[GUMP@vmgump]: Project tomcat-trunk-test-nio (in module tomcat-trunk) failed

2016-06-21 Thread Bill Barker
To whom it may engage...

This is an automated request, but not an unsolicited one. For 
more information please visit http://gump.apache.org/nagged.html, 
and/or contact the folk at gene...@gump.apache.org.

Project tomcat-trunk-test-nio has an issue affecting its community integration.
This issue affects 1 projects,
 and has been outstanding for 6 runs.
The current state of this project is 'Failed', with reason 'Build Timed Out'.
For reference only, the following projects are affected by this:
- tomcat-trunk-test-nio :  Tomcat 9.x, a web server implementing the Java 
Servlet 4.0,
...


Full details are available at:

http://vmgump.apache.org/gump/public/tomcat-trunk/tomcat-trunk-test-nio/index.html

That said, some information snippets are provided here.

The following annotations (debug/informational/warning/error messages) were 
provided:
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
commons-daemon.native.src.tgz.
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
tomcat-native.tar.gz.
 -INFO- Failed with reason build timed out
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-trunk/output/logs-NIO
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-trunk/output/test-tmp-NIO/logs
 -WARNING- No directory 
[/srv/gump/public/workspace/tomcat-trunk/output/test-tmp-NIO/logs]



The following work was performed:
http://vmgump.apache.org/gump/public/tomcat-trunk/tomcat-trunk-test-nio/gump_work/build_tomcat-trunk_tomcat-trunk-test-nio.html
Work Name: build_tomcat-trunk_tomcat-trunk-test-nio (Type: Build)
Work ended in a state of : Failed
Elapsed: 1 hour 2 secs
Command Line: /usr/lib/jvm/java-8-oracle/bin/java -Djava.awt.headless=true 
-Dbuild.sysclasspath=only org.apache.tools.ant.Main 
-Dgump.merge=/srv/gump/public/gump/work/merge.xml 
-Djunit.jar=/srv/gump/public/workspace/junit/target/junit-4.13-SNAPSHOT.jar 
-Dobjenesis.jar=/srv/gump/public/workspace/objenesis/main/target/objenesis-2.5-SNAPSHOT.jar
 -Dtest.reports=output/logs-NIO 
-Dtomcat-native.tar.gz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20160621-native-src.tar.gz
 -Dexamples.sources.skip=true 
-Dbase.path=/srv/gump/public/workspace/tomcat-trunk/tomcat-build-libs 
-Djdt.jar=/srv/gump/packages/eclipse/plugins/R-4.5-201506032000/ecj-4.5.jar 
-Dtest.relaxTiming=true 
-Dcommons-daemon.jar=/srv/gump/public/workspace/apache-commons/daemon/dist/commons-daemon-20160621.jar
 
-Dcommons-daemon.native.src.tgz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20160621-native-src.tar.gz
 -Dtest.temp=output/test-tmp-NIO -Dtest.accesslog=true -Dexecute.t
 est.nio=true 
-Dtest.openssl.path=/srv/gump/public/workspace/openssl-master/dest-20160621/bin/openssl
 -Dexecute.test.apr=false -Dtest.excludePerformance=true 
-Dexecute.test.nio2=false 
-Deasymock.jar=/srv/gump/public/workspace/easymock/core/target/easymock-3.5-SNAPSHOT.jar
 -Dhamcrest.jar=/srv/gump/packages/hamcrest/hamcrest-core-1.3.jar 
-Dcglib.jar=/srv/gump/packages/cglib/cglib-nodep-2.2.jar test 
[Working Directory: /srv/gump/public/workspace/tomcat-trunk]
CLASSPATH: 
/usr/lib/jvm/java-8-oracle/lib/tools.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/webapps/examples/WEB-INF/classes:/srv/gump/public/workspace/tomcat-trunk/output/testclasses:/srv/gump/public/workspace/ant/dist/lib/ant.jar:/srv/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/srv/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit4.jar:/srv/gump/public/workspace/ant/dist/lib/ant-swing.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-resolver.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-xalan2.jar:/srv/gump/public/workspace/xml-commons/java/build/resolver.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/bin/bootstrap.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/bin/tomcat-juli.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/annotations-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/servlet-api.ja
 
r:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jsp-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/el-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/websocket-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jaspic-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-ant.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-storeconfig.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/tomcat-coyote.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jasper.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jasper-el.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-tribes.jar:/srv/gump/pub

buildbot failure in on tomcat-8-trunk

2016-06-21 Thread buildbot
The Buildbot has detected a new failure on builder tomcat-8-trunk while 
building . Full details are available at:
https://ci.apache.org/builders/tomcat-8-trunk/builds/663

Buildbot URL: https://ci.apache.org/

Buildslave for this Build: silvanus_ubuntu

Build Reason: The AnyBranchScheduler scheduler named 'on-tomcat-8-commit' 
triggered this build
Build Source Stamp: [branch tomcat/tc8.0.x/trunk] 1749449
Blamelist: kfujino

BUILD FAILED: failed compile_1

Sincerely,
 -The Buildbot




-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1749460 - in /tomcat/site/trunk: ./ docs/ xdocs/

2016-06-21 Thread violetagg
Author: violetagg
Date: Tue Jun 21 08:05:57 2016
New Revision: 1749460

URL: http://svn.apache.org/viewvc?rev=1749460&view=rev
Log:
Updates (excluding docs) for 7.0.70 release

Modified:
tomcat/site/trunk/build.properties.default
tomcat/site/trunk/docs/doap_Tomcat.rdf
tomcat/site/trunk/docs/download-70.html
tomcat/site/trunk/docs/index.html
tomcat/site/trunk/docs/migration-7.html
tomcat/site/trunk/docs/oldnews.html
tomcat/site/trunk/docs/whichversion.html
tomcat/site/trunk/xdocs/doap_Tomcat.rdf
tomcat/site/trunk/xdocs/download-70.xml
tomcat/site/trunk/xdocs/index.xml
tomcat/site/trunk/xdocs/migration-7.xml
tomcat/site/trunk/xdocs/oldnews.xml
tomcat/site/trunk/xdocs/whichversion.xml

Modified: tomcat/site/trunk/build.properties.default
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/build.properties.default?rev=1749460&r1=1749459&r2=1749460&view=diff
==
--- tomcat/site/trunk/build.properties.default (original)
+++ tomcat/site/trunk/build.properties.default Tue Jun 21 08:05:57 2016
@@ -37,7 +37,7 @@ tomcat.loc=http://www.apache.org/dist/to
 
 # - Tomcat versions -
 tomcat60=6.0.45
-tomcat70=7.0.69
+tomcat70=7.0.70
 tomcat80=8.0.36
 tomcat85=8.5.3
 tomcat90=9.0.0.M8

Modified: tomcat/site/trunk/docs/doap_Tomcat.rdf
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/doap_Tomcat.rdf?rev=1749460&r1=1749459&r2=1749460&view=diff
==
--- tomcat/site/trunk/docs/doap_Tomcat.rdf (original)
+++ tomcat/site/trunk/docs/doap_Tomcat.rdf Tue Jun 21 08:05:57 2016
@@ -67,8 +67,8 @@
 
   
 Latest Stable 7.0.x Release
-2016-04-15
-7.0.69
+2016-06-20
+7.0.70
   
 
 

Modified: tomcat/site/trunk/docs/download-70.html
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/download-70.html?rev=1749460&r1=1749459&r2=1749460&view=diff
==
--- tomcat/site/trunk/docs/download-70.html (original)
+++ tomcat/site/trunk/docs/download-70.html Tue Jun 21 08:05:57 2016
@@ -222,7 +222,7 @@
 Quick Navigation
 
 
-[define v]7.0.69[end]
+[define v]7.0.70[end]
 https://www.apache.org/dist/tomcat/tomcat-7/KEYS";>KEYS |
 [v] |
 Browse |
@@ -324,14 +324,6 @@
   
   
 
