Is empty Content Type of Request allowed in Tomcat?

2011-08-29 Thread Isaac Li
Hello,

I'm using Cyberduck as client to send request to my web server which using
apache-tomcat-7.0.16 as web container.

When Cyberduck sent a request with an empty Content Type, web server
returned following errors:

HTTP/1.1 400 Bad Request (text/plain)

Bad Content-Type header value: ''


I thought this error is reported by tomcat, since it has not running into my
code.


I've enabled Tomcat debug log, and have no clue, following are some catalina
log:

2011-08-29 15:29:50,031
[ContainerBackgroundProcessor[StandardEngine[Catalina]]] DEBUG
org.apache.catalina.startup.HostConfig- Checking context[/host-manager]
reload resource D:\apache-tomcat-7.0.16\webapps\host-manager\WEB-INF\web.xml

2011-08-29 15:29:50,531 [http-apr-80-exec-5] DEBUG
org.apache.catalina.connector.CoyoteAdapter- The variable [uriBC] has value
[/]

2011-08-29 15:29:50,531 [http-apr-80-exec-5] DEBUG
org.apache.catalina.connector.CoyoteAdapter- The variable [semicolon] has
value [-1]

2011-08-29 15:29:50,531 [http-apr-80-exec-5] DEBUG
org.apache.catalina.connector.CoyoteAdapter- The variable [enc] has value
[ISO-8859-1]

2011-08-29 15:29:50,531 [http-apr-80-exec-5] DEBUG
org.apache.catalina.authenticator.AuthenticatorBase- Security checking
request GET /

2011-08-29 15:29:50,531 [http-apr-80-exec-5] DEBUG
org.apache.catalina.realm.RealmBase-   No applicable constraints defined

2011-08-29 15:29:50,531 [http-apr-80-exec-5] DEBUG
org.apache.catalina.authenticator.AuthenticatorBase-  Not subject to any
constraint

2011-08-29 15:30:00,031
[ContainerBackgroundProcessor[StandardEngine[Catalina]]] DEBUG
org.apache.catalina.startup.HostConfig- Checking context[] redeploy resource
D:\apache-tomcat-7.0.16\webapps\ROOT


So is it possible to modify tomcat setting to allow empty Content Type of
request? or I should try other ways (I heard someone said adding some
filters?)   - and What's the detailed steps?

Thanks


Re: Cannot build mod_jk.1.2.32

2011-08-29 Thread Casper Wandahl Schmidt

So I fanilly had time to check up on this topic :)

Lets start with the apache2ctl -V command:
Server version: Apache/2.2.8 (Ubuntu)
Server built:   Nov 18 2010 21:19:17
Server's Module Magic Number: 20051115:11
Server loaded:  APR 1.2.11, APR-Util 1.2.12
Compiled using: APR 1.2.11, APR-Util 1.2.12
Architecture:   32-bit
Server MPM: Prefork
  threaded: no
forked: yes (variable process count)
Server compiled with
 -D APACHE_MPM_DIR=server/mpm/prefork
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=128
 -D HTTPD_ROOT=
 -D SUEXEC_BIN=/usr/lib/apache2/suexec
 -D DEFAULT_PIDLOG=/var/run/apache2.pid
 -D DEFAULT_SCOREBOARD=logs/apache_runtime_status
 -D DEFAULT_LOCKFILE=/var/run/apache2/accept.lock
 -D DEFAULT_ERRORLOG=logs/error_log
 -D AP_TYPES_CONFIG_FILE=/etc/apache2/mime.types
 -D SERVER_CONFIG_FILE=/etc/apache2/apache2.conf

I suppose the Server MPM: Prefork (you have Worker) might be the reason 
why I couldn't get the mod_jk working earlier because apache is not set 
up for using a worker as I was trying to?


Next the other apache info:
ii  apache22.2.8-1ubuntu0.19
ii  apache2-mpm-prefork2.2.8-1ubuntu0.19
ii  apache2-src2.2.8-1ubuntu0.19
ii  apache2-threaded-dev   2.2.8-1ubuntu0.19
ii  apache2-utils  2.2.8-1ubuntu0.19
ii  apache2.2-common   2.2.8-1ubuntu0.19
ii  libapache2-mod-php55.2.4-2ubuntu5.17

Finally the beginning of the error-log I made when running make:
Making all in common
make[1]: Entering directory 
`/var/www/tomcat-connectors-1.2.32-src/native/common'

make[1]: Nothing to be done for `all'.
make[1]: Leaving directory 
`/var/www/tomcat-connectors-1.2.32-src/native/common'

Making all in apache-2.0
make[1]: Entering directory 
`/var/www/tomcat-connectors-1.2.32-src/native/apache-2.0'
/bin/sh ../libtool --mode=compile gcc -I/usr/src/apache2/include 
-I/usr/src/apache2/srclib/apr/include -I/usr/src/apache2/os/unix 
-I/usr/src/apache2/srclib/apr-util/include  -DHAVE_CONFIG_H 
-DUSE_APACHE_MD5 -I ../common -I /include -I /include/  
-DHAVE_CONFIG_H   -c mod_jk.c -o mod_jk.lo
 gcc -I/usr/src/apache2/include -I/usr/src/apache2/srclib/apr/include 
-I/usr/src/apache2/os/unix -I/usr/src/apache2/srclib/apr-util/include 
-DHAVE_CONFIG_H -DUSE_APACHE_MD5 -I ../common -I /include -I /include/ 
-DHAVE_CONFIG_H -c mod_jk.c  -fPIC -DPIC -o .libs/mod_jk.o

In file included from mod_jk.c:29:
/usr/src/apache2/include/ap_config.h:25:17: error: apr.h: No such file 
or directory

In file included from /usr/src/apache2/include/ap_config.h:26,
 from mod_jk.c:29:
/usr/src/apache2/srclib/apr-util/include/apr_hooks.h:20:17: error: 
apu.h: No such file or directory
In file included from 
/usr/src/apache2/srclib/apr-util/include/apr_hooks.h:22,

 from /usr/src/apache2/include/ap_config.h:26,
 from mod_jk.c:29:
/usr/src/apache2/srclib/apr/include/apr_tables.h:25:17: error: apr.h: No 
such file or directory

In file included from /usr/src/apache2/srclib/apr/include/apr_pools.h:38,
 from /usr/src/apache2/srclib/apr/include/apr_tables.h:26,
 from 
/usr/src/apache2/srclib/apr-util/include/apr_hooks.h:22,

 from /usr/src/apache2/include/ap_config.h:26,
 from mod_jk.c:29:
/usr/src/apache2/srclib/apr/include/apr_errno.h: In function 'APR_DECLARE':
/usr/src/apache2/srclib/apr/include/apr_errno.h:52: error: expected 
declaration specifiers before 'apr_strerror'

In file included from /usr/src/apache2/srclib/apr/include/apr_pools.h:39,
 from /usr/src/apache2/srclib/apr/include/apr_tables.h:26,
 from 
/usr/src/apache2/srclib/apr-util/include/apr_hooks.h:22,

 from /usr/src/apache2/include/ap_config.h:26,
 from mod_jk.c:29:
/usr/src/apache2/srclib/apr/include/apr_general.h:68: error: storage 
class specified for parameter 'apr_signum_t'
/usr/src/apache2/srclib/apr/include/apr_general.h:126: error: expected 
declaration specifiers or '...' before 'size_t'
/usr/src/apache2/srclib/apr/include/apr_general.h:160: error: expected 
declaration specifiers or '...' before 'size_t'
/usr/src/apache2/srclib/apr/include/apr_general.h:176: error: expected 
declaration specifiers before 'APR_DECLARE'
/usr/src/apache2/srclib/apr/include/apr_general.h:190: error: expected 
declaration specifiers before 'APR_DECLARE'
/usr/src/apache2/srclib/apr/include/apr_general.h:203: error: expected 
declaration specifiers before 'APR_DECLARE_NONSTD'
/usr/src/apache2/srclib/apr/include/apr_general.h:214: error: expected 
declaration specifiers before 'APR_DECLARE'


I 

Re: Cannot build mod_jk.1.2.32

2011-08-29 Thread Mladen Turk

On 08/29/2011 10:55 AM, Casper Wandahl Schmidt wrote:

So I fanilly had time to check up on this topic :)

Lets start with the apache2ctl -V command:
Server version: Apache/2.2.8 (Ubuntu)

I suppose the Server MPM: Prefork (you have Worker) might be the reason why I 
couldn't get the mod_jk working earlier because apache is not set up for using 
a worker as I was trying to?



