Bug 225592 - Internal websocket server must only accept connections from localhost
Internal websocket server must only accept connections from localhost
Status: VERIFIED FIXED
Product: web
Classification: Unclassified
Component: HTML Project
7.3
All All
: P1 (vote)
: 7.3
Assigned To: Tomas Mysik
issues@web
: 73_HR_FIX
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-01-31 11:20 UTC by Petr Jiricka
Modified: 2013-02-06 11:20 UTC (History)
3 users (show)

See Also:
Issue Type: DEFECT
:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Petr Jiricka 2013-01-31 11:20:44 UTC
To strengthen security, the websocket server in:
/netserver/src/org/netbeans/modules/netserver/SocketFramework.java 
/web.common/src/org/netbeans/modules/web/common/api/WebServer.java

must only accept connections from localhost, not from other machines. This is an interim solution for 7.3 only, for post-7.3 we will want to think about another solution.
Comment 1 Tomas Mysik 2013-01-31 11:28:20 UTC
I will look at it. Not sure about TM.
Comment 2 Tomas Mysik 2013-01-31 12:15:16 UTC
David suggested this patch:

diff --git a/netserver/src/org/netbeans/modules/netserver/SocketFramework.java b/netserver/src/org/netbeans/modules/netserver/SocketFramework.java
--- a/netserver/src/org/netbeans/modules/netserver/SocketFramework.java
+++ b/netserver/src/org/netbeans/modules/netserver/SocketFramework.java
@@ -132,6 +132,11 @@
                if (!key.isValid()) {
                    continue;
                }
+                if (key.channel() instanceof SocketChannel &&
+ (!((SocketChannel)key.channel()).socket().getInetAddress().isSiteLocalAddress())) {
+                    close(key);
+                    continue;
+                }

                try {
                    process(key);
Comment 3 Tomas Mysik 2013-01-31 12:22:39 UTC
Unfortunately, David's patch does not work for me (Chrome will stay on the "blank" page). I am NOT expert in this area, but the proper solution seems to me to bind this server just to local address, it means to start it with:
new InetSocketAddress("localhost", PORT).
Comment 4 Tomas Mysik 2013-01-31 13:11:51 UTC
One note to David's patch: not only isSiteLocalAddress() but also
isLoopbackAddress() must be called. However, then anyone from local address
(e.g. WiFi) can connect to the server and this is not what we want, at least
now.

Fixed by binding to the localhost, can be verified using netstat utility [1].

Fixed _only_ in branch release73 in the releases repo. Please verify, thanks.

http://hg.netbeans.org/releases/rev/1bbf113ae327

[1] tcp6       0      0 127.0.0.1:8008          :::*                    LISTEN 
    18743/java
Comment 5 Tomas Mysik 2013-01-31 13:13:47 UTC
I forgot - as agreed with PetrJ, fixed only the websocket server, not the internal webserver.

Thanks.
Comment 6 Vladimir Riha 2013-01-31 13:59:15 UTC
I tried the patch and its ok, I also tried simple inpection/debugging (just if it even works). I'll verify it tomorrow in RC.
Comment 7 Petr Jiricka 2013-01-31 14:11:27 UTC
Thanks a lot everyone.
Comment 8 David Konecny 2013-01-31 19:15:52 UTC
Thanks for resolving this Tomas. My patch was an idea rather than know-how.
Comment 9 Quality Engineering 2013-02-01 01:21:09 UTC
Integrated into 'releases', will be available in build *201301312200* or newer. Wait for official and publicly available build.
Changeset: http://hg.netbeans.org/releases/rev/1bbf113ae327
User: Tomas Mysik <tmysik@netbeans.org>
Log: #225592 - Internal websocket server must only accept connections from localhost
Comment 10 Vladimir Riha 2013-02-01 08:26:03 UTC
verified

Product Version: NetBeans IDE 7.3 RC1 (Build 201301312200)
Java: 1.6.0_38; Java HotSpot(TM) Client VM 20.13-b02
Runtime: Java(TM) SE Runtime Environment 1.6.0_38-b05
System: Linux version 3.2.0-35-generic-pae running on i386; UTF-8; en_US (nb)
Comment 11 Petr Jiricka 2013-02-05 10:10:39 UTC
Also transplanted to trunk: http://hg.netbeans.org/web-main/rev/71cb4f5aba4c
Comment 12 Quality Engineering 2013-02-06 11:20:37 UTC
Integrated into 'main-golden', will be available in build *201302060843* on http://bits.netbeans.org/dev/nightly/ (upload may still be in progress)
Changeset: http://hg.netbeans.org/main-golden/rev/71cb4f5aba4c
User: Tomas Mysik <tmysik@netbeans.org>
Log: #225592 - Internal websocket server must only accept connections from localhost
(transplanted from 1bbf113ae327f0712b9f9c0fcfffe359f1f9dd1a)


By use of this website, you agree to the NetBeans Policies and Terms of Use. © 2012, Oracle Corporation and/or its affiliates. Sponsored by Oracle logo