-
-64-bit Itanium Windows zip 
-(https://www.apache.org/dist/tomcat/tomcat-7/v[v]/bin/apache-tomcat-[v]-windows-i64.zip.asc";>pgp,
 
-https://www.apache.org/dist/tomcat/tomcat-7/v[v]/bin/apache-tomcat-[v]-windows-i64.zip.md5";>md5,
-https://www.apache.org/dist/tomcat/tomcat-7/v[v]/bin/apache-tomcat-[v]-windows-i64.zip.sha1";>sha1)
-  
-  
-
 
 32-bit/64-bit Windows Service Installer 
 (https://www.apache.org/dist/tomcat/tomcat-7/v[v]/bin/apache-tomcat-[v].exe.asc";>pgp,
 

Modified: tomcat/site/trunk/docs/index.html
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/index.html?rev=1749460&r1=1749459&r2=1749460&view=diff
==
--- tomcat/site/trunk/docs/index.html (original)
+++ tomcat/site/trunk/docs/index.html Tue Jun 21 08:05:57 2016
@@ -245,6 +245,42 @@ project logo are trademarks of the Apach
 
 
 
+
+2016-06-20 Tomcat 7.0.70 Released
+
+
+
+The Apache Tomcat Project is proud to announce the release of version 7.0.70 of
+Apache Tomcat. This release contains a number of bug fixes and improvements
+compared to version 7.0.69. The notable changes since 7.0.69 include:
+
+
+
+
+Update the packaged version of the Tomcat Native Library to 1.2.7 to pick
+up the Windows binaries that are based on OpenSSL 1.0.2h and APR 1.5.2.
+
+
+Remove native code (Windows Service Wrapper, APR/native connector) support
+for Windows Itanium. 
+
+
+
+
+
+Full details of these changes, and all the other changes, are available in the
+Tomcat 7 changelog.
+
+
+
+
+
+Download |
+ChangeLog for 7.0.70
+
+
+
+
 
 2016-06-13 Tomcat 8.5.3 Released
 
@@ -379,39 +415,6 @@ using 1.2.x in preference to 1.1.x.
 
 
 
-
-
-2016-04-15 Tomcat 7.0.69 Released
-
-
-
-The Apache Tomcat Project is proud to announce the release of version 7.0.69 of
-Apache Tomcat. This release contains a number of bug fixes and improvements
-compared to version 7.0.68. The notable changes since 7.0.68 include:
-
-
-
-
-Correct a false positive warning for ThreadLocal related memory leaks when
-the key class but not the value class has been loaded by the web
-application class loader.
-
-
-
-
-
-Full details of these changes, and all the other changes, are available in the
-Tomcat 7 changelog.
-
-
-
-
-
-Download |
-ChangeLog for 7.0.69
-
-
-
 
 
 2016-02-11 Tomcat 6.0.45 Released

Modified: tomcat/site/trunk/docs/migration-7.html
URL: 
http://svn.apache.org/viewvc/tomc

svn commit: r1749463 - in /tomcat/site/trunk/docs/tomcat-7.0-doc: ./ api/ api/org/apache/catalina/ api/org/apache/catalina/ant/ api/org/apache/catalina/ant/jmx/ api/org/apache/catalina/authenticator/

2016-06-21 Thread violetagg
Author: violetagg
Date: Tue Jun 21 08:28:46 2016
New Revision: 1749463

URL: http://svn.apache.org/viewvc?rev=1749463&view=rev
Log:
Update docs for Apache Tomcat 7.0.70 release.


[This commit notification would consist of 334 parts, 
which exceeds the limit of 50 ones, so it was shortened to the summary.]

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r14069 - /release/tomcat/tomcat-7/v7.0.69/

2016-06-21 Thread violetagg
Author: violetagg
Date: Tue Jun 21 08:31:57 2016
New Revision: 14069

Log:
Remove 7.0.69

Removed:
release/tomcat/tomcat-7/v7.0.69/


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1749465 - in /tomcat/trunk/java/org/apache/tomcat/util/net: SSLHostConfig.java SSLHostConfigCertificate.java

2016-06-21 Thread markt
Author: markt
Date: Tue Jun 21 08:35:53 2016
New Revision: 1749465

URL: http://svn.apache.org/viewvc?rev=1749465&view=rev
Log:
Follow-up to r1749373
Use getters since various defaults are applied in the getters

Modified:
tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfig.java
tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java

Modified: tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfig.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfig.java?rev=1749465&r1=1749464&r2=1749465&view=diff
==
--- tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfig.java (original)
+++ tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfig.java Tue Jun 21 
08:35:53 2016
@@ -597,8 +597,8 @@ public class SSLHostConfig {
 if (result == null) {
 if (truststoreFile != null){
 try {
-result = SSLUtilBase.getStore(truststoreType, 
truststoreProvider,
-truststoreFile, truststorePassword);
+result = SSLUtilBase.getStore(getTruststoreType(), 
getTruststoreProvider(),
+getTruststoreFile(), getTruststorePassword());
 } catch (IOException ioe) {
 Throwable cause = ioe.getCause();
 if (cause instanceof UnrecoverableKeyException) {
@@ -606,8 +606,8 @@ public class SSLHostConfig {
 
log.warn(sm.getString("jsse.invalid_truststore_password"),
 cause);
 // Re-try
-result = SSLUtilBase.getStore(truststoreType, 
truststoreProvider,
-truststoreFile, null);
+result = SSLUtilBase.getStore(getTruststoreType(), 
getTruststoreProvider(),
+getTruststoreFile(), null);
 } else {
 // Something else went wrong - re-throw
 throw ioe;

Modified: 
tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java?rev=1749465&r1=1749464&r2=1749465&view=diff
==
--- tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java 
(original)
+++ tomcat/trunk/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java 
Tue Jun 21 08:35:53 2016
@@ -182,8 +182,9 @@ public class SSLHostConfigCertificate {
 KeyStore result = certificateKeystore;
 
 if (result == null) {
-result = SSLUtilBase.getStore(certificateKeystoreType, 
certificateKeystoreProvider,
-certificateKeystoreFile, certificateKeystorePassword);
+result = SSLUtilBase.getStore(getCertificateKeystoreType(),
+getCertificateKeystoreProvider(), 
getCertificateKeystoreFile(),
+getCertificateKeystorePassword());
 }
 
 return result;



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1749466 - in /tomcat/tc8.5.x/trunk: ./ java/org/apache/tomcat/util/net/SSLHostConfig.java java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java

2016-06-21 Thread markt
Author: markt
Date: Tue Jun 21 08:36:59 2016
New Revision: 1749466

URL: http://svn.apache.org/viewvc?rev=1749466&view=rev
Log:
Follow-up to r1749374
Use getters since various defaults are applied in the getters

Modified:
tomcat/tc8.5.x/trunk/   (props changed)
tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/net/SSLHostConfig.java

tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/net/SSLHostConfigCertificate.java

Propchange: tomcat/tc8.5.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue Jun 21 08:36:59 2016
@@ -1 +1 @@
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737903,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409,1741501
 
,1741677,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268,1742276,1742369,1742387,1742448,1742509-1742512,1742917,1742919,1742933,1742975-1742976,1742984,1742986,1743019,1743115,1743117,1743124-1743125,1743134,1743425,1743554,1743679,1743696-1743698,1743700-1743701,1744058,1744064-1744065,1744125,1744194,1744229,1744270,1744323,1744432,1744684,1744697,1744705,1744713,1744760,1744786,1745142-1745143,1745145,1745177,1745179-1745180,1745227,1745248,1745254,1745337,1745467,1745576,1745735,1745744,1746304,1746306-1746307,1746319,1746327,1746338,1746340-1746341,1746344,1746427,1746441,1746473,1746490,1746492,1746495-1746496,1746499-1746501,1746503-1746507,1746509,1746549,1746551,1746554,1746556,1746558,1746584,1746620,1746649,1746724,1746939,1746989,1747014,1747028,1747035,1747210,1747225,1747234,1747253,1747404,1747506,1747536,1747924,1747980,1747
 
