[pkg-java] r12686 - in trunk/tomcat6/debian: . patches
Torsten Werner
twerner at alioth.debian.org
Mon Jun 28 20:00:37 UTC 2010
Author: twerner
Date: 2010-06-28 20:00:35 +0000 (Mon, 28 Jun 2010)
New Revision: 12686
Added:
trunk/tomcat6/debian/patches/0001-set-UTF-8-as-default-character-encoding.patch
trunk/tomcat6/debian/patches/0002-do-not-load-AJP13-connector-by-default.patch
trunk/tomcat6/debian/patches/0003-disable-APR-library-loading.patch
trunk/tomcat6/debian/patches/0004-split-deploy-webapps-target-from-deploy-target.patch
trunk/tomcat6/debian/patches/0005-change-default-DBCP-factory-class.patch
trunk/tomcat6/debian/patches/0006-add-JARs-below-var-to-class-loader.patch
trunk/tomcat6/debian/patches/0007-add-OSGi-headers-to-servlet-api.patch
trunk/tomcat6/debian/patches/0008-add-OSGI-headers-to-jsp-api.patch
trunk/tomcat6/debian/patches/0009-allow-empty-PID-file.patch
trunk/tomcat6/debian/patches/0010-avoid-deadlock-in-WebappClassLoader.patch
trunk/tomcat6/debian/patches/0011-Use-java.security.policy-file-in-catalina.sh.patch
trunk/tomcat6/debian/patches/0012-Prevent-disclosure-of-host-name-or-IP-address.patch
Removed:
trunk/tomcat6/debian/patches/allow-empty-pid-file.patch
trunk/tomcat6/debian/patches/catalina-sh-security-manager.patch
trunk/tomcat6/debian/patches/default-encoding-utf8.patch
trunk/tomcat6/debian/patches/deploy-webapps-build-xml.patch
trunk/tomcat6/debian/patches/disable-ajp-connector.patch
trunk/tomcat6/debian/patches/disable-apr-loading.patch
trunk/tomcat6/debian/patches/jsp-api-OSGi.patch
trunk/tomcat6/debian/patches/servlet-api-OSGi.patch
trunk/tomcat6/debian/patches/use-commons-dbcp.patch
trunk/tomcat6/debian/patches/var_loaders.patch
trunk/tomcat6/debian/patches/webapp-classloader-deadlock-fix.patch
Modified:
trunk/tomcat6/debian/changelog
trunk/tomcat6/debian/patches/series
Log:
* Convert patches to dep3 format.
* Backport security fix from trunk to fix CVE-2010-1157. (Closes: #587447)
* Set urgency to medium due to the security fix.
Modified: trunk/tomcat6/debian/changelog
===================================================================
--- trunk/tomcat6/debian/changelog 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/changelog 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,3 +1,11 @@
+tomcat6 (6.0.26-5) unstable; urgency=medium
+
+ * Convert patches to dep3 format.
+ * Backport security fix from trunk to fix CVE-2010-1157. (Closes: #587447)
+ * Set urgency to medium due to the security fix.
+
+ -- Torsten Werner <twerner at debian.org> Mon, 28 Jun 2010 21:41:31 +0200
+
tomcat6 (6.0.26-4) unstable; urgency=low
[ Thierry Carrez ]
Added: trunk/tomcat6/debian/patches/0001-set-UTF-8-as-default-character-encoding.patch
===================================================================
--- trunk/tomcat6/debian/patches/0001-set-UTF-8-as-default-character-encoding.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0001-set-UTF-8-as-default-character-encoding.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,21 @@
+From: Thomas Koch <thomas at koch.ro>
+Date: Mon, 28 Jun 2010 21:32:15 +0200
+Subject: [PATCH] set UTF-8 as default character encoding
+
+---
+ conf/server.xml | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/conf/server.xml b/conf/server.xml
+index 30673f6..03894e7 100644
+--- a/conf/server.xml
++++ b/conf/server.xml
+@@ -68,6 +68,7 @@
+ -->
+ <Connector port="8080" protocol="HTTP/1.1"
+ connectionTimeout="20000"
++ URIEncoding="UTF-8"
+ redirectPort="8443" />
+ <!-- A "Connector" using the shared thread pool-->
+ <!--
+--
Added: trunk/tomcat6/debian/patches/0002-do-not-load-AJP13-connector-by-default.patch
===================================================================
--- trunk/tomcat6/debian/patches/0002-do-not-load-AJP13-connector-by-default.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0002-do-not-load-AJP13-connector-by-default.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,23 @@
+From: Thierry Carrez <thierry.carrez at ubuntu.com>
+Date: Mon, 28 Jun 2010 21:32:21 +0200
+Subject: [PATCH] do not load AJP13 connector by default
+
+---
+ conf/server.xml | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/conf/server.xml b/conf/server.xml
+index 03894e7..500e39a 100644
+--- a/conf/server.xml
++++ b/conf/server.xml
+@@ -88,7 +88,9 @@
+ -->
+
+ <!-- Define an AJP 1.3 Connector on port 8009 -->
++ <!--
+ <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
++ -->
+
+
+ <!-- An Engine represents the entry point (within Catalina) that processes
+--
Added: trunk/tomcat6/debian/patches/0003-disable-APR-library-loading.patch
===================================================================
--- trunk/tomcat6/debian/patches/0003-disable-APR-library-loading.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0003-disable-APR-library-loading.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,24 @@
+From: Thierry Carrez <thierry.carrez at ubuntu.com>
+Date: Mon, 28 Jun 2010 21:32:28 +0200
+Subject: [PATCH] disable APR library loading
+
+ ... until we properly provide it.
