context instead of a StandardManager. + The cluster class will start up a membership service (multicast) and a replication service (tcp unicast). + More on the architecture further down in this document. +
+
TomcatB starts up +
+ When TomcatB starts up, it follows the same sequence as TomcatA did with one exception. + The cluster is started and will establish a membership (TomcatA,TomcatB). + TomcatB will now request the session state from a server that already exists in the cluster, + in this case TomcatA. TomcatA responds to the request, and before TomcatB starts listening + for HTTP requests, the state has been transferred from TomcatA to TomcatB. + In case TomcatA doesn't respond, TomcatB will time out after 60 seconds, and issue a log + entry. The session state gets transferred for each web application that has distributable in + its web.xml. Note: To use session replication efficiently, all your tomcat instances should be + configured the same. +
+
TomcatA receives a request, a session S1 is created. +
+ The request coming in to TomcatA is treated exactly the same way as without session replication. + The action happens when the request is completed, the ReplicationValve will intercept + the request before the response is returned to the user. + At this point it finds that the session has been modified, and it uses TCP to replicate the + session to TomcatB. Once the serialized data has been handed off to the operating systems TCP logic, + the request returns to the user, back through the valve pipeline. + For each request the entire session is replicated, this allows code that modifies attributes + in the session without calling setAttribute or removeAttribute to be replicated. + a useDirtyFlag configuration parameter can be used to optimize the number of times + a session is replicated. +
+ +
TomcatA crashes +
+ When TomcatA crashes, TomcatB receives a notification that TomcatA has dropped out + of the cluster. TomcatB removes TomcatA from its membership list, and TomcatA will no longer + be notified of any changes that occurs in TomcatB. + The load balancer will redirect the requests from TomcatA to TomcatB and all the sessions + are current. +
+
TomcatB receives a request for session S1 +
Nothing exciting, TomcatB will process the request as any other request. +
+
TomcatA starts up +
Upon start up, before TomcatA starts taking new request and making itself + available to it will follow the start up sequence described above 1) 2). + It will join the cluster, contact TomcatB for the current state of all the sessions. + And once it receives the session state, it finishes loading and opens its HTTP/mod_jk ports. + So no requests will make it to TomcatA until it has received the session state from TomcatB. +
+
TomcatA receives a request, invalidate is called on the session (S1) +
The invalidate call is intercepted, and the session is queued with invalidated sessions. + When the request is complete, instead of sending out the session that has changed, it sends out + an "expire" message to TomcatB and TomcatB will invalidate the session as well. +
+ +
TomcatB receives a request, for a new session (S2) +
Same scenario as in step 3) +
+ + +
TomcatA The session S2 expires due to inactivity. +
The invalidate call is intercepted the same was as when a session is invalidated by the user, + and the session is queued with invalidated sessions. + At this point, the invalidated session will not be replicated across until + another request comes through the system and checks the invalid queue. +
+

+ +

Phuuuhh! :)

+ +

Membership + Clustering membership is established using very simple multicast pings. + Each Tomcat instance will periodically send out a multicast ping, + in the ping message the instance will broad cast its IP and TCP listen port + for replication. + If an instance has not received such a ping within a given timeframe, the + member is considered dead. Very simple, and very effective! + Of course, you need to enable multicasting on your system. +

+ +

TCP Replication + Once a multicast ping has been received, the member is added to the cluster + Upon the next replication request, the sending instance will use the host and + port info and establish a TCP socket. Using this socket it sends over the serialized data. + The reason I choose TCP sockets is because it has built in flow control and guaranteed delivery. + So I know, when I send some data, it will make it there :) +

+ +

Distributed locking and pages using frames + Tomcat does not keep session instances in sync across the cluster. + The implementation of such logic would be to much overhead and cause all + kinds of problems. If your client accesses the same session + simultaneously using multiple requests, then the last request + will override the other sessions in the cluster. +

+ +

Monitoring your Cluster with JMX

Monitoring is a very important question when you use a cluster. Some of the cluster objects are JMX MBeans

Add the following parameter to your startup script with Java 5:

set CATALINA_OPTS=\
+-Dcom.sun.management.jmxremote \
+-Dcom.sun.management.jmxremote.port=%my.jmx.port% \
+-Dcom.sun.management.jmxremote.ssl=false \
+-Dcom.sun.management.jmxremote.authenticate=false

