ZOOKEEPER-5038: Migrate to Jetty 12.1.12 (EE10)

owaspSuppressions.xml

@@ -18,23 +18,6 @@
 -->
 
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
-   <suppress>
-      <!--
-         We have updated jetty[1] to 9.4.57.v20241219[2] which includes a fix[3] for CVE-2024-6763[4].
-         But it is not listed as fixed version since 9.x is EOL[5]. So we still have to suppress this
-         to pass vulnerabilities check. Besides above, ZooKeeper does not use HttpURI[6] thus should
-         not be affected by this CVE anyway.
-
-         Refs:
-         [1]: https://github.com/apache/zookeeper/pull/2220
-         [2]: https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.57.v20241219
-         [3]: https://github.com/jetty/jetty.project/pull/12532
-         [4]: https://github.com/advisories/GHSA-qh8g-58pp-2wxh
-         [5]: https://gitlab.eclipse.org/security/cve-assignement/-/issues/25#note_2968611
-         [6]: https://issues.apache.org/jira/browse/ZOOKEEPER-4876
-      -->
-      <cve>CVE-2024-6763</cve>
-   </suppress>
    <suppress>
       <!-- ZOOKEEPER-3217 -->
       <cve>CVE-2018-8088</cve>
@@ -74,8 +57,6 @@
    <suppress>
       <!-- Seems like false positives about zookeeper-jute -->
       <cve>CVE-2021-29425</cve>
-      <cve>CVE-2021-28164</cve>
-      <cve>CVE-2021-34429</cve>
    </suppress>
 
    <suppress>

pom.xml

@@ -547,7 +547,9 @@
     <hamcrest.version>2.2</hamcrest.version>
     <commons-cli.version>1.5.0</commons-cli.version>
     <netty.version>4.1.136.Final</netty.version>
-    <jetty.version>9.4.58.v20250814</jetty.version>
+    <jetty.version>12.1.12</jetty.version>
+    <!-- Servlet API version required by Jetty EE10 (see ee10.jakarta.servlet.api.version in jetty-ee10) -->
+    <jakarta.servlet.version>6.0.0</jakarta.servlet.version>
     <jackson.version>2.18.8</jackson.version>
     <jline.version>3.25.1</jline.version>
     <snappy.version>1.1.10.5</snappy.version>
@@ -702,18 +704,23 @@
       </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
-        <artifactId>jetty-server</artifactId>
+        <artifactId>jetty-bom</artifactId>
         <version>${jetty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
       </dependency>
       <dependency>
-        <groupId>org.eclipse.jetty</groupId>
-        <artifactId>jetty-servlet</artifactId>
+        <groupId>org.eclipse.jetty.ee10</groupId>
+        <artifactId>jetty-ee10-bom</artifactId>
         <version>${jetty.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
       </dependency>
+      <!-- Not managed by the Jetty BOMs, so it has to be pinned explicitly -->
       <dependency>
-        <groupId>org.eclipse.jetty</groupId>
-        <artifactId>jetty-client</artifactId>
-        <version>${jetty.version}</version>
+        <groupId>jakarta.servlet</groupId>
+        <artifactId>jakarta.servlet-api</artifactId>
+        <version>${jakarta.servlet.version}</version>
       </dependency>
       <dependency>
         <groupId>io.dropwizard.metrics</groupId>

zookeeper-assembly/pom.xml

@@ -92,8 +92,12 @@
       <artifactId>jetty-server</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-servlet</artifactId>
+      <groupId>org.eclipse.jetty.ee10</groupId>
+      <artifactId>jetty-ee10-servlet</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>jakarta.servlet</groupId>
+      <artifactId>jakarta.servlet-api</artifactId>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>

zookeeper-contrib/zookeeper-contrib-fatjar/pom.xml

@@ -71,8 +71,8 @@
       <artifactId>jetty-server</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-servlet</artifactId>
+      <groupId>org.eclipse.jetty.ee10</groupId>
+      <artifactId>jetty-ee10-servlet</artifactId>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>

