[GUMP@vmgump-vm3]: Project tomcat-trunk-test-nio2 (in module tomcat-trunk) failed

2018-10-31 Thread Bill Barker
To whom it may engage...

This is an automated request, but not an unsolicited one. For 
more information please visit http://gump.apache.org/nagged.html, 
and/or contact the folk at gene...@gump.apache.org.

Project tomcat-trunk-test-nio2 has an issue affecting its community integration.
This issue affects 1 projects.
The current state of this project is 'Failed', with reason 'Build Failed'.
For reference only, the following projects are affected by this:
- tomcat-trunk-test-nio2 :  Tomcat 9.x, a web server implementing the Java 
Servlet 4.0,
...


Full details are available at:
http://vmgump-vm3.apache.org/tomcat-trunk/tomcat-trunk-test-nio2/index.html

That said, some information snippets are provided here.

The following annotations (debug/informational/warning/error messages) were 
provided:
 -DEBUG- Dependency on bnd exists, no need to add for property bndlib.jar.
 -INFO- Failed with reason build failed
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-trunk/output/logs-NIO2
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-trunk/output/test-tmp-NIO2/logs
 -WARNING- No directory 
[/srv/gump/public/workspace/tomcat-trunk/output/test-tmp-NIO2/logs]



The following work was performed:
http://vmgump-vm3.apache.org/tomcat-trunk/tomcat-trunk-test-nio2/gump_work/build_tomcat-trunk_tomcat-trunk-test-nio2.html
Work Name: build_tomcat-trunk_tomcat-trunk-test-nio2 (Type: Build)
Work ended in a state of : Failed
Elapsed: 24 mins 3 secs
Command Line: /usr/lib/jvm/java-8-oracle/bin/java -Djava.awt.headless=true 
-Dbuild.sysclasspath=only -Dsun.zip.disableMemoryMapping=true 
org.apache.tools.ant.Main -Dgump.merge=/srv/gump/public/gump/work/merge.xml 
-Djunit.jar=/srv/gump/public/workspace/junit/target/junit-4.13-SNAPSHOT.jar 
-Djava.net.preferIPv4Stack=/srv/gump/public/workspace/tomcat-trunk/true 
-Dobjenesis.jar=/srv/gump/public/workspace/objenesis/main/target/objenesis-3.1-SNAPSHOT.jar
 -Dtest.reports=output/logs-NIO2 -Dexecute.test.nio2=true 
-Dexamples.sources.skip=true 
-Dbase.path=/srv/gump/public/workspace/tomcat-trunk/tomcat-build-libs 
-Djdt.jar=/srv/gump/packages/eclipse/plugins/R-4.7.3a-201803300640/ecj-4.7.3a.jar
 -Dbndlib.jar=/srv/gump/packages/bnd/bndlib-4.0.0/biz.aQute.bndlib-4.0.0.jar 
-Dcommons-daemon.jar=/srv/gump/public/workspace/apache-commons/daemon/target/commons-daemon-1.1.1-SNAPSHOT.jar
 
-Dtest.openssl.path=/srv/gump/public/workspace/openssl-master/dest-20181101/bin/openssl
 -Dtest.temp=output/test-tmp-NIO2
  -Dtest.accesslog=true -Dexecute.test.nio=false 
-Dbnd.jar=/srv/gump/packages/bnd/bnd-4.0.0/biz.aQute.bnd-4.0.0.jar 
-Dexecute.test.apr=false -Dtest.excludePerformance=true -Dtest.relaxTiming=true 
-Deasymock.jar=/srv/gump/public/workspace/easymock/core/target/easymock-4.1-SNAPSHOT.jar
 -Dhamcrest.jar=/srv/gump/packages/hamcrest/hamcrest-core-1.3.jar 
-Dcglib.jar=/srv/gump/packages/cglib/cglib-nodep-2.2.jar test 
[Working Directory: /srv/gump/public/workspace/tomcat-trunk]
CLASSPATH: 
/usr/lib/jvm/java-8-oracle/lib/tools.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/webapps/examples/WEB-INF/classes:/srv/gump/public/workspace/tomcat-trunk/output/testclasses:/srv/gump/public/workspace/ant/dist/lib/ant.jar:/srv/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/srv/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit4.jar:/srv/gump/public/workspace/ant/dist/lib/ant-swing.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-resolver.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-xalan2.jar:/srv/gump/public/workspace/xml-commons/java/build/resolver.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/bin/bootstrap.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/bin/tomcat-juli.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/annotations-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/servlet-api.ja
 
r:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jsp-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/el-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/websocket-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jaspic-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-ant.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-storeconfig.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/tomcat-coyote.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jasper.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jasper-el.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-tribes.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-ha.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/tomcat-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/bu
 

[Bug 62873] New: Tomcat Monitor application will update multi-string values in Windows registry with blank lines

2018-10-31 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=62873

Bug ID: 62873
   Summary: Tomcat Monitor application will update multi-string
values in Windows registry with blank lines
   Product: Tomcat 8
   Version: 8.5.34
  Hardware: PC
Status: NEW
  Severity: normal
  Priority: P2
 Component: Meta
  Assignee: dev@tomcat.apache.org
  Reporter: brandon.wh...@tasktop.com
  Target Milestone: 

This is a Windows-platform specific issue.

The Tomcat Monitor application does not prevent a user from accidentally
inserting blank lines into the Java Options or Java 9 Options text areas. If a
blank line is introduced into either text area and the changes are applied (by
hitting the Apply or OK button), the changes are committed to the associating
multi-string value in the Windows registry.

If a user were to relaunch the Tomcat Monitor application and view the Java or
Java 9 Options again, they would see that the content has been clipped.
Individual options above the blank line would remain but any below would not be
present. If the Windows Registry editor were used to view the associating
multi-string values, they would see all of the content including the blank
line.

Changing the options again from within the Tomcat Monitor application will
succeed but when the options are committed to the registry multi-string value,
any options that existed below the blank line will be removed.

Note that the Windows registry editor will display an error dialog if a user
attempts to save a multi-string value with an empty line present. The message
is: "Data of type REG_MULTI_SZ cannot contain empty strings. Registry Editor
will remove all empty strings found."

Steps to Reproduce:

1) Download latest Tomcat 8 distribution for windows
2) Run service.bat install to install the default tomcat8 service.
3) Run tomcat8w.exe to start the tomcat monitor application. 
4) Switch to the Java tab and edit either the Java Options or Java 9 Options.
Insert a blank line somewhere in the middle of the text area. Click OK
5) Run tomcat8w.exe again. Look at the Java Options or Java 9 Options where the
blank line was inserted. Notice that all options below the blank line are not
visible.
6) Open up the registry editor and navigate to the multi-string value
associated with the Java (9) Options text area:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apache Software Foundation\Procrun
2.0\Tomcat8\Parameters\Java
7) Notice that all content is present (including the blank line) in the
registry value.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



[GitHub] tomcat pull request #130: Add two spaces (nbsp) in front of the Undeploy but...