+ +

+ List of Cluster Mbeans +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Name	Description	MBean ObjectName - Engine	MBean ObjectName - Host
Cluster	The complete cluster element	`type=Cluster`	`type=Cluster,host=${HOST}`
DeltaManager	This manager control the sessions and handle session replication	`type=Manager,context=${APP.CONTEXT.PATH}, host=${HOST}`	`type=Manager,context=${APP.CONTEXT.PATH}, host=${HOST}`
FarmWarDeployer	Manages the process of deploying an application to all nodes in the cluster	Not supported	`type=Cluster, host=${HOST}, component=deployer`
Member	Represents a node in the cluster	type=Cluster, component=member, name=${NODE_NAME}	`type=Cluster, host=${HOST}, component=member, name=${NODE_NAME}`
ReplicationValve	This valve control the replication to the backup nodes	`type=Valve,name=ReplicationValve`	`type=Valve,name=ReplicationValve,host=${HOST}`
JvmRouteBinderValve	This is a cluster fallback valve to change the Session ID to the current tomcat jvmroute.	`type=Valve,name=JvmRouteBinderValve, + context=${APP.CONTEXT.PATH}`	`type=Valve,name=JvmRouteBinderValve,host=${HOST}, + context=${APP.CONTEXT.PATH}`

FAQ

Please see the clustering section of the FAQ.

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509330470/3/comments.html b/ZipProject/wwwroot/zip/15509330470/3/comments.html new file mode 100644 index 0000000..c0c5627 --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/3/comments.html @@ -0,0 +1,122 @@ + +Apache Tomcat 9 (9.0.11) - Documentation User Comments

Documentation User Comments

Introduction

+ +

The Tomcat documentation integrates the +Apache Comments System. +It allows users to add comments to most documentation pages. The comments +section can be found at the end of each page.

+ +

Allowed Content

+ +

Please use the Apache Comments System responsibly. We can only provide +this service to the community as long as it isn't misused.

+ +

The comments are not for general Q&A. +Comments should be pointed towards suggestions on improving the documentation +or server. Questions on how to use Apache Tomcat should be directed +to our mailing lists.

+ +

Comments may be removed by moderators if they are either +implemented or considered invalid/off-topic.

+ +

HTML is not allowed in comments, and will just display as raw source code +if attempted. Links that do not point to an Apache site (*.apache.org) will +need approval by a moderator before the comment is visible to regular visitors.

+ +

License

+ +

Any submitted comments must be contributed under the terms of the +Apache License, Version 2.0.

+ +

Verified Users

+ +

Verified users gain the Apache feather next to their name, +and may post comments with links in them without requiring approval +by a moderator before the comments are shown. Being a verified user +in itself does not give you moderating rights. If you are interested +in becoming a verified user, please contact us on the +users mailing list.

+ +

All ASF committers are automatically verified users.

+ +

Moderators

+ +

Moderators are allowed to mark comments as "Resolved", "Invalid" +or "Sticky", remove marks, approve comments e.g. if they contain +a link, and delete comments. Moderators can also subscribe to new +comments and comment updates and use the dashboard to gain some +overview over all comments of a site.

+ +

To use the moderation features, you need to login to the comments +system. Furthermore you will need to allow cookies to be set for +comments.apache.org (this is done using a secure https cookie). Once +logged in as a moderator you will see additional moderation +options attached to each comment.

+ +

If you are a long time follower of the Apache Tomcat projects +and you are interested in becoming a moderator, please contact us on the +users mailing list.

+ +

Privacy Policy

+ +

No data except what you personally submit is kept on record. +A cookie is used to keep track of moderators and other people +who wish to create an account to avoid having to enter their +credentials whenever they wish to post a comment.

+ +

To prevent spam and unsolicited comments, we use a digest of +visitors' IPs to keep track of comments posted by them.

+ +

Entering an email address when you post a comment is completely +optional, and will not be shared with anyone. If you enter an +email address, it will be used to notify you when someone posts +a reply to one of your comments, provided you have registered +an account and validated your email address.

+ +

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509330470/connectors.html b/ZipProject/wwwroot/zip/15509330470/connectors.html new file mode 100644 index 0000000..29f090b --- /dev/null +++ b/ZipProject/wwwroot/zip/15509330470/connectors.html @@ -0,0 +1,86 @@ + +Apache Tomcat 9 (9.0.11) - Connectors How To

Connectors How To

Introduction
HTTP
AJP

Introduction

+ +

Choosing a connector to use with Tomcat can be difficult. This page will +list the connectors which are supported with this Tomcat release, and will +hopefully help you make the right choice according to your needs.