Nope.


Next the other apache info:
ii apache2 2.2.8-1ubuntu0.19
ii apache2-mpm-prefork 2.2.8-1ubuntu0.19
ii apache2-src 2.2.8-1ubuntu0.19
ii apache2-threaded-dev 2.2.8-1ubuntu0.19
ii apache2-utils 2.2.8-1ubuntu0.19
ii apache2.2-common 2.2.8-1ubuntu0.19
ii libapache2-mod-php5 5.2.4-2ubuntu5.17

Finally the beginning of the error-log I made when running make:


You don't need source packages.
All you need are -dev packages.
Then configure --with-apxs=/path/to/the/apxs(2)


In file included from mod_jk.c:29:
/usr/src/apache2/include/ap_config.h:25:17: error: apr.h: No such file or 
directory
In file included from /usr/src/apache2/include/ap_config.h:26,


This happens since you forced the 'src' directory.
Sources like name suggests contain sources, apr.h and apu.h are generated
when you build the apr/apr-util (can be part of httpd build process)
but you don't need to build the httpd. Your dist already have it.



$ svn checkout https://svn.apache.org/repos/asf/tomcat/jk/tags/JK_1_2_32
$ cd JK_1_2_32/native
$ ./buildconf.sh (you don't need to do this if you didn't use svn)
$ which apxs2
/usr/bin/apxs2
$ ./configure --with-apxs=/usr/bin/apxs2



Note: Some distros don't have 2 sufix. It's just /xxx/yyy/apxs
However seems Ubuntu has /usr/bin/apxs2




Regards
--
^TM

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Tomcat service blocks all TCP or UDP ports?

2011-08-29 Thread Michael Südkamp
Hello,

we have a problem on a customer's server which we never had in many years of 
working with Tomcat.
The customer runs a Windows 2008R2 with Tomcat 6.0.29 und Java 1.6.0_20
The situation when the problem occurs is always this:
Our web-apps logs that suddenly the MS SQL Server on the same server cannot be 
reached anymore due to a generic network error (The TCP connection to host 
localhost port 1433 has failed).
A check on the server showed that the required TCP ports are not accessible via 
telnet (Ports for MSSQL, Tomcat AJP, Tomcat shutdown). Even more: also TCP or 
UDP ports which haven't anything to do with Tomcat are missing (ports e.g. for 
lsass ntp). netstat shows only two entries in high port region while 
normally on any system you get a longer list.
After a restart of Tomcat service everything works again and all ports are back 
in netstat.

Do you have any idea what can cause such a behaviour?

Best regards

Michael

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Cannot build mod_jk.1.2.32

2011-08-29 Thread Casper Wandahl Schmidt



Den 29-08-2011 11:30, Mladen Turk skrev:

On 08/29/2011 10:55 AM, Casper Wandahl Schmidt wrote:

So I fanilly had time to check up on this topic :)

Lets start with the apache2ctl -V command:
Server version: Apache/2.2.8 (Ubuntu)

I suppose the Server MPM: Prefork (you have Worker) might be the 
reason why I couldn't get the mod_jk working earlier because apache 
is not set up for using a worker as I was trying to?




Nope.

Nice, then I should be able to make it work soon :)



Next the other apache info:
ii apache2 2.2.8-1ubuntu0.19
ii apache2-mpm-prefork 2.2.8-1ubuntu0.19
ii apache2-src 2.2.8-1ubuntu0.19
ii apache2-threaded-dev 2.2.8-1ubuntu0.19
ii apache2-utils 2.2.8-1ubuntu0.19
ii apache2.2-common 2.2.8-1ubuntu0.19
ii libapache2-mod-php5 5.2.4-2ubuntu5.17

Finally the beginning of the error-log I made when running make:


You don't need source packages.
All you need are -dev packages.
Then configure --with-apxs=/path/to/the/apxs(2)
As I think I said in the beginning ./configure complained about no 
apache and giving me an error about some source directory (can't 
remember the details)



In file included from mod_jk.c:29:
/usr/src/apache2/include/ap_config.h:25:17: error: apr.h: No such 
file or directory

In file included from /usr/src/apache2/include/ap_config.h:26,


This happens since you forced the 'src' directory.
Sources like name suggests contain sources, apr.h and apu.h are generated
when you build the apr/apr-util (can be part of httpd build process)
but you don't need to build the httpd. Your dist already have it.



$ svn checkout 
https://svn.apache.org/repos/asf/tomcat/jk/tags/JK_1_2_32

$ cd JK_1_2_32/native
$ ./buildconf.sh (you don't need to do this if you didn't use svn)
$ which apxs2
/usr/bin/apxs2
$ ./configure --with-apxs=/usr/bin/apxs2



Note: Some distros don't have 2 sufix. It's just /xxx/yyy/apxs
However seems Ubuntu has /usr/bin/apxs2
I tried removing my working directory and unpacking the tar.gz again. 
This time I did a chown before trying ./configure --with-apxs (leaving 
the 2 out)=/usr/bin/apxs2 - it still gave the no apache given 
warning but it actually did configure thinks correctly this time :) I 
don't know if it was because of the chown (ran ./configure as root 
before because the folder was owned by root:bin after unpacking with 
sudo tar ) or because I changed --with-apxs2 to --with-apxs 
(although I believe I tried both before starting this thread because I 
only found the --with-apxs2 switch after searching google for days)


Anyway I was able to run make successfully and now I have the mod_jk.so :)

Thank you all for your time and help. I might be back with questions on 
how to make the connector work at a later time :)





Regards


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Cannot build mod_jk.1.2.32

2011-08-29 Thread Mladen Turk

On 08/29/2011 11:46 AM, Casper Wandahl Schmidt wrote:



Anyway I was able to run make successfully and now I have the mod_jk.so :)



Cool.



Thank you all for your time and help. I might be back with questions on how to 
make the connector work at a later time :)


Cannot wait for that one ;)


Cheers
--
^TM

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Cannot build mod_jk.1.2.32

2011-08-29 Thread Casper Wandahl Schmidt



Den 29-08-2011 12:47, Mladen Turk skrev:

On 08/29/2011 11:46 AM, Casper Wandahl Schmidt wrote:



Anyway I was able to run make successfully and now I have the 
mod_jk.so :)




Cool.


Thank you all for your time and help. I might be back with questions 
on how to make the connector work at a later time :)


Cannot wait for that one ;)
Sorry to disappoint you but I got it up and running with the tomcat 
examples in less than 10 minutes this time :) (I kept all the conf files 
etc. from my last try and only did minor changes)



Cheers

Kind regards
Casper

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Is empty Content Type of Request allowed in Tomcat?

2011-08-29 Thread André Warnier

Isaac Li wrote:

Hello,

I'm using Cyberduck as client to send request to my web server which using
apache-tomcat-7.0.16 as web container.

When Cyberduck sent a request with an empty Content Type, web server
returned following errors:

HTTP/1.1 400 Bad Request (text/plain)

Bad Content-Type header value: ''


That is clearly incorrect, so Tomcat would be right to complain.




I thought this error is reported by tomcat, since it has not running into my
code.



...


So is it possible to modify tomcat setting to allow empty Content Type of
request? 


Why should Tomcat be modifiedt to accept incorrect HTTP requests ?
Tomcat is a HTTP server, so it must follow the HTTP specs.  And the HTTP specs probably 
say that if a request header is clearly incorrect (as this one is), the server MUST 
respond with a 400 error.


or I should try other ways

Yes, fix the client.
(Or report the problem on the Cyberduck mailing list).

 (I heard someone said adding some

filters?)


Would probably not help, as the error may be generated before the filter is 
ever called.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: parallel deployment of tomcat 7

2011-08-29 Thread Konstantin Kolinko
2011/8/29 Sammy MT Lau sammy...@hk1.ibm.com:

 I've read some articles regarding to the parallel deployment of tomcat 7.
 From what I've read, enabling parallel deployment requires the enablement
 of tomcat session as well. However, the API server and client I'm working
 with don't do any session management using the tomcat session. Therefore,
 I've the tomcat session disabled. So, what's the behaviour of parallel
 deployment when I just turned on the tomcat session without having the
 client ever do anything with the session id in url or cookie. In that case,
 all of the requests coming to the tomcat doesn't have any session info. I'm
 going to do some tests but if someone on the list could shed me some light
 on this would be highly appreciated.


If there is no session, then all requests will be served by the latest
version of webapp.

In essence: after a new version of webapp starts up you can
immediately shut down the old version. Without parallel deployment you
would have to undeploy the old version before deploying the new one.