2018-10-31 Thread ljader
GitHub user ljader opened a pull request:

https://github.com/apache/tomcat/pull/130

Add two spaces (nbsp) in front of the Undeploy button

Since there is no JavaScript in the Manager HTML,
I decided to visually separate the Undeploy button from the rest of the 
buttons.

This is to "prevent" **missclicks** on the Reload button,
which ends with the Undeploy being clicked.

(there is no Bugzilla ticket for this - I've created this to get your 
opinion on this.)

You can merge this pull request into a Git repository by running:

$ git pull https://github.com/ljader/tomcat trunk

Alternatively you can review and apply these changes as the patch at:

https://github.com/apache/tomcat/pull/130.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

This closes #130


commit a775d89f16563de3959189baa6b74acfd6696419
Author: Lukasz Jader 
Date:   2018-11-01T00:12:12Z

Add two spaces (nbsp) in front of the Undeploy button

This is to "prevent" missclicks on the Reload button,
which ends with the Undeploy being clicked.




---

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Re: Mime types

2018-10-31 Thread Rémy Maucherat
On Wed, Oct 31, 2018 at 10:30 PM Igal Sapir  wrote:

> >> Unless DefaultServlet behaviour is fixed, enabling probeContentType is
> >> likely to break my configurations.
>
> How about allowing to remove a Mime type by mapping it to an empty
> string?  That way you would only need to override that one in your
> Application's web.xml.
>
> Would that work?
>

That won't work, but I'm adding an init-param for the feature to disable it
at the same time.


>
> >> 4. I see a similarity to mod_mime_magic module of HTTPD.
> >>
> >> http://httpd.apache.org/docs/current/mod/mod_mime.html
> >> http://httpd.apache.org/docs/current/mod/mod_mime_magic.html
> >>
> >> (For some reason I though that mod_mime_magic uses the magic file from
> >> Unix OS.
> >> Actually it uses its own magic file from configuration of HTTPD,
> >> configured by directive "MimeMagicFile".
> >> So it is actually portable.)
> >>
> >> MimeMagicFile directive is disabled by default.
> >>
> >>
> http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/conf/httpd.conf.in?view=markup#l330
> >>
> >> Performance =?
> >> The documentation of mod_mime_magic says that performance is a concern
> >> for this module.
>
> The lookup will only happen for unknown types, and as Remy said they
> will be cached so I don't think that performance is an issue here.
>
> >
> > No idea really, probeContentType checks a number of sources [on Fedora it
> > is: new GnomeFileTypeDetector(), new
> > MimeTypesFileTypeDetector(userMimeTypes), new
> > MimeTypesFileTypeDetector(etcMimeTypes), new MagicFileTypeDetector()],
> and
> > it is platform dependent as you say. The result is then cached into the
> > resource in Tomcat, so it should be "ok" performance wise. The question
> is:
> > besides the default servlet not respecting a possibly set content-type (I
> > have not looked at it, and IMO it is a separate issue, no problem if
> you'd
> > like to fix it), is the Files.probeContentType result good enough on
> > Windows ?
>
> I have both Windows and Fedora so if you want me to test something
> specific please let me know.
>

Looked at the code, Windows uses the registry only (so something that may
be incomplete and not standardized). As a result, it would be unreasonable
to remove the current default mappings.
Example: https://bugs.java.com/bugdatabase/view_bug.do?bug_id=8080369

Rémy


[Bug 62871] New: JMX: ThreadPool.socketProperties is not Serializable

2018-10-31 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=62871

Bug ID: 62871
   Summary: JMX: ThreadPool.socketProperties is not Serializable
   Product: Tomcat 8
   Version: 8.5.x-trunk
  Hardware: All
OS: All
Status: NEW
  Severity: normal
  Priority: P2
 Component: Util
  Assignee: dev@tomcat.apache.org
  Reporter: m...@suse.de
  Target Milestone: 

Created attachment 36224
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=36224=edit
Trivial patch that addresses this bug

Some JMX clients such as Prometheus'[1] jmx_exporter[2] will bulk-load all
attributes of an MBean for performance reasons. This means that one
non-Serializable attribute is sufficient to make all information from the MBean
inaccessible.


I could readily reproduce a problem with the ThreadPool MBean, specifically
with the socketProperties property which is not Serializable.

Reproducer:

# enable JMX's full logging
cat >logging.properties <<<"
handlers=java.util.logging.ConsoleHandler
java.util.logging.ConsoleHandler.level=ALL
io.prometheus.jmx.level=ALL
io.prometheus.jmx.shaded.io.prometheus.jmx.level=ALL
"

# configure reading from a local Tomcat instance with JMX configured on port

cat >config.yml <<<"
hostPort: localhost:
whitelistObjectNames:
  - Catalina:type=ThreadPool,name=*
rules:
  - pattern: ".*"
"

# launch jmx_exporter
/usr/bin/java -Djava.util.logging.config.file=logging.properties -jar
jmx_prometheus_httpserver.jar 5556 jmx_exporter.yml


Visiting with a browser http://localhost:5556/metrics will trigger jmx_exporter
and the following error is produced:

FINE: scrape:
'Catalina:type=ThreadPool,name="http-apr-127.0.0.1-8080"_[currentThreadsBusy,
paused, sSLCertificateKeyFile, sSLProtocol, keyAlias, truststoreType,
sSLPassword, sendfileCount, sSLCACertificatePath, useCometTimeout,
socketProperties, p
ollTime, sSLHonorCipherOrder, currentThreadCount, trustManagerClassName,
sSLCARevocationFile, usePolling, keystorePass, trustMaxCertLength, maxThreads,
truststoreAlgorithm, tcpNoDelay, algorithm, keepAliveTimeout,
maxKeepAliveRequests, localPort, t
ruststoreProvider, acceptorThreadCount, soTimeout, daemon, minSpareThreads,
sSLDisableSessionTickets, sessionCacheSize, acceptorThreadPriority, backlog,
port, maxHeaderCount, sSLCARevocationPath, keystoreType, name, sslProtocol,
soLinger, sessionTi
meout, useComet, sSLVerifyDepth, clientAuth, modelerType, sSLCertificateFile,
connectionCount, sendfileThreadCount, threadPriority, running,
executorTerminationTimeoutMillis, allowUnsafeLegacyRenegotiation,
sslEnabledProtocolsArray, jniSslContext,
ciphers, truststorePass, sSLEnabled, sendfileSize, maxThreadsWithExecutor,
crlFile, sSLVerifyClient, maxConnections, keystoreProvider, keepAliveCount,
sSLCipherSuite, deferAccept, sSLDisableCompression, useSendfile,
sSLCertificateChainFile, sSLCACe
rtificateFile, ciphersUsed, keyPass, bindOnInit, sSLInsecureRenegotiation,
truststoreFile, keystoreFile, useServerCipherSuitesOrder]': Fail:
java.rmi.UnmarshalException: error unmarshalling return; nested exception is:
java.io.WriteAbortedException: writing aborted;
java.io.NotSerializableException: org.apache.tomcat.util.net.SocketProperties


I have successfully tested a trivial patch that simply makes socketProperties
protected instead of public - this does not seem to have negative consequences
at least in the environment I tested it in (Tomcat 8.0.53 as shipped in SUSE
Linux Enterprise Server 12 SP3). Patch is attached to this bug.