+ +

HTTP

+ +

The HTTP connector is setup by default with Tomcat, and is ready to use. This +connector features the lowest latency and best overall performance.

+ +

For clustering, a HTTP load balancer with support for web sessions stickiness +must be installed to direct the traffic to the Tomcat servers. Tomcat supports mod_proxy +(on Apache HTTP Server 2.x, and included by default in Apache HTTP Server 2.2) as the load balancer. +It should be noted that the performance of HTTP proxying is usually lower than the +performance of AJP, so AJP clustering is often preferable.

+ +

AJP

+ +

When using a single server, the performance when using a native webserver in +front of the Tomcat instance is most of the time significantly worse than a +standalone Tomcat with its default HTTP connector, even if a large part of the web +application is made of static files. If integration with the native webserver is +needed for any reason, an AJP connector will provide faster performance than +proxied HTTP. AJP clustering is the most efficient from the Tomcat perspective. +It is otherwise functionally equivalent to HTTP clustering.

+ +

The native connectors supported with this Tomcat release are:

JK 1.2.x with any of the supported servers
mod_proxy on Apache HTTP Server 2.x (included by default in Apache HTTP Server 2.2), +with AJP enabled

+ +

Other native connectors supporting AJP may work, but are no longer supported.

+ +

+ Comments +

\ No newline at end of file diff --git "a/ZipProject/wwwroot/zip/15509338630/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" "b/ZipProject/wwwroot/zip/15509338630/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" new file mode 100644 index 0000000..2235920 --- /dev/null +++ "b/ZipProject/wwwroot/zip/15509338630/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" @@ -0,0 +1,278 @@ + +Apache Tomcat 9 (9.0.11) - Building Tomcat

Building Tomcat

Introduction
Download a Java Development Kit (JDK) version 8
Install Apache Ant 1.9.8 or later
Checkout or obtain the Tomcat source code
Configure download area
Building Tomcat
Building with Eclipse
Building with other IDEs

Introduction

+ +

Download a Java Development Kit (JDK) version 8

+ +

+IMPORTANT: Set an environment variable JAVA_HOME to the pathname of the +directory into which you installed the JDK release. +

+ +

Install Apache Ant 1.9.8 or later

+ +

+Download a binary distribution of Ant 1.9.8 or later from +here. +

+ +

Checkout or obtain the Tomcat source code

+ +

+ Tomcat SVN repository URL: + https://svn.apache.org/repos/asf/tomcat/trunk/ +

+ Tomcat source packages: + https://tomcat.apache.org/download-90.cgi. +

+ +

Configure download area

+ +

+ Building Tomcat involves downloading a number of libraries that it depends on. + It is strongly recommended to configure download area for those libraries. +

+ +

+ By default the build is configured to download the dependencies into the + ${user.home}/tomcat-build-libs directory. You can change this + (see below) but it must be an absolute path. +

+ +

+ The download area is defined by property base.path. For example: +

+ +

# ----- Default Base Path for Dependent Packages -----
+# Replace this path with the directory path where
+# dependencies binaries should be downloaded.
+base.path=/home/me/some-place-to-download-to

+ +

+ Different versions of Tomcat are allowed to share the same download area. +

+ +

+ Another example: +

+ +

base.path=${user.dir}/../libraries-tomcat9.0

+ +

+ Users who access the Internet through a proxy must use the properties + file to indicate to Ant the proxy configuration: +

+ +

# ----- Proxy setup -----
+proxy.host=proxy.domain
+proxy.port=8080
+proxy.use=on

+ +

Building Tomcat

+ +

+Use the following commands to build Tomcat: +

+ +

+cd ${tomcat.source}
+ant +

+ +

Building with Eclipse

+ +

+WARNING: Do not forget to create and configure + ${tomcat.source}/build.properties file as described above + before running any Ant targets. +

+ +

+An Ant target is provided as a convenience to download all binary dependencies, and to create +the Eclipse project and classpath files in the root of the source tree. +

+ +

+cd ${tomcat.source}
+ant ide-eclipse +

+ +

+Start Eclipse and create a new Workspace. +

+ +

+Open the Preferences dialog and then select Java->Build Path->Classpath +Variables to add two new Classpath Variables: +

+ + + + + +

TOMCAT_LIBS_BASE	The same location as the `base.path` + setting in `build.properties`, where the binary dependencies have been downloaded
ANT_HOME	the base path of Ant 1.9.8 or later

+ + +

+Use File->Import and choose Existing Projects into Workspace. +From there choose the root directory of the Tomcat source tree (${tomcat.source}) +and import the Tomcat project located there. +

