traccar / traccar

Traccar GPS Tracking System
https://www.traccar.org
Apache License 2.0
4.95k stars 2.51k forks source link

Loads all protocols not the one listed in traccar.xml in version 6.12 #5334

Closed omogenot closed 2 weeks ago

omogenot commented 2 weeks ago

Describe the bug When traccar server starts, it loads all possible tracker protocols even if only 1 of them was declared in the configurations file.

To Reproduce Remove default.xml reference in the traccar.xml file :

<!--entry key='config.default'>./conf/default.xml</entry-->

Add only one tracker protocol in the file :

 <entry key='h02.port'>7700</entry>
 <entry key='h02.timeout'>600</entry>

Expected behavior Only the declared tracker protocols shall be active (i.e. only the declared ports shall be open on the server). This was the expected behaviour that work in my previous installed version (5.06).

tananaev commented 2 weeks ago

This is not a bug. It's expected behavior. Traccar loads all protocols by default.

omogenot commented 2 weeks ago

Understood as being, now, a default behaviour. Which is not documented in the release notes. However, this is potentially a big breach in security on servers that need only few protocols.

At least, a new config key shall be created such as :

<entry key='enable_all_protocols>true</entry>

So that a company can select whether or not to open all these ports.

tananaev commented 2 weeks ago

It was always the default behavior.

omogenot commented 2 weeks ago

It was always the default behavior.

Sorry to say it, but no. As I mentioned in my original message: I removed the reference to the default.xml file, so that no default protocol is declared. If I run the same traccar.xml config file with 5.08, it works as expected, if I upgrade to 6.12, all protocols are loaded instead of the only one declared in my config file. So something has changed. Either the config is not read from the same place, or ... (I don't know). I reverted to 5.08 for the time being.

tananaev commented 2 weeks ago

Sorry to say, but seems like you have been doing it wrong this whole time. You should have never ever touched default xml. This is exactly why we removed it now because people keep messing with it when it should never be modified.

omogenot commented 2 weeks ago

So something has changed... No, I don't think I did it wrong as I did not change a line in the default.xml, I just removed its reference from the traccar.xml as expected by the comment inside the file:

<!--

    This is the main configuration file. All your configuration parameters should be placed in this file.

    Default configuration parameters are located in the "default.xml" file. You should not modify it to avoid issues
    with upgrading to a new version. Parameters in the main config file override values in the default file. Do not
    remove "config.default" parameter from this file unless you know what you are doing.

    For list of available parameters see following page: https://www.traccar.org/configuration-file/

    -->

And I knew what I was doing apparently since it made what I expected.

Now, to come back to my original statement, I think there shall be a new key defined for the traccar.xml config file that allows to disable all default protocols (since this is a thing that we cannot have access to anymore now) and leave it to the user to declare only the one(s) the user needs. Once again, I believe it's not necessarily good to open so many ports on a server.

tananaev commented 2 weeks ago

What you're asking for is already available. It has been available for a long time. And that's what you should have been using instead of removing defaults.

omogenot commented 2 weeks ago

I think we are not talking about the same thing. Please review my original message. And could you please explain me how to achieve it with the new version 6.12.

tananaev commented 2 weeks ago

Recommended and valid configuration for the current and previous versions:

<entry key='protocols.enable'>h02</entry>
<entry key='h02.port'>7700</entry>
<entry key='h02.timeout'>600</entry>
omogenot commented 2 weeks ago

Thanks.