Skip to content
This repository was archived by the owner on Sep 13, 2023. It is now read-only.

Commit 2283a0e

Browse files
lsimonslsimons
committed
Disable more potentialy unsafe networking code in log4j.net.
Disables * SocketNode * TelnetAppender Adds tests for the remaining behavior. Adds warnings * for SyslogAppender if logging to a non-loopback address * deprecation for SocketAppender since it's the client side of the disabled server code Normalizes warnings in other net code to use LogLog.error() consistently and removes internal use of log4j Logger objects.
1 parent c11c645 commit 2283a0e

File tree

13 files changed

+80
-314
lines changed

13 files changed

+80
-314
lines changed

‎src/main/java/org/apache/log4j/helpers/SyslogWriter.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,10 @@ public class SyslogWriter extends Writer {
9292

9393
try {
9494
this.address = InetAddress.getByName(host);
95+
if(!this.address.isLoopbackAddress()) {
96+
LogLog.warn("WARN-LOG4J-NETWORKING-REMOTE-SYSLOG: logging to remote syslog host '" +
97+
syslogHost + "'! Syslog is an unencrypted protocol.");
98+
}
9599
}
96100
catch (UnknownHostException e) {
97101
LogLog.error("Could not find " + host +

‎src/main/java/org/apache/log4j/net/JMSAppender.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public class JMSAppender extends AppenderSkeleton {
4242

4343
static final String JMS_UNSUPPORTED =
4444
"ERROR-LOG4J-NETWORKING-UNSUPPORTED: JMS unsupported!" +
45-
" This is a breaking change in Log4J >=1.2.18. Change your config to stop using JMS!";
45+
" This is a breaking change in Log4J 1 >=1.2.18. Change your config to stop using JMS!";
4646

4747
public
4848
JMSAppender() {

‎src/main/java/org/apache/log4j/net/JMSSink.java

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717

1818
package org.apache.log4j.net;
1919

20-
import org.apache.log4j.Logger;
20+
import org.apache.log4j.helpers.LogLog;
2121

2222
import javax.naming.Context;
2323
import javax.naming.NamingException;
@@ -34,25 +34,23 @@
3434
*/
3535
public class JMSSink implements javax.jms.MessageListener {
3636

37-
static Logger logger = Logger.getLogger(JMSSink.class);
38-
3937
static public void main(String[] args) throws Exception {
4038
usage();
4139
}
4240

4341
/** @noinspection unused*/
4442
public JMSSink(String tcfBindingName, String topicBindingName, String username,
4543
String password) {
46-
logger.error(JMSAppender.JMS_UNSUPPORTED);
44+
LogLog.error(JMSAppender.JMS_UNSUPPORTED);
4745
}
4846

4947
public void onMessage(javax.jms.Message message) {
50-
logger.error(JMSAppender.JMS_UNSUPPORTED);
48+
LogLog.error(JMSAppender.JMS_UNSUPPORTED);
5149
}
5250

53-
/** @noinspection unused*/
51+
/** @noinspection unused, UnusedReturnValue, SameParameterValue */
5452
protected static Object lookup(Context ctx, String name) throws NamingException {
55-
logger.error(JMSAppender.JMS_UNSUPPORTED);
53+
LogLog.error(JMSAppender.JMS_UNSUPPORTED);
5654
throw new NamingException(JMSAppender.JMS_UNSUPPORTED);
5755
}
5856

‎src/main/java/org/apache/log4j/net/SimpleSocketServer.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public class SimpleSocketServer {
3131

3232
static final String SOCKET_SERVER_UNSUPPORTED =
3333
"ERROR-LOG4J-NETWORKING-UNSUPPORTED: SimpleSocketServer unsupported!" +
34-
" This is a breaking change in Log4J >=1.2.18. Stop using this class!";
34+
" This is a breaking change in Log4J 1 >=1.2.18. Stop using this class!";
3535

3636
public
3737
static

‎src/main/java/org/apache/log4j/net/SocketAppender.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,10 @@ is slow but still faster than the rate of (log) event production
9797
</ul>
9898
9999
@author Ceki G&uuml;lc&uuml;
100+
@deprecated
101+
The server side of the log4j socket protocol has been disabled
102+
in Log4j >= 1.2.18. Change your config to ship logs using a
103+
modern and secure protocol!
100104
@since 0.8.4 */
101105

102106
public class SocketAppender extends AppenderSkeleton {

‎src/main/java/org/apache/log4j/net/SocketHubAppender.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ public class SocketHubAppender extends AppenderSkeleton {
3939

4040
static final String SOCKET_HUB_UNSUPPORTED =
4141
"ERROR-LOG4J-NETWORKING-UNSUPPORTED: SocketHubAppender unsupported!" +
42-
" This is a breaking change in Log4J >=1.2.18. Stop using this class!";
42+
" This is a breaking change in Log4J 1 >=1.2.18. Stop using this class!";
4343