+ +

+Tweaking a few formatting preferences will make it much easier to keep consistent with Tomcat +coding conventions (and have your contributions accepted): +

+ + + + + + + + +

Java -> Code Style -> Formatter -> Edit...	Tab policy: Spaces only Tab and Indentation size: 4
General -> Editors -> Text Editors	Displayed tab width: 2 Insert spaces for tabs Show whitespace characters (optional)
XML -> XML Files -> Editor	Indent using spaces Indentation size: 2
Ant -> Editor -> Formatter	Tab size: 2 Use tab character instead of spaces: unchecked

+ +

+The recommended configuration of Compiler Warnings is documented in +res/ide-support/eclipse/java-compiler-errors-warnings.txt file. +

+ +

Building with other IDEs

+The same general approach should work for most IDEs; it has been reported +to work in IntelliJ IDEA, for example. +

+ +

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509338630/balancer-howto.html b/ZipProject/wwwroot/zip/15509338630/balancer-howto.html new file mode 100644 index 0000000..ebef81c --- /dev/null +++ b/ZipProject/wwwroot/zip/15509338630/balancer-howto.html @@ -0,0 +1,61 @@ + +Apache Tomcat 9 (9.0.11) - Load Balancer HOW-TO

Load Balancer HOW-TO

Using the JK 1.2.x native connector
Using Apache HTTP Server 2.x with mod_proxy

Using the JK 1.2.x native connector

+ +Please refer to the JK 1.2.x documentation. + +

Using Apache HTTP Server 2.x with mod_proxy

+ Comments +

\ No newline at end of file diff --git "a/ZipProject/wwwroot/zip/15509339270/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" "b/ZipProject/wwwroot/zip/15509339270/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" new file mode 100644 index 0000000..2235920 --- /dev/null +++ "b/ZipProject/wwwroot/zip/15509339270/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" @@ -0,0 +1,278 @@ + +Apache Tomcat 9 (9.0.11) - Building Tomcat

Building Tomcat

Introduction
Download a Java Development Kit (JDK) version 8
Install Apache Ant 1.9.8 or later
Checkout or obtain the Tomcat source code
Configure download area
Building Tomcat
Building with Eclipse
Building with other IDEs

Introduction

+ +

Download a Java Development Kit (JDK) version 8

+ +

+IMPORTANT: Set an environment variable JAVA_HOME to the pathname of the +directory into which you installed the JDK release. +

+ +

Install Apache Ant 1.9.8 or later

+ +

+Download a binary distribution of Ant 1.9.8 or later from +here. +

+ +

Checkout or obtain the Tomcat source code

+ +

+ Tomcat SVN repository URL: + https://svn.apache.org/repos/asf/tomcat/trunk/ +

+ Tomcat source packages: + https://tomcat.apache.org/download-90.cgi. +

+ +

Configure download area

+ +

+ Building Tomcat involves downloading a number of libraries that it depends on. + It is strongly recommended to configure download area for those libraries. +

+ +

+ By default the build is configured to download the dependencies into the + ${user.home}/tomcat-build-libs directory. You can change this + (see below) but it must be an absolute path. +

+ +

+ The download area is defined by property base.path. For example: +

+ +

# ----- Default Base Path for Dependent Packages -----
+# Replace this path with the directory path where
+# dependencies binaries should be downloaded.
+base.path=/home/me/some-place-to-download-to

+ +

+ Different versions of Tomcat are allowed to share the same download area. +

+ +

+ Another example: +

+ +

base.path=${user.dir}/../libraries-tomcat9.0

+ +

+ Users who access the Internet through a proxy must use the properties + file to indicate to Ant the proxy configuration: +

+ +

# ----- Proxy setup -----
+proxy.host=proxy.domain
+proxy.port=8080
+proxy.use=on

+ +

Building Tomcat

+ +

+Use the following commands to build Tomcat: +

+ +

+cd ${tomcat.source}
+ant +

+ +

Building with Eclipse

+ +

+WARNING: Do not forget to create and configure + ${tomcat.source}/build.properties file as described above + before running any Ant targets. +

+ +

+An Ant target is provided as a convenience to download all binary dependencies, and to create +the Eclipse project and classpath files in the root of the source tree. +

+ +

+cd ${tomcat.source}
+ant ide-eclipse +

+ +

+Start Eclipse and create a new Workspace. +

+ +

+Open the Preferences dialog and then select Java->Build Path->Classpath +Variables to add two new Classpath Variables: +