+---
+ conf/server.xml | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/conf/server.xml b/conf/server.xml
+index 500e39a..155b664 100644
+--- a/conf/server.xml
++++ b/conf/server.xml
+@@ -22,7 +22,9 @@
+ <Server port="8005" shutdown="SHUTDOWN">
+
+ <!--APR library loader. Documentation at /docs/apr.html -->
++ <!--
+ <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
++ -->
+ <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
+ <Listener className="org.apache.catalina.core.JasperListener" />
+ <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+--
Added: trunk/tomcat6/debian/patches/0004-split-deploy-webapps-target-from-deploy-target.patch
===================================================================
--- trunk/tomcat6/debian/patches/0004-split-deploy-webapps-target-from-deploy-target.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0004-split-deploy-webapps-target-from-deploy-target.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,47 @@
+From: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
+Date: Mon, 28 Jun 2010 21:32:35 +0200
+Subject: [PATCH] split deploy-webapps target from deploy target
+
+---
+ build.xml | 13 ++++++++-----
+ 1 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/build.xml b/build.xml
+index 4073712..1e2ec83 100644
+--- a/build.xml
++++ b/build.xml
+@@ -469,7 +469,7 @@
+ building a tomcat release.</echo>
+ </target>
+
+- <target name="deploy" depends="build-only,build-docs,warn.dbcp">
++ <target name="deploy" depends="build-only,build-docs,warn.dbcp,deploy-webapps">
+
+ <copy tofile="${tomcat.build}/bin/tomcat-native.tar.gz"
+ file="${tomcat-native.tar.gz}" />
+@@ -505,6 +505,13 @@
+ </fileset>
+ </copy>
+
++ <copy file="${tomcat-dbcp.jar}" todir="${tomcat.build}/lib" />
++ <copy file="${jasper-jdt.jar}" todir="${tomcat.build}/lib" />
++
++ </target>
++
++ <target name="deploy-webapps" depends="build-only,build-docs">
++
+ <!-- Copy other regular webapps -->
+ <copy todir="${tomcat.build}/webapps">
+ <fileset dir="webapps">
+@@ -629,10 +636,6 @@
+ </fileset>
+ </txt2html>
+
+- <copy file="${tomcat-dbcp.jar}" todir="${tomcat.build}/lib"
+- failonerror="false"/>
+- <copy file="${jasper-jdt.jar}" todir="${tomcat.build}/lib" />
+-
+ </target>
+
+ <target name="clean-depend"
+--
Added: trunk/tomcat6/debian/patches/0005-change-default-DBCP-factory-class.patch
===================================================================
--- trunk/tomcat6/debian/patches/0005-change-default-DBCP-factory-class.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0005-change-default-DBCP-factory-class.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,40 @@
+From: Thierry Carrez <thierry.carrez at ubuntu.com>
+Date: Mon, 28 Jun 2010 21:32:44 +0200
+Subject: [PATCH] change default DBCP factory class
+
+... to org.apache.commons.dbcp.BasicDataSourceFactory
+---
+ java/org/apache/naming/factory/Constants.java | 2 +-
+ webapps/docs/jndi-resources-howto.xml | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/java/org/apache/naming/factory/Constants.java b/java/org/apache/naming/factory/Constants.java
+index 22ef7aa..ab1d759 100644
+--- a/java/org/apache/naming/factory/Constants.java
++++ b/java/org/apache/naming/factory/Constants.java
+@@ -49,7 +49,7 @@ public final class Constants {
+ Package + ".HandlerFactory";
+
+ public static final String DBCP_DATASOURCE_FACTORY =
+- "org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory";
++ "org.apache.commons.dbcp.BasicDataSourceFactory";
+
+ public static final String OPENEJB_EJB_FACTORY =
+ Package + ".OpenEjbFactory";
+diff --git a/webapps/docs/jndi-resources-howto.xml b/webapps/docs/jndi-resources-howto.xml
+index 259d733..4f8877e 100644
+--- a/webapps/docs/jndi-resources-howto.xml
++++ b/webapps/docs/jndi-resources-howto.xml
+@@ -656,9 +656,9 @@ conn.close();
+ <code>driverName</code> parameters to match your actual database's
+ JDBC driver and connection URL.</p>
+
+- <p>The configuration properties for Tomcat's standard data source
++ <p>The configuration properties for our default data source
+ resource factory
+- (<code>org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory</code>) are
++ (<code>org.apache.commons.dbcp.BasicDataSourceFactory</code>) are
+ as follows:</p>
+ <ul>
+ <li><strong>driverClassName</strong> - Fully qualified Java class name
+--
Added: trunk/tomcat6/debian/patches/0006-add-JARs-below-var-to-class-loader.patch
===================================================================
--- trunk/tomcat6/debian/patches/0006-add-JARs-below-var-to-class-loader.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0006-add-JARs-below-var-to-class-loader.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,40 @@
+From: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
+Date: Mon, 28 Jun 2010 21:32:57 +0200
+Subject: [PATCH] add JARs below /var to class loader
+
+---
+ conf/catalina.properties | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/conf/catalina.properties b/conf/catalina.properties
+index dc2db35..5971437 100644
+--- a/conf/catalina.properties
++++ b/conf/catalina.properties
+@@ -44,7 +44,7 @@ package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache
+ # "foo/*.jar": Add all the JARs of the specified folder as class
+ # repositories
+ # "foo/bar.jar": Add bar.jar as a class repository
+-common.loader=${catalina.base}/lib,${catalina.base}/lib/*.jar,${catalina.home}/lib,${catalina.home}/lib/*.jar
++common.loader=${catalina.base}/lib,${catalina.base}/lib/*.jar,${catalina.home}/lib,${catalina.home}/lib/*.jar,/var/lib/tomcat6/common/classes,/var/lib/tomcat6/common/*.jar
+
+ #
+ # List of comma-separated paths defining the contents of the "server"
+@@ -57,7 +57,7 @@ common.loader=${catalina.base}/lib,${catalina.base}/lib/*.jar,${catalina.home}/l
+ # "foo/*.jar": Add all the JARs of the specified folder as class
+ # repositories
+ # "foo/bar.jar": Add bar.jar as a class repository
+-server.loader=
++server.loader=${catalina.home}/server/classes,${catalina.home}/server/*.jar,/var/lib/tomcat6/server/classes,/var/lib/tomcat6/server/*.jar
+
+ #
+ # List of comma-separated paths defining the contents of the "shared"
+@@ -71,7 +71,7 @@ server.loader=
+ # "foo/bar.jar": Add bar.jar as a class repository
+ # Please note that for single jars, e.g. bar.jar, you need the URL form
+ # starting with file:.
+-shared.loader=
++shared.loader=${catalina.home}/shared/classes,${catalina.home}/shared/*.jar,/var/lib/tomcat6/shared/classes,/var/lib/tomcat6/shared/*.jar
+
+ #
+ # String cache configuration.