I do not really know Tomcat (and not even JMX, to be honest) to know if this
patch is really acceptable or if it's really oversimplified, as this is my
first contribution!


[1] https://prometheus.io/
[2] https://github.com/prometheus/jmx_exporter
[3]
https://github.com/prometheus/jmx_exporter/issues/265#issuecomment-383614412

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Re: Mime types

2018-10-31 Thread Igal Sapir

On 10/31/2018 12:50 PM, Rémy Maucherat wrote:

On Wed, Oct 31, 2018 at 8:16 PM Konstantin Kolinko 
wrote:


ср, 31 окт. 2018 г. в 19:38, Rémy Maucherat :

Hi,

There are two main contraptions in Tomcat that do (badly ...) extension tomime 
type mapping: the shared web.xml and some hardcoded stuff in
startup.Tomcat.

While we should obviously have support for user configured mime types in
web.xml, as it's the spec, there should be a possibility to use
Files.probeContentType as the fallback when a mime type isn't found (and
maybe also have an option to disable it ? - although I don't quite see why it 
would bother anyone). After looking at its implementation, it looks into all 
mime type locations we might want (the OS, a mime.types file, etc).  Theonly 
problem is that it uses a Path (that would be an issue since it's
super tied to a real filesystem), but thankfully it mostly uses toSting and 
thus can be worked around using a new fake Path implementation.

The code calling Files.probeContentType could be inserted here in
DefaultServlet:
 // Find content type.
 String contentType = resource.getMimeType();
 if (contentType == null) {
 contentType =
getServletContext().getMimeType(resource.getName());
--->
 resource.setMimeType(contentType);
 }

And then all the badly maintained content from web.xml and the Tomcat class can 
be deleted.

Comments ?

1. "badly maintained content from web.xml"

Do not call them "bad".


Ok, but they didn't look too good. My mime.types has a lot more types for
starters, and it's so big I don't feel like adding all that.


AFAIK, Those are synchronized with httpd. IIRC there was python script
to check the sync. Technically, it should be possible to sync with
IANA registry.

(I do not remember the details - those should be easy to find in the
archives of this mailing list. I just remember that the last time that
the sync was checked, there was some good job done to automate and
perform the check.)

Who maintains the mappings used Files.probeContentType and why do you
think that those are maintained any better?

I remember we had a number of BZs asking to add or fix mime mappings.  Annoying.


If an OS is an LTS one, are mime-mapping configurations in the OS
updated as the time goes?

Well, ultimately the guy can still add its new mapping in web.xml. Just the
basic usual ones don't need to be there.


It should be possible to write a JUnit test to keep the mappings in
startup.Tomcat.DEFAULT_MIME_MAPPINGS in sync with the default web.xml
file.

2. web.xml is portable between operating systems.

I would expect surprises from Files.probeContentType()

Looking at javadocs, FileTypeDetector is pluggable,
and the default behaviour is os-dependent


https://docs.oracle.com/javase/8/docs/api/java/nio/file/Files.html#probeContentType-java.nio.file.Path-

https://docs.oracle.com/javase/8/docs/api/java/nio/file/spi/FileTypeDetector.html

3, My own story: I had to remove the default mime-type mapping for
"gz" from conf/web.xml in my configurations:

For filenames like "filename.foo.gz" it is "foo" part that determines
the mime-type for me. This cannot be configured in web.xml. I use a
filter (urlrewrite) to set content-type for requests to those files.

Generally, configuring a Filter should have been enough. But there is
a bug in the DefaultServlet that it does not respect the content-type
that has already been set on the response and blindly overwrites it.
Unless I remove the default mapping for "gz", the content-type value
set by a filter is overwritten.

Unless DefaultServlet behaviour is fixed, enabling probeContentType is
likely to break my configurations.


How about allowing to remove a Mime type by mapping it to an empty 
string?  That way you would only need to override that one in your 
Application's web.xml.


Would that work?


4. I see a similarity to mod_mime_magic module of HTTPD.

http://httpd.apache.org/docs/current/mod/mod_mime.html
http://httpd.apache.org/docs/current/mod/mod_mime_magic.html

(For some reason I though that mod_mime_magic uses the magic file from
Unix OS.
Actually it uses its own magic file from configuration of HTTPD,
configured by directive "MimeMagicFile".
So it is actually portable.)

MimeMagicFile directive is disabled by default.

http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/conf/httpd.conf.in?view=markup#l330

Performance =?
The documentation of mod_mime_magic says that performance is a concern
for this module.


The lookup will only happen for unknown types, and as Remy said they 
will be cached so I don't think that performance is an issue here.




No idea really, probeContentType checks a number of sources [on Fedora it
is: new GnomeFileTypeDetector(), new
MimeTypesFileTypeDetector(userMimeTypes), new
MimeTypesFileTypeDetector(etcMimeTypes), new MagicFileTypeDetector()], and
it is platform dependent as you say. The result is then cached into the
resource in Tomcat, so it should be 

Re: Mime types

2018-10-31 Thread Rémy Maucherat
On Wed, Oct 31, 2018 at 8:16 PM Konstantin Kolinko 
wrote:

> ср, 31 окт. 2018 г. в 19:38, Rémy Maucherat :
> >
> > Hi,
> >
> > There are two main contraptions in Tomcat that do (badly ...) extension
> to
> > mime type mapping: the shared web.xml and some hardcoded stuff in
> > startup.Tomcat.
> >
> > While we should obviously have support for user configured mime types in
> > web.xml, as it's the spec, there should be a possibility to use
> > Files.probeContentType as the fallback when a mime type isn't found (and
> > maybe also have an option to disable it ? - although I don't quite see
> why
> > it would bother anyone). After looking at its implementation, it looks
> into
> > all mime type locations we might want (the OS, a mime.types file, etc).
> The
> > only problem is that it uses a Path (that would be an issue since it's
> > super tied to a real filesystem), but thankfully it mostly uses toSting
> and
> > thus can be worked around using a new fake Path implementation.
> >
> > The code calling Files.probeContentType could be inserted here in
> > DefaultServlet:
> > // Find content type.
> > String contentType = resource.getMimeType();
> > if (contentType == null) {
> > contentType =
> > getServletContext().getMimeType(resource.getName());
> > --->
> > resource.setMimeType(contentType);
> > }
> >
> > And then all the badly maintained content from web.xml and the Tomcat
> class
> > can be deleted.
> >
> > Comments ?
>
> 1. "badly maintained content from web.xml"
>
> Do not call them "bad".
>

Ok, but they didn't look too good. My mime.types has a lot more types for
starters, and it's so big I don't feel like adding all that.

