diff --git a/LICENSE.txt b/LICENSE.txt
index d177d7983c..206d51f104 100644
--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -212,12 +212,11 @@ Applications:
      Zxing 3.3.0:
        See licenses/LICENSE-Apache2.0.txt
 
-   Jetty 8.1.21.v20160908:
+   Jetty 9.2.21.v20170120:
    See licenses/ABOUT-Jetty.html
    See licenses/NOTICE-Jetty.html
    See licenses/LICENSE-Apache2.0.txt
    See licenses/LICENSE-ECLIPSE-1.0.html
-   See licenses/NOTICE-Commons-Logging.txt
 
    JRobin 1.6.0-1:
    Copyright (c) 2001-2005 Sasa Markovic and Ciaran Treanor.
@@ -283,7 +282,7 @@ Applications:
       Bundles systray4j-2.4.1:
       See licenses/LICENSE-LGPLv2.1.txt
 
-   Tomcat 6.0.48:
+   Tomcat 8.0.33:
    Copyright 1999-2016 The Apache Software Foundation
    See licenses/LICENSE-Apache2.0.txt
    See licenses/NOTICE-Tomcat.txt
diff --git a/apps/i2ptunnel/java/build.xml b/apps/i2ptunnel/java/build.xml
index 93f5cc3391..c9a3a74c10 100644
--- a/apps/i2ptunnel/java/build.xml
+++ b/apps/i2ptunnel/java/build.xml
@@ -277,14 +277,17 @@
             <classpath>
                 <pathelement location="../../jetty/jettylib/jasper-runtime.jar" />
                 <pathelement location="../../jetty/jettylib/javax.servlet.jar" />
-                <!-- jsp-api.jar only present for debian builds -->
+
+                <!-- following jars only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/jsp-api.jar" />
-                <!-- tomcat-api.jar only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/tomcat-api.jar" />
-                <!-- jasper-el.jar only present for debian builds -->
+                <pathelement location="../../jetty/jettylib/tomcat-util.jar" />
+                <pathelement location="../../jetty/jettylib/tomcat-util-scan.jar" />
+
                 <pathelement location="../../jetty/jettylib/jasper-el.jar" />
                 <pathelement location="../../jetty/jettylib/commons-logging.jar" />
                 <pathelement location="../../jetty/jettylib/commons-el.jar" />
+                <pathelement location="../../jetty/jettylib/jetty-util.jar" />
                 <pathelement location="${ant.home}/lib/ant.jar" />
                 <pathelement location="build/i2ptunnel.jar" />
                 <pathelement location="build/temp-beans.jar" />
@@ -309,12 +312,14 @@
             <classpath>
                 <pathelement location="../../jetty/jettylib/jasper-runtime.jar" />
                 <pathelement location="../../jetty/jettylib/javax.servlet.jar" />
-                <!-- jsp-api.jar only present for debian builds -->
+
+                <!-- following jars only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/jsp-api.jar" />
-                <!-- tomcat-api.jar only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/tomcat-api.jar" />
-                <!-- jasper-el.jar only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/jasper-el.jar" />
+                <pathelement location="../../jetty/jettylib/tomcat-util.jar" />
+                <pathelement location="../../jetty/jettylib/tomcat-util-scan.jar" />
+
                 <pathelement location="../../jetty/jettylib/commons-logging.jar" />
                 <pathelement location="../../jetty/jettylib/commons-el.jar" />
                 <pathelement location="build/i2ptunnel.jar" />
diff --git a/apps/jetty/apache-tomcat-deployer/NOTICE b/apps/jetty/apache-tomcat-deployer/NOTICE
deleted file mode 100644
index 130d56e7d9..0000000000
--- a/apps/jetty/apache-tomcat-deployer/NOTICE
+++ /dev/null
@@ -1,22 +0,0 @@
-Apache Tomcat
-Copyright 1999-2016 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
-
-The Windows Installer is built with the Nullsoft
-Scriptable Install System (NSIS), which is
-open source software.  The original software and
-related information is available at
-http://nsis.sourceforge.net.
-
-Java compilation software for JSP pages is provided by the Eclipse
-JDT Core Batch Compiler component, which is open source software.
-The original software and related information is available at
-http://www.eclipse.org/jdt/core/.
-
-The original XML Schemas for Java EE Deployment Descriptors:
- - javaee_5.xsd
- - javaee_web_services_1_2.xsd
- - javaee_web_services_client_1_2.xsd
-may be obtained from http://java.sun.com/xml/ns/javaee/
diff --git a/apps/jetty/apache-tomcat-deployer/README-i2p.txt b/apps/jetty/apache-tomcat-deployer/README-i2p.txt
deleted file mode 100644
index 6b8c0edf31..0000000000
--- a/apps/jetty/apache-tomcat-deployer/README-i2p.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-This is Apache Tomcat 6.x, supporting Servlet 2.5 and JSP 2.1.
-The Glassfish JSP 2.1 bundled in Jetty 6 is way too old.
-
-Retrieved from the file
-	apache-tomcat-6.0.48-deployer.tar.gz
-
-minus the following files and directores:
-
-	build.xml
-	deployer-howto.html
-	images/*
-	lib/catalina*
-	lib/jsp-api.jar (see below)
-	lib/servlet-api.jar (see below)
-	LICENSE (see ../../../licenses/LICENSE-Apache2.0.txt, it's also inside every jar)
-	RELEASE-NOTES
-
-
-We could use the following API jars from Apache Tomcat 7.x, supporting Servlet 3.0 and JSP 2.2,
-that are required for Jetty 8, but we just bundle the ones from Jetty 8 instead:
-
-	lib/jsp-api.jar
-	lib/servlet-api.jar
-
-For more info:
-http://tomcat.apache.org/whichversion.html
diff --git a/apps/jetty/apache-tomcat-deployer/lib/el-api.jar b/apps/jetty/apache-tomcat-deployer/lib/el-api.jar
deleted file mode 100644
index 2598a4a8fa..0000000000
Binary files a/apps/jetty/apache-tomcat-deployer/lib/el-api.jar and /dev/null differ
diff --git a/apps/jetty/apache-tomcat-deployer/lib/jasper-el.jar b/apps/jetty/apache-tomcat-deployer/lib/jasper-el.jar
deleted file mode 100644
index b7205e347d..0000000000
Binary files a/apps/jetty/apache-tomcat-deployer/lib/jasper-el.jar and /dev/null differ
diff --git a/apps/jetty/apache-tomcat-deployer/lib/jasper.jar b/apps/jetty/apache-tomcat-deployer/lib/jasper.jar
deleted file mode 100644
index ca2d7269d8..0000000000
Binary files a/apps/jetty/apache-tomcat-deployer/lib/jasper.jar and /dev/null differ
diff --git a/apps/jetty/apache-tomcat-deployer/lib/tomcat-juli.jar b/apps/jetty/apache-tomcat-deployer/lib/tomcat-juli.jar
deleted file mode 100644
index c5e0f8f779..0000000000
Binary files a/apps/jetty/apache-tomcat-deployer/lib/tomcat-juli.jar and /dev/null differ
diff --git a/apps/jetty/apache-tomcat/README-i2p.txt b/apps/jetty/apache-tomcat/README-i2p.txt
deleted file mode 100644
index 015ff4736a..0000000000
--- a/apps/jetty/apache-tomcat/README-i2p.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-This is Apache Tomcat 6.x, supporting Servlet 2.5 and JSP 2.1.
-
-Retrieved from the file
-	apache-tomcat-6.0.48.tar.gz
-
-containing only a small subset of lib/tomcat-coyote.jar.
-
-See the buildTomcatUtilJar target in ../build.xml for the classes extracted and more information.
-
-LICENSE: see ../../../licenses/LICENSE-Apache2.0.txt
diff --git a/apps/jetty/apache-tomcat/lib/tomcat-coyote-util.jar b/apps/jetty/apache-tomcat/lib/tomcat-coyote-util.jar
deleted file mode 100644
index a45499414e..0000000000
Binary files a/apps/jetty/apache-tomcat/lib/tomcat-coyote-util.jar and /dev/null differ
diff --git a/apps/jetty/build.xml b/apps/jetty/build.xml
index 47b88cb5d1..f3de9bffa0 100644
--- a/apps/jetty/build.xml
+++ b/apps/jetty/build.xml
@@ -3,7 +3,7 @@
 
     <!-- This copies jars, with some modifications and renaming,
          from the jetty-distribution directory to the jettylib directory.
-         This is disabled if the property with-libjetty8-java=true.
+         This is disabled if the property with-libjetty9-java=true.
 
          This copies jars, with some modifications and renaming,
          from the apache-tomcat-deployer and apache-tomcat directories to the jettylib directory.
@@ -14,18 +14,17 @@
      -->
 
     <!-- Note: Please change all references in top-level build.xml if you update to a new Jetty! -->
-    <property name="jetty.ver" value="8.1.21.v20160908" />
+    <!-- unused until we go to 9.3 -->
+    <property name="jetty.branch" value="stable-9" />
+    <property name="jetty.ver" value="9.2.21.v20170120" />
     <property name="jetty.base" value="jetty-distribution-${jetty.ver}" />
-    <property name="jetty.sha1" value="9780e99e765fd7b9bb1aac8ba2bba374ac039764" />
+    <property name="jetty.sha1" value="3dcd4f66cc3f72800a2ee53fecf7b3f9d3f23eb2" />
     <property name="jetty.filename" value="${jetty.base}.zip" />
-    <property name="jetty.url" value="http://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/${jetty.ver}/${jetty.filename}" />
+    <!-- change jetty.ver to jetty.branch for 9.3 -->
+    <property name="jetty.url" value="http://central.maven.org/maven2/org/eclipse/jetty/jetty-distribution/${jetty.ver}/${jetty.filename}" />
     <property name="verified.filename" value="verified.txt" />
     <property name="javac.compilerargs" value="" />
     <property name="javac.version" value="1.7" />
-    <property name="tomcat.lib" value="apache-tomcat-deployer/lib" />
-    <property name="tomcat.ver" value="6.0.48" />
-    <property name="tomcat2.lib" value="apache-tomcat-${tomcat.ver}/lib" />
-    <property name="tomcat2.lib.small" value="apache-tomcat/lib" />
 
     <target name="all" depends="build" />
 
@@ -41,7 +40,7 @@
     <target name="ensureJettylib1" >
         <condition property="jetty.zip.extracted" >
             <or>
-                <istrue value="${with-libjetty8-java}" />
+                <istrue value="${with-libjetty9-java}" />
                 <available file="${jetty.base}" type="dir" />
             </or>
         </condition>
@@ -53,7 +52,7 @@
         </condition>
         <condition property="verified.already" >
             <or>
-                <istrue value="${with-libjetty8-java}" />
+                <istrue value="${with-libjetty9-java}" />
                 <istrue value="${jetty.zip.extracted}" />
                 <and>
                     <available file="${jetty.filename}" />
@@ -120,10 +119,17 @@
     </target>
 
     <!-- Jetty and tomcat files -->
-    <target name="copyJettylib" depends="mkJettylibdir, copyJettylib1, copyTomcatLib" />
+    <!--
+         We support the following configurations:
+           no system jars: Precise, Trusty
+           with-libtomcat8-java: Jessie (without backports), Wheezy
+           with-libtomcat8-java AND with-libjetty9-java: Xenial, Jessie (with backports), Stretch
+           with-libjetty9-java (only): not supported
+     -->
+    <target name="copyJettylib" depends="mkJettylibdir, copyJettylib1, copyTomcatLib1, copyJettylib2, copyTomcatLib" />
 
     <!-- Jetty files only -->
-    <target name="copyJettylib1" depends="extractJettylib" unless="${with-libjetty8-java}" >
+    <target name="copyJettylib1" depends="extractJettylib" unless="${with-libjetty9-java}" >
       <!-- We copy everything to names without the version numbers so we
            can update them later. Where there was something similar in Jetty 5/6,
            we use the same names so they will overwrite the Jetty 5/6 jar on upgrade.
@@ -166,43 +172,29 @@
                 <attribute name="Note" value="Intentionally empty" />
             </manifest>
         </jar>
+    </target>
+
+    <!-- If with-libtomcat8-java but not with-libjetty9-java, we don't do this -->
+    <target name="copyJettylib2" depends="extractJettylib" unless="${with-libtomcat8-java}" >
         <jar destfile="jettylib/javax.servlet.jar" duplicate="preserve" filesetmanifest="mergewithoutmain" >
-            <zipfileset excludes="about.html about_files about_files/* META-INF/ECLIPSEF.* META-INF/eclipse.inf plugin.properties" src="${jetty.base}/lib/servlet-api-3.0.jar" />
-            <zipfileset excludes="about.html about_files about_files/* META-INF/ECLIPSEF.* META-INF/eclipse.inf plugin.properties" src="${jetty.base}/lib/jsp/javax.servlet.jsp-2.2.0.v201112011158.jar" />
+            <zipfileset excludes="about.html about_files about_files/* META-INF/ECLIPSEF.* META-INF/eclipse.inf plugin.properties" src="${jetty.base}/lib/servlet-api-3.1.jar" />
+          <!--
+            Jetty version - see below for why we don't use this one
+            <zipfileset excludes="about.html about_files about_files/* META-INF/ECLIPSEF.* META-INF/eclipse.inf plugin.properties" src="${jetty.base}/lib/jsp/javax.servlet.jsp-api-2.3.1.jar" />
+           -->
+            <!-- Apache version -->
+            <!-- Also includes org.apache.*, this is copied into jasper-runtime.jar below -->
+            <zipfileset includes="javax/**/*" src="${jetty.base}/lib/apache-jsp/org.mortbay.jasper.apache-jsp-8.0.33.jar"/>
+            <!-- In Debian packages they are found in /usr/share/java/tomcat8-servlet-api.jar in the libtomcat8-java package -->
+            <!-- javax/servlet/jsp/resources are dups of those in apache-jsp jar -->
+            <zipfileset excludes="about.html about_files about_files/* META-INF/ECLIPSEF.* META-INF/eclipse.inf plugin.properties javax/servlet/jsp/resources/*" src="${jetty.base}/lib/jetty-schemas-3.1.jar" />
         </jar>
       <!--
         <delete file="jetty.tar" />
         <delete dir="${jetty.base}" />
       -->
-        <!-- commons-logging.jar not in Jetty 6 but we have it in launch4j so copy it over,
-             needed for old plugins and things. We add tomcat-juli below.
-          -->
-      <!--
-        * Removed in 0.9.24, see ticket #1679
-        * Jetty now uses tomcat-juli (added below to commons-logging.jar), not commons-logging proper,
-        * and no known plugins use it either.
-        <jar destfile="jettylib/commons-logging.jar" filesetmanifest="mergewithoutmain" >
-            <zipfileset excludes="META-INF/LICENSE.txt META-INF/NOTICE.txt" src="../../installer/lib/launch4j/lib/commons-logging.jar" />
-        </jar>
-      -->
     </target>
 
-    <!-- Tomcat util jar.
-         As of Tomcat 6.0.39, the deployer does not contain some classes that are required
-         to precompile jsps with tags (SusiDNS and i2p-bote).
-         These classes are in the main Tomcat package, in lib/tomcat-coyote.jar.
-         As the jar is 800 KB and we only need 12 KB of that, we extract the required classes
-         to a new jar, created and checked in using this target.
-         Apparently this is only required for precompilation of jsps, so this is put in
-         with the JspC compiler jasper-runtime.jar below.
-     -->
-    <target name="buildTomcatUtilJar" unless="${with-libservlet2.5-java}" >
-        <!-- take only what we need from the tomcat-coyote jar -->
-        <jar destfile="${tomcat2.lib.small}/tomcat-coyote-util.jar" >
-            <zipfileset src="${tomcat2.lib}/tomcat-coyote.jar"
-             includes="org/apache/tomcat/util/descriptor/* org/apache/tomcat/util/res/*" />
-        </jar>
-    </target>
 
     <!-- Tomcat.
          The glassfish jars bundled in Jetty 6 are way too old.
@@ -221,7 +213,7 @@
      -->
     <target name="copyTomcatLib" depends="mkJettylibdir, copyTomcatLib1, copyTomcatLib2, copyTomcatLib3" />
 
-    <target name="copyTomcatLib1" unless="${with-libservlet2.5-java}" >
+    <target name="copyTomcatLib1" >
         <condition property="with-libtomcat-java" >
             <or>
                 <istrue value="${with-libtomcat6-java}" />
@@ -233,34 +225,47 @@
 
 
     <target name="copyTomcatLib2" unless="${with-libtomcat-java}" >
-        <!-- EL libs.
+        <!-- EL API and compiler libs.
              Tomcat 6 has EL 2.1.
              Tomcat 7 / libservlet3.0 has EL 2.2.
+             Jetty 9 / Tomcat 8 / libservlet3.1 has EL 3.0.
              According to http://stackoverflow.com/questions/7202686/differences-between-el-2-1-and-2-2
              2.2 is backwards-compatible with 2.1.
          -->
-        <jar destfile="jettylib/commons-el.jar" duplicate="preserve" filesetmanifest="merge" >
-            <zipfileset excludes="META-INF/LICENSE META-INF/NOTICE" src="${tomcat.lib}/jasper-el.jar" />
-            <zipfileset excludes="META-INF/**/*" src="${tomcat.lib}/el-api.jar" />
+        <!-- the javax.el API, AND the com.sun.el parser -->
+        <!-- actually from jetty9, not tomcat8... this will fail unless we have the jetty files also -->
+        <jar destfile="jettylib/commons-el.jar" >
+          <!--
+            Jetty version
+            <zipfileset src="${jetty.base}/lib/jsp/javax.el-3.0.0.jar"/>
+           -->
+            <!-- Apache version -->
+            <zipfileset src="${jetty.base}/lib/apache-jsp/org.mortbay.jasper.apache-el-8.0.33.jar"/>
         </jar>
 
-        <jar destfile="jettylib/jasper-runtime.jar" filesetmanifest="merge" >
-            <zipfileset excludes="META-INF/LICENSE META-INF/NOTICE" src="${tomcat.lib}/jasper.jar" />
-            <zipfileset src="${tomcat2.lib.small}/tomcat-coyote-util.jar" />
+        <!-- actually from jetty9, not tomcat8... this will fail unless we have the jetty files also -->
+        <jar destfile="jettylib/jasper-runtime.jar" >
+          <!--
+            Jetty version
+            <zipfileset src="${jetty.base}/lib/jsp/javax.servlet.jsp-2.3.2.jar"/>
+            To be included in jasper-runtime.jar?
+            Server complains "NO JSP Support for /, did not find org.eclipse.jetty.jsp.JettyJspServlet" even with this included (but it still works).
+            The following file has the class, but /usr/share/java/jetty8-jsp.jar is empty
+            We don't use this one, because we want to be consistent with Debian builds that
+            must use Apache (aka libtomcat8).
+            <zipfileset excludes="about.html about_files about_files/* META-INF/ECLIPSEF.* META-INF/eclipse.inf plugin.properties" src="${jetty.base}/lib/jsp/jetty-jsp-${jetty.ver}.jar" />
+           -->
+            <!-- Apache version -->
+            <!-- Also includes javax.servlet.jsp.*, this is copied into javax.servlet.jar above -->
+            <zipfileset includes="org/**/*" src="${jetty.base}/lib/apache-jsp/org.mortbay.jasper.apache-jsp-8.0.33.jar"/>
+            <!-- required Jetty initializer (see RouterConsoleRunner) -->
+            <zipfileset src="${jetty.base}/lib/apache-jsp/org.eclipse.jetty.apache-jsp-${jetty.ver}.jar"/>
         </jar>
-<!--
-        <jar destfile="jettylib/javax.servlet.jar" duplicate="preserve" filesetmanifest="mergewithoutmain" >
-            <zipfileset excludes="META-INF/LICENSE META-INF/NOTICE" src="${tomcat.lib}/servlet-api.jar" />
-            <zipfileset excludes="META-INF/**/*" src="${tomcat.lib}/jsp-api.jar" />
-            <zipfileset excludes="META-INF/LICENSE META-INF/NOTICE" src="${tomcat.lib}/tomcat-api.jar" />
-            <zipfileset excludes="META-INF/LICENSE META-INF/NOTICE" src="${tomcat.lib}/tomcat-util.jar" />
-        </jar>
--->
-        <!-- Ant bug, don't set update and filesetmanifest or the update doesn't happen,
-             Their bug tracker claims fixed in 1.8.0 but broken for me in 1.8.1
-          -->
+
         <jar destfile="jettylib/commons-logging.jar" update="true" >
-            <zipfileset excludes="META-INF/LICENSE META-INF/NOTICE" src="${tomcat.lib}/tomcat-juli.jar" />
+            <manifest>
+                <attribute name="Note" value="Intentionally empty" />
+            </manifest>
         </jar>
     </target>
 
diff --git a/apps/jetty/java/src/net/i2p/jetty/I2PLogger.java b/apps/jetty/java/src/net/i2p/jetty/I2PLogger.java
index 28b0115611..1586963972 100644
--- a/apps/jetty/java/src/net/i2p/jetty/I2PLogger.java
+++ b/apps/jetty/java/src/net/i2p/jetty/I2PLogger.java
@@ -263,4 +263,11 @@ public class I2PLogger implements Logger
     public String getName() {
         return "net.i2p.jetty.I2PLogger";
     }
+
+    /**
+     *  @since Jetty 9
+     */
+    public void debug(String msg, long arg) {
+        debug(msg, Long.valueOf(arg), null);
+    }
 }
diff --git a/apps/jetty/java/src/net/i2p/jetty/I2PRequestLog.java b/apps/jetty/java/src/net/i2p/jetty/I2PRequestLog.java
index 222960780c..83c82b5919 100644
--- a/apps/jetty/java/src/net/i2p/jetty/I2PRequestLog.java
+++ b/apps/jetty/java/src/net/i2p/jetty/I2PRequestLog.java
@@ -24,7 +24,6 @@ import java.util.TimeZone;
 
 import javax.servlet.http.Cookie;
 
-import org.eclipse.jetty.http.HttpHeaders;
 import org.eclipse.jetty.http.PathMap;
 import org.eclipse.jetty.server.Request;
 import org.eclipse.jetty.server.RequestLog;
@@ -81,7 +80,7 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
     private transient OutputStream _out;
     private transient OutputStream _fileOut;
     private transient DateCache _logDateCache;
-    private transient PathMap _ignorePathMap;
+    private transient PathMap<String> _ignorePathMap;
     private transient Writer _writer;
     private transient ArrayList<Utf8StringBuilder> _buffers;
     private transient char[] _copy;
@@ -286,7 +285,7 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
                 String addr = null;
                 if (_preferProxiedForAddress) 
                 {
-                    addr = request.getHeader(HttpHeaders.X_FORWARDED_FOR);
+                    addr = request.getHeader("X-Forwarded-For");
                 }
 
                 if (addr == null) {
@@ -310,7 +309,9 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
                 if (_logDateCache!=null)
                     buf.append(_logDateCache.format(request.getTimeStamp()));
                 else
-                    buf.append(request.getTimeStampBuffer().toString());
+                    //buf.append(request.getTimeStampBuffer().toString());
+                    // TODO SimpleDateFormat or something
+                    buf.append(request.getTimeStamp());
                     
                 buf.append("] \"");
                 buf.append(request.getMethod());
@@ -358,7 +359,7 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
             {
                 synchronized(_writer)
                 {
-                    buf.append(StringUtil.__LINE_SEPARATOR);
+                    buf.append(System.getProperty("line.separator", "\n"));
                     int l=buf.length();
                     if (l>_copy.length)
                         l=_copy.length;  
@@ -412,7 +413,7 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
                         _writer.write(Long.toString(System.currentTimeMillis() - request.getTimeStamp()));
                     }
 
-                    _writer.write(StringUtil.__LINE_SEPARATOR);
+                    _writer.write(System.getProperty("line.separator", "\n"));
                     _writer.flush();
                 }
             }
@@ -429,7 +430,7 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
                                Response response, 
                                Writer writer) throws IOException 
     {
-        String referer = request.getHeader(HttpHeaders.REFERER);
+        String referer = request.getHeader("Referer");
         if (referer == null) 
             writer.write("\"-\" ");
         else 
@@ -439,7 +440,7 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
             writer.write("\" ");
         }
         