+--
Added: trunk/tomcat6/debian/patches/0007-add-OSGi-headers-to-servlet-api.patch
===================================================================
--- trunk/tomcat6/debian/patches/0007-add-OSGi-headers-to-servlet-api.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0007-add-OSGi-headers-to-servlet-api.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,29 @@
+From: Niels Thykier <niels at thykier.net>
+Date: Mon, 28 Jun 2010 21:33:03 +0200
+Subject: [PATCH] add OSGi headers to servlet-api
+
+---
+ res/META-INF/servlet-api.jar.manifest | 9 +++++++++
+ 1 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/res/META-INF/servlet-api.jar.manifest b/res/META-INF/servlet-api.jar.manifest
+index 4dbb748..a85f9ed 100644
+--- a/res/META-INF/servlet-api.jar.manifest
++++ b/res/META-INF/servlet-api.jar.manifest
+@@ -1,6 +1,15 @@
+ Manifest-version: 1.0
+ X-Compile-Source-JDK: @source.jdk@
+ X-Compile-Target-JDK: @target.jdk@
++Bundle-ManifestVersion: 2
++Export-Package: javax.servlet;version="2.5",javax.servlet.http;version
++ ="2.5",javax.servlet.resources;version="2.5"
++Bundle-Version: 2.5.0.v200806031605
++Bundle-SymbolicName: javax.servlet
++Bundle-Name: Servlet API Bundle
++Bundle-RequiredExecutionEnvironment: CDC-1.0/Foundation-1.0,J2SE-1.3
++Bundle-Localization: plugin
++Bundle-Vendor: Apache Software Foundation
+
+ Name: javax/servlet/
+ Specification-Title: Java API for Servlets
+--
Added: trunk/tomcat6/debian/patches/0008-add-OSGI-headers-to-jsp-api.patch
===================================================================
--- trunk/tomcat6/debian/patches/0008-add-OSGI-headers-to-jsp-api.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0008-add-OSGI-headers-to-jsp-api.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,32 @@
+From: Niels Thykier <niels at thykier.net>
+Date: Mon, 28 Jun 2010 21:18:30 +0200
+Subject: [PATCH] add OSGI headers to jsp-api
+
+---
+ res/META-INF/jsp-api.jar.manifest | 12 ++++++++++++
+ 1 files changed, 12 insertions(+), 0 deletions(-)
+
+diff --git a/res/META-INF/jsp-api.jar.manifest b/res/META-INF/jsp-api.jar.manifest
+index fb050ea..e44409d 100644
+--- a/res/META-INF/jsp-api.jar.manifest
++++ b/res/META-INF/jsp-api.jar.manifest
+@@ -1,6 +1,18 @@
+ Manifest-version: 1.0
+ X-Compile-Source-JDK: @source.jdk@
+ X-Compile-Target-JDK: @target.jdk@
++Import-Package: javax.servlet; version=2.5,javax.servlet.http; version
++ =2.5,javax.servlet.resources; version=2.5
++Bundle-ManifestVersion: 2
++Export-Package: javax.servlet.jsp; version=2.1,javax.servlet.jsp.el; v
++ ersion=2.1,javax.servlet.jsp.resources; version=2.1,javax.servlet.jsp
++ .tagext; version=2.1
++Bundle-Version: 2.0.1.v200806031605
++Bundle-SymbolicName: javax.servlet.jsp
++Bundle-Name: Java Server Pages API Bundle
++Bundle-RequiredExecutionEnvironment: CDC-1.0/Foundation-1.0,J2SE-1.3
++Bundle-Localization: plugin
++Bundle-Vendor: Apache Software Foundation
+
+ Name: javax/servlet/jsp/
+ Specification-Title: Java API for JavaServer Pages
+--
Added: trunk/tomcat6/debian/patches/0009-allow-empty-PID-file.patch
===================================================================
--- trunk/tomcat6/debian/patches/0009-allow-empty-PID-file.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0009-allow-empty-PID-file.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,40 @@
+From: Arto Jantunen <viiru at debian.org>
+Date: Mon, 28 Jun 2010 21:19:14 +0200
+Subject: [PATCH] allow empty PID file
+
+---
+ bin/catalina.sh | 8 ++++++--
+ 1 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/bin/catalina.sh b/bin/catalina.sh
+index 2ef2323..5843b56 100755
+--- a/bin/catalina.sh
++++ b/bin/catalina.sh
+@@ -305,7 +305,7 @@ elif [ "$1" = "run" ]; then
+ elif [ "$1" = "start" ] ; then
+
+ if [ ! -z "$CATALINA_PID" ]; then
+- if [ -f "$CATALINA_PID" ]; then
++ if [ -s "$CATALINA_PID" ]; then
+ echo "PID file ($CATALINA_PID) found. Is Tomcat still running? Start aborted."
+ exit 1
+ fi
+@@ -363,12 +363,16 @@ elif [ "$1" = "stop" ] ; then
+ fi
+
+ if [ ! -z "$CATALINA_PID" ]; then
+- if [ -f "$CATALINA_PID" ]; then
++ if [ -s "$CATALINA_PID" ]; then
+ kill -0 `cat $CATALINA_PID` >/dev/null 2>&1
+ if [ $? -eq 1 ]; then
+ echo "PID file ($CATALINA_PID) found but no matching process was found. Stop aborted."
+ exit 1
+ fi
++ elif [ -f "$CATALINA_PID" ]; then
++ rm $CATALINA_PID
++ echo "\$CATALINA_PID was set ($CATALINA_PID) but the specified file is empty. Did Tomcat fail while starting? Stop aborted."
++ exit 1
+ else
+ echo "\$CATALINA_PID was set ($CATALINA_PID) but the specified file does not exist. Is Tomcat running? Stop aborted."
+ exit 1
+--
Added: trunk/tomcat6/debian/patches/0010-avoid-deadlock-in-WebappClassLoader.patch
===================================================================
--- trunk/tomcat6/debian/patches/0010-avoid-deadlock-in-WebappClassLoader.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0010-avoid-deadlock-in-WebappClassLoader.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,286 @@
+From: Marcus Better <marcus at better.se>
+Date: Mon, 28 Jun 2010 21:19:59 +0200
+Subject: [PATCH] avoid deadlock in WebappClassLoader
+
+---
+ java/org/apache/catalina/loader/ResourceEntry.java | 2 +-
+ .../apache/catalina/loader/WebappClassLoader.java | 193 ++++++++++----------
+ java/org/apache/jasper/servlet/JasperLoader.java | 4 +-
+ 3 files changed, 99 insertions(+), 100 deletions(-)
+
+diff --git a/java/org/apache/catalina/loader/ResourceEntry.java b/java/org/apache/catalina/loader/ResourceEntry.java
+index d002a48..7d56590 100644
+--- a/java/org/apache/catalina/loader/ResourceEntry.java
++++ b/java/org/apache/catalina/loader/ResourceEntry.java
+@@ -47,7 +47,7 @@ public class ResourceEntry {
+ /**
+ * Loaded class.