>
> AFAIK, Those are synchronized with httpd. IIRC there was python script
> to check the sync. Technically, it should be possible to sync with
> IANA registry.
>
> (I do not remember the details - those should be easy to find in the
> archives of this mailing list. I just remember that the last time that
> the sync was checked, there was some good job done to automate and
> perform the check.)
>
> Who maintains the mappings used Files.probeContentType and why do you
> think that those are maintained any better?
>

I remember we had a number of BZs asking to add or fix mime mappings.
Annoying.

>
> If an OS is an LTS one, are mime-mapping configurations in the OS
> updated as the time goes?
>

Well, ultimately the guy can still add its new mapping in web.xml. Just the
basic usual ones don't need to be there.

>
> It should be possible to write a JUnit test to keep the mappings in
> startup.Tomcat.DEFAULT_MIME_MAPPINGS in sync with the default web.xml
> file.
>
> 2. web.xml is portable between operating systems.
>
> I would expect surprises from Files.probeContentType()
>
> Looking at javadocs, FileTypeDetector is pluggable,
> and the default behaviour is os-dependent
>
>
> https://docs.oracle.com/javase/8/docs/api/java/nio/file/Files.html#probeContentType-java.nio.file.Path-
>
> https://docs.oracle.com/javase/8/docs/api/java/nio/file/spi/FileTypeDetector.html
>
> 3, My own story: I had to remove the default mime-type mapping for
> "gz" from conf/web.xml in my configurations:
>
> For filenames like "filename.foo.gz" it is "foo" part that determines
> the mime-type for me. This cannot be configured in web.xml. I use a
> filter (urlrewrite) to set content-type for requests to those files.
>
> Generally, configuring a Filter should have been enough. But there is
> a bug in the DefaultServlet that it does not respect the content-type
> that has already been set on the response and blindly overwrites it.
> Unless I remove the default mapping for "gz", the content-type value
> set by a filter is overwritten.
>
> Unless DefaultServlet behaviour is fixed, enabling probeContentType is
> likely to break my configurations.
>
> 4. I see a similarity to mod_mime_magic module of HTTPD.
>
> http://httpd.apache.org/docs/current/mod/mod_mime.html
> http://httpd.apache.org/docs/current/mod/mod_mime_magic.html
>
> (For some reason I though that mod_mime_magic uses the magic file from
> Unix OS.
> Actually it uses its own magic file from configuration of HTTPD,
> configured by directive "MimeMagicFile".
> So it is actually portable.)
>
> MimeMagicFile directive is disabled by default.
>
> http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/conf/httpd.conf.in?view=markup#l330
>
> Performance =?
> The documentation of mod_mime_magic says that performance is a concern
> for this module.
>

No idea really, probeContentType checks a number of sources [on Fedora it
is: new GnomeFileTypeDetector(), new
MimeTypesFileTypeDetector(userMimeTypes), new
MimeTypesFileTypeDetector(etcMimeTypes), new MagicFileTypeDetector()], and
it is platform dependent as you say. The result is then cached into the
resource in Tomcat, so it should be "ok" performance wise. The question is:
besides the default servlet not respecting a possibly set content-type (I
have not 

Re: Mime types

2018-10-31 Thread Konstantin Kolinko
ср, 31 окт. 2018 г. в 19:38, Rémy Maucherat :
>
> Hi,
>
> There are two main contraptions in Tomcat that do (badly ...) extension to
> mime type mapping: the shared web.xml and some hardcoded stuff in
> startup.Tomcat.
>
> While we should obviously have support for user configured mime types in
> web.xml, as it's the spec, there should be a possibility to use
> Files.probeContentType as the fallback when a mime type isn't found (and
> maybe also have an option to disable it ? - although I don't quite see why
> it would bother anyone). After looking at its implementation, it looks into
> all mime type locations we might want (the OS, a mime.types file, etc). The
> only problem is that it uses a Path (that would be an issue since it's
> super tied to a real filesystem), but thankfully it mostly uses toSting and
> thus can be worked around using a new fake Path implementation.
>
> The code calling Files.probeContentType could be inserted here in
> DefaultServlet:
> // Find content type.
> String contentType = resource.getMimeType();
> if (contentType == null) {
> contentType =
> getServletContext().getMimeType(resource.getName());
> --->
> resource.setMimeType(contentType);
> }
>
> And then all the badly maintained content from web.xml and the Tomcat class
> can be deleted.
>
> Comments ?

1. "badly maintained content from web.xml"

Do not call them "bad".

AFAIK, Those are synchronized with httpd. IIRC there was python script
to check the sync. Technically, it should be possible to sync with
IANA registry.

(I do not remember the details - those should be easy to find in the
archives of this mailing list. I just remember that the last time that
the sync was checked, there was some good job done to automate and
perform the check.)

Who maintains the mappings used Files.probeContentType and why do you
think that those are maintained any better?

If an OS is an LTS one, are mime-mapping configurations in the OS
updated as the time goes?

It should be possible to write a JUnit test to keep the mappings in
startup.Tomcat.DEFAULT_MIME_MAPPINGS in sync with the default web.xml
file.

2. web.xml is portable between operating systems.

I would expect surprises from Files.probeContentType()

Looking at javadocs, FileTypeDetector is pluggable,
and the default behaviour is os-dependent

https://docs.oracle.com/javase/8/docs/api/java/nio/file/Files.html#probeContentType-java.nio.file.Path-
https://docs.oracle.com/javase/8/docs/api/java/nio/file/spi/FileTypeDetector.html

3, My own story: I had to remove the default mime-type mapping for
"gz" from conf/web.xml in my configurations:

For filenames like "filename.foo.gz" it is "foo" part that determines
the mime-type for me. This cannot be configured in web.xml. I use a
filter (urlrewrite) to set content-type for requests to those files.

Generally, configuring a Filter should have been enough. But there is
a bug in the DefaultServlet that it does not respect the content-type
that has already been set on the response and blindly overwrites it.
Unless I remove the default mapping for "gz", the content-type value
set by a filter is overwritten.

Unless DefaultServlet behaviour is fixed, enabling probeContentType is
likely to break my configurations.

4. I see a similarity to mod_mime_magic module of HTTPD.

http://httpd.apache.org/docs/current/mod/mod_mime.html
http://httpd.apache.org/docs/current/mod/mod_mime_magic.html

(For some reason I though that mod_mime_magic uses the magic file from Unix OS.
Actually it uses its own magic file from configuration of HTTPD,
configured by directive "MimeMagicFile".
So it is actually portable.)