-        String agent = request.getHeader(HttpHeaders.USER_AGENT);
+        String agent = request.getHeader("User-Agent");
         if (agent == null)
             writer.write("\"-\" ");
         else
@@ -455,8 +456,7 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
     {
         if (_logDateFormat!=null)
         {       
-            _logDateCache = new DateCache(_logDateFormat, _logLocale);
-            _logDateCache.setTimeZoneID(_logTimeZone);
+            _logDateCache = new DateCache(_logDateFormat, _logLocale, _logTimeZone);
         }
         
         if (_filename != null) 
@@ -472,7 +472,7 @@ public class I2PRequestLog extends AbstractLifeCycle implements RequestLog
         
         if (_ignorePaths != null && _ignorePaths.length > 0)
         {
-            _ignorePathMap = new PathMap();
+            _ignorePathMap = new PathMap<String>();
             for (int i = 0; i < _ignorePaths.length; i++) 
                 _ignorePathMap.put(_ignorePaths[i], _ignorePaths[i]);
         }
diff --git a/apps/jetty/java/src/net/i2p/jetty/JettyStart.java b/apps/jetty/java/src/net/i2p/jetty/JettyStart.java
index 2c1b6c2553..f068a20c08 100644
--- a/apps/jetty/java/src/net/i2p/jetty/JettyStart.java
+++ b/apps/jetty/java/src/net/i2p/jetty/JettyStart.java
@@ -30,6 +30,7 @@ import net.i2p.util.I2PAppThread;
 import net.i2p.util.PortMapper;
 
 import org.eclipse.jetty.server.Connector;
+import org.eclipse.jetty.server.NetworkConnector;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.util.component.LifeCycle;
 import org.eclipse.jetty.util.resource.Resource;
@@ -130,13 +131,17 @@ public class JettyStart implements ClientApp {
                                 Server server = (Server) lc;
                                 Connector[] connectors = server.getConnectors();
                                 if (connectors.length > 0) {
-                                    int port = connectors[0].getPort();
-                                    if (port > 0) {
-                                        _port = port;
-                                        String host = connectors[0].getHost();
-                                        if (host.equals("0.0.0.0") || host.equals("::"))
-                                            host = "127.0.0.1";
-                                        _context.portMapper().register(PortMapper.SVC_EEPSITE, host, port);
+                                    Connector conn = connectors[0];
+                                    if (conn instanceof NetworkConnector) {
+                                        NetworkConnector nconn = (NetworkConnector) conn;
+                                        int port = nconn.getPort();
+                                        if (port > 0) {
+                                            _port = port;
+                                            String host = nconn.getHost();
+                                            if (host.equals("0.0.0.0") || host.equals("::"))
+                                                host = "127.0.0.1";
+                                            _context.portMapper().register(PortMapper.SVC_EEPSITE, host, port);
+                                        }
                                     }
                                 }
                             }
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-continuation-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-continuation-8.1.21.v20160908.jar
deleted file mode 100644
index ef8b5f4dc1..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-continuation-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-deploy-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-deploy-8.1.21.v20160908.jar
deleted file mode 100644
index 1df83b801a..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-deploy-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-http-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-http-8.1.21.v20160908.jar
deleted file mode 100644
index 6bbb4224c1..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-http-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-io-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-io-8.1.21.v20160908.jar
deleted file mode 100644
index 502691d379..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-io-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-jmx-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-jmx-8.1.21.v20160908.jar
deleted file mode 100644
index 9a5a030904..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-jmx-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-rewrite-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-rewrite-8.1.21.v20160908.jar
deleted file mode 100644
index a2a145408e..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-rewrite-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-security-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-security-8.1.21.v20160908.jar
deleted file mode 100644
index dcacc12ade..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-security-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-server-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-server-8.1.21.v20160908.jar
deleted file mode 100644
index 0a99f84974..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-server-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-servlet-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-servlet-8.1.21.v20160908.jar
deleted file mode 100644
index 1e563538c0..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-servlet-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-servlets-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-servlets-8.1.21.v20160908.jar
deleted file mode 100644
index 28e4fe6c27..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-servlets-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-util-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-util-8.1.21.v20160908.jar
deleted file mode 100644
index 646b23b0f1..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-util-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-webapp-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-webapp-8.1.21.v20160908.jar
deleted file mode 100644
index b8d340f32d..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-webapp-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-xml-8.1.21.v20160908.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-xml-8.1.21.v20160908.jar
deleted file mode 100644
index 1bedc9e62e..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jetty-xml-8.1.21.v20160908.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jsp/javax.servlet.jsp-2.2.0.v201112011158.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jsp/javax.servlet.jsp-2.2.0.v201112011158.jar
deleted file mode 100644
index dc2fbb0da8..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/jsp/javax.servlet.jsp-2.2.0.v201112011158.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/servlet-api-3.0.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/servlet-api-3.0.jar
deleted file mode 100644
index b135409682..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/lib/servlet-api-3.0.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-8.1.21.v20160908/start.jar b/apps/jetty/jetty-distribution-8.1.21.v20160908/start.jar
deleted file mode 100644
index 43442c4457..0000000000
Binary files a/apps/jetty/jetty-distribution-8.1.21.v20160908/start.jar and /dev/null differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.eclipse.jetty.apache-jsp-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.eclipse.jetty.apache-jsp-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..5a6cc108e4
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.eclipse.jetty.apache-jsp-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.mortbay.jasper.apache-el-8.0.33.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.mortbay.jasper.apache-el-8.0.33.jar
new file mode 100644
index 0000000000..32a98131e3
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.mortbay.jasper.apache-el-8.0.33.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.mortbay.jasper.apache-jsp-8.0.33.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.mortbay.jasper.apache-jsp-8.0.33.jar
new file mode 100644
index 0000000000..3577b5a06d
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/apache-jsp/org.mortbay.jasper.apache-jsp-8.0.33.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-continuation-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-continuation-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..4aac6404c3
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-continuation-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-deploy-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-deploy-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..d535a6b2eb
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-deploy-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-http-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-http-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..5079527347
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-http-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-io-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-io-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..5eafefc7c7
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-io-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-jmx-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-jmx-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..5f11c2fd46
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-jmx-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-rewrite-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-rewrite-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..ea2adc1f8b
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-rewrite-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-schemas-3.1.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-schemas-3.1.jar
new file mode 100644
index 0000000000..7166da3f8c
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-schemas-3.1.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-security-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-security-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..f54d07c38a
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-security-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-server-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-server-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..8a4c5fad45
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-server-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-servlet-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-servlet-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..4fd13be325
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-servlet-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-servlets-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-servlets-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..c11519c1a4
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-servlets-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-util-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-util-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..edf6b9bea1
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-util-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-webapp-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-webapp-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..a7f7dcd761
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-webapp-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-xml-9.2.21.v20170120.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-xml-9.2.21.v20170120.jar
new file mode 100644
index 0000000000..f82eba9cf7
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/jetty-xml-9.2.21.v20170120.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/servlet-api-3.1.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/servlet-api-3.1.jar
new file mode 100644
index 0000000000..6b14c3d267
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/lib/servlet-api-3.1.jar differ
diff --git a/apps/jetty/jetty-distribution-9.2.21.v20170120/start.jar b/apps/jetty/jetty-distribution-9.2.21.v20170120/start.jar
new file mode 100644
index 0000000000..4dc45c3b98
Binary files /dev/null and b/apps/jetty/jetty-distribution-9.2.21.v20170120/start.jar differ
diff --git a/apps/routerconsole/java/build.xml b/apps/routerconsole/java/build.xml
index 56c399b987..fe6e9ed1b4 100644
--- a/apps/routerconsole/java/build.xml
+++ b/apps/routerconsole/java/build.xml
@@ -70,11 +70,15 @@
                 <pathelement location="../../jetty/jettylib/jetty-util.jar" />
                 <pathelement location="../../jetty/jettylib/jetty-webapp.jar" />
                 <pathelement location="../../jetty/jettylib/javax.servlet.jar" />
+                <pathelement location="../../jetty/jettylib/jasper-runtime.jar" />
                 <pathelement location="../../jetty/jettylib/jetty-i2p.jar" />
                 <pathelement location="../../systray/java/build/systray.jar" />
                 <pathelement location="../../desktopgui/dist/desktopgui.jar" />
                 <pathelement location="../../../installer/lib/wrapper/all/wrapper.jar" />
                 <pathelement location="../../jrobin/java/build/jrobin.jar" />
+
+                <!-- following jars only present for debian builds -->
+                <pathelement location="../../jetty/jettylib/tomcat-api.jar" />
             </classpath>
         </javac>
     </target>
@@ -365,14 +369,17 @@
             <classpath>
                 <pathelement location="../../jetty/jettylib/jasper-runtime.jar" />
                 <pathelement location="../../jetty/jettylib/javax.servlet.jar" />
-                <!-- jsp-api.jar only present for debian builds -->
+
+                <!-- following jars only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/jsp-api.jar" />
-                <!-- tomcat-api.jar only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/tomcat-api.jar" />
-                <!-- jasper-el.jar only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/jasper-el.jar" />
+                <pathelement location="../../jetty/jettylib/tomcat-util.jar" />
+                <pathelement location="../../jetty/jettylib/tomcat-util-scan.jar" />
+
                 <pathelement location="../../jetty/jettylib/commons-logging.jar" />
                 <pathelement location="../../jetty/jettylib/commons-el.jar" />
+                <pathelement location="../../jetty/jettylib/jetty-util.jar" />
                 <pathelement location="${ant.home}/lib/ant.jar" />
                 <pathelement location="../../jetty/jettylib/jetty-i2p.jar" />
                 <pathelement location="../../systray/java/build/obj" />
@@ -403,10 +410,13 @@
             <classpath>
                 <pathelement location="../../jetty/jettylib/jasper-runtime.jar" />
                 <pathelement location="../../jetty/jettylib/javax.servlet.jar" />
-                <!-- jsp-api.jar only present for debian builds -->
+
+                <!-- following jars only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/jsp-api.jar" />
-                <!-- tomcat-api.jar only present for debian builds -->
                 <pathelement location="../../jetty/jettylib/tomcat-api.jar" />
+                <pathelement location="../../jetty/jettylib/tomcat-util.jar" />
+                <pathelement location="../../jetty/jettylib/tomcat-util-scan.jar" />
+
                 <pathelement location="../../jetty/jettylib/commons-logging.jar" />
                 <pathelement location="../../jetty/jettylib/commons-el.jar" />
                 <pathelement location="../../jetty/jettylib/org.mortbay.jetty.jar" />
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/RouterConsoleRunner.java b/apps/routerconsole/java/src/net/i2p/router/web/RouterConsoleRunner.java
index 888ccb131d..b2381344b4 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/RouterConsoleRunner.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/RouterConsoleRunner.java
@@ -46,19 +46,21 @@ import org.eclipse.jetty.security.ConstraintMapping;
 import org.eclipse.jetty.security.ConstraintSecurityHandler;
 import org.eclipse.jetty.security.authentication.DigestAuthenticator;
 import org.eclipse.jetty.server.AbstractConnector;
+import org.eclipse.jetty.server.ConnectionFactory;
 import org.eclipse.jetty.server.Connector;
+import org.eclipse.jetty.server.HttpConfiguration;
+import org.eclipse.jetty.server.HttpConnectionFactory;
 import org.eclipse.jetty.server.NCSARequestLog;
+import org.eclipse.jetty.server.SecureRequestCustomizer;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.UserIdentity;
-import org.eclipse.jetty.server.bio.SocketConnector;
+import org.eclipse.jetty.server.ServerConnector;
+import org.eclipse.jetty.server.SslConnectionFactory;
 import org.eclipse.jetty.server.handler.ContextHandlerCollection;
 import org.eclipse.jetty.server.handler.DefaultHandler;
 import org.eclipse.jetty.server.handler.HandlerCollection;
 import org.eclipse.jetty.server.handler.HandlerWrapper;
 import org.eclipse.jetty.server.handler.RequestLogHandler;
-import org.eclipse.jetty.server.nio.SelectChannelConnector;
-import org.eclipse.jetty.server.ssl.SslSocketConnector;
-import org.eclipse.jetty.server.ssl.SslSelectChannelConnector;
 import org.eclipse.jetty.servlet.ServletHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
 import org.eclipse.jetty.webapp.WebAppContext;
@@ -363,6 +365,22 @@ public class RouterConsoleRunner implements RouterApp {
      *			DefaultHandler
      *			RequestLogHandler (opt)
      *</pre>
+     *
+     *  Porting to Jetty 9:
+     *
+     *  http://dev.eclipse.org/mhonarc/lists/jetty-dev/msg01952.html
+     *  You are missing a few facts about Jetty 9.1 ...
+     *  First, there are no longer any blocking connectors.
+     *  Its all async / nio connectors now. (mainly because that's the direction that the servlet api 3.1 is taking)
+     *
+     *  Next, there is only 1 connector.   The ServerConnector.
+     *  However, it takes 1 or more ConnectionFactory implementations to know how to handle the incoming connection.
+     *  We have factories for HTTP (0.9 thru 1.1), SPDY, SSL-http, and SSL-npn so far.
+     *  This list of factories will expand as the future of connectivity to web servers is ever growing (think HTTP/2)
+     *
+     *  Use the embedded examples for help understanding this.
+     *  http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git/tree/examples/embedded/src/main/java/org/eclipse/jetty/embedded/ManyConnectors.java?id=jetty-9.1.0.RC0
+     *
      */
     public void startConsole() {
         File workDir = new SecureDirectory(_context.getTempDir(), "jetty-work");
@@ -375,8 +393,9 @@ public class RouterConsoleRunner implements RouterApp {
 
         // so Jetty can find WebAppConfiguration
         System.setProperty("jetty.class.path", _context.getBaseDir() + "/lib/routerconsole.jar");
-        _server = new Server();
-        _server.setGracefulShutdown(1000);
+        // FIXME
+        // http://dev.eclipse.org/mhonarc/lists/jetty-users/msg03487.html
+        //_server.setGracefulShutdown(1000);
 
         // In Jetty 6, QTP was not concurrent, so we switched to
         // ThreadPoolExecutor with a fixed-size queue, a set maxThreads,
@@ -408,14 +427,11 @@ public class RouterConsoleRunner implements RouterApp {
             // class not found...
             //System.out.println("INFO: Jetty concurrent ThreadPool unavailable, using QueuedThreadPool");
             LinkedBlockingQueue<Runnable> lbq = new LinkedBlockingQueue<Runnable>(4*MAX_THREADS);
-            QueuedThreadPool qtp = new QueuedThreadPool(lbq);
-            // min and max threads will be set below
-            //qtp.setMinThreads(MIN_THREADS);
-            //qtp.setMaxThreads(MAX_THREADS);
-            qtp.setMaxIdleTimeMs(MAX_IDLE_TIME);
+            // min and max threads will be reset below
+            QueuedThreadPool qtp = new QueuedThreadPool(MAX_THREADS, MIN_THREADS, MAX_IDLE_TIME, lbq);
             qtp.setName(THREAD_NAME);
             qtp.setDaemon(true);
-            _server.setThreadPool(qtp);
+            _server = new Server(qtp);
         //}
 
         HandlerCollection hColl = new HandlerCollection();
@@ -502,27 +518,15 @@ public class RouterConsoleRunner implements RouterApp {
                         } finally {
                             if (testSock != null) try { testSock.close(); } catch (IOException ioe) {}
                         }
-                        //if (host.indexOf(":") >= 0) // IPV6 - requires patched Jetty 5
-                        //    _server.addListener('[' + host + "]:" + _listenPort);
-                        //else
-                        //    _server.addListener(host + ':' + _listenPort);
-                        AbstractConnector lsnr;
-                        if (SystemVersion.isJava6() && !SystemVersion.isGNU()) {
-                            SelectChannelConnector slsnr = new SelectChannelConnector();
-                            slsnr.setUseDirectBuffers(false);  // default true seems to be leaky
-                            lsnr = slsnr;
-                        } else {
-                            // Jetty 6 and NIO on Java 5 don't get along that well
-                            // Also: http://jira.codehaus.org/browse/JETTY-1238
-                            // "Do not use GCJ with Jetty, it will not work."
-                            // Actually it does if you don't use NIO
-                            lsnr = new SocketConnector();
-                        }
+                        HttpConfiguration httpConfig = new HttpConfiguration();
+                        // number of acceptors, (default) number of selectors
+                        ServerConnector lsnr = new ServerConnector(_server, 1, 0,
+                                                                   new HttpConnectionFactory(httpConfig));
+                        //lsnr.setUseDirectBuffers(false);  // default true seems to be leaky
                         lsnr.setHost(host);
                         lsnr.setPort(lport);
-                        lsnr.setMaxIdleTime(90*1000);  // default 10 sec
+                        lsnr.setIdleTimeout(90*1000);  // default 10 sec
                         lsnr.setName("ConsoleSocket");   // all with same name will use the same thread pool
-                        lsnr.setAcceptors(1);          // default changed to 2 somewhere in Jetty 7?
                         //_server.addConnector(lsnr);
                         connectors.add(lsnr);
                         boundAddresses++;
@@ -586,22 +590,19 @@ public class RouterConsoleRunner implements RouterApp {
                             } finally {
                                 if (testSock != null) try { testSock.close(); } catch (IOException ioe) {}
                             }
-                            // TODO if class not found use SslChannelConnector
-                            AbstractConnector ssll;
-                            if (SystemVersion.isJava6() && !SystemVersion.isGNU()) {
-                                SslSelectChannelConnector sssll = new SslSelectChannelConnector(sslFactory);
-                                sssll.setUseDirectBuffers(false);  // default true seems to be leaky
-                                ssll = sssll;
-                            } else {
-                                // Jetty 6 and NIO on Java 5 don't get along that well
-                                SslSocketConnector sssll = new SslSocketConnector(sslFactory);
-                                ssll = sssll;
-                            }
+                            HttpConfiguration httpConfig = new HttpConfiguration();
+                            httpConfig.setSecureScheme("https");
+                            httpConfig.setSecurePort(sslPort);
+                            httpConfig.addCustomizer(new SecureRequestCustomizer());
+                            // number of acceptors, (default) number of selectors
+                            ServerConnector ssll = new ServerConnector(_server, 1, 0,
+                                                                       new SslConnectionFactory(sslFactory, "http/1.1"),
+                                                                       new HttpConnectionFactory(httpConfig));
+                            //sssll.setUseDirectBuffers(false);  // default true seems to be leaky
                             ssll.setHost(host);
                             ssll.setPort(sslPort);
-                            ssll.setMaxIdleTime(90*1000);  // default 10 sec
+                            ssll.setIdleTimeout(90*1000);  // default 10 sec
                             ssll.setName("ConsoleSocket");   // all with same name will use the same thread pool
-                            ssll.setAcceptors(1);          // default changed to 2 somewhere in Jetty 7?
                             //_server.addConnector(ssll);
                             connectors.add(ssll);
                             boundAddresses++;
@@ -638,17 +639,25 @@ public class RouterConsoleRunner implements RouterApp {
             File tmpdir = new SecureDirectory(workDir, ROUTERCONSOLE + "-" +
                                                        (_listenPort != null ? _listenPort : _sslListenPort));
             tmpdir.mkdir();
-            if (!SystemVersion.isWindows() && !SystemVersion.isMac() &&
-                _context.getBaseDir().getAbsolutePath().equals("/usr/share/i2p")) {
-               // We are using Tomcat 6, so the Debian patch doesn't apply.
-               // Remove when we switch to Tomcat 8
-               _context.logManager().getLog(Server.class).logAlways(net.i2p.util.Log.INFO, "Please ignore any InstanceManager warnings");
-            }
             rootServletHandler = new ServletHandler();
             rootWebApp = new LocaleWebAppHandler(_context,
                                                   "/", _webAppsDir + ROUTERCONSOLE + ".war",
                                                  tmpdir, rootServletHandler);
-            initialize(_context, (WebAppContext)(rootWebApp.getHandler()));
+            try {
+                // Not sure who is supposed to call this, but unless we do,
+                // all the jsps die NPE, because JspFactory.getDefaultContext() returns null.
+                // We probably have to do this because we don't bundle the Jetty annotations jar and scanner.
+                // This is only with Tomcat 8, not with the Jetty (Eclipse) jsp impl.
+                // Got a clue from this ancient post for Tomcat 6:
+                // https://bz.apache.org/bugzilla/show_bug.cgi?id=39804
+                // see also apps/jetty/build.xml
+                Class.forName("org.eclipse.jetty.apache.jsp.JettyJasperInitializer");
+            } catch (ClassNotFoundException cnfe) {
+                System.err.println("Warning: JettyJasperInitializer not found");
+            }
+            WebAppContext wac = (WebAppContext)(rootWebApp.getHandler());
+            initialize(_context, wac);
+            WebAppStarter.setWebAppConfiguration(wac);
             chColl.addHandler(rootWebApp);
 
         } catch (Exception ioe) {
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/WebAppConfiguration.java b/apps/routerconsole/java/src/net/i2p/router/web/WebAppConfiguration.java
index 3e2eb9ecc6..57a2ee7dfd 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/WebAppConfiguration.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/WebAppConfiguration.java
@@ -15,6 +15,7 @@ import java.util.StringTokenizer;
 
 import net.i2p.I2PAppContext;
 
+import org.apache.tomcat.SimpleInstanceManager;
 import org.eclipse.jetty.webapp.Configuration;
 import org.eclipse.jetty.webapp.WebAppClassLoader;
 import org.eclipse.jetty.webapp.WebAppContext;
@@ -191,6 +192,10 @@ public class WebAppConfiguration implements Configuration {
     /** @since Jetty 7 */
     public void configure(WebAppContext context) throws Exception {
         configureClassPath(context);
+        // do we just need one, in the ContextHandlerCollection, or one for each?
+        // http://stackoverflow.com/questions/17529936/issues-while-using-jetty-embedded-to-handle-jsp-jasperexception-unable-to-com
+        // https://github.com/jetty-project/embedded-jetty-jsp/blob/master/src/main/java/org/eclipse/jetty/demo/Main.java
+        context.getServletContext().setAttribute("org.apache.tomcat.InstanceManager", new SimpleInstanceManager());
     }
 
     /** @since Jetty 7 */
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/WebAppStarter.java b/apps/routerconsole/java/src/net/i2p/router/web/WebAppStarter.java
index 70a86a89b4..884a88cbcc 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/WebAppStarter.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/WebAppStarter.java
@@ -109,17 +109,30 @@ public class WebAppStarter {
 
         // this does the passwords...
         RouterConsoleRunner.initialize(ctx, wac);
+        setWebAppConfiguration(wac);
+        server.addHandler(wac);
+        server.mapContexts();
+        return wac;
+    }
 
+    /**
+     *  @since Jetty 9
+     */
+    static void setWebAppConfiguration(WebAppContext wac) {
         // see WebAppConfiguration for info
         String[] classNames = wac.getConfigurationClasses();
+        // In Jetty 9, it doesn't set the defaults if we've already added one, but the
+        // defaults aren't set yet when we call the above. So we have to get the defaults.
+        // Without the default configuration, the web.xml isn't read, and the webapp
+        // won't respond to any requests, even though it appears to be running.
+        // See WebAppContext.loadConfigurations() in source
+        if (classNames.length == 0)
+            classNames = wac.getDefaultConfigurationClasses();
         String[] newClassNames = new String[classNames.length + 1];
         for (int j = 0; j < classNames.length; j++)
              newClassNames[j] = classNames[j];
         newClassNames[classNames.length] = WebAppConfiguration.class.getName();
         wac.setConfigurationClasses(newClassNames);
-        server.addHandler(wac);
-        server.mapContexts();
-        return wac;
     }
 
