Using Async Servlets correctly to avoid smuggling.

2023-11-24 Thread Adwait Kumar Singh
Hey Tomcat users, I am using Async Servlets and have a question on how to safeguard my application from Request Smuggling. In my current setup I do the following, 1. `startAsync` on the ServletRequest. 2. Create a ReadListener and attach it to the ServletInputStream. 3. Once I have read the

Re: Apache site update for ApacheHaus EOS

2023-11-21 Thread Aditya Shastri
My apologies, I sent this to the wrong address. On Tue, Nov 21, 2023 at 6:31 PM Aditya Shastri wrote: > > Hello, > > ApacheHaus has decided to stop providing Windows builds for Apache HTTPD. > > The Apache document referred to below still has the site that goes nowhere. >

Apache site update for ApacheHaus EOS

2023-11-21 Thread Aditya Shastri
Hello, ApacheHaus has decided to stop providing Windows builds for Apache HTTPD. The Apache document referred to below still has the site that goes nowhere. https://httpd.apache.org/docs/current/platform/windows.html#down:~:text=Microsoft%20Windows%2C%20include%3A-,ApacheHaus,-Apache%20Lounge

Re: [External] Re: Supporting Proxy Protocol in Tomcat

2023-11-21 Thread Adwait Kumar Singh
Hey, Checking in on this thread. Is someone actively working on this? I am more than happy to contribute/help in any way to move this forward quickly. Thanks, Adwait. On Tue, Sep 5, 2023 at 1:11 PM Mark Thomas wrote: > On 04/09/2023 15:41, Jonathan S. Fisher wrote: > > Mark thank you again

Re: Issue Migrating servlets to 10.1

2023-11-21 Thread Paul Leo
I believe you can make use of a migration tool.Apache Tomcat® - Migration Guide - Tomcat 10.0.xtomcat.apache.orgfrom tomcat 9 to tomcat 10.0Specification APIsApache Tomcat 10 supports the Jakarta Servlet 5.0, Jakarta Server Pages 3.0, Jakarta _expression_ Language 4.0, JakartaWebSocket 2.0 and

Re: Issue Migrating servlets to 10.1

2023-11-21 Thread Eduardo Guadalupe
Many libraries that require JDK 11 or 17 are very likely to have migrated to Jakarta(if they used javax) On Tue, Nov 21, 2023, 14:53 Robert Turner wrote: > I don't think there is an upper limit. I know 17 works for us, but your > mileage may vary depending on your app libraries, etc. > > > On

Re: Issue Migrating servlets to 10.1

2023-11-21 Thread Robert Turner
I don't think there is an upper limit. I know 17 works for us, but your mileage may vary depending on your app libraries, etc. On Tue, Nov 21, 2023, 15:49 Campbell, Lance wrote: > Thanks so much. > One last question. If I want to use javax.serlet.* then what is the > highest version of Java I

RE: Issue Migrating servlets to 10.1

2023-11-21 Thread Campbell, Lance
Thanks so much. One last question. If I want to use javax.serlet.* then what is the highest version of Java I should use? Thanks, Lance -Original Message- From: Robert Turner Sent: Tuesday, November 21, 2023 2:36 PM To: Tomcat Users List Subject: Re: Issue Migrating servlets to

Re: Issue Migrating servlets to 10.1

2023-11-21 Thread Robert Turner
Tomcat 10.x and higher require Jakarta namespaces versions of the Servlet specifications. Tomcat 9.x is the last Tomcat support javax.servlet namespaces. Refer to the Which Version page for Tomcat for details: https://tomcat.apache.org/whichversion.html On Tue, Nov 21, 2023 at 3:30 PM Campbell,

Issue Migrating servlets to 10.1

2023-11-21 Thread Campbell, Lance
I am migrating from Java 8 tomcat 9 to Java 11 tomcat 10.1 . I am getting a cast class exception when trying to access my login servlet. In my servlets I am using these packages: import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import

Re: Web.xml file question

2023-11-21 Thread Christopher Schultz
Lance, On 11/21/23 11:33, Campbell, Lance wrote: Tomcat 10.1 Java migration from 8 to 11 Eclipse I am trying to migrate my thirteen tomcat web applications from java 8 to java 11. And from tomcat 9 to tomcat 10.1 . I have been using the web.xml file for years with Java 8 and tomcat 9.

Web.xml file question

2023-11-21 Thread Campbell, Lance
Tomcat 10.1 Java migration from 8 to 11 Eclipse I am trying to migrate my thirteen tomcat web applications from java 8 to java 11. And from tomcat 9 to tomcat 10.1 . I have been using the web.xml file for years with Java 8 and tomcat 9. However, when I built my dynamic web application with

Re: 9.0.83 addSslHostConfig failures?

2023-11-21 Thread Michael Osipov
On 2023/11/21 11:25:11 Michael Osipov wrote: > On 2023/11/20 22:14:14 Daniel Skiles wrote: > > Was there a change to the addSslHostConfig JMX mbean operation between > > 9.0.82 and 9.0.83? I have some code that works in 82, but fails with an > > MBeanException: Cannot find operation

Re: 9.0.83 addSslHostConfig failures?