MimeMagicFile directive is disabled by default.
http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/conf/httpd.conf.in?view=markup#l330

Performance =?
The documentation of mod_mime_magic says that performance is a concern
for this module.

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840629 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840629
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:07:56 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:07:56 2018
@@ -1 +1,2 @@
 Tab police
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1841463 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1841463
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:08:12 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:08:12 2018
@@ -2,3 +2,4 @@ Silence compiler warning (unused variabl
 
 The variable is a leftover from the r1840588
 refactoring.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840610 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840610
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:07:41 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:07:41 2018
@@ -1 +1,2 @@
 With the improvements in path parameter handling for the mapping phase, ensure 
the original URI - with the parameters - is used as the basis for the URI 
passed to Tomcat.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840604 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840604
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:07:28 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:07:28 2018
@@ -1 +1,2 @@
 Fix typo
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840603 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840603
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:07:15 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:07:15 2018
@@ -1 +1,2 @@
 IIS: Improve path parameter handling so that strip_session can remove session 
IDs that are specified on path parameters in any segment of the URI rather than 
only the final segment.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840592 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840592
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:07:01 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:07:01 2018
@@ -1 +1,2 @@
 Tweak patch to make Windows build happy.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840588 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840588
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:06:44 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:06:44 2018
@@ -1 +1,2 @@
 Apache: Improve path parameter handling so that JkStripSession can remove 
session IDs that are specified on path parameters in any segment of the URI 
rather than only the final segment.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840491 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840491
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:06:28 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:06:28 2018
@@ -1 +1,2 @@
 Make extract of session ID from path parameters more robust.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840450 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840450
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:06:02 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:06:02 2018
@@ -1,2 +1,3 @@
 Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=62689
 Correct regression in 1.2.44 that broke request handling for "OPTIONS *" 
requests. (rjung)
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840451 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840451
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:06:15 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:06:15 2018
@@ -1 +1,2 @@
 Let the webserver know about normalized URLs used for worker mapping but use 
the original URL when doing the final forwarding.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840449 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840449
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:05:43 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:05:43 2018
@@ -1 +1,2 @@
 Optimize handling of request_config.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840445 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840445
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:05:14 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:05:14 2018
@@ -1 +1,2 @@
 Optimize path parameter handling, by centralizing it in jk_servlet_normalize() 
and removing it from map_uri_to_worker_ext()
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840448 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840448
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:05:28 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:05:28 2018
@@ -1 +1,2 @@
 Change return code for bad request paths to the more appropriate 
HTTP_BAD_REQUEST.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1840444 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1840444
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:04:50 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:04:50 2018
@@ -1 +1,2 @@
 Minor logging performance optimization
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1838882 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1838882
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:04:29 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:04:29 2018
@@ -1 +1,2 @@
 Fix compilation for IIS
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1838871 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1838871
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:04:11 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:04:11 2018
@@ -1 +1,2 @@
 Remove unnecessary processing of CollapseSlashes option
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1838836 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1838836
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:03:33 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:03:33 2018
@@ -1 +1,2 @@
 Refactor normalisation of request URIs to a common location and align the 
normalisation implementation for mod_jk with that implemented by Tomcat.
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn propchange: r1838857 - svn:log

2018-10-31 Thread markt
Author: markt
Revision: 1838857
Modified property: svn:log

Modified: svn:log at Wed Oct 31 19:03:55 2018
--
--- svn:log (original)
+++ svn:log Wed Oct 31 19:03:55 2018
@@ -1 +1,2 @@
 Further normalization clean-up
+This is part of the fix for CVE-2018-11759


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



[SECURITY] CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal

2018-10-31 Thread Mark Thomas

CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
- Apache Tomcat JK mod_jk Connector 1.2.0 to 1.2.44

Description:
The Apache Web Server (httpd) specific code that normalised the 
requested path before matching it to the URI-worker map did not handle 
some edge cases correctly. If only a sub-set of the URLs supported by 
Tomcat were exposed via httpd, then it was possible for a specially 
constructed request to expose application functionality through the 
reverse proxy that was not intended for clients accessing the 
application via the reverse proxy. It was also possible in some 
configurations for a specially constructed request to bypass the access 
controls configured in httpd.
While there is some overlap between this issue and CVE-2018-1323, they 
are not identical.


Mitigation:
Users of affected versions should apply one of the following mitigations:
- Upgrade to Apache Tomcat JK ISAPI Connector 1.2.46 or later.
- Use alternative measures (e.g. the remote address filter) to restrict
  access to trusted users.

Credit:
This issue was first discovered by Alphan YAVAS from Biznet Bilisim A.S. 
and reported responsibly to the Apache Tomcat Security Team. Additional 
attack vectors were identified by Raphaël Arrouas (Xel) and Jean Lejeune 
(Nitrax) from immunIT.



References:
[1] http://tomcat.apache.org/security-jk.html

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1845353 - in /tomcat/site/trunk: docs/security-jk.html xdocs/security-jk.xml

2018-10-31 Thread markt
Author: markt
Date: Wed Oct 31 17:44:50 2018
New Revision: 1845353

URL: http://svn.apache.org/viewvc?rev=1845353=rev
Log:
Add information for CVE-2018-11759

Modified:
tomcat/site/trunk/docs/security-jk.html
tomcat/site/trunk/xdocs/security-jk.xml

Modified: tomcat/site/trunk/docs/security-jk.html
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-jk.html?rev=1845353=1845352=1845353=diff
==
--- tomcat/site/trunk/docs/security-jk.html (original)
+++ tomcat/site/trunk/docs/security-jk.html Wed Oct 31 17:44:50 2018
@@ -214,6 +214,9 @@
 Apache Tomcat JK 
Connectors vulnerabilities
 
 
+Fixed in Apache Tomcat 
JK Connector 1.2.46
+
+
 Fixed in Apache Tomcat 
JK Connector 1.2.43
 
 
@@ -256,6 +259,61 @@
 
   
 