More details about this feature are on the Context page in the
configuration reference.

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Tomcat 6.xx SSL supports

2011-08-29 Thread sanjivacharyya

Hi,

I have the below requirements for SSL certificates.
Please do let me know is tomcat 6.xx  supports below requirements :-
1) 128 bit data encryption will be employed. 
2) 1024 bit server certificate keys will be used. 
3) 2048 bit VeriSign Intermediate and Root CA Certificate keys will be used. 

Thanks in advance.
Regards,
Sanjiv
-- 
View this message in context: 
http://old.nabble.com/Tomcat-6.xx-SSL-supports-tp32356619p32356619.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: parallel deployment of tomcat 7

2011-08-29 Thread Mark Thomas
On 29/08/2011 04:15, Sammy MT Lau wrote:
 
 
 Hello all,
 
 I've read some articles regarding to the parallel deployment of tomcat 7.
 From what I've read, enabling parallel deployment requires the enablement
 of tomcat session as well. However, the API server and client I'm working
 with don't do any session management using the tomcat session. Therefore,
 I've the tomcat session disabled. So, what's the behaviour of parallel
 deployment when I just turned on the tomcat session without having the
 client ever do anything with the session id in url or cookie. In that case,
 all of the requests coming to the tomcat doesn't have any session info. I'm
 going to do some tests but if someone on the list could shed me some light
 on this would be highly appreciated.

Requests will always go to the latest version of the web application. In
this scenario, there is little benefit to using parallel deployment.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Is empty Content Type of Request allowed in Tomcat?

2011-08-29 Thread Mark Thomas
On 29/08/2011 09:10, Isaac Li wrote:
 Hello,
 
 I'm using Cyberduck as client to send request to my web server which using
 apache-tomcat-7.0.16 as web container.
 
 When Cyberduck sent a request with an empty Content Type, web server
 returned following errors:

Cyberduck is broken and is violating RFC2616.

 HTTP/1.1 400 Bad Request (text/plain)
 
 Bad Content-Type header value: ''
 
 I thought this error is reported by tomcat, since it has not running into my
 code.

Tomcat is rejected this request. The request is invalid.

 I've enabled Tomcat debug log, and have no clue, following are some catalina
 log:

If you want a clue, try reading RFC2616.

 So is it possible to modify tomcat setting to allow empty Content Type of
 request?

No.

 or I should try other ways (I heard someone said adding some
 filters?)

Whoever said a filter was a solution to this problem is clueless. The
request is rejected long before the filters are reached.

  - and What's the detailed steps?

1. Get the bug in Cyberduck fixed.
2. Try again.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Ajp13Processor threads are not getting closed.

2011-08-29 Thread Jagadish Raj R
Hi Andre,

Here are the results.

Compiled in modules:
  core.c
  prefork.c
  http_core.c
  mod_so.c


KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15


Thanks  Regards, 
JAGADISH RAJ R 

-Original Message-
From: André Warnier [mailto:a...@ice-sa.com] 
Sent: Thursday, August 25, 2011 4:48 PM
To: Tomcat Users List
Subject: Re: Ajp13Processor threads are not getting closed.

To the original poster Jagadish Raj :

Maybe let's restart from the beginning.

First, re-read this page of the online documentation for the mod_jk connector :
http://tomcat.apache.org/connectors-doc/reference/workers.html
Particularly, next to the connection_pool* parameters, the items in red.

Considering that, what is the MPM used on your Apache httpd server ?
(you can see this by running /usr/sbin/apache2 -l or httpd -l; list the 
result here).
(This is to find out if your httpd server is running in prefork mode or one 
of the 
multi-threading modes.)

Then, what are the httpd settings for KeepAlive ?
(KeepAlive and KeepAliveTimeout). This is usually in /etc/apache2/apache2.conf.


Edward Quick wrote:
 mod_jk is not Tomcat so I'm not sure you need to worry about running an older 
 version of tomcat as long as it's listening on the AJP connector.
 
 
 -Original Message-
 From: Jagadish Raj R [mailto:jagadish_ra...@symantec.com] 
 Sent: 25 August 2011 10:08
 To: Tomcat Users List
 Subject: RE: Ajp13Processor threads are not getting closed.
 
 Hi,
 
 Apache not accepting JkWatchDogInterval parameter (think it's version 
 problem). How is this problem fixed in higher Tomcat versions. Can I do the 
 same in lower version of Tomcat.
 
 (As of now, I don't have a choice of upgrading Tomcat as this requires 
 upgrade of TIBCO Administrator which is built on top of Tomcat)
 
 
 Thanks  Regards, 
 JAGADISH RAJ R | Symantec EAI Support | M P H A S I S an HP company | Level 
 2, Tower 7, Magarpatta SEZ, Magarpatta city, Pune-411013| Mobile: +91 
 9011047954| Email: jagadish_ra...@symantec.com
 
 
 -Original Message-
 From: Edward Quick [mailto:edward.qu...@iggroup.com] 
 Sent: Wednesday, August 24, 2011 3:20 PM
 To: Tomcat Users List
 Subject: RE: Ajp13Processor threads are not getting closed.
 
 You could try adding JkWatchDogInterval 30. That did the trick for me.
 
 -Original Message-
 From: Jagadish Raj R [mailto:jagadish_ra...@symantec.com]
 Sent: 24 August 2011 10:39
 To: Tomcat Users List
 Subject: Ajp13Processor threads are not getting closed.
 
 Hi Tomcat Users,
 
 I have a Tomcat server to which another apache webserver connects using AJP 
 1.3 Connector. I have set up a maxProcessors=75 in connector settings. 
 Whenever a user creates a connection an Ajp13Processor connection thread is 
 created. My problem is this thread does not get terminated even after the 
 user close the session. Please help me in finding some configuration changes 
 that will allow me to close these sessions/threads after a certain timeout 
 value.
 
 I am pasting below the configurations I am using.
 
 !-- Define an AJP 1.3 Connector on port 8009 --
 Connector className=org.apache.ajp.tomcat4.Ajp13Connector 
 port=8089 minProcessors=5 maxProcessors=75 acceptCount=10 
 connectionTimeout=6 debug=0/
 
 Workers.properties file:-
 
 worker.list=ajp13
 worker.ajp13.port=
 worker.ajp13.host=hostname
 worker.ajp13.type=ajp13
 worker.ajp13.connection_pool_size=75
 worker.ajp13.connection_pool_minsize=15
 worker.ajp13.connection_pool_timeout=60
 
 
 Logs from thread dump of tomcat process:-
 
 Ajp13Processor[][7] daemon prio=10 tid=0x0166c038 nid=0xe0 in 
 Object.wait() [0xa64ff000..0xa64ffa28]
 at java.lang.Object.wait(Native Method)
 - waiting on 0xc6de9028 (a org.apache.ajp.tomcat4.Ajp13Processor)
 at java.lang.Object.wait(Object.java:474)
 at 
 org.apache.ajp.tomcat4.Ajp13Processor.await(Ajp13Processor.java:316)
 - locked 0xc6de9028 (a org.apache.ajp.tomcat4.Ajp13Processor)
 at org.apache.ajp.tomcat4.Ajp13Processor.run(Ajp13Processor.java:576)
 at java.lang.Thread.run(Thread.java:595)
 
 
 Versions:-
 
 Tomcat - 4.1.27
 Mod JK -  mod_jk-apache-2.0.49-linux-i686.so
 
 
 
 
 Thanks  Regards,
 JAGADISH RAJ R | Symantec EAI Support | M P H A S I S an HP company | Level 
 2, Tower 7, Magarpatta SEZ, Magarpatta city, Pune-411013| Mobile: +91 
 9011047954| Email: 
 jagadish_ra...@symantec.commailto:jagadish_ra...@symantec.com
 
 
 The information contained in this email is strictly confidential and for the 
 use of the addressee only, unless otherwise indicated. If you are not the 
 intended recipient, please do not read, copy, use or disclose to others this 
 message or any attachment. Please also notify the sender by replying to this 
 email or by telephone (+44 (0)20 7896 0011) and then delete the email and any 
 copies of it. Opinions, conclusions (etc) that do not relate to the official 
 business of this company shall be understood as neither given 

Re: Tomcat started and localhost:8080 is loading

2011-08-29 Thread Priya Ram Prasad
Hi,

I don't think there is any problem with the tomcat.

Did you add the plugin properly and started the eclipse with -clean option ?

Check your Tomcat version and tomcat home directory in eclipse preference.

Also whether your eclipse's installed JRE is pointing to jdk directory.