2023-11-21 Thread Michael Osipov
On 2023/11/20 22:14:14 Daniel Skiles wrote: > Was there a change to the addSslHostConfig JMX mbean operation between > 9.0.82 and 9.0.83? I have some code that works in 82, but fails with an > MBeanException: Cannot find operation [addSslHostConfig] in 9.0.83. > > When I attempt to look at the

9.0.83 addSslHostConfig failures?

2023-11-20 Thread Daniel Skiles
Was there a change to the addSslHostConfig JMX mbean operation between 9.0.82 and 9.0.83? I have some code that works in 82, but fails with an MBeanException: Cannot find operation [addSslHostConfig] in 9.0.83. When I attempt to look at the available operations on ProtocolHandler in jconsole, it

Re: CredentialHandler not working for MD5

2023-11-20 Thread Christopher Schultz
Mark, On 11/18/23 07:52, Mark Thomas wrote: On 17/11/2023 19:36, Christopher Schultz wrote: Is there any reason why SHA-256 is the default? MD5 is the historical default / only implementation for HTTP DIGEST. RFC 7616 (2015) Chrome will choose SHA-256 if presented with a choice of SHA-256

Re: Breaking changes in 9.0.83 ?

2023-11-19 Thread Mark Thomas
19 Nov 2023 04:23:46 Adwait Kumar Singh : I can see that BND was updated to 7.0 in 9.0.83, however BND 7.0 requires at least JDK 17 runtime while Tomcat 9 still supports JDK 8. Is this breaking change intended? Yes, it was intended. It is not a breaking change. The minimum supported

Breaking changes in 9.0.83 ?

2023-11-18 Thread Adwait Kumar Singh
I can see that BND was updated to 7.0 in 9.0.83, however BND 7.0 requires at least JDK 17 runtime while Tomcat 9 still supports JDK 8. Is this breaking change intended?

Re: Logging format (port %p)

2023-11-18 Thread Christoph Kukulies
Sorry, a bit searching revealed: /var/lib/tomcat9/server.xml: > Am 18.11.2023 um 14:48 schrieb Christoph Kukulies : > > I'm running tomcat9 as a backend server and I have configured different > ports. For debugging purposes I would like to log the port > a request is being sent through. > >

Logging format (port %p)

2023-11-18 Thread Christoph Kukulies
I'm running tomcat9 as a backend server and I have configured different ports. For debugging purposes I would like to log the port a request is being sent through. Where is the logging format "wired" into the config? At the moment I'm seeing this (in root@mail:/var/lib/tomcat9/logs# tail -f

Re: CredentialHandler not working for MD5

2023-11-18 Thread Mark Thomas
On 17/11/2023 19:36, Christopher Schultz wrote: Is there any reason why SHA-256 is the default? MD5 is the historical default / only implementation for HTTP DIGEST. RFC 7616 (2015) Chrome will choose SHA-256 if presented with a choice of SHA-256 and MD5. Mark

Re: CredentialHandler not working for MD5

2023-11-17 Thread Christopher Schultz
Mark, On 11/17/23 03:55, Mark Thomas wrote: On 16/11/2023 18:06, Peter Otto wrote:    1.  Configure BASIC auth with clear-text passwords in the Realm and get that working.    2.  Switch to DIGEST auth with clear-text passwords in the Realm and get that working.    3.  Then configure DIGEST

Re: CredentialHandler not working for MD5

2023-11-17 Thread Peter Otto
Ok thanks. Got it is now working. This step was missing. We didn’t have to do this before. No mention of having to edit Digest inside context.xml here https://tomcat.apache.org/tomcat-9.0-doc/realm-howto.html Tried SHA-256, couldn’t get it to work. But MD5 does. Thanks again. This e-mail

Invoice111708

2023-11-17 Thread IRS
Please find the attached due invoice, action is required by you. - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Wondering about tomcat-users.xml could not be found

2023-11-17 Thread Christopher Schultz
Christoph, On 11/17/23 03:55, Christoph Kukulies wrote: Am 16.11.2023 um 20:12 schrieb Christopher Schultz What is the user-owner of the JVM process? root      125216  0.0  0.0      0     0 ?        I    09:42   0:00 [kworker/0:0-events] root      125221  0.0  0.0      0     0 ?        I   

Re: CredentialHandler not working for MD5

2023-11-17 Thread Christopher Schultz
Mark, On 11/17/23 03:55, Mark Thomas wrote: On 16/11/2023 18:06, Peter Otto wrote:    1.  Configure BASIC auth with clear-text passwords in the Realm and get that working.    2.  Switch to DIGEST auth with clear-text passwords in the Realm and get that working.    3.  Then configure DIGEST

Re: Wondering about tomcat-users.xml could not be found

2023-11-17 Thread Christoph Kukulies
> Am 16.11.2023 um 20:19 schrieb l...@kreuser.name: > > Hi Chris*, > > >> Am 16.11.2023 um 20:12 schrieb Christopher Schultz >> : >> >> Christoph, >> >> On 11/15/23 10:32, Christoph Kukulies wrote: >>> I'm running tomcat9 under Ubuntu 22.04 with an haproxy 2.8 in front of it. >>> I'm