+ + + + + +

TOMCAT_LIBS_BASE	The same location as the `base.path` + setting in `build.properties`, where the binary dependencies have been downloaded
ANT_HOME	the base path of Ant 1.9.8 or later

+ + +

+Use File->Import and choose Existing Projects into Workspace. +From there choose the root directory of the Tomcat source tree (${tomcat.source}) +and import the Tomcat project located there. +

+ +

+Tweaking a few formatting preferences will make it much easier to keep consistent with Tomcat +coding conventions (and have your contributions accepted): +

+ + + + + + + + +

Java -> Code Style -> Formatter -> Edit...	Tab policy: Spaces only Tab and Indentation size: 4
General -> Editors -> Text Editors	Displayed tab width: 2 Insert spaces for tabs Show whitespace characters (optional)
XML -> XML Files -> Editor	Indent using spaces Indentation size: 2
Ant -> Editor -> Formatter	Tab size: 2 Use tab character instead of spaces: unchecked

+ +

+The recommended configuration of Compiler Warnings is documented in +res/ide-support/eclipse/java-compiler-errors-warnings.txt file. +

+ +

Building with other IDEs

+The same general approach should work for most IDEs; it has been reported +to work in IntelliJ IDEA, for example. +

+ +

+ Comments +

\ No newline at end of file diff --git a/ZipProject/wwwroot/zip/15509339270/balancer-howto.html b/ZipProject/wwwroot/zip/15509339270/balancer-howto.html new file mode 100644 index 0000000..ebef81c --- /dev/null +++ b/ZipProject/wwwroot/zip/15509339270/balancer-howto.html @@ -0,0 +1,61 @@ + +Apache Tomcat 9 (9.0.11) - Load Balancer HOW-TO

Load Balancer HOW-TO

Using the JK 1.2.x native connector
Using Apache HTTP Server 2.x with mod_proxy

Using the JK 1.2.x native connector

+ +Please refer to the JK 1.2.x documentation. + +

Using Apache HTTP Server 2.x with mod_proxy

+ Comments +

\ No newline at end of file diff --git "a/ZipProject/wwwroot/zip/15509339460/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" "b/ZipProject/wwwroot/zip/15509339460/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" new file mode 100644 index 0000000..2235920 --- /dev/null +++ "b/ZipProject/wwwroot/zip/15509339460/1\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/building.html" @@ -0,0 +1,278 @@ + +Apache Tomcat 9 (9.0.11) - Building Tomcat

Building Tomcat

Introduction
Download a Java Development Kit (JDK) version 8
Install Apache Ant 1.9.8 or later
Checkout or obtain the Tomcat source code
Configure download area
Building Tomcat
Building with Eclipse
Building with other IDEs

Introduction

+ +

Download a Java Development Kit (JDK) version 8

+ +

+IMPORTANT: Set an environment variable JAVA_HOME to the pathname of the +directory into which you installed the JDK release. +

+ +

Install Apache Ant 1.9.8 or later

+ +

+Download a binary distribution of Ant 1.9.8 or later from +here. +

+ +

Checkout or obtain the Tomcat source code

+ +

+ Tomcat SVN repository URL: + https://svn.apache.org/repos/asf/tomcat/trunk/ +

+ Tomcat source packages: + https://tomcat.apache.org/download-90.cgi. +

+ +

Configure download area

+ +

+ Building Tomcat involves downloading a number of libraries that it depends on. + It is strongly recommended to configure download area for those libraries. +

+ +

+ By default the build is configured to download the dependencies into the + ${user.home}/tomcat-build-libs directory. You can change this + (see below) but it must be an absolute path. +

+ +

+ The download area is defined by property base.path. For example: +

+ +

# ----- Default Base Path for Dependent Packages -----
+# Replace this path with the directory path where
+# dependencies binaries should be downloaded.
+base.path=/home/me/some-place-to-download-to

+ +

+ Different versions of Tomcat are allowed to share the same download area. +

+ +

+ Another example: +

+ +

base.path=${user.dir}/../libraries-tomcat9.0

+ +

+ Users who access the Internet through a proxy must use the properties + file to indicate to Ant the proxy configuration: +

+ +

# ----- Proxy setup -----
+proxy.host=proxy.domain
+proxy.port=8080
+proxy.use=on

+ +

Building Tomcat

+ +

+Use the following commands to build Tomcat: +

+ +

+cd ${tomcat.source}
+ant +

+ +

Building with Eclipse

+ +

+WARNING: Do not forget to create and configure + ${tomcat.source}/build.properties file as described above + before running any Ant targets. +

