[java-idp-tomcat-base] 01/02: Update from Tomcat 9.0.59 distribution
Tom Zeller
tzeller at dragonacea.biz
Fri Mar 11 14:28:04 UTC 2022
This is an automated email from the git hooks/post-receive script.
tzeller pushed a commit to branch 9.0
in repository java-idp-tomcat-base.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-tomcat-base.git;a=commit;h=4af5f19f1dac973bc3c74f53d3da0d43120ee17c
commit 4af5f19f1dac973bc3c74f53d3da0d43120ee17c
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Thu Mar 10 11:54:57 2022 -0600
Update from Tomcat 9.0.59 distribution
---
.../resources/tomcat-base/conf/catalina.policy | 10 +-
.../resources/tomcat-base/conf/catalina.properties | 12 +--
.../resources/tomcat-base/conf/logging.properties | 9 ++
src/main/resources/tomcat-base/conf/server.xml | 106 ++++++++++++++++-----
src/main/resources/tomcat-base/conf/web.xml | 37 ++++++-
5 files changed, 137 insertions(+), 37 deletions(-)
diff --git a/src/main/resources/tomcat-base/conf/catalina.policy b/src/main/resources/tomcat-base/conf/catalina.policy
index 51c390f..7aab95d 100644
--- a/src/main/resources/tomcat-base/conf/catalina.policy
+++ b/src/main/resources/tomcat-base/conf/catalina.policy
@@ -39,7 +39,7 @@ grant codeBase "file:${java.home}/jre/lib/ext/-" {
permission java.security.AllPermission;
};
-// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
+// These permissions apply to javac when ${java.home} points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/../lib/-" {
permission java.security.AllPermission;
};
@@ -50,9 +50,14 @@ grant codeBase "file:${java.home}/lib/ext/-" {
permission java.security.AllPermission;
};
+// This permission is required when using javac to compile JSPs on Java 9
+// onwards
+//grant codeBase "jrt:/jdk.compiler" {
+// permission java.security.AllPermission;
+//};
-// ========== CATALINA CODE PERMISSIONS =======================================
+// ========== CATALINA CODE PERMISSIONS =======================================
// These permissions apply to the daemon code
grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
@@ -84,7 +89,6 @@ grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
permission java.util.PropertyPermission "java.util.logging.config.class", "read";
permission java.util.PropertyPermission "java.util.logging.config.file", "read";
- permission java.util.PropertyPermission "org.apache.juli.AsyncLoggerPollInterval", "read";
permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read";
permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read";
permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
diff --git a/src/main/resources/tomcat-base/conf/catalina.properties b/src/main/resources/tomcat-base/conf/catalina.properties
index 407c150..c748df1 100644
--- a/src/main/resources/tomcat-base/conf/catalina.properties
+++ b/src/main/resources/tomcat-base/conf/catalina.properties
@@ -115,10 +115,9 @@ aspectj*.jar,\
bootstrap.jar,\
catalina-ant.jar,\
catalina-ha.jar,\
-catalina-jmx-remote.jar,\
+catalina-ssi.jar,\
catalina-storeconfig.jar,\
catalina-tribes.jar,\
-catalina-ws.jar,\
catalina.jar,\
cglib-*.jar,\
cobertura-*.jar,\
@@ -135,12 +134,14 @@ commons-lang*.jar,\
commons-logging*.jar,\
commons-math*.jar,\
commons-pool*.jar,\
+derby-*.jar,\
dom4j-*.jar,\
easymock-*.jar,\
ecj-*.jar,\
el-api.jar,\
geronimo-spec-jaxrpc*.jar,\
h2*.jar,\
+ha-api-*.jar,\
hamcrest-*.jar,\
hibernate*.jar,\
httpclient*.jar,\
@@ -150,6 +151,7 @@ jasper.jar,\
jaspic-api.jar,\
jaxb-*.jar,\
jaxen-*.jar,\
+jaxws-rt-*.jar,\
jdom-*.jar,\
jetty-*.jar,\
jmx-tools.jar,\
@@ -172,11 +174,7 @@ tagsoup-*.jar,\
tomcat-api.jar,\
tomcat-coyote.jar,\
tomcat-dbcp.jar,\
-tomcat-i18n-en.jar,\
-tomcat-i18n-es.jar,\
-tomcat-i18n-fr.jar,\
-tomcat-i18n-ja.jar,\
-tomcat-i18n-ru.jar,\
+tomcat-i18n-*.jar,\
tomcat-jdbc.jar,\
tomcat-jni.jar,\
tomcat-juli-adapters.jar,\
diff --git a/src/main/resources/tomcat-base/conf/logging.properties b/src/main/resources/tomcat-base/conf/logging.properties
index a2ad9c2..e8b7b16 100644
--- a/src/main/resources/tomcat-base/conf/logging.properties
+++ b/src/main/resources/tomcat-base/conf/logging.properties
@@ -25,21 +25,30 @@ handlers = 1catalina.org.apache.juli.AsyncFileHandler, 2localhost.org.apache.jul
1catalina.org.apache.juli.AsyncFileHandler.level = FINE
1catalina.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
1catalina.org.apache.juli.AsyncFileHandler.prefix = catalina.