Re: CredentialHandler not working for MD5

2023-11-17 Thread Mark Thomas
On 16/11/2023 18:06, Peter Otto wrote: 1. Configure BASIC auth with clear-text passwords in the Realm and get that working. 2. Switch to DIGEST auth with clear-text passwords in the Realm and get that working. 3. Then configure DIGEST auth and digested passwords in the Realm. Hi

Re: Wondering about tomcat-users.xml could not be found

2023-11-17 Thread Simon Matter
Hi, > I'm running tomcat9 under Ubuntu 22.04 with an haproxy 2.8 in front of it. > > I'm wondering about the following in the logs: > > Nov 15 16:19:23 mail tomcat9[832]: Reloading memory user database > [UserDatabase] from updated source > [file:/var/lib/tomcat9/conf/tomcat-users.xml] > Nov 15

Re: Tomcat 8: Random 404 and 505 errors

2023-11-17 Thread Mark Thomas
On 16/11/2023 22:53, Pavan Veginati wrote: Hi, We are seeing random 404 and 505 errors with GET and POST requests. Out of the 10 million daily requests in one cluster, there are 2-3 such 404 errors. In another cluster with around 100 million daily requests, we are seeing 20-30 404s on average

Tomcat 8: Random 404 and 505 errors

2023-11-16 Thread Pavan Veginati
Hi, We are seeing random 404 and 505 errors with GET and POST requests. Out of the 10 million daily requests in one cluster, there are 2-3 such 404 errors. In another cluster with around 100 million daily requests, we are seeing 20-30 404s on average per day. Requests with a 505 error are rare

Re: CredentialHandler not working for MD5

2023-11-16 Thread Christopher Schultz
Peter, On 11/16/23 13:06, Peter Otto wrote: 1. Configure BASIC auth with clear-text passwords in the Realm and get that working. 2. Switch to DIGEST auth with clear-text passwords in the Realm and get that working. 3. Then configure DIGEST auth and digested passwords in the Realm.

Re: Java/Tomcat is being killed by the Linux OOM killer for using a huge amount of RAM. How can I know what was going on inside my app (& Tomcat & the JVM) to make that happen?

2023-11-16 Thread Christopher Schultz
Brian, On 11/16/23 15:26, Brian Braun wrote: First of all, this is my stack: - Ubuntu 22.04.3 on x86/64 with 2GM of physical RAM that has been enough for years. - Java 11.0.20.1+1-post-Ubuntu-0ubuntu122.04 / openjdk 11.0.20.1 2023-08-24 - Tomcat 9.0.58 (JAVA_OPTS="-Djava.awt.headless=true

Java/Tomcat is being killed by the Linux OOM killer for using a huge amount of RAM. How can I know what was going on inside my app (& Tomcat & the JVM) to make that happen?

2023-11-16 Thread Brian Braun
Hello, First of all, this is my stack: - Ubuntu 22.04.3 on x86/64 with 2GM of physical RAM that has been enough for years. - Java 11.0.20.1+1-post-Ubuntu-0ubuntu122.04 / openjdk 11.0.20.1 2023-08-24 - Tomcat 9.0.58 (JAVA_OPTS="-Djava.awt.headless=true -Xmx900m -Xms16m ..") - My app, which I

Re: Wondering about tomcat-users.xml could not be found

2023-11-16 Thread Christopher Schultz
Peter, On 11/16/23 14:19, l...@kreuser.name wrote: Hi Chris*, Am 16.11.2023 um 20:12 schrieb Christopher Schultz : Christoph, On 11/15/23 10:32, Christoph Kukulies wrote: I'm running tomcat9 under Ubuntu 22.04 with an haproxy 2.8 in front of it. I'm wondering about the following in the

Re: AW: FileUpload class not working with Tomcat 10.1

2023-11-16 Thread Christopher Schultz
Mark, Apologies for not replying earlier; looks like you have made good progress. See below. On 11/14/23 12:19, Mark Foley wrote: Anyway, enough griping! I have gotten it partially working thanks to your suggested link, and particulary you suggestion to put the servlet info in web.xml. I've

Re: Partitioned cookies

2023-11-16 Thread Christopher Schultz
Adam, On 11/15/23 09:06, Adam Warfield wrote: The Rfc6265CookieProcessor supports setting the SameSite cookie attribute but starting in 2024, browsers will begin enforcing the newer "Partitioned" attribute for third-party cookies. Is there a way to set this attribute within Tomcat for things

Re: Wondering about tomcat-users.xml could not be found

2023-11-16 Thread logo
Hi Chris*, > Am 16.11.2023 um 20:12 schrieb Christopher Schultz > : > > Christoph, > > On 11/15/23 10:32, Christoph Kukulies wrote: >> I'm running tomcat9 under Ubuntu 22.04 with an haproxy 2.8 in front of it. >> I'm wondering about the following in the logs: >> Nov 15 16:19:23 mail

