source: nutchez-0.1/tomcat/webapps/docs/printer/apr.html @ 163

Last change on this file since 163 was 66, checked in by waue, 15 years ago

NutchEz - an easy way to nutch
File size: 21.4 KB
Line 
1<html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 6.0 - Apache Portable Runtime (APR) based Native library for Tomcat</title><meta value="Remy Maucherat" name="author"><meta value="" name="email"></head><body vlink="#525D76" alink="#525D76" link="#525D76" text="#000000" bgcolor="#ffffff"><table cellspacing="0" width="100%" border="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img border="0" alt="
2      The Apache Tomcat Servlet/JSP Container
3    " align="right" src="./../images/tomcat.gif"></a></td><td><font face="arial,helvetica,sanserif"><h1>Apache Tomcat 6.0</h1></font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img border="0" alt="Apache Logo" align="right" src="./../images/asf-logo.gif"></a></td></tr></table><table cellspacing="4" width="100%" border="0"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr size="1" noshade></td></tr><tr><!--RIGHT SIDE MAIN BODY--><td align="left" valign="top" width="80%"><table cellspacing="4" width="100%" border="0"><tr><td valign="top" align="left"><h1>Apache Tomcat 6.0</h1><h2>Apache Portable Runtime (APR) based Native library for Tomcat</h2></td><td nowrap="true" valign="top" align="right"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
4
5  <p>
6      Tomcat can use the <a href="http://apr.apache.org/">Apache Portable Runtime</a> to
7      provide superior scalability, performance, and better integration with native server
8      technologies. The Apache Portable Runtime is a highly portable library that is at
9      the heart of Apache HTTP Server 2.x. APR has many uses, including access to advanced IO
10      functionality (such as sendfile, epoll and OpenSSL), OS level functionality (random number
11      generation, system status, etc), and native process handling (shared memory, NT
12      pipes and Unix sockets).
13  </p>
14 
15  <p>
16      These features allows making Tomcat a general purpose webserver, will enable much better
17      integration with other native web technologies, and overall make Java much more viable as
18      a full fledged webserver platform rather than simply a backend focused technology.
19  </p>
20
21  </blockquote></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Installation"><strong>Installation</strong></a></font></td></tr><tr><td><blockquote>
22
23    <p>
24      APR support requires three main native components to be installed:
25      <ul>
26        <li>APR library</li>
27        <li>JNI wrappers for APR used by Tomcat (libtcnative)</li>
28        <li>OpenSSL libraries</li>
29      </ul>
30    </p>
31
32    <table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#828DA6"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Windows"><strong>Windows</strong></a></font></td></tr><tr><td><blockquote>
33   
34    <p>
35      Windows binaries are provided for tcnative-1, which is a statically compiled .dll which includes
36      OpenSSL and APR. It can be downloaded from <a href="http://tomcat.heanet.ie/native/">here</a>
37      as 32bit or AMD x86-64 binaries.
38      In security conscious production environments, it is recommended to use separate shared dlls
39      for OpenSSL, APR, and libtcnative-1, and update them as needed according to security bulletins.
40      Windows OpenSSL binaries are linked from the <a href="http://www.openssl.org">Official OpenSSL
41      website</a> (see related/binaries).
42    </p>
43   
44    </blockquote></td></tr></table>
45   
46    <table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#828DA6"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Linux"><strong>Linux</strong></a></font></td></tr><tr><td><blockquote>
47   
48    <p>
49      Most Linux distributions will ship packages for APR and OpenSSL. The JNI wrapper (libtcnative) will
50      then have to be compiled. It depends on APR, OpenSSL, and the Java headers.
51    </p>
52   
53    <p>
54      Requirements:
55      <ul>
56        <li>APR 1.2+ development headers (libapr1-dev package)</li>
57        <li>OpenSSL 0.9.7+ development headers (libssl-dev package)</li>
58        <li>JNI headers from Java compatible JDK 1.4+</li>
59        <li>GNU development environment (gcc, make)</li>
60      </ul>
61    </p>
62   
63    <p>
64      The wrapper library sources are located in the Tomcat binary bundle, in the
65      <code>bin/tomcat-native.tar.gz</code> archive.