993,1748001,1748253,1748452,1748547,1748629,1748676,1748715,1749287,1749296,1749328,1749373
+/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737903,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409,1741501
 
,1741677,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268,1742276,1742369,1742387,1742448,1742509-1742512,1742917,1742919,1742933,1742975-1742976,1742984,1742986,1743019,1743115,1743117,1743124-1743125,1743134,1743425,1743554,1743679,1743696-1743698,1743700-1743701,1744058,1744064-1744065,1744125,1744194,1744229,1744270,1744323,1744432,1744684,1744697,1744705,1744713,1744760,1744786,1745142-1745143,1745145,1745177,1745179-1745180,1745227,1745248,1745254,1745337,1745467,1745576,1745735,1745744,1746304,1746306-1746307,1746319,1746327,1746338,1746340-1746341,1746344,1746427,1746441,1746473,1746490,1746492,1746495-1746496,1746499-1746501,1746503-1746507,1746509,1746549,1746551,1746554,1746556,1746558,1746584,1746620,1746649,1746724,1746939,1746989,1747014,1747028,1747035,1747210,1747225,1747234,1747253,1747404,1747506,1747536,1747924,1747980,1747
 
993,1748001,1748253,1748452,1748547,1748629,1748676,1748715,1749287,1749296,1749328,1749373,1749465

Modified: 
tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/net/SSLHostConfig.java
URL: 
http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/net/SSLH

[Bug 59715] Getting ClassCircularityError on using javaagent in Catalina.bat and application is using custom SecurityManager.

2016-06-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=59715

--- Comment #2 from Dipankar Datta  ---
I have upgraded Tomcat from 7.0.26 to 7.0.69 but still the issue exists.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



[ANN] Apache Tomcat 7.0.70 released

2016-06-21 Thread Violeta Georgieva
The Apache Tomcat team announces the immediate availability of Apache
Tomcat 7.0.70.

Apache Tomcat is an open source software implementation of the Java
Servlet, JavaServer Pages, Java Expression Language and Java
WebSocket technologies.

This release contains a number of bug fixes and improvements compared to
version 7.0.69. The notable changes since 7.0.69 include:


- Update the packaged version of the Tomcat Native Library to 1.2.7 to pick
  up the Windows binaries that are based on OpenSSL 1.0.2h and APR 1.5.2

- Remove native code (Windows Service Wrapper, APR/native connector)
  support for Windows Itanium.


Please refer to the change log for the complete list of changes:
http://tomcat.apache.org/tomcat-7.0-doc/changelog.html

Downloads:
http://tomcat.apache.org/download-70.cgi

Migration guides from Apache Tomcat 5.5.x and 6.0.x:
http://tomcat.apache.org/migration.html

Enjoy

The Apache Tomcat team


[GUMP@vmgump]: Project tomcat-trunk-test-nio2 (in module tomcat-trunk) failed

2016-06-21 Thread Bill Barker
To whom it may engage...

This is an automated request, but not an unsolicited one. For 
more information please visit http://gump.apache.org/nagged.html, 
and/or contact the folk at gene...@gump.apache.org.

Project tomcat-trunk-test-nio2 has an issue affecting its community integration.
This issue affects 1 projects,
 and has been outstanding for 2 runs.
The current state of this project is 'Failed', with reason 'Build Timed Out'.
For reference only, the following projects are affected by this:
- tomcat-trunk-test-nio2 :  Tomcat 9.x, a web server implementing the Java 
Servlet 4.0,
...


Full details are available at:

http://vmgump.apache.org/gump/public/tomcat-trunk/tomcat-trunk-test-nio2/index.html

That said, some information snippets are provided here.

The following annotations (debug/informational/warning/error messages) were 
provided:
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
commons-daemon.native.src.tgz.
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
tomcat-native.tar.gz.
 -INFO- Failed with reason build timed out
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-trunk/output/logs-NIO2
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-trunk/output/test-tmp-NIO2/logs
 -WARNING- No directory 
[/srv/gump/public/workspace/tomcat-trunk/output/test-tmp-NIO2/logs]



The following work was performed:
http://vmgump.apache.org/gump/public/tomcat-trunk/tomcat-trunk-test-nio2/gump_work/build_tomcat-trunk_tomcat-trunk-test-nio2.html
Work Name: build_tomcat-trunk_tomcat-trunk-test-nio2 (Type: Build)
Work ended in a state of : Failed
Elapsed: 1 hour 1 sec
Command Line: /usr/lib/jvm/java-8-oracle/bin/java -Djava.awt.headless=true 
-Dbuild.sysclasspath=only org.apache.tools.ant.Main 
-Dgump.merge=/srv/gump/public/gump/work/merge.xml 
-Djunit.jar=/srv/gump/public/workspace/junit/target/junit-4.13-SNAPSHOT.jar 
-Dobjenesis.jar=/srv/gump/public/workspace/objenesis/main/target/objenesis-2.5-SNAPSHOT.jar
 -Dtest.reports=output/logs-NIO2 
-Dtomcat-native.tar.gz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20160621-native-src.tar.gz
 -Dexamples.sources.skip=true 
-Dbase.path=/srv/gump/public/workspace/tomcat-trunk/tomcat-build-libs 
-Djdt.jar=/srv/gump/packages/eclipse/plugins/R-4.5-201506032000/ecj-4.5.jar 
-Dtest.relaxTiming=true 
-Dcommons-daemon.jar=/srv/gump/public/workspace/apache-commons/daemon/dist/commons-daemon-20160621.jar
 
-Dcommons-daemon.native.src.tgz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20160621-native-src.tar.gz
 -Dtest.temp=output/test-tmp-NIO2 -Dtest.accesslog=true -Dexecute
 .test.nio=false 
-Dtest.openssl.path=/srv/gump/public/workspace/openssl-master/dest-20160621/bin/openssl
 -Dexecute.test.apr=false -Dtest.excludePerformance=true 
-Dexecute.test.nio2=true 
-Deasymock.jar=/srv/gump/public/workspace/easymock/core/target/easymock-3.5-SNAPSHOT.jar
 -Dhamcrest.jar=/srv/gump/packages/hamcrest/hamcrest-core-1.3.jar 
-Dcglib.jar=/srv/gump/packages/cglib/cglib-nodep-2.2.jar test 
[Working Directory: /srv/gump/public/workspace/tomcat-trunk]
CLASSPATH: 
/usr/lib/jvm/java-8-oracle/lib/tools.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/webapps/examples/WEB-INF/classes:/srv/gump/public/workspace/tomcat-trunk/output/testclasses:/srv/gump/public/workspace/ant/dist/lib/ant.jar:/srv/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/srv/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit4.jar:/srv/gump/public/workspace/ant/dist/lib/ant-swing.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-resolver.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-xalan2.jar:/srv/gump/public/workspace/xml-commons/java/build/resolver.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/bin/bootstrap.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/bin/tomcat-juli.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/annotations-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/servlet-api.ja
 
r:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jsp-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/el-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/websocket-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jaspic-api.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-ant.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-storeconfig.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/tomcat-coyote.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jasper.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/jasper-el.jar:/srv/gump/public/workspace/tomcat-trunk/output/build/lib/catalina-tribes.jar:/srv/g

[GUMP@vmgump]: Project tomcat-tc7.0.x-test-bio (in module tomcat-7.0.x) failed

2016-06-21 Thread Bill Barker
To whom it may engage...

This is an automated request, but not an unsolicited one. For 
more information please visit http://gump.apache.org/nagged.html, 
and/or contact the folk at gene...@gump.apache.org.

Project tomcat-tc7.0.x-test-bio has an issue affecting its community 
integration.
This issue affects 1 projects,
 and has been outstanding for 26 runs.
The current state of this project is 'Failed', with reason 'Build Failed'.
For reference only, the following projects are affected by this:
- tomcat-tc7.0.x-test-bio :  Tomcat 7.x, a web server implementing Java 
Servlet 3.0,
...


Full details are available at:

http://vmgump.apache.org/gump/public/tomcat-7.0.x/tomcat-tc7.0.x-test-bio/index.html

That said, some information snippets are provided here.