+ */
+- public Class loadedClass = null;
++ public volatile Class loadedClass = null;
+
+
+ /**
+diff --git a/java/org/apache/catalina/loader/WebappClassLoader.java b/java/org/apache/catalina/loader/WebappClassLoader.java
+index 5e5aa1a..0c9f8a5 100644
+--- a/java/org/apache/catalina/loader/WebappClassLoader.java
++++ b/java/org/apache/catalina/loader/WebappClassLoader.java
+@@ -1388,102 +1388,121 @@ public class WebappClassLoader
+ *
+ * @exception ClassNotFoundException if the class was not found
+ */
+- public Class loadClass(String name, boolean resolve)
++ public synchronized Class loadClass(String name, boolean resolve)
+ throws ClassNotFoundException {
+
+- synchronized (name.intern()) {
+- if (log.isDebugEnabled())
+- log.debug("loadClass(" + name + ", " + resolve + ")");
+- Class clazz = null;
+-
+- // Log access to stopped classloader
+- if (!started) {
+- try {
+- throw new IllegalStateException();
+- } catch (IllegalStateException e) {
+- log.info(sm.getString("webappClassLoader.stopped", name), e);
+- }
++ if (log.isDebugEnabled())
++ log.debug("loadClass(" + name + ", " + resolve + ")");
++ Class clazz = null;
++
++ // Log access to stopped classloader
++ if (!started) {
++ try {
++ throw new IllegalStateException();
++ } catch (IllegalStateException e) {
++ log.info(sm.getString("webappClassLoader.stopped", name), e);
+ }
+-
+- // (0) Check our previously loaded local class cache
+- clazz = findLoadedClass0(name);
++ }
++
++ // (0) Check our previously loaded local class cache
++ clazz = findLoadedClass0(name);
++ if (clazz != null) {
++ if (log.isDebugEnabled())
++ log.debug(" Returning class from cache");
++ if (resolve)
++ resolveClass(clazz);
++ return (clazz);
++ }
++
++ // (0.1) Check our previously loaded class cache
++ clazz = findLoadedClass(name);
++ if (clazz != null) {
++ if (log.isDebugEnabled())
++ log.debug(" Returning class from cache");
++ if (resolve)
++ resolveClass(clazz);
++ return (clazz);
++ }
++
++ // (0.2) Try loading the class with the system class loader, to prevent
++ // the webapp from overriding J2SE classes
++ try {
++ clazz = system.loadClass(name);
+ if (clazz != null) {
+- if (log.isDebugEnabled())
+- log.debug(" Returning class from cache");
+ if (resolve)
+ resolveClass(clazz);
+ return (clazz);
+ }
+-
+- // (0.1) Check our previously loaded class cache
+- clazz = findLoadedClass(name);
+- if (clazz != null) {
+- if (log.isDebugEnabled())
+- log.debug(" Returning class from cache");
+- if (resolve)
+- resolveClass(clazz);
+- return (clazz);
++ } catch (ClassNotFoundException e) {
++ // Ignore
++ }
++
++ // (0.5) Permission to access this class when using a SecurityManager
++ if (securityManager != null) {
++ int i = name.lastIndexOf('.');
++ if (i >= 0) {
++ try {
++ securityManager.checkPackageAccess(name.substring(0,i));
++ } catch (SecurityException se) {
++ String error = "Security Violation, attempt to use " +
++ "Restricted Class: " + name;
++ log.info(error, se);
++ throw new ClassNotFoundException(error, se);
++ }
+ }
+-
+- // (0.2) Try loading the class with the system class loader, to prevent
+- // the webapp from overriding J2SE classes
++ }
++
++ boolean delegateLoad = delegate || filter(name);
++
++ // (1) Delegate to our parent if requested
++ if (delegateLoad) {
++ if (log.isDebugEnabled())
++ log.debug(" Delegating to parent classloader1 " + parent);
++ ClassLoader loader = parent;
++ if (loader == null)
++ loader = system;
+ try {
+- clazz = system.loadClass(name);
++ clazz = loader.loadClass(name);
+ if (clazz != null) {
++ if (log.isDebugEnabled())
++ log.debug(" Loading class from parent");
+ if (resolve)
+ resolveClass(clazz);
+ return (clazz);
+ }
+ } catch (ClassNotFoundException e) {
+- // Ignore
+- }
+-
+- // (0.5) Permission to access this class when using a SecurityManager
+- if (securityManager != null) {
+- int i = name.lastIndexOf('.');
+- if (i >= 0) {
+- try {
+- securityManager.checkPackageAccess(name.substring(0,i));
+- } catch (SecurityException se) {
+- String error = "Security Violation, attempt to use " +
+- "Restricted Class: " + name;
+- log.info(error, se);
+- throw new ClassNotFoundException(error, se);
+- }
+- }
++ ;
+ }
+-
+- boolean delegateLoad = delegate || filter(name);
+-
+- // (1) Delegate to our parent if requested
+- if (delegateLoad) {
++ }
++
++ // (2) Search local repositories
++ if (log.isDebugEnabled())
++ log.debug(" Searching local repositories");
++ try {
++ clazz = findClass(name);
++ if (clazz != null) {
+ if (log.isDebugEnabled())
+- log.debug(" Delegating to parent classloader1 " + parent);
+- ClassLoader loader = parent;
+- if (loader == null)
+- loader = system;
+- try {
+- clazz = loader.loadClass(name);
+- if (clazz != null) {
+- if (log.isDebugEnabled())
+- log.debug(" Loading class from parent");
+- if (resolve)
+- resolveClass(clazz);
+- return (clazz);
+- }
+- } catch (ClassNotFoundException e) {
+- ;
+- }
++ log.debug(" Loading class from local repository");
++ if (resolve)
++ resolveClass(clazz);
++ return (clazz);
+ }
+-
+- // (2) Search local repositories
++ } catch (ClassNotFoundException e) {
++ ;
++ }
++
++ // (3) Delegate to parent unconditionally
++ if (!delegateLoad) {
+ if (log.isDebugEnabled())
+- log.debug(" Searching local repositories");
++ log.debug(" Delegating to parent classloader at end: " + parent);
++ ClassLoader loader = parent;
++ if (loader == null)
++ loader = system;
+ try {
+- clazz = findClass(name);
++ clazz = loader.loadClass(name);
+ if (clazz != null) {
+ if (log.isDebugEnabled())
+- log.debug(" Loading class from local repository");
++ log.debug(" Loading class from parent");
+ if (resolve)
+ resolveClass(clazz);
+ return (clazz);
+@@ -1491,30 +1510,10 @@ public class WebappClassLoader
+ } catch (ClassNotFoundException e) {
+ ;
+ }
+-
+- // (3) Delegate to parent unconditionally
+- if (!delegateLoad) {
+- if (log.isDebugEnabled())
+- log.debug(" Delegating to parent classloader at end: " + parent);
+- ClassLoader loader = parent;
+- if (loader == null)
+- loader = system;
+- try {
+- clazz = loader.loadClass(name);
+- if (clazz != null) {
+- if (log.isDebugEnabled())
+- log.debug(" Loading class from parent");
+- if (resolve)
+- resolveClass(clazz);
+- return (clazz);
+- }
+- } catch (ClassNotFoundException e) {
+- ;
+- }
+- }
+-
+- throw new ClassNotFoundException(name);
+ }
++
++ throw new ClassNotFoundException(name);
++
+ }
+
+
+@@ -2469,7 +2468,7 @@ public class WebappClassLoader
+ if (clazz != null)
+ return clazz;
+
+- synchronized (name.intern()) {
++ synchronized (this) {
+ clazz = entry.loadedClass;
+ if (clazz != null)
+ return clazz;
+diff --git a/java/org/apache/jasper/servlet/JasperLoader.java b/java/org/apache/jasper/servlet/JasperLoader.java
+index 7a3b0f7..43d56cb 100644
+--- a/java/org/apache/jasper/servlet/JasperLoader.java
++++ b/java/org/apache/jasper/servlet/JasperLoader.java
+@@ -91,7 +91,7 @@ public class JasperLoader extends URLClassLoader {
+ *
+ * @exception ClassNotFoundException if the class was not found
+ */
+- public Class loadClass(final String name, boolean resolve)
++ public synchronized Class loadClass(final String name, boolean resolve)
+ throws ClassNotFoundException {
+
+ Class clazz = null;
+@@ -169,4 +169,4 @@ public class JasperLoader extends URLClassLoader {
+ public final PermissionCollection getPermissions(CodeSource codeSource) {
+ return permissionCollection;
+ }
+-}
+\ No newline at end of file
++}
+--
Added: trunk/tomcat6/debian/patches/0011-Use-java.security.policy-file-in-catalina.sh.patch
===================================================================
--- trunk/tomcat6/debian/patches/0011-Use-java.security.policy-file-in-catalina.sh.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0011-Use-java.security.policy-file-in-catalina.sh.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,46 @@
+From: Adam Guthrie <asguthrie at gmail.com>
+Date: Mon, 28 Jun 2010 21:53:50 +0200
+Subject: [PATCH] Use java.security.policy file in catalina.sh
+
+Make sure catalina.sh uses the Debian/Ubuntu java.security.policy
+file location when Tomcat is started with a security manager.