66      Once the build environment is installed and the source archive is extracted, the wrapper library
67      can be compiled using (from the folder containing the configure script):
68      <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre>./configure &amp;&amp; make &amp;&amp; make install</pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div>
69    </p>
70   
71    </blockquote></td></tr></table>
72 
73  </blockquote></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="APR Components"><strong>APR Components</strong></a></font></td></tr><tr><td><blockquote>
74
75  <p>
76    Once the libraries are properly installed and available to Java (if loading fails, the library path
77    will be displayed), the Tomcat connectors will automatically use APR. Configuration of the connectors
78    is similar to the regular connectors, but have a few extra attributes which are used to configure
79    APR components. Note that the defaults should be well tuned for most use cases, and additional
80    tweaking shouldn't be required.
81  </p>
82
83  <p>
84    When APR is enabled, the following features are also enabled in Tomcat:
85    <ul>
86      <li>Secure session ID generation by default on all platforms (platforms other than Linux required
87          random number generation using a configured entropy)</li>
88      <li>OS level statistics on memory usage and CPU usage by the Tomcat process are displayed by
89          the status servlet</li>
90    </ul>
91  </p>
92
93  </blockquote></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="APR Lifecycle Listener Configuration"><strong>APR Lifecycle Listener Configuration</strong></a></font></td></tr><tr><td><blockquote>
94    <table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#828DA6"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="AprLifecycleListener"><strong>AprLifecycleListener</strong></a></font></td></tr><tr><td><blockquote>
95    <attribute name="SSLEngine" required="false">
96    <p>
97      Name of the SSLEngine to use. off: Do not use SSL, on: Use SSL but no specific ENGINE.
98      The default value is <b>on</b>.
99      This initializes the native SSL engine, then enable the use of this engine in the connector
100      using the <code>SSLEnabled</code> attribute. Example:
101      <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre>
102&lt;Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /&gt;
103      </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div>
104    </p>
105    <p>See the <a href="http://www.openssl.org">Official OpenSSL
106       website</a> for more details on SSL hardware engines and manufacturers.
107    </p>
108    </attribute>
109    </blockquote></td></tr></table>
110  </blockquote></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="APR Connectors Configuration"><strong>APR Connectors Configuration</strong></a></font></td></tr><tr><td><blockquote>
111
112    <table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#828DA6"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="HTTP"><strong>HTTP</strong></a></font></td></tr><tr><td><blockquote>
113   
114    <p>
115      When APR is enabled, the HTTP connector will use sendfile for hadling large static files (all such
116      files will be sent ansychronously using high performance kernel level calls), and will use
117      a socket poller for keepalive, increasing scalability of the server.
118    </p>
119
120    <p>
121      The following attributes are supported in the HTTP APR connector in addition to the ones supported
122      in the regular HTTP connector:
123    </p>
124
125    <table cellpadding="5" border="1"><tr><th bgcolor="#023264" width="15%"><font color="#ffffff">Attribute</font></th><th bgcolor="#023264" width="85%"><font color="#ffffff">Description</font></th></tr><tr><td valign="center" align="left"><code>keepAliveTimeout</code></td><td valign="center" align="left">
126      <p>The number of milliseconds this <strong>Connector</strong> will wait for
127       another HTTP request before closing the connection.
