Apache Tomcat 5.5 Servlet/JSP 容器Apache可移植运行库 与 Tomcat |  |
| 简介 |
Tomcat can use the Apache可移植运行库 to
provide superior scalability, 性能, and better integration with native server
technologies. The Apache Portable Runtime is a highly portable library that is at
the heart of Apache HTTP Server 2.x. APR has many uses, including access to advanced IO
functionality (such as sendfile, epoll and OpenSSL), OS level functionality (random number
generation, system status, etc), and native process handling (shared memory, NT
pipes and Unix sockets).
These features allows making Tomcat a general purpose webserver, will enable much better
integration with other native web technologies, and overall make Java much more viable as
a full fledged webserver platform rather than simply a backend focused technology.
|
| 安装 |
安装好以下三个主要的本地组件方可支持 APR :
- APR库
- 供Tomcat使用APR的JNI包装器 (libtcnative)
- OpenSSL库
| Windows |
Windows 二进制 are provided for tcnative-1, which is a statically compiled .dll which includes
OpenSSL and APR. It can be downloaded from here
as 32bit or AMD x86-64 binaries.
In security conscious production environments, it is recommended to use separate shared dlls
for OpenSSL, APR, and libtcnative-1, and update them as needed according to security bulletins.
Windows OpenSSL binaries are linked from the Official OpenSSL
website (see related/binaries).
|
|
| APR 组件 |
一旦这些组件正确的安装并且可供java调用 (如果加载失败, 库文件路径将被显示在控制台),
Tomcat 连接器将自动使用 APR 功能. APR连接器的配置与普通连接器的配置基本相同，
但是提供了一些扩展的属性供APR组件使用。 注意:默认值已经适用于大多数的应用场景，
额外的调整不是必须的。
当APR可用之后, 以下特性将在Tomcat中可用:
- Secure session ID generation by default on all platforms (platforms other than Linux required
random number generation using a configured entropy)
- Tomcat进程的内存占用率和CPU占用率将被 status servlet 显示。
|
| APR连接器配置 |
| HTTP |
当APR可用之后, HTTP 连接器 will use sendfile for hadling large static files (all such
files will be sent ansychronously using high performance kernel level calls), and will use
a socket poller for keepalive, increasing scalability of the server.
The following attributes are supported in the HTTP APR connector in addition to the ones supported
in the regular HTTP connector:
| Attribute | Description |
|---|
firstReadTimeout |
The first read of a request will be made using the specified timeout. If no data is available
after the specified time, the socket will be placed in the poller. The value of this attribute is
in ms. Setting this value to 0 or -1 will
increase scalability by always using a poller to handle keepalive, but will have a minor impact
on latency (see the related pollTime attribute). The difference is that with 0, the first read of
a request will be made using a short timeout, while with -1, the first read will be made using the
regular socket timeout that is configured on the connector. Setting this to -2 will cause
the connector to not use the poller for keepalive in most situations, emulating the behavior of
the java.io HTTP connector.
The default value is -1. Note: on Windows, the actual value of firstReadTimeout will
be 500 + the specified value, if the specified value is strictly positive.
| pollTime |
Duration of a poll call. Lowering this value will slightly decrease latency of connections
being kept alive in some cases, but will use more CPU as more poll calls are being made. The
default value is 2000 (5ms).
| pollerSize |
Amount of sockets that the poller responsible for polling kept alive connections can hold at a
given time. Extra connections will be closed right away. The default value is 8192, corresponding to
8192 keepalive connections.
| useSendfile |
Use kernel level sendfile for certain static files. The default value is true.
| sendfileSize |
Amount of sockets that the poller responsible for sending static files asynchronously can hold
at a given time. Extra connections will be closed right away without any data being sent
(resulting in a zero length file on the client side). Note that in most cases, sendfile is a call
that will return right away (being taken care of "synchonously" by the kernel), and the sendfile
poller will not be used, so the amount of static files which can be sent concurrently is much larger
than the specified amount. The default value is 1024.
|
|
| HTTPS |
When APR is enabled, the HTTPS connector will use a socket poller for keepalive, increasing
scalability of the server. It also uses OpenSSL, which may be more optimized than JSSE depending
on the processor being used, and can be complemented with many commercial accelerator components.
