Skip to content

Commit ec525da

Browse files
ikxenoikxeno
authored
ZOOKEEPER-5038: Migrate to Jetty 12.1.12 (EE10)
Reviewers: anmolnar, PDavid Author: IvanKhanas Closes #2435 from IvanKhanas/ZOOKEEPER-5038
1 parent 14a1ba2 commit ec525da

38 files changed

Lines changed: 785 additions & 829 deletions

‎owaspSuppressions.xml‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,23 +18,6 @@
1818
-->
1919

2020
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
21-
<suppress>
22-
<!--
23-
We have updated jetty[1] to 9.4.57.v20241219[2] which includes a fix[3] for CVE-2024-6763[4].
24-
But it is not listed as fixed version since 9.x is EOL[5]. So we still have to suppress this
25-
to pass vulnerabilities check. Besides above, ZooKeeper does not use HttpURI[6] thus should
26-
not be affected by this CVE anyway.
27-
28-
Refs:
29-
[1]: https://github.com/apache/zookeeper/pull/2220
30-
[2]: https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.57.v20241219
31-
[3]: https://github.com/jetty/jetty.project/pull/12532
32-
[4]: https://github.com/advisories/GHSA-qh8g-58pp-2wxh
33-
[5]: https://gitlab.eclipse.org/security/cve-assignement/-/issues/25#note_2968611
34-
[6]: https://issues.apache.org/jira/browse/ZOOKEEPER-4876
35-
-->
36-
<cve>CVE-2024-6763</cve>
37-
</suppress>
3821
<suppress>
3922
<!-- ZOOKEEPER-3217 -->
4023
<cve>CVE-2018-8088</cve>
@@ -74,8 +57,6 @@
7457
<suppress>
7558
<!-- Seems like false positives about zookeeper-jute -->
7659
<cve>CVE-2021-29425</cve>
77-
<cve>CVE-2021-28164</cve>
78-
<cve>CVE-2021-34429</cve>
7960
</suppress>
8061

8162
<suppress>

‎pom.xml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -547,7 +547,9 @@
547547
<hamcrest.version>2.2</hamcrest.version>
548548
<commons-cli.version>1.5.0</commons-cli.version>
549549
<netty.version>4.1.136.Final</netty.version>
550-
<jetty.version>9.4.58.v20250814</jetty.version>
550+
<jetty.version>12.1.12</jetty.version>
551+
<!-- Servlet API version required by Jetty EE10 (see ee10.jakarta.servlet.api.version in jetty-ee10) -->
552+
<jakarta.servlet.version>6.0.0</jakarta.servlet.version>
551553
<jackson.version>2.18.8</jackson.version>
552554
<jline.version>3.25.1</jline.version>
553555
<snappy.version>1.1.10.5</snappy.version>
@@ -702,18 +704,23 @@
702704
</dependency>
703705
<dependency>
704706
<groupId>org.eclipse.jetty</groupId>
705-
<artifactId>jetty-server</artifactId>
707+
<artifactId>jetty-bom</artifactId>
706708
<version>${jetty.version}</version>
709+
<type>pom</type>
710+
<scope>import</scope>
707711
</dependency>
708712
<dependency>
709-
<groupId>org.eclipse.jetty</groupId>
710-
<artifactId>jetty-servlet</artifactId>
713+
<groupId>org.eclipse.jetty.ee10</groupId>
714+
<artifactId>jetty-ee10-bom</artifactId>
711715
<version>${jetty.version}</version>
716+
<type>pom</type>
717+
<scope>import</scope>
712718
</dependency>
719+
<!-- Not managed by the Jetty BOMs, so it has to be pinned explicitly -->
713720
<dependency>
714-
<groupId>org.eclipse.jetty</groupId>
715-
<artifactId>jetty-client</artifactId>
716-
<version>${jetty.version}</version>
721+
<groupId>jakarta.servlet</groupId>
722+
<artifactId>jakarta.servlet-api</artifactId>
723+
<version>${jakarta.servlet.version}</version>
717724
</dependency>
718725
<dependency>
719726
<groupId>io.dropwizard.metrics</groupId>

