10

(This question has been downvoted, which I find strange. How have I offended?)

Am I right to think that running a swank server usually opens port 4005 to the world, not bound to localhost-only connections?

So anyone hacking in a café is not only allowing passers-by to execute arbitrary code on their computer, but is giving them a nice interface to do it with.

It appears that when I run a swank server with either 'mvn clojure:swank', or 'lein swank', or (swank.swank/start-server "/tmp/yo")

then I get something like (thanks Mike!):

$lsof -i -P
java      11693 john   13r  IPv6 6701891      0t0  TCP *:34983 (LISTEN)

and indeed I can connect from an emacs running on another machine on the same network.

(swank.swank/start-server "/tmp/yo")

If I start the server by hand, it produces the following output

Connection opened on local port  34983
#<ServerSocket ServerSocket[addr=0.0.0.0/0.0.0.0,port=0,localport=34983]>

Whereas:

(swank.swank/start-server "/tmp/yo" :host "localhost")

produces:

Connection opened on local port  40368
#<ServerSocket ServerSocket[addr=localhost/127.0.0.1,port=0,localport=40368]>

Which seems more like I was expecting.

Is there any good reason for doing this?

Any ideas on how it the more conventional ways of starting it could be persuaded to only accept connections from local processes?

John Lawrence Aspden
  • 17,124
  • 11
  • 67
  • 110

3 Answers3

5

Totally valid question.

After opening a slime server, you'll notice:

eames:~:% lsof -i -P | grep 4005
java      41477  mjd   33u  IPv6 0x0b8956d0      0t0  TCP [::127.0.0.1]:4005 (LISTEN)

The connection is listening on the local address at port 4005. This interface isn't exposed to the network, so other devices on the network can't connect to your slime server.

edit:

This was my result of starting swank using leiningen, which provides "localhost" as an argument to swank.swank/start-server. You may want to double check that the leiningen plugin is opening non-local ports.

You're right that swank opens the connection on every address if a host isn't explicitly provided. The relevant code is swank.util.net.sockets/make-server-socket, and this behavior is documented. I agree, it seems like the wrong default.

Mike Douglas
  • 3,345
  • 2
  • 28
  • 30
  • java 10561 john 14r IPv6 6521448 0t0 TCP *:4005 (LISTEN) – John Lawrence Aspden Sep 19 '10 at 21:15
  • That's a publicly exposed port. How are you starting swank? – Mike Douglas Sep 19 '10 at 21:18
  • mike, sorry for the super-terse response. was editing my original and somehow didn't notice that my copy and paste had gone into the comments. Thanks for the diagnostic! – John Lawrence Aspden Sep 19 '10 at 21:28
  • Seeing the same thing: java 8578 john 43u IPv6 597878 0t0 TCP *:4005 (LISTEN) using $lein version Leiningen 1.3.1 on Java 1.6.0_20 Java HotSpot(TM) Client VM and the port is open, confirmed by connecting to it from emacs on a second machine. – John Lawrence Aspden Sep 19 '10 at 21:58
  • Which version of swank are you using? You should have something like `:dev-dependencies [["swank-clojure" "1.2.1"]]` in your project.clj. – Mike Douglas Sep 19 '10 at 22:15
  • ah, mine says: [leiningen/lein-swank "1.1.0"]. will retry. – John Lawrence Aspden Sep 19 '10 at 22:17
  • generating a new project with $lein new test gives (defproject test "1.0.0-SNAPSHOT" :description "FIXME: write" :dependencies [[org.clojure/clojure "1.2.0"] [org.clojure/clojure-contrib "1.2.0"]]) and indeed, lein swank from here seems to open a local port. Looks like the default has been changed recently. Thanks! – John Lawrence Aspden Sep 19 '10 at 22:23
  • 3
    If you're using `swank-clojure.el`, you can add `:host \"localhost\"` inside the `format` string which controls how the server is started in `swank-clojure-init` (look for `"(swank.swank/start-server ...)\n\n"`) to have it listen on localhost only. – Michał Marczyk Sep 20 '10 at 00:36
1

it only accepts one connection so even if it is exposed to the world it stops listening once you connect.

Arthur Ulfeldt
  • 90,827
  • 27
  • 201
  • 284
  • and it's only a little annoying that it does not start listening when you disconnect (though i's much more secure this way) and it't really not a lot more work to restart it rather than having to remember to stop it when I finish. – Arthur Ulfeldt Sep 21 '10 at 17:59
1

If you're using the clojure-maven-plugin, version 1.3.4 was recently released which now start the swank server against localhost to prevent this problem.

This behaviour can be configured in your pom.xml file with:

<configuration>
  <swankHost>someotherhostname</swankHost>
</configuration>

or from the command line with:

mvn clojure:swank -Dclojure.swank.host=someotherhostname
Mark Derricutt
  • 979
  • 1
  • 11
  • 20