diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java index ca568ab9260e2838fc1dc8326d1c606ecc68a5e8..bc7e4ab9056a0425a43d6611bec3f824268ed338 100644 --- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java +++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java @@ -192,11 +192,19 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { // at java.lang.Thread.run(Thread.java:619) // at net.i2p.util.I2PThread.run(I2PThread.java:71) try { - serverin = _webserver.getInputStream(); + serverin = _webserver.getInputStream(); } catch (NullPointerException npe) { throw new IOException("getInputStream NPE"); } CompressedResponseOutputStream compressedOut = new CompressedResponseOutputStream(browserout); + + //Change headers to protect server identity + StringBuilder command = new StringBuilder(128); + Properties headers = readHeaders(serverin, command); + headers.setProperty("Server", "I2PServer"); + String modifiedHeaders = formatHeaders(headers, command); + compressedOut.write(modifiedHeaders.getBytes()); + Sender s = new Sender(compressedOut, serverin, "server: server to browser"); if (_log.shouldLog(Log.INFO)) _log.info("Before pumping the compressed response"); @@ -328,7 +336,7 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { /** ridiculously long, just to prevent OOM DOS @since 0.7.13 */ private static final int MAX_HEADERS = 60; - private Properties readHeaders(InputStream in, StringBuilder command) throws IOException { + private static Properties readHeaders(InputStream in, StringBuilder command) throws IOException { Properties headers = new Properties(); StringBuilder buf = new StringBuilder(128); @@ -348,8 +356,8 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { } } } - if (trimmed > 0) - getTunnel().getContext().statManager().addRateData("i2ptunnel.httpNullWorkaround", trimmed, 0); + //if (trimmed > 0) + // getTunnel().getContext().statManager().addRateData("i2ptunnel.httpNullWorkaround", trimmed, 0); int i = 0; while (true) { diff --git a/history.txt b/history.txt index ef5d62249f8dddfc2bfa318b566efbf995903040..1442617588700c62ee906bb305fc0f6ec3946b8e 100644 --- a/history.txt +++ b/history.txt @@ -1,3 +1,6 @@ +2010-12-07 Mathiasdm + * I2PTunnel: Security fix: change server reply + to return 'I2PServer' instead of the actual servername. 2010-12-06 dr|z3d * I2PSnark: - Resolve table header wrapping issue.