You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "Matt Pavlovich (Jira)" <ji...@apache.org> on 2021/03/02 16:17:00 UTC
[jira] [Comment Edited] (AMQ-6951) Hide embedded jetty version
[ https://issues.apache.org/jira/browse/AMQ-6951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17293809#comment-17293809 ]
Matt Pavlovich edited comment on AMQ-6951 at 3/2/21, 4:16 PM:
--------------------------------------------------------------
Before patch:
{noformat}
% nc localhost 61614
GET /
HTTP/1.1 505 HTTP/0.9 not supported
Content-Type: text/html;charset=iso-8859-1
Content-Length: 65
Connection: close
Server: Jetty(9.4.35.v20201120)
{noformat}
After patch:
{noformat}
% nc localhost 61610 (http:// transport)
GET /
HTTP/1.1 505 HTTP/0.9 not supported
Content-Type: text/html;charset=iso-8859-1
Content-Length: 65
Connection: close
<h1>Bad Message 505</h1><pre>reason: HTTP/0.9 not supported</pre>%
% nc localhost 61614 (ws:// transport)
GET /
HTTP/1.1 505 HTTP/0.9 not supported
Content-Type: text/html;charset=iso-8859-1
Content-Length: 65
Connection: close
<h1>Bad Message 505</h1><pre>reason: HTTP/0.9 not supported</pre>%
{noformat}
was (Author: mattrpav):
Before patch:
{noformat}
% nc localhost 61614
GET /
HTTP/1.1 505 HTTP/0.9 not supported
Content-Type: text/html;charset=iso-8859-1
Content-Length: 65
Connection: close
Server: Jetty(9.4.35.v20201120)
{noformat}
After patch:
{noformat}
% nc localhost 61610
GET /
HTTP/1.1 505 HTTP/0.9 not supported
Content-Type: text/html;charset=iso-8859-1
Content-Length: 65
Connection: close
<h1>Bad Message 505</h1><pre>reason: HTTP/0.9 not supported</pre>%
% nc localhost 61614
GET /
HTTP/1.1 505 HTTP/0.9 not supported
Content-Type: text/html;charset=iso-8859-1
Content-Length: 65
Connection: close
<h1>Bad Message 505</h1><pre>reason: HTTP/0.9 not supported</pre>%
{noformat}
> Hide embedded jetty version
> ---------------------------
>
> Key: AMQ-6951
> URL: https://issues.apache.org/jira/browse/AMQ-6951
> Project: ActiveMQ
> Issue Type: New Feature
> Reporter: Marcos Moreno Martin
> Assignee: Matt Pavlovich
> Priority: Major
> Fix For: 5.17.0, 5.15.15, 5.16.2
>
>
> Hi,
> sorry in advance if this is something easy for jetty experts. We need some guidance or see if hiding the embedded jetty configuration is possible.
> We have not seen anywhere in the documentation how to hide the embedded jetty version. This is marked as a security thread by our penetration testers when we are using a web sockets transport on port 80. We have been playing around with the configuration file jetty.xml and the parameters, but no success. It has been addressed for other projects (see https://issues.apache.org/jira/browse/HADOOP-13414)
> So far we have been trying to change the configuration in jetty.xml.
> As far as we know, this should be the configuration for the property:
> {code:java}
> <bean id="httpConfig" class="org.eclipse.jetty.server.HttpConfiguration">
> <property name="sendServerVersion" value="false">
> </property>
> </bean>
> {code}
> However, this has no effect in the exposing of the version. We tried further and tried with a connection factory, but this also had no effect:
> {code:java}
> <bean id="invokeConnectors" class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
> <property name="targetObject" ref="Server" />
> <property name="targetMethod" value="setConnectors" />
> <property name="arguments">
> <list>
> <bean id="Connector" class="org.eclipse.jetty.server.ServerConnector">
> <constructor-arg ref="Server" />
> <constructor-arg>
> <list>
> <bean id="httpConnectionFactory" class="org.eclipse.jetty.server.HttpConnectionFactory">
> <constructor-arg ref="httpConfig"/>
> </bean>
> </list>
> </constructor-arg>
> <!-- see the jettyPort bean -->
> <property name="host" value="#{systemProperties['jetty.host']}" />
> <property name="port" value="#{systemProperties['jetty.port']}" />
> </bean>
> </list>
> </property>
> </bean>
> {code}
> Are we on the right track, or does it need to be addressed by the codebase of ActiveMQ?
> This is how we show the version:
> {code:java}
> #nmap -sV -p80 localhost
> Starting Nmap 7.70 ( https://nmap.org ) at 2018-04-23 18:16 CEST
> Nmap scan report for localhost (127.0.0.1)
> Host is up (0.000098s latency).
> PORT STATE SERVICE VERSION
> 80/tcp open http Jetty 9.2.22.v20170606
> Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
> Nmap done: 1 IP address (1 host up) scanned in 11.34 seconds
> {code}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)