I have the CaveatEmptor example application. The filter for the session-per-rewquest pattern commit transaction at the end of the chaining.
Dao objects begin a transaction everytime i call the costrutor.
But there aren't rollback in the source code. Why?
And where should i put them?

In the command or session bean implementations (or in commit/flush in HibernateUtil, to catch DML exceptions). Not the best way, but we didn't finish the complete upper layers (only persistence and some ideas for the business layer/controllers/commands).

Why not in the filter?

public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
try {
chain.doFilter(request, response);
HibernateUtil.commitTransaction();
} catch (Exception e) {
HibernateUtil.rollbackTransaction();
} finally {
HibernateUtil.closeSession();
}
}

Yeah, didn't think much about the exception handling so far.