‎zookeeper-assembly/pom.xml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,12 @@
9292
<artifactId>jetty-server</artifactId>
9393
</dependency>
9494
<dependency>
95-
<groupId>org.eclipse.jetty</groupId>
96-
<artifactId>jetty-servlet</artifactId>
95+
<groupId>org.eclipse.jetty.ee10</groupId>
96+
<artifactId>jetty-ee10-servlet</artifactId>
97+
</dependency>
98+
<dependency>
99+
<groupId>jakarta.servlet</groupId>
100+
<artifactId>jakarta.servlet-api</artifactId>
97101
</dependency>
98102
<dependency>
99103
<groupId>com.fasterxml.jackson.core</groupId>

‎zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,8 @@
7171
<artifactId>jetty-server</artifactId>
7272
</dependency>
7373
<dependency>
74-
<groupId>org.eclipse.jetty</groupId>
75-
<artifactId>jetty-servlet</artifactId>
74+
<groupId>org.eclipse.jetty.ee10</groupId>
75+
<artifactId>jetty-ee10-servlet</artifactId>
7676
</dependency>
7777
<dependency>
7878
<groupId>com.fasterxml.jackson.core</groupId>

‎zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@
3333

3434
<properties>
3535
<prometheus.version>1.3.10</prometheus.version>
36-
<jetty.version>9.4.58.v20250814</jetty.version>
3736
<datasketches.version>7.0.1</datasketches.version>
3837
</properties>
3938
<dependencies>
@@ -58,7 +57,7 @@
5857
</dependency>
5958
<dependency>
6059
<groupId>io.prometheus</groupId>
61-
<artifactId>prometheus-metrics-exporter-servlet-javax</artifactId>
60+
<artifactId>prometheus-metrics-exporter-servlet-jakarta</artifactId>
6261
<version>${prometheus.version}</version>
6362
</dependency>
6463
<dependency>
@@ -84,24 +83,19 @@
8483
<dependency>
8584
<groupId>org.eclipse.jetty</groupId>
8685
<artifactId>jetty-server</artifactId>
87-
<version>${jetty.version}</version>
8886
</dependency>
8987
<dependency>
90-
<groupId>org.eclipse.jetty</groupId>
91-
<artifactId>jetty-servlet</artifactId>
92-
<version>${jetty.version}</version>
88+
<groupId>org.eclipse.jetty.ee10</groupId>
89+
<artifactId>jetty-ee10-servlet</artifactId>
9390
</dependency>
94-
<!-- You likely don't need this, but if you do, here's the correct syntax -->
91+
<!-- jetty-util provides KeyStoreScanner, used for hot-reloading the keystore -->
9592
<dependency>
9693
<groupId>org.eclipse.jetty</groupId>
9794
<artifactId>jetty-util</artifactId>
98-
<version>${jetty.version}</version>
99-
<!-- You could add a scope here if needed, e.g., <scope>provided</scope> -->
10095
</dependency>
10196
<dependency>
102-
<groupId>javax.servlet</groupId>
103-
<artifactId>javax.servlet-api</artifactId>
104-
<version>3.1.0</version>
97+
<groupId>jakarta.servlet</groupId>
98+
<artifactId>jakarta.servlet-api</artifactId>
10599
<scope>provided</scope>
106100
</dependency>
107101
<dependency>