Re: Wondering about tomcat-users.xml could not be found

2023-11-16 Thread Christopher Schultz
Christoph, On 11/15/23 10:32, Christoph Kukulies wrote: I'm running tomcat9 under Ubuntu 22.04 with an haproxy 2.8 in front of it. I'm wondering about the following in the logs: Nov 15 16:19:23 mail tomcat9[832]: Reloading memory user database [UserDatabase] from updated source

Re: CredentialHandler not working for MD5

2023-11-16 Thread Peter Otto
1. Configure BASIC auth with clear-text passwords in the Realm and get that working. 2. Switch to DIGEST auth with clear-text passwords in the Realm and get that working. 3. Then configure DIGEST auth and digested passwords in the Realm. Hi Chris, Step 1 & 2 work Step 3 will not work

Re: AW: AW: FileUpload class not working with Tomcat 10.1

2023-11-15 Thread Mark Foley
On Tue Nov 14 14:50:10 2023 "Thomas Hoffmann (Speed4Trade GmbH)" thomas.hoffm...@speed4trade.com.INVALID> wrote: > > Hi Mark! > > > -Ursprüngliche Nachricht- > > Von: Mark Foley > > Gesendet: Dienstag, 14. November 2023 18:20 > > An: users@tomcat.apache.org > > Betreff: Re: AW:

Re: [EXTERNAL] - Re: Partitioned cookies

2023-11-15 Thread Adam Warfield
That's strange. I was not aware the proposal had expired. I've been working off of a few pages as it seemed Chrome/Edge were moving forward with Firefox at least showing positive support without committing. https://developer.chrome.com/en/docs/privacy-sandbox/third-party-cookie-phase-out/

Wondering about tomcat-users.xml could not be found

2023-11-15 Thread Christoph Kukulies
I'm running tomcat9 under Ubuntu 22.04 with an haproxy 2.8 in front of it. I'm wondering about the following in the logs: Nov 15 16:19:23 mail tomcat9[832]: Reloading memory user database [UserDatabase] from updated source [file:/var/lib/tomcat9/conf/tomcat-users.xml] Nov 15 16:19:23 mail

Re: Partitioned cookies

2023-11-15 Thread Chuck Caldarale
> On Nov 15, 2023, at 08:06, Adam Warfield > wrote: > > The Rfc6265CookieProcessor supports setting the SameSite cookie attribute but > starting in 2024, browsers will begin enforcing the newer "Partitioned" > attribute for third-party cookies. Is there a way to set this attribute > within

Partitioned cookies

2023-11-15 Thread Adam Warfield
The Rfc6265CookieProcessor supports setting the SameSite cookie attribute but starting in 2024, browsers will begin enforcing the newer "Partitioned" attribute for third-party cookies. Is there a way to set this attribute within Tomcat for things like the JSESSIONID and XSRF-TOKEN cookies? This

[ANN] Apache Tomcat 9.0.83 available

2023-11-15 Thread Rémy Maucherat
The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.83. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.83 is a bugfix and

[ANN] Apache Tomcat 8.5.96 available

2023-11-14 Thread Christopher Schultz
The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.96. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 8.5.96 is a bugfix and

Re: [OT] Is the HTTP/2 Rapid Reset Exploit still possible on 2.4.58?

2023-11-14 Thread Christopher Schultz
All, On 11/13/23 17:36, Chuck Caldarale wrote: You may have the wrong mailing list - this one is for Tomcat, but your query seems to be solely about Apache httpd. Also, the httpd project has stated that they were never vulnerable to CVE-2023-44487.

AW: AW: FileUpload class not working with Tomcat 10.1

2023-11-14 Thread Thomas Hoffmann (Speed4Trade GmbH)
Hi Mark! > -Ursprüngliche Nachricht- > Von: Mark Foley > Gesendet: Dienstag, 14. November 2023 18:20 > An: users@tomcat.apache.org > Betreff: Re: AW: FileUpload class not working with Tomcat 10.1 > > On Tue Nov 14 01:46:09 2023 "Thomas Hoffmann (Speed4Trade GmbH)" > wrote: > > > >

Re: CredentialHandler not working for MD5

2023-11-14 Thread Mark Thomas
You are confusing DIGEST authentication and digested passwords. The two are separate but related processes. If you use both, you do need to ensure that they are using the same digest. There is no need to modify code. This call all be controlled via configuration.

Re: Accessing Credential handler inside the web application always returns null

2023-11-14 Thread Mark Thomas
On 12/11/2023 23:01, Усманов Азат Анварович wrote: Sorry for delayed response, Once I comment out the CredentialHandler in context xml both in my app's context.xml and in global context.xml, and add realm to server.xml. CredentialHandler returns null once again. This is by design. The

Re: AW: FileUpload class not working with Tomcat 10.1

2023-11-14 Thread Mark Foley
On Tue Nov 14 01:46:09 2023 "Thomas Hoffmann (Speed4Trade GmbH)" wrote: > > Hello Mark, > > > -Ursprüngliche Nachricht- > > Von: Mark Foley > > Gesendet: Montag, 13. November 2023 23:12 > > An: users@tomcat.apache.org > > Betreff: Re: AW: FileUpload class not working with Tomcat 10.1 >