The following annotations (debug/informational/warning/error messages) were 
provided:
 -DEBUG- Dependency on tomcat-tc7.0.x-dbcp exists, no need to add for property 
tomcat-dbcp-src.jar.
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
commons-daemon.native.src.tgz.
 -DEBUG- Dependency on commons-daemon exists, no need to add for property 
tomcat-native.tar.gz.
 -DEBUG- Dependency on tomcat-tc7.0.x-dbcp exists, no need to add for property 
tomcat-dbcp.home.
 -INFO- Failed with reason build failed
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-7.0.x/output/logs-BIO
 -INFO- Project Reports in: 
/srv/gump/public/workspace/tomcat-7.0.x/output/test-tmp-BIO/logs



The following work was performed:
http://vmgump.apache.org/gump/public/tomcat-7.0.x/tomcat-tc7.0.x-test-bio/gump_work/build_tomcat-7.0.x_tomcat-tc7.0.x-test-bio.html
Work Name: build_tomcat-7.0.x_tomcat-tc7.0.x-test-bio (Type: Build)
Work ended in a state of : Failed
Elapsed: 39 mins 10 secs
Command Line: /usr/lib/jvm/java-8-oracle/bin/java -Djava.awt.headless=true 
-Dbuild.sysclasspath=only org.apache.tools.ant.Main 
-Dgump.merge=/srv/gump/public/gump/work/merge.xml 
-Dbase.path=/srv/gump/public/workspace/tomcat-7.0.x/tomcat-build-libs 
-Dcommons-pool.home=/srv/gump/public/workspace/commons-pool-1.x 
-Dtest.temp=output/test-tmp-BIO 
-Djunit.jar=/srv/gump/public/workspace/junit/target/junit-4.13-SNAPSHOT.jar 
-Dobjenesis.jar=/srv/gump/public/workspace/objenesis/main/target/objenesis-2.5-SNAPSHOT.jar
 -Dexamples.sources.skip=true 
-Dcommons-daemon.jar=/srv/gump/public/workspace/apache-commons/daemon/dist/commons-daemon-20160621.jar
 
-Dtomcat-dbcp-src.jar=/srv/gump/public/workspace/tomcat-7.0.x/tomcat-deps/tomcat-dbcp-src.jar
 -Dtomcat-dbcp.home=/srv/gump/public/workspace/tomcat-7.0.x/tomcat-deps 
-Dtest.excludePerformance=true 
-Dhamcrest.jar=/srv/gump/packages/hamcrest/hamcrest-core-1.3.jar 
-Dcommons-dbcp.home=/srv/gump/public/workspace/commons-dbcp-1.x 
-Dexecute.test.apr=false -Dexe
 cute.test.bio=true 
-Dcommons-daemon.native.src.tgz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20160621-native-src.tar.gz
 -Dtest.reports=output/logs-BIO 
-Dtomcat-native.tar.gz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20160621-native-src.tar.gz
 -Djdt.jar=/srv/gump/packages/eclipse/plugins/R-4.5-201506032000/ecj-4.5.jar 
-Dtest.relaxTiming=true -Dexecute.test.nio=false -Dtest.accesslog=true 
-Dtomcat-dbcp.jar=/srv/gump/public/workspace/tomcat-7.0.x/tomcat-deps/tomcat-dbcp-20160621.jar
 
-Deasymock.jar=/srv/gump/public/workspace/easymock/core/target/easymock-3.5-SNAPSHOT.jar
 -Dcglib.jar=/srv/gump/packages/cglib/cglib-nodep-2.2.jar test 
[Working Directory: /srv/gump/public/workspace/tomcat-7.0.x]
CLASSPATH: 
/usr/lib/jvm/java-8-oracle/lib/tools.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/webapps/examples/WEB-INF/classes:/srv/gump/public/workspace/tomcat-7.0.x/output/testclasses:/srv/gump/public/workspace/ant/dist/lib/ant.jar:/srv/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/srv/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit.jar:/srv/gump/public/workspace/ant/dist/lib/ant-junit4.jar:/srv/gump/public/workspace/ant/dist/lib/ant-swing.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-resolver.jar:/srv/gump/public/workspace/ant/dist/lib/ant-apache-xalan2.jar:/srv/gump/public/workspace/xml-commons/java/build/resolver.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/bin/bootstrap.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/bin/tomcat-juli.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/lib/annotations-api.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/lib/servlet-api.ja
 
r:/srv/gump/public/workspace/tomcat-7.0.x/output/build/lib/jsp-api.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/lib/el-api.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/lib/catalina.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/lib/catalina-ant.jar:/srv/gump/public/workspace/tomcat-7.0.x/output/build/lib/tomcat-coyote.jar:/srv/gump/public/workspace/tomcat-7.

Fwd: CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability

2016-06-21 Thread Mark Thomas

 Original Message 
From: Jochen Wiedmann 
Sent: 21 June 2016 10:18:15 BST
To: priv...@commons.apache.org, "secur...@apache.org" , 
Tomcat Security List , annou...@apache.org, Apache 
Commons Developers List 
Subject: CVE-2016-3092: Apache Commons Fileupload information disclosure 
vulnerability

CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability

Severity: Moderate

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Commons Fileupload 1.3 to 1.3.1
Apache Commons Fileupload 1.2 to 1.2.2
The unsupported Apache Commons Fileupload 1.0.x, and 1.1.x may also be affected.
Apache Tomcat 9.x to 9.0.0M6
Apache Tomcat 8.x to 8.0.35
Apache Tomcat 7.x to 7.0.69
Apache Tomcat 6.x
Unsupported versions of Apache Tomcat, like 5.x may also be affected.
Apache Struts 2.5.x, and previous versions, which are distributing
Commons FileUpload 1.3.1, or earlier versions.

Description:
A malicious client can send file upload requests that cause the HTTP server
using the Apache Commons Fileupload library to become unresponsive, preventing
the server from servicing other requests.

This flaw is not exploitable beyond causing the code to loop expending
CPU resources.


Mitigation:
All users of Apache Commons Fileupload should upgrade to 1.3.2.
All users of Apache Tomcat should upgrade to 9.0.0M8, 8.0.36, or
7.0.70, respectively.
All users of Apache Struts should replace the copy of Commons
FileUpload (which is distributed as part of Struts) with the fixed
version 1.3.2.

Workaround:

System administrators should restrict the permitted maximum size of HTTP request
header values (For example, Apache Httpd provides a
LimitRequestFieldSize directive,
and Apache Tomcat provides a maxHttpHeaderSize attribute in their respective
configuration files). A maximum header value size of 2048 bytes would block all
dangerous request.

Example:
File upload requests contain a so-called boundary in the Content-Type header:

Content-Type: multipart/mixed;
  boundary=gc0p4Jq0M2Yt08jU534c0p

The boundary may be chosen by the request sender. In the case of
previous versions
of Apache Commons Fileupload the boundary becomes dangerous, if its
size is close
to 4096 bytes.

Credit:
TERASOLUNA Framework Development Team at the Software Engineering,
Research and Development Headquarter, for detecting this flaw, and reporting
it to the JPCERT/CC,
Taki Uchiyama (JPCERT/CC Vulnerability Handling Team) reported this
problem to us.

References:
https://commons.apache.org/proper/commons-fileupload/security.html

-- 
The next time you hear: "Don't reinvent the wheel!"

http://www.keystonedevelopment.co.uk/wp-content/uploads/2014/10/evolution-of-the-wheel-300x85.jpg

-
To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org
For additional commands, e-mail: dev-h...@commons.apache.org


Note: Apache Tomcat 6.x and earlier are NOT affected.



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



buildbot success in on tomcat-trunk

2016-06-21 Thread buildbot
The Buildbot has detected a restored build on builder tomcat-trunk while 
building . Full details are available at:
https://ci.apache.org/builders/tomcat-trunk/builds/1460

Buildbot URL: https://ci.apache.org/

Buildslave for this Build: silvanus_ubuntu

Build Reason: The AnyBranchScheduler scheduler named 'on-tomcat-commit' 
triggered this build
Build Source Stamp: [branch tomcat/trunk] 1749465
Blamelist: markt

Build succeeded!