‎zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,12 @@
2020

2121
import static org.apache.zookeeper.common.LogRedactor.redactSensitiveValues;
2222
import io.prometheus.metrics.core.metrics.GaugeWithCallback;
23-
import io.prometheus.metrics.exporter.servlet.javax.PrometheusMetricsServlet;
23+
import io.prometheus.metrics.exporter.servlet.jakarta.PrometheusMetricsServlet;
2424
import io.prometheus.metrics.instrumentation.jvm.JvmMetrics;
2525
import io.prometheus.metrics.model.registry.PrometheusRegistry;
26+
import jakarta.servlet.ServletException;
27+
import jakarta.servlet.http.HttpServletRequest;
28+
import jakarta.servlet.http.HttpServletResponse;
2629
import java.io.IOException;
2730
import java.security.GeneralSecurityException;
2831
import java.security.KeyStore;
@@ -37,9 +40,6 @@
3740
import java.util.concurrent.TimeUnit;
3841
import java.util.concurrent.atomic.AtomicInteger;
3942
import java.util.function.BiConsumer;
40-
import javax.servlet.ServletException;
41-
import javax.servlet.http.HttpServletRequest;
42-
import javax.servlet.http.HttpServletResponse;
4343
import org.apache.zookeeper.common.X509Util;
4444
import org.apache.zookeeper.metrics.Counter;
4545
import org.apache.zookeeper.metrics.CounterSet;
@@ -51,15 +51,16 @@
5151
import org.apache.zookeeper.metrics.Summary;
5252
import org.apache.zookeeper.metrics.SummarySet;
5353
import org.apache.zookeeper.server.admin.UnifiedConnectionFactory;
54+
import org.eclipse.jetty.ee10.servlet.ServletContextHandler;
55+
import org.eclipse.jetty.ee10.servlet.ServletHolder;
5456
import org.eclipse.jetty.http.HttpVersion;
5557
import org.eclipse.jetty.server.HttpConfiguration;
5658
import org.eclipse.jetty.server.HttpConnectionFactory;
5759
import org.eclipse.jetty.server.SecureRequestCustomizer;
5860
import org.eclipse.jetty.server.Server;
5961
import org.eclipse.jetty.server.ServerConnector;
60-
import org.eclipse.jetty.servlet.ServletContextHandler;
61-
import org.eclipse.jetty.servlet.ServletHolder;
62-
import org.eclipse.jetty.util.resource.Resource;
62+
import org.eclipse.jetty.server.SslConnectionFactory;
63+
import org.eclipse.jetty.util.resource.ResourceFactory;
6364
import org.eclipse.jetty.util.ssl.KeyStoreScanner;
6465
import org.eclipse.jetty.util.ssl.SslContextFactory;
6566
import org.eclipse.jetty.util.thread.QueuedThreadPool;
@@ -234,6 +235,10 @@ public void start() throws MetricsProviderLifeCycleException {
234235
customizer.setStsMaxAge(DEFAULT_STS_MAX_AGE);
235236
// Strict-Transport-Security HTTP header should apply to all subdomains of the host's domain as well.
236237
customizer.setStsIncludeSubDomains(true);
238+
// The metrics port does not multiplex virtual hosts, so there is no
239+
// SNI name to match against. Jetty 10+ defaults this check to true,
240+
// which rejects connections made to a bare IP address or to localhost.
241+
customizer.setSniHostCheck(false);
237242

238243
HttpConfiguration config = new HttpConfiguration();
239244
config.setSecureScheme("https");
@@ -356,7 +361,7 @@ private SslContextFactory.Server createSslContextFactory() throws GeneralSecurit
356361
sslContextFactory.setKeyStorePassword(this.keyStorePassword);
357362

358363
// This is needed for KeyStoreScanner to work.
359-
sslContextFactory.setKeyStoreResource(Resource.newResource(this.keyStorePath));
364+
sslContextFactory.setKeyStoreResource(ResourceFactory.of(this.server).newResource(this.keyStorePath));
360365

361366
// Validate and set TrustStore properties (often needed for client auth)
362367
if (this.needClientAuth && (this.trustStorePath == null || this.trustStorePath.isEmpty())) {
@@ -406,7 +411,23 @@ private SslContextFactory.Server createSslContextFactory() throws GeneralSecurit
406411
*/
407412
private ServerConnector createSslConnector(Server server, int acceptors, int selectors,
408413
SslContextFactory.Server sslContextFactory) {
409-
ServerConnector sslConnector = new ServerConnector(server, acceptors, selectors, sslContextFactory);
414+
// Spelled out rather than left to the implicit HttpConfiguration, whose
415+
// SecureRequestCustomizer defaults to sniHostCheck=true and would reject
416+
// requests to a bare IP address or to localhost. Setting it up here also
417+
// gives this connector the same Strict-Transport-Security header as the
418+
// unified one.
419+
SecureRequestCustomizer customizer = new SecureRequestCustomizer();
420+
customizer.setStsMaxAge(DEFAULT_STS_MAX_AGE);
421+
customizer.setStsIncludeSubDomains(true);
422+
customizer.setSniHostCheck(false);
423+
424+
HttpConfiguration config = new HttpConfiguration();
425+
config.setSecureScheme("https");
426+
config.addCustomizer(customizer);
427+
428+
ServerConnector sslConnector = new ServerConnector(server, acceptors, selectors,
429+
new SslConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
430+
new HttpConnectionFactory(config));
410431
sslConnector.setPort(this.httpsPort);
411432
sslConnector.setHost(this.host);
412433
return sslConnector;