+
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/591802
+Bug-Debian: http://bugs.debian.org/585379
+Forwarded: not-needed
+---
+ bin/catalina.sh | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/bin/catalina.sh b/bin/catalina.sh
+index 5843b56..783b382 100755
+--- a/bin/catalina.sh
++++ b/bin/catalina.sh
+@@ -261,7 +261,7 @@ if [ "$1" = "debug" ] ; then
+ -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
+ -sourcepath "$CATALINA_HOME"/../../java \
+ -Djava.security.manager \
+- -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
++ -Djava.security.policy=="$CATALINA_BASE"/work/catalina.policy \
+ -Dcatalina.base="$CATALINA_BASE" \
+ -Dcatalina.home="$CATALINA_HOME" \
+ -Djava.io.tmpdir="$CATALINA_TMPDIR" \
+@@ -288,7 +288,7 @@ elif [ "$1" = "run" ]; then
+ exec "$_RUNJAVA" "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \
+ -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
+ -Djava.security.manager \
+- -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
++ -Djava.security.policy=="$CATALINA_BASE"/work/catalina.policy \
+ -Dcatalina.base="$CATALINA_BASE" \
+ -Dcatalina.home="$CATALINA_HOME" \
+ -Djava.io.tmpdir="$CATALINA_TMPDIR" \
+@@ -321,7 +321,7 @@ elif [ "$1" = "start" ] ; then
+ "$_RUNJAVA" "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \
+ -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
+ -Djava.security.manager \
+- -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
++ -Djava.security.policy=="$CATALINA_BASE"/work/catalina.policy \
+ -Dcatalina.base="$CATALINA_BASE" \
+ -Dcatalina.home="$CATALINA_HOME" \
+ -Djava.io.tmpdir="$CATALINA_TMPDIR" \
+--
Added: trunk/tomcat6/debian/patches/0012-Prevent-disclosure-of-host-name-or-IP-address.patch
===================================================================
--- trunk/tomcat6/debian/patches/0012-Prevent-disclosure-of-host-name-or-IP-address.patch (rev 0)
+++ trunk/tomcat6/debian/patches/0012-Prevent-disclosure-of-host-name-or-IP-address.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -0,0 +1,59 @@
+From: Torsten Werner <twerner at debian.org>
+Date: Mon, 28 Jun 2010 21:39:20 +0200
+Subject: [PATCH] Prevent disclosure of host name or IP address
+
+Fix CVE-2010-1157. Prevent possible disclosure of host name or IP
+address via the HTTP WWW-Authenticate header when using BASIC or DIGEST
+authentication.
+---
+ .../catalina/authenticator/AuthenticatorBase.java | 5 +++++
+ .../catalina/authenticator/BasicAuthenticator.java | 4 +---
+ .../authenticator/DigestAuthenticator.java | 3 +--
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/java/org/apache/catalina/authenticator/AuthenticatorBase.java b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
+index aa425c7..9d1c182 100644
+--- a/java/org/apache/catalina/authenticator/AuthenticatorBase.java
++++ b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
+@@ -99,6 +99,11 @@ public abstract class AuthenticatorBase
+
+
+ /**
++ * Default authentication realm name.
++ */
++ protected static final String REALM_NAME = "Authentication required";
++
++ /**
+ * The message digest algorithm to be used when generating session
+ * identifiers. This must be an algorithm supported by the
+ * <code>java.security.MessageDigest</code> class on your platform.
+diff --git a/java/org/apache/catalina/authenticator/BasicAuthenticator.java b/java/org/apache/catalina/authenticator/BasicAuthenticator.java
+index 31ffaf9..b00859e 100644
+--- a/java/org/apache/catalina/authenticator/BasicAuthenticator.java
++++ b/java/org/apache/catalina/authenticator/BasicAuthenticator.java
+@@ -194,9 +194,7 @@ public class BasicAuthenticator
+ CharChunk authenticateCC = authenticate.getCharChunk();
+ authenticateCC.append("Basic realm=\"");
+ if (config.getRealmName() == null) {
+- authenticateCC.append(request.getServerName());
+- authenticateCC.append(':');
+- authenticateCC.append(Integer.toString(request.getServerPort()));
++ authenticateCC.append(REALM_NAME);
+ } else {
+ authenticateCC.append(config.getRealmName());
+ }
+diff --git a/java/org/apache/catalina/authenticator/DigestAuthenticator.java b/java/org/apache/catalina/authenticator/DigestAuthenticator.java
+index 821e08f..ee5a46b 100644
+--- a/java/org/apache/catalina/authenticator/DigestAuthenticator.java
++++ b/java/org/apache/catalina/authenticator/DigestAuthenticator.java
+@@ -406,8 +406,7 @@ public class DigestAuthenticator
+ // Get the realm name
+ String realmName = config.getRealmName();
+ if (realmName == null)
+- realmName = request.getServerName() + ":"
+- + request.getServerPort();
++ realmName = REALM_NAME;
+
+ byte[] buffer = null;
+ synchronized (md5Helper) {
+--
Deleted: trunk/tomcat6/debian/patches/allow-empty-pid-file.patch
===================================================================
--- trunk/tomcat6/debian/patches/allow-empty-pid-file.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/allow-empty-pid-file.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,29 +0,0 @@
---- a/bin/catalina.sh
-+++ b/bin/catalina.sh
-@@ -305,7 +305,7 @@
- elif [ "$1" = "start" ] ; then
-
- if [ ! -z "$CATALINA_PID" ]; then
-- if [ -f "$CATALINA_PID" ]; then
-+ if [ -s "$CATALINA_PID" ]; then
- echo "PID file ($CATALINA_PID) found. Is Tomcat still running? Start aborted."
- exit 1
- fi
-@@ -363,12 +363,16 @@
- fi
-
- if [ ! -z "$CATALINA_PID" ]; then
-- if [ -f "$CATALINA_PID" ]; then
-+ if [ -s "$CATALINA_PID" ]; then
- kill -0 `cat $CATALINA_PID` >/dev/null 2>&1
- if [ $? -eq 1 ]; then
- echo "PID file ($CATALINA_PID) found but no matching process was found. Stop aborted."
- exit 1
- fi
-+ elif [ -f "$CATALINA_PID" ]; then
-+ rm $CATALINA_PID
-+ echo "\$CATALINA_PID was set ($CATALINA_PID) but the specified file is empty. Did Tomcat fail while starting? Stop aborted."
-+ exit 1
- else
- echo "\$CATALINA_PID was set ($CATALINA_PID) but the specified file does not exist. Is Tomcat running? Stop aborted."