Sincerely,
 -The Buildbot




-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Re: CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability

2016-06-21 Thread Jochen Wiedmann
Thanks for forwarding. I hope, that everything is alright with the announcement?


On Tue, Jun 21, 2016 at 11:53 AM, Mark Thomas  wrote:
>
>  Original Message 
> From: Jochen Wiedmann 
> Sent: 21 June 2016 10:18:15 BST
> To: priv...@commons.apache.org, "secur...@apache.org" , 
> Tomcat Security List , annou...@apache.org, 
> Apache Commons Developers List 
> Subject: CVE-2016-3092: Apache Commons Fileupload information disclosure 
> vulnerability
>
> CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability
>
> Severity: Moderate
>
> Vendor:
> The Apache Software Foundation
>
> Versions Affected:
> Apache Commons Fileupload 1.3 to 1.3.1
> Apache Commons Fileupload 1.2 to 1.2.2
> The unsupported Apache Commons Fileupload 1.0.x, and 1.1.x may also be 
> affected.
> Apache Tomcat 9.x to 9.0.0M6
> Apache Tomcat 8.x to 8.0.35
> Apache Tomcat 7.x to 7.0.69
> Apache Tomcat 6.x
> Unsupported versions of Apache Tomcat, like 5.x may also be affected.
> Apache Struts 2.5.x, and previous versions, which are distributing
> Commons FileUpload 1.3.1, or earlier versions.
>
> Description:
> A malicious client can send file upload requests that cause the HTTP server
> using the Apache Commons Fileupload library to become unresponsive, preventing
> the server from servicing other requests.
>
> This flaw is not exploitable beyond causing the code to loop expending
> CPU resources.
>
>
> Mitigation:
> All users of Apache Commons Fileupload should upgrade to 1.3.2.
> All users of Apache Tomcat should upgrade to 9.0.0M8, 8.0.36, or
> 7.0.70, respectively.
> All users of Apache Struts should replace the copy of Commons
> FileUpload (which is distributed as part of Struts) with the fixed
> version 1.3.2.
>
> Workaround:
>
> System administrators should restrict the permitted maximum size of HTTP 
> request
> header values (For example, Apache Httpd provides a
> LimitRequestFieldSize directive,
> and Apache Tomcat provides a maxHttpHeaderSize attribute in their respective
> configuration files). A maximum header value size of 2048 bytes would block 
> all
> dangerous request.
>
> Example:
> File upload requests contain a so-called boundary in the Content-Type header:
>
> Content-Type: multipart/mixed;
>   boundary=gc0p4Jq0M2Yt08jU534c0p
>
> The boundary may be chosen by the request sender. In the case of
> previous versions
> of Apache Commons Fileupload the boundary becomes dangerous, if its
> size is close
> to 4096 bytes.
>
> Credit:
> TERASOLUNA Framework Development Team at the Software Engineering,
> Research and Development Headquarter, for detecting this flaw, and reporting
> it to the JPCERT/CC,
> Taki Uchiyama (JPCERT/CC Vulnerability Handling Team) reported this
> problem to us.
>
> References:
> https://commons.apache.org/proper/commons-fileupload/security.html
>
> --
> The next time you hear: "Don't reinvent the wheel!"
>
> http://www.keystonedevelopment.co.uk/wp-content/uploads/2014/10/evolution-of-the-wheel-300x85.jpg
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org
> For additional commands, e-mail: dev-h...@commons.apache.org
>
>
> Note: Apache Tomcat 6.x and earlier are NOT affected.
>
>



-- 
The next time you hear: "Don't reinvent the wheel!"

http://www.keystonedevelopment.co.uk/wp-content/uploads/2014/10/evolution-of-the-wheel-300x85.jpg

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Memory problems caused by the messageBufferText CharBuffer in WSFrameBase.java

2016-06-21 Thread Afaf Zahkya
Hello,

I m using tomcat 8.0.21.

I want to send *up* to 4 MB of text messages through a websocket connection
to my tomcat server. I set the MaxTextMessageBufferSize to 4 MB.Now as a
result, every time I open a websocket  connection and I send a message , I
can see that 4 MB are  being allocated in memory for the CharBuffer
messageBufferText regardless of the size of the message I send . 99 % of my
messages would be way smaller.The 4 MB  remain allocated in the
messageBufferText CharBuffer even after the message is handled.  The
connection can stay open up to 30 minutes in my case, and each  websocket
connection is taking 4 MB of memory all of that time even if it's inactive
which leads my server to eventually run out of memory even with inactive
connections  . Note that I m using a Whole Message Handler.

 Why not set the messageBufferText CharBuffer size to the payload length if
it doesn't exceed the maxTextMessageBufferSize, and then clearing that
buffer ( reducing its size) after the message is handled by the Handler, so
that inactive connections don't take up memory. ( same for the binary) ?

Any other / better suggestions on how to solve that problem ?

Thanks.


Re: Memory problems caused by the messageBufferText CharBuffer in WSFrameBase.java

2016-06-21 Thread Mark Thomas
On 21/06/2016 13:46, Afaf Zahkya wrote:
> Hello,
> 
> I m using tomcat 8.0.21.
> 
> I want to send *up* to 4 MB of text messages through a websocket connection
> to my tomcat server. I set the MaxTextMessageBufferSize to 4 MB.Now as a
> result, every time I open a websocket  connection and I send a message , I
> can see that 4 MB are  being allocated in memory for the CharBuffer
> messageBufferText regardless of the size of the message I send . 99 % of my
> messages would be way smaller.The 4 MB  remain allocated in the
> messageBufferText CharBuffer even after the message is handled.  The
> connection can stay open up to 30 minutes in my case, and each  websocket
> connection is taking 4 MB of memory all of that time even if it's inactive
> which leads my server to eventually run out of memory even with inactive
> connections  . Note that I m using a Whole Message Handler.
> 
>  Why not set the messageBufferText CharBuffer size to the payload length if
> it doesn't exceed the maxTextMessageBufferSize, and then clearing that
> buffer ( reducing its size) after the message is handled by the Handler, so
> that inactive connections don't take up memory. ( same for the binary) ?
> 
> Any other / better suggestions on how to solve that problem ?

This question belongs on the users list.

Mark


-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1749506 - in /tomcat/trunk: java/org/apache/tomcat/websocket/server/ webapps/docs/

2016-06-21 Thread markt
Author: markt
Date: Tue Jun 21 13:40:32 2016
New Revision: 1749506

URL: http://svn.apache.org/viewvc?rev=1749506&view=rev
Log:
Now the WebSocket implementation is not built directly on top of the Servlet 
API and can use Tomcat internals, there is no need for the dedicated WebSocket 
executor.