Thanks,
Priya

On Sun, Aug 28, 2011 at 10:53 PM, Pratibha S psund...@gmail.com wrote:

 Hi,

 I'm using Tomcat 7.0 and Eclipse Indigo. I'm using Mongrel plug-in for
 Tomcat.

 When I start startup.sh, I can load the localhost:8080 page.
 But when I start Tomcat from Eclipse, it is able to start but I'm unable to
 load the localhost page. Explorer says, could not connect to
 localhost:8080.
 From here, (

 http://stackoverflow.com/questions/2280064/tomcat-started-in-eclipse-but-unable-to-connect-to-link-to-http-localhost8085
 )
 I changed the settings of server to use Tomcat Installation rather than
 from
 workspace. But still I'm unable to load the page. My Catalina.out is not
 showing any errors (it is given below)

 Please guide me.

 -
 INFO: Starting service Catalina
 Aug 28, 2011 8:38:48 PM org.apache.catalina.core.StandardEngine
 startInternal
 INFO: Starting Servlet Engine: Apache Tomcat/7.0.20
 Aug 28, 2011 8:38:48 PM org.apache.catalina.startup.HostConfig
 deployDirectory
 INFO: Deploying web application directory manager
 Aug 28, 2011 8:38:48 PM org.apache.catalina.startup.HostConfig
 deployDirectory
 INFO: Deploying web application directory host-manager
 Aug 28, 2011 8:38:49 PM org.apache.catalina.startup.HostConfig
 deployDirectory
 INFO: Deploying web application directory ROOT
 Aug 28, 2011 8:38:49 PM org.apache.catalina.startup.HostConfig
 deployDirectory
 INFO: Deploying web application directory examples
 Aug 28, 2011 8:38:49 PM org.apache.catalina.startup.HostConfig
 deployDirectory
 INFO: Deploying web application directory docs
 Aug 28, 2011 8:38:49 PM org.apache.coyote.AbstractProtocol start
 INFO: Starting ProtocolHandler [http-bio-8080]
 Aug 28, 2011 8:38:49 PM org.apache.coyote.AbstractProtocol start
 INFO: Starting ProtocolHandler [ajp-bio-8009]
 Aug 28, 2011 8:38:49 PM org.apache.catalina.startup.Catalina start
 INFO: Server startup in 1667 ms
 Aug 28, 2011 11:02:37 PM org.apache.catalina.core.StandardServer await
 INFO: A valid shutdown command was received via the shutdown port. Stopping
 the Server instance.
 Aug 28, 2011 11:02:37 PM org.apache.coyote.AbstractProtocol pause
 INFO: Pausing ProtocolHandler [http-bio-8080]
 Aug 28, 2011 11:02:39 PM org.apache.coyote.AbstractProtocol pause
 INFO: Pausing ProtocolHandler [ajp-bio-8009]
 Aug 28, 2011 11:02:40 PM org.apache.catalina.core.StandardService
 stopInternal
 INFO: Stopping service Catalina
 Aug 28, 2011 11:02:40 PM org.apache.coyote.AbstractProtocol stop
 INFO: Stopping ProtocolHandler [http-bio-8080]
 Aug 28, 2011 11:02:40 PM org.apache.coyote.AbstractProtocol stop
 INFO: Stopping ProtocolHandler [ajp-bio-8009]
 Aug 28, 2011 11:02:40 PM org.apache.coyote.AbstractProtocol destroy
 INFO: Destroying ProtocolHandler [http-bio-8080]
 Aug 28, 2011 11:02:40 PM org.apache.coyote.AbstractProtocol destroy
 INFO: Destroying ProtocolHandler [ajp-bio-8009]
 ---



Re: Tomcat 6.xx SSL supports

2011-08-29 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Sanjiv,

On 8/29/2011 8:53 AM, sanjivacharyya wrote:
 I have the below requirements for SSL certificates. Please do let
 me know is tomcat 6.xx  supports below requirements :- 1) 128 bit
 data encryption will be employed. 2) 1024 bit server certificate
 keys will be used. 3) 2048 bit VeriSign Intermediate and Root CA
 Certificate keys will be used.

These will either be supported by the JVM or by OpenSSL depending on
how you have your server configured. I believe there are no problems
with the above requirements under either configuration.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5buJMACgkQ9CaO5/Lv0PCvbwCeIabFZssIybm94LdSGRrD2lhu
sv0An145oLGfsZ4a5llW4apXLkmXrRIZ
=h3KX
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat started and localhost:8080 is loading

2011-08-29 Thread Priya Ram Prasad
Hi,

I don't think there is any problem with the tomcat.

Did you add the plugin properly and started the eclipse with -clean option ?

Check your Tomcat version and tomcat home directory in eclipse preference.

Also whether your eclipse's installed JRE is pointing to jdk directory.

Thanks,
Priya


Re: parallel deployment of tomcat 7

2011-08-29 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Mark,

On 8/29/2011 9:37 AM, Mark Thomas wrote:
 On 29/08/2011 04:15, Sammy MT Lau wrote:
 
 
 Hello all,
 
 I've read some articles regarding to the parallel deployment of
 tomcat 7. From what I've read, enabling parallel deployment
 requires the enablement of tomcat session as well. However, the
 API server and client I'm working with don't do any session
 management using the tomcat session. Therefore, I've the tomcat
 session disabled. So, what's the behaviour of parallel deployment
 when I just turned on the tomcat session without having the 
 client ever do anything with the session id in url or cookie. In
 that case, all of the requests coming to the tomcat doesn't have
 any session info. I'm going to do some tests but if someone on
 the list could shed me some light on this would be highly
 appreciated.
 
 Requests will always go to the latest version of the web
 application. In this scenario, there is little benefit to using
 parallel deployment.

I still see a use for parallel deployment: zero down-time. Webapp
redeployment isn't instantaneous, especially if the webapp itself has
a non-trivial startup time. Parallel deployment allows more seamless
upgrades.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5bubQACgkQ9CaO5/Lv0PDsZACcCDMelwap3NlMvFnIkZTMsxwu
AiMAoKghLsJrhWUUmrpSP4vg9HXhUXc2
=M6lv
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Exception Handling

2011-08-29 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Donald,

On 8/28/2011 4:35 PM, Donald Jolley wrote:
 Exception handling can be configured in WEB-INF/web.xml
 
 This suggestion seems to hold a lot of promise for error handling.
 The only problem is that I have not been able to get it to work.  I
 have the following stanza in the web-app container of my web.xml
 file:
 
 error-page exception-typejava.lang.Throwable/exception-type 
 location/errors.jsp/location /error-page
 
 It is my understanding that the above is a catch-all that will trap
 any error.

Servlets aren't allowed to throw Throwable directly, so that might be
the problem. Try catching java.lang.RuntimeException instead.

 I also have the following at the top of my errors.jsp file:
 
 %@ page isErrorPage=true %

That is proper procedure.

 That almost sounds like the display of the error page specified in
 web.xml won't get triggered unless the default Tomcat error page
 would have been displayed.  IOW, it sort of suggests that it
 wouldn't work with errors that would not trigger the display of the
 Tomcat default error page (such as Java exceptions)  I don't know
 if that is the case or not; but, it sure doesn't seem to be
 working.

No, the implementation looks conceptually like this:

try {
  Servlet servlet = // get the servlet to execute

  servlet.service(request, response);

  // check status code, show appropriate error page defined in web.xml
} catch (RuntimeException|IOException|ServletException ex) {
  Servlet errorHandler = // get error handler from web.xml or default

  request.setAttribute(javax.servlet.error.exception, ex);
  // and others... see SVR 10.9.1

  try {
errorHandler.service(request, response);
  } catch (Throwable t) {
// show default error page, guaranteed not to fail
  }
}

Tomcat should be able to intercept any exception that a servlet can
legally throw. Again, java.lang.Throwable is too generic for that.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5bxpMACgkQ9CaO5/Lv0PB7HACeLJ0psZpMC21m9dZ7o+bYbzC7
GkAAoLMDFZAVOLavQhDS703Y4DTGBv6D
=3+3P
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Could not find datasource when starting tomcat

2011-08-29 Thread Alaeddine HAOUAS
Hi,

 

I try to backup a java 1.5 web application with servlet/JSP using
tomcat-6.0.20.

