From 1851d21f78e17e140dd84432e713fe2dc603a646 Mon Sep 17 00:00:00 2001
From: Mario Melara <maamelara@gmail.com>
Date: Fri, 28 Aug 2020 10:40:47 -0700
Subject: [PATCH] Add tomcat9 config changes

Closes ess-dive/ess-dive-project#153

Upgrades tomcat7 to tomcat9 and includes the required configuration
changes needed. The AJP connector had changes made to it since tomcat7
which include allowedRequestAttributesPattern, default address is the
loopback address and other changes described here:

https://tomcat.apache.org/migration-9.html

The changes were made accordingly so that metacat and metacatui can
connect with each other as shown in the server.xml.patch file.

Use tomcat with jdk8

Metacat has compatability problems with jdk11. It has been suggested by
the NCEAS group to downgrade and use Java 8.

Add server.xml with configuration changes

The configuration changes include some additional parameters to get the
AJP connector working in Tomcat 9 since some changes were made.

Add patch file for server
---
 Dockerfile       |  2 +-
 image-server.xml | 60 +++++++++++++++++++++++++++++++------------
 server.xml       | 66 ++++++++++++++++++++++++++++++++++--------------
 server.xml.patch | 38 +++++++++++++++++++---------
 4 files changed, 118 insertions(+), 48 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index ec4795e..b2cc604 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM tomcat:7.0-jre8
+FROM tomcat:9.0-jdk8
 
 # Debian Tomcat UID
 ARG METACAT_UID=108
diff --git a/image-server.xml b/image-server.xml
index df638a3..d676400 100644
--- a/image-server.xml
+++ b/image-server.xml
@@ -1,4 +1,4 @@
-<?xml version='1.0' encoding='utf-8'?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
@@ -26,8 +26,6 @@
   -->
   <!--APR library loader. Documentation at /docs/apr.html -->
   <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
-  <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
-  <Listener className="org.apache.catalina.core.JasperListener" />
   <!-- Prevent memory leaks due to use of particular java/javax APIs-->
   <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
   <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
@@ -63,10 +61,10 @@
 
     <!-- A "Connector" represents an endpoint by which requests are received
          and responses are returned. Documentation at :
-         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+         Java HTTP Connector: /docs/config/http.html
          Java AJP  Connector: /docs/config/ajp.html
          APR (HTTP/AJP) Connector: /docs/apr.html
-         Define a non-SSL HTTP/1.1 Connector on port 8080
+         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
     -->
     <Connector port="8080" protocol="HTTP/1.1"
                connectionTimeout="20000"
@@ -78,20 +76,49 @@
                connectionTimeout="20000"
                redirectPort="8443" />
     -->
-    <!-- Define a SSL HTTP/1.1 Connector on port 8443
-         This connector uses the BIO implementation that requires the JSSE
-         style configuration. When using the APR/native implementation, the
-         OpenSSL style configuration is required as described in the APR/native
-         documentation -->
+    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
+         This connector uses the NIO implementation. The default
+         SSLImplementation will depend on the presence of the APR/native
+         library and the useOpenSSL attribute of the
+         AprLifecycleListener.
+         Either JSSE or OpenSSL style configuration may be used regardless of
+         the SSLImplementation selected. JSSE style configuration is used below.
+    -->
     <!--
-    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
-               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
-               clientAuth="false" sslProtocol="TLS" />
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
+               maxThreads="150" SSLEnabled="true">
+        <SSLHostConfig>
+            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
+    -->
+    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
+         This connector uses the APR/native implementation which always uses
+         OpenSSL for TLS.
+         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
+         configuration is used below.
+    -->
+    <!--
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
+               maxThreads="150" SSLEnabled="true" >
+        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
+        <SSLHostConfig>
+            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
+                         certificateFile="conf/localhost-rsa-cert.pem"
+                         certificateChainFile="conf/localhost-rsa-chain.pem"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
     -->
 
     <!-- Define an AJP 1.3 Connector on port 8009 -->
-    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
-
+    <!--
+    <Connector protocol="AJP/1.3"
+               address="::1"
+               port="8009"
+               redirectPort="8443" />
+    -->
 
     <!-- An Engine represents the entry point (within Catalina) that processes
          every request.  The Engine implementation for Tomcat stand alone
@@ -135,10 +162,11 @@
              Documentation at: /docs/config/valve.html
              Note: The pattern used is equivalent to using pattern="common" -->
         <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
-               prefix="localhost_access_log." suffix=".txt"
+               prefix="localhost_access_log" suffix=".txt"
                pattern="%h %l %u %t &quot;%r&quot; %s %b" />
 
       </Host>
     </Engine>
   </Service>
 </Server>
+
diff --git a/server.xml b/server.xml
index b4324ff..9281e10 100644
--- a/server.xml
+++ b/server.xml
@@ -1,4 +1,4 @@
-<?xml version='1.0' encoding='utf-8'?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
@@ -26,8 +26,6 @@
   -->
   <!--APR library loader. Documentation at /docs/apr.html -->
   <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
-  <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
-  <Listener className="org.apache.catalina.core.JasperListener" />
   <!-- Prevent memory leaks due to use of particular java/javax APIs-->
   <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
   <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
@@ -63,10 +61,10 @@
 