     /**
diff --git a/apps/routerconsole/jsp/viewstat.jsp b/apps/routerconsole/jsp/viewstat.jsp
index ce44c5cb79..2d17dedc75 100644
--- a/apps/routerconsole/jsp/viewstat.jsp
+++ b/apps/routerconsole/jsp/viewstat.jsp
@@ -61,13 +61,13 @@ if ( !rendered && ((rs != null) || fakeBw) ) {
         if (str != null) try { periodCount = Integer.parseInt(str); } catch (NumberFormatException nfe) {}
         str = request.getParameter("end");
         if (str != null) try { end = Integer.parseInt(str); } catch (NumberFormatException nfe) {}
-        boolean hideLegend = Boolean.parseBoolean((String) request.getParameter("hideLegend"));
-        boolean hideGrid = Boolean.parseBoolean((String) request.getParameter("hideGrid"));
-        boolean hideTitle = Boolean.parseBoolean((String) request.getParameter("hideTitle"));
-        boolean showEvents = Boolean.parseBoolean((String) request.getParameter("showEvents"));
+        boolean hideLegend = Boolean.parseBoolean(request.getParameter("hideLegend"));
+        boolean hideGrid = Boolean.parseBoolean(request.getParameter("hideGrid"));
+        boolean hideTitle = Boolean.parseBoolean(request.getParameter("hideTitle"));
+        boolean showEvents = Boolean.parseBoolean(request.getParameter("showEvents"));
         boolean showCredit = false;
         if (request.getParameter("showCredit") != null)
-          showCredit = Boolean.parseBoolean((String) request.getParameter("showCredit"));
+          showCredit = Boolean.parseBoolean(request.getParameter("showCredit"));
         if (fakeBw)
             rendered = net.i2p.router.web.StatSummarizer.instance().renderRatePng(cout, width, height, hideLegend, hideGrid, hideTitle, showEvents, periodCount, end, showCredit);
         else
diff --git a/apps/susidns/src/build.xml b/apps/susidns/src/build.xml
index ac9a6f63aa..06582c7769 100644
--- a/apps/susidns/src/build.xml
+++ b/apps/susidns/src/build.xml
@@ -16,18 +16,19 @@
                   -->
 		<pathelement location="${lib}/commons-el.jar" />
 		<pathelement location="${lib}/javax.servlet.jar"/>
-                <!-- jsp-api.jar only present for debian builds -->
+
+                <!-- following jars only present for debian builds -->
                 <pathelement location="${lib}/jsp-api.jar" />
-                <!-- tomcat-api.jar only present for debian builds -->
                 <pathelement location="${lib}/tomcat-api.jar" />
-                <!-- tomcat-util.jar only present for debian builds -->
                 <pathelement location="${lib}/tomcat-util.jar" />
+                <pathelement location="${lib}/tomcat-util-scan.jar" />
+		<pathelement location="${lib}/jasper-el.jar" />
+
 		<pathelement location="lib/jstl.jar" />
 		<pathelement location="lib/standard.jar" />
 		<pathelement location="${lib}/jasper-runtime.jar" />
 		<pathelement location="${lib}/commons-logging.jar" />
-                <!-- jasper-el.jar only present for debian builds -->
-		<pathelement location="${lib}/jasper-el.jar" />
+		<pathelement location="${lib}/jetty-util.jar" />
 		<pathelement location="${ant.home}/lib/ant.jar" />
 		<pathelement location="../../../core/java/build/i2p.jar" />
  	</path>
diff --git a/build.properties b/build.properties
index 8aa9bb3275..9545420895 100644
--- a/build.properties
+++ b/build.properties
@@ -131,12 +131,8 @@ javac.version=1.7
 ### Debian/Ubuntu packages ###
 # Don't include geoip files, we will use geoip-database package
 #with-geoip-database=true
-# Don't include jetty files, we will use libjetty8-java package
-#with-libjetty8-java=true
-# Don't include tomcat files, we will use libtomcat6-java package
-#with-libtomcat6-java=true
-# Don't include tomcat files, we will use libtomcat7-java package
-#with-libtomcat7-java=true
+# Don't include jetty files, we will use libjetty9-java package. Requires with-libtomcat8-java=true.
+#with-libjetty9-java=true
 # Don't include tomcat files, we will use libtomcat8-java package
 #with-libtomcat8-java=true
 # Don't include jstl.jar and standard.jar, we will use glassfish-javaee package
diff --git a/build.xml b/build.xml
index 2b5f482c7e..ccbec260e5 100644
--- a/build.xml
+++ b/build.xml
@@ -70,8 +70,8 @@
             <echo message="The following command will install the build dependencies for you:" />
             <echo message=" " />
             <echo message="sudo apt-get install debhelper ant debconf default-jdk gettext libgmp-dev po-debconf fakeroot \" />
-            <echo message="  build-essential quilt libcommons-logging-java dh-apparmor dh-systemd libservice-wrapper-java \"  />
-            <echo message="  devscripts libjetty8-java glassfish-javaee"  />
+            <echo message="  build-essential quilt dh-apparmor dh-systemd libservice-wrapper-java \"  />
+            <echo message="  devscripts libjetty9-java libtomcat8-java glassfish-javaee libgetopt-java"  />
             <echo message=" " />
             <echo message="The following command will install the additional runtime dependencies:" />
             <echo message="sudo apt-get install libecj-java geoip-database" />
@@ -1242,7 +1242,7 @@
         <copy file="build/jetty-i2p.jar" todir="pkg-temp/lib" />
     </target>
 
-    <target name="copyjetty-unlesspkg" unless="${with-libjetty8-java}" >
+    <target name="copyjetty-unlesspkg" unless="${with-libjetty9-java}" >
         <copy todir="pkg-temp/lib" >
             <fileset dir="build" includes="javax.servlet.jar jetty*.jar org.mortbay.*.jar" excludes="jetty-i2p.jar" />
         </copy>
@@ -1289,7 +1289,9 @@
     </target>
 
     <target name="preplicenses-unlesspkg" depends="settomcatprop" unless="${with-libtomcat-java}" >
+<!--  replacement?
         <copy file="apps/jetty/apache-tomcat-deployer/NOTICE" tofile="pkg-temp/licenses/NOTICE-Tomcat.txt" />
+-->
     </target>
 
     <!-- DOES include launch4j licenses for Windows builds -->
@@ -1462,11 +1464,11 @@
         <!-- *nix here -->
         <exec executable="sh" osfamily="unix" failonerror="true">
             <arg value="-c" />
-            <arg value="for i in pkg-temp/lib/*.jar pkg-temp/webapps/*war; do if [ $i = pkg-temp/lib/jasper-compiler.jar -o $i = pkg-temp/lib/jbigi.jar -o $i = pkg-temp/lib/jetty-java5-threadpool.jar -o $i = pkg-temp/lib/jetty-sslengine.jar ]; then continue; fi; echo pack200 $i; mv $i $i.jar; pack200 -g $i.pack $i.jar; rm -f $i.jar; done" />
+            <arg value="for i in pkg-temp/lib/*.jar pkg-temp/webapps/*war; do if [ $i = pkg-temp/lib/commons-logging.jar -o $i = pkg-temp/lib/jasper-compiler.jar -o $i = pkg-temp/lib/jbigi.jar -o $i = pkg-temp/lib/jetty-java5-threadpool.jar -o $i = pkg-temp/lib/jetty-sslengine.jar ]; then continue; fi; echo pack200 $i; mv $i $i.jar; pack200 -g $i.pack $i.jar; rm -f $i.jar; done" />
         </exec>
         <exec executable="sh" osfamily="mac" failonerror="true">
             <arg value="-c" />
-            <arg value="for i in pkg-temp/lib/*.jar pkg-temp/webapps/*war; do if [ $i = pkg-temp/lib/jasper-compiler.jar -o $i = pkg-temp/lib/jbigi.jar -o $i = pkg-temp/lib/jetty-java5-threadpool.jar -o $i = pkg-temp/lib/jetty-sslengine.jar ]; then continue; fi; echo pack200 $i; mv $i $i.jar; pack200 -g $i.pack $i.jar; rm -f $i.jar; done" />
+            <arg value="for i in pkg-temp/lib/*.jar pkg-temp/webapps/*war; do if [ $i = pkg-temp/lib/commons-logging.jar -o $i = pkg-temp/lib/jasper-compiler.jar -o $i = pkg-temp/lib/jbigi.jar -o $i = pkg-temp/lib/jetty-java5-threadpool.jar -o $i = pkg-temp/lib/jetty-sslengine.jar ]; then continue; fi; echo pack200 $i; mv $i $i.jar; pack200 -g $i.pack $i.jar; rm -f $i.jar; done" />
         </exec>
         <!-- windoz here : i admit, i hate escaped symbols in xml, indeed = =! -->
         <exec executable="cmd" osfamily="windows" failonerror="true">
@@ -1595,13 +1597,13 @@
         <!--  We have to package the new eepsite files for MigrateJetty.java, but we
               can't overwrite an existing eepsite dir in a non-split configuration.
           -->
-        <copy todir="pkg-temp/eepsite-jetty7" >
+        <copy todir="pkg-temp/eepsite-jetty9" >
             <fileset dir="installer/resources/eepsite" includes="*.xml contexts/* etc/*" />
         </copy>
     </target>
 
     <target name="delete-j6-update">
-        <delete dir="pkg-temp/eepsite-jetty7" />
+        <delete dir="pkg-temp/eepsite-jetty9" />
     </target>
 
     <!-- Jetty 6 I2P logging addons, not really fixes -->
@@ -2204,7 +2206,7 @@
             <arg value="w:" />
             <arg value="../i2p-${Extended.Version}" />
         </exec>
-        <delete includeemptydirs="true" quiet="false">
+        <delete includeemptydirs="true" quiet="false" failonerror="false">
             <fileset dir="../i2p-${Extended.Version}/debian-alt/" />
             <fileset dir="../i2p-${Extended.Version}/installer/lib/" />
             <fileset dir="../i2p-${Extended.Version}/Slackware" />
@@ -2220,19 +2222,14 @@
             <!-- geoip-database -->
             <file name="../i2p-${Extended.Version}/installer/resources/geoip.txt" />
             <file name="../i2p-${Extended.Version}/installer/resources/geoipv6.dat.gz" />
-            <!-- libjetty8-java -->
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/jetty-distribution-8.1.21.v20160908" />
+            <!-- libjetty9-java -->
+            <fileset dir="../i2p-${Extended.Version}/apps/jetty/jetty-distribution-9.2.21.v20170120" />
             <!-- libjstl1.1-java or glassfish-javaee -->
           <!--
             <file name="../i2p-${Extended.Version}/apps/susidns/src/lib/jstl.jar" />
            -->
             <!-- libjakarta-taglibs-standard-java or glassfish-javaee -->
             <file name="../i2p-${Extended.Version}/apps/susidns/src/lib/standard.jar" />
-            <!-- libtomcat6-java or libtomcat7-java -->
-          <!--
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/apache-tomcat" />
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/apache-tomcat-deployer/" />
-           -->
             <!-- anything added above, add in debian-release-tarball also -->
         </delete>
         <tar longfile="gnu" destfile="../${debian.tarball.name}" compression="bzip2">
@@ -2248,10 +2245,6 @@
                 <exclude name="apps/susidns/src/lib/jstl.jar" />
            -->
                 <exclude name="apps/susidns/src/lib/standard.jar" />
-          <!--
-                <exclude name="apps/jetty/apache-tomcat/**"/>
-                <exclude name="apps/jetty/apache-tomcat-deployer/**"/>
-           -->
                 <!-- anything added above, add in debian-release-tarball also -->
             </tarfileset>
             <tarfileset dir="../i2p-${Extended.Version}" prefix="/i2p-${Extended.Version}" filemode="755">
@@ -2286,7 +2279,7 @@
             <arg value="i2p.i2p" />
             <arg value="../i2p-${Extended.Version}" />
         </exec>
-        <delete includeemptydirs="true" quiet="false">
+        <delete includeemptydirs="true" quiet="false" failonerror="false">
             <fileset dir="../i2p-${Extended.Version}/debian-alt/" />
             <fileset dir="../i2p-${Extended.Version}/installer/lib/" />
             <fileset dir="../i2p-${Extended.Version}/Slackware" />
@@ -2302,9 +2295,9 @@
             <!-- geoip-database -->
             <file name="../i2p-${Extended.Version}/installer/resources/geoip.txt" />
             <file name="../i2p-${Extended.Version}/installer/resources/geoipv6.dat.gz" />
-            <!-- libjetty8-java -->
+            <!-- libjetty9-java -->
           <!--
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/jetty-distribution-8.1.21.v20160908" />
+            <fileset dir="../i2p-${Extended.Version}/apps/jetty/jetty-distribution-9.2.21.v20170120" />
            -->
             <!-- libjstl1.1-java or glassfish-javaee -->
           <!--
@@ -2312,11 +2305,6 @@
            -->
             <!-- libjakarta-taglibs-standard-java or glassfish-javaee -->
             <file name="../i2p-${Extended.Version}/apps/susidns/src/lib/standard.jar" />
-            <!-- libtomcat6-java or libtomcat7-java -->
-          <!--
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/apache-tomcat" />
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/apache-tomcat-deployer/" />
-           -->
             <!-- anything added above, add in debian-release-tarball also -->
         </delete>
         <tar longfile="gnu" destfile="../${debian.tarball.name}" compression="bzip2">
@@ -2334,10 +2322,6 @@
                 <exclude name="apps/susidns/src/lib/jstl.jar" />
            -->
                 <exclude name="apps/susidns/src/lib/standard.jar" />
-          <!--
-                <exclude name="apps/jetty/apache-tomcat/**"/>
-                <exclude name="apps/jetty/apache-tomcat-deployer/**"/>
-           -->
                 <!-- anything added above, add in debian-release-tarball also -->
             </tarfileset>
             <tarfileset dir="../i2p-${Extended.Version}" prefix="/i2p-${Extended.Version}" filemode="755">
@@ -2369,7 +2353,7 @@
             <arg value="i2p.i2p" />
             <arg value="../i2p-${Extended.Version}" />
         </exec>
-        <delete includeemptydirs="true" quiet="false">
+        <delete includeemptydirs="true" quiet="false" failonerror="false">ilonerror="false">
             <fileset dir="../i2p-${Extended.Version}/debian-alt/" />
             <fileset dir="../i2p-${Extended.Version}/installer/lib/" />
             <fileset dir="../i2p-${Extended.Version}/Slackware" />
@@ -2381,15 +2365,11 @@
            -->
             <file name="../i2p-${Extended.Version}/installer/resources/geoip.txt" />
             <file name="../i2p-${Extended.Version}/installer/resources/geoipv6.dat.gz" />
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/jetty-distribution-8.1.21.v20160908" />
+            <fileset dir="../i2p-${Extended.Version}/apps/jetty/jetty-distribution-9.2.21.v20170120" />
           <!--
             <file name="../i2p-${Extended.Version}/apps/susidns/src/lib/jstl.jar" />
            -->
             <file name="../i2p-${Extended.Version}/apps/susidns/src/lib/standard.jar" />
-          <!--
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/apache-tomcat" />
-            <fileset dir="../i2p-${Extended.Version}/apps/jetty/apache-tomcat-deployer/" />
-           -->
             <!-- anything added above, add in debian-tarball also -->
         </delete>
         <tar longfile="gnu" destfile="../${debian.tarball.name}" compression="bzip2">
@@ -2405,10 +2385,6 @@
                 <exclude name="apps/susidns/src/lib/jstl.jar" />
            -->
                 <exclude name="apps/susidns/src/lib/standard.jar" />
-          <!--
-                <exclude name="apps/jetty/apache-tomcat/**"/>
-                <exclude name="apps/jetty/apache-tomcat-deployer/**"/>
-           -->
                 <!-- anything added above, add in debian-tarball also -->
             </tarfileset>
             <tarfileset dir="../i2p-${Extended.Version}" prefix="/i2p-${release.number}" filemode="755">
diff --git a/debian-alt/README.txt b/debian-alt/README.txt
index 9bc53dd6d6..4a2c538827 100644
--- a/debian-alt/README.txt
+++ b/debian-alt/README.txt
@@ -1,7 +1,13 @@
-The files in ../debian/ are for jessie/stable.
-Alternates are in the subdirectories here.
+The files in ../debian/ are for stretch.
+You may also use them for jessie if you have libjetty9-java from jessie-backports.
 
-trusty may be copied to utopic, vivid, wily, xenial.
+Alternates are in the subdirectories here.
+To use them, copy them over the files in ../debian/  .
+
+Built file compatibility:
+trusty may be copied to vivid.
+trusty may be used for jessie without libjetty9-java from backports.
+xenial may be copied to yakkety, zesty.
 
 tails-jessie and tails-wheezy are currently the same as
 jessie and wheezy, respectively. If they diverge, put the changes here.
diff --git a/debian-alt/doc/dependencies.txt b/debian-alt/doc/dependencies.txt
index 23ea68a242..05fb581f4d 100644
--- a/debian-alt/doc/dependencies.txt
+++ b/debian-alt/doc/dependencies.txt
@@ -41,8 +41,8 @@ Current Runtime Dependencies
   For /usr/share/java/gnu-getopt.jar.
   In non-Debian builds we bundle the source code; it's removed in the Debian source package.
 
-* libjetty8-java
-  For /usr/share/java/jetty8-*.jar.
+* libjetty9-java
+  For /usr/share/java/jetty9-*.jar.
   In non-Debian builds we bundle the jars; it's removed in the Debian source package.
   For some Debian and Ubuntu releases, these seem to be much older than what we're bundling,
   which is 8.1.21, but there's no particular version that we need.
@@ -52,7 +52,7 @@ Current Runtime Dependencies
   Jetty 9.2.x is in recent Ubuntu and Debian.
   Jetty 9 ticket is https://trac.i2p2.de/ticket/1512
   Updating Jetty may break external plugins. Extensive testing is required.
-  Note that the libjetty8-java dependency brings in libservlet3.0-java which we require.
+  Note that the libjetty9-java dependency brings in libservlet3.0-java which we require.
 