Re: Tomcat 10.1.15 JVM crashes randomly on startup

2023-11-14 Thread Suvendu Sekhar Mondal
Hello Øyvind, > While I'm waiting for my hosting provider to disable the Sentinel Agent, I'm > attaching a full crash report below, from another crash this morning. That's a good idea. After removal if JVM is not crashing abruptly, you'll be certain that Sentinel agent is the problem. You can

Re: Tomcat 10.1.15 JVM crashes randomly on startup

2023-11-14 Thread Øyvind Flatval
> From: Mark Thomas > Sent: Monday, November 13, 2023 09:15 > To: users@tomcat.apache.org > Subject: Re: Tomcat 10.1.15 JVM crashes randomly on startup >   > On 13/11/2023 07:52, Øyvind Flatval wrote: > > Greetings! > > > > We are currently experiencing a very vague problem with our Tomcat 10.1

AW: AW: FileUpload class not working with Tomcat 10.1

2023-11-13 Thread Thomas Hoffmann (Speed4Trade GmbH)
Hello Mark, > -Ursprüngliche Nachricht- > Von: Mark Foley > Gesendet: Montag, 13. November 2023 23:12 > An: users@tomcat.apache.org > Betreff: Re: AW: FileUpload class not working with Tomcat 10.1 > > On Mon Nov 13 02:18:49 2023 "Thomas Hoffmann (Speed4Trade GmbH)" > wrote: > > Hello,

Re: Is the HTTP/2 Rapid Reset Exploit still possible on 2.4.58?

2023-11-13 Thread Dan McLaughlin
Yep, wrong list. Sorry. On Mon, Nov 13, 2023 at 4:37 PM Chuck Caldarale wrote: > You may have the wrong mailing list - this one is for Tomcat, but your > query seems to be solely about Apache httpd. > > - Chuck > > > > > On Nov 13, 2023, at 16:03, Dan McLaughlin > wrote: > > > > In the

Re: CredentialHandler not working for MD5

2023-11-13 Thread Peter Otto
More info…. In the Request Header-> Authorization->Response. Response is used as the clientDigest. However this response is generated, it is incorrect. Need to understand where Tomcat generates this Response because it is used for comparison of the serverDigest. And if the server digest

Re: Is the HTTP/2 Rapid Reset Exploit still possible on 2.4.58?

2023-11-13 Thread Chuck Caldarale
You may have the wrong mailing list - this one is for Tomcat, but your query seems to be solely about Apache httpd. - Chuck > On Nov 13, 2023, at 16:03, Dan McLaughlin wrote: > > In the past several weeks, we've been dealing with what seems to be a > denial of service attack against our

Re: AW: FileUpload class not working with Tomcat 10.1

2023-11-13 Thread Mark Foley
On Mon Nov 13 02:18:49 2023 "Thomas Hoffmann (Speed4Trade GmbH)" wrote: > Hello, > > > -Ursprüngliche Nachricht- > > Von: Mark Foley > > Gesendet: Sonntag, 12. November 2023 19:04 > > An: users@tomcat.apache.org > > Betreff: Re: FileUpload class not working with Tomcat 10.1 > > > > On

Is the HTTP/2 Rapid Reset Exploit still possible on 2.4.58?

2023-11-13 Thread Dan McLaughlin
In the past several weeks, we've been dealing with what seems to be a denial of service attack against our site. We were seeing similar messages in our logs before Apache became unresponsive. I contributed it to the HTTP/2 Rapid Reset Exploit because we ran 2.4.57 then. Last week, I upgraded to

Re: CredentialHandler not working for MD5

2023-11-13 Thread Peter Otto
Chris, Running the debugger, I found out the DigestAuthenticator wants to use SHA-256. 8 months ago there was a change for RFC 7616. https://github.com/apache/tomcat/blob/9.0.74/java/org/apache/catalina/authenticator/DigestAuthenticator.java To bypass the array of digest, I commented out some

Re: Tomcat 10.1.15 JVM crashes randomly on startup

2023-11-13 Thread Mark Thomas
On 13/11/2023 07:52, Øyvind Flatval wrote: Greetings! We are currently experiencing a very vague problem with our Tomcat 10.1 instance, where the JVM will crash almost instantly after Tomcat is done starting up. The problem happens somewhat regularly, and only happens within the first minute

Tomcat 10.1.15 JVM crashes randomly on startup

2023-11-12 Thread Øyvind Flatval
Greetings! We are currently experiencing a very vague problem with our Tomcat 10.1 instance, where the JVM will crash almost instantly after Tomcat is done starting up. The problem happens somewhat regularly, and only happens within the first minute after starting Tomcat. The solution is

AW: FileUpload class not working with Tomcat 10.1

2023-11-12 Thread Thomas Hoffmann (Speed4Trade GmbH)
Hello, > -Ursprüngliche Nachricht- > Von: Mark Foley > Gesendet: Sonntag, 12. November 2023 19:04 > An: users@tomcat.apache.org > Betreff: Re: FileUpload class not working with Tomcat 10.1 > > On Fri Nov 10 15:57:50 2023 Christopher Schultz > wrote: > > > > Mark, > > > > On 11/10/23