+1catalina.org.apache.juli.AsyncFileHandler.maxDays = 90
+1catalina.org.apache.juli.AsyncFileHandler.encoding = UTF-8
2localhost.org.apache.juli.AsyncFileHandler.level = FINE
2localhost.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
2localhost.org.apache.juli.AsyncFileHandler.prefix = localhost.
+2localhost.org.apache.juli.AsyncFileHandler.maxDays = 90
+2localhost.org.apache.juli.AsyncFileHandler.encoding = UTF-8
3manager.org.apache.juli.AsyncFileHandler.level = FINE
3manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
3manager.org.apache.juli.AsyncFileHandler.prefix = manager.
+3manager.org.apache.juli.AsyncFileHandler.maxDays = 90
+3manager.org.apache.juli.AsyncFileHandler.encoding = UTF-8
4host-manager.org.apache.juli.AsyncFileHandler.level = FINE
4host-manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
4host-manager.org.apache.juli.AsyncFileHandler.prefix = host-manager.
+4host-manager.org.apache.juli.AsyncFileHandler.maxDays = 90
+4host-manager.org.apache.juli.AsyncFileHandler.encoding = UTF-8
java.util.logging.ConsoleHandler.level = FINE
java.util.logging.ConsoleHandler.formatter = org.apache.juli.OneLineFormatter
+java.util.logging.ConsoleHandler.encoding = UTF-8
############################################################
diff --git a/src/main/resources/tomcat-base/conf/server.xml b/src/main/resources/tomcat-base/conf/server.xml
index d9866ef..507f668 100644
--- a/src/main/resources/tomcat-base/conf/server.xml
+++ b/src/main/resources/tomcat-base/conf/server.xml
@@ -44,25 +44,43 @@
maxThreads="150" minSpareThreads="4"/>
-->
- <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
+
+ <!-- A "Connector" represents an endpoint by which requests are received
+ and responses are returned. Documentation at :
+ Java HTTP Connector: /docs/config/http.html
+ Java AJP Connector: /docs/config/ajp.html
+ APR (HTTP/AJP) Connector: /docs/apr.html
+ Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
+ -->
+ <!--
+ <Connector port="8080" protocol="HTTP/1.1"
+ connectionTimeout="20000"
+ redirectPort="8443" />
+ -->
+ <!-- A "Connector" using the shared thread pool-->
+ <!--
+ <Connector executor="tomcatThreadPool"
+ port="8080" protocol="HTTP/1.1"
+ connectionTimeout="20000"
+ redirectPort="8443" />
+ -->
+ <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
This connector uses the NIO implementation. The default
SSLImplementation will depend on the presence of the APR/native
- library and the useOpenSSL attribute of the
- AprLifecycleListener.
+ library and the useOpenSSL attribute of the AprLifecycleListener.
Either JSSE or OpenSSL style configuration may be used regardless of
the SSLImplementation selected. JSSE style configuration is used below.
-->
-
- <Connector port="${tomcat.https.port}" protocol="org.apache.coyote.http11.Http11NioProtocol"
- maxThreads="150" SSLEnabled="true" scheme="https" secure="true">
+ <!--
+ <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
+ maxThreads="150" SSLEnabled="true">
<SSLHostConfig>
- <Certificate certificateKeystoreFile="${tomcat.https.certificateKeystoreFile}"
- certificateKeystorePassword="${tomcat.https.certificateKeystorePassword}"
+ <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
type="RSA" />
</SSLHostConfig>
</Connector>
-
- <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
+ -->
+ <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
This connector uses the APR/native implementation which always uses
OpenSSL for TLS.