 * glassfish-javaee
   We need jstl.jar and standard.jar version 1.2.
diff --git a/debian-alt/jessie/README.txt b/debian-alt/jessie/README.txt
new file mode 100644
index 0000000000..eb5df37927
--- /dev/null
+++ b/debian-alt/jessie/README.txt
@@ -0,0 +1,4 @@
+If you have libjetty9-java from jessie-backports: use the stretch files in ../../debian.
+
+If you do not have libjetty9-java from jessie-backports: use the trusty files in ../trusty,
+or use the files here to depend on libtomcat8-java.
diff --git a/debian-alt/jessie/control b/debian-alt/jessie/control
new file mode 100644
index 0000000000..e5c9401ec0
--- /dev/null
+++ b/debian-alt/jessie/control
@@ -0,0 +1,109 @@
+Source: i2p
+Maintainer: zzz <zzz@i2pmail.org>
+Section: net
+Standards-Version: 3.9.6
+Priority: optional
+Bugs: mailto:zzz@i2pmail.org
+Homepage: https://geti2p.net/
+Build-Depends: debhelper (>= 7.0.50~)
+ ,ant (>= 1.8)
+ ,debconf
+ ,openjdk-7-jdk
+# Ant requires java 6 tools.jar:
+# Unable to locate tools.jar. Expected to find it in /usr/lib/jvm/java-6-openjdk-amd64/lib/tools.jar
+ ,openjdk-6-jdk
+ ,libtomcat8-java
+ ,dh-apparmor
+ ,gettext
+ ,libgetopt-java
+ ,libgmp-dev (>= 2:5.0.2)
+ ,libservice-wrapper-java
+ ,hardening-wrapper
+ ,po-debconf
+
+Package: i2p
+Architecture: all
+Section: net
+Priority: optional
+Depends: ${java:Depends}, ${shlibs:Depends},
+ adduser,
+ debconf,
+ i2p-router (>= 0.8.6-5),
+ libjbigi-jni,
+ lsb-base,
+ service-wrapper
+Description: I2P anonymous network
+ I2P is an anonymizing network, offering a simple layer that identity-sensitive
+ applications can use to securely communicate. All data is wrapped with several
+ layers of encryption, and the network is both distributed and dynamic, with no
+ trusted parties.
+ .
+ This package depends on the router, jbigi, the java service wrapper, and
+ includes support to run I2P as a daemon.
+
+Package: libjbigi-jni
+Architecture: any
+Section: java
+Priority: optional
+Depends: ${shlibs:Depends}, i2p-router
+Homepage: https://geti2p.net/
+Description: I2P libjbigi library
+ This Package contains the libjbigi JNI library (and on x86 platforms, jcpuid).
+ .
+ libjbigi is a math library that is part of the I2P installation.  Use of this
+ library greatly enhances the efficiency of cryptographic algorithms, such as
+ the ones used by I2P. You can expect to see a 5-7x speed improvement on certain
+ tasks, such as elGamal encryption/decryption.
+
+Package: i2p-doc
+Architecture: all
+Section: doc
+Priority: extra
+Depends: ${misc:Depends}
+Suggests: i2p, default-jdk-doc
+Description: I2P developer documentation
+ I2P is an anonymizing network, offering a simple layer that identity-sensitive
+ applications can use to securely communicate. All data is wrapped with several
+ layers of encryption, and the network is both distributed and dynamic, with no
+ trusted parties.
+ .
+ This package contains the Javadoc files.
+
+Package: i2p-router
+Architecture: all
+Section: net
+Priority: optional
+Depends: ${misc:Depends}, ${java:Depends}, ${shlibs:Depends},
+ openjdk-8-jre-headless | openjdk-7-jre-headless | java8-runtime-headless | java7-runtime-headless,
+ libtomcat8-java,
+ geoip-database,
+ gettext-base,
+ libgetopt-java,
+Replaces: i2p ( << 0.8.6-5)
+Breaks: i2p (<< 0.8.6-5)
+Recommends: libjbigi-jni, ttf-dejavu
+Suggests: tor
+ ,apparmor
+ ,i2p-messenger
+ ,i2phex
+ ,i2p-tahoe-lafs
+ ,imule
+ ,irc-client
+ ,itoopie
+ ,mail-client
+ ,mail-reader
+ ,news-reader
+ ,polipo
+ ,privoxy
+ ,robert
+ ,syndie
+ ,www-browser
+ ,xul-ext-torbutton
+Description: I2P router
+ I2P is an anonymizing network, offering a simple layer that identity-sensitive
+ applications can use to securely communicate. All data is wrapped with several
+ layers of encryption, and the network is both distributed and dynamic, with no
+ trusted parties.
+ .
+ TrueType fonts (such as those provided in the package ttf-dejavu) are required
+ in order to generate graphs.
diff --git a/debian-alt/jessie/i2p-router.install b/debian-alt/jessie/i2p-router.install
new file mode 100644
index 0000000000..b67858d043
--- /dev/null
+++ b/debian-alt/jessie/i2p-router.install
@@ -0,0 +1,72 @@
+# history.txt is installed to /usr/share/i2p because
+# it's shown in the router console at http://127.0.0.1:7657
+# (this is also why I don't use dh_installchangelogs -k for it)
+history.txt usr/share/i2p
+
+pkg-temp/blocklist.txt usr/share/i2p
+pkg-temp/certificates usr/share/i2p
+pkg-temp/clients.config usr/share/i2p
+pkg-temp/docs usr/share/i2p/
+pkg-temp/eepget usr/bin
+pkg-temp/eepsite usr/share/i2p
+pkg-temp/geoip usr/share/i2p
+pkg-temp/hosts.txt usr/share/i2p
+pkg-temp/i2prouter-nowrapper usr/bin
+pkg-temp/i2psnark.config usr/share/i2p
+pkg-temp/i2ptunnel.config usr/share/i2p
+pkg-temp/router.config usr/share/i2p
+pkg-temp/systray.config usr/share/i2p
+pkg-temp/webapps usr/share/i2p
+
+
+pkg-temp/lib/BOB.jar usr/share/i2p/lib
+pkg-temp/lib/desktopgui.jar usr/share/i2p/lib
+pkg-temp/lib/i2p.jar usr/share/i2p/lib
+pkg-temp/lib/i2psnark.jar usr/share/i2p/lib
+pkg-temp/lib/i2ptunnel.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-i2p.jar usr/share/i2p/lib
+pkg-temp/lib/jrobin.jar usr/share/i2p/lib
+pkg-temp/lib/mstreaming.jar usr/share/i2p/lib
+pkg-temp/lib/routerconsole.jar usr/share/i2p/lib
+pkg-temp/lib/router.jar usr/share/i2p/lib
+pkg-temp/lib/sam.jar usr/share/i2p/lib
+pkg-temp/lib/streaming.jar usr/share/i2p/lib
+pkg-temp/lib/systray.jar usr/share/i2p/lib
+
+
+# uncomment if not building with libjetty9-java
+# ubuntu: in trusty vivid wily xenial
+# debian: in wheezy jessie stretch sid
+pkg-temp/lib/jetty-continuation.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-deploy.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-http.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-io.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-rewrite-handler.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-security.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-servlet.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-servlets.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-start.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-util.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-webapp.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-xml.jar usr/share/i2p/lib
+pkg-temp/lib/org.mortbay.jetty.jar usr/share/i2p/lib
+pkg-temp/lib/org.mortbay.jmx.jar usr/share/i2p/lib
+
+
+# uncomment if not building with libtomcat8-java
+#pkg-temp/lib/commons-el.jar usr/share/i2p/lib
+# legacy name, contains only tomcat-juli, not commons-logging
+#pkg-temp/lib/commons-logging.jar usr/share/i2p/lib
+#pkg-temp/lib/jasper-runtime.jar usr/share/i2p/lib
+#pkg-temp/lib/javax.servlet.jar usr/share/i2p/lib
+
+
+# uncomment if not building with either glassfish-javaee or libjakarta-taglibs-standard-java
+# ubuntu and debian: everywhere
+# glassfish-javaee.jar has ancient and conflicting classes, e.g. javax.mail
+pkg-temp/lib/jstl.jar usr/share/i2p/lib
+
+
+# uncomment if not building with either glassfish-javaee or libjstl1.1-java
+# ubuntu and debian: everywhere
+#pkg-temp/lib/standard.jar usr/share/i2p/lib
diff --git a/debian-alt/jessie/i2p-router.links b/debian-alt/jessie/i2p-router.links
new file mode 100644
index 0000000000..d85cf86ee3
--- /dev/null
+++ b/debian-alt/jessie/i2p-router.links
@@ -0,0 +1,85 @@
+usr/share/common-licenses/GPL-2 usr/share/doc/i2p-router/licenses/LICENSE-GPLv2.txt
+usr/share/common-licenses/LGPL-2.1 usr/share/doc/i2p-router/licenses/LICENSE-LGPLv2.1.txt
+usr/share/common-licenses/Apache-2.0 usr/share/doc/i2p-router/licenses/LICENSE-Apache2.0.txt
+usr/share/common-licenses/BSD usr/share/doc/i2p-router/licenses/LICENSE-BSD.txt
+
+
+# comment out if not building with libjetty9-java
+# ubuntu: in trusty vivid wily xenial
+# debian: in wheezy jessie stretch sid
+#usr/share/java/jetty9-continuation.jar usr/share/i2p/lib/jetty-continuation.jar
+#usr/share/java/jetty9-deploy.jar usr/share/i2p/lib/jetty-deploy.jar
+#usr/share/java/jetty9-http.jar usr/share/i2p/lib/jetty-http.jar
+#usr/share/java/jetty9-io.jar usr/share/i2p/lib/jetty-io.jar
+# legacy name in lib/
+#usr/share/java/jetty9-rewrite.jar usr/share/i2p/lib/jetty-rewrite-handler.jar
+#usr/share/java/jetty9-security.jar usr/share/i2p/lib/jetty-security.jar
+#usr/share/java/jetty9-servlet.jar usr/share/i2p/lib/jetty-servlet.jar
+#usr/share/java/jetty9-servlets.jar usr/share/i2p/lib/jetty-servlets.jar
+#usr/share/java/jetty9-start.jar usr/share/i2p/lib/jetty-start.jar
+#usr/share/java/jetty9-util.jar usr/share/i2p/lib/jetty-util.jar
+#usr/share/java/jetty9-webapp.jar usr/share/i2p/lib/jetty-webapp.jar
+#usr/share/java/jetty9-xml.jar usr/share/i2p/lib/jetty-xml.jar
+# legacy name in lib/
+#usr/share/java/jetty9-server.jar usr/share/i2p/lib/org.mortbay.jetty.jar
+# legacy name in lib/
+#usr/share/java/jetty9-jmx.jar usr/share/i2p/lib/org.mortbay.jmx.jar
+# following two are from libservlet3.1-java which is a dependency of libjetty9-java
+# legacy name in lib/
+#usr/share/java/servlet-api-3.1.jar usr/share/i2p/lib/javax.servlet.jar
+# combined into javax.servlet.jar in non-package builds
+#usr/share/java/jsp-api-2.3.jar usr/share/i2p/lib/jsp-api.jar
+
+
+# comment out if not building with libtomcat8-java
+# ubuntu: only in xenial+
+# debian: wheezy-backports, jessie+
+# legacy name, contains only tomcat-juli, not commons-logging
+usr/share/java/tomcat8-juli.jar usr/share/i2p/lib/commons-logging.jar
+usr/share/java/tomcat8-jasper.jar usr/share/i2p/lib/jasper-runtime.jar
+# combined into jasper-runtime.jar in non-package builds
+usr/share/java/tomcat8-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
+usr/share/java/tomcat8-api.jar usr/share/i2p/lib/tomcat-api.jar
+usr/share/java/tomcat8-util.jar usr/share/i2p/lib/tomcat-util.jar
+usr/share/java/tomcat8-util-scan.jar usr/share/i2p/lib/tomcat-util-scan.jar
+# combined into commons-el.jar in non-package builds
+usr/share/java/tomcat8-jasper-el.jar usr/share/i2p/lib/jasper-el.jar
+# legacy name in lib/
+usr/share/java/tomcat8-el-api.jar usr/share/i2p/lib/commons-el.jar
+usr/share/java/tomcat8-servlet-api.jar usr/share/i2p/lib/javax.servlet.jar
+usr/share/java/tomcat8-jsp-api.jar usr/share/i2p/lib/jsp-api.jar
+
+
+# comment out if not building with glassfish-javaee
+# glassfish-javaee.jar has ancient and conflicting classes, e.g. javax.mail
+#usr/share/java/glassfish-javaee.jar usr/share/i2p/lib/jstl.jar
+usr/share/java/glassfish-appserv-jstl.jar usr/share/i2p/lib/standard.jar
+
+
+# comment out if not building with libjakarta-taglibs-standard-java
+# ubuntu and debian: everywhere
+#usr/share/java/standard.jar usr/share/i2p/lib/standard.jar
+
+
+# comment out if not building with libjstl1.1-java
+# ubuntu and debian: everywhere
+#usr/share/java/jstl1.1.jar usr/share/i2p/lib/jstl.jar
+
+
+# comment out if not building with gettext-base
+# ubuntu and debian: everywhere
+usr/share/java/libintl.jar usr/share/i2p/lib/libintl.jar
+
+
+# comment out if not building with libgetopt-java
+# ubuntu and debian: everywhere
+usr/share/java/gnu-getopt.jar usr/share/i2p/lib/gnu-getopt.jar
+
+
+# comment out if not building with libhttpclient-java and libhttpcore-java
+# 2 MB of dependencies vs. 20 KB of copied source
+# Requires 4.4 or higher.
+# Debian: Not in wheezy/jessie
+# Ubuntu: Only in wily and later
+#usr/share/java/httpclient.jar usr/share/i2p/lib/httpclient.jar
+#usr/share/java/httpcore.jar usr/share/i2p/lib/httpcore.jar
diff --git a/debian-alt/jessie/rules b/debian-alt/jessie/rules
new file mode 100755
index 0000000000..94ad107b23
--- /dev/null
+++ b/debian-alt/jessie/rules
@@ -0,0 +1,205 @@
+#!/usr/bin/make -f
+
+# Quoting Policy version 3.9.2.0, 2011-04-07 section 4.9:
+
+# /start quote
+# For some packages, notably ones where the same source tree is compiled in
+# different ways to produce two binary packages, the build target does not make
+# much sense. For these packages it is good enough to provide two (or more)
+# targets (build-a and build-b or whatever) for each of the ways of building the
+# package, and a build target that does nothing. The binary target will have to
+# build the package in each of the possible ways and make the binary package out
+# of each.
+# ...
+# When a package has a configuration and build routine which takes a long time,
+# or when the makefiles are poorly designed, or when build needs to run clean
+# first, it is a good idea to touch build when the build process is complete.
+# This will ensure that if debian/rules build is run again it will not rebuild
+# the whole program.
+# /end quote
+
+# Since that fits building I2P very well, we override the build target.
+#
+
+build:
+	@echo 'The build target is disabled. Use the appropriate binary target.'
+
+JAVA_HOME=/usr/lib/jvm/default-java
+I2P=$(CURDIR)/pkg-temp
+ROUTERVERSION=$(CURDIR)/router/java/src/net/i2p/router/RouterVersion.java
+export DEB_BUILD_HARDENING=1
+
+# I2P's version will be displayed in the router console as "$I2PVERSION-$EXTRAPREFIX$DEBIANVERSION", eg. 0.8.12-0-deb1
+#export EXTRAPREFIX := deb
+export JAVA_HOME I2P
+export DEBIANVERSION := $(shell dpkg-parsechangelog |awk -F' ' '/^Version:/{print $$2}' |sed 's/.*-\([.0-9A-Za-z~+]\{1,\}\)$$/\1/')
+# required for jbigi/jcpuid build
+export BITS := $(shell dpkg-architecture -qDEB_HOST_ARCH_BITS)
+#export DEB_HOST_ARCH_CPU := $(shell dpkg-architecture -qDEB_HOST_ARCH_CPU)
+
+%:
+	dh $@ --with systemd,quilt
+
+clean: createcopyright
+
+override_dh_auto_clean:
+	-[ -r $(CURDIR)/debian/routerversion.java.bak ] && mv -f $(CURDIR)/debian/routerversion.java.bak $(ROUTERVERSION)
+	dh_auto_clean
+	ant distclean
+	find $(CURDIR)/core \( -name '*\.so' -o -name '*\.o' \) -exec rm -f {} \;
+	rm -rf $(CURDIR)/core/c/jcpuid/lib/
+	rm -f $(CURDIR)/installer/lib/wrapper/all/wrapper.jar
+	rm -rf $(CURDIR)/debian/python-i2p
+	rm -f $(CURDIR)/override.properties
+	debconf-updatepo
+
+override_dh_auto_build:
+
+override_dh_systemd_enable:
+	# We purposely do not set I2P to start at boot.
+	# This matches the behavior of the initscript
+	# and the setting RUN_DAEMON=false in /etc/default/i2p
+
+binary-indep: build-indep
+build-indep:
+	dh_prep
+	mkdir -p $(CURDIR)/installer/lib/wrapper/all
+	ln -sf /usr/share/java/wrapper.jar $(CURDIR)/installer/lib/wrapper/all/wrapper.jar
+	if [ ! -e $(CURDIR)/debian/routerversion.java.bak ]; then \
+		cp $(ROUTERVERSION) $(CURDIR)/debian/routerversion.java.bak; \
+	fi
+ifeq "$(findstring deb,$(shell grep 'deb' $(ROUTERVERSION)))" ""
+	sed -e "s/\(.*EXTRA\ =\ \)[^ ]*\"\(.*\)\"/\1\"\2-$$EXTRAPREFIX$$DEBIANVERSION\"/" < $(ROUTERVERSION) > $(ROUTERVERSION).tmp
+	mv -f $(ROUTERVERSION).tmp $(ROUTERVERSION)
+else
+	@echo "Already found deb in version, not doing anything"
+endif
+	@# build options
+	@/bin/echo -e "javac.version=1.7" > $(CURDIR)/override.properties
+	@/bin/echo -e "javac.compilerargs=-bootclasspath $(JAVA_HOME)/jre/lib/rt.jar:$(JAVA_HOME)/jre/lib/jce.jar" >> $(CURDIR)/override.properties
+	@/bin/echo -e "javac.compilerargs7=-bootclasspath $(JAVA_HOME)/jre/lib/rt.jar:$(JAVA_HOME)/jre/lib/jce.jar" >> $(CURDIR)/override.properties
+	@/bin/echo -e "build.built-by=debian" >> $(CURDIR)/override.properties
+
+	@# debian and ubuntu: everywhere
+	@/bin/echo -e "with-geoip-database=true" >> $(CURDIR)/override.properties
+
+	@# ubuntu: in xenial
+	@# debian: in jessie-backports stretch sid
+	@#/bin/echo -e "with-libjetty9-java=true" >> $(CURDIR)/override.properties
+	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
+	@#ln -sf /usr/share/java/jetty9-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
+	@#ln -sf /usr/share/java/jetty9-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
+	@#ln -sf /usr/share/java/jetty9-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
+	@#ln -sf /usr/share/java/jetty9-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
+	@#ln -sf /usr/share/java/jetty9-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
+	@#ln -sf /usr/share/java/jetty9-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
+	@#ln -sf /usr/share/java/jetty9-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
+	@#ln -sf /usr/share/java/jetty9-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
+	@#ln -sf /usr/share/java/jetty9-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
+	@#ln -sf /usr/share/java/jetty9-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
+	@#ln -sf /usr/share/java/jetty9-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
+	@#ln -sf /usr/share/java/jetty9-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
+	@#ln -sf /usr/share/java/jetty9-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
+	@#ln -sf /usr/share/java/jetty9-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
+	@# following two are from libservlet3.1-java which is a dependency of libjetty9-java
+	@#ln -sf /usr/share/java/servlet-api-3.1.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
+	@#ln -sf /usr/share/java/jsp-api-2.3.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
+
+	@# debian and ubuntu: wheezy-backports, jessie+, xenial+
+	@/bin/echo -e "with-libtomcat8-java=true" >> $(CURDIR)/override.properties
+	@mkdir -p $(CURDIR)/apps/jetty/jettylib
+	ln -sf /usr/share/java/tomcat8-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
+	ln -sf /usr/share/java/tomcat8-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
+	ln -sf /usr/share/java/tomcat8-el-api.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	ln -sf /usr/share/java/tomcat8-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
+	ln -sf /usr/share/java/tomcat8-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
+	ln -sf /usr/share/java/tomcat8-jsp-api.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
+	ln -sf /usr/share/java/tomcat8-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
+	ln -sf /usr/share/java/tomcat8-servlet-api.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
+	ln -sf /usr/share/java/tomcat8-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
+	ln -sf /usr/share/java/tomcat8-util-scan.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util-scan.jar
+
+	@# debian and ubuntu: everywhere
+	@/bin/echo -e "with-glassfish-javaee=true" >> $(CURDIR)/override.properties
+	@# glassfish-javaee.jar has ancient and conflicting classes, e.g. javax.mail
+	@#ln -sf /usr/share/java/glassfish-javaee.jar $(CURDIR)/apps/susidns/src/lib/jstl.jar
+	ln -sf /usr/share/java/glassfish-appserv-jstl.jar $(CURDIR)/apps/susidns/src/lib/standard.jar
+
+	@# debian and ubuntu: everywhere
+	@#/bin/echo -e "with-libjakarta-taglibs-standard-java=true" >> $(CURDIR)/override.properties
+	@#ln -sf /usr/share/java/standard.jar $(CURDIR)/apps/susidns/src/lib/standard.jar
+
+	@# debian and ubuntu: everywhere
+	@#/bin/echo -e "with-libjstl1.1-java=true" >> $(CURDIR)/override.properties
+	@#ln -sf /usr/share/java/jstl1.1.jar $(CURDIR)/apps/susidns/src/lib/jstl.jar
+
+	@# debian and ubuntu: everywhere
+	@/bin/echo -e "with-gettext-base=true" >> $(CURDIR)/override.properties
+	@mkdir -p $(CURDIR)/core/java/build
+	ln -sf /usr/share/java/libintl.jar $(CURDIR)/core/java/build/libintl.jar
+
+	@# debian and ubuntu: everywhere
+	@/bin/echo -e "with-libgetopt-java=true" >> $(CURDIR)/override.properties
+	@mkdir -p $(CURDIR)/core/java/build
+	ln -sf /usr/share/java/gnu-getopt.jar $(CURDIR)/core/java/build/gnu-getopt.jar
+
+	@# 2 MB of dependencies vs. 20 KB of copied source
+	@# Requires 4.4 or higher.
+	@# Debian: Not in wheezy/jessie
+	@# Ubuntu: Only in wily and later
+	@#/bin/echo -e "with-libhttpclient-java=true" >> $(CURDIR)/override.properties
+	@#mkdir -p $(CURDIR)/core/java/build
+	@#ln -sf /usr/share/java/httpclient.jar $(CURDIR)/core/java/build/httpclient.jar
+	@#ln -sf /usr/share/java/httpcore.jar $(CURDIR)/core/java/build/httpcore.jar
+
+	TZ=UTC JAVA_TOOL_OPTIONS=-Dfile.encoding=UTF8 ant preppkg-unix javadoc
+	echo router.updateDisabled=true > $(I2P)/router.config
+	mv $(I2P)/runplain.sh $(I2P)/i2prouter-nowrapper
+
+binary-arch: build-arch
+build-arch:
+	# build jbigi
+	cd $(CURDIR)/core/c/jbigi && ./build_jbigi.sh dynamic
+	# build jcpuid
+	cd $(CURDIR)/core/c/jcpuid && ./build.sh
+
+binary: binary-arch binary-indep
+
+createcopyright:
+	@echo " *** Creating debian/copyright*** "
+	@rm -f $(CURDIR)/debian/copyright
+	@/bin/echo -e "This package was Debianized by kytv <killyourtv@i2pmail.org>" >> $(CURDIR)/debian/copyright
+	@/bin/echo -e "Sun, 23 Jan 2011 20:26:51 +0000" >> $(CURDIR)/debian/copyright
+	@/bin/echo -e "\nIt was downloaded from https://geti2p.net" >> $(CURDIR)/debian/copyright
+	@/bin/echo -e "\nI2P is tracked upstream using the Monotone VCS" >> $(CURDIR)/debian/copyright
+	@/bin/echo -e "Complete information on fetching the source with monotone can be found" >> $(CURDIR)/debian/copyright
+	@/bin/echo -e "at https://geti2p.net/newdevelopers#getting-the-i2p-code\n\n\n" >> $(CURDIR)/debian/copyright
+	@/bin/cat $(CURDIR)/LICENSE.txt >> $(CURDIR)/debian/copyright
+	@/bin/echo -e "\n\n The debian packaging has been released into the public domain." >> $(CURDIR)/debian/copyright
+
+override_dh_compress:
+	dh_compress -X.xsl -X.xml
+
+override_dh_install:
+	dh_install --list-missing
+	dh_apparmor --profile-name=system_i2p -pi2p
+	dh_apparmor --profile-name=usr.bin.i2prouter -pi2p
+
+override_dh_installchangelogs:
+	dh_installchangelogs history.txt
+
+override_dh_installdocs:
+	dh_installdocs -pi2p -plibjbigi-jni --link-doc=i2p-router
+	dh_installdocs --remaining-packages
+
+override_dh_dhlibdeps:
+	dh_shlibdeps -llibjbigi-jni debian/libjbigi-jni/usr/lib/jni/*.so
+
+#override_dh_installinit:
+#	dh_installinit -r
+
+override_dh_builddeb:
+	dh_builddeb -- -Zxz
+
+get-orig-source:
+	uscan --verbose --rename --destdir $(CURDIR)/.. --watchfile debian/watch --force-download
diff --git a/debian-alt/precise/control b/debian-alt/precise/control
index ee3f8a3d75..49b3639bad 100644
--- a/debian-alt/precise/control
+++ b/debian-alt/precise/control
@@ -7,7 +7,6 @@ Bugs: mailto:zzz@i2pmail.org
 Homepage: https://geti2p.net/
 Build-Depends: debhelper (>= 7.0.50~)
  ,ant (>= 1.8)
- ,ant-optional
  ,debconf
  ,openjdk-7-jdk
 # Ant requires java 6 tools.jar:
@@ -76,7 +75,6 @@ Section: net
 Priority: optional
 Depends: ${misc:Depends}, ${java:Depends}, ${shlibs:Depends},
  openjdk-8-jre-headless | openjdk-7-jre-headless | java8-runtime-headless | java7-runtime-headless,
- libecj-java,
  geoip-database,
  gettext-base,
  libgetopt-java,
diff --git a/debian-alt/precise/i2p-router.install b/debian-alt/precise/i2p-router.install
index 2234bf8cdd..3d044ecf8b 100644
--- a/debian-alt/precise/i2p-router.install
+++ b/debian-alt/precise/i2p-router.install
@@ -34,7 +34,7 @@ pkg-temp/lib/streaming.jar usr/share/i2p/lib
 pkg-temp/lib/systray.jar usr/share/i2p/lib
 
 
-# uncomment if not building with libjetty8-java
+# uncomment if not building with libjetty9-java
 # ubuntu: in trusty vivid wily xenial
 # debian: in wheezy jessie stretch sid
 pkg-temp/lib/jetty-continuation.jar usr/share/i2p/lib
@@ -51,15 +51,14 @@ pkg-temp/lib/jetty-webapp.jar usr/share/i2p/lib
 pkg-temp/lib/jetty-xml.jar usr/share/i2p/lib
 pkg-temp/lib/org.mortbay.jetty.jar usr/share/i2p/lib
 pkg-temp/lib/org.mortbay.jmx.jar usr/share/i2p/lib
-# following two are from libservlet3.0-java which is a dependency of libjetty8-java
-pkg-temp/lib/javax.servlet.jar usr/share/i2p/lib
 
 
-# uncomment if not building with either libtomcat6-java or libtomcat7-java
+# uncomment if not building with libtomcat8-java
 pkg-temp/lib/commons-el.jar usr/share/i2p/lib
 # legacy name, contains only tomcat-juli, not commons-logging
 pkg-temp/lib/commons-logging.jar usr/share/i2p/lib
 pkg-temp/lib/jasper-runtime.jar usr/share/i2p/lib
+pkg-temp/lib/javax.servlet.jar usr/share/i2p/lib
 
 
 # uncomment if not building with either glassfish-javaee or libjakarta-taglibs-standard-java
diff --git a/debian-alt/precise/i2p-router.links b/debian-alt/precise/i2p-router.links
index e3aa80d785..f89ae3bd7d 100644
--- a/debian-alt/precise/i2p-router.links
+++ b/debian-alt/precise/i2p-router.links
@@ -3,67 +3,51 @@ usr/share/common-licenses/LGPL-2.1 usr/share/doc/i2p-router/licenses/LICENSE-LGP
 usr/share/common-licenses/Apache-2.0 usr/share/doc/i2p-router/licenses/LICENSE-Apache2.0.txt
 usr/share/common-licenses/BSD usr/share/doc/i2p-router/licenses/LICENSE-BSD.txt
 
-usr/share/java/eclipse-ecj.jar usr/share/i2p/lib/eclipse-ecj.jar
 
-
-# comment out if not building with libjetty8-java
+# comment out if not building with libjetty9-java
 # ubuntu: in trusty vivid wily xenial
 # debian: in wheezy jessie stretch sid
-#usr/share/java/jetty8-continuation.jar usr/share/i2p/lib/jetty-continuation.jar
-#usr/share/java/jetty8-deploy.jar usr/share/i2p/lib/jetty-deploy.jar
-#usr/share/java/jetty8-http.jar usr/share/i2p/lib/jetty-http.jar
-#usr/share/java/jetty8-io.jar usr/share/i2p/lib/jetty-io.jar
+#usr/share/java/jetty9-continuation.jar usr/share/i2p/lib/jetty-continuation.jar
+#usr/share/java/jetty9-deploy.jar usr/share/i2p/lib/jetty-deploy.jar
+#usr/share/java/jetty9-http.jar usr/share/i2p/lib/jetty-http.jar
+#usr/share/java/jetty9-io.jar usr/share/i2p/lib/jetty-io.jar
 # legacy name in lib/
-#usr/share/java/jetty8-rewrite.jar usr/share/i2p/lib/jetty-rewrite-handler.jar
-#usr/share/java/jetty8-security.jar usr/share/i2p/lib/jetty-security.jar
-#usr/share/java/jetty8-servlet.jar usr/share/i2p/lib/jetty-servlet.jar
-#usr/share/java/jetty8-servlets.jar usr/share/i2p/lib/jetty-servlets.jar
-#usr/share/java/jetty8-start.jar usr/share/i2p/lib/jetty-start.jar
-#usr/share/java/jetty8-util.jar usr/share/i2p/lib/jetty-util.jar
-#usr/share/java/jetty8-webapp.jar usr/share/i2p/lib/jetty-webapp.jar
-#usr/share/java/jetty8-xml.jar usr/share/i2p/lib/jetty-xml.jar
+#usr/share/java/jetty9-rewrite.jar usr/share/i2p/lib/jetty-rewrite-handler.jar
+#usr/share/java/jetty9-security.jar usr/share/i2p/lib/jetty-security.jar
+#usr/share/java/jetty9-servlet.jar usr/share/i2p/lib/jetty-servlet.jar
+#usr/share/java/jetty9-servlets.jar usr/share/i2p/lib/jetty-servlets.jar
+#usr/share/java/jetty9-start.jar usr/share/i2p/lib/jetty-start.jar
+#usr/share/java/jetty9-util.jar usr/share/i2p/lib/jetty-util.jar
+#usr/share/java/jetty9-webapp.jar usr/share/i2p/lib/jetty-webapp.jar
+#usr/share/java/jetty9-xml.jar usr/share/i2p/lib/jetty-xml.jar
 # legacy name in lib/
-#usr/share/java/jetty8-server.jar usr/share/i2p/lib/org.mortbay.jetty.jar
+#usr/share/java/jetty9-server.jar usr/share/i2p/lib/org.mortbay.jetty.jar
 # legacy name in lib/
-#usr/share/java/jetty8-jmx.jar usr/share/i2p/lib/org.mortbay.jmx.jar
-# following two are from libservlet3.0-java which is a dependency of libjetty8-java
+#usr/share/java/jetty9-jmx.jar usr/share/i2p/lib/org.mortbay.jmx.jar
+# following two are from libservlet3.1-java which is a dependency of libjetty9-java
 # legacy name in lib/
-#usr/share/java/servlet-api-3.0.jar usr/share/i2p/lib/javax.servlet.jar
+#usr/share/java/servlet-api-3.1.jar usr/share/i2p/lib/javax.servlet.jar
 # combined into javax.servlet.jar in non-package builds
-#usr/share/java/jsp-api-2.2.jar usr/share/i2p/lib/jsp-api.jar
+#usr/share/java/jsp-api-2.3.jar usr/share/i2p/lib/jsp-api.jar
 