Modified:
tomcat/trunk/java/org/apache/tomcat/websocket/server/Constants.java
tomcat/trunk/java/org/apache/tomcat/websocket/server/LocalStrings.properties

tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsServerContainer.java
tomcat/trunk/webapps/docs/web-socket-howto.xml

Modified: tomcat/trunk/java/org/apache/tomcat/websocket/server/Constants.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/websocket/server/Constants.java?rev=1749506&r1=1749505&r2=1749506&view=diff
==
--- tomcat/trunk/java/org/apache/tomcat/websocket/server/Constants.java 
(original)
+++ tomcat/trunk/java/org/apache/tomcat/websocket/server/Constants.java Tue Jun 
21 13:40:32 2016
@@ -28,12 +28,6 @@ public class Constants {
 public static final String 
ENFORCE_NO_ADD_AFTER_HANDSHAKE_CONTEXT_INIT_PARAM =
 "org.apache.tomcat.websocket.noAddAfterHandshake";
 
-// Executor configuration
-public static final String EXECUTOR_CORE_SIZE_INIT_PARAM =
-"org.apache.tomcat.websocket.executorCoreSize";
-public static final String EXECUTOR_KEEPALIVETIME_SECONDS_INIT_PARAM =
-"org.apache.tomcat.websocket.executorKeepAliveTimeSeconds";
-
 public static final String SERVER_CONTAINER_SERVLET_CONTEXT_ATTRIBUTE =
 "javax.websocket.server.ServerContainer";
 

Modified: 
tomcat/trunk/java/org/apache/tomcat/websocket/server/LocalStrings.properties
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/websocket/server/LocalStrings.properties?rev=1749506&r1=1749505&r2=1749506&view=diff
==
--- 
tomcat/trunk/java/org/apache/tomcat/websocket/server/LocalStrings.properties 
(original)
+++ 
tomcat/trunk/java/org/apache/tomcat/websocket/server/LocalStrings.properties 
Tue Jun 21 13:40:32 2016
@@ -22,7 +22,6 @@ serverContainer.missingEndpoint=An Endpo
 serverContainer.pojoDeploy=POJO class [{0}] deploying to path [{1}] in 
ServletContext [{2}]
 serverContainer.servletContextMismatch=Attempted to register a POJO annotated 
for WebSocket at path [{0}] in the ServletContext with context path [{1}] when 
the WebSocket ServerContainer is allocated to the ServletContext with context 
path [{2}]
 serverContainer.servletContextMissing=No ServletContext was specified
-serverContainer.threadGroupNotDestroyed=Unable to destroy WebSocket thread 
group [{0}] as [{1}] threads were still running when the web application was 
stopped. The thread group will be destroyed once the threads terminate.
 
 upgradeUtil.incompatibleRsv=Extensions were specified that have incompatible 
RSV bit usage
 

Modified: 
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java?rev=1749506&r1=1749505&r2=1749506&view=diff
==
--- 
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
 (original)
+++ 
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
 Tue Jun 21 13:40:32 2016
@@ -20,13 +20,13 @@ import java.io.EOFException;
 import java.io.IOException;
 import java.net.SocketTimeoutException;
 import java.nio.ByteBuffer;
-import java.util.concurrent.ExecutorService;
-
+import java.util.concurrent.Executor;
 import javax.websocket.SendHandler;
 import javax.websocket.SendResult;
 
 import org.apache.juli.logging.Log;
 import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.net.AbstractEndpoint;
 import org.apache.tomcat.util.net.SocketWrapperBase;
 import org.apache.tomcat.util.res.StringManager;
 import org.apache.tomcat.websocket.Transformation;
@@ -44,7 +44,6 @@ public class WsRemoteEndpointImplServer
 
 private final SocketWrapperBase socketWrapper;
 private final WsWriteTimeout wsWriteTimeout;
-private final ExecutorService executorService;
 private volatile SendHandler handler = null;
 private volatile ByteBuffer[] buffers = null;
 
@@ -55,7 +54,6 @@ public class WsRemoteEndpointImplServer
 WsServerContainer serverContainer) {
 this.socketWrapper = socketWrapper;
 this.wsWriteTimeout = serverContainer.getTimeout();
-this.executorService = serverContainer.getExecutorService();
 }
 
 
@@ -227,7 +225,11 @@ public class WsRemoteEndpointImplServer
 if (sh != null) {
 

svn commit: r1749508 - /tomcat/trunk/webapps/docs/changelog.xml

2016-06-21 Thread markt
Author: markt
Date: Tue Jun 21 13:45:02 2016
New Revision: 1749508

URL: http://svn.apache.org/viewvc?rev=1749508&view=rev
Log:
Update changelog

Modified:
tomcat/trunk/webapps/docs/changelog.xml

Modified: tomcat/trunk/webapps/docs/changelog.xml
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/webapps/docs/changelog.xml?rev=1749508&r1=1749507&r2=1749508&view=diff
==
--- tomcat/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/trunk/webapps/docs/changelog.xml Tue Jun 21 13:45:02 2016
@@ -97,6 +97,16 @@
   
 
   
+  
+
+  
+Now the WebSocket implementation is not built directly on top of the
+Servlet API and can use Tomcat internals, there is no need for the
+dedicated WebSocket Executor. It has been replaced by the use of the
+Connector/Endpoint provided Executor. (markt)
+  
+
+  
   
 
   



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1749509 - in /tomcat/tc8.5.x/trunk: ./ java/org/apache/tomcat/websocket/server/ webapps/docs/

2016-06-21 Thread markt
Author: markt
Date: Tue Jun 21 13:45:35 2016
New Revision: 1749509

URL: http://svn.apache.org/viewvc?rev=1749509&view=rev
Log:
Now the WebSocket implementation is not built directly on top of the Servlet 
API and can use Tomcat internals, there is no need for the dedicated WebSocket 
executor.

Modified:
tomcat/tc8.5.x/trunk/   (props changed)
tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/Constants.java

tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/LocalStrings.properties

tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java

tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/WsServerContainer.java
tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml
tomcat/tc8.5.x/trunk/webapps/docs/web-socket-howto.xml

Propchange: tomcat/tc8.5.x/trunk/
--
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue Jun 21 13:45:35 2016
@@ -1 +1 @@
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737903,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409,1741501
 
,1741677,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268,1742276,1742369,1742387,1742448,1742509-1742512,1742917,1742919,1742933,1742975-1742976,1742984,1742986,1743019,1743115,1743117,1743124-1743125,1743134,1743425,1743554,1743679,1743696-1743698,1743700-1743701,1744058,1744064-1744065,1744125,1744194,1744229,1744270,1744323,1744432,1744684,1744697,1744705,1744713,1744760,1744786,1745142-1745143,1745145,1745177,1745179-1745180,1745227,1745248,1745254,1745337,1745467,1745576,1745735,1745744,1746304,1746306-1746307,1746319,1746327,1746338,1746340-1746341,1746344,1746427,1746441,1746473,1746490,1746492,1746495-1746496,1746499-1746501,1746503-1746507,1746509,1746549,1746551,1746554,1746556,1746558,1746584,1746620,1746649,1746724,1746939,1746989,1747014,1747028,1747035,1747210,1747225,1747234,1747253,1747404,1747506,1747536,1747924,1747980,1747
 
993,1748001,1748253,1748452,1748547,1748629,1748676,1748715,1749287,1749296,1749328,1749373,1749465
+/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737903,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409,1741501
 
,1741677,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268,1742276,1742369,1742387,1742448,1742509-1742512,1742917,1742919,1742933,1742975-1742976,1742984,1742986,1743019,1743115,1743117,1743124-1743125,1743134,1743425,1743554,1743679,1743696-1743698,1743700-1743701,1744058,1744064-1744065,1744125,1744194,1744229,1744270,1744323,1744432,1744684,1744697,1744705,1744713,1744760,1744786,1745142-1745143,1745145,1745177,1745179-1745180,1745227,1745248,1745254,1745337,1745467,1745576,1745735,1745744,1746304,1746306-1746307,1746319,1746327,1746338,1746340-1746341,1746344,1746427,1746441,1746473,1746490,1746492,1746495-1746496,1746499-1746501,1746503-1746507,1746509,1746549,1746551,1746554,1746556,1746558,1746584,1746620,1746649,1746724

svn commit: r1749560 - in /tomcat/trunk/java/org/apache/tomcat/websocket/server: WsRemoteEndpointImplServer.java WsServerContainer.java

2016-06-21 Thread remm
Author: remm
Date: Tue Jun 21 15:47:20 2016
New Revision: 1749560

URL: http://svn.apache.org/viewvc?rev=1749560&view=rev
Log:
Fix for a lame checkstyle rule.