     <!-- A "Connector" represents an endpoint by which requests are received
          and responses are returned. Documentation at :
-         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+         Java HTTP Connector: /docs/config/http.html
          Java AJP  Connector: /docs/config/ajp.html
          APR (HTTP/AJP) Connector: /docs/apr.html
-         Define a non-SSL HTTP/1.1 Connector on port 8080
+         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
     -->
     <Connector port="8080" protocol="HTTP/1.1"
                connectionTimeout="20000"
@@ -78,26 +76,55 @@
                connectionTimeout="20000"
                redirectPort="8443" />
     -->
-    <!-- Define a SSL HTTP/1.1 Connector on port 8443
-         This connector uses the BIO implementation that requires the JSSE
-         style configuration. When using the APR/native implementation, the
-         OpenSSL style configuration is required as described in the APR/native
-         documentation -->
+    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
+         This connector uses the NIO implementation. The default
+         SSLImplementation will depend on the presence of the APR/native
+         library and the useOpenSSL attribute of the
+         AprLifecycleListener.
+         Either JSSE or OpenSSL style configuration may be used regardless of
+         the SSLImplementation selected. JSSE style configuration is used below.
+    -->
+    <!--
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
+               maxThreads="150" SSLEnabled="true">
+        <SSLHostConfig>
+            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
+    -->
+    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
+         This connector uses the APR/native implementation which always uses
+         OpenSSL for TLS.
+         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
+         configuration is used below.
+    -->
     <!--
-    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
-               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
-               clientAuth="false" sslProtocol="TLS" />
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
+               maxThreads="150" SSLEnabled="true" >
+        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
+        <SSLHostConfig>
+            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
+                         certificateFile="conf/localhost-rsa-cert.pem"
+                         certificateChainFile="conf/localhost-rsa-chain.pem"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
     -->
 
     <!-- Define an AJP 1.3 Connector on port 8009 -->
-    <Connector port="8009" protocol="AJP/1.3"
-               acceptCount="1000"
+    <Connector protocol="AJP/1.3"
+               address="0.0.0.0"
+               port="8009"
+               redirectPort="8443"
+               acceptCount="1000" 
                acceptorThreadCount="2"
                connectionTimeout="20000"
                maxConnections="10000"
                maxPostSize="-1"
-               maxThreads="500" />
-
+               maxThreads="500"
+               allowedRequestAttributesPattern=".*"
+               secretRequired="false"/>
 
     <!-- An Engine represents the entry point (within Catalina) that processes
          every request.  The Engine implementation for Tomcat stand alone
@@ -131,12 +158,12 @@
       <Host name="localhost"  appBase="webapps"
             unpackWARs="true" autoDeploy="true">
 
+
         <!-- SingleSignOn valve, share authentication between web applications
              Documentation at: /docs/config/valve.html -->
         <!--
         <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
         -->
-
         <!-- Remote IP Valve -->
         <Valve className="org.apache.catalina.valves.RemoteIpValve" requestAttributesEnabled="true" />
 
@@ -145,10 +172,11 @@
              Note: The pattern used is equivalent to using pattern="common" -->
         <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                requestAttributesEnabled="true"
-               prefix="localhost_access_log." suffix=".txt"
+               prefix="localhost_access_log" suffix=".txt"
                pattern="%a %l %u %t &quot;%r&quot; %s %b" />
 
       </Host>
     </Engine>
   </Service>
 </Server>
+
diff --git a/server.xml.patch b/server.xml.patch
index 2467226..e41760b 100644
--- a/server.xml.patch
+++ b/server.xml.patch
@@ -1,33 +1,47 @@
---- image-server.xml	2019-05-31 12:43:29.000000000 -0700
-+++ server.xml	2019-05-31 16:11:30.000000000 -0700
-@@ -90,7 +90,13 @@
+--- image-server.xml	2020-09-10 11:49:53.000000000 -0700
++++ server.xml	2020-09-16 11:08:20.000000000 -0700
+@@ -113,12 +113,18 @@
      -->
  
      <!-- Define an AJP 1.3 Connector on port 8009 -->
--    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
-+    <Connector port="8009" protocol="AJP/1.3"
-+               acceptCount="1000"
+-    <!--
+     <Connector protocol="AJP/1.3"
+-               address="::1"
++               address="0.0.0.0"
+                port="8009"
+-               redirectPort="8443" />
+-    -->
++               redirectPort="8443"
++               acceptCount="1000" 
 +               acceptorThreadCount="2"
 +               connectionTimeout="20000"
 +               maxConnections="10000"
 +               maxPostSize="-1"
-+               maxThreads="500" />
- 
++               maxThreads="500"
++               allowedRequestAttributesPattern=".*"
++               secretRequired="false"/>
  
      <!-- An Engine represents the entry point (within Catalina) that processes
-@@ -131,12 +137,16 @@
+          every request.  The Engine implementation for Tomcat stand alone
+@@ -152,18 +158,22 @@
+       <Host name="localhost"  appBase="webapps"
+             unpackWARs="true" autoDeploy="true">
+ 
++
+         <!-- SingleSignOn valve, share authentication between web applications
+              Documentation at: /docs/config/valve.html -->
+         <!--
          <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
          -->
- 
 +        <!-- Remote IP Valve -->
 +        <Valve className="org.apache.catalina.valves.RemoteIpValve" requestAttributesEnabled="true" />
-+
+ 
          <!-- Access log processes all example.
               Documentation at: /docs/config/valve.html
               Note: The pattern used is equivalent to using pattern="common" -->
          <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
 +               requestAttributesEnabled="true"
-                prefix="localhost_access_log." suffix=".txt"
+                prefix="localhost_access_log" suffix=".txt"
 -               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
 +               pattern="%a %l %u %t &quot;%r&quot; %s %b" />