zookeeper-metrics-providers/zookeeper-prometheus-metrics/pom.xml

@@ -33,7 +33,6 @@
 
   <properties>
       <prometheus.version>1.3.10</prometheus.version>
-      <jetty.version>9.4.58.v20250814</jetty.version>
       <datasketches.version>7.0.1</datasketches.version>
   </properties>
   <dependencies>
@@ -58,7 +57,7 @@
     </dependency>
     <dependency>
       <groupId>io.prometheus</groupId>
-      <artifactId>prometheus-metrics-exporter-servlet-javax</artifactId>
+      <artifactId>prometheus-metrics-exporter-servlet-jakarta</artifactId>
       <version>${prometheus.version}</version>
     </dependency>
     <dependency>
@@ -84,24 +83,19 @@
     <dependency>
         <groupId>org.eclipse.jetty</groupId>
         <artifactId>jetty-server</artifactId>
-        <version>${jetty.version}</version>
     </dependency>
     <dependency>
-        <groupId>org.eclipse.jetty</groupId>
-        <artifactId>jetty-servlet</artifactId>
-        <version>${jetty.version}</version>
+        <groupId>org.eclipse.jetty.ee10</groupId>
+        <artifactId>jetty-ee10-servlet</artifactId>
     </dependency>
-    <!-- You likely don't need this, but if you do, here's the correct syntax -->
+    <!-- jetty-util provides KeyStoreScanner, used for hot-reloading the keystore -->
     <dependency>
         <groupId>org.eclipse.jetty</groupId>
         <artifactId>jetty-util</artifactId>
-        <version>${jetty.version}</version>
-        <!-- You could add a scope here if needed, e.g., <scope>provided</scope> -->
     </dependency>
     <dependency>
-        <groupId>javax.servlet</groupId>
-        <artifactId>javax.servlet-api</artifactId>
-        <version>3.1.0</version>
+        <groupId>jakarta.servlet</groupId>
+        <artifactId>jakarta.servlet-api</artifactId>
         <scope>provided</scope>
     </dependency>
     <dependency>

zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/main/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProvider.java

@@ -20,9 +20,12 @@
 
 import static org.apache.zookeeper.common.LogRedactor.redactSensitiveValues;
 import io.prometheus.metrics.core.metrics.GaugeWithCallback;
-import io.prometheus.metrics.exporter.servlet.javax.PrometheusMetricsServlet;
+import io.prometheus.metrics.exporter.servlet.jakarta.PrometheusMetricsServlet;
 import io.prometheus.metrics.instrumentation.jvm.JvmMetrics;
 import io.prometheus.metrics.model.registry.PrometheusRegistry;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
@@ -37,9 +40,6 @@
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.BiConsumer;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.metrics.Counter;
 import org.apache.zookeeper.metrics.CounterSet;
@@ -51,15 +51,16 @@
 import org.apache.zookeeper.metrics.Summary;
 import org.apache.zookeeper.metrics.SummarySet;
 import org.apache.zookeeper.server.admin.UnifiedConnectionFactory;
+import org.eclipse.jetty.ee10.servlet.ServletContextHandler;
+import org.eclipse.jetty.ee10.servlet.ServletHolder;
 import org.eclipse.jetty.http.HttpVersion;
 import org.eclipse.jetty.server.HttpConfiguration;
 import org.eclipse.jetty.server.HttpConnectionFactory;
 import org.eclipse.jetty.server.SecureRequestCustomizer;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
-import org.eclipse.jetty.servlet.ServletContextHandler;
-import org.eclipse.jetty.servlet.ServletHolder;
-import org.eclipse.jetty.util.resource.Resource;
+import org.eclipse.jetty.server.SslConnectionFactory;
+import org.eclipse.jetty.util.resource.ResourceFactory;
 import org.eclipse.jetty.util.ssl.KeyStoreScanner;
 import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.eclipse.jetty.util.thread.QueuedThreadPool;
@@ -234,6 +235,10 @@ public void start() throws MetricsProviderLifeCycleException {
                 customizer.setStsMaxAge(DEFAULT_STS_MAX_AGE);
                 // Strict-Transport-Security HTTP header should apply to all subdomains of the host's domain as well.
                 customizer.setStsIncludeSubDomains(true);
+                // The metrics port does not multiplex virtual hosts, so there is no
+                // SNI name to match against. Jetty 10+ defaults this check to true,
+                // which rejects connections made to a bare IP address or to localhost.
+                customizer.setSniHostCheck(false);
 
