[Bug 55536] allow to disable Secure Client-Initiated Renegotiation in Java TLS - DOS risk

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=55536 --- Comment #5 from yuyan --- For now, I find two solutions for this problem to share: 1 improve the jdk to java8 and set the system property as Ralf Hauser said: System.setProperty("jdk.tls.rejectClientInitiatedRenegotiation", "true"); 2 use

svn commit: r1675235 - in /tomcat/tc7.0.x/trunk: java/org/apache/catalina/ha/session/mbeans-descriptors.xml webapps/docs/changelog.xml

2015-04-21 Thread kfujino
Author: kfujino Date: Wed Apr 22 00:53:33 2015 New Revision: 1675235 URL: http://svn.apache.org/r1675235 Log: Remove unused pathname attribute in mbean definition of BackupManager. Modified: tomcat/tc7.0.x/trunk/java/org/apache/catalina/ha/session/mbeans-descriptors.xml tomcat/tc7.0.x/tr

svn commit: r1675234 - in /tomcat/tc8.0.x/trunk: java/org/apache/catalina/ha/session/mbeans-descriptors.xml webapps/docs/changelog.xml

2015-04-21 Thread kfujino
Author: kfujino Date: Wed Apr 22 00:52:09 2015 New Revision: 1675234 URL: http://svn.apache.org/r1675234 Log: Remove unused pathname attribute in mbean definition of BackupManager. Modified: tomcat/tc8.0.x/trunk/java/org/apache/catalina/ha/session/mbeans-descriptors.xml tomcat/tc8.0.x/tr

svn commit: r1675233 - /tomcat/trunk/java/org/apache/catalina/ha/session/mbeans-descriptors.xml

2015-04-21 Thread kfujino
Author: kfujino Date: Wed Apr 22 00:50:57 2015 New Revision: 1675233 URL: http://svn.apache.org/r1675233 Log: Remove unused pathname attribute in mbean definition of BackupManager. Modified: tomcat/trunk/java/org/apache/catalina/ha/session/mbeans-descriptors.xml Modified: tomcat/trunk/java/

svn commit: r1675198 - in /tomcat/trunk: java/org/apache/tomcat/util/net/AprEndpoint.java java/org/apache/tomcat/util/net/SSLHostConfig.java webapps/docs/config/http.xml

2015-04-21 Thread markt
Author: markt Date: Tue Apr 21 20:56:14 2015 New Revision: 1675198 URL: http://svn.apache.org/r1675198 Log: Document the protocols attribute for SSLHostConfig and align the implementation with it. Modified: tomcat/trunk/java/org/apache/tomcat/util/net/AprEndpoint.java tomcat/trunk/java/o

[GUMP@vmgump]: Project tomcat-tc8.0.x-test-bio (in module tomcat-8.0.x) failed

2015-04-21 Thread Bill Barker
it/target/junit-4.13-SNAPSHOT.jar -Dobjenesis.jar=/srv/gump/public/workspace/objenesis/main/target/objenesis-2.2-SNAPSHOT.jar -Dtest.reports=output/logs-BIO -Dtomcat-native.tar.gz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-20150421-native-src.tar.gz -Dexampl

[Bug 57841] Change logging defaults to avoid unusable feedback by default

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57841 --- Comment #2 from krich...@posteo.de --- No, it's really only that. I found more detailed error details including an exception stack in `logs/localhost.-MM-DD.log`. That should be displayed in stdout or referenced there. -- You are recei

svn commit: r1675185 - in /tomcat/trunk: java/org/apache/coyote/http11/AbstractHttp11Protocol.java java/org/apache/tomcat/util/net/SSLHostConfig.java webapps/docs/config/http.xml

2015-04-21 Thread markt
Author: markt Date: Tue Apr 21 19:07:58 2015 New Revision: 1675185 URL: http://svn.apache.org/r1675185 Log: Start to document SSLHostConfig Tweak implementation to align with how my thinking evolved while writing the docs so far Modified: tomcat/trunk/java/org/apache/coyote/http11/AbstractHt