- exit 1
Deleted: trunk/tomcat6/debian/patches/catalina-sh-security-manager.patch
===================================================================
--- trunk/tomcat6/debian/patches/catalina-sh-security-manager.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/catalina-sh-security-manager.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,36 +0,0 @@
-Description: Make sure catalina.sh uses the Debian/Ubuntu java.security.policy
- file location when Tomcat is started with a security manager.
-Author: Adam Guthrie <asguthrie at gmail.com>
-Bug-Ubuntu: https://bugs.launchpad.net/bugs/591802
-Bug-Debian: http://bugs.debian.org/585379
-Forwarded: not-needed
-
---- tomcat6-6.0.24.orig/bin/catalina.sh
-+++ tomcat6-6.0.24/bin/catalina.sh
-@@ -261,7 +261,7 @@ if [ "$1" = "debug" ] ; then
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
- -sourcepath "$CATALINA_HOME"/../../java \
- -Djava.security.manager \
-- -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-+ -Djava.security.policy=="$CATALINA_BASE"/work/catalina.policy \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-@@ -288,7 +288,7 @@ elif [ "$1" = "run" ]; then
- exec "$_RUNJAVA" "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
- -Djava.security.manager \
-- -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-+ -Djava.security.policy=="$CATALINA_BASE"/work/catalina.policy \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-@@ -321,7 +321,7 @@ elif [ "$1" = "start" ] ; then
- "$_RUNJAVA" "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
- -Djava.security.manager \
-- -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-+ -Djava.security.policy=="$CATALINA_BASE"/work/catalina.policy \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
Deleted: trunk/tomcat6/debian/patches/default-encoding-utf8.patch
===================================================================
--- trunk/tomcat6/debian/patches/default-encoding-utf8.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/default-encoding-utf8.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,10 +0,0 @@
---- a/conf/server.xml
-+++ b/conf/server.xml
-@@ -68,6 +68,7 @@
- -->
- <Connector port="8080" protocol="HTTP/1.1"
- connectionTimeout="20000"
-+ URIEncoding="UTF-8"
- redirectPort="8443" />
- <!-- A "Connector" using the shared thread pool-->
- <!--
Deleted: trunk/tomcat6/debian/patches/deploy-webapps-build-xml.patch
===================================================================
--- trunk/tomcat6/debian/patches/deploy-webapps-build-xml.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/deploy-webapps-build-xml.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,36 +0,0 @@
---- a/build.xml
-+++ b/build.xml
-@@ -494,7 +494,7 @@
- building a tomcat release.</echo>
- </target>
-
-- <target name="deploy" depends="build-only,build-docs,warn.dbcp">
-+ <target name="deploy" depends="build-only,build-docs,warn.dbcp,deploy-webapps">
-
- <copy tofile="${tomcat.build}/bin/tomcat-native.tar.gz"
- file="${tomcat-native.tar.gz}" />
-@@ -530,6 +530,13 @@
- </fileset>
- </copy>
-
-+ <copy file="${tomcat-dbcp.jar}" todir="${tomcat.build}/lib" />
-+ <copy file="${jasper-jdt.jar}" todir="${tomcat.build}/lib" />
-+
-+ </target>
-+
-+ <target name="deploy-webapps" depends="build-only,build-docs">
-+
- <!-- Copy other regular webapps -->
- <copy todir="${tomcat.build}/webapps">
- <fileset dir="webapps">
-@@ -654,10 +661,6 @@
- </fileset>
- </txt2html>
-
-- <copy file="${tomcat-dbcp.jar}" todir="${tomcat.build}/lib"
-- failonerror="false"/>
-- <copy file="${jasper-jdt.jar}" todir="${tomcat.build}/lib" />
--
- </target>
-
- <target name="clean-depend"
Deleted: trunk/tomcat6/debian/patches/disable-ajp-connector.patch
===================================================================
--- trunk/tomcat6/debian/patches/disable-ajp-connector.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/disable-ajp-connector.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,12 +0,0 @@
---- a/conf/server.xml
-+++ b/conf/server.xml
-@@ -87,7 +87,9 @@
- -->
-
- <!-- Define an AJP 1.3 Connector on port 8009 -->
-+ <!--
- <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
-+ -->
-
-
- <!-- An Engine represents the entry point (within Catalina) that processes
Deleted: trunk/tomcat6/debian/patches/disable-apr-loading.patch
===================================================================
--- trunk/tomcat6/debian/patches/disable-apr-loading.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/disable-apr-loading.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,12 +0,0 @@
---- a/conf/server.xml
-+++ b/conf/server.xml
-@@ -22,7 +22,9 @@
- <Server port="8005" shutdown="SHUTDOWN">
-
- <!--APR library loader. Documentation at /docs/apr.html -->
-+ <!--
- <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
-+ -->
- <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
- <Listener className="org.apache.catalina.core.JasperListener" />
- <!-- Prevent memory leaks due to use of particular java/javax APIs-->
Deleted: trunk/tomcat6/debian/patches/jsp-api-OSGi.patch
===================================================================
--- trunk/tomcat6/debian/patches/jsp-api-OSGi.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/jsp-api-OSGi.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,23 +0,0 @@
-Description: Adds OSGi metadata needed by eclipse.
-
---- a/res/META-INF/jsp-api.jar.manifest
-+++ b/res/META-INF/jsp-api.jar.manifest
-@@ -1,6 +1,18 @@
- Manifest-version: 1.0
- X-Compile-Source-JDK: @source.jdk@
- X-Compile-Target-JDK: @target.jdk@
-+Import-Package: javax.servlet; version=2.5,javax.servlet.http; version
-+ =2.5,javax.servlet.resources; version=2.5
-+Bundle-ManifestVersion: 2
-+Export-Package: javax.servlet.jsp; version=2.1,javax.servlet.jsp.el; v
-+ ersion=2.1,javax.servlet.jsp.resources; version=2.1,javax.servlet.jsp
-+ .tagext; version=2.1
-+Bundle-Version: 2.0.1.v200806031605
-+Bundle-SymbolicName: javax.servlet.jsp
-+Bundle-Name: Java Server Pages API Bundle
-+Bundle-RequiredExecutionEnvironment: CDC-1.0/Foundation-1.0,J2SE-1.3
-+Bundle-Localization: plugin
-+Bundle-Vendor: Apache Software Foundation
-
- Name: javax/servlet/jsp/
- Specification-Title: Java API for JavaServer Pages
Modified: trunk/tomcat6/debian/patches/series
===================================================================
--- trunk/tomcat6/debian/patches/series 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/series 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,11 +1,12 @@
-default-encoding-utf8.patch
-disable-ajp-connector.patch
-disable-apr-loading.patch
-deploy-webapps-build-xml.patch
-use-commons-dbcp.patch
-var_loaders.patch
-servlet-api-OSGi.patch
-jsp-api-OSGi.patch
-allow-empty-pid-file.patch
-webapp-classloader-deadlock-fix.patch
-catalina-sh-security-manager.patch
+0001-set-UTF-8-as-default-character-encoding.patch
+0002-do-not-load-AJP13-connector-by-default.patch
+0003-disable-APR-library-loading.patch
+0004-split-deploy-webapps-target-from-deploy-target.patch
+0005-change-default-DBCP-factory-class.patch
+0006-add-JARs-below-var-to-class-loader.patch
+0007-add-OSGi-headers-to-servlet-api.patch
+0008-add-OSGI-headers-to-jsp-api.patch
+0009-allow-empty-PID-file.patch
+0010-avoid-deadlock-in-WebappClassLoader.patch
+0011-Use-java.security.policy-file-in-catalina.sh.patch
+0012-Prevent-disclosure-of-host-name-or-IP-address.patch
Deleted: trunk/tomcat6/debian/patches/servlet-api-OSGi.patch
===================================================================
--- trunk/tomcat6/debian/patches/servlet-api-OSGi.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/servlet-api-OSGi.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,20 +0,0 @@
-Description: Adds OSGi metadata needed by eclipse.