                 HttpConfiguration config = new HttpConfiguration();
                 config.setSecureScheme("https");
@@ -356,7 +361,7 @@ private SslContextFactory.Server createSslContextFactory() throws GeneralSecurit
         sslContextFactory.setKeyStorePassword(this.keyStorePassword);
 
         // This is needed for KeyStoreScanner to work.
-        sslContextFactory.setKeyStoreResource(Resource.newResource(this.keyStorePath));
+        sslContextFactory.setKeyStoreResource(ResourceFactory.of(this.server).newResource(this.keyStorePath));
 
         // Validate and set TrustStore properties (often needed for client auth)
         if (this.needClientAuth && (this.trustStorePath == null || this.trustStorePath.isEmpty())) {
@@ -406,7 +411,23 @@ private SslContextFactory.Server createSslContextFactory() throws GeneralSecurit
      */
     private ServerConnector createSslConnector(Server server, int acceptors, int selectors,
             SslContextFactory.Server sslContextFactory) {
-        ServerConnector sslConnector = new ServerConnector(server, acceptors, selectors, sslContextFactory);
+        // Spelled out rather than left to the implicit HttpConfiguration, whose
+        // SecureRequestCustomizer defaults to sniHostCheck=true and would reject
+        // requests to a bare IP address or to localhost. Setting it up here also
+        // gives this connector the same Strict-Transport-Security header as the
+        // unified one.
+        SecureRequestCustomizer customizer = new SecureRequestCustomizer();
+        customizer.setStsMaxAge(DEFAULT_STS_MAX_AGE);
+        customizer.setStsIncludeSubDomains(true);
+        customizer.setSniHostCheck(false);
+
+        HttpConfiguration config = new HttpConfiguration();
+        config.setSecureScheme("https");
+        config.addCustomizer(customizer);
+
+        ServerConnector sslConnector = new ServerConnector(server, acceptors, selectors,
+                new SslConnectionFactory(sslContextFactory, HttpVersion.fromVersion(httpVersion).asString()),
+                new HttpConnectionFactory(config));
         sslConnector.setPort(this.httpsPort);
         sslConnector.setHost(this.host);
         return sslConnector;

zookeeper-metrics-providers/zookeeper-prometheus-metrics/src/test/java/org/apache/zookeeper/metrics/prometheus/PrometheusMetricsProviderTest.java

@@ -28,6 +28,12 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletOutputStream;
+import jakarta.servlet.WriteListener;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.util.ArrayList;
@@ -38,12 +44,6 @@
 import java.util.Map;
 import java.util.Properties;
 import java.util.concurrent.atomic.AtomicInteger;
-import javax.servlet.ServletException;
-import javax.servlet.ServletOutputStream;
-import javax.servlet.WriteListener;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.metrics.Counter;
 import org.apache.zookeeper.metrics.CounterSet;
 import org.apache.zookeeper.metrics.Gauge;

zookeeper-server/pom.xml

@@ -91,15 +91,20 @@
       <scope>provided</scope>
     </dependency>
     <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-servlet</artifactId>
+      <groupId>org.eclipse.jetty.ee10</groupId>
+      <artifactId>jetty-ee10-servlet</artifactId>
       <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-client</artifactId>
       <scope>provided</scope>
     </dependency>
+    <dependency>
+      <groupId>jakarta.servlet</groupId>
+      <artifactId>jakarta.servlet-api</artifactId>
+      <scope>provided</scope>
+    </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>

zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/CommandResponse.java

@@ -17,11 +17,11 @@
 
 package org.apache.zookeeper.server.admin;
 