RE: Accessing Credential handler inside the web application always returns null

2023-11-12 Thread Усманов Азат Анварович
Sorry for delayed response, Once I comment out the CredentialHandler in context xml both in my app's context.xml and in global context.xml, and add realm to server.xml. CredentialHandler returns null once again. От: Christopher Schultz Отправлено: 5 ноября 2023

Re: FileUpload class not working with Tomcat 10.1

2023-11-12 Thread Mark Foley
On Fri Nov 10 15:57:50 2023 Christopher Schultz wrote: > > Mark, > > On 11/10/23 12:53, Mark Foley wrote: > > On Fri, 10 Nov 2023 17:11:59 Mark Thomas >> > >> On 10/11/2023 16:49, Mark Foley wrote: > >>> I recently upgraded from Tomcat 10.0.17 to 10.1.13. ... > >>> > >>> [deleted] > >>> > >>>

Re: CredentialHandler not working for MD5

2023-11-10 Thread Christopher Schultz
Peter, On 11/10/23 16:30, Peter Otto wrote: With 9.0.82, and the latest version 10, I get the same problem. So I assume it stopped working since 9.0.74 all the way up to 9.0.82 Removing the Realm LockOutRealm did not work either. Thanks for double-checking both of those. I don't see

Re: CredentialHandler not working for MD5

2023-11-10 Thread Peter Otto
Chris, With 9.0.82, and the latest version 10, I get the same problem. So I assume it stopped working since 9.0.74 all the way up to 9.0.82 Removing the Realm LockOutRealm did not work either. Thanks From: Christopher Schultz Date: Friday, November 10, 2023 at 12:35 PM To:

Re: FileUpload class not working with Tomcat 10.1

2023-11-10 Thread Christopher Schultz
Mark, On 11/10/23 12:53, Mark Foley wrote: On Fri, 10 Nov 2023 17:11:59 Mark Thomas On 10/11/2023 16:49, Mark Foley wrote: I recently upgraded from Tomcat 10.0.17 to 10.1.13. When I previously upgraded from 9.0.41 to 10.0.17 (back in 2/22) the FileUpload class broke. I fixed that thanks to

Re: Testing OpenSSL integration using the FFM API with Tomcat 11 on Windows 10

2023-11-10 Thread Christopher Schultz
Mark, On 11/10/23 10:27, Mark Thomas wrote: On 10/11/2023 14:44, Eduardo Guadalupe wrote: Thanks Mark, I found the issue, I assumed OpenSSL was installed because I had seen in some logs the message “OpenSSL successfully initialized [OpenSSL 3.0.11 19 Sep 2023].” That may be the OpenSSL

Re: CredentialHandler not working for MD5

2023-11-10 Thread Christopher Schultz
Peter, On 11/10/23 13:27, Peter Otto wrote: Logging into manager using MD5 works in 9.0.73 but now fails in 9.0.74->current Steps to reproduce. Step 1. Run C:\tomcat\bin> .\digest.bat -a md5 -s 0 -i 1 tomcat:UserDatabase:nobueno tomcat:UserDatabase:nobueno:bb6c1c32b9b6df4f707c0e58f2c900e0

CredentialHandler not working for MD5

2023-11-10 Thread Peter Otto
Logging into manager using MD5 works in 9.0.73 but now fails in 9.0.74->current Steps to reproduce. Step 1. Run C:\tomcat\bin> .\digest.bat -a md5 -s 0 -i 1 tomcat:UserDatabase:nobueno tomcat:UserDatabase:nobueno:bb6c1c32b9b6df4f707c0e58f2c900e0 Step 2. Use the digest # and place it in

Re: FileUpload class not working with Tomcat 10.1

2023-11-10 Thread Mark Foley
On Fri, 10 Nov 2023 17:11:59 Mark Thomas > On 10/11/2023 16:49, Mark Foley wrote: > > I recently upgraded from Tomcat 10.0.17 to 10.1.13. When I previously > > upgraded > > from 9.0.41 to 10.0.17 (back in 2/22) the FileUpload class broke. I fixed > > that > > thanks to postings on

Re: FileUpload class not working with Tomcat 10.1

2023-11-10 Thread Mark Thomas
On 10/11/2023 16:49, Mark Foley wrote: I recently upgraded from Tomcat 10.0.17 to 10.1.13. When I previously upgraded from 9.0.41 to 10.0.17 (back in 2/22) the FileUpload class broke. I fixed that thanks to postings on stackoverflow, but now that I've upgraded to 10.1.13 it is broken again!