‎zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@
2828
import static org.mockito.Mockito.mock;
2929
import static org.mockito.Mockito.verify;
3030
import static org.mockito.Mockito.when;
31+
import jakarta.servlet.ServletException;
32+
import jakarta.servlet.ServletOutputStream;
33+
import jakarta.servlet.WriteListener;
34+
import jakarta.servlet.http.HttpServlet;
35+
import jakarta.servlet.http.HttpServletRequest;
36+
import jakarta.servlet.http.HttpServletResponse;
3137
import java.io.ByteArrayOutputStream;
3238
import java.io.IOException;
3339
import java.util.ArrayList;
@@ -38,12 +44,6 @@
3844
import java.util.Map;
3945
import java.util.Properties;
4046
import java.util.concurrent.atomic.AtomicInteger;
41-
import javax.servlet.ServletException;
42-
import javax.servlet.ServletOutputStream;
43-
import javax.servlet.WriteListener;
44-
import javax.servlet.http.HttpServlet;
45-
import javax.servlet.http.HttpServletRequest;
46-
import javax.servlet.http.HttpServletResponse;
4747
import org.apache.zookeeper.metrics.Counter;
4848
import org.apache.zookeeper.metrics.CounterSet;
4949
import org.apache.zookeeper.metrics.Gauge;

‎zookeeper-server/pom.xml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,15 +91,20 @@
9191
<scope>provided</scope>
9292
</dependency>
9393
<dependency>
94-
<groupId>org.eclipse.jetty</groupId>
95-
<artifactId>jetty-servlet</artifactId>
94+
<groupId>org.eclipse.jetty.ee10</groupId>
95+
<artifactId>jetty-ee10-servlet</artifactId>
9696
<scope>provided</scope>
9797
</dependency>
9898
<dependency>
9999
<groupId>org.eclipse.jetty</groupId>
100100
<artifactId>jetty-client</artifactId>
101101
<scope>provided</scope>
102102
</dependency>
103+
<dependency>
104+
<groupId>jakarta.servlet</groupId>
105+
<artifactId>jakarta.servlet-api</artifactId>
106+
<scope>provided</scope>
107+
</dependency>
103108
<dependency>
104109
<groupId>com.fasterxml.jackson.core</groupId>
105110
<artifactId>jackson-databind</artifactId>

‎zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@
1717

1818
package org.apache.zookeeper.server.admin;
1919

20+
import jakarta.servlet.http.HttpServletResponse;
2021
import java.io.InputStream;
2122
import java.util.HashMap;
2223
import java.util.LinkedHashMap;
2324
import java.util.Map;
24-
import javax.servlet.http.HttpServletResponse;
2525

2626
/**
2727
* A response from running a {@link Command}.

‎zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
import com.fasterxml.jackson.databind.JsonNode;
2424
import com.fasterxml.jackson.databind.ObjectMapper;
2525
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
26+
import jakarta.servlet.http.HttpServletRequest;
27+
import jakarta.servlet.http.HttpServletResponse;
2628
import java.io.File;
2729
import java.io.FileInputStream;
2830
import java.io.IOException;
@@ -41,8 +43,6 @@
4143
import java.util.TreeMap;
4244
import java.util.concurrent.TimeUnit;
4345
import java.util.stream.Collectors;
44-
import javax.servlet.http.HttpServletRequest;
45-
import javax.servlet.http.HttpServletResponse;
4646
import org.apache.zookeeper.Environment;
4747
import org.apache.zookeeper.Environment.Entry;
4848
import org.apache.zookeeper.KeeperException;

0 commit comments

Comments
 (0)