 
-# comment out if not building with libtomcat6-java
-# ubuntu: only in precise trusty vivid
-# debian: only in wheezy
+# comment out if not building with libtomcat8-java
+# ubuntu: only in xenial+
+# debian: wheezy-backports, jessie+
 # legacy name, contains only tomcat-juli, not commons-logging
-#usr/share/java/tomcat-juli.jar usr/share/i2p/lib/commons-logging.jar
-#usr/share/java/jasper.jar usr/share/i2p/lib/jasper-runtime.jar
+#usr/share/java/tomcat8-juli.jar usr/share/i2p/lib/commons-logging.jar
+#usr/share/java/tomcat8-jasper.jar usr/share/i2p/lib/jasper-runtime.jar
 # combined into jasper-runtime.jar in non-package builds
-#usr/share/java/tomcat-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
+#usr/share/java/tomcat8-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
+#usr/share/java/tomcat8-api.jar usr/share/i2p/lib/tomcat-api.jar
+#usr/share/java/tomcat8-util.jar usr/share/i2p/lib/tomcat-util.jar
+#usr/share/java/tomcat8-util-scan.jar usr/share/i2p/lib/tomcat-util-scan.jar
 # combined into commons-el.jar in non-package builds
-#usr/share/java/jasper-el.jar usr/share/i2p/lib/jasper-el.jar
-# following is from libservlet2.5-java which is a dependency of libtomcat6-java
+#usr/share/java/tomcat8-jasper-el.jar usr/share/i2p/lib/jasper-el.jar
 # legacy name in lib/
-#usr/share/java/el-api-2.1.jar usr/share/i2p/lib/commons-el.jar
-
-
-# comment out if not building with libtomcat7-java
-# ubuntu: only in precise trusty vivid
-# debian: only in wheezy
-# legacy name, contains only tomcat-juli, not commons-logging
-#usr/share/java/tomcat-juli.jar usr/share/i2p/lib/commons-logging.jar
-#usr/share/java/tomcat-jasper.jar usr/share/i2p/lib/jasper-runtime.jar
-# combined into jasper-runtime.jar in non-package builds
-#usr/share/java/tomcat-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
-# tomcat 7 only
-#usr/share/java/tomcat-api.jar usr/share/i2p/lib/tomcat-api.jar
-#usr/share/java/tomcat-util.jar usr/share/i2p/lib/tomcat-util.jar
-# combined into commons-el.jar in non-package builds
-#usr/share/java/tomcat-jasper-el.jar usr/share/i2p/lib/jasper-el.jar
-# following is from libservlet3.0-java which is a dependency of libtomcat7-java
-# legacy name in lib/
-#usr/share/java/el-api-2.2.jar usr/share/i2p/lib/commons-el.jar
+#usr/share/java/tomcat8-el-api.jar usr/share/i2p/lib/commons-el.jar
+#usr/share/java/tomcat8-servlet-api.jar usr/share/i2p/lib/javax.servlet.jar
+#usr/share/java/tomcat8-jsp-api.jar usr/share/i2p/lib/jsp-api.jar
 
 
 # comment out if not building with glassfish-javaee
diff --git a/debian-alt/precise/rules b/debian-alt/precise/rules
index 4afb564189..826b6a5fa0 100755
--- a/debian-alt/precise/rules
+++ b/debian-alt/precise/rules
@@ -84,50 +84,41 @@ endif
 	@# debian and ubuntu: everywhere
 	@/bin/echo -e "with-geoip-database=true" >> $(CURDIR)/override.properties
 
-	@# ubuntu: not in precise
-	@# debian: in wheezy jessie stretch sid
-	@#/bin/echo -e "with-libjetty8-java=true" >> $(CURDIR)/override.properties
+	@# ubuntu: in xenial
+	@# debian: in jessie-backports stretch sid
+	@#/bin/echo -e "with-libjetty9-java=true" >> $(CURDIR)/override.properties
 	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/jetty8-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
-	@#ln -sf /usr/share/java/jetty8-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
-	@#ln -sf /usr/share/java/jetty8-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
-	@#ln -sf /usr/share/java/jetty8-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
-	@#ln -sf /usr/share/java/jetty8-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
-	@#ln -sf /usr/share/java/jetty8-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
-	@#ln -sf /usr/share/java/jetty8-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
-	@#ln -sf /usr/share/java/jetty8-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
-	@#ln -sf /usr/share/java/jetty8-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
-	@#ln -sf /usr/share/java/jetty8-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
-	@#ln -sf /usr/share/java/jetty8-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
-	@#ln -sf /usr/share/java/jetty8-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
-	@#ln -sf /usr/share/java/jetty8-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
-	@#ln -sf /usr/share/java/jetty8-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
-	@# following two are from libservlet3.0-java which is a dependency of libjetty8-java
-	@#ln -sf /usr/share/java/servlet-api-3.0.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
-	@#ln -sf /usr/share/java/jsp-api-2.2.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
+	@#ln -sf /usr/share/java/jetty9-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
+	@#ln -sf /usr/share/java/jetty9-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
+	@#ln -sf /usr/share/java/jetty9-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
+	@#ln -sf /usr/share/java/jetty9-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
+	@#ln -sf /usr/share/java/jetty9-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
+	@#ln -sf /usr/share/java/jetty9-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
+	@#ln -sf /usr/share/java/jetty9-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
+	@#ln -sf /usr/share/java/jetty9-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
+	@#ln -sf /usr/share/java/jetty9-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
+	@#ln -sf /usr/share/java/jetty9-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
+	@#ln -sf /usr/share/java/jetty9-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
+	@#ln -sf /usr/share/java/jetty9-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
+	@#ln -sf /usr/share/java/jetty9-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
+	@#ln -sf /usr/share/java/jetty9-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
+	@# following two are from libservlet3.1-java which is a dependency of libjetty9-java
+	@#ln -sf /usr/share/java/servlet-api-3.1.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
+	@#ln -sf /usr/share/java/jsp-api-2.3.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
 
-	@# ubuntu: only in precise trusty vivid
-	@# debian: only in wheezy
-	@#@/bin/echo -e "with-libtomcat6-java=true" >> $(CURDIR)/override.properties
+	@# debian and ubuntu: wheezy-backports, jessie+, xenial+
+	@#/bin/echo -e "with-libtomcat8-java=true" >> $(CURDIR)/override.properties
 	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@# following is from libservlet2.5-java which is a dependency of libtomcat6-java
-	@#ln -sf /usr/share/java/el-api-2.1.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
-
-	@# debian and ubuntu: everywhere
-	@#/bin/echo -e "with-libtomcat7-java=true" >> $(CURDIR)/override.properties
-	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/tomcat-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
-	@#ln -sf /usr/share/java/tomcat-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
-	@#ln -sf /usr/share/java/tomcat-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/tomcat-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@# following is from libservlet3.0-java which is a dependency of libtomcat7-java
-	@#ln -sf /usr/share/java/el-api-2.2.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	@#ln -sf /usr/share/java/tomcat8-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
+	@#ln -sf /usr/share/java/tomcat8-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
+	@#ln -sf /usr/share/java/tomcat8-el-api.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	@#ln -sf /usr/share/java/tomcat8-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
+	@#ln -sf /usr/share/java/tomcat8-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
+	@#ln -sf /usr/share/java/tomcat8-jsp-api.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
+	@#ln -sf /usr/share/java/tomcat8-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
+	@#ln -sf /usr/share/java/tomcat8-servlet-api.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
+	@#ln -sf /usr/share/java/tomcat8-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
+	@#ln -sf /usr/share/java/tomcat8-util-scan.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util-scan.jar
 
 	@# debian and ubuntu: everywhere
 	@/bin/echo -e "with-glassfish-javaee=true" >> $(CURDIR)/override.properties
diff --git a/debian-alt/trusty/control b/debian-alt/trusty/control
new file mode 100644
index 0000000000..75a2dbd89b
--- /dev/null
+++ b/debian-alt/trusty/control
@@ -0,0 +1,109 @@
+Source: i2p
+Maintainer: zzz <zzz@i2pmail.org>
+Section: net
+Standards-Version: 3.9.6
+Priority: optional
+Bugs: mailto:zzz@i2pmail.org
+Homepage: https://geti2p.net/
+Build-Depends: debhelper (>= 7.0.50~)
+ ,ant (>= 1.8)
+ ,debconf
+ ,openjdk-7-jdk
+# Ant requires java 6 tools.jar:
+# Unable to locate tools.jar. Expected to find it in /usr/lib/jvm/java-6-openjdk-amd64/lib/tools.jar
+ ,openjdk-6-jdk
+ ,glassfish-javaee
+ ,dh-apparmor
+ ,gettext
+ ,libgetopt-java
+ ,libgmp-dev (>= 2:5.0.2)
+ ,libservice-wrapper-java
+ ,hardening-wrapper
+ ,po-debconf
+
+Package: i2p
+Architecture: all
+Section: net
+Priority: optional
+Depends: ${java:Depends}, ${shlibs:Depends},
+ adduser,
+ debconf,
+ i2p-router (>= 0.8.6-5),
+ libjbigi-jni,
+ lsb-base,
+ service-wrapper
+Description: I2P anonymous network
+ I2P is an anonymizing network, offering a simple layer that identity-sensitive
+ applications can use to securely communicate. All data is wrapped with several
+ layers of encryption, and the network is both distributed and dynamic, with no
+ trusted parties.
+ .
+ This package depends on the router, jbigi, the java service wrapper, and
+ includes support to run I2P as a daemon.
+
+Package: libjbigi-jni
+Architecture: any
+Section: java
+Priority: optional
+Depends: ${shlibs:Depends}, i2p-router
+Homepage: https://geti2p.net/
+Description: I2P libjbigi library
+ This Package contains the libjbigi JNI library (and on x86 platforms, jcpuid).
+ .
+ libjbigi is a math library that is part of the I2P installation.  Use of this
+ library greatly enhances the efficiency of cryptographic algorithms, such as
+ the ones used by I2P. You can expect to see a 5-7x speed improvement on certain
+ tasks, such as elGamal encryption/decryption.
+
+Package: i2p-doc
+Architecture: all
+Section: doc
+Priority: extra
+Depends: ${misc:Depends}
+Suggests: i2p, default-jdk-doc
+Description: I2P developer documentation
+ I2P is an anonymizing network, offering a simple layer that identity-sensitive
+ applications can use to securely communicate. All data is wrapped with several
+ layers of encryption, and the network is both distributed and dynamic, with no
+ trusted parties.
+ .
+ This package contains the Javadoc files.
+
+Package: i2p-router
+Architecture: all
+Section: net
+Priority: optional
+Depends: ${misc:Depends}, ${java:Depends}, ${shlibs:Depends},
+ openjdk-8-jre-headless | openjdk-7-jre-headless | java8-runtime-headless | java7-runtime-headless,
+ glassfish-javaee,
+ geoip-database,
+ gettext-base,
+ libgetopt-java,
+Replaces: i2p ( << 0.8.6-5)
+Breaks: i2p (<< 0.8.6-5)
+Recommends: libjbigi-jni, ttf-dejavu
+Suggests: tor
+ ,apparmor
+ ,i2p-messenger
+ ,i2phex
+ ,i2p-tahoe-lafs
+ ,imule
+ ,irc-client
+ ,itoopie
+ ,mail-client
+ ,mail-reader
+ ,news-reader
+ ,polipo
+ ,privoxy
+ ,robert
+ ,syndie
+ ,www-browser
+ ,xul-ext-torbutton
+Description: I2P router
+ I2P is an anonymizing network, offering a simple layer that identity-sensitive
+ applications can use to securely communicate. All data is wrapped with several
+ layers of encryption, and the network is both distributed and dynamic, with no
+ trusted parties.
+ .
+ TrueType fonts (such as those provided in the package ttf-dejavu) are required
+ in order to generate graphs.
diff --git a/debian-alt/trusty/i2p-router.install b/debian-alt/trusty/i2p-router.install
new file mode 100644
index 0000000000..3d044ecf8b
--- /dev/null
+++ b/debian-alt/trusty/i2p-router.install
@@ -0,0 +1,72 @@
+# history.txt is installed to /usr/share/i2p because
+# it's shown in the router console at http://127.0.0.1:7657
+# (this is also why I don't use dh_installchangelogs -k for it)
+history.txt usr/share/i2p
+
+pkg-temp/blocklist.txt usr/share/i2p
+pkg-temp/certificates usr/share/i2p
+pkg-temp/clients.config usr/share/i2p
+pkg-temp/docs usr/share/i2p/
+pkg-temp/eepget usr/bin
+pkg-temp/eepsite usr/share/i2p
+pkg-temp/geoip usr/share/i2p
+pkg-temp/hosts.txt usr/share/i2p
+pkg-temp/i2prouter-nowrapper usr/bin
+pkg-temp/i2psnark.config usr/share/i2p
+pkg-temp/i2ptunnel.config usr/share/i2p
+pkg-temp/router.config usr/share/i2p
+pkg-temp/systray.config usr/share/i2p
+pkg-temp/webapps usr/share/i2p
+
+
+pkg-temp/lib/BOB.jar usr/share/i2p/lib
+pkg-temp/lib/desktopgui.jar usr/share/i2p/lib
+pkg-temp/lib/i2p.jar usr/share/i2p/lib
+pkg-temp/lib/i2psnark.jar usr/share/i2p/lib
+pkg-temp/lib/i2ptunnel.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-i2p.jar usr/share/i2p/lib
+pkg-temp/lib/jrobin.jar usr/share/i2p/lib
+pkg-temp/lib/mstreaming.jar usr/share/i2p/lib
+pkg-temp/lib/routerconsole.jar usr/share/i2p/lib
+pkg-temp/lib/router.jar usr/share/i2p/lib
+pkg-temp/lib/sam.jar usr/share/i2p/lib
+pkg-temp/lib/streaming.jar usr/share/i2p/lib
+pkg-temp/lib/systray.jar usr/share/i2p/lib
+
+
+# uncomment if not building with libjetty9-java
+# ubuntu: in trusty vivid wily xenial
+# debian: in wheezy jessie stretch sid
+pkg-temp/lib/jetty-continuation.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-deploy.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-http.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-io.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-rewrite-handler.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-security.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-servlet.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-servlets.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-start.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-util.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-webapp.jar usr/share/i2p/lib
+pkg-temp/lib/jetty-xml.jar usr/share/i2p/lib
+pkg-temp/lib/org.mortbay.jetty.jar usr/share/i2p/lib
+pkg-temp/lib/org.mortbay.jmx.jar usr/share/i2p/lib
+
+
+# uncomment if not building with libtomcat8-java
+pkg-temp/lib/commons-el.jar usr/share/i2p/lib
+# legacy name, contains only tomcat-juli, not commons-logging
+pkg-temp/lib/commons-logging.jar usr/share/i2p/lib
+pkg-temp/lib/jasper-runtime.jar usr/share/i2p/lib
+pkg-temp/lib/javax.servlet.jar usr/share/i2p/lib
+
+
+# uncomment if not building with either glassfish-javaee or libjakarta-taglibs-standard-java
+# ubuntu and debian: everywhere
+# glassfish-javaee.jar has ancient and conflicting classes, e.g. javax.mail
+pkg-temp/lib/jstl.jar usr/share/i2p/lib
+
+
+# uncomment if not building with either glassfish-javaee or libjstl1.1-java
+# ubuntu and debian: everywhere
+#pkg-temp/lib/standard.jar usr/share/i2p/lib
diff --git a/debian-alt/trusty/i2p-router.links b/debian-alt/trusty/i2p-router.links
new file mode 100644
index 0000000000..f89ae3bd7d
--- /dev/null
+++ b/debian-alt/trusty/i2p-router.links
@@ -0,0 +1,85 @@
+usr/share/common-licenses/GPL-2 usr/share/doc/i2p-router/licenses/LICENSE-GPLv2.txt
+usr/share/common-licenses/LGPL-2.1 usr/share/doc/i2p-router/licenses/LICENSE-LGPLv2.1.txt
+usr/share/common-licenses/Apache-2.0 usr/share/doc/i2p-router/licenses/LICENSE-Apache2.0.txt
+usr/share/common-licenses/BSD usr/share/doc/i2p-router/licenses/LICENSE-BSD.txt
+
+
+# comment out if not building with libjetty9-java
+# ubuntu: in trusty vivid wily xenial
+# debian: in wheezy jessie stretch sid
+#usr/share/java/jetty9-continuation.jar usr/share/i2p/lib/jetty-continuation.jar
+#usr/share/java/jetty9-deploy.jar usr/share/i2p/lib/jetty-deploy.jar
+#usr/share/java/jetty9-http.jar usr/share/i2p/lib/jetty-http.jar
+#usr/share/java/jetty9-io.jar usr/share/i2p/lib/jetty-io.jar
+# legacy name in lib/
+#usr/share/java/jetty9-rewrite.jar usr/share/i2p/lib/jetty-rewrite-handler.jar
+#usr/share/java/jetty9-security.jar usr/share/i2p/lib/jetty-security.jar
+#usr/share/java/jetty9-servlet.jar usr/share/i2p/lib/jetty-servlet.jar
+#usr/share/java/jetty9-servlets.jar usr/share/i2p/lib/jetty-servlets.jar
+#usr/share/java/jetty9-start.jar usr/share/i2p/lib/jetty-start.jar
+#usr/share/java/jetty9-util.jar usr/share/i2p/lib/jetty-util.jar
+#usr/share/java/jetty9-webapp.jar usr/share/i2p/lib/jetty-webapp.jar
+#usr/share/java/jetty9-xml.jar usr/share/i2p/lib/jetty-xml.jar
+# legacy name in lib/
+#usr/share/java/jetty9-server.jar usr/share/i2p/lib/org.mortbay.jetty.jar
+# legacy name in lib/
+#usr/share/java/jetty9-jmx.jar usr/share/i2p/lib/org.mortbay.jmx.jar
+# following two are from libservlet3.1-java which is a dependency of libjetty9-java
+# legacy name in lib/
+#usr/share/java/servlet-api-3.1.jar usr/share/i2p/lib/javax.servlet.jar
+# combined into javax.servlet.jar in non-package builds
+#usr/share/java/jsp-api-2.3.jar usr/share/i2p/lib/jsp-api.jar
+
+
+# comment out if not building with libtomcat8-java
+# ubuntu: only in xenial+
+# debian: wheezy-backports, jessie+
+# legacy name, contains only tomcat-juli, not commons-logging
+#usr/share/java/tomcat8-juli.jar usr/share/i2p/lib/commons-logging.jar
+#usr/share/java/tomcat8-jasper.jar usr/share/i2p/lib/jasper-runtime.jar
+# combined into jasper-runtime.jar in non-package builds
+#usr/share/java/tomcat8-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
+#usr/share/java/tomcat8-api.jar usr/share/i2p/lib/tomcat-api.jar
+#usr/share/java/tomcat8-util.jar usr/share/i2p/lib/tomcat-util.jar
+#usr/share/java/tomcat8-util-scan.jar usr/share/i2p/lib/tomcat-util-scan.jar
+# combined into commons-el.jar in non-package builds
+#usr/share/java/tomcat8-jasper-el.jar usr/share/i2p/lib/jasper-el.jar
+# legacy name in lib/
+#usr/share/java/tomcat8-el-api.jar usr/share/i2p/lib/commons-el.jar
+#usr/share/java/tomcat8-servlet-api.jar usr/share/i2p/lib/javax.servlet.jar
+#usr/share/java/tomcat8-jsp-api.jar usr/share/i2p/lib/jsp-api.jar
+
+
+# comment out if not building with glassfish-javaee
+# glassfish-javaee.jar has ancient and conflicting classes, e.g. javax.mail
+#usr/share/java/glassfish-javaee.jar usr/share/i2p/lib/jstl.jar
+usr/share/java/glassfish-appserv-jstl.jar usr/share/i2p/lib/standard.jar
+
+
+# comment out if not building with libjakarta-taglibs-standard-java
+# ubuntu and debian: everywhere
+#usr/share/java/standard.jar usr/share/i2p/lib/standard.jar
+
+
+# comment out if not building with libjstl1.1-java
+# ubuntu and debian: everywhere
+#usr/share/java/jstl1.1.jar usr/share/i2p/lib/jstl.jar
+
+
+# comment out if not building with gettext-base
+# ubuntu and debian: everywhere
+usr/share/java/libintl.jar usr/share/i2p/lib/libintl.jar
+
+
+# comment out if not building with libgetopt-java
+# ubuntu and debian: everywhere
+usr/share/java/gnu-getopt.jar usr/share/i2p/lib/gnu-getopt.jar
+
+
+# comment out if not building with libhttpclient-java and libhttpcore-java
+# 2 MB of dependencies vs. 20 KB of copied source
+# Requires 4.4 or higher.
+# Debian: Not in wheezy/jessie
+# Ubuntu: Only in wily and later
+#usr/share/java/httpclient.jar usr/share/i2p/lib/httpclient.jar
+#usr/share/java/httpcore.jar usr/share/i2p/lib/httpcore.jar
diff --git a/debian-alt/trusty/rules b/debian-alt/trusty/rules
index 257162006c..a4907fef8f 100755
--- a/debian-alt/trusty/rules
+++ b/debian-alt/trusty/rules
@@ -83,50 +83,41 @@ endif
 	@# debian and ubuntu: everywhere
 	@/bin/echo -e "with-geoip-database=true" >> $(CURDIR)/override.properties
 
-	@# ubuntu: not in precise
-	@# debian: in wheezy jessie stretch sid
-	@/bin/echo -e "with-libjetty8-java=true" >> $(CURDIR)/override.properties
-	mkdir -p $(CURDIR)/apps/jetty/jettylib
-	ln -sf /usr/share/java/jetty8-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
-	ln -sf /usr/share/java/jetty8-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
-	ln -sf /usr/share/java/jetty8-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
-	ln -sf /usr/share/java/jetty8-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
-	ln -sf /usr/share/java/jetty8-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
-	ln -sf /usr/share/java/jetty8-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
-	ln -sf /usr/share/java/jetty8-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
-	ln -sf /usr/share/java/jetty8-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
-	ln -sf /usr/share/java/jetty8-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
-	ln -sf /usr/share/java/jetty8-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
-	ln -sf /usr/share/java/jetty8-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
-	ln -sf /usr/share/java/jetty8-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
-	ln -sf /usr/share/java/jetty8-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
-	ln -sf /usr/share/java/jetty8-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
-	@# following two are from libservlet3.0-java which is a dependency of libjetty8-java
-	ln -sf /usr/share/java/servlet-api-3.0.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
-	ln -sf /usr/share/java/jsp-api-2.2.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
-
-	@# ubuntu: only in precise trusty vivid
-	@# debian: only in wheezy
-	@#@/bin/echo -e "with-libtomcat6-java=true" >> $(CURDIR)/override.properties
+	@# ubuntu: in xenial
+	@# debian: in jessie-backports stretch sid
+	@#/bin/echo -e "with-libjetty9-java=true" >> $(CURDIR)/override.properties
 	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@# following is from libservlet2.5-java which is a dependency of libtomcat6-java
-	@#ln -sf /usr/share/java/el-api-2.1.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	@#ln -sf /usr/share/java/jetty9-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
+	@#ln -sf /usr/share/java/jetty9-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
+	@#ln -sf /usr/share/java/jetty9-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
+	@#ln -sf /usr/share/java/jetty9-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
+	@#ln -sf /usr/share/java/jetty9-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
+	@#ln -sf /usr/share/java/jetty9-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
+	@#ln -sf /usr/share/java/jetty9-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
+	@#ln -sf /usr/share/java/jetty9-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
+	@#ln -sf /usr/share/java/jetty9-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
+	@#ln -sf /usr/share/java/jetty9-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
+	@#ln -sf /usr/share/java/jetty9-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
+	@#ln -sf /usr/share/java/jetty9-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
+	@#ln -sf /usr/share/java/jetty9-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
+	@#ln -sf /usr/share/java/jetty9-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
+	@# following two are from libservlet3.1-java which is a dependency of libjetty9-java
+	@#ln -sf /usr/share/java/servlet-api-3.1.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
+	@#ln -sf /usr/share/java/jsp-api-2.3.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
 