[Bug 57808] Don't preload all charsets

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57808 Fredrik Jonson changed: What|Removed |Added CC||fred...@jonson.org -- You are receiv

[Bug 57837] add "text/css" to default of compressableMimeType

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57837 --- Comment #5 from Christopher Schultz --- Don't forget that the availability of sendFile trumps any compression configuration. -- You are receiving this mail because: You are the assignee for the bug. --

[Bug 57841] Change logging defaults to avoid unusable feedback by default

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57841 --- Comment #1 from Christopher Schultz --- There is usually a "Caused by" section below the "Error listenerStart" line. Is that not the case? -- You are receiving this mail because: You are the assignee for the bug.

Re: Coverity Scan

2015-04-21 Thread Violeta Georgieva
2015-04-21 17:26 GMT+03:00 Violeta Georgieva : > > Hi, > > > 2015-01-22 12:13 GMT+02:00 Violeta Georgieva : > > > > > > > > 2015-01-22 9:02 GMT+02:00 Violeta Georgieva : > > > > > > Hi, > > > > > > I would like to update the coverity scan report. > > > As the previous one was based on Tomcat 8 (bac

Re: Coverity Scan

2015-04-21 Thread Violeta Georgieva
Hi, 2015-01-22 12:13 GMT+02:00 Violeta Georgieva : > > > > 2015-01-22 9:02 GMT+02:00 Violeta Georgieva : > > > > Hi, > > > > I would like to update the coverity scan report. > > As the previous one was based on Tomcat 8 (back in the time it was trunk) I think to base the scan again on Tomcat 8. >

[Bug 57837] add "text/css" to default of compressableMimeType

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57837 Ralf Hauser changed: What|Removed |Added Severity|normal |enhancement Summary|"compress

[Bug 57841] New: Change logging defaults to avoid unusable feedback by default

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57841 Bug ID: 57841 Summary: Change logging defaults to avoid unusable feedback by default Product: Tomcat 7 Version: 7.0.57 Hardware: PC OS: Linux

[Bug 57808] Don't preload all charsets

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57808 --- Comment #8 from Mark Thomas --- (In reply to Fredrik Jonson from comment #7) > (In reply to Mark Thomas from comment #6) > > > It means you don't have to cache the misses since misses have their own DoS > > potential. > > Is it correct th

[Bug 57839] Commons DBCP Closed Connection error

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57839 Mark Thomas changed: What|Removed |Added Status|NEW |RESOLVED Resolution|---

[Bug 57808] Don't preload all charsets

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57808 --- Comment #7 from Fredrik Jonson --- (In reply to Mark Thomas from comment #6) > It means you don't have to cache the misses since misses have their own DoS > potential. Is it correct that there are two possible DOS attacks with dynamic cha

[Bug 57839] New: Commons DBCP Closed Connection error

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57839 Bug ID: 57839 Summary: Commons DBCP Closed Connection error Product: Tomcat 6 Version: 6.0.5 Hardware: PC OS: Linux Status: NEW Severity: normal

[GUMP@vmgump]: Project tomcat-trunk-test-apr (in module tomcat-trunk) failed

2015-04-21 Thread Bill Barker
ump/public/workspace/junit/target/junit-4.13-SNAPSHOT.jar -Dobjenesis.jar=/srv/gump/public/workspace/objenesis/main/target/objenesis-2.2-SNAPSHOT.jar -Dtest.reports=output/logs-APR -Dtomcat-native.tar.gz=/srv/gump/public/workspace/apache-commons/daemon/dist/bin/commons-daemon-201504

[Bug 57837] "compression" in server.xml not considered sufficient by google

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57837 --- Comment #3 from Rainer Jung --- The google test lists a css as an example. We should probably add css and JavaScript files to the default list. To Ralf: Does ist work for the mime types cited by Violeta? You can change the list with the at

[Bug 57830] Add support for ProxyProtocol

2015-04-21 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=57830 --- Comment #5 from Bill Barker --- Ok, so I miss read the spec. After reading the spec again, I have lost all interest in this issue. -- You are receiving this mail because: You are the assignee for the bug. ---