Skip to content

Commit 304e1ab

Browse files
ldematteldematte
committed
Add URLConnection instrumentation
1 parent ae46613 commit 304e1ab

File tree

2 files changed

+196
-1
lines changed

2 files changed

+196
-1
lines changed

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,9 +322,49 @@ public interface EntitlementChecker {
322322

323323
void check$java_net_Socket$connect(Class<?> callerClass, Socket that, SocketAddress endpoint, int backlog);
324324

325-
// Network miscellanea
325+
// URLConnection (java.net + sun.net.www)
326+
326327
void check$java_net_URL$openConnection(Class<?> callerClass, java.net.URL that, Proxy proxy);
327328

329+
void check$java_net_URLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that);
330+
331+
void check$java_net_URLConnection$getContentLengthLong(Class<?> callerClass, java.net.URLConnection that);
332+
333+
void check$java_net_URLConnection$getContentType(Class<?> callerClass, java.net.URLConnection that);
334+
335+
void check$java_net_URLConnection$getContentEncoding(Class<?> callerClass, java.net.URLConnection that);
336+
337+
void check$java_net_URLConnection$getExpiration(Class<?> callerClass, java.net.URLConnection that);
338+
339+
void check$java_net_URLConnection$getDate(Class<?> callerClass, java.net.URLConnection that);
340+
341+
void check$java_net_URLConnection$getLastModified(Class<?> callerClass, java.net.URLConnection that);
342+
343+
void check$java_net_URLConnection$getHeaderFieldInt(Class<?> callerClass, java.net.URLConnection that, String name, int defaultValue);
344+
345+
void check$java_net_URLConnection$getHeaderFieldLong(Class<?> callerClass, java.net.URLConnection that, String name, long defaultValue);
346+
347+
void check$java_net_URLConnection$getHeaderFieldDate(Class<?> callerClass, java.net.URLConnection that, String name, long defaultValue);
348+
349+
void check$java_net_URLConnection$getContent(Class<?> callerClass, java.net.URLConnection that);
350+
351+
void check$java_net_URLConnection$getContent(Class<?> callerClass, java.net.URLConnection that, Class<?>[] classes);
352+
353+
// Using java.net.URLConnection for "that" as sun.net.www.URLConnection is not exported
354+
void check$sun_net_www_URLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, String name);
355+
356+
void check$sun_net_www_URLConnection$getHeaderFields(Class<?> callerClass, java.net.URLConnection that);
357+
358+
void check$sun_net_www_URLConnection$getHeaderFieldKey(Class<?> callerClass, java.net.URLConnection that, int n);
359+
360+
void check$sun_net_www_URLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, int n);
361+
362+
void check$sun_net_www_URLConnection$getContentType(Class<?> callerClass, java.net.URLConnection that);
363+
364+
void check$sun_net_www_URLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that);
365+
366+
// Network miscellanea
367+
328368
// HttpClient#send and sendAsync are abstract, so we instrument their internal implementations
329369
void check$jdk_internal_net_http_HttpClientImpl$send(
330370
Class<?> callerClass,

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
import java.net.DatagramSocket;
3737
import java.net.DatagramSocketImplFactory;
3838
import java.net.FileNameMap;
39+
import java.net.HttpURLConnection;
3940
import java.net.InetAddress;
4041
import java.net.InetSocketAddress;
4142
import java.net.MulticastSocket;
@@ -646,6 +647,160 @@ public ElasticsearchEntitlementChecker(PolicyManager policyManager) {
646647
}
647648
}
648649