Either JSSE or OpenSSL style configuration may be used. OpenSSL style
@@ -81,21 +99,41 @@
</Connector>
-->
- <Connector port="${tomcat.backchannel.port}" protocol="org.apache.coyote.http11.Http11NioProtocol"
- maxThreads="150"
- maxPostSize="100000"
- SSLEnabled="true"
- scheme="https"
- secure="true"
- clientAuth="want"
- keystoreFile="${tomcat.backchannel.keystoreFile}"
- keystorePass="${tomcat.backchannel.keystorePass}"
- keystoreType="${tomcat.backchannel.keystoreType}"
- trustManagerClassName="net.shibboleth.utilities.ssl.TrustAnyCertificate" />
+ <Connector
+ port="${tomcat.https.port}"
+ protocol="org.apache.coyote.http11.Http11NioProtocol"
+ maxThreads="150"
+ SSLEnabled="true"
+ scheme="https"
+ secure="true">
+ <SSLHostConfig>
+ <Certificate
+ certificateKeystoreFile="${tomcat.https.certificateKeystoreFile}"
+ certificateKeystorePassword="${tomcat.https.certificateKeystorePassword}"
+ type="RSA" />
+ </SSLHostConfig>
+ </Connector>
+
+ <Connector
+ port="${tomcat.backchannel.port}"
+ protocol="org.apache.coyote.http11.Http11NioProtocol"
+ maxThreads="150"
+ maxPostSize="100000"
+ SSLEnabled="true"
+ scheme="https"
+ secure="true"
+ clientAuth="want"
+ keystoreFile="${tomcat.backchannel.keystoreFile}"
+ keystorePass="${tomcat.backchannel.keystorePass}"
+ keystoreType="${tomcat.backchannel.keystoreType}"
+ trustManagerClassName="net.shibboleth.utilities.ssl.TrustAnyCertificate" />
<!-- Define an AJP 1.3 Connector on port 8009 -->
<!--
- <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
+ <Connector protocol="AJP/1.3"
+ address="::1"
+ port="8009"
+ redirectPort="8443" />
-->
<!-- An Engine represents the entry point (within Catalina) that processes
@@ -109,9 +147,33 @@
-->
<Engine name="Catalina" defaultHost="localhost">
+ <!--For clustering, please take a look at documentation at:
+ /docs/cluster-howto.html (simple how to)
+ /docs/config/cluster.html (reference documentation) -->
+ <!--
+ <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+ -->
+
+ <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+ via a brute-force attack -->
+ <Realm className="org.apache.catalina.realm.LockOutRealm">
+ <!-- This Realm uses the UserDatabase configured in the global JNDI
+ resources under the key "UserDatabase". Any edits
+ that are performed against this UserDatabase are immediately
+ available for use by the Realm. -->
+ <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+ resourceName="UserDatabase"/>
+ </Realm>
+
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true">
+ <!-- SingleSignOn valve, share authentication between web applications
+ Documentation at: /docs/config/valve.html -->
+ <!--
+ <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
+ -->
+
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common" -->
diff --git a/src/main/resources/tomcat-base/conf/web.xml b/src/main/resources/tomcat-base/conf/web.xml
index b3ebce2..a9e29ee 100644
--- a/src/main/resources/tomcat-base/conf/web.xml
+++ b/src/main/resources/tomcat-base/conf/web.xml
@@ -104,6 +104,11 @@
<!-- showServerInfo Should server information be presented in the -->
<!-- response sent to clients when directory -->
<!-- listings is enabled? [true] -->
+ <!-- -->
+ <!-- allowPartialPut Should the server treat an HTTP PUT request -->
+ <!-- with a Range header as a partial PUT? Note -->
+ <!-- that RFC 7233 clarified that Range headers are -->
+ <!-- only valid for GET requests. [true] -->
<servlet>
<servlet-name>default</servlet-name>
@@ -346,6 +351,28 @@
<!-- If not set, then webAppRootDir is used. -->
<!-- Recommended value: WEB-INF/cgi -->
<!-- -->
+ <!-- cmdLineArgumentsDecoded -->
+ <!-- Only used when enableCmdLineArguments is -->
+ <!-- true. The pattern that individual decoded -->
+ <!-- command line arguments must match else the -->
+ <!-- request will be rejected. This is to -->
+ <!-- work-around various issues when Java passes -->
+ <!-- the arguments to the OS. See the CGI How-To -->
+ <!-- for more details. The default varies by -->
+ <!-- platform. -->
+ <!-- Windows: [[a-zA-Z0-9\Q-_.\\/:\E]+] -->
+ <!-- Others: [.*] -->
+ <!-- Note that internally the CGI Servlet treats -->
+ <!-- [.*] as a special case to improve performance -->
+ <!-- -->
+ <!-- cmdLineArgumentsEncoded -->
+ <!-- Only used when enableCmdLineArguments is -->
+ <!-- true. The pattern that individual encoded -->
+ <!-- command line arguments must match else the -->
+ <!-- request will be rejected. The default matches -->
+ <!-- the allowed values defined by RFC3875. -->
+ <!-- [[a-zA-Z0-9\Q%;/?:@&,$-_.!~*'()\E]+] -->
+ <!-- -->
<!-- enableCmdLineArguments -->
<!-- Are command line parameters generated from -->
<!-- the query string as per section 4.4 of 3875 -->
@@ -516,7 +543,7 @@
<!-- this to work you will need to uncomment the .shtml mime type -->
<!-- definition towards the bottom of this file. -->
<!-- The contentType init param allows you to apply SSI processing to JSP -->
- <!-- pages, javascript, or any other content you wish. This filter -->
+ <!-- pages, JavaScript, or any other content you wish. This filter -->
<!-- supports the following initialization parameters (default values are -->
<!-- in square brackets): -->
<!-- -->
@@ -4225,6 +4252,10 @@
<extension>wad</extension>
<mime-type>application/x-doom</mime-type>
</mime-mapping>
+ <mime-mapping>
+ <extension>wasm</extension>
+ <mime-type>application/wasm</mime-type>
+ </mime-mapping>
<mime-mapping>
<extension>wav</extension>
<mime-type>audio/x-wav</mime-type>
@@ -4630,10 +4661,6 @@
<extension>z</extension>
<mime-type>application/x-compress</mime-type>
</mime-mapping>
- <mime-mapping>
- <extension>Z</extension>
- <mime-type>application/x-compress</mime-type>
- </mime-mapping>
<mime-mapping>
<extension>z1</extension>
<mime-type>application/x-zmachine</mime-type>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list