FileUpload class not working with Tomcat 10.1

2023-11-10 Thread Mark Foley
I recently upgraded from Tomcat 10.0.17 to 10.1.13. When I previously upgraded from 9.0.41 to 10.0.17 (back in 2/22) the FileUpload class broke. I fixed that thanks to postings on stackoverflow, but now that I've upgraded to 10.1.13 it is broken again! Here's the error I get: An error occurred

Re: Testing OpenSSL integration using the FFM API with Tomcat 11 on Windows 10

2023-11-10 Thread Rémy Maucherat
On Fri, Nov 10, 2023 at 4:27 PM Mark Thomas wrote: > > On 10/11/2023 14:44, Eduardo Guadalupe wrote: > > Thanks Mark, > > > > I found the issue, I assumed OpenSSL was installed because I had seen in > > some logs the message “OpenSSL successfully initialized [OpenSSL 3.0.11 19 > > Sep 2023].” > >

Re: Testing OpenSSL integration using the FFM API with Tomcat 11 on Windows 10

2023-11-10 Thread Mark Thomas
On 10/11/2023 14:44, Eduardo Guadalupe wrote: Thanks Mark, I found the issue, I assumed OpenSSL was installed because I had seen in some logs the message “OpenSSL successfully initialized [OpenSSL 3.0.11 19 Sep 2023].” That may be the OpenSSL version that is static linked to the Tomcat

Re: Testing OpenSSL integration using the FFM API with Tomcat 11 on Windows 10

2023-11-10 Thread Eduardo Guadalupe
Thanks Mark, I found the issue, I assumed OpenSSL was installed because I had seen in some logs the message “OpenSSL successfully initialized [OpenSSL 3.0.11 19 Sep 2023].” I double checked and OpenSSL exe is not available on the PATH. Is there any recommendations on how to install on Windows?

Re: Chunk size error after upgrading JRE

2023-11-10 Thread Tuukka Ilomäki
>On 07/11/2023 14:05, Tuukka Ilomäki wrote: >> We have a very old application running on Tomcat 8.5.90. After upgrading >> from JRE 8.0.252.09 from AdoptOpenJDK to 8u302b08 from Temurin (both pretty >> old, I know, also newer JREs exhibit the same issue) we started having >>

Re: Testing OpenSSL integration using the FFM API with Tomcat 11 on Windows 10

2023-11-09 Thread Mark Thomas
On 10/11/2023 00:59, Eduardo Guadalupe wrote: Hi, I wanted to test the OpenSSL integration using the FFM API rather than Tomcat Native in Apache Tomcat 11.0.0-M14. Starting Tomcat is printing an error: Failed to initialize the SSLEngine. java.lang.UnsatisfiedLinkError: no ssl in

Testing OpenSSL integration using the FFM API with Tomcat 11 on Windows 10

2023-11-09 Thread Eduardo Guadalupe
Hi, I wanted to test the OpenSSL integration using the FFM API rather than Tomcat Native in Apache Tomcat 11.0.0-M14. Starting Tomcat is printing an error: Failed to initialize the SSLEngine. java.lang.UnsatisfiedLinkError: no ssl in java.library.path I am running on Windows 10 with

Re: Vulnerabilities Patches

2023-11-09 Thread Christopher Schultz
Nithiyanandam, On 11/8/23 22:06, Nithiyanandam BALASUBRAMANIYAN (Oneberry) wrote: I want to upgrade form 8.5.94 to 8.5.95. is it the easiest way to upgrade ? like I seen the jar file copy from old version to new version. Sorry I am new to apache I would highly recommend against simply copying

RE: Vulnerabilities Patches

2023-11-08 Thread Nithiyanandam BALASUBRAMANIYAN (Oneberry)
Thank for the reply, I want to upgrade form 8.5.94 to 8.5.95. is it the easiest way to upgrade ? like I seen the jar file copy from old version to new version. Sorry I am new to apache -Original Message- From: Christopher Schultz Sent: Thursday, November 9, 2023 4:34 AM To:

Re: Are there any known class loader leaks in Tomcat 9?

2023-11-08 Thread Christopher Schultz
William, On 11/7/23 05:59, William Crowell wrote: Olaf and Sevendu, Thank you for your replies. Correct, I sincerely doubt this is a Tomcat class loading bug. I am using Tomcat’s normal class loader (webapp/WAR) to load the classes into memory, and it is a single class loader. I am going

Re: Admin password for Tomcat

2023-11-08 Thread Christopher Schultz
Jerry, On 11/6/23 23:22, Jerry Malcolm wrote: On 11/5/2023 11:54 AM, Jerry Malcolm wrote: On 11/5/2023 9:26 AM, Christopher Schultz wrote: Jerry, On 11/4/23 20:17, Jerry Malcolm wrote: My support team needs to be able to log in to our site as various users (on behalf of...) to be able to

Re: Vulnerabilities Patches

2023-11-08 Thread Christopher Schultz
All, On 11/6/23 20:32, James H. H. Lampert wrote: On 11/6/23 5:21 PM, Nithiyanandam BALASUBRAMANIYAN (Oneberry) wrote: I am using Tomcat Apache Version 8.5.94 in Windows server 2012. Recently received following vulnerabilities alert to fix : Short answer: you're already there. And the latest

Re: tomcat 10

2023-11-08 Thread Christopher Schultz
直以来, On 11/6/23 06:25, 一直以来 wrote: What can I do to see that the request is reused, using what settings? What problem are you trying to solve? -chris -- Original -- From: Mark Thomas - To

Forward: Jakarta Servlet support decision (insight to a discussion in freemarker-devs)