-
---- a/res/META-INF/servlet-api.jar.manifest
-+++ b/res/META-INF/servlet-api.jar.manifest
-@@ -1,6 +1,15 @@
- Manifest-version: 1.0
- X-Compile-Source-JDK: @source.jdk@
- X-Compile-Target-JDK: @target.jdk@
-+Bundle-ManifestVersion: 2
-+Export-Package: javax.servlet;version="2.5",javax.servlet.http;version
-+ ="2.5",javax.servlet.resources;version="2.5"
-+Bundle-Version: 2.5.0.v200806031605
-+Bundle-SymbolicName: javax.servlet
-+Bundle-Name: Servlet API Bundle
-+Bundle-RequiredExecutionEnvironment: CDC-1.0/Foundation-1.0,J2SE-1.3
-+Bundle-Localization: plugin
-+Bundle-Vendor: Apache Software Foundation
-
- Name: javax/servlet/
- Specification-Title: Java API for Servlets
Deleted: trunk/tomcat6/debian/patches/use-commons-dbcp.patch
===================================================================
--- trunk/tomcat6/debian/patches/use-commons-dbcp.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/use-commons-dbcp.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,25 +0,0 @@
---- a/java/org/apache/naming/factory/Constants.java
-+++ b/java/org/apache/naming/factory/Constants.java
-@@ -49,7 +49,7 @@
- Package + ".HandlerFactory";
-
- public static final String DBCP_DATASOURCE_FACTORY =
-- "org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory";
-+ "org.apache.commons.dbcp.BasicDataSourceFactory";
-
- public static final String OPENEJB_EJB_FACTORY =
- Package + ".OpenEjbFactory";
---- a/webapps/docs/jndi-resources-howto.xml
-+++ b/webapps/docs/jndi-resources-howto.xml
-@@ -653,9 +653,9 @@
- <code>driverName</code> parameters to match your actual database's
- JDBC driver and connection URL.</p>
-
-- <p>The configuration properties for Tomcat's standard data source
-+ <p>The configuration properties for our default data source
- resource factory
-- (<code>org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory</code>) are
-+ (<code>org.apache.commons.dbcp.BasicDataSourceFactory</code>) are
- as follows:</p>
- <ul>
- <li><strong>driverClassName</strong> - Fully qualified Java class name
Deleted: trunk/tomcat6/debian/patches/var_loaders.patch
===================================================================
--- trunk/tomcat6/debian/patches/var_loaders.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/var_loaders.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,29 +0,0 @@
---- a/conf/catalina.properties
-+++ b/conf/catalina.properties
-@@ -44,7 +44,7 @@
- # "foo/*.jar": Add all the JARs of the specified folder as class
- # repositories
- # "foo/bar.jar": Add bar.jar as a class repository
--common.loader=${catalina.base}/lib,${catalina.base}/lib/*.jar,${catalina.home}/lib,${catalina.home}/lib/*.jar
-+common.loader=${catalina.base}/lib,${catalina.base}/lib/*.jar,${catalina.home}/lib,${catalina.home}/lib/*.jar,/var/lib/tomcat6/common/classes,/var/lib/tomcat6/common/*.jar
-
- #
- # List of comma-separated paths defining the contents of the "server"
-@@ -57,7 +57,7 @@
- # "foo/*.jar": Add all the JARs of the specified folder as class
- # repositories
- # "foo/bar.jar": Add bar.jar as a class repository
--server.loader=
-+server.loader=${catalina.home}/server/classes,${catalina.home}/server/*.jar,/var/lib/tomcat6/server/classes,/var/lib/tomcat6/server/*.jar
-
- #
- # List of comma-separated paths defining the contents of the "shared"
-@@ -71,7 +71,7 @@
- # "foo/bar.jar": Add bar.jar as a class repository
- # Please note that for single jars, e.g. bar.jar, you need the URL form
- # starting with file:.
--shared.loader=
-+shared.loader=${catalina.home}/shared/classes,${catalina.home}/shared/*.jar,/var/lib/tomcat6/shared/classes,/var/lib/tomcat6/shared/*.jar
-
- #
- # String cache configuration.
Deleted: trunk/tomcat6/debian/patches/webapp-classloader-deadlock-fix.patch
===================================================================
--- trunk/tomcat6/debian/patches/webapp-classloader-deadlock-fix.patch 2010-06-28 19:07:51 UTC (rev 12685)
+++ trunk/tomcat6/debian/patches/webapp-classloader-deadlock-fix.patch 2010-06-28 20:00:35 UTC (rev 12686)
@@ -1,275 +0,0 @@
-Index: trunk/java/org/apache/jasper/servlet/JasperLoader.java
-===================================================================
---- trunk/java/org/apache/jasper/servlet/JasperLoader.java (revision 941867)
-+++ trunk/java/org/apache/jasper/servlet/JasperLoader.java (revision 941868)
-@@ -91,7 +91,7 @@
- *
- * @exception ClassNotFoundException if the class was not found
- */
-- public Class loadClass(final String name, boolean resolve)
-+ public synchronized Class loadClass(final String name, boolean resolve)
- throws ClassNotFoundException {
-
- Class clazz = null;
-@@ -169,4 +169,4 @@
- public final PermissionCollection getPermissions(CodeSource codeSource) {
- return permissionCollection;
- }
--}
-\ No newline at end of file
-+}
-Index: trunk/java/org/apache/catalina/loader/ResourceEntry.java
-===================================================================
---- trunk/java/org/apache/catalina/loader/ResourceEntry.java (revision 941867)
-+++ trunk/java/org/apache/catalina/loader/ResourceEntry.java (revision 941868)
-@@ -47,7 +47,7 @@
- /**
- * Loaded class.