650+
// We have to use class names for sun.net.www classes as java.base does not export them
651+
private static final List<String> ADDITIONAL_NETWORK_URL_CONNECT_CLASS_NAMES = List.of(
652+
"sun.net.www.protocol.ftp.FtpURLConnection",
653+
"sun.net.www.protocol.mailto.MailToURLConnection"
654+
);
655+
656+
private static boolean isNetworkUrlConnection(java.net.URLConnection urlConnection) {
657+
var connectionClass = urlConnection.getClass();
658+
return connectionClass.isAssignableFrom(HttpURLConnection.class)
659+
|| ADDITIONAL_NETWORK_URL_CONNECT_CLASS_NAMES.contains(connectionClass.getName());
660+
}
661+
662+
@Override
663+
public void check$java_net_URLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that) {
664+
if (isNetworkUrlConnection(that)) {
665+
policyManager.checkOutboundNetworkAccess(callerClass);
666+
}
667+
}
668+
669+
@Override
670+
public void check$java_net_URLConnection$getContentLengthLong(Class<?> callerClass, java.net.URLConnection that) {
671+
if (isNetworkUrlConnection(that)) {
672+
policyManager.checkOutboundNetworkAccess(callerClass);
673+
}
674+
}
675+
676+
@Override
677+
public void check$java_net_URLConnection$getContentType(Class<?> callerClass, java.net.URLConnection that) {
678+
if (isNetworkUrlConnection(that)) {
679+
policyManager.checkOutboundNetworkAccess(callerClass);
680+
}
681+
}
682+
683+
@Override
684+
public void check$java_net_URLConnection$getContentEncoding(Class<?> callerClass, java.net.URLConnection that) {
685+
if (isNetworkUrlConnection(that)) {
686+
policyManager.checkOutboundNetworkAccess(callerClass);
687+
}
688+
}
689+
690+
@Override
691+
public void check$java_net_URLConnection$getExpiration(Class<?> callerClass, java.net.URLConnection that) {
692+
if (isNetworkUrlConnection(that)) {
693+
policyManager.checkOutboundNetworkAccess(callerClass);
694+
}
695+
}
696+
697+
@Override
698+
public void check$java_net_URLConnection$getDate(Class<?> callerClass, java.net.URLConnection that) {
699+
if (isNetworkUrlConnection(that)) {
700+
policyManager.checkOutboundNetworkAccess(callerClass);
701+
}
702+
}
703+
704+
@Override
705+
public void check$java_net_URLConnection$getLastModified(Class<?> callerClass, java.net.URLConnection that) {
706+
if (isNetworkUrlConnection(that)) {
707+
policyManager.checkOutboundNetworkAccess(callerClass);
708+
}
709+
}
710+
711+
@Override
712+
public void check$java_net_URLConnection$getHeaderFieldInt(
713+
Class<?> callerClass,
714+
java.net.URLConnection that,
715+
String name,
716+
int defaultValue
717+
) {
718+
if (isNetworkUrlConnection(that)) {
719+
policyManager.checkOutboundNetworkAccess(callerClass);
720+
}
721+
}
722+
723+
@Override
724+
public void check$java_net_URLConnection$getHeaderFieldLong(
725+
Class<?> callerClass,
726+
java.net.URLConnection that,
727+
String name,
728+
long defaultValue
729+
) {
730+
if (isNetworkUrlConnection(that)) {
731+
policyManager.checkOutboundNetworkAccess(callerClass);
732+
}
733+
}
734+
735+
@Override
736+
public void check$java_net_URLConnection$getHeaderFieldDate(
737+
Class<?> callerClass,
738+
java.net.URLConnection that,
739+
String name,
740+
long defaultValue
741+
) {
742+
if (isNetworkUrlConnection(that)) {
743+
policyManager.checkOutboundNetworkAccess(callerClass);
744+
}
745+
}
746+
747+
@Override
748+
public void check$java_net_URLConnection$getContent(Class<?> callerClass, java.net.URLConnection that) {
749+
if (isNetworkUrlConnection(that)) {
750+
policyManager.checkOutboundNetworkAccess(callerClass);
751+
}
752+
}
753+
754+
@Override
755+
public void check$java_net_URLConnection$getContent(Class<?> callerClass, java.net.URLConnection that, Class<?>[] classes) {
756+
if (isNetworkUrlConnection(that)) {
757+
policyManager.checkOutboundNetworkAccess(callerClass);
758+
}
759+
}
760+
761+
// Using java.net.URLConnection for "that" as sun.net.www.URLConnection is not exported
762+
@Override
763+
public void check$sun_net_www_URLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, String name) {
764+
if (isNetworkUrlConnection(that)) {
765+
policyManager.checkOutboundNetworkAccess(callerClass);
766+
}
767+
}
768+
769+
@Override
770+
public void check$sun_net_www_URLConnection$getHeaderFields(Class<?> callerClass, java.net.URLConnection that) {
771+
if (isNetworkUrlConnection(that)) {
772+
policyManager.checkOutboundNetworkAccess(callerClass);
773+
}
774+
}
775+
776+
@Override
777+
public void check$sun_net_www_URLConnection$getHeaderFieldKey(Class<?> callerClass, java.net.URLConnection that, int n) {
778+
if (isNetworkUrlConnection(that)) {
779+
policyManager.checkOutboundNetworkAccess(callerClass);
780+
}
781+
}
782+
783+
@Override
784+
public void check$sun_net_www_URLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, int n) {
785+
if (isNetworkUrlConnection(that)) {
786+
policyManager.checkOutboundNetworkAccess(callerClass);
787+
}
788+
}
789+
790+
@Override
791+
public void check$sun_net_www_URLConnection$getContentType(Class<?> callerClass, java.net.URLConnection that) {
792+
if (isNetworkUrlConnection(that)) {
793+
policyManager.checkOutboundNetworkAccess(callerClass);
794+
}
795+
}
796+
797+
@Override
798+
public void check$sun_net_www_URLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that) {
799+
if (isNetworkUrlConnection(that)) {
800+
policyManager.checkOutboundNetworkAccess(callerClass);
801+
}
802+
}
803+
649804
@Override
650805
public void check$jdk_internal_net_http_HttpClientImpl$send(
651806
Class<?> callerClass,

0 commit comments

Comments
 (0)