-	@# debian and ubuntu: everywhere
-	@#/bin/echo -e "with-libtomcat7-java=true" >> $(CURDIR)/override.properties
+	@# debian and ubuntu: wheezy-backports, jessie+, xenial+
+	@#/bin/echo -e "with-libtomcat8-java=true" >> $(CURDIR)/override.properties
 	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/tomcat-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
-	@#ln -sf /usr/share/java/tomcat-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
-	@#ln -sf /usr/share/java/tomcat-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/tomcat-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@# following is from libservlet3.0-java which is a dependency of libtomcat7-java
-	@#ln -sf /usr/share/java/el-api-2.2.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	@#ln -sf /usr/share/java/tomcat8-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
+	@#ln -sf /usr/share/java/tomcat8-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
+	@#ln -sf /usr/share/java/tomcat8-el-api.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	@#ln -sf /usr/share/java/tomcat8-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
+	@#ln -sf /usr/share/java/tomcat8-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
+	@#ln -sf /usr/share/java/tomcat8-jsp-api.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
+	@#ln -sf /usr/share/java/tomcat8-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
+	@#ln -sf /usr/share/java/tomcat8-servlet-api.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
+	@#ln -sf /usr/share/java/tomcat8-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
+	@#ln -sf /usr/share/java/tomcat8-util-scan.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util-scan.jar
 
 	@# debian and ubuntu: everywhere
 	@/bin/echo -e "with-glassfish-javaee=true" >> $(CURDIR)/override.properties
diff --git a/debian-alt/wheezy/README.txt b/debian-alt/wheezy/README.txt
new file mode 100644
index 0000000000..4a25580509
--- /dev/null
+++ b/debian-alt/wheezy/README.txt
@@ -0,0 +1 @@
+Not maintained. Use the precise files instead.
diff --git a/debian-alt/wheezy/control b/debian-alt/wheezy/control
index c9f476c6c1..0c0695d53d 100644
--- a/debian-alt/wheezy/control
+++ b/debian-alt/wheezy/control
@@ -1,5 +1,5 @@
 Source: i2p
-Maintainer: Kill Your TV <killyourtv@i2pmail.org>
+Maintainer: zzz <zzz@i2pmail.org>
 Section: net
 Standards-Version: 3.9.6
 Priority: optional
@@ -7,9 +7,10 @@ Bugs: mailto:killyourtv@i2pmail.org
 Homepage: https://geti2p.net
 Build-Depends: debhelper (>= 7.0.50~)
  ,ant (>= 1.8)
- ,ant-optional
  ,debconf
- ,default-jdk | openjdk-7-jdk | openjdk-6-jdk
+ ,default-jdk | openjdk-7-jdk
+ ,libtomcat8-java
+ ,glassfish-javaee
  ,gettext
  ,dh-apparmor
  ,libgmp3-dev
@@ -71,7 +72,12 @@ Architecture: all
 Section: net
 Priority: optional
 Depends: ${misc:Depends}, ${java:Depends}, ${shlibs:Depends},
- openjdk-8-jre-headless | openjdk-7-jre-headless | openjdk-6-jre-headless | default-jre-headless | java8-runtime-headless | java7-runtime-headless | java6-runtime-headless, libecj-java
+ openjdk-8-jre-headless | openjdk-7-jre-headless | java8-runtime-headless | java7-runtime-headless,
+ libtomcat8-java,
+ geoip-database,
+ gettext-base,
+ libgetopt-java,
+ glassfish-javaee
 Replaces: i2p ( << 0.8.6-5)
 Breaks: i2p (<< 0.8.6-5)
 Recommends: libjbigi-jni, ttf-dejavu
diff --git a/debian-alt/xenial/control b/debian-alt/xenial/control
index 7b55ca9676..3fe552d463 100644
--- a/debian-alt/xenial/control
+++ b/debian-alt/xenial/control
@@ -7,10 +7,11 @@ Bugs: mailto:zzz@i2pmail.org
 Homepage: https://geti2p.net/
 Build-Depends: debhelper (>= 7.0.50~)
  ,ant (>= 1.8)
- ,ant-optional
  ,debconf
  ,openjdk-8-jdk
+ ,libjetty9-java
  ,glassfish-javaee
+ ,libtomcat8-java
  ,dh-apparmor
  ,gettext
  ,libgetopt-java
@@ -73,11 +74,12 @@ Section: net
 Priority: optional
 Depends: ${misc:Depends}, ${java:Depends}, ${shlibs:Depends},
  openjdk-8-jre-headless | java8-runtime-headless,
- libecj-java,
+ libjetty9-java,
+ glassfish-javaee,
+ libtomcat8-java,
  geoip-database,
  gettext-base,
  libgetopt-java,
- glassfish-javaee
 Replaces: i2p ( << 0.8.6-5)
 Breaks: i2p (<< 0.8.6-5)
 Recommends: libjbigi-jni, ttf-dejavu
diff --git a/debian-alt/xenial/rules b/debian-alt/xenial/rules
index 4e87fc72bb..c70f194383 100755
--- a/debian-alt/xenial/rules
+++ b/debian-alt/xenial/rules
@@ -83,50 +83,40 @@ endif
 	@# debian and ubuntu: everywhere
 	@/bin/echo -e "with-geoip-database=true" >> $(CURDIR)/override.properties
 
-	@# ubuntu: not in precise
-	@# debian: in wheezy jessie stretch sid
-	@/bin/echo -e "with-libjetty8-java=true" >> $(CURDIR)/override.properties
+	@# ubuntu: in xenial
+	@# debian: in jessie-backports stretch sid
+	@/bin/echo -e "with-libjetty9-java=true" >> $(CURDIR)/override.properties
 	mkdir -p $(CURDIR)/apps/jetty/jettylib
-	ln -sf /usr/share/java/jetty8-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
-	ln -sf /usr/share/java/jetty8-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
-	ln -sf /usr/share/java/jetty8-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
-	ln -sf /usr/share/java/jetty8-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
-	ln -sf /usr/share/java/jetty8-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
-	ln -sf /usr/share/java/jetty8-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
-	ln -sf /usr/share/java/jetty8-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
-	ln -sf /usr/share/java/jetty8-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
-	ln -sf /usr/share/java/jetty8-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
-	ln -sf /usr/share/java/jetty8-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
-	ln -sf /usr/share/java/jetty8-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
-	ln -sf /usr/share/java/jetty8-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
-	ln -sf /usr/share/java/jetty8-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
-	ln -sf /usr/share/java/jetty8-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
-	@# following two are from libservlet3.0-java which is a dependency of libjetty8-java
-	ln -sf /usr/share/java/servlet-api-3.0.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
-	ln -sf /usr/share/java/jsp-api-2.2.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
+	ln -sf /usr/share/java/jetty9-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
+	ln -sf /usr/share/java/jetty9-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
+	ln -sf /usr/share/java/jetty9-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
+	ln -sf /usr/share/java/jetty9-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
+	ln -sf /usr/share/java/jetty9-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
+	ln -sf /usr/share/java/jetty9-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
+	ln -sf /usr/share/java/jetty9-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
+	ln -sf /usr/share/java/jetty9-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
+	ln -sf /usr/share/java/jetty9-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
+	ln -sf /usr/share/java/jetty9-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
+	ln -sf /usr/share/java/jetty9-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
+	ln -sf /usr/share/java/jetty9-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
+	ln -sf /usr/share/java/jetty9-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
+	ln -sf /usr/share/java/jetty9-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
+	@# following two are from libservlet3.1-java which is a dependency of libjetty9-java
+	ln -sf /usr/share/java/servlet-api-3.1.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
+	@# this is roughly the same as tomcat8-jsp-api.jar, we use this one
+	ln -sf /usr/share/java/jsp-api-2.3.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
 
-	@# ubuntu: only in precise trusty vivid
-	@# debian: only in wheezy
-	@#@/bin/echo -e "with-libtomcat6-java=true" >> $(CURDIR)/override.properties
-	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@# following is from libservlet2.5-java which is a dependency of libtomcat6-java
-	@#ln -sf /usr/share/java/el-api-2.1.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
-
-	@# debian and ubuntu: everywhere
-	@#/bin/echo -e "with-libtomcat7-java=true" >> $(CURDIR)/override.properties
-	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/tomcat-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
-	@#ln -sf /usr/share/java/tomcat-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
-	@#ln -sf /usr/share/java/tomcat-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/tomcat-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@# following is from libservlet3.0-java which is a dependency of libtomcat7-java
-	@#ln -sf /usr/share/java/el-api-2.2.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	@# debian and ubuntu: wheezy-backports, jessie+, xenial+
+	@/bin/echo -e "with-libtomcat8-java=true" >> $(CURDIR)/override.properties
+	mkdir -p $(CURDIR)/apps/jetty/jettylib
+	ln -sf /usr/share/java/tomcat8-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
+	ln -sf /usr/share/java/tomcat8-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
+	ln -sf /usr/share/java/tomcat8-el-api.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	ln -sf /usr/share/java/tomcat8-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
+	ln -sf /usr/share/java/tomcat8-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
+	ln -sf /usr/share/java/tomcat8-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
+	ln -sf /usr/share/java/tomcat8-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
+	ln -sf /usr/share/java/tomcat8-util-scan.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util-scan.jar
 
 	@# debian and ubuntu: everywhere
 	@/bin/echo -e "with-glassfish-javaee=true" >> $(CURDIR)/override.properties
diff --git a/debian/control b/debian/control
index 7a9a12c20b..d665948653 100644
--- a/debian/control
+++ b/debian/control
@@ -7,11 +7,11 @@ Bugs: mailto:zzz@i2pmail.org
 Homepage: https://geti2p.net/
 Build-Depends: debhelper (>= 7.0.50~)
  ,ant (>= 1.8)
- ,ant-optional
  ,debconf
  ,openjdk-7-jdk
- ,libjetty8-java, libservlet3.0-java
+ ,libjetty9-java
  ,glassfish-javaee
+ ,libtomcat8-java
  ,dh-apparmor
  ,gettext
  ,libgetopt-java
@@ -79,8 +79,9 @@ Depends: ${misc:Depends}, ${java:Depends}, ${shlibs:Depends},
  geoip-database,
  gettext-base,
  libgetopt-java,
- libjetty8-java, libservlet3.0-java,
- glassfish-javaee
+ libjetty9-java,
+ glassfish-javaee,
+ libtomcat8-java
 Replaces: i2p ( << 0.8.6-5)
 Breaks: i2p (<< 0.8.6-5)
 Recommends: libjbigi-jni, ttf-dejavu
diff --git a/debian/i2p-router.install b/debian/i2p-router.install
index a61b4e834e..2d514a85f1 100644
--- a/debian/i2p-router.install
+++ b/debian/i2p-router.install
@@ -34,7 +34,7 @@ pkg-temp/lib/streaming.jar usr/share/i2p/lib
 pkg-temp/lib/systray.jar usr/share/i2p/lib
 
 
-# uncomment if not building with libjetty8-java
+# uncomment if not building with libjetty9-java
 # ubuntu: in trusty vivid wily xenial
 # debian: in wheezy jessie stretch sid
 #pkg-temp/lib/jetty-continuation.jar usr/share/i2p/lib
@@ -51,15 +51,15 @@ pkg-temp/lib/systray.jar usr/share/i2p/lib
 #pkg-temp/lib/jetty-xml.jar usr/share/i2p/lib
 #pkg-temp/lib/org.mortbay.jetty.jar usr/share/i2p/lib
 #pkg-temp/lib/org.mortbay.jmx.jar usr/share/i2p/lib
-# following two are from libservlet3.0-java which is a dependency of libjetty8-java
+# following two are from libservlet3.0-java which is a dependency of libjetty9-java
 #pkg-temp/lib/javax.servlet.jar usr/share/i2p/lib
 
 
-# uncomment if not building with either libtomcat6-java or libtomcat7-java
-pkg-temp/lib/commons-el.jar usr/share/i2p/lib
+# uncomment if not building with libtomcat8-java
+#pkg-temp/lib/commons-el.jar usr/share/i2p/lib
 # legacy name, contains only tomcat-juli, not commons-logging
-pkg-temp/lib/commons-logging.jar usr/share/i2p/lib
-pkg-temp/lib/jasper-runtime.jar usr/share/i2p/lib
+#pkg-temp/lib/commons-logging.jar usr/share/i2p/lib
+#pkg-temp/lib/jasper-runtime.jar usr/share/i2p/lib
 
 
 # uncomment if not building with either glassfish-javaee or libjakarta-taglibs-standard-java
diff --git a/debian/i2p-router.links b/debian/i2p-router.links
index e32b48b497..5fd470ffa3 100644
--- a/debian/i2p-router.links
+++ b/debian/i2p-router.links
@@ -6,81 +6,49 @@ usr/share/common-licenses/BSD usr/share/doc/i2p-router/licenses/LICENSE-BSD.txt
 usr/share/java/eclipse-ecj.jar usr/share/i2p/lib/eclipse-ecj.jar
 
 
-# comment out if not building with libjetty8-java
+# comment out if not building with libjetty9-java
 # ubuntu: in trusty vivid wily xenial
 # debian: in wheezy jessie stretch sid
-usr/share/java/jetty8-continuation.jar usr/share/i2p/lib/jetty-continuation.jar
-usr/share/java/jetty8-deploy.jar usr/share/i2p/lib/jetty-deploy.jar
-usr/share/java/jetty8-http.jar usr/share/i2p/lib/jetty-http.jar
-usr/share/java/jetty8-io.jar usr/share/i2p/lib/jetty-io.jar
+usr/share/java/jetty9-apache-jsp.jar usr/share/i2p/lib/jetty-apache-jsp.jar
+usr/share/java/jetty9-continuation.jar usr/share/i2p/lib/jetty-continuation.jar
+usr/share/java/jetty9-deploy.jar usr/share/i2p/lib/jetty-deploy.jar
+usr/share/java/jetty9-http.jar usr/share/i2p/lib/jetty-http.jar
+usr/share/java/jetty9-io.jar usr/share/i2p/lib/jetty-io.jar
 # legacy name in lib/
-usr/share/java/jetty8-rewrite.jar usr/share/i2p/lib/jetty-rewrite-handler.jar
-usr/share/java/jetty8-security.jar usr/share/i2p/lib/jetty-security.jar
-usr/share/java/jetty8-servlet.jar usr/share/i2p/lib/jetty-servlet.jar
-usr/share/java/jetty8-servlets.jar usr/share/i2p/lib/jetty-servlets.jar
-usr/share/java/jetty8-start.jar usr/share/i2p/lib/jetty-start.jar
-usr/share/java/jetty8-util.jar usr/share/i2p/lib/jetty-util.jar
-usr/share/java/jetty8-webapp.jar usr/share/i2p/lib/jetty-webapp.jar
-usr/share/java/jetty8-xml.jar usr/share/i2p/lib/jetty-xml.jar
+usr/share/java/jetty9-rewrite.jar usr/share/i2p/lib/jetty-rewrite-handler.jar
+usr/share/java/jetty9-security.jar usr/share/i2p/lib/jetty-security.jar
+usr/share/java/jetty9-servlet.jar usr/share/i2p/lib/jetty-servlet.jar
+usr/share/java/jetty9-servlets.jar usr/share/i2p/lib/jetty-servlets.jar
+usr/share/java/jetty9-start.jar usr/share/i2p/lib/jetty-start.jar
+usr/share/java/jetty9-util.jar usr/share/i2p/lib/jetty-util.jar
+usr/share/java/jetty9-webapp.jar usr/share/i2p/lib/jetty-webapp.jar
+usr/share/java/jetty9-xml.jar usr/share/i2p/lib/jetty-xml.jar
 # legacy name in lib/
-usr/share/java/jetty8-server.jar usr/share/i2p/lib/org.mortbay.jetty.jar
+usr/share/java/jetty9-server.jar usr/share/i2p/lib/org.mortbay.jetty.jar
 # legacy name in lib/
-usr/share/java/jetty8-jmx.jar usr/share/i2p/lib/org.mortbay.jmx.jar
-# following two are from libservlet3.0-java which is a dependency of libjetty8-java
+usr/share/java/jetty9-jmx.jar usr/share/i2p/lib/org.mortbay.jmx.jar
+# following two are from libservlet3.1-java which is a dependency of libjetty9-java
 # legacy name in lib/
-usr/share/java/servlet-api-3.0.jar usr/share/i2p/lib/javax.servlet.jar
+usr/share/java/servlet-api-3.1.jar usr/share/i2p/lib/javax.servlet.jar
 # combined into javax.servlet.jar in non-package builds
-usr/share/java/jsp-api-2.2.jar usr/share/i2p/lib/jsp-api.jar
-
-
-# comment out if not building with libtomcat6-java
-# ubuntu: only in precise trusty vivid
-# debian: only in wheezy
-# legacy name, contains only tomcat-juli, not commons-logging
-#usr/share/java/tomcat-juli.jar usr/share/i2p/lib/commons-logging.jar
-#usr/share/java/jasper.jar usr/share/i2p/lib/jasper-runtime.jar
-# combined into jasper-runtime.jar in non-package builds
-#usr/share/java/tomcat-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
-# combined into commons-el.jar in non-package builds
-#usr/share/java/jasper-el.jar usr/share/i2p/lib/jasper-el.jar
-# following is from libservlet2.5-java which is a dependency of libtomcat6-java
-# legacy name in lib/
-#usr/share/java/el-api-2.1.jar usr/share/i2p/lib/commons-el.jar
-
-
-# comment out if not building with libtomcat7-java
-# ubuntu: only in precise trusty vivid
-# debian: only in wheezy
-# legacy name, contains only tomcat-juli, not commons-logging
-#usr/share/java/tomcat-juli.jar usr/share/i2p/lib/commons-logging.jar
-#usr/share/java/tomcat-jasper.jar usr/share/i2p/lib/jasper-runtime.jar
-# combined into jasper-runtime.jar in non-package builds
-#usr/share/java/tomcat-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
-# tomcat 7 only
-#usr/share/java/tomcat-api.jar usr/share/i2p/lib/tomcat-api.jar
-#usr/share/java/tomcat-util.jar usr/share/i2p/lib/tomcat-util.jar
-# combined into commons-el.jar in non-package builds
-#usr/share/java/tomcat-jasper-el.jar usr/share/i2p/lib/jasper-el.jar
-# following is from libservlet3.0-java which is a dependency of libtomcat7-java
-# legacy name in lib/
-#usr/share/java/el-api-2.2.jar usr/share/i2p/lib/commons-el.jar
+usr/share/java/jsp-api-2.3.jar usr/share/i2p/lib/jsp-api.jar
 
 
 # comment out if not building with libtomcat8-java
 # ubuntu: only in xenial+
 # debian: wheezy-backports, jessie+
 # legacy name, contains only tomcat-juli, not commons-logging
-#usr/share/java/tomcat8-juli.jar usr/share/i2p/lib/commons-logging.jar
-#usr/share/java/tomcat8-jasper.jar usr/share/i2p/lib/jasper-runtime.jar
+usr/share/java/tomcat8-juli.jar usr/share/i2p/lib/commons-logging.jar
+usr/share/java/tomcat8-jasper.jar usr/share/i2p/lib/jasper-runtime.jar
 # combined into jasper-runtime.jar in non-package builds
-#usr/share/java/tomcat8-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
-# tomcat 7 only
-#usr/share/java/tomcat8-api.jar usr/share/i2p/lib/tomcat-api.jar
-#usr/share/java/tomcat8-util.jar usr/share/i2p/lib/tomcat-util.jar
+usr/share/java/tomcat8-coyote.jar usr/share/i2p/lib/tomcat-coyote.jar
+usr/share/java/tomcat8-api.jar usr/share/i2p/lib/tomcat-api.jar
+usr/share/java/tomcat8-util.jar usr/share/i2p/lib/tomcat-util.jar
+usr/share/java/tomcat8-util-scan.jar usr/share/i2p/lib/tomcat-util-scan.jar
 # combined into commons-el.jar in non-package builds
-#usr/share/java/tomcat8-jasper-el.jar usr/share/i2p/lib/jasper-el.jar
+usr/share/java/tomcat8-jasper-el.jar usr/share/i2p/lib/jasper-el.jar
 # legacy name in lib/
-#usr/share/java/tomcat8-el-api.jar usr/share/i2p/lib/commons-el.jar
+usr/share/java/tomcat8-el-api.jar usr/share/i2p/lib/commons-el.jar
 
 
 # comment out if not building with glassfish-javaee
diff --git a/debian/rules b/debian/rules
index a1277c451c..00f0f6b93b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -83,61 +83,40 @@ endif
 	@# debian and ubuntu: everywhere
 	@/bin/echo -e "with-geoip-database=true" >> $(CURDIR)/override.properties
 
-	@# ubuntu: not in precise
-	@# debian: in wheezy jessie stretch sid
-	@/bin/echo -e "with-libjetty8-java=true" >> $(CURDIR)/override.properties
+	@# ubuntu: in xenial
+	@# debian: in jessie-backports stretch sid
+	@/bin/echo -e "with-libjetty9-java=true" >> $(CURDIR)/override.properties
 	mkdir -p $(CURDIR)/apps/jetty/jettylib
-	ln -sf /usr/share/java/jetty8-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
-	ln -sf /usr/share/java/jetty8-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
-	ln -sf /usr/share/java/jetty8-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
-	ln -sf /usr/share/java/jetty8-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
-	ln -sf /usr/share/java/jetty8-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
-	ln -sf /usr/share/java/jetty8-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
-	ln -sf /usr/share/java/jetty8-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
-	ln -sf /usr/share/java/jetty8-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
-	ln -sf /usr/share/java/jetty8-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
-	ln -sf /usr/share/java/jetty8-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
-	ln -sf /usr/share/java/jetty8-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
-	ln -sf /usr/share/java/jetty8-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
-	ln -sf /usr/share/java/jetty8-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
-	ln -sf /usr/share/java/jetty8-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
-	@# following two are from libservlet3.0-java which is a dependency of libjetty8-java
-	ln -sf /usr/share/java/servlet-api-3.0.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
-	ln -sf /usr/share/java/jsp-api-2.2.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
-
-	@# ubuntu: only in precise trusty vivid
-	@# debian: only in wheezy
-	@#@/bin/echo -e "with-libtomcat6-java=true" >> $(CURDIR)/override.properties
-	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@# following is from libservlet2.5-java which is a dependency of libtomcat6-java
-	@#ln -sf /usr/share/java/el-api-2.1.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
-
-	@# debian and ubuntu: everywhere
-	@#/bin/echo -e "with-libtomcat7-java=true" >> $(CURDIR)/override.properties
-	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/tomcat-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
-	@#ln -sf /usr/share/java/tomcat-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
-	@#ln -sf /usr/share/java/tomcat-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/tomcat-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@# following is from libservlet3.0-java which is a dependency of libtomcat7-java
-	@#ln -sf /usr/share/java/el-api-2.2.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	ln -sf /usr/share/java/jetty9-continuation.jar $(CURDIR)/apps/jetty/jettylib/jetty-continuation.jar
+	ln -sf /usr/share/java/jetty9-deploy.jar $(CURDIR)/apps/jetty/jettylib/jetty-deploy.jar
+	ln -sf /usr/share/java/jetty9-http.jar $(CURDIR)/apps/jetty/jettylib/jetty-http.jar
+	ln -sf /usr/share/java/jetty9-io.jar $(CURDIR)/apps/jetty/jettylib/jetty-io.jar
+	ln -sf /usr/share/java/jetty9-rewrite.jar $(CURDIR)/apps/jetty/jettylib/jetty-rewrite-handler.jar
+	ln -sf /usr/share/java/jetty9-security.jar $(CURDIR)/apps/jetty/jettylib/jetty-security.jar
+	ln -sf /usr/share/java/jetty9-servlet.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlet.jar
+	ln -sf /usr/share/java/jetty9-servlets.jar $(CURDIR)/apps/jetty/jettylib/jetty-servlets.jar
+	ln -sf /usr/share/java/jetty9-start.jar $(CURDIR)/apps/jetty/jettylib/jetty-start.jar
+	ln -sf /usr/share/java/jetty9-util.jar $(CURDIR)/apps/jetty/jettylib/jetty-util.jar
+	ln -sf /usr/share/java/jetty9-webapp.jar $(CURDIR)/apps/jetty/jettylib/jetty-webapp.jar
+	ln -sf /usr/share/java/jetty9-xml.jar $(CURDIR)/apps/jetty/jettylib/jetty-xml.jar
+	ln -sf /usr/share/java/jetty9-server.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jetty.jar
+	ln -sf /usr/share/java/jetty9-jmx.jar $(CURDIR)/apps/jetty/jettylib/org.mortbay.jmx.jar
+	@# following two are from libservlet3.1-java which is a dependency of libjetty9-java
+	ln -sf /usr/share/java/servlet-api-3.1.jar $(CURDIR)/apps/jetty/jettylib/javax.servlet.jar
+	@# this is roughly the same as tomcat8-jsp-api.jar, we use this one
+	ln -sf /usr/share/java/jsp-api-2.3.jar $(CURDIR)/apps/jetty/jettylib/jsp-api.jar
 