128       The default value is to use the value that has been set for the
129       connectionTimeout attribute. This value also controls the timeout interval which
130       is used for Comet connections.</p>
131    </td></tr><tr><td valign="center" align="left"><code>pollTime</code></td><td valign="center" align="left">
132      <p>Duration of a poll call. Lowering this value will slightly decrease latency of connections
133      being kept alive in some cases, but will use more CPU as more poll calls are being made. The
134      default value is 2000 (5ms).</p>
135    </td></tr><tr><td valign="center" align="left"><code>pollerSize</code></td><td valign="center" align="left">
136      <p>Amount of sockets that the poller responsible for polling kept alive connections can hold at a
137      given time. Extra connections will be closed right away. The default value is 8192, corresponding to
138      8192 keepalive connections.</p>
139    </td></tr><tr><td valign="center" align="left"><code>useSendfile</code></td><td valign="center" align="left">
140      <p>Use kernel level sendfile for certain static files. The default value is true.</p>
141    </td></tr><tr><td valign="center" align="left"><code>sendfileSize</code></td><td valign="center" align="left">
142      <p>Amount of sockets that the poller responsible for sending static files asynchronously can hold
143      at a given time. Extra connections will be closed right away without any data being sent
144      (resulting in a zero length file on the client side). Note that in most cases, sendfile is a call
145      that will return right away (being taken care of "synchonously" by the kernel), and the sendfile
146      poller will not be used, so the amount of static files which can be sent concurrently is much larger
147      than the specified amount. The default value is 1024.</p>
148    </td></tr></table>
149   
150    </blockquote></td></tr></table>
151 
152    <table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#828DA6"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="HTTPS"><strong>HTTPS</strong></a></font></td></tr><tr><td><blockquote>
153   
154    <p>
155      When APR is enabled, the HTTPS connector will use a socket poller for keepalive, increasing
156      scalability of the server. It also uses OpenSSL, which may be more optimized than JSSE depending
157      on the processor being used, and can be complemented with many commercial accelerator components.
158      Unlike the HTTP connector, the HTTPS connector cannot use sendfile to optimize static file
159      processing.
160    </p>
161
162    <p>
163      The HTTPS APR connector has the same basic attributes than the HTTP APR connector, but adds
164      OpenSSL specific ones. For the full details on using OpenSSL, please refer to OpenSSL documentations
165      and the many books available for it (see the <a href="http://www.openssl.org">Official OpenSSL
166      website</a>). The SSL specific attributes for the connector are:
167    </p>
168   
169    <table cellpadding="5" border="1"><tr><th bgcolor="#023264" width="15%"><font color="#ffffff">Attribute</font></th><th bgcolor="#023264" width="85%"><font color="#ffffff">Description</font></th></tr><tr><td valign="center" align="left"><code>SSLEnabled</code></td><td valign="center" align="left">
170    <p>
171      Enable SSL on the socket, default value is false. Set this value to true
172      to enable SSL handshake/encryption/decryption in the APR connector.
173    </p>
174    </td></tr><tr><td valign="center" align="left"><code>SSLProtocol</code></td><td valign="center" align="left">
175    <p>
176      Protocol which may be used for communicating with clients. The default is "all", with
177      other acceptable values being "SSLv2", "SSLv3", "TLSv1", and "SSLv2+SSLv3".
178    </p>
179    </td></tr><tr><td valign="center" align="left"><code>SSLCipherSuite</code></td><td valign="center" align="left">
180    <p>
181      Ciphers which may be used for communicating with clients. The default is "ALL", with
182      other acceptable values being a list of ciphers, with ":" used as the delimiter
183      (see OpenSSL documentation for the list of ciphers supported).
184    </p>
185    </td></tr><tr><td valign="center" align="left"><strong><code>SSLCertificateFile</code></strong></td><td valign="center" align="left">
186    <p>
187      Name of the file that contains the server certificate. The format is PEM-encoded.
188    </p>
189    </td></tr><tr><td valign="center" align="left"><code>SSLCertificateKeyFile</code></td><td valign="center" align="left">
190    <p>
191      Name of the file that contains the server private key. The format is PEM-encoded.
192      The default value is the value of "SSLCertificateFile" and in this case both certificate
193      and private key have to be in this file (NOT RECOMMENDED).
194    </p>
195    </td></tr><tr><td valign="center" align="left"><code>SSLPassword</code></td><td valign="center" align="left">
196    <p>
197      Pass phrase for the encrypted private key. If "SSLPassword" is not provided, the callback fonction
198      should prompt for the pass phrase.