 

I am having the following error when starting my tomcat in Eclipse (sysdeo
plugin v3.2.1) :

 

FATAL [main] DatasourceConnectionProvider:47 - Could not find datasource:
dbName

javax.naming.NameNotFoundException

 

 

I have read the Context Container documentation to make a correct context
file. I added a context file 'proto.xml' in conf\catalina\localhost. The
file content :

 

Context reloadable=true
docBase=C:\eclipse\workspace-intranet\sadeteProto\web
workDir=C:\eclipse\workspace-intranet\sadeteProto\work 

 

Environment name=server.nametype=java.lang.String
value=x /

Environment name=jdbc.prefixtype=java.lang.String
value= /





Resource name=dbName auth=Container
type=javax.sql.DataSource

driverClassName=com.microsoft.sqlserver.jdbc.SQLServerDriver

 
url=jdbc:sqlserver://xxx.xx.xx.xxx:1433?database=DB_copieamp;autoReconnect
=true

username=User_DB

password=xxx /

   

/Context

 

 

In the hibernate config file I have the following property :

property name=connection.datasourcedbName/property

 

 

Any idea how to make the datasource visible for my application ?

 

Thanks

 

 

Alaeddine 

 



Re: Could not find datasource when starting tomcat

2011-08-29 Thread Savitha Akella
Hi ,

Usually in the resource tag , we define the name parameter as below:

name=jndi/dbName

Make this change and hopefully it should work.

Thanks

On Mon, Aug 29, 2011 at 10:20 AM, Alaeddine HAOUAS 
a.hao...@nouvellemarque.com wrote:

 Hi,



 I try to backup a java 1.5 web application with servlet/JSP using
 tomcat-6.0.20.



 I am having the following error when starting my tomcat in Eclipse (sysdeo
 plugin v3.2.1) :



 FATAL [main] DatasourceConnectionProvider:47 - Could not find datasource:
 dbName

 javax.naming.NameNotFoundException





 I have read the Context Container documentation to make a correct context
 file. I added a context file 'proto.xml' in conf\catalina\localhost. The
 file content :



 Context reloadable=true
 docBase=C:\eclipse\workspace-intranet\sadeteProto\web
 workDir=C:\eclipse\workspace-intranet\sadeteProto\work 



Environment name=server.nametype=java.lang.String
 value=x /

Environment name=jdbc.prefixtype=java.lang.String
 value= /





Resource name=dbName auth=Container
 type=javax.sql.DataSource

driverClassName=com.microsoft.sqlserver.jdbc.SQLServerDriver



 url=jdbc:sqlserver://xxx.xx.xx.xxx:1433?database=DB_copieamp;autoReconnect
 =true

username=User_DB

password=xxx /



 /Context





 In the hibernate config file I have the following property :

 property name=connection.datasourcedbName/property





 Any idea how to make the datasource visible for my application ?



 Thanks





 Alaeddine






CometFilter getAuthType() returns null

2011-08-29 Thread Sudeep Pradhan
Hi,

I am using Tomcat 6.0.33. I have a CometProcessor Servlet and CometFilter. I 
use curl as http client and send username/password with basic authentication. 
The curl trace shows that the authentication type is basic. I have HTTPS in 
place. I try to get the AuthType and Principal in CometFilter but both are 
null.  I have the following code in place:

HttpServletRequest request = 
event.getHttpServletRequest();
HttpServletResponse response = 
event.getHttpServletResponse();

System.out.println(Auth Type :  + 
request.getAuthType());
System.out.println(User Principal:  + 
request.getUserPrincipal());

Can you tell me what needs to be done in order to get this working?

Thanks,
Sudeep


Re: CometFilter getAuthType() returns null

2011-08-29 Thread Mark Thomas
On 29/08/2011 19:20, Sudeep Pradhan wrote:
 Hi,
 
 I am using Tomcat 6.0.33. I have a CometProcessor Servlet and CometFilter. I 
 use curl as http client and send username/password with basic authentication. 
 The curl trace shows that the authentication type is basic. I have HTTPS in 
 place. I try to get the AuthType and Principal in CometFilter but both are 
 null.  I have the following code in place:
 
 HttpServletRequest request = 
 event.getHttpServletRequest();
 HttpServletResponse response = 
 event.getHttpServletResponse();
 
 System.out.println(Auth Type :  + 
 request.getAuthType());
 System.out.println(User Principal:  + 
 request.getUserPrincipal());
 
 Can you tell me what needs to be done in order to get this working?

Tomcat doesn't process authentication headers unless the resource has a
security constraint defined. What constraints are defined for this resource?

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat started and localhost:8080 is loading

2011-08-29 Thread Pratibha S
Hi Priya,

Thank you for the response. I started eclipse with -clean option. error
remains the same.
Tomcat version and home directory are configured in mongrel settings. How do
I check plug-in is installed properly or not?

Installed JRE is poiting to jdk directory.

Regards,

On Mon, Aug 29, 2011 at 12:09 PM, Priya Ram Prasad priya@gmail.comwrote:

 Hi,

 I don't think there is any problem with the tomcat.

 Did you add the plugin properly and started the eclipse with -clean option
 ?

 Check your Tomcat version and tomcat home directory in eclipse preference.

 Also whether your eclipse's installed JRE is pointing to jdk directory.

 Thanks,
 Priya



Re: Could not find datasource when starting tomcat

2011-08-29 Thread Mark Eggers
- Original Message -

 From: Savitha Akella savitha.saraswa...@gmail.com
 To: Tomcat Users List users@tomcat.apache.org
 Cc: 
 Sent: Monday, August 29, 2011 10:36 AM
 Subject: Re: Could not find datasource when starting tomcat
 
 Hi ,
 
 Usually in the resource tag , we define the name parameter as below:
 
 name=jndi/dbName
 
 Make this change and hopefully it should work.
 
 Thanks
 
 On Mon, Aug 29, 2011 at 10:20 AM, Alaeddine HAOUAS 
 a.hao...@nouvellemarque.com wrote:
 
  Hi,
 
 
 
  I try to backup a java 1.5 web application with servlet/JSP 
 using
  tomcat-6.0.20.
 
 
 
  I am having the following error when starting my tomcat in Eclipse (sysdeo
  plugin v3.2.1) :
 
 
 
  FATAL [main] DatasourceConnectionProvider:47 - Could not find datasource:
  dbName
 
  javax.naming.NameNotFoundException
 
 
 
 
 
  I have read the Context Container documentation to make a correct context
  file. I added a context file 'proto.xml' in 
 conf\catalina\localhost. The
  file content :
 
 
 
  Context reloadable=true
 
 docBase=C:\eclipse\workspace-intranet\sadeteProto\web
 
 workDir=C:\eclipse\workspace-intranet\sadeteProto\work 
 
 
 
 
     Environment name=server.name                
 type=java.lang.String
  value=x /
 
     Environment name=jdbc.prefix                
 type=java.lang.String
  value= /
 
 
 
 
 
                 Resource name=dbName 
 auth=Container
  type=javax.sql.DataSource
 
     driverClassName=com.microsoft.sqlserver.jdbc.SQLServerDriver
 
 
 
 
 url=jdbc:sqlserver://xxx.xx.xx.xxx:1433?database=DB_copieautoReconnect
  =true
 
     username=User_DB
 
     password=xxx /
 
 
 
  /Context
 
 
 
 
 
  In the hibernate config file I have the following property :
 
  property 
 name=connection.datasourcedbName/property
 
 
 
 
 
  Any idea how to make the datasource visible for my application ?
 
 
 
  Thanks
 
 
 
 
 
  Alaeddine
 
 
 
 


Read the following Wiki entry: http://wiki.apache.org/tomcat/TomcatHibernate

In particular, pay attention to:

!-- using container-managed JNDI --
propertyname=hibernate.connection.datasource
   java:comp/env/jdbc/sakila
/property

in hibernate.cfg.xml.

Change jdbc/sakila as appropriate for your application.

. . . . just my two cents.
/mde/

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat started and localhost:8080 is loading

2011-08-29 Thread Priya Ram Prasad
Hi,

Add the plugin to eclipse\plugins and then run eclipse with -clean option.

Can you send the error trace when you open localhost:8080 page ?

thanks

On Mon, Aug 29, 2011 at 1:32 PM, Pratibha S psund...@gmail.com wrote:

 Hi Priya,

 Thank you for the response. I started eclipse with -clean option. error
 remains the same.
 Tomcat version and home directory are configured in mongrel settings. How
 do
 I check plug-in is installed properly or not?

 Installed JRE is poiting to jdk directory.

 Regards,

 On Mon, Aug 29, 2011 at 12:09 PM, Priya Ram Prasad priya@gmail.com
 wrote:

  Hi,
 
  I don't think there is any problem with the tomcat.
 