- */
-- public Class loadedClass = null;
-+ public volatile Class loadedClass = null;
-
-
- /**
-Index: trunk/java/org/apache/catalina/loader/WebappClassLoader.java
-===================================================================
---- trunk/java/org/apache/catalina/loader/WebappClassLoader.java (revision 941867)
-+++ trunk/java/org/apache/catalina/loader/WebappClassLoader.java (revision 941868)
-@@ -1432,102 +1432,121 @@
- *
- * @exception ClassNotFoundException if the class was not found
- */
-- public Class loadClass(String name, boolean resolve)
-+ public synchronized Class loadClass(String name, boolean resolve)
- throws ClassNotFoundException {
-
-- synchronized (name.intern()) {
-- if (log.isDebugEnabled())
-- log.debug("loadClass(" + name + ", " + resolve + ")");
-- Class clazz = null;
--
-- // Log access to stopped classloader
-- if (!started) {
-- try {
-- throw new IllegalStateException();
-- } catch (IllegalStateException e) {
-- log.info(sm.getString("webappClassLoader.stopped", name), e);
-- }
-+ if (log.isDebugEnabled())
-+ log.debug("loadClass(" + name + ", " + resolve + ")");
-+ Class clazz = null;
-+
-+ // Log access to stopped classloader
-+ if (!started) {
-+ try {
-+ throw new IllegalStateException();
-+ } catch (IllegalStateException e) {
-+ log.info(sm.getString("webappClassLoader.stopped", name), e);
- }
--
-- // (0) Check our previously loaded local class cache
-- clazz = findLoadedClass0(name);
-+ }
-+
-+ // (0) Check our previously loaded local class cache
-+ clazz = findLoadedClass0(name);
-+ if (clazz != null) {
-+ if (log.isDebugEnabled())
-+ log.debug(" Returning class from cache");
-+ if (resolve)
-+ resolveClass(clazz);
-+ return (clazz);
-+ }
-+
-+ // (0.1) Check our previously loaded class cache
-+ clazz = findLoadedClass(name);
-+ if (clazz != null) {
-+ if (log.isDebugEnabled())
-+ log.debug(" Returning class from cache");
-+ if (resolve)
-+ resolveClass(clazz);
-+ return (clazz);
-+ }
-+
-+ // (0.2) Try loading the class with the system class loader, to prevent
-+ // the webapp from overriding J2SE classes
-+ try {
-+ clazz = system.loadClass(name);
- if (clazz != null) {
-- if (log.isDebugEnabled())
-- log.debug(" Returning class from cache");
- if (resolve)
- resolveClass(clazz);
- return (clazz);
- }
--
-- // (0.1) Check our previously loaded class cache
-- clazz = findLoadedClass(name);
-- if (clazz != null) {
-- if (log.isDebugEnabled())
-- log.debug(" Returning class from cache");
-- if (resolve)
-- resolveClass(clazz);
-- return (clazz);
-+ } catch (ClassNotFoundException e) {
-+ // Ignore
-+ }
-+
-+ // (0.5) Permission to access this class when using a SecurityManager
-+ if (securityManager != null) {
-+ int i = name.lastIndexOf('.');
-+ if (i >= 0) {
-+ try {
-+ securityManager.checkPackageAccess(name.substring(0,i));
-+ } catch (SecurityException se) {
-+ String error = "Security Violation, attempt to use " +
-+ "Restricted Class: " + name;
-+ log.info(error, se);
-+ throw new ClassNotFoundException(error, se);
-+ }
- }
--
-- // (0.2) Try loading the class with the system class loader, to prevent
-- // the webapp from overriding J2SE classes
-+ }
-+
-+ boolean delegateLoad = delegate || filter(name);
-+
-+ // (1) Delegate to our parent if requested
-+ if (delegateLoad) {
-+ if (log.isDebugEnabled())
-+ log.debug(" Delegating to parent classloader1 " + parent);
-+ ClassLoader loader = parent;
-+ if (loader == null)
-+ loader = system;
- try {
-- clazz = system.loadClass(name);
-+ clazz = loader.loadClass(name);
- if (clazz != null) {
-+ if (log.isDebugEnabled())
-+ log.debug(" Loading class from parent");
- if (resolve)
- resolveClass(clazz);
- return (clazz);
- }
- } catch (ClassNotFoundException e) {
-- // Ignore
-+ ;
- }
--
-- // (0.5) Permission to access this class when using a SecurityManager
-- if (securityManager != null) {
-- int i = name.lastIndexOf('.');
-- if (i >= 0) {
-- try {
-- securityManager.checkPackageAccess(name.substring(0,i));
-- } catch (SecurityException se) {
-- String error = "Security Violation, attempt to use " +
-- "Restricted Class: " + name;
-- log.info(error, se);
-- throw new ClassNotFoundException(error, se);
-- }
-- }
-- }
--
-- boolean delegateLoad = delegate || filter(name);
--
-- // (1) Delegate to our parent if requested
-- if (delegateLoad) {
-+ }
-+
-+ // (2) Search local repositories
-+ if (log.isDebugEnabled())
-+ log.debug(" Searching local repositories");
-+ try {
-+ clazz = findClass(name);
-+ if (clazz != null) {
- if (log.isDebugEnabled())
-- log.debug(" Delegating to parent classloader1 " + parent);
-- ClassLoader loader = parent;
-- if (loader == null)
-- loader = system;
-- try {
-- clazz = loader.loadClass(name);
-- if (clazz != null) {
-- if (log.isDebugEnabled())
-- log.debug(" Loading class from parent");
-- if (resolve)
-- resolveClass(clazz);
-- return (clazz);
-- }
-- } catch (ClassNotFoundException e) {
-- ;
-- }
-+ log.debug(" Loading class from local repository");
-+ if (resolve)
-+ resolveClass(clazz);
-+ return (clazz);
- }
--
-- // (2) Search local repositories
-+ } catch (ClassNotFoundException e) {
-+ ;
-+ }
-+
-+ // (3) Delegate to parent unconditionally
-+ if (!delegateLoad) {
- if (log.isDebugEnabled())
-- log.debug(" Searching local repositories");
-+ log.debug(" Delegating to parent classloader at end: " + parent);
-+ ClassLoader loader = parent;
-+ if (loader == null)
-+ loader = system;
- try {
-- clazz = findClass(name);
-+ clazz = loader.loadClass(name);
- if (clazz != null) {
- if (log.isDebugEnabled())
-- log.debug(" Loading class from local repository");
-+ log.debug(" Loading class from parent");
- if (resolve)
- resolveClass(clazz);
- return (clazz);
-@@ -1535,30 +1554,10 @@
- } catch (ClassNotFoundException e) {
- ;
- }
--
-- // (3) Delegate to parent unconditionally
-- if (!delegateLoad) {
-- if (log.isDebugEnabled())
-- log.debug(" Delegating to parent classloader at end: " + parent);
-- ClassLoader loader = parent;
-- if (loader == null)
-- loader = system;
-- try {
-- clazz = loader.loadClass(name);
-- if (clazz != null) {
-- if (log.isDebugEnabled())
-- log.debug(" Loading class from parent");
-- if (resolve)
-- resolveClass(clazz);
-- return (clazz);
-- }
-- } catch (ClassNotFoundException e) {
-- ;
-- }
-- }
--
-- throw new ClassNotFoundException(name);
- }
-+
-+ throw new ClassNotFoundException(name);
-+
- }
-
-
-@@ -2544,7 +2543,7 @@
- if (clazz != null)
- return clazz;
-
-- synchronized (name.intern()) {
-+ synchronized (this) {
- clazz = entry.loadedClass;
- if (clazz != null)
- return clazz;
More information about the pkg-java-commits
mailing list