Unlike the HTTP connector, the HTTPS connector cannot use sendfile to optimize static file
processing.
The HTTPS APR connector has the same basic attributes than the HTTP APR connector, but adds
OpenSSL specific ones. For the full details on using OpenSSL, please refer to OpenSSL documentations
and the many books available for it (见 OpenSSL官方站点).
The SSL specific attributes for the connector are:
| Attribute | Description |
|---|
SSLEngine |
将使用的 SSL引擎名字. off: 不使用 SSL, on: 使用 SSL 但没有指定的引擎. 默认值是 off.
| SSLProtocol |
Protocol which may be used for communicating with clients. 默认是 "all", 支持的
其它可用值有 "SSLv2", "SSLv3", "TLSv1", and "SSLv2+SSLv3".
| SSLCipherSuite |
Ciphers which may be used for communicating with clients. The default is "ALL", with
other acceptable values being a list of ciphers, with ":" used as the delimiter
(see OpenSSL documentation for the list of ciphers supported).
| SSLCertificateFile |
包含有服务器证书的文件路径。 格式是 PEM-encoded.
| SSLCertificateKeyFile |
Name of the file that contains the server private key. The format is PEM-encoded.
The default value is the value of "SSLCertificateFile" and in this case both certificate
and private key have to be in this file (NOT RECOMMENDED).
| SSLPassword |
Pass phrase for the encrypted private key. If "SSLPassword" is not provided, the callback fonction
should prompt for the pass phrase.
| SSLVerifyClient |
Ask client for certificate. 默认为 "none", meaning the client will not have the opportunity
to submit a certificate. Other acceptable values include "optional", "require" and "optionalNoCA".
| SSLVerifyDepth |
Maximum verification depth for client certificates. 默认为 "10".
| SSLCACertificateFile |
见 mod_ssl相关文档.
| SSLCACertificatePath |
见 mod_ssl相关文档.
| SSLCertificateChainFile |
见 mod_ssl相关文档.
| SSLCARevocationFile |
见 mod_ssl相关文档.
| SSLCARevocationPath |
见 mod_ssl相关文档.
|
下面是SSL连接器定义的一个范例:
| | | |
<Connector port="443" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
SSLEngine="on"
SSLCertificateFile="${catalina.base}/conf/localhost.crt"
SSLCertificateKeyFile="${catalina.base}/conf/localhost.key" /> | | | | |
|
| AJP |
When APR is enabled, the AJP connector will use a socket poller for keepalive, increasing
scalability of the server. As AJP is designed around a pool of persistent (or almost
persistent) connections, this will reduce significantly the amount of processing threads
needed by Tomcat. Unlike the HTTP connector, the AJP connector cannot use sendfile to optimize
static file processing.
The following attributes are supported in the AJP APR connector in addition to the ones supported
in the regular AJP connector:
| Attribute | Description |
|---|
firstReadTimeout |
The first read of a request will be made using the specified timeout. If no data is available
after the specified time, the socket will be placed in the poller. The value of this attribute is
in ms. Setting this value to 0 or -1 will
increase scalability by always using a poller to handle keepalive, but will have a minor impact
on latency (see the related pollTime attribute). The difference is that with 0, the first read of
a request will be made using a short timeout, while with -1, the first read will be made using the
regular socket timeout that is configured on the connector. Setting this to -2 will cause
the connector to not use the poller for keepalive in most situations, emulating the behavior of
the java.io HTTP connector.
The default value is -1. Note: on Windows, the actual value of firstReadTimeout will
be 500 + the specified value, if the specified value is strictly positive.
| pollTime |
Duration of a poll call. Lowering this value will slightly decrease latency of connections
being kept alive in some cases, but will use more CPU as more poll calls are being made. The
default value is 2000 (5ms).
| pollerSize |
Amount of sockets that the poller responsible for polling kept alive connections can hold at a
given time. Extra connections will be closed right away. The default value is 8192, corresponding to
8192 keepalive connections.
|
|
|
|