+Fixed in Apache Tomcat JK 
Connector 1.2.46
+
+
+
+
+Note: The issue below was fixed in Apache Tomcat JK Connector 1.2.45
+   but the release vote for the 1.2.45 release candidate did not pass.
+   Therefore, although users must download 1.2.46 to obtain a version that
+   includes the fix for this issue, version 1.2.45 is not included in the
+   list of affected versions.
+
+
+
+
+Important: Information disclosure
+   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11759; 
rel="nofollow">CVE-2018-11759
+
+
+
+The Apache Web Server (httpd) specific code that normalised the requested 
+   path before matching it to the URI-worker map did not handle some edge
+   cases correctly. If only a sub-set of the URLs supported by Tomcat were
+   exposed via httpd, then it was possible for a specially constructed
+   request to expose application functionality through the reverse proxy
+   that was not intended for clients accessing the application via the
+   reverse proxy. It was also possible in some configurations for a
+   specially constructed request to bypass the access controls configured 
in
+   httpd. While there is some overlap between this issue and CVE-2018-1323,
+   they are not identical.
+
+
+This was fixed in revisions http://svn.apache.org/viewvc?view=revrev=1838836;>1838836,
+   http://svn.apache.org/viewvc?view=revrev=1838857;>1838857,
+   http://svn.apache.org/viewvc?view=revrev=1838871;>1838871,
+   http://svn.apache.org/viewvc?view=revrev=1838882;>1838882,
+   http://svn.apache.org/viewvc?view=revrev=1840444;>1840444,
+   http://svn.apache.org/viewvc?view=revrev=1840445;>1840445,
+   http://svn.apache.org/viewvc?view=revrev=1840448;>1840448,
+   http://svn.apache.org/viewvc?view=revrev=1840449;>1840449,
+   http://svn.apache.org/viewvc?view=revrev=1840450;>1840450,
+   http://svn.apache.org/viewvc?view=revrev=1840451;>1840451,
+   http://svn.apache.org/viewvc?view=revrev=1840491;>1840491,
+   http://svn.apache.org/viewvc?view=revrev=1840588;>1840588,
+   http://svn.apache.org/viewvc?view=revrev=1840592;>1840592,
+   http://svn.apache.org/viewvc?view=revrev=1840603;>1840603,
+   http://svn.apache.org/viewvc?view=revrev=1840604;>1840604,
+   http://svn.apache.org/viewvc?view=revrev=1840610;>1840610,
+   http://svn.apache.org/viewvc?view=revrev=1840629;>1840629 and
+   http://svn.apache.org/viewvc?view=revrev=1841463;>1841463.
+
+
+Affects: JK 1.2.0-1.2.44
+
+  
+
 Fixed in Apache Tomcat JK 
Connector 1.2.43
 
 

Modified: tomcat/site/trunk/xdocs/security-jk.xml
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-jk.xml?rev=1845353=1845352=1845353=diff
==
--- tomcat/site/trunk/xdocs/security-jk.xml (original)
+++ tomcat/site/trunk/xdocs/security-jk.xml Wed Oct 31 17:44:50 2018
@@ -28,6 +28,51 @@
 
   
 
+  
+
+Note: The issue below was fixed in Apache Tomcat JK Connector 1.2.45
+   but the release vote for the 1.2.45 release candidate did not pass.
+   Therefore, although users must download 1.2.46 to obtain a version that
+   includes the fix for this issue, version 1.2.45 is not included in the
+   list of affected versions.
+
+Important: Information disclosure
+   CVE-2018-11759
+
+The Apache Web Server (httpd) specific code that normalised the 
requested 
+   path before matching it to the URI-worker map did not handle some edge
+   cases correctly. If only a sub-set of the URLs supported by Tomcat were
+   exposed via httpd, then it was possible for a specially constructed
+   request to expose application functionality through the reverse proxy
+   that was not intended for clients accessing the application via the
+   reverse proxy. It was also possible in some configurations for a
+   specially constructed request to bypass the access controls configured 
in
+   httpd. While there is some overlap between this issue and CVE-2018-1323,
+   they are not identical.
+
+This was 

Mime types

2018-10-31 Thread Rémy Maucherat
Hi,

There are two main contraptions in Tomcat that do (badly ...) extension to
mime type mapping: the shared web.xml and some hardcoded stuff in
startup.Tomcat.

While we should obviously have support for user configured mime types in
web.xml, as it's the spec, there should be a possibility to use
Files.probeContentType as the fallback when a mime type isn't found (and
maybe also have an option to disable it ? - although I don't quite see why
it would bother anyone). After looking at its implementation, it looks into
all mime type locations we might want (the OS, a mime.types file, etc). The
only problem is that it uses a Path (that would be an issue since it's
super tied to a real filesystem), but thankfully it mostly uses toSting and
thus can be worked around using a new fake Path implementation.

The code calling Files.probeContentType could be inserted here in
DefaultServlet:
// Find content type.
String contentType = resource.getMimeType();
if (contentType == null) {
contentType =
getServletContext().getMimeType(resource.getName());
--->
resource.setMimeType(contentType);
}

And then all the badly maintained content from web.xml and the Tomcat class
can be deleted.

Comments ?

Rémy


[GitHub] tomcat pull request #129: Fix typo in Spanish translation

2018-10-31 Thread markt-asf
Github user markt-asf closed the pull request at:

https://github.com/apache/tomcat/pull/129


---

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



[GitHub] tomcat issue #129: Fix typo in Spanish translation

2018-10-31 Thread markt-asf
Github user markt-asf commented on the issue:

https://github.com/apache/tomcat/pull/129
  
Thanks. Patch applied to 9.0.x, 8.5.x and 7.0.x for the next release of 
each.


---

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1845340 - in /tomcat/tc7.0.x/trunk: ./ java/org/apache/catalina/connector/LocalStrings_es.properties webapps/docs/changelog.xml

2018-10-31 Thread markt
Author: markt
Date: Wed Oct 31 15:27:17 2018
New Revision: 1845340

URL: http://svn.apache.org/viewvc?rev=1845340=rev
Log:
Correct a typo in the Spanish resource files.
Patch provided by Diego Agulló.

Modified:
tomcat/tc7.0.x/trunk/   (props changed)

tomcat/tc7.0.x/trunk/java/org/apache/catalina/connector/LocalStrings_es.properties
tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc7.0.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Wed Oct 31 15:27:17 2018
@@ -1,3 +1,3 @@
 
/tomcat/tc8.0.x/trunk:1636525,1637336,1637685,1637709,1638726,1640089,1640276,1640349,1640363,1640366,1640642,1640672,1640674,1640689,1640884,1641001,1641065,1641067,1641375,1641638,1641723,1641726,1641729-1641730,1641736,1641988,1642669-1642670,1642698,1642701,1643205,1643215,1643217,1643230,1643232,1643273,1643285,1643329-1643330,1643511,1643513,1643521,1643539,1643571,1643581-1643582,1643635,1643655,1643738,1643964,1644018,1644333,1644525,1644954,1644992,1645014,1645360,1645456,1645627,1645642,1645686,1645903-1645904,1645908-1645909,1645913,1645920,1646458,1646460-1646462,1646735,1646738-1646741,1646744,1646746,1646748-1646755,1646757,1646759-1646760,1647043,1648816,1651420-1651422,1651844,1652926,1652939-1652940,1652973,1653798,1653817,1653841,1654042,1654161,1654736,1654767,1654787,1656592,1659907,1662986,1663265,1663278,1663325,1663535,1663567,1663679,1663997,1664175,1664321,1664872,1665061,1665086,1666027,1666395,1666503,1666506,1666560,1666570,1666581,1666759,1666967,1666988
 