Modified:

tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsServerContainer.java

Modified: 
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java?rev=1749560&r1=1749559&r2=1749560&view=diff
==
--- 
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
 (original)
+++ 
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
 Tue Jun 21 15:47:20 2016
@@ -21,6 +21,7 @@ import java.io.IOException;
 import java.net.SocketTimeoutException;
 import java.nio.ByteBuffer;
 import java.util.concurrent.Executor;
+
 import javax.websocket.SendHandler;
 import javax.websocket.SendResult;
 

Modified: 
tomcat/trunk/java/org/apache/tomcat/websocket/server/WsServerContainer.java
URL: 
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/websocket/server/WsServerContainer.java?rev=1749560&r1=1749559&r2=1749560&view=diff
==
--- tomcat/trunk/java/org/apache/tomcat/websocket/server/WsServerContainer.java 
(original)
+++ tomcat/trunk/java/org/apache/tomcat/websocket/server/WsServerContainer.java 
Tue Jun 21 15:47:20 2016
@@ -26,6 +26,7 @@ import java.util.Set;
 import java.util.SortedSet;
 import java.util.TreeSet;
 import java.util.concurrent.ConcurrentHashMap;
+
 import javax.servlet.DispatcherType;
 import javax.servlet.FilterRegistration;
 import javax.servlet.ServletContext;



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



buildbot failure in on tomcat-trunk

2016-06-21 Thread buildbot
The Buildbot has detected a new failure on builder tomcat-trunk while building 
. Full details are available at:
https://ci.apache.org/builders/tomcat-trunk/builds/1462

Buildbot URL: https://ci.apache.org/

Buildslave for this Build: silvanus_ubuntu

Build Reason: The AnyBranchScheduler scheduler named 'on-tomcat-commit' 
triggered this build
Build Source Stamp: [branch tomcat/trunk] 1749560
Blamelist: remm

BUILD FAILED: failed compile_1

Sincerely,
 -The Buildbot




-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1749565 - /tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java

2016-06-21 Thread remm
Author: remm
Date: Tue Jun 21 16:05:58 2016
New Revision: 1749565

URL: http://svn.apache.org/viewvc?rev=1749565&view=rev
Log:
Fix for a lame checkstyle rule.

Modified:

tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java

Modified: 
tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
URL: 
http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java?rev=1749565&r1=1749564&r2=1749565&view=diff
==
--- 
tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
 (original)
+++ 
tomcat/tc8.5.x/trunk/java/org/apache/tomcat/websocket/server/WsRemoteEndpointImplServer.java
 Tue Jun 21 16:05:58 2016
@@ -21,6 +21,7 @@ import java.io.IOException;
 import java.net.SocketTimeoutException;
 import java.nio.ByteBuffer;
 import java.util.concurrent.Executor;
+
 import javax.websocket.SendHandler;
 import javax.websocket.SendResult;
 



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



[Bug 59715] Getting ClassCircularityError on using javaagent in Catalina.bat and application is using custom SecurityManager.

2016-06-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=59715

Christopher Schultz  changed:

   What|Removed |Added

 Status|NEW |RESOLVED
 Resolution|--- |INVALID

--- Comment #3 from Christopher Schultz  ---
I'm certain this isn't a Tomcat issue.

If java.lang.String requires java.lang.String to load itself, then something is
wrong with the JVM itself, or with the custom SecurityManager that may be
damaging the ClassLoader hierarchy.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Re: Memory problems caused by the messageBufferText CharBuffer in WSFrameBase.java

2016-06-21 Thread Christopher Schultz
Afaf,

On 6/21/16 8:46 AM, Afaf Zahkya wrote:
> Hello,
> 
> I m using tomcat 8.0.21.
> 
> I want to send *up* to 4 MB of text messages through a websocket connection
> to my tomcat server. I set the MaxTextMessageBufferSize to 4 MB.Now as a
> result, every time I open a websocket  connection and I send a message , I
> can see that 4 MB are  being allocated in memory for the CharBuffer
> messageBufferText regardless of the size of the message I send . 99 % of my
> messages would be way smaller.The 4 MB  remain allocated in the
> messageBufferText CharBuffer even after the message is handled.  The
> connection can stay open up to 30 minutes in my case, and each  websocket
> connection is taking 4 MB of memory all of that time even if it's inactive
> which leads my server to eventually run out of memory even with inactive
> connections  . Note that I m using a Whole Message Handler.
> 
>  Why not set the messageBufferText CharBuffer size to the payload length if
> it doesn't exceed the maxTextMessageBufferSize, and then clearing that
> buffer ( reducing its size) after the message is handled by the Handler, so
> that inactive connections don't take up memory. ( same for the binary) ?
> 
> Any other / better suggestions on how to solve that problem ?

If you configure Tomcat with maxTextMessageBufferSize="4MB" but only
send small messages, do you get a small buffer? Or do you get a 4MB
buffer immediately?

-chris



signature.asc
Description: OpenPGP digital signature


[Bug 56026] RemoteEndpoint.Async#sendText(String, SendHandler) not thread safe

2016-06-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=56026

--- Comment #13 from a...@bgprotect.com ---
I've ran into this issue too and I must say that although tomcat's current
behavior doesn't directly contradict the standard, it's very unexpected and
goes against simple common sense. This is an async call, and Session must be
thread safe according to the spec. I can accept that there could be some
uncertainty if one mixes sync and async sends, especially in partial messages,
but if all calls are async this *really* should never happen. 

What's worse, as others have mentioned, this goes against what other
implementations are doing without as much as documenting this behavior. Neither
"Session"'s nor "RemoteEndpoint.Async"'s Javadoc have anything to say about
thread safety or specifically the lack thereof.

Does the race condition occur only during the call to sendText()/sendBinary()?
i.e. Would synchronizing such calls on the session object (as balusc suggested)
solve 100% of these cases?

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org



Memory problems caused by the messageBufferText CharBuffer in WSFrameBase.java

2016-06-21 Thread Afaf Zahkya
You get a 4 MB buffer immediately and it stays there as long as your
connection is alive. But as Mark replied, this thread belongs in the user
mailing list because if you are gonna have a buffer bigger than the
default, perhaps you are better off using the partial message
handler.What's annoying in my case is that i would need the whole message
to do something with it, so i d have to gather all the message in my
partial message handler and have it garbage collected after i get the last
chunk and do what i want to do with it, so from a design perspective that
doesn't sound right . In the user mailing list mark mentioned that the
reason the buffer doesn't shrink is to avoid gc churn which is a good
point. The right question is ,would the gc churn be worse than the memory
penalty ?

On Tuesday, June 21, 2016, Christopher Schultz 
wrote:

> Afaf,
>
> On 6/21/16 8:46 AM, Afaf Zahkya wrote:
> > Hello,
> >
> > I m using tomcat 8.0.21.
> >
> > I want to send *up* to 4 MB of text messages through a websocket
> connection
> > to my tomcat server. I set the MaxTextMessageBufferSize to 4 MB.Now as a
> > result, every time I open a websocket  connection and I send a message ,
> I
> > can see that 4 MB are  being allocated in memory for the CharBuffer
> > messageBufferText regardless of the size of the message I send . 99 % of
> my
> > messages would be way smaller.The 4 MB  remain allocated in the
> > messageBufferText CharBuffer even after the message is handled.  The
> > connection can stay open up to 30 minutes in my case, and each  websocket
> > connection is taking 4 MB of memory all of that time even if it's
> inactive
> > which leads my server to eventually run out of memory even with inactive
> > connections  . Note that I m using a Whole Message Handler.
> >
> >  Why not set the messageBufferText CharBuffer size to the payload length
> if
> > it doesn't exceed the maxTextMessageBufferSize, and then clearing that
> > buffer ( reducing its size) after the message is handled by the Handler,
> so
> > that inactive connections don't take up memory. ( same for the binary) ?
> >
> > Any other / better suggestions on how to solve that problem ?
>
> If you configure Tomcat with maxTextMessageBufferSize="4MB" but only
> send small messages, do you get a small buffer? Or do you get a 4MB
> buffer immediately?
>
> -chris
>
>


RE: CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability

2016-06-21 Thread Chinoy Gupta
What about 8.5.x branch? Is that also affected. And I am not able to see this 
update on Tomcat security page. Any reasons for that?