199    </p>
200    </td></tr><tr><td valign="center" align="left"><code>SSLVerifyClient</code></td><td valign="center" align="left">
201    <p>
202      Ask client for certificate. The default is "none", meaning the client will not have the opportunity
203      to submit a certificate. Other acceptable values include "optional", "require" and "optionalNoCA".
204    </p>
205    </td></tr><tr><td valign="center" align="left"><code>SSLVerifyDepth</code></td><td valign="center" align="left">
206    <p>
207      Maximum verification depth for client certificates. The default is "10".
208    </p>
209    </td></tr><tr><td valign="center" align="left"><code>SSLCACertificateFile</code></td><td valign="center" align="left">
210    <p>
211      See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcacertificatefile">the mod_ssl documentation</a>.
212    </p>
213    </td></tr><tr><td valign="center" align="left"><code>SSLCACertificatePath</code></td><td valign="center" align="left">
214    <p>
215      See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcacertificatepath">the mod_ssl documentation</a>.
216    </p>
217    </td></tr><tr><td valign="center" align="left"><code>SSLCertificateChainFile</code></td><td valign="center" align="left">
218    <p>
219      See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcertificatechainfile">the mod_ssl documentation</a>.
220    </p>
221    </td></tr><tr><td valign="center" align="left"><code>SSLCARevocationFile</code></td><td valign="center" align="left">
222    <p>
223      See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcarevocationfile">the mod_ssl documentation</a>.
224    </p>
225    </td></tr><tr><td valign="center" align="left"><code>SSLCARevocationPath</code></td><td valign="center" align="left">
226    <p>
227      See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcarevocationpath">the mod_ssl documentation</a>.
228    </p>
229    </td></tr></table>
230   
231    <p>
232    An example SSL Connector declaration can be:
233    <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre>
234    &lt;Connector port="443" maxHttpHeaderSize="8192"
235               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
236               enableLookups="false" disableUploadTimeout="true"
237               acceptCount="100" scheme="https" secure="true"
238               SSLEnabled="true"
239               SSLCertificateFile="${catalina.base}/conf/localhost.crt"
240               SSLCertificateKeyFile="${catalina.base}/conf/localhost.key" /&gt;</pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div>
241    </p>
242   
243    </blockquote></td></tr></table>
244 
245    <table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#828DA6"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="AJP"><strong>AJP</strong></a></font></td></tr><tr><td><blockquote>
246   
247    <p>
248      When APR is enabled, the AJP connector will use a socket poller for keepalive, increasing
249      scalability of the server. As AJP is designed around a pool of persistent (or almost
250      persistent) connections, this will reduce significantly the amount of processing threads
251      needed by Tomcat. Unlike the HTTP connector, the AJP connector cannot use sendfile to optimize
252      static file processing.
253    </p>
254
255    <p>
256      The following attributes are supported in the AJP APR connector in addition to the ones supported
257      in the regular AJP connector:
258    </p>
259
260    <table cellpadding="5" border="1"><tr><th bgcolor="#023264" width="15%"><font color="#ffffff">Attribute</font></th><th bgcolor="#023264" width="85%"><font color="#ffffff">Description</font></th></tr><tr><td valign="center" align="left"><code>pollTime</code></td><td valign="center" align="left">
261      <p>Duration of a poll call. Lowering this value will slightly decrease latency of connections
262      being kept alive in some cases, but will use more CPU as more poll calls are being made. The
263      default value is 2000 (5ms).</p>
264    </td></tr><tr><td valign="center" align="left"><code>pollerSize</code></td><td valign="center" align="left">
265      <p>Amount of sockets that the poller responsible for polling kept alive connections can hold at a
266      given time. Extra connections will be closed right away. The default value is 8192, corresponding to
267      8192 keepalive connections.</p>
268    </td></tr></table>
269   
270    </blockquote></td></tr></table>
271 
272  </blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr size="1" noshade></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font size="-1" color="#525D76"><em>
273        Copyright &copy; 1999-2008, Apache Software Foundation
274        </em></font></div></td></tr></table></body></html>
Note: See TracBrowser for help on using the repository browser.