  Did you add the plugin properly and started the eclipse with -clean
 option
  ?
 
  Check your Tomcat version and tomcat home directory in eclipse
 preference.
 
  Also whether your eclipse's installed JRE is pointing to jdk directory.
 
  Thanks,
  Priya
 



Re: Ajp13Processor threads are not getting closed.

2011-08-29 Thread André Warnier

Well then..

Jagadish Raj R wrote:

Hi Andre,

Here are the results.

Compiled in modules:
  core.c


this :
  prefork.c 


means that your front-end Apache httpd server is running in prefork mode.
And what do the parts in red say in the link I sent you before ?


  http_core.c
  mod_so.c


KeepAlive On
MaxKeepAliveRequests 100


And this :


KeepAliveTimeout 15


means that any time a browser makes a connectionm to the server, sends a few requests on 
that connection, and then does not send anything anymore, the server will keep listening 
anyway for up to 15 seconds after the last request, just in case the browser /would/ send 
another request on that connection.
And during that same time, one connection from Apache httpd to Tomcat will be kept 
waiting, and one thread in Tomcat will be kept waiting, for the same reason.
You would probably improve the responsiveness of your server in general, by reducing this 
to 3 for example.






Thanks  Regards, 
JAGADISH RAJ R 


-Original Message-
From: André Warnier [mailto:a...@ice-sa.com] 
Sent: Thursday, August 25, 2011 4:48 PM

To: Tomcat Users List
Subject: Re: Ajp13Processor threads are not getting closed.

To the original poster Jagadish Raj :

Maybe let's restart from the beginning.

First, re-read this page of the online documentation for the mod_jk connector :
http://tomcat.apache.org/connectors-doc/reference/workers.html
Particularly, next to the connection_pool* parameters, the items in red.

Considering that, what is the MPM used on your Apache httpd server ?
(you can see this by running /usr/sbin/apache2 -l or httpd -l; list the 
result here).
(This is to find out if your httpd server is running in prefork mode or one of the 
multi-threading modes.)


Then, what are the httpd settings for KeepAlive ?
(KeepAlive and KeepAliveTimeout). This is usually in /etc/apache2/apache2.conf.


Edward Quick wrote:

mod_jk is not Tomcat so I'm not sure you need to worry about running an older 
version of tomcat as long as it's listening on the AJP connector.


-Original Message-
From: Jagadish Raj R [mailto:jagadish_ra...@symantec.com] 
Sent: 25 August 2011 10:08

To: Tomcat Users List
Subject: RE: Ajp13Processor threads are not getting closed.

Hi,

Apache not accepting JkWatchDogInterval parameter (think it's version problem). 
How is this problem fixed in higher Tomcat versions. Can I do the same in lower 
version of Tomcat.

(As of now, I don't have a choice of upgrading Tomcat as this requires upgrade 
of TIBCO Administrator which is built on top of Tomcat)


Thanks  Regards, 
JAGADISH RAJ R | Symantec EAI Support | M P H A S I S an HP company | Level 2, Tower 7, Magarpatta SEZ, Magarpatta city, Pune-411013| Mobile: +91 9011047954| Email: jagadish_ra...@symantec.com



-Original Message-
From: Edward Quick [mailto:edward.qu...@iggroup.com] 
Sent: Wednesday, August 24, 2011 3:20 PM

To: Tomcat Users List
Subject: RE: Ajp13Processor threads are not getting closed.

You could try adding JkWatchDogInterval 30. That did the trick for me.

-Original Message-
From: Jagadish Raj R [mailto:jagadish_ra...@symantec.com]
Sent: 24 August 2011 10:39
To: Tomcat Users List
Subject: Ajp13Processor threads are not getting closed.

Hi Tomcat Users,

I have a Tomcat server to which another apache webserver connects using AJP 1.3 
Connector. I have set up a maxProcessors=75 in connector settings. Whenever a 
user creates a connection an Ajp13Processor connection thread is created. My problem is 
this thread does not get terminated even after the user close the session. Please help me 
in finding some configuration changes that will allow me to close these sessions/threads 
after a certain timeout value.

I am pasting below the configurations I am using.

!-- Define an AJP 1.3 Connector on port 8009 --
Connector className=org.apache.ajp.tomcat4.Ajp13Connector port=8089 minProcessors=5 
maxProcessors=75 acceptCount=10 connectionTimeout=6 debug=0/

Workers.properties file:-

worker.list=ajp13
worker.ajp13.port=
worker.ajp13.host=hostname
worker.ajp13.type=ajp13
worker.ajp13.connection_pool_size=75
worker.ajp13.connection_pool_minsize=15
worker.ajp13.connection_pool_timeout=60


Logs from thread dump of tomcat process:-

Ajp13Processor[][7] daemon prio=10 tid=0x0166c038 nid=0xe0 in 
Object.wait() [0xa64ff000..0xa64ffa28]
at java.lang.Object.wait(Native Method)
- waiting on 0xc6de9028 (a org.apache.ajp.tomcat4.Ajp13Processor)
at java.lang.Object.wait(Object.java:474)
at org.apache.ajp.tomcat4.Ajp13Processor.await(Ajp13Processor.java:316)
- locked 0xc6de9028 (a org.apache.ajp.tomcat4.Ajp13Processor)
at org.apache.ajp.tomcat4.Ajp13Processor.run(Ajp13Processor.java:576)
at java.lang.Thread.run(Thread.java:595)


Versions:-

Tomcat - 4.1.27
Mod JK -  mod_jk-apache-2.0.49-linux-i686.so




Thanks  Regards,
JAGADISH RAJ R | Symantec EAI Support | M P H A S I S an HP company | Level 

[SECURITY] CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure

2011-08-29 Thread Mark Thomas
CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
- Tomcat 7.0.0 to 7.0.20
- Tomcat 6.0.0 to 6.0.33
- Tomcat 5.5.0 to 5.5.33
- Earlier, unsupported versions may also be affected

Description:
Apache Tomcat supports the AJP protocol which is used with reverse
proxies to pass requests and associated data about the request from the
reverse proxy to Tomcat. The AJP protocol is designed so that when a
request includes a request body, an unsolicited AJP message is sent to
Tomcat that includes the first part (or possibly all) of the request
body. In certain circumstances, Tomcat did not process this message as a
request body but as a new request. This permitted an attacker to have
full control over the AJP message which allowed an attacker to (amongst
other things):
- insert the name of an authenticated user
- insert any client IP address (potentially bypassing any client IP
address filtering)
- trigger the mixing of responses between users

The following AJP connector implementations are not affected:
org.apache.jk.server.JkCoyoteHandler (5.5.x - default, 6.0.x - default)

The following AJP connector implementations are affected:

org.apache.coyote.ajp.AjpProtocol (6.0.x, 7.0.x - default)
org.apache.coyote.ajp.AjpNioProtocol (7.0.x)
org.apache.coyote.ajp.AjpAprProtocol (5.5.x, 6.0.x, 7.0.x)

Further, this issue only applies if all of the following are are true
for at least one resource:
- POST requests are accepted
- The request body is not processed


Example: See https://issues.apache.org/bugzilla/show_bug.cgi?id=51698

Mitigation:
Users of affected versions should apply one of the following mitigations:
- Upgrade to a version of Apache Tomcat that includes a fix for this
issue when available
- Apply the appropriate patch
  - 7.0.x http://svn.apache.org/viewvc?rev=1162958view=rev
  - 6.0.x http://svn.apache.org/viewvc?rev=1162959view=rev
  - 5.5.x http://svn.apache.org/viewvc?rev=1162960view=rev
- Configure the reverse proxy and Tomcat's AJP connector(s) to use the
requiredSecret attribute
- Use the org.apache.jk.server.JkCoyoteHandler AJP connector (not
available for Tomcat 7.0.x)

Credit:
The issue was reported via Apache Tomcat's public issue tracker.
The Apache Tomcat security team strongly discourages reporting of
undisclosed vulnerabilities via public channels. All Apache Tomcat
security vulnerabilities should be reported to the private security team
mailing list: secur...@tomcat.apache.org

References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat started and localhost:8080 is loading

2011-08-29 Thread Pratibha S
The plug-in is already in the plugins directory. I started eclipse with
-clean option.

