Attachment 186619 Details for Bug 322917 – Patch to restrict the local host address on which equinox listens for telnet connections

Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

[patch] Patch to restrict the local host address on which equinox listens for telnet connections

restrict_console_host_patch.txt (text/plain), 3.73 KB, created by Lazar Kirchev

on 2011-01-12 08:09:53 EST

(hide)

Description:

Filename:

MIME Type:

Creator: Lazar Kirchev

Created: 2011-01-12 08:09:53 EST

Size: 3.73 KB

patch

obsolete

>Index: console/src/org/eclipse/osgi/framework/internal/core/ConsoleManager.java
>===================================================================
>RCS file: /cvsroot/rt/org.eclipse.equinox/framework/bundles/org.eclipse.osgi/console/src/org/eclipse/osgi/framework/internal/core/ConsoleManager.java,v
>retrieving revision 1.7
>diff -u -r1.7 ConsoleManager.java
>--- console/src/org/eclipse/osgi/framework/internal/core/ConsoleManager.java	11 Jan 2011 13:20:25 -0000	1.7
>+++ console/src/org/eclipse/osgi/framework/internal/core/ConsoleManager.java	12 Jan 2011 13:03:53 -0000
>@@ -12,8 +12,7 @@
> 
> import java.io.*;
> import java.lang.reflect.Method;
>-import java.net.ServerSocket;
>-import java.net.Socket;
>+import java.net.*;
> import java.util.Dictionary;
> import java.util.Hashtable;
> import org.eclipse.osgi.framework.console.CommandProvider;
>@@ -92,23 +91,38 @@
> 	private final ServiceTracker<CommandProvider, CommandProvider> cpTracker;
> 	private final ServiceTracker<ConsoleSession, FrameworkConsole> sessions;
> 	private final String consolePort;
>+	// Allow for specifying the particular local host address on which the framework to listen for connections. Currently it listens on 
>+	// all network interfaces of the host and restricting this is desirable from security point of view. See bug 322917.
>+	private final String consoleHost;
> 	private FrameworkCommandProvider fwkCommands;
> 	private ServiceRegistration<?> builtinSession;
>-	private ConsoleSocketGetter scsg;
>+	private ConsoleSocketGetter socketGetter;
> 	private final boolean isEnabled;
> 
>-	public ConsoleManager(Framework framework, String consolePort) {
>-		if ("false".equals(FrameworkProperties.getProperty(PROP_CONSOLE_ENABLED)) || "none".equals(consolePort)) { //$NON-NLS-1$ //$NON-NLS-2$
>+	public ConsoleManager(Framework framework, String consolePropValue) {
>+		String port = null;
>+		String host = null;
>+		if (consolePropValue != null) {
>+			int index = consolePropValue.lastIndexOf(":"); //$NON-NLS-1$
>+			if (index > -1) {
>+				host = consolePropValue.substring(0, index);
>+			}
>+			port = consolePropValue.substring(index + 1);
>+		}
>+
>+		if ("false".equals(FrameworkProperties.getProperty(PROP_CONSOLE_ENABLED)) || "none".equals(port)) { //$NON-NLS-1$ //$NON-NLS-2$
> 			isEnabled = false;
> 			this.framework = null;
> 			this.cpTracker = null;
> 			this.sessions = null;
>+			this.consoleHost = null;
> 			this.consolePort = null;
> 			return;
> 		}
> 		this.isEnabled = true;
> 		this.framework = framework;
>-		this.consolePort = consolePort != null ? consolePort.trim() : consolePort;
>+		this.consoleHost = host != null ? host.trim() : host;
>+		this.consolePort = port != null ? port.trim() : port;
> 		this.cpTracker = new ServiceTracker<CommandProvider, CommandProvider>(framework.getSystemBundleContext(), CommandProvider.class.getName(), null);
> 		this.sessions = new ServiceTracker<ConsoleSession, FrameworkConsole>(framework.getSystemBundleContext(), ConsoleSession.class.getName(), this);
> 	}
>@@ -166,7 +180,11 @@
> 			builtinSession = framework.getSystemBundleContext().registerService(ConsoleSession.class.getName(), session, props);
> 		} else {
> 			try {
>-				scsg = new ConsoleManager.ConsoleSocketGetter(new ServerSocket(port));
>+				if (consoleHost != null) {
>+					socketGetter = new ConsoleSocketGetter(new ServerSocket(port, 0, InetAddress.getByName(consoleHost)));
>+				} else {
>+					socketGetter = new ConsoleManager.ConsoleSocketGetter(new ServerSocket(port));
>+				}
> 			} catch (IOException e) {
> 				e.printStackTrace();
> 			}
>@@ -189,8 +207,8 @@
> 			}
> 		sessions.close();
> 		cpTracker.close();
>-		if (scsg != null)
>-			scsg.shutdown();
>+		if (socketGetter != null)
>+			socketGetter.shutdown();
> 		if (fwkCommands != null)
> 			fwkCommands.stop();
> 	}

Flags:

tjwatson: iplog+

Actions: View | Diff

Attachments on bug 322917: 186619