Regards,
Chinoy

-Original Message-
From: Mark Thomas [mailto:ma...@apache.org] 
Sent: Tuesday, June 21, 2016 3:23 PM
To: us...@tomcat.apache.org; dev@tomcat.apache.org; annou...@tomcat.apache.org; 
annou...@apache.org; secur...@tomcat.apache.org
Subject: Fwd: CVE-2016-3092: Apache Commons Fileupload information disclosure 
vulnerability


 Original Message 
From: Jochen Wiedmann 
Sent: 21 June 2016 10:18:15 BST
To: priv...@commons.apache.org, "secur...@apache.org" , 
Tomcat Security List , annou...@apache.org, Apache 
Commons Developers List 
Subject: CVE-2016-3092: Apache Commons Fileupload information disclosure 
vulnerability

CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability

Severity: Moderate

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Commons Fileupload 1.3 to 1.3.1
Apache Commons Fileupload 1.2 to 1.2.2
The unsupported Apache Commons Fileupload 1.0.x, and 1.1.x may also be affected.
Apache Tomcat 9.x to 9.0.0M6
Apache Tomcat 8.x to 8.0.35
Apache Tomcat 7.x to 7.0.69
Apache Tomcat 6.x
Unsupported versions of Apache Tomcat, like 5.x may also be affected.
Apache Struts 2.5.x, and previous versions, which are distributing Commons 
FileUpload 1.3.1, or earlier versions.

Description:
A malicious client can send file upload requests that cause the HTTP server 
using the Apache Commons Fileupload library to become unresponsive, preventing 
the server from servicing other requests.

This flaw is not exploitable beyond causing the code to loop expending CPU 
resources.


Mitigation:
All users of Apache Commons Fileupload should upgrade to 1.3.2.
All users of Apache Tomcat should upgrade to 9.0.0M8, 8.0.36, or 7.0.70, 
respectively.
All users of Apache Struts should replace the copy of Commons FileUpload (which 
is distributed as part of Struts) with the fixed version 1.3.2.

Workaround:

System administrators should restrict the permitted maximum size of HTTP 
request header values (For example, Apache Httpd provides a 
LimitRequestFieldSize directive, and Apache Tomcat provides a maxHttpHeaderSize 
attribute in their respective configuration files). A maximum header value size 
of 2048 bytes would block all dangerous request.

Example:
File upload requests contain a so-called boundary in the Content-Type header:

Content-Type: multipart/mixed;
  boundary=gc0p4Jq0M2Yt08jU534c0p

The boundary may be chosen by the request sender. In the case of previous 
versions of Apache Commons Fileupload the boundary becomes dangerous, if its 
size is close to 4096 bytes.

Credit:
TERASOLUNA Framework Development Team at the Software Engineering, Research and 
Development Headquarter, for detecting this flaw, and reporting it to the 
JPCERT/CC, Taki Uchiyama (JPCERT/CC Vulnerability Handling Team) reported this 
problem to us.

References:
https://commons.apache.org/proper/commons-fileupload/security.html

--
The next time you hear: "Don't reinvent the wheel!"

http://www.keystonedevelopment.co.uk/wp-content/uploads/2014/10/evolution-of-the-wheel-300x85.jpg

-
To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org
For additional commands, e-mail: dev-h...@commons.apache.org


Note: Apache Tomcat 6.x and earlier are NOT affected.



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional 
commands, e-mail: dev-h...@tomcat.apache.org



svn commit: r1749635 - in /tomcat/site/trunk: docs/migration-85.html docs/migration-9.html xdocs/migration-85.xml xdocs/migration-9.xml

2016-06-21 Thread kfujino
Author: kfujino
Date: Wed Jun 22 06:02:39 2016
New Revision: 1749635

URL: http://svn.apache.org/viewvc?rev=1749635&view=rev
Log:
Add description about removal of SessionManager attributes to the migration 
guides.

Modified:
tomcat/site/trunk/docs/migration-85.html
tomcat/site/trunk/docs/migration-9.html
tomcat/site/trunk/xdocs/migration-85.xml
tomcat/site/trunk/xdocs/migration-9.xml

Modified: tomcat/site/trunk/docs/migration-85.html
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/migration-85.html?rev=1749635&r1=1749634&r2=1749635&view=diff
==
--- tomcat/site/trunk/docs/migration-85.html (original)
+++ tomcat/site/trunk/docs/migration-85.html Wed Jun 22 06:02:39 2016
@@ -245,6 +245,9 @@
 
 InstanceListener removed
 
+
+SessionManager
+
 
 
 
@@ -486,6 +489,59 @@ of Apache Tomcat.
 
 
   
+
+
+
+  
+
+SessionManager
+
+
+
+The following session manager attribute of has been completely removed in
+8.5.
+
+
+
+  
+
+distributable
+
+  
+
+maxInactiveInterval
+
+  
+
+sessionIdLength
+
+
+
+
+
+Clarify are:
+
+
+  
+The distributable attribute has been deprecated in 8.0
+  and specified value is ignored. This should be configured via the
+  Context. The value is inherited based on the presence or absence of
+  the  element in
+  /WEB-INF/web.xml.
+
+  
+The maxInactiveInterval attribute has been deprecated in
+  8.0. If the value is specified, a warning log is Issued. This should
+  be configured via the Context. The value is inherited based on the
+  value of the  element in
+  /WEB-INF/web.xml.
+  
+The sessionIdLength attribute of Manager has
+  been replaced by sessionIdLength attribute of
+  SessionIdGenerator.
+
+
+  
 
 
 

Modified: tomcat/site/trunk/docs/migration-9.html
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/migration-9.html?rev=1749635&r1=1749634&r2=1749635&view=diff
==
--- tomcat/site/trunk/docs/migration-9.html (original)
+++ tomcat/site/trunk/docs/migration-9.html Wed Jun 22 06:02:39 2016
@@ -263,6 +263,9 @@
 
 InstanceListener removed
 
+
+SessionManager
+
 
 
 
@@ -639,6 +642,64 @@ of Apache Tomcat.
 
 
   
+
+
+
+  
+
+SessionManager
+
+
+
+
+The following change is present in 8.5.0 onwards.
+
+
+
+The following session manager attribute of has been completely removed in
+8.5.
+
+
+
+  
+
+distributable
+
+  
+
+maxInactiveInterval
+
+  
+
+sessionIdLength
+
+
+
+
+
+Clarify are:
+
+
+  
+The distributable attribute has been deprecated in 8.0
+  and specified value is ignored. This should be configured via the
+  Context. The value is inherited based on the presence or absence of
+  the  element in
+  /WEB-INF/web.xml.
+
+  
+The maxInactiveInterval attribute has been deprecated in
+  8.0. If the value is specified, a warning log is Issued. This should
+  be configured via the Context. The value is inherited based on the
+  value of the  element in
+  /WEB-INF/web.xml.
+  
+The sessionIdLength attribute of Manager has
+  been replaced by sessionIdLength attribute of
+  SessionIdGenerator.
+
+
+  
 
 
 

Modified: tomcat/site/trunk/xdocs/migration-85.xml
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/migration-85.xml?rev=1749635&r1=1749634&r2=1749635&view=diff
==
Binary files - no diff available.

Modified: tomcat/site/trunk/xdocs/migration-9.xml
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/migration-9.xml?rev=1749635&r1=1749634&r2=1749635&view=diff
==
--- tomcat/site/trunk/xdocs/migration-9.xml (original)
+++ tomcat/site/trunk/xdocs/migration-9.xml Wed Jun 22 06:02:39 2016
@@ -222,6 +222,37 @@ of Apache Tomcat.
 
   
 
+  
+
+The following change is present in 8.5.0 onwards.
+
+The following session manager attribute of has been completely removed 
in
+8.5.
+
+
+  distributable
+  maxInactiveInterval
+  sessionIdLength
+
+
+Clarify are:
+
+  The distributable attribute has been deprecated in 8.0
+  and specified value is ignored. This should be configured via the
+  Context. The value is inherited based on the presence or absence of
+  the  element in
+  /WEB-INF/web.xml.
+  The maxInactiveInterval attribute has been deprecated in
+  8.0. If the value is specified, a warning log is Issued. This should
+  be configured via the Context. The value is inherited based on the