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.InputStream;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
-import javax.servlet.http.HttpServletResponse;
 
 /**
  * A response from running a {@link Command}.

zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/Commands.java

@@ -23,6 +23,8 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -41,8 +43,6 @@
 import java.util.TreeMap;
 import java.util.concurrent.TimeUnit;
 import java.util.stream.Collectors;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.Environment;
 import org.apache.zookeeper.Environment.Entry;
 import org.apache.zookeeper.KeeperException;

zookeeper-server/src/main/java/org/apache/zookeeper/server/admin/JettyAdminServer.java

@@ -18,35 +18,35 @@
 
 package org.apache.zookeeper.server.admin;
 
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 import org.apache.zookeeper.common.QuorumX509Util;
 import org.apache.zookeeper.common.SecretUtils;
 import org.apache.zookeeper.common.X509Util;
 import org.apache.zookeeper.server.ZooKeeperServer;
 import org.apache.zookeeper.server.auth.IPAuthenticationProvider;
+import org.eclipse.jetty.ee10.servlet.ServletContextHandler;
+import org.eclipse.jetty.ee10.servlet.ServletHolder;
 import org.eclipse.jetty.http.HttpHeader;
+import org.eclipse.jetty.http.HttpMethod;
 import org.eclipse.jetty.http.HttpVersion;
-import org.eclipse.jetty.security.ConstraintMapping;
-import org.eclipse.jetty.security.ConstraintSecurityHandler;
+import org.eclipse.jetty.security.Constraint;
+import org.eclipse.jetty.security.SecurityHandler;
 import org.eclipse.jetty.server.HttpConfiguration;
 import org.eclipse.jetty.server.HttpConnectionFactory;
 import org.eclipse.jetty.server.SecureRequestCustomizer;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
 import org.eclipse.jetty.server.SslConnectionFactory;
-import org.eclipse.jetty.servlet.ServletContextHandler;
-import org.eclipse.jetty.servlet.ServletHolder;
-import org.eclipse.jetty.util.security.Constraint;
 import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -118,6 +118,10 @@ public JettyAdminServer(
             SecureRequestCustomizer customizer = new SecureRequestCustomizer();
             customizer.setStsMaxAge(DEFAULT_STS_MAX_AGE);
             customizer.setStsIncludeSubDomains(true);
+            // The admin port does not multiplex virtual hosts, so there is no SNI
+            // name to match against. Jetty 10+ defaults this check to true, which
+            // rejects connections made to a bare IP address or to localhost.
+            customizer.setSniHostCheck(false);
 
             HttpConfiguration config = new HttpConfiguration();
             config.setSecureScheme("https");
@@ -188,7 +192,7 @@ public JettyAdminServer(
         server.addConnector(connector);
 
         ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
-        context.setContextPath("/*");
+        context.setContextPath("/");
         constrainTraceMethod(context);
         server.setHandler(context);
 
@@ -369,16 +373,8 @@ private List<String> commandLinks() {
      * @param ctxHandler the context to modify
      */
     private void constrainTraceMethod(ServletContextHandler ctxHandler) {
-        Constraint c = new Constraint();
-        c.setAuthenticate(true);
-
-        ConstraintMapping cmt = new ConstraintMapping();
-        cmt.setConstraint(c);
-        cmt.setMethod("TRACE");
-        cmt.setPathSpec("/*");
-
-        ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
-        securityHandler.setConstraintMappings(new ConstraintMapping[] {cmt});
+        SecurityHandler.PathMethodMapped securityHandler = new SecurityHandler.PathMethodMapped();
+        securityHandler.put("/*", HttpMethod.TRACE.asString(), Constraint.FORBIDDEN);
 
         ctxHandler.setSecurityHandler(securityHandler);
     }