+ +

+An Ant target is provided as a convenience to download all binary dependencies, and to create +the Eclipse project and classpath files in the root of the source tree. +

+ +

+cd ${tomcat.source}
+ant ide-eclipse +

+ +

+Start Eclipse and create a new Workspace. +

+ +

+Open the Preferences dialog and then select Java->Build Path->Classpath +Variables to add two new Classpath Variables: +

+ + + + + +

TOMCAT_LIBS_BASE	The same location as the `base.path` + setting in `build.properties`, where the binary dependencies have been downloaded
ANT_HOME	the base path of Ant 1.9.8 or later

+ + +

+Use File->Import and choose Existing Projects into Workspace. +From there choose the root directory of the Tomcat source tree (${tomcat.source}) +and import the Tomcat project located there. +

+ +

+Tweaking a few formatting preferences will make it much easier to keep consistent with Tomcat +coding conventions (and have your contributions accepted): +

+ + + + + + + + +

Java -> Code Style -> Formatter -> Edit...	Tab policy: Spaces only Tab and Indentation size: 4
General -> Editors -> Text Editors	Displayed tab width: 2 Insert spaces for tabs Show whitespace characters (optional)
XML -> XML Files -> Editor	Indent using spaces Indentation size: 2
Ant -> Editor -> Formatter	Tab size: 2 Use tab character instead of spaces: unchecked

+ +

+The recommended configuration of Compiler Warnings is documented in +res/ide-support/eclipse/java-compiler-errors-warnings.txt file. +

+ +

Building with other IDEs

+The same general approach should work for most IDEs; it has been reported +to work in IntelliJ IDEA, for example. +

+ +

+ Comments +

\ No newline at end of file diff --git "a/ZipProject/wwwroot/zip/15509339460/2\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/balancer-howto.html" "b/ZipProject/wwwroot/zip/15509339460/2\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/balancer-howto.html" new file mode 100644 index 0000000..ebef81c --- /dev/null +++ "b/ZipProject/wwwroot/zip/15509339460/2\353\262\210\353\224\224\353\240\211\355\206\240\353\246\254/balancer-howto.html" @@ -0,0 +1,61 @@ + +Apache Tomcat 9 (9.0.11) - Load Balancer HOW-TO

Load Balancer HOW-TO

Using the JK 1.2.x native connector
Using Apache HTTP Server 2.x with mod_proxy

Using the JK 1.2.x native connector

+ +Please refer to the JK 1.2.x documentation. + +

Using Apache HTTP Server 2.x with mod_proxy

+ Comments +

\ No newline at end of file

Building Tomcat

Table of Contents

Introduction

Download a Java Development Kit (JDK) version 8

Install Apache Ant 1.9.8 or later

Checkout or obtain the Tomcat source code

Configure download area

Building Tomcat

Building with Eclipse

Building with other IDEs

+ Comments +

Load Balancer HOW-TO

Table of Contents

Using the JK 1.2.x native connector

Using Apache HTTP Server 2.x with mod_proxy

+ Comments +

Load Balancer HOW-TO

Table of Contents

Using the JK 1.2.x native connector

Using Apache HTTP Server 2.x with mod_proxy

+ Comments +

Building Tomcat

Table of Contents

Introduction

Download a Java Development Kit (JDK) version 8

Install Apache Ant 1.9.8 or later

Checkout or obtain the Tomcat source code

Configure download area

Building Tomcat

Building with Eclipse

Building with other IDEs

+ Comments +

CGI How To

Table of Contents

Introduction

Installation

Configuration

+ Comments +

Changelog

Tomcat 9.0.11 (markt)

Catalina

Coyote

Jasper

WebSocket

Web applications

Tribes

Other

2018-06-25 Tomcat 9.0.10 (markt)

Catalina

not released Tomcat 9.0.9 (markt)

Catalina

Coyote

Jasper

Cluster

WebSocket

Web applications

Tribes

jdbc-pool

Other

2018-05-03 Tomcat 9.0.8 (markt)

Catalina

Coyote

Jasper

WebSocket

Other

2018-04-07 Tomcat 9.0.7 (markt)

Catalina

Coyote

Web applications

Tribes

jdbc-pool

Other

2018-03-08 Tomcat 9.0.6 (markt)

Catalina

Coyote

Web applications

2018-02-11 Tomcat 9.0.5 (markt)

Catalina

Coyote

Jasper