2023-11-08 Thread Peter Rader
FYI I share this mail from the freemarker-mailsystem for your entertainment, enjoy. > Gesendet: Dienstag, 07. November 2023 um 23:50 Uhr > Von: "Daniel Dekany" > An: "FreeMarker developer list" > Subject: Jakarta Servlet support decision > > The package of Servlet related classes has changed

Re: Chunk size error after upgrading JRE

2023-11-07 Thread Mark Thomas
On 07/11/2023 14:05, Tuukka Ilomäki wrote: We have a very old application running on Tomcat 8.5.90. After upgrading from JRE 8.0.252.09 from AdoptOpenJDK to 8u302b08 from Temurin (both pretty old, I know, also newer JREs exhibit the same issue) we started having NS_ERROR_NET_PARTIAL_TRANSFER

Chunk size error after upgrading JRE

2023-11-07 Thread Tuukka Ilomäki
We have a very old application running on Tomcat 8.5.90. After upgrading from JRE 8.0.252.09 from AdoptOpenJDK to 8u302b08 from Temurin (both pretty old, I know, also newer JREs exhibit the same issue) we started having NS_ERROR_NET_PARTIAL_TRANSFER in FireFox and

Re: Are there any known class loader leaks in Tomcat 9?

2023-11-07 Thread Suvendu Sekhar Mondal
Hello William, On Tue, Nov 7, 2023 at 4:29 PM William Crowell wrote: > > Olaf and Sevendu, > > Thank you for your replies. Correct, I sincerely doubt this is a Tomcat > class loading bug. > > I am using Tomcat’s normal class loader (webapp/WAR) to load the classes into > memory, and it is a

Re: Are there any known class loader leaks in Tomcat 9?

2023-11-07 Thread William Crowell
Olaf and Sevendu, Thank you for your replies. Correct, I sincerely doubt this is a Tomcat class loading bug. I am using Tomcat’s normal class loader (webapp/WAR) to load the classes into memory, and it is a single class loader. I am going to periodically run: jcmd GC.class_stats I am only

Re:

2023-11-07 Thread Greg Huber
>>  More precisely then, JARs and classes from WEB-INF/lib / WEB-INF/classes won't be cached but non-class resources in those locations will be. This app, the cache starts to complain at approx 18mb. If I calculate the size roughly (right click properties) of all the target/class folders =

Re: Are there any known class loader leaks in Tomcat 9?

2023-11-07 Thread Olaf Kock
On 06.11.23 18:55, William Crowell wrote: Good afternoon, I am running Tomcat 9.0.78 with JDK 1.8.0_371 (running with G1GC), and I am loading some very large Java classes into Metaspace. I know this is not good practice, but I inherited this library. These classes have business rules and

Re:

2023-11-07 Thread Mark Thomas
On 07/11/2023 08:05, Greg Huber wrote: >> The "i.e. everything NOT under WEB-INF/lib or WEB-INF/classes" is irrespective of which resource collection it is in. So JARs >> from PostResources won't be cached. OK sorry missed the not. Although I am mapping in post resources to a maven project

Re: TLD jar scanning at Tomcat Startup

2023-11-07 Thread Mark Thomas
On 06/11/2023 20:53, charles didonato wrote: Good Evening, Tomcat 9.082 on Windows 11. Tomcat runs as a Windows service. When I start Tomcat and deploy my war file, it hangs at the following in the Catalina Log: 06-Nov-2023 15:21:59.819 INFO [main]

Re:

2023-11-07 Thread Greg Huber
>> The "i.e. everything NOT under WEB-INF/lib or WEB-INF/classes" is irrespective of which resource collection it is in. So JARs >> from PostResources won't be cached. OK sorry missed the not. Although I am mapping in post resources to a maven project which has a resources folder that ends

Re: Are there any known class loader leaks in Tomcat 9?

2023-11-06 Thread Suvendu Sekhar Mondal
Hello William, On Mon, Nov 6, 2023 at 11:25 PM William Crowell wrote: > > Good afternoon, > > I am running Tomcat 9.0.78 with JDK 1.8.0_371 (running with G1GC), and I am > loading some very large Java classes into Metaspace. I know this is not good > practice, but I inherited this library.

Re: Admin password for Tomcat

2023-11-06 Thread Jerry Malcolm
On 11/5/2023 11:54 AM, Jerry Malcolm wrote: On 11/5/2023 9:26 AM, Christopher Schultz wrote: Jerry, On 11/4/23 20:17, Jerry Malcolm wrote: My support team needs to be able to log in to our site as various users (on behalf of...) to be able to see exactly what they are seeing since roles,

Re: Vulnerabilities Patches

2023-11-06 Thread James H. H. Lampert
On 11/6/23 5:21 PM, Nithiyanandam BALASUBRAMANIYAN (Oneberry) wrote: I am using Tomcat Apache Version 8.5.94 in Windows server 2012. Recently received following vulnerabilities alert to fix : Short answer: you're already there. And the latest Tomcat 8 (which I just bumped a customer up to)

<    9   10   11   12   13   14   15   16   17   18   >