This is an automated email from the ASF dual-hosted git repository.
nkalmar pushed a commit to branch branch-3.6
in repository https://gitbox.apache.org/repos/asf/zookeeper.git
The following commit(s) were added to refs/heads/branch-3.6 by this push:
new 02816bb ZOOKEEPER-3772: JettyAdminServer should not allow Http TRACE method
02816bb is described below
commit 02816bbd6b4229915954a2cfdaccc4295adca2bc
Author: lingjinjiang <lingjinjiang@gmail.com>
AuthorDate: Tue May 5 09:18:18 2020 +0200
ZOOKEEPER-3772: JettyAdminServer should not allow Http TRACE method
A nessus scan pinged the cluster after I upgrade my zookeeper cluster, because the 8080
port of JettyAdminServer allows Http TRACE method.
Author: lingjinjiang <lingjinjiang@gmail.com>
Reviewers: Mate Szalay-Beko <symat@apache.org>, Andor Molnar <andor@apache.org>,
Norbert Kalmar <nkalmar@apache.org>
Closes #1296 from lingjinjiang/master
(cherry picked from commit 44de549657a539dcedba58d56e67b8c906c89580)
Signed-off-by: Norbert Kalmar <nkalmar@apache.org>
---
.../zookeeper/server/admin/JettyAdminServer.java | 22 ++++++++++++++++++++++
.../server/admin/JettyAdminServerTest.java | 20 ++++++++++++++++++++
2 files changed, 42 insertions(+)
diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
index 2724243..6845f23 100644
--- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
+++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java
@@ -34,6 +34,8 @@ import org.apache.zookeeper.common.QuorumX509Util;
import org.apache.zookeeper.common.X509Util;
import org.apache.zookeeper.server.ZooKeeperServer;
import org.eclipse.jetty.http.HttpVersion;
+import org.eclipse.jetty.security.ConstraintMapping;
+import org.eclipse.jetty.security.ConstraintSecurityHandler;
import org.eclipse.jetty.server.HttpConfiguration;
import org.eclipse.jetty.server.HttpConnectionFactory;
import org.eclipse.jetty.server.SecureRequestCustomizer;
@@ -41,6 +43,7 @@ import org.eclipse.jetty.server.Server;
import org.eclipse.jetty.server.ServerConnector;
import org.eclipse.jetty.servlet.ServletContextHandler;
import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.security.Constraint;
import org.eclipse.jetty.util.ssl.SslContextFactory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -153,6 +156,7 @@ public class JettyAdminServer implements AdminServer {
ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
context.setContextPath("/*");
+ constrainTraceMethod(context);
server.setHandler(context);
context.addServlet(new ServletHolder(new CommandServlet()), commandUrl + "/*");
@@ -266,4 +270,22 @@ public class JettyAdminServer implements AdminServer {
return links;
}
+ /**
+ * Add constraint to a given context to disallow TRACE method
+ * @param ctxHandler the context to modify
+ */
+ private void constrainTraceMethod(ServletContextHandler ctxHandler) {
+ Constraint c = new Constraint();
+ c.setAuthenticate(true);
+
+ ConstraintMapping cmt = new ConstraintMapping();
+ cmt.setConstraint(c);
+ cmt.setMethod("TRACE");
+ cmt.setPathSpec("/*");
+
+ ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
+ securityHandler.setConstraintMappings(new ConstraintMapping[] {cmt});
+
+ ctxHandler.setSecurityHandler(securityHandler);
+ }
}
diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
index 525c1c9..4e77a6b 100644
--- a/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
+++ b/zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/JettyAdminServerTest.java
@@ -18,11 +18,13 @@
package org.apache.zookeeper.server.admin;
+import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
import java.io.BufferedReader;
import java.io.File;
import java.io.IOException;
import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
import java.net.URL;
import java.security.GeneralSecurityException;
import java.security.Security;
@@ -152,6 +154,7 @@ public class JettyAdminServerTest extends ZKTestCase {
try {
server.start();
queryAdminServer(jettyAdminPort);
+ traceAdminServer(jettyAdminPort);
} finally {
server.shutdown();
}
@@ -262,4 +265,21 @@ public class JettyAdminServerTest extends ZKTestCase {
assertTrue(line.length() > 0);
}
+ /**
+ * Using TRACE method to visit admin server
+ */
+ private void traceAdminServer(int port) throws IOException {
+ traceAdminServer(String.format(URL_FORMAT, port));
+ traceAdminServer(String.format(HTTPS_URL_FORMAT, port));
+ }
+
+ /**
+ * Using TRACE method to visit admin server, the response should be 403 forbidden
+ */
+ private void traceAdminServer(String urlStr) throws IOException {
+ HttpURLConnection conn = (HttpURLConnection) new URL(urlStr).openConnection();
+ conn.setRequestMethod("TRACE");
+ conn.connect();
+ assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
+ }
}
|