,1667553-1667555,1667558,1667617,1667633,1667637,1667747,1667767,1667873,1668028,1668137,1668634,1669432,1669801,1669840,1669895-1669896,1670398,1670435,1670592,1670605-1670607,1670609,1670632,1670720,1670725,1670727,1670731,1671114,1672273,1672285,1673759,1674220,1674295,1675469,1675488,1675595,1675831,1676232,1676367-1676369,1676382,1676394,1676483,1676556,1676635,1678178,1679536,1679988,1680256,1681124,1681182,1681703,1681730,1681840,1681864,1681869,1682010,1682034,1682047,1682052-1682053,1682062,1682064,1682070,1682312,1682325,1682331,1682386,1684367,1684385,1685759,1685774,1685827,1685892,1687341,1688904,1689358,1689657,1689921,1692850,1693093,1693108,1693324,1694060,1694115,1694291,1694427,1694431,1694503,1694549,1694789,1694873,1694881,1695356,1695372,1695823-1695825,1696200,1696281,1696379,1696468,1700608,1700871,1700897,1700978,1701094,1701124,1701608,1701668,1701676,1701766,1701944,1702248,1702252,1702314,1702390,1702723,1702725,1702728,1702730,1702733,1702735,1702737,1702
 
739,1702742,1702744,1702748,1702751,1702754,1702758,1702760,1702763,1702766,1708779,1708782,1708806,1709314,1709670,1710347,1710442,1710448,1710490,1710574,1710578,1712226,1712229,1712235,1712255,1712618,1712649,1712655,1712860,1712899,1712903,1712906,1712913,1712926,1712975,1713185,1713262,1713287,1713613,1713621,1713872,1713976,1713994,1713998,1714004,1714013,1714059,1714538,1714580,1715189,1715207,1715544,1715549,1715637,1715639-1715645,1715667,1715683,1715866,1715978,1715981,1716216-1716217,1716355,1716414,1716421,1717208-1717209,1717257,1717283,1717288,1717291,1717421,1717517,1717529,1718797,1718840-1718843,1719348,1719357-1719358,1719400,1719491,1719737,1720235,1720396,1720442,1720446,1720450,1720463,1720658-1720660,1720756,1720816,1721813,1721818,1721831,1721861,1721867,1721882,1722523,1722527,1722800,1722926,1722941,1722997,1723130,1723440,1723488,1723890,1724434,1724674,1724792,1724803,1724902,1725128,1725131,1725154,1725167,1725911,1725921,1725929,1725963-1725965,1725970,1
 
725974,1726171-1726173,1726175,1726179-1726182,1726190-1726191,1726195-1726200,1726203,1726226,1726576,1726630,1726992,1727029,1727037,1727671,1727676,1727900,1728028,1728092,1728439,1728449,1729186,1729362,1731009,1731303,1731867,1731872,1731874,1731876,1731885,1731947,1731955,1731959,1731977,1731984,1732360,1732490,1732672,1732902,1733166,1733603,1733619,1733735,1733752,1733764,1733915,1733941,1733964,1734115,1734133,1734261,1734421,1734531,1736286,1737967,1738173,1738182,1738992,1739039,1739089-1739091,1739294,1739777,1739821,1739981,1740513,1740726,1741019,1741162,1741217,1743647,1743681,1744152,1744272,1746732,1746750,1752739,1754615,1755886,1756018,1758563,1759565,1761686,1762173,1762206,1766280,1767507-1767508,1767653,1767656,1769267,1772949,1773521,1773527,1774104,1777015,1777213,1779330,1783151,1784188,1784966,1785670,1786846,1788260,1788999,1789140,1789402,1791529,1791559,1795291,1796906,1797523,1799214,1800998-1800999,1801003,1801007-1801008,1801017,1801020,1802808,180281
 

svn commit: r1845339 - in /tomcat/tc8.5.x/trunk: ./ java/org/apache/catalina/connector/LocalStrings_es.properties webapps/docs/changelog.xml

2018-10-31 Thread markt
Author: markt
Date: Wed Oct 31 15:26:21 2018
New Revision: 1845339

URL: http://svn.apache.org/viewvc?rev=1845339=rev
Log:
Correct a typo in the Spanish resource files.
Patch provided by Diego Agulló.

Modified:
tomcat/tc8.5.x/trunk/   (props changed)

tomcat/tc8.5.x/trunk/java/org/apache/catalina/connector/LocalStrings_es.properties
tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml

Propchange: tomcat/tc8.5.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Wed Oct 31 15:26:21 2018
@@ -1,2 +1,2 @@
 /tomcat/tc8.0.x/trunk:1809644
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737903,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739492,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409
 
,1741501,1741677,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268,1742276,1742369,1742387,1742448,1742509-1742512,1742917,1742919,1742933,1742975-1742976,1742984,1742986,1743019,1743115,1743117,1743124-1743125,1743134,1743425,1743554,1743679,1743696-1743698,1743700-1743701,1744058,1744064-1744065,1744125,1744149,1744194,1744229,1744270,1744323,1744432,1744684,1744697,1744705,1744713,1744760,1744786,1745083,1745142-1745143,1745145,1745177,1745179-1745180,1745227,1745248,1745254,1745337,1745467,1745473,1745535,1745576,1745735,1745744,1746304,1746306-1746307,1746319,1746327,1746338,1746340-1746341,1746344,1746427,1746441,1746473,1746490,1746492,1746495-1746496,1746499-1746501,1746503-1746507,1746509,1746549,1746551,1746554,1746556,1746558,1746584,1746620,1746649,1746724,1746939,1746989,1747014,1747028,1747035,1747210,1747225,1747234,1747253,1747
 
404,1747506,1747536,1747924,1747980,1747993,1748001,1748253,1748452,1748547,1748629,1748676,1748715,1749287,1749296,1749328,1749373,1749465,1749506,1749508,1749665-1749666,1749763,1749865-1749866,1749898,1749978,1749980,1750011,1750015,1750056,1750480,1750617,1750634,1750692,1750697,1750700,1750703,1750707,1750714,1750718,1750723,1750774,1750899,1750975,1750995,1751061,1751097,1751173,1751438,1751447,1751463,1751702,1752212,1752737,1752745,1753078,1753080,1753358,1753363,1754111,1754140-1754141,1754281,1754310,1754445,1754467,1754494,1754496,1754528,1754532-1754533,1754613,1754714,1754874,1754941,1754944,1754950-1754951,1755005,1755007,1755009,1755132,1755180-1755181,1755185,1755190,1755204-1755206,1755208,1755214,1755224,1755227,1755230,1755629,1755646-1755647,1755650,1755653,1755675,1755680,1755683,1755693,1755717,1755731-1755737,1755812,1755828,1755884,1755890,1755918-1755919,1755942,1755958,1755960,1755970,1755993,1756013,1756019,1756039,1756056,1756083-1756114,1756175,1756288-1
 