Sorry for a naive question.The eclipse console does not show any error. Is
error trace, the file localhost_access_log.date.txt? If yes, please find
the entry below:


127.0.0.1 - - [29/Aug/2011:00:21:28 -0400] GET / HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:00:21:38 -0400] GET /manager HTTP/1.1 404
-
0:0:0:0:0:0:0:1 - - [29/Aug/2011:00:21:47 -0400] GET /manager HTTP/1.1 404
-
0:0:0:0:0:0:0:1 - - [29/Aug/2011:00:21:55 -0400] GET /manager/status
HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:00:22:12 -0400] GET /manager/status
HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:00:22:19 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:00:33:20 -0400] GET / HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:00:33:34 -0400] GET / HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:00:33:43 -0400] GET /manager HTTP/1.1 404
-
0:0:0:0:0:0:0:1 - - [29/Aug/2011:00:33:49 -0400] GET /manager/status
HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:00:34:22 -0400] GET
/RecommendationApp/registration.jsp HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:00:34:23 -0400] GET /favicon.ico HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:13:49:13 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:13:49:39 -0400] GET
/RecommendationApp/registration.jsp HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:13:49:42 -0400] GET /favicon.ico HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:14:23:53 -0400] GET / HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:14:24:42 -0400] GET /manager HTTP/1.1 404
-
0:0:0:0:0:0:0:1 - - [29/Aug/2011:14:24:50 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:14:25:10 -0400] GET
/RecommendationApp/registration.jsp HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:14:25:11 -0400] GET /favicon.ico HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:14:50:39 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:14:53:28 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:14:54:39 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:14:54:55 -0400] GET
/RecommendationApp/registration.jsp HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:14:54:55 -0400] GET /favicon.ico HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:15:09:47 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:15:10:03 -0400] GET
/RecommendationApp/registration.jsp HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:15:10:04 -0400] GET /favicon.ico HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:15:10:35 -0400] GET /manager HTTP/1.1 404
-
0:0:0:0:0:0:0:1 - - [29/Aug/2011:15:10:40 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:15:15:54 -0400] GET / HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:15:17:37 -0400] GET / HTTP/1.1 404 -
0:0:0:0:0:0:0:1 - - [29/Aug/2011:15:17:42 -0400] GET /manager HTTP/1.1 404
-
127.0.0.1 - - [29/Aug/2011:16:26:26 -0400] GET / HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:16:26:27 -0400] GET
/RecommendationApp/registration.jsp HTTP/1.1 404 -
127.0.0.1 - - [29/Aug/2011:16:26:29 -0400] GET /favicon.ico HTTP/1.1 404 -

--


On Mon, Aug 29, 2011 at 3:07 PM, Priya Ram Prasad priya@gmail.comwrote:

 Hi,

 Add the plugin to eclipse\plugins and then run eclipse with -clean option.

 Can you send the error trace when you open localhost:8080 page ?

 thanks

 On Mon, Aug 29, 2011 at 1:32 PM, Pratibha S psund...@gmail.com wrote:

  Hi Priya,
 
  Thank you for the response. I started eclipse with -clean option. error
  remains the same.
  Tomcat version and home directory are configured in mongrel settings. How
  do
  I check plug-in is installed properly or not?
 
  Installed JRE is poiting to jdk directory.
 
  Regards,
 
  On Mon, Aug 29, 2011 at 12:09 PM, Priya Ram Prasad priya@gmail.com
  wrote:
 
   Hi,
  
   I don't think there is any problem with the tomcat.
  
   Did you add the plugin properly and started the eclipse with -clean
  option
   ?
  
   Check your Tomcat version and tomcat home directory in eclipse
  preference.
  
   Also whether your eclipse's installed JRE is pointing to jdk directory.
  
   Thanks,
   Priya
  
 



Tomcat JDBC Connection Pool, Tomcat 7, and Maven?

2011-08-29 Thread Andrew Todd
Hi,

So I'm working on a Maven-based project in which I would like to use
the Tomcat JDBC connection pool. I've noticed that with Tomcat 7, the
documentation has now moved into the official Tomcat docs
(https://tomcat.apache.org/tomcat-7.0-doc/jdbc-pool.html).

However, I'm wondering a few things:

1) Since the documentation provides information on using it
standalone, is it available as a Maven artifact? I've seen

 
http://ebr.springsource.com/repository/app/bundle/detail?name=com.springsource.org.apache.tomcat.jdbc

but I'm wondering if there's any relationship between that and what's
available through the Tomcat releases at

http://repo2.maven.org/maven2/org/apache/tomcat/

as I'd much rather pull from your repository. Is it related to tomcat-dbcp?

2) I'm assuming that JDBC Pool is available in the Tomcat tarball.
Just want to make sure.


Thanks.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat started and localhost:8080 is loading

2011-08-29 Thread André Warnier

Hi.

At the beginning, you said :

When I start startup.sh, I can load the localhost:8080 page.
But when I start Tomcat from Eclipse, it is able to start but I'm unable to
load the localhost page. Explorer says, could not connect to
localhost:8080.


That seems to indicate that Tomcat is not listening on port 8080, when you start it from 
Eclipse.  I am not an Eclipse user, but from similar previous posts on this list, that 
seems to indicate that Eclipse is using another set of configuration files for Tomcat, 
than the ones that are used when you start Tomcat from startup.sh.


You did not say on which platform you are running this, but try the following 
to confirm :

A)
1) start Tomcat with startup.sh
2) in a command window, enter netstat -pan (Linux) or netstat -aopn (Windows), and 
look for lines containing the word LISTEN.  You should see a line containing the port :8080.

That is Tomcat, and its PID is at the end of the same line.
3) stop Tomcat

B)
1) start Tomcat with Eclipse
2) in a command window, enter netstat -pan (Linux) or netstat -aopn (Windows), and 
look for lines containing the word LISTEN.  Do you see a line containing the port :8080 
?  If not, and you see for instance a line with port :80 instead, then it means that 
Tomcat is started differently. (And try http://localhost:80;)

If so, search the archives of this list as to how to correct that issue.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Exception Handling

2011-08-29 Thread Donald Jolley
I am happy to report that I finally got exception handling to work using the
web.xml approach.  To me this approach makes the most sense for handling
errors.  (Forwarding is a different issue.)  It was a patchwork of
assistance from many that finally led me to this point.  Thanks to all who
contributed.

I also want to report exactly what the hangup was because it illustrates how
newbies like myself can easily miss important points.

The solution is very obvious once the problem is understood.  The thing is
that the web.xml approach is an exception catcher.  It is an alternative to
try/catch blocks.  For web.xml to catch an exception, the exception has to
actually be thrown and not caught by some other means such as a catch
block.  In the situation under study the exception that I was dealing with
was logged but caught in a catch block.  Therefore, web.xml never saw the
exception.  The solution was simply to remove the try/catch blocks and
substitute a throws statement.  Once I did that, web.xml began catching the
exceptions just fine.  It's all just a case of understanding.  In that
regard I want to report that I have taken Mark's suggestion and ordered a
new book dealing with servlets and JSP (expedited shipping).  I should have
it in a few days.  I recognize that I need some major help that goes beyond
what a list can provide.  I do, however, sincerely appreciate all the help
that I have received on this list.

Finally, as I have said, I now have the error handling working.  My errors
page displays the information obtained from exception.toString().  Is there
any other information available that I could display on my errors page?

Thanks.

  ... doug


Re: Exception Handling

2011-08-29 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Donald,

On 8/29/2011 5:46 PM, Donald Jolley wrote:
 Finally, as I have said, I now have the error handling working.

Great.

 My errors page displays the information obtained from 
 exception.toString().  Is there any other information available
 that I could display on my errors page?

Check the servlet spec section called Exception Handling under Web
Applications. There are a few things that the container is required
to provide to you: stuff like the original URI being processed, the
exception type and message, the exception object itself, etc.

Generally speaking, if you want more information, you'll have to
manage it yourself. Like... what other information do you want to
provide? An explanation of what to do to avoid the error? That is
worthy of a Turing Award if you can pull it off :)

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5cDk4ACgkQ9CaO5/Lv0PCQ5wCgvO6Ku6hpBPPl7uSHpoeYEJRW
LdgAoLiOKdBF1DoIMZ82XYt3wnOlsyhE
=9fVe
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Exception Handling

2011-08-29 Thread Donald Jolley
 Like... what other information do you want to
 provide? An explanation of what to do to avoid the error? That is
 worthy of a Turing Award if you can pull it off :)

I am interested in identifying as clearly as possible the specific code that
was the root cause of the error.  The original URI that you mentioned
sounded helpful.  So far I have not been able to figure out how to do that.
I was able to add a stack trace.

So far, I am quite willing to live with what I have.  Thanks for your input.

 ... doug


Re: Is empty Content Type of Request allowed in Tomcat?