 	@# debian and ubuntu: wheezy-backports, jessie+, xenial+
-	@#/bin/echo -e "with-libtomcat8-java=true" >> $(CURDIR)/override.properties
-	@#mkdir -p $(CURDIR)/apps/jetty/jettylib
-	@#ln -sf /usr/share/java/tomcat8-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
-	@#ln -sf /usr/share/java/tomcat8-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
-	@#ln -sf /usr/share/java/tomcat8-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
-	@#ln -sf /usr/share/java/tomcat8-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
-	@#ln -sf /usr/share/java/tomcat8-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
-	@#ln -sf /usr/share/java/tomcat8-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
-	@#ln -sf /usr/share/java/tomcat8-el-api.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	/bin/echo -e "with-libtomcat8-java=true" >> $(CURDIR)/override.properties
+	mkdir -p $(CURDIR)/apps/jetty/jettylib
+	ln -sf /usr/share/java/tomcat8-api.jar $(CURDIR)/apps/jetty/jettylib/tomcat-api.jar
+	ln -sf /usr/share/java/tomcat8-coyote.jar $(CURDIR)/apps/jetty/jettylib/tomcat-coyote.jar
+	ln -sf /usr/share/java/tomcat8-el-api.jar $(CURDIR)/apps/jetty/jettylib/commons-el.jar
+	ln -sf /usr/share/java/tomcat8-jasper.jar $(CURDIR)/apps/jetty/jettylib/jasper-runtime.jar
+	ln -sf /usr/share/java/tomcat8-jasper-el.jar $(CURDIR)/apps/jetty/jettylib/jasper-el.jar
+	ln -sf /usr/share/java/tomcat8-juli.jar $(CURDIR)/apps/jetty/jettylib/commons-logging.jar
+	ln -sf /usr/share/java/tomcat8-util.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util.jar
+	ln -sf /usr/share/java/tomcat8-util-scan.jar $(CURDIR)/apps/jetty/jettylib/tomcat-util-scan.jar
 
 	@# debian and ubuntu: everywhere
 	@/bin/echo -e "with-glassfish-javaee=true" >> $(CURDIR)/override.properties
diff --git a/installer/resources/eepsite/jetty-jmx.xml b/installer/resources/eepsite/jetty-jmx.xml
index 4db0dbb473..aca96f7c2c 100644
--- a/installer/resources/eepsite/jetty-jmx.xml
+++ b/installer/resources/eepsite/jetty-jmx.xml
@@ -1,103 +1,43 @@
 <?xml version="1.0"?>
-<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
 
-<!-- ============================================================================ -->
-<!-- To correctly start Jetty with JMX module enabled, this configuration         -->
-<!-- file must appear first in the list of the configuration files.               -->
-<!-- The simplest way to achieve this is to add etc/jetty-jmx.xml as the          -->
-<!-- first file in configuration file list at the end of start.ini file.          -->
-<!-- ============================================================================ -->
 <Configure id="Server" class="org.eclipse.jetty.server.Server">
 
   <!-- =========================================================== -->
   <!-- Set the java.rmi.server.hostname property in case you've    -->
   <!-- got a misconfigured /etc/hosts entry or the like.           -->
   <!-- =========================================================== -->
-  <!-- 
+  <!--
   <Call class="java.lang.System" name="setProperty">
     <Arg>java.rmi.server.hostname</Arg>
     <Arg>127.0.0.1</Arg>
   </Call>
   -->
-  
+
   <!-- =========================================================== -->
-  <!-- Initialize an mbean server                                  -->
+  <!-- Get the platform mbean server                               -->
   <!-- =========================================================== -->
   <Call id="MBeanServer" class="java.lang.management.ManagementFactory"
     name="getPlatformMBeanServer" />
 
   <!-- =========================================================== -->
-  <!-- Initialize the Jetty MBean container                        -->
+  <!-- Initialize the Jetty MBean container -->
   <!-- =========================================================== -->
-  <New id="MBeanContainer" class="org.eclipse.jetty.jmx.MBeanContainer">
-    <Arg><Ref id="MBeanServer" /></Arg>
-    <Call name="start"/>
-  </New>
-
-  <!-- Add to the Server to listen for object events -->
-  <Get id="Container" name="container">
-    <Call name="addEventListener">
-      <Arg><Ref id="MBeanContainer" /></Arg>
-    </Call>
-  </Get>
-
-  <!-- Add to the Server as a managed lifecycle -->
   <Call name="addBean">
-    <Arg><Ref id="MBeanContainer"/></Arg>
-    <Arg type="boolean">true</Arg>
+    <Arg>
+      <New id="MBeanContainer" class="org.eclipse.jetty.jmx.MBeanContainer">
+        <Arg>
+          <Ref refid="MBeanServer" />
+        </Arg>
+      </New>
+    </Arg>
   </Call>
 
   <!-- Add the static log -->
-  <Ref id="MBeanContainer">
-    <Call name="addBean">
-      <Arg>
-        <New class="org.eclipse.jetty.util.log.Log"/>
-      </Arg>
-    </Call>
-  </Ref>
-  
-  <!-- In order to connect to the JMX server remotely from a different
-       process, possibly running on a different host, Jetty JMX module
-       can create a remote JMX connector. It requires RMI registry to
-       be started prior to creating the connector server because the
-       JMX specification uses RMI to facilitate connections.        
-   -->
-
-  <!-- Optionally start the RMI registry. Normally RMI registry runs on
-       port 1099. The argument below can be changed in order to comply
-       with the firewall requirements.
-  -->
-  <!--
-  <Call name="createRegistry" class="java.rmi.registry.LocateRegistry">
-    <Arg type="java.lang.Integer"><SystemProperty name="jetty.jmxrmiport" default="1099"/></Arg>
-    <Call name="sleep" class="java.lang.Thread">
-       <Arg type="java.lang.Integer">1000</Arg>
-    </Call>
-  </Call>
-  -->
- 
-  <!-- Optionally add a remote JMX connector. The parameters of the constructor
-       below specify the JMX service URL, and the object name string for the
-       connector server bean. The parameters of the JMXServiceURL constructor 
-       specify the protocol that clients will use to connect to the remote JMX
-       connector (RMI), the hostname of the server (local hostname), port number
-       (automatically assigned), and the URL path. Note that URL path contains
-       the RMI registry hostname and port number, that may need to be modified
-       in order to comply with the firewall requirements. 
-  -->
-  <!--
-  <New id="ConnectorServer" class="org.eclipse.jetty.jmx.ConnectorServer">
+  <Call name="addBean">
     <Arg>
-      <New class="javax.management.remote.JMXServiceURL">
-        <Arg type="java.lang.String">rmi</Arg>
-        <Arg type="java.lang.String" />
-        <Arg type="java.lang.Integer"><SystemProperty name="jetty.jmxrmiport" default="1099"/></Arg>
-        <Arg type="java.lang.String">/jndi/rmi://<SystemProperty name="jetty.jmxrmihost" default="localhost"/>:<SystemProperty name="jetty.jmxrmiport" default="1099"/>/jmxrmi</Arg>
-      </New>
+      <New class="org.eclipse.jetty.util.log.Log" />
     </Arg>
-    <Arg>org.eclipse.jetty.jmx:name=rmiconnectorserver</Arg>
-    <Call name="start" />
-  </New>
-  -->
+  </Call>
 </Configure>
 
diff --git a/installer/resources/eepsite/jetty-rewrite.xml b/installer/resources/eepsite/jetty-rewrite.xml
index 1d208f8bfc..1f93937d5b 100644
--- a/installer/resources/eepsite/jetty-rewrite.xml
+++ b/installer/resources/eepsite/jetty-rewrite.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
 
 <!-- =============================================================== -->
 <!-- Mixin the RewriteHandler                                        -->
@@ -9,13 +9,13 @@
 <Configure id="Server" class="org.eclipse.jetty.server.Server">
 
     <!-- =========================================================== -->
-    <!-- configure rewrite handler                                   --> 
+    <!-- configure rewrite handler                                   -->
     <!-- =========================================================== -->
     <Get id="oldhandler" name="handler"/>
 
     <Set name="handler">
      <New id="Rewrite" class="org.eclipse.jetty.rewrite.handler.RewriteHandler">
-      <Set name="handler"><Ref id="oldhandler"/></Set>
+      <Set name="handler"><Ref refid="oldhandler"/></Set>
       <Set name="rewriteRequestURI">true</Set>
       <Set name="rewritePathInfo">false</Set>
       <Set name="originalPathAttribute">requestedPath</Set>
@@ -68,7 +68,7 @@
           </New>
         </Arg>
       </Call>
-      
+
       <!-- reverse the order of the path sections -->
       <Call name="addRule">
         <Arg>
@@ -89,7 +89,7 @@
           </New>
         </Arg>
       </Call>
-      
+
       <!--  actual redirect, instead of internal rewrite -->
       <Call name="addRule">
         <Arg>
@@ -113,5 +113,5 @@
 
      </New>
     </Set>
-    
+
 </Configure>
diff --git a/installer/resources/eepsite/jetty-ssl.xml b/installer/resources/eepsite/jetty-ssl.xml
index b91d5c25cb..5b42684334 100644
--- a/installer/resources/eepsite/jetty-ssl.xml
+++ b/installer/resources/eepsite/jetty-ssl.xml
@@ -1,6 +1,8 @@
 <?xml version="1.0"?>
 <!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
 
+<!-- This configuration supports Jetty 9. Do not remove this line. -->
+
 <!-- ========================================================================= -->
 <!-- If you have a 'split' directory installation, with configuration          -->
 <!-- files in ~/.i2p (Linux), %APPDATA%\I2P (Windows),                         -->
@@ -175,87 +177,108 @@
 
 <Configure id="Server" class="org.eclipse.jetty.server.Server">
 
-  <!-- if NIO is not available, use org.eclipse.jetty.server.ssl.SslSocketConnector -->
-  
-  <New id="sslContextFactory" class="org.eclipse.jetty.http.ssl.SslContextFactory">
-    <Set name="KeyStore">./eepsite/etc/keystore.ks</Set>
+  <New id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory">
+    <Set name="KeyStorePath">./eepsite/etc/keystore.ks</Set>
     <Set name="KeyStorePassword">changeit</Set>
     <Set name="KeyManagerPassword">myKeyPassword</Set>
-    <Set name="TrustStore">./eepsite/etc/keystore.ks</Set>
+    <Set name="TrustStorePath">./eepsite/etc/keystore.ks</Set>
     <Set name="TrustStorePassword">changeit</Set>
+    <Set name="ExcludeCipherSuites">
+      <Array type="java.lang.String">
+        <Item>SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA</Item>
+        <Item>SSL_DH_anon_EXPORT_WITH_RC4_40_MD5</Item>
+        <Item>SSL_DH_anon_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>SSL_DH_anon_WITH_DES_CBC_SHA</Item>
+        <Item>SSL_DH_anon_WITH_RC4_128_MD5</Item>
+        <Item>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</Item>
+        <Item>SSL_DHE_DSS_WITH_DES_CBC_SHA</Item>
+        <Item>SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
+        <Item>SSL_DHE_RSA_WITH_DES_CBC_SHA</Item>
+        <Item>SSL_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
+        <Item>SSL_RSA_EXPORT_WITH_RC4_40_MD5</Item>
+        <Item>SSL_RSA_WITH_DES_CBC_SHA</Item>
+        <Item>SSL_RSA_WITH_NULL_MD5</Item>
+        <Item>SSL_RSA_WITH_NULL_SHA</Item>
+        <Item>TLS_DH_anon_WITH_AES_128_CBC_SHA</Item>
+        <Item>TLS_DH_anon_WITH_AES_128_CBC_SHA256</Item>
+        <Item>TLS_DH_anon_WITH_AES_128_GCM_SHA256</Item>
+        <Item>TLS_DH_anon_WITH_AES_256_CBC_SHA</Item>
+        <Item>TLS_DH_anon_WITH_AES_256_CBC_SHA256</Item>
+        <Item>TLS_DH_anon_WITH_AES_256_GCM_SHA384</Item>
+        <Item>TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>TLS_ECDH_anon_WITH_AES_128_CBC_SHA</Item>
+        <Item>TLS_ECDH_anon_WITH_AES_256_CBC_SHA</Item>
+        <Item>TLS_ECDH_anon_WITH_NULL_SHA</Item>
+        <Item>TLS_ECDH_anon_WITH_RC4_128_SHA</Item>
+        <Item>TLS_ECDH_ECDSA_WITH_NULL_SHA</Item>
+        <Item>TLS_ECDHE_ECDSA_WITH_NULL_SHA</Item>
+        <Item>TLS_ECDHE_RSA_WITH_NULL_SHA</Item>
+        <Item>TLS_ECDH_RSA_WITH_NULL_SHA</Item>
+        <Item>TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5</Item>
+        <Item>TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA</Item>
+        <Item>TLS_KRB5_EXPORT_WITH_RC4_40_MD5</Item>
+        <Item>TLS_KRB5_EXPORT_WITH_RC4_40_SHA</Item>
+        <Item>TLS_KRB5_WITH_3DES_EDE_CBC_MD5</Item>
+        <Item>TLS_KRB5_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>TLS_KRB5_WITH_DES_CBC_MD5</Item>
+        <Item>TLS_KRB5_WITH_DES_CBC_SHA</Item>
+        <Item>TLS_KRB5_WITH_RC4_128_MD5</Item>
+        <Item>TLS_KRB5_WITH_RC4_128_SHA</Item>
+        <Item>TLS_RSA_WITH_NULL_SHA256</Item>
+        <Item>SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>SSL_RSA_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>SSL_RSA_WITH_RC4_128_MD5</Item>
+        <Item>SSL_RSA_WITH_RC4_128_SHA</Item>
+        <Item>TLS_ECDH_ECDSA_WITH_RC4_128_SHA</Item>
+        <Item>TLS_ECDH_RSA_WITH_RC4_128_SHA</Item>
+        <Item>TLS_ECDHE_ECDSA_WITH_RC4_128_SHA</Item>
+        <Item>TLS_ECDHE_RSA_WITH_RC4_128_SHA</Item>
+        <Item>TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
+        <Item>TLS_DHE_DSS_WITH_AES_128_CBC_SHA</Item>
+        <!-- Please keep this list in sync with the one in I2PSSLSocketFactory -->
+      </Array>
+    </Set>
+    <Set name="ExcludeProtocols">
+      <Array type="java.lang.String">
+        <Item>SSLv2Hello</Item>
+        <Item>SSLv3</Item>
+      </Array>
+    </Set>
   </New>
 
   <Call name="addConnector">
     <Arg>
-      <New class="org.eclipse.jetty.server.ssl.SslSelectChannelConnector">
-        <Arg><Ref id="sslContextFactory" /></Arg>
+      <New class="org.eclipse.jetty.server.ServerConnector">
+        <Arg><Ref id="Server" /></Arg>
+        <Arg type="int">1</Arg>     <!-- number of acceptors -->
+        <Arg type="int">0</Arg>     <!-- default number of selectors -->
+        <Arg>
+           <Array type="org.eclipse.jetty.server.ConnectionFactory">    <!-- varargs so we need an array -->
+              <Item>
+                <New class="org.eclipse.jetty.server.SslConnectionFactory">
+                  <Arg><Ref id="sslContextFactory" /></Arg>
+                  <Arg>http/1.1</Arg>
+                </New>
+              </Item>
+              <Item>
+                <New class="org.eclipse.jetty.server.HttpConnectionFactory">
+                  <Arg>
+                    <New class="org.eclipse.jetty.server.HttpConfiguration">
+                      <Set name="sendServerVersion">false</Set>
+                      <Set name="sendDateHeader">true</Set>
+                    </New>
+                  </Arg>
+                </New>
+              </Item>
+            </Array>
+        </Arg>
         <Set name="host">127.0.0.1</Set>
         <Set name="port">7668</Set>
-        <Set name="maxIdleTime">600000</Set>
-        <Set name="useDirectBuffers">false</Set>
-        <Set name="acceptors">1</Set>
-        <Set name="statsOn">false</Set>
-        <Set name="lowResourcesConnections">5000</Set>
-        <Set name="lowResourcesMaxIdleTime">5000</Set>
-        <Set name="ExcludeCipherSuites">
-          <Array type="java.lang.String">
-            <Item>SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA</Item>
-            <Item>SSL_DH_anon_EXPORT_WITH_RC4_40_MD5</Item>
-            <Item>SSL_DH_anon_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>SSL_DH_anon_WITH_DES_CBC_SHA</Item>
-            <Item>SSL_DH_anon_WITH_RC4_128_MD5</Item>
-            <Item>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</Item>
-            <Item>SSL_DHE_DSS_WITH_DES_CBC_SHA</Item>
-            <Item>SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
-            <Item>SSL_DHE_RSA_WITH_DES_CBC_SHA</Item>
-            <Item>SSL_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
-            <Item>SSL_RSA_EXPORT_WITH_RC4_40_MD5</Item>
-            <Item>SSL_RSA_WITH_DES_CBC_SHA</Item>
-            <Item>SSL_RSA_WITH_NULL_MD5</Item>
-            <Item>SSL_RSA_WITH_NULL_SHA</Item>
-            <Item>TLS_DH_anon_WITH_AES_128_CBC_SHA</Item>
-            <Item>TLS_DH_anon_WITH_AES_128_CBC_SHA256</Item>
-            <Item>TLS_DH_anon_WITH_AES_128_GCM_SHA256</Item>
-            <Item>TLS_DH_anon_WITH_AES_256_CBC_SHA</Item>
-            <Item>TLS_DH_anon_WITH_AES_256_CBC_SHA256</Item>
-            <Item>TLS_DH_anon_WITH_AES_256_GCM_SHA384</Item>
-            <Item>TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>TLS_ECDH_anon_WITH_AES_128_CBC_SHA</Item>
-            <Item>TLS_ECDH_anon_WITH_AES_256_CBC_SHA</Item>
-            <Item>TLS_ECDH_anon_WITH_NULL_SHA</Item>
-            <Item>TLS_ECDH_anon_WITH_RC4_128_SHA</Item>
-            <Item>TLS_ECDH_ECDSA_WITH_NULL_SHA</Item>
-            <Item>TLS_ECDHE_ECDSA_WITH_NULL_SHA</Item>
-            <Item>TLS_ECDHE_RSA_WITH_NULL_SHA</Item>
-            <Item>TLS_ECDH_RSA_WITH_NULL_SHA</Item>
-            <Item>TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5</Item>
-            <Item>TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA</Item>
-            <Item>TLS_KRB5_EXPORT_WITH_RC4_40_MD5</Item>
-            <Item>TLS_KRB5_EXPORT_WITH_RC4_40_SHA</Item>
-            <Item>TLS_KRB5_WITH_3DES_EDE_CBC_MD5</Item>
-            <Item>TLS_KRB5_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>TLS_KRB5_WITH_DES_CBC_MD5</Item>
-            <Item>TLS_KRB5_WITH_DES_CBC_SHA</Item>
-            <Item>TLS_KRB5_WITH_RC4_128_MD5</Item>
-            <Item>TLS_KRB5_WITH_RC4_128_SHA</Item>
-            <Item>TLS_RSA_WITH_NULL_SHA256</Item>
-            <Item>SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>SSL_RSA_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>SSL_RSA_WITH_RC4_128_MD5</Item>
-            <Item>SSL_RSA_WITH_RC4_128_SHA</Item>
-            <Item>TLS_ECDH_ECDSA_WITH_RC4_128_SHA</Item>
-            <Item>TLS_ECDH_RSA_WITH_RC4_128_SHA</Item>
-            <Item>TLS_ECDHE_ECDSA_WITH_RC4_128_SHA</Item>
-            <Item>TLS_ECDHE_RSA_WITH_RC4_128_SHA</Item>
-            <Item>TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
-            <Item>TLS_DHE_DSS_WITH_AES_128_CBC_SHA</Item>
-            <!-- Please keep this list in sync with the one in I2PSSLSocketFactory -->
-          </Array>
-        </Set>
+        <Set name="idleTimeout">600000</Set>
       </New>
     </Arg>
   </Call>
diff --git a/installer/resources/eepsite/jetty.xml b/installer/resources/eepsite/jetty.xml
index 5e9ad9e840..dd2be4dddb 100644
--- a/installer/resources/eepsite/jetty.xml
+++ b/installer/resources/eepsite/jetty.xml
@@ -1,6 +1,8 @@
 <?xml version="1.0" encoding="UTF-8" ?> 
 <!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
 
+<!-- This configuration supports Jetty 9. Do not remove this line. -->
+
 <!-- ========================================================================= -->
 <!-- This file configures the Jetty server.                                    -->
 <!-- All changes require a restart of I2P.                                     -->
@@ -12,16 +14,16 @@
 <!--   * port: Default 7658 in the addConnector section                         -->
 <!--   * docroot: Change the ResourceBase in the contexts/base-context.xml file -->
 <!--           to serve files from a different location.                       -->
-<!--   * threads: Raise maximumPoolSize in the ThreadPool section              -->
+<!--   * threads: Raise maxThreads in the ThreadPool section                   -->
 <!--           if you have a high-traffic site and get a lot of warnings.      -->
 <!--   * Uncomment the addWebApplications section to use to enable             -->
 <!--           war files placed in the webapps/ dir.                           -->
 <!--   * Uncomment the line to allow Jetty to follow symlinks                  -->
 <!--                                                                           -->
-<!-- I2P uses Jetty 7. If you need web server features not found               -->
-<!-- in Jetty 7, you may install and run Jetty 7 or 8 in a different JVM       -->
+<!-- I2P uses Jetty 9. If you need web server features not found               -->
+<!-- in Jetty 9, you may install and run Jetty 7 or 8 in a different JVM       -->
 <!-- or run any other web server such as Apache. If you do run another web     -->
-<!-- server instead, be sure and disable the Jetty 6 server for your           -->
+<!-- server instead, be sure and disable the Jetty 9 server for your           -->
 <!-- eepsite on http://127.0.0.1:7657/configclients.jsp .                      -->
 <!--                                                                           -->
 <!-- Jetty now uses the I2P logging system rather than wrapper.log.            -->
@@ -41,13 +43,13 @@
 <!--                                                                           -->
 <!-- ========================================================================= -->
 
-<!-- =============================================================== -->
-<!-- Configure the Jetty Server                                      -->
-<!--                                                                 -->
-<!-- Documentation of this file format can be found at:              -->
-<!-- http://docs.codehaus.org/display/JETTY/jetty.xml                -->
-<!--                                                                 -->
-<!-- =============================================================== -->
+<!-- ========================================================================= -->
+<!-- Configure the Jetty Server                                                -->
+<!--                                                                           -->
+<!-- Documentation of this file format can be found at:                        -->
+<!-- http://www.eclipse.org/jetty/documentation/current/jetty-xml-config.html  -->
+<!--                                                                           -->
+<!-- ========================================================================= -->
 
 
 <Configure id="Server" class="org.eclipse.jetty.server.Server">
@@ -55,7 +57,7 @@
     <!-- =========================================================== -->
     <!-- Server Thread Pool                                          -->
     <!-- =========================================================== -->
-    <Set name="ThreadPool">
+    <Arg>
 