756289,1756408-1756410,1756778,1756798,1756878,1756898,1756939,1757123-1757124,1757126,1757128,1757132-1757133,1757136,1757145,1757167-1757168,1757175,1757180,1757182,1757195,1757271,1757278,1757347,1757353-1757354,1757363,1757374,1757399,1757406,1757408,1757485,1757495,1757499,1757527,1757578,1757684,1757722,1757727,1757790,1757799,1757813,1757853,1757883,1757903,1757976,1757997,1758000,1758058,1758072-1758075,1758078-1758079,1758223,1758257,1758261,1758276,1758292,1758369,1758378-1758383,1758421,1758423,1758425-1758427,1758430,1758443,1758448,1758459,1758483,1758486-1758487,1758499,1758525,1758556,1758580,1758582,1758584,1758588,1758842,1759019,1759212,1759224,1759227,1759252,1759274,1759513-1759516,1759611,1759757,1759785-1759790,1760005,1760022,1760109-1760110,1760135,1760200-1760201,1760227,1760300,1760397,1760446,1760454,1760640,1760648,1761057,1761422,1761491,1761498,1761500-1761501,1761550,1761553,1761572,1761574,1761625-1761626,1761628,1761682,1761740,1761752,1762051-176205
 

svn commit: r1845338 - in /tomcat/trunk: java/org/apache/catalina/connector/LocalStrings_es.properties webapps/docs/changelog.xml

2018-10-31 Thread markt
Author: markt
Date: Wed Oct 31 15:24:53 2018
New Revision: 1845338

URL: http://svn.apache.org/viewvc?rev=1845338=rev
Log:
Correct a typo in the Spanish resource files.
Patch provided by Diego Agulló.

Modified:
tomcat/trunk/java/org/apache/catalina/connector/LocalStrings_es.properties
tomcat/trunk/webapps/docs/changelog.xml

Modified: 
tomcat/trunk/java/org/apache/catalina/connector/LocalStrings_es.properties
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/connector/LocalStrings_es.properties?rev=1845338=1845337=1845338=diff
==
--- tomcat/trunk/java/org/apache/catalina/connector/LocalStrings_es.properties 
[UTF-8] (original)
+++ tomcat/trunk/java/org/apache/catalina/connector/LocalStrings_es.properties 
[UTF-8] Wed Oct 31 15:24:53 2018
@@ -30,7 +30,7 @@ coyoteAdapter.accesslogFail = Excepción
 # CoyoteResponse
 coyoteResponse.getOutputStream.ise = getWriter() ya ha sido llamado para esta 
respuesta
 coyoteResponse.getWriter.ise = getOutputStream() ya ha sido llamado para esta 
respuesta
-coyoteResponse.resetBuffer.ise = No puedo limpiar el búfer después de que la 
repuesta ha sido llevada a cabo
+coyoteResponse.resetBuffer.ise = No puedo limpiar el búfer después de que la 
respuesta ha sido llevada a cabo
 coyoteResponse.sendError.ise = No puedo llamar a sendError() tras llevar a 
cabo la respuesta
 coyoteResponse.sendRedirect.ise = No puedo llamar a sendRedirect() tras llevar 
a cabo la respuesta
 coyoteResponse.setBufferSize.ise = No puedo cambiar la medida del búfer tras 
escribir los datos

Modified: tomcat/trunk/webapps/docs/changelog.xml
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1845338=1845337=1845338=diff
==
--- tomcat/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/trunk/webapps/docs/changelog.xml Wed Oct 31 15:24:53 2018
@@ -137,6 +137,10 @@
 to Tomcat clustering regardless of the type of cluster manager
 or membership being used. (schultz)
   
+  
+Correct a typo in the Spanish resource files. Patch provided by Diego
+Agulló. (markt)
+  
 
   
   



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



[Bug 62868] WebappClassLoaderBase getResources(String) is not ordered according to delegate flag

2018-10-31 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=62868

--- Comment #4 from Remy Maucherat  ---
I think that justifies keeping it open.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Re: JDK 12 Early Access build 15 is available

2018-10-31 Thread Rémy Maucherat
On Tue, Oct 30, 2018 at 7:12 PM Mark Thomas  wrote:

> Ah. More likely a JDK regression then.
>
>
After enabling it for NIO, it also fails. Works with an "older" 11-ea18 I
had, fails with 12-ea17. Basically it makes the 10 requests, but the
listener set with socket.addHandshakeCompletedListener is not getting
called. Otherwise the behavior is unchanged.

Rémy


Re: JDK 12 Early Access build 15 is available

2018-10-31 Thread Rory O'Donnell

Hi Mark,

Can you send us the JI-number when you get time to log a bug ?

Rgds,Rory


On 30/10/2018 17:42, Mark Thomas wrote:

FYI,

org.apache.tomcat.util.net.TestSsl.testRenegotiateWorks() is failing
consistently when running with the NIO2 connector.

It works with:
- Oracle JDK 1.8.0 update 192
- Oracle JDK 9.0.4
- Oracle JDK 10.0.2

It fails with:
- OpenJDK 11.0.1
- OpenJDK 12 ea17

First impression (based on the results above) is that there is a
regression somewhere in JSSE. On the other hand, it works with NIO with
all of the above versions which suggests a bug in NIO2.

I have not investigated this any further than simply running the test so
I have not (yet) opened a bug.

Mark


On 15/10/18 11:37, Rory O'Donnell wrote:

Hi Mark,

*JDK 12 Early Access build 15 is available at : - jdk.java.net/12/*

  * JDK 12 Schedule is confirmed.
  o 2018/12/13 Rampdown Phase One 
  o 2019/01/17 Rampdown Phase Two 
  o 2019/02/07 Release-Candidate Phase
    
  o 2019/03/19 General Availability
  * Release Notes for JDK 12 [1]
  * JEPs targeted to JDK 12, so far
  o 325: Switch Expressions (Preview [2]) - Integrated
  o 326: Raw String Literals (Preview [2]) - Integrated
  o 340: One AArch64 Port, Not Two
     - Targeted
  o 341: Default CDS Archives -
    Integrated
  * Important fixes since last email
  o (b15)  Implementation of JEP 341: Default CDS Archives
  o (b14) LDAPS Communication Failure (JDK-8211107
    )
  o (b14) Support dns_canonicalize_hostname in krb5.conf
    (JDK-8210821 )
  o (b14) Removal of com.sun.awt.SecurityWarning Class (JDK-8210692
    )


*JDK 8u202 planning [3]*

  * 8u202 is proposed to be the last Oracle led release for this OpenJDK
    Project.
  * A proposed timeline is as follows :
  o July 2018 8u-dev forest begins collecting 8u202 fixes
  o Mid October 2018 RampDown 2
  o Mid January 2019 GA

Rgds, Rory

[1] http://jdk.java.net/12/release-notes
[2] http://openjdk.java.net/jeps/12
[3]
http://mail.openjdk.java.net/pipermail/jdk8u-dev/2018-September/007923.html






--
Rgds,Rory O'Donnell
Quality Engineering Manager
Oracle EMEA , Dublin, Ireland


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org