2011-08-29 Thread Isaac Li
Thank André and Mark for your quick response, detailed answer and
references!

I'll try to report this issue to Cyberduck.

One more question: when I uses current version of Cyberduck to connect
Amazon S3, it can accept this kind of invalid request,
is it a kind of fault tolerance design of  Amazon S3?  Should it be
encouraged?  or I missed something here?


On Mon, Aug 29, 2011 at 9:44 PM, Mark Thomas ma...@apache.org wrote:

 On 29/08/2011 09:10, Isaac Li wrote:
  Hello,
 
  I'm using Cyberduck as client to send request to my web server which
 using
  apache-tomcat-7.0.16 as web container.
 
  When Cyberduck sent a request with an empty Content Type, web server
  returned following errors:

 Cyberduck is broken and is violating RFC2616.

  HTTP/1.1 400 Bad Request (text/plain)
 
  Bad Content-Type header value: ''
 
  I thought this error is reported by tomcat, since it has not running into
 my
  code.

 Tomcat is rejected this request. The request is invalid.

  I've enabled Tomcat debug log, and have no clue, following are some
 catalina
  log:

 If you want a clue, try reading RFC2616.

  So is it possible to modify tomcat setting to allow empty Content Type of
  request?

 No.

  or I should try other ways (I heard someone said adding some
  filters?)

 Whoever said a filter was a solution to this problem is clueless. The
 request is rejected long before the filters are reached.

   - and What's the detailed steps?

 1. Get the bug in Cyberduck fixed.
 2. Try again.

 Mark

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




Re: Exception Handling

2011-08-29 Thread Mark Eggers
- Original Message -

 From: Donald Jolley jolleyt...@gmail.com
 To: Tomcat Users List users@tomcat.apache.org
 Cc: 
 Sent: Monday, August 29, 2011 5:38 PM
 Subject: Re: Exception Handling
 
  Like... what other information do you want to
  provide? An explanation of what to do to avoid the error? That is
  worthy of a Turing Award if you can pull it off :)
 
 I am interested in identifying as clearly as possible the specific code that
 was the root cause of the error.  The original URI that you 
 mentioned
 sounded helpful.  So far I have not been able to figure out how to do that.
 I was able to add a stack trace.
 
 So far, I am quite willing to live with what I have.  Thanks for your input.
 
          ... doug


There's an implicit object called pageContext.


The javadoc for that (javax.servlet.jsp.PageContext) has a lot of interesting 
information.

One of the methods is getErrorData. Looking at the javadoc for ErrorData 
(javax.servlet.jsp.ErrorData), there's a method called getRequestURI. This 
sounds exactly like what you're looking for:

${pageContext.errorData.requestURI} will give you the URI.

Also in the javadoc for pageContext, there's a method called getException, 
which returns an Exception object.

java.lang.Exception implements java.lang.Throwable, which has a lot of nice 
information.

One nice one is getMessage, which may give a more detailed message than the 
default toString. You could access that by:

${pageContext.exception.message}

Another one is getStackTrace, which returns an array of StackTraceElement. So 
you could
print the stack trace using the following code (if you've included the standard 
tag lib):

c:forEach var=st items=${pageContext.exception.stackTrace}
   ${st}br
/c:forEach

This makes use of the StackTraceElement.toString() method. There are obviously 
more games you can play. For example, if you don't want the entire stack trace, 
you can do this:

${pageContext.exception.stackTrace[0].fileName}br
${pageContext.exception.stackTrace[0].lineNumber}br
${pageContext.exception.stackTrace[0].className}br

There may be more than one class you're responsible for, so the first entry in 
the array might not be the most interesting one. Here's a slightly different 
foreach loop which just dumps class names and line numbers:

c:forEach var=st items={pageContext.exception.stackTrace}
   ${st.className} ${st.lineNumber}br
/c:forEach

See the java.lang.StackTraceElement for other useful features.

In short, look at implicit objects, then see what's populated when 
isErrorPage=true is set, and finally look at the javadoc for the classes.


. . . . just my two cents.
/mde/


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Two SSL certs. for same web app

2011-08-29 Thread Greg Johnson
We have a wildcard SSL cert. installed on our tomcat (6.0.18) instance. We are 
not fronted by Apache, as we just use Tomcat to serve the content directly. We 
provide subdomains for our clients to connect to us. For example:
https://client1.mycompany.com
represents client 1's portal into our web app.
https://client2.mycompany.com
represents client 2's portal into our web app.

A particular client is not happy with the strength of our SSL certificate, and 
wants us to install a better one for them to use when accessing our web app. 
(We don't need to discuss better hereI've already pulled my hair out on 
this one. And, no, it's not possible for us to simply get a better wildcard 
cert.) We have a single web app, and all clients access the same ROOT app. The 
subdomains are used primarily to allow us to skin our site differently for each 
client.

What is the method I should use to have most of our clients access our web 
app. using our existing wildcard cert., but still allow a single client to use 
a second SSL cert to access the same web app? In other words, when client N 
accesses our web site via:
https://clientn.mycompany.com
they should use a separate SSL cert.

I'm assuming I'll need a second network connection for our tomcat server. Our 
standard traffic will arrive via ip-address-one, and client N's traffic 
will arrive via ip-address-two. (With DNS configured to make that work 
correctly.) My guess would be that in addition to our tomcat.keystore file, I 
should create a clientn.keystore (which obviously holds the better one).  If 
that is the case, then I'm confused as to how to configure things in server.xml.

My current structure in server.xml is:
Server
Service
Connector port=8080 ... /
Connector port=8443 keystoreFile=tomcat.keystore ... /
Engine defaultHost=localhost
Host name=localhost
/Host
/Service

/Server

I've done some research and I believe I should use the address parameter on 
the connectors, so that I would then have two sets of Connector's, using the 
clientn.keystore on the 2nd SSL connector. But from there I'm confused as to 
what IP addresses should be used in the Engine and Host blocks. Do I need two 
Host sections? 

Server
Service
Connector port=8080 address=ip-address-one... /
Connector port=8443 address=ip-address-one keystoreFile=tomcat.keystore 
... /
Connector port=8080 address=ip-address-two... /
Connector port=8443 address=ip-address-two keystoreFile=clientn.keystore 
... /
Engine defaultHost=localhost

Host name=localhost
/Host
/Service

/Server

 If I simply replace localhost in the Engine and Host blocks with 
ip-address-one, I get traffic correctly on all of our subdomains, but don't 
get any response when connecting to ip-address-two.


Be gentle, but please slap me down the right road. ;-) I'm just stumbling 
through this, as you can tell. I hope I've not forgotten to share enough 
details.


Re: Is empty Content Type of Request allowed in Tomcat?

2011-08-29 Thread Isaac Li
On Tue, Aug 30, 2011 at 10:00 AM, Isaac Li tingjun...@gmail.com wrote:

 Thank André and Mark for your quick response, detailed answer and
 references!

 I'll try to report this issue to Cyberduck.

 One more question: when I uses current version of Cyberduck to connect
 Amazon S3,


See request at No.25 of  Cyberduck_login_amazon_s3_ok.pcap (attched)

GET / HTTP/1.1
Date: Tue, 30 Aug 2011 02:28:50 GMT
Content-Type:
Authorization: AWS AKIAJHSWPWM6W6KUXAIQ:u4QnOMbP0vuTsgpUXQ0WfXIWz9c=
Host: s3.amazonaws.com:80
Connection: Keep-Alive
User-Agent: Cyberduck/4.1 (8911) (Windows 7/6.1) (x86)
Accept-Encoding: gzip,deflate



 it can accept this kind of invalid request,


request at No.31 of Cyberduck_login_amazon_s3_ok.pcap

31 5.805868 207.171.189.80 192.168.1.104 HTTP/XML 64 HTTP/1.1 200 OK



 Is it a kind of fault tolerance design of  Amazon S3?  Should it be
 encouraged?  or I missed something here?


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: Two SSL certs. for same web app

2011-08-29 Thread Caldarale, Charles R
 From: Greg Johnson [mailto:gre...@yahoo.com] 
 Subject: Two SSL certs. for same web app

 I've done some research and I believe I should use the address 
 parameter on the connectors, so that I would then have two sets of
 Connector's, using the clientn.keystore on the 2nd SSL connector.

Correct.

 But from there I'm confused as to what IP addresses should be used 
 in the Engine and Host blocks. Do I need two Host sections? 

No, and you don't need to make any changes other than adding the extra 
Connector.  Traffic from both Connectors will be routed to the single 
Engine and Host.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org