       <!-- PICK ONE -->
 
@@ -71,6 +73,9 @@
            http://trac.i2p2.i2p/ticket/1395
        -->
       <New class="org.eclipse.jetty.util.thread.QueuedThreadPool">
+        <Arg type="int">20</Arg>     <!-- maxThreads, overridden below -->
+        <Arg type="int">3</Arg>      <!-- minThreads, overridden below -->
+        <Arg type="int">60000</Arg>  <!-- maxIdleTimeMs, overridden below -->
         <Arg>
            <New class="java.util.concurrent.LinkedBlockingQueue">
               <Arg type="int">40</Arg>
@@ -78,43 +83,11 @@
         </Arg>
         <Set name="minThreads">3</Set>
         <Set name="maxThreads">20</Set>
-        <Set name="maxIdleTimeMs">60000</Set>
+        <Set name="idleTimeout">60000</Set>
         <Set name="daemon">true</Set>
         <Set name="name">Eepsite Jetty</Set>
       </New>
-
-      <!-- Optional Java 5 bounded threadpool with job queue 
-           Requests above the max will be rejected and logged.
-           High-traffic sites should increase maximumPoolSize.
-
-           Args are:
-             corePoolSize (should be at least 3)
-             maximumPoolSize
-             keepAliveTime (milliseconds)
-             timeout (TimeUnit)
-             queue (BlockingQueue)
-
-           Not recommended.
-           ref:
-           http://trac.i2p2.i2p/ticket/1395
-           http://docs.oracle.com/javase/6/docs/api/java/util/concurrent/ThreadPoolExecutor.html
-       -->
-     <!--
-      <New class="org.eclipse.jetty.util.thread.ExecutorThreadPool">
-        <Arg type="int">3</Arg>
-        <Arg type="int">20</Arg>
-        <Arg type="long">60000</Arg>
-        <Arg>
-            <Call class="java.util.concurrent.TimeUnit" name="valueOf" >
-                <Arg>MILLISECONDS</Arg>
-            </Call>
-        </Arg>
-        <Arg>
-            <New class="java.util.concurrent.SynchronousQueue" />
-        </Arg>
-      </New>
-     -->
-    </Set>
+    </Arg>
 
 
 
@@ -133,36 +106,31 @@
     -->    
     <Call name="addConnector">
       <Arg>
-          <New class="org.eclipse.jetty.server.nio.SelectChannelConnector">
+          <New class="org.eclipse.jetty.server.ServerConnector">
+            <Arg><Ref id="Server" /></Arg>
+            <Arg type="int">1</Arg>     <!-- number of acceptors -->
+            <Arg type="int">0</Arg>     <!-- default number of selectors -->
+            <Arg>
+              <Array type="org.eclipse.jetty.server.ConnectionFactory">    <!-- varargs so we need an array -->
+                <Item>
+                  <New class="org.eclipse.jetty.server.HttpConnectionFactory">
+                    <Arg>
+                      <New class="org.eclipse.jetty.server.HttpConfiguration">
+                        <Set name="sendServerVersion">false</Set>
+                        <Set name="sendDateHeader">true</Set>
+                      </New>
+                    </Arg>
+                  </New>
+                </Item>
+              </Array>
+            </Arg>
             <Set name="host">127.0.0.1</Set>
             <Set name="port">7658</Set>
-            <Set name="maxIdleTime">600000</Set>
-            <Set name="Acceptors">1</Set>
-            <Set name="statsOn">false</Set>
-	    <Set name="lowResourcesConnections">5000</Set>
-	    <Set name="lowResourcesMaxIdleTime">5000</Set>
-	    <Set name="useDirectBuffers">false</Set>
+            <Set name="idleTimeout">600000</Set>
           </New>
       </Arg>
     </Call>
 
-    <!-- Recommended to use this connector on Java 5, as
-         Jetty 6 and Java 5 NIO don't play well together.
-    -->
-    <!--
-    <Call name="addConnector">
-      <Arg>
-          <New class="org.eclipse.jetty.server.bio.SocketConnector">
-            <Set name="host">127.0.0.1</Set>
-            <Set name="port">7658</Set>
-            <Set name="maxIdleTime">600000</Set>
-            <Set name="Acceptors">1</Set>
-            <Set name="statsOn">false</Set>
-          </New>
-      </Arg>
-    </Call>
-    -->
-
     <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
     <!-- To add a HTTPS SSL listener                                     -->
     <!-- see jetty-ssl.xml to add an ssl connector. use                  -->
@@ -242,7 +210,7 @@
     <Ref id="DeploymentManager">
       <Call name="addAppProvider">
         <Arg>
-          <New class="org.eclipse.jetty.deploy.providers.ContextProvider">
+          <New class="org.eclipse.jetty.deploy.providers.WebAppProvider">
             <Set name="monitoredDirName">./eepsite/contexts</Set>
             <Set name="scanInterval">120</Set>
           </New>
@@ -332,8 +300,6 @@
     <!-- extra options                                               -->
     <!-- =========================================================== -->
     <Set name="stopAtShutdown">true</Set>
-    <Set name="sendServerVersion">false</Set>
-    <Set name="sendDateHeader">true</Set>
-    <Set name="gracefulShutdown">1000</Set>
+    <Set name="stopTimeout">1000</Set>
 
 </Configure>
diff --git a/router/java/src/net/i2p/router/startup/MigrateJetty.java b/router/java/src/net/i2p/router/startup/MigrateJetty.java
index ed461c6ed4..db6476baac 100644
--- a/router/java/src/net/i2p/router/startup/MigrateJetty.java
+++ b/router/java/src/net/i2p/router/startup/MigrateJetty.java
@@ -6,13 +6,25 @@ package net.i2p.router.startup;
  */
 
 import java.io.File;
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.OutputStreamWriter;
+import java.io.IOException;
+import java.io.PrintWriter;
 import java.util.List;
 
+import net.i2p.data.DataHelper;
 import net.i2p.router.RouterContext;
+import net.i2p.util.FileUtil;
+import net.i2p.util.I2PSSLSocketFactory;
+import net.i2p.util.SecureFileOutputStream;
+import net.i2p.util.VersionComparator;
 
 /**
  *  Migrate the clients.config and jetty.xml files
- *  from Jetty 5/6 to Jetty 7.
+ *  from Jetty 5/6 to Jetty 7/8.
+ *  Also migrate jetty.xml from Jetty 7/8 to Jetty 9.
  *
  *  For each client for class org.mortbay.jetty.Server:
  *<pre>
@@ -29,7 +41,8 @@ import net.i2p.router.RouterContext;
  *  Copies clients.config to clients.config.jetty6;
  *  Saves new clients.config.
  *
- *  Does NOT preserve port number, thread counts, etc.
+ *  Does NOT preserve port number, thread counts, etc. in the migration to 7/8.
+ *  DOES preserve everything in the migration to 9.
  *
  *  @since Jetty 6
  */
@@ -42,24 +55,43 @@ abstract class MigrateJetty {
     private static final String NEW_CLASS = "net.i2p.jetty.JettyStart";
     private static final String TEST_CLASS = "org.eclipse.jetty.server.Server";
     private static final String BACKUP_SUFFIX = ".jetty6";
-    private static final String JETTY_TEMPLATE_DIR = "eepsite-jetty7";
+    private static final String BACKUP_SUFFIX_8 = ".jetty8";
+    private static final String JETTY_TEMPLATE_DIR = "eepsite-jetty9";
     private static final String JETTY_TEMPLATE_PKGDIR = "eepsite";
     private static final String BASE_CONTEXT = "contexts/base-context.xml";
     private static final String CGI_CONTEXT = "contexts/cgi-context.xml";
+    private static final String PROP_JETTY9_MIGRATED = "router.startup.jetty9.migrated";
     
     /**
      *  For each entry in apps, if the main class is an old Jetty class,
      *  migrate it to the new Jetty class, and update the Jetty config files.
      */
     public static void migrate(RouterContext ctx, List<ClientAppConfig> apps) {
+        if (ctx.getBooleanProperty(PROP_JETTY9_MIGRATED))
+            return;
+        String installed = ctx.getProperty("router.firstVersion");
+        if (installed != null && VersionComparator.comp(installed, "0.9.30") >= 0) {
+            ctx.router().saveConfig(PROP_JETTY9_MIGRATED, "true");
+            return;
+        }
         boolean shouldSave = false;
+        boolean jetty9success = false;
         for (int i = 0; i < apps.size(); i++) {
             ClientAppConfig app = apps.get(i);
-            if (!(app.className.equals(OLD_CLASS) || app.className.equals(OLD_CLASS_6)))
+            String client;
+            String backupSuffix;
+            if (app.className.equals(NEW_CLASS)) {
+                client = "client application " + i + " [" + app.clientName +
+                         "] from Jetty 7/8 to Jetty 9";
+                backupSuffix = BACKUP_SUFFIX_8;
+            } else if (app.className.equals(OLD_CLASS) || app.className.equals(OLD_CLASS_6)) {
+                client = "client application " + i + " [" + app.clientName +
+                         "] from Jetty 5/6 " + app.className +
+                         " to Jetty 9 " + NEW_CLASS;
+                backupSuffix = BACKUP_SUFFIX;
+            } else {
                 continue;
-            String client = "client application " + i + " [" + app.clientName +
-                            "] from Jetty 5/6 " + app.className +
-                            " to Jetty 7 " + NEW_CLASS;
+            }
             if (!hasLatestJetty()) {
                 System.err.println("WARNING: Jetty 7 unavailable, cannot migrate " + client);
                 continue;
@@ -80,12 +112,38 @@ abstract class MigrateJetty {
                 continue;
             }
             File eepsite = xmlFile.getParentFile();
-            boolean ok = backupFile(xmlFile);
+            boolean ok = backupFile(xmlFile, backupSuffix);
             if (!ok) {
                 System.err.println("WARNING: Failed to backup up XML file " + xmlFile +
                                ", cannot migrate " + client);
                 continue;
             }
+            if (app.className.equals(NEW_CLASS)) {
+                // Do the migration of 8 to 9, handle additional command-line xml files too
+                for (int j = 0; j < args.length; j++) {
+                    if (j > 0) {
+                        // probably jetty-ssl.xml
+                        xmlFile = new File(args[j]);
+                        ok = backupFile(xmlFile, backupSuffix);
+                        if (!ok) {
+                            System.err.println("WARNING: Failed to backup up XML file " + xmlFile +
+                                               ", cannot migrate " + client);
+                            continue;
+                        }
+                    }
+                    boolean ok9 = migrateToJetty9(xmlFile);
+                    if (ok9) {
+                        System.err.println("WARNING: Migrated " + client + ".\n" +
+                                           "Check the " + xmlFile.getName() + " file in " + eepsite + ".\n" +
+                                           "Your old " + xmlFile.getName() + " file was backed up to " + xmlFile.getAbsolutePath() + BACKUP_SUFFIX_8);
+                        jetty9success = true;
+                    }
+                }
+                continue;
+            }
+
+            // Below here is migration of 5/6 to 9
+
             File baseEep = new File(ctx.getBaseDir(), JETTY_TEMPLATE_DIR);
             // in packages, or perhaps on an uninstall/reinstall, the files are in eepsite/
             if (!baseEep.exists())
@@ -141,12 +199,228 @@ abstract class MigrateJetty {
                 ClientAppConfig.writeClientAppConfig(ctx, apps);
                 System.err.println("WARNING: Migrated clients config file " + cfgFile +
                                " from Jetty 5/6 " + OLD_CLASS + '/' + OLD_CLASS_6 +
-                               " to Jetty 7 " + NEW_CLASS);
+                               " to Jetty 9 " + NEW_CLASS);
             }
         }
+        if (jetty9success)
+            ctx.router().saveConfig(PROP_JETTY9_MIGRATED, "true");
+    }
+
+    /**
+     *  Migrate a jetty.xml file to Jetty 9.
+     *  Unlike above, where we just migrate the new install file over for Jetty 9,
+     *  here we modify the xml file in-place to preserve settings where possible.
+     *
+     *  @return success
+     *  @since Jetty 9
+     */
+    private static boolean migrateToJetty9(File xmlFile) {
+        if (xmlFile.getName().equals("jetty-jmx.xml")) {
+            // This is lazy but nobody's using jmx, not worth the trouble
+            System.err.println("ERROR: Migration  of " + xmlFile +
+                               " file is not supported. Copy new file from $I2P/eepsite-jetty9/jetty-jmx.xml");
+            return false;
+        }
+        // we don't re-migrate from the template, we just add the
+        // necessary args for the QueuedThreadPool constructor in-place
+        // and fixup the renamed set call
+        boolean modified = false;
+        File eepsite = xmlFile.getParentFile();
+        File newFile = new File(eepsite, xmlFile.getName() + System.currentTimeMillis() + ".tmp");
+        FileInputStream in = null;
+        PrintWriter out = null;
+        try {
+            in = new FileInputStream(xmlFile);
+            out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(new SecureFileOutputStream(newFile), "UTF-8")));
+            String s;
+            boolean foundQTP = false;
+            boolean foundSTP = false;
+            boolean foundETP = false;
+            boolean foundSCC = false;
+            boolean foundHC = false;
+            boolean foundSSCC = false;
+            while ((s = DataHelper.readLine(in)) != null) {
+                // readLine() doesn't strip \r
+                if (s.endsWith("\r"))
+                    s = s.substring(0, s.length() - 1);
+                if (s.contains("Modified by I2P migration script for Jetty 9.") ||
+                    s.contains("This configuration supports Jetty 9.") ||
+                    s.contains("http://www.eclipse.org/jetty/configure_9_0.dtd")) {
+                    if (!modified)
+                        break;
+                    // else we've modified it twice?
+                } else if (s.contains("org.eclipse.jetty.util.thread.QueuedThreadPool")) {
+                    foundQTP = true;
+                } else if (foundQTP) {
+                    if (!(s.contains("Modified by") || s.contains("<Arg type=\"int\">"))) {
+                        out.println("        <!-- Modified by I2P migration script for Jetty 9. Do not remove this line -->");
+                        out.println("        <Arg type=\"int\">20</Arg>     <!-- maxThreads, overridden below -->");
+                        out.println("        <Arg type=\"int\">3</Arg>      <!-- minThreads, overridden below -->");
+                        out.println("        <Arg type=\"int\">60000</Arg>  <!-- maxIdleTimeMs, overridden below -->");
+                        modified = true;
+                    }
+                    foundQTP = false;
+                }
+                if (s.contains("<Set name=\"maxIdleTimeMs\">")) {
+                    // <Set name="maxIdleTimeMs">60000</Set>
+                    s = s.replace("<Set name=\"maxIdleTimeMs\">", "<Set name=\"idleTimeout\">");
+                    modified = true;
+                } else if (s.contains("<Set name=\"ThreadPool\">")) {
+                    // <Set name="ThreadPool">, must be changed to constructor arg
+                    out.println("    <!-- Modified by I2P migration script for Jetty 9. Do not remove this line -->");
+                    s = s.replace("<Set name=\"ThreadPool\">", "<Arg>");
+                    foundSTP = true;
+                    modified = true;
+                } else if (foundSTP && !foundETP && s.contains("</Set>") && !s.contains("<Set")) {
+                    // </Set> (close of <Set name="ThreadPool">)
+                    // All the lines above have <Set>...</Set> on the same line, if they don't, this will break.
+                    s = s.replace("</Set>", "</Arg>");
+                    foundETP = true;
+                } else if (s.contains("org.eclipse.jetty.server.nio.SelectChannelConnector")) {
+                    s = s.replace("org.eclipse.jetty.server.nio.SelectChannelConnector", "org.eclipse.jetty.server.ServerConnector");
+                    out.println("          <!-- Modified by I2P migration script for Jetty 9. Do not remove this line -->");
+                    out.println(s);
+                    out.println("            <Arg><Ref id=\"Server\" /></Arg>");
+                    out.println("            <Arg type=\"int\">1</Arg>     <!-- number of acceptors -->");
+                    out.println("            <Arg type=\"int\">0</Arg>     <!-- default number of selectors -->");
+                    out.println("            <Arg>");
+                    out.println("              <Array type=\"org.eclipse.jetty.server.ConnectionFactory\">    <!-- varargs so we need an array -->");
+                    out.println("                <Item>");
+                    out.println("                  <New class=\"org.eclipse.jetty.server.HttpConnectionFactory\">");
+                    out.println("                    <Arg>");
+                    out.println("                      <New class=\"org.eclipse.jetty.server.HttpConfiguration\">");
+                    out.println("                        <Set name=\"sendServerVersion\">false</Set>");
+                    out.println("                        <Set name=\"sendDateHeader\">true</Set>");
+                    out.println("                      </New>");
+                    out.println("                    </Arg>");
+                    out.println("                  </New>");
+                    out.println("                </Item>");
+                    out.println("              </Array>");
+                    out.println("            </Arg>");
+                    modified = true;
+                    continue;
+             // SSL starts here
+                } else if (s.contains("org.eclipse.jetty.http.ssl.SslContextFactory")) {
+                    s = s.replace("org.eclipse.jetty.http.ssl.SslContextFactory", "org.eclipse.jetty.util.ssl.SslContextFactory");
+                    out.println("  <!-- Modified by I2P migration script for Jetty 9. Do not remove this line -->");
+                    out.println(s);
+                    // don't try to migrate from below, just generate a new list
+                    out.println("    <Set name=\"ExcludeCipherSuites\">");
+                    out.println("      <Array type=\"java.lang.String\">");
+                    for (String ss : I2PSSLSocketFactory.EXCLUDE_CIPHERS) {
+                        out.println("        <Item>" + ss + "</Item>");
+                    }
+                    out.println("      </Array>");
+                    out.println("    </Set>");
+                    out.println("    <Set name=\"ExcludeProtocols\">");
+                    out.println("      <Array type=\"java.lang.String\">");
+                    for (String ss : I2PSSLSocketFactory.EXCLUDE_PROTOCOLS) {
+                        out.println("        <Item>" + ss + "</Item>");
+                    }
+                    out.println("      </Array>");
+                    out.println("    </Set>");
+                    modified = true;
+                    continue;
+                } else if (s.contains("org.eclipse.jetty.server.ssl.SslSelectChannelConnector")) {
+                    s = s.replace("org.eclipse.jetty.server.ssl.SslSelectChannelConnector", "org.eclipse.jetty.server.ServerConnector");
+                    out.println("      <!-- Modified by I2P migration script for Jetty 9. Do not remove this line -->");
+                    out.println(s);
+                    out.println("        <Arg><Ref id=\"Server\" /></Arg>");
+                    out.println("        <Arg type=\"int\">1</Arg>     <!-- number of acceptors -->");
+                    out.println("        <Arg type=\"int\">0</Arg>     <!-- default number of selectors -->");
+                    out.println("        <Arg>");
+                    out.println("           <Array type=\"org.eclipse.jetty.server.ConnectionFactory\">    <!-- varargs so we need an array -->");
+                    out.println("              <Item>");
+                    out.println("                <New class=\"org.eclipse.jetty.server.SslConnectionFactory\">");
+                    out.println("                  <Arg><Ref id=\"sslContextFactory\" /></Arg>");
+                    out.println("                  <Arg>http/1.1</Arg>");
+                    out.println("                </New>");
+                    out.println("              </Item>");
+                    out.println("              <Item>");
+                    out.println("                <New class=\"org.eclipse.jetty.server.HttpConnectionFactory\">");
+                    out.println("                  <Arg>");
+                    out.println("                    <New class=\"org.eclipse.jetty.server.HttpConfiguration\">");
+                    out.println("                      <Set name=\"sendServerVersion\">false</Set>");
+                    out.println("                      <Set name=\"sendDateHeader\">true</Set>");
+                    out.println("                    </New>");
+                    out.println("                  </Arg>");
+                    out.println("                </New>");
+                    out.println("              </Item>");
+                    out.println("            </Array>");
+                    out.println("        </Arg>");
+                    foundSSCC = true;
+                    modified = true;
+                    continue;
+                } else if (foundSSCC && s.contains("<Set name=\"ExcludeCipherSuites\">")) {
+                    // delete the old ExcludeCipherSuites in this section
+                    do {
+                        s = DataHelper.readLine(in);
+                    } while(s != null && !s.contains("</Set>"));
+                    modified = true;
+                    continue;
+                } else if (foundSSCC &&
+                           s.contains("<Ref id=\"sslContextFactory\"")) {
+                    // delete old one in this section, replaced above
+                    modified = true;
+                    continue;
+                } else if (s.contains("<Set name=\"KeyStore\">")) {
+                    s = s.replace("<Set name=\"KeyStore\">", "<Set name=\"KeyStorePath\">");
+                    modified = true;
+                } else if (s.contains("<Set name=\"TrustStore\">")) {
+                    s = s.replace("<Set name=\"TrustStore\">", "<Set name=\"TrustStorePath\">");
+                    modified = true;
+             // SSL ends here
+                } else if (s.contains("class=\"org.eclipse.jetty.deploy.providers.ContextProvider\">")) {
+                    // WebAppProvider now also does what ContextProvider used to do
+                    out.println("        <!-- Modified by I2P migration script for Jetty 9. Do not remove this line -->");
+                    s = s.replace("class=\"org.eclipse.jetty.deploy.providers.ContextProvider\">", "class=\"org.eclipse.jetty.deploy.providers.WebAppProvider\">");
+                    modified = true;
+                } else if (s.contains("<Set name=\"maxIdleTime\">")) {
+                    s = s.replace("<Set name=\"maxIdleTime\">", "<Set name=\"idleTimeout\">");
+                    modified = true;
+                } else if (s.contains("<Set name=\"gracefulShutdown\">")) {
+                    s = s.replace("<Set name=\"gracefulShutdown\">", "<Set name=\"stopTimeout\">");
+                    modified = true;
+                } else if (s.contains("org.eclipse.jetty.server.HttpConfiguration")) {
+                    foundHC = true;
+                } else if (!foundHC &&
+                           (s.contains("<Set name=\"sendServerVersion\">") ||
+                            s.contains("<Set name=\"sendDateHeader\">"))) {
+                    // old ones for Server, not in HTTPConfiguration section, delete
+                    modified = true;
+                    continue;
+                } else if (s.contains("<Set name=\"Acceptors\">") ||
+                           s.contains("<Set name=\"acceptors\">") ||
+                           s.contains("<Set name=\"statsOn\">") ||
+                           s.contains("<Set name=\"confidentialPort\">") ||
+                           s.contains("<Set name=\"lowResourcesConnections\">") ||
+                           s.contains("<Set name=\"lowResourcesMaxIdleTime\">") ||
+                           s.contains("<Set name=\"useDirectBuffers\">")) {
+                    // delete
+                    modified = true;
+                    continue;
+                }
+                out.println(s);
+            }
+        } catch (IOException ioe) {
+            if (in != null) {
+                System.err.println("FAILED migration of " + xmlFile + ": " + ioe);
+            }
+            return false;
+        } finally {
+            if (in != null) try { in.close(); } catch (IOException ioe) {}
+            if (out != null) out.close();
+        }
+        if (modified) {
+            return FileUtil.rename(newFile, xmlFile);
+        } else {
+            newFile.delete();
+            return true;
+        }
     }
 
-    /** do we have Jetty 7? */
+
+    /** do we have Jetty 7/8/9? */
     private static boolean hasLatestJetty() {
         if (!_wasChecked) {
             try {
@@ -164,9 +438,18 @@ abstract class MigrateJetty {
      *  @since Jetty 7
      */
     private static boolean backupFile(File from) {
+        return backupFile(from, BACKUP_SUFFIX);
+    }
+
+    /**
+     *  Backup a file with given suffix
+     *  @return success
+     *  @since Jetty 9
+     */
+    private static boolean backupFile(File from, String suffix) {
         if (!from.exists())
             return true;
-        File to = new File(from.getAbsolutePath() + BACKUP_SUFFIX);
+        File to = new File(from.getAbsolutePath() + suffix);
         if (to.exists())
             to = new File(to.getAbsolutePath() + "." + System.currentTimeMillis());
         boolean rv = WorkingDir.copyFile(from, to);
diff --git a/router/java/src/net/i2p/router/startup/WorkingDir.java b/router/java/src/net/i2p/router/startup/WorkingDir.java
index 5c9b9192ea..4d4be708a2 100644
--- a/router/java/src/net/i2p/router/startup/WorkingDir.java
+++ b/router/java/src/net/i2p/router/startup/WorkingDir.java
@@ -327,7 +327,6 @@ public class WorkingDir {
         } catch (IOException ioe) {
             if (in != null) {
                 System.err.println("FAILED copy " + oldFile + ": " + ioe);
-                return false;
             }
             return false;
         } finally {
@@ -365,7 +364,6 @@ public class WorkingDir {
         } catch (IOException ioe) {
             if (in != null) {
                 System.err.println("FAILED copy " + oldFile + ": " + ioe);
-                return false;
             }
             return false;
         } finally {