4444
/**
4545
The default port number of the ServerSocket will be created on. */

‎src/main/java/org/apache/log4j/net/SocketNode.java

Lines changed: 13 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -17,108 +17,38 @@
1717

1818
package org.apache.log4j.net;
1919

20-
import java.io.BufferedInputStream;
21-
import java.io.IOException;
22-
import java.io.InterruptedIOException;
23-
import java.io.ObjectInputStream;
2420
import java.net.Socket;
2521

26-
import org.apache.log4j.Logger;
22+
import org.apache.log4j.helpers.LogLog;
2723
import org.apache.log4j.spi.LoggerRepository;
2824
import org.apache.log4j.spi.LoggingEvent;
2925

3026
// Contributors: Moses Hohman <mmhohman@rainbow.uchicago.edu>
3127

3228
/**
3329
Read {@link LoggingEvent} objects sent from a remote client using
34-
Sockets (TCP). These logging events are logged according to local
35-
policy, as if they were generated locally.
30+
Sockets (TCP) in Log4j up to 1.2.17.
3631
37-
<p>For example, the socket node might decide to log events to a
38-
local file and also resent them to a second socket node.
32+
Changed in 1.2.18+ to complain about its use and do nothing else.
33+
See <a href="https://logging.apache.org/log4j/1.2/">the log4j 1.2 homepage</a>
34+
for more information on why JMS is disabled since 1.2.18.
3935
40-
@author Ceki G&uuml;lc&uuml;
36+
@author Ceki G&uuml;lc&uuml;
4137
42-
@since 0.8.4
38+
@since 0.8.4
39+
@noinspection unused
4340
*/
4441
public class SocketNode implements Runnable {
4542

46-
Socket socket;
47-
LoggerRepository hierarchy;
48-
ObjectInputStream ois;
49-
50-
static Logger logger = Logger.getLogger(SocketNode.class);
43+
static final String SOCKET_NODE_UNSUPPORTED =
44+
"ERROR-LOG4J-NETWORKING-UNSUPPORTED: SocketNode unsupported!" +
45+
" This is a breaking change in Log4J 1 >=1.2.18. Stop using this class!";
5146

5247
public SocketNode(Socket socket, LoggerRepository hierarchy) {
53-
this.socket = socket;
54-
this.hierarchy = hierarchy;
55-
try {
56-
ois = new ObjectInputStream(
57-
new BufferedInputStream(socket.getInputStream()));
58-
} catch(InterruptedIOException e) {
59-
Thread.currentThread().interrupt();
60-
logger.error("Could not open ObjectInputStream to "+socket, e);
61-
} catch(IOException e) {
62-
logger.error("Could not open ObjectInputStream to "+socket, e);
63-
} catch(RuntimeException e) {
64-
logger.error("Could not open ObjectInputStream to "+socket, e);
65-
}
48+
LogLog.error(SOCKET_NODE_UNSUPPORTED);
6649
}
6750

68-
//public
69-
//void finalize() {
70-
//System.err.println("-------------------------Finalize called");
71-
// System.err.flush();
72-
//}
73-
7451
public void run() {
75-
LoggingEvent event;
76-
Logger remoteLogger;
77-
78-
try {
79-
if (ois != null) {
80-
while(true) {
81-
// read an event from the wire
82-
event = (LoggingEvent) ois.readObject();
83-
// get a logger from the hierarchy. The name of the logger is taken to be the name contained in the event.
84-
remoteLogger = hierarchy.getLogger(event.getLoggerName());
85-
//event.logger = remoteLogger;
86-
// apply the logger-level filter
87-
if(event.getLevel().isGreaterOrEqual(remoteLogger.getEffectiveLevel())) {
88-
// finally log the event as if was generated locally
89-
remoteLogger.callAppenders(event);
90-
}
91-
}
92-
}
93-
} catch(java.io.EOFException e) {
94-
logger.info("Caught java.io.EOFException closing conneciton.");
95-
} catch(java.net.SocketException e) {
96-
logger.info("Caught java.net.SocketException closing conneciton.");
97-
} catch(InterruptedIOException e) {
98-
Thread.currentThread().interrupt();
99-
logger.info("Caught java.io.InterruptedIOException: "+e);
100-
logger.info("Closing connection.");
101-
} catch(IOException e) {
102-
logger.info("Caught java.io.IOException: "+e);
103-
logger.info("Closing connection.");
104-
} catch(Exception e) {
105-
logger.error("Unexpected exception. Closing conneciton.", e);
106-
} finally {
107-
if (ois != null) {
108-
try {
109-
ois.close();
110-
} catch(Exception e) {
111-
logger.info("Could not close connection.", e);
112-
}
113-
}
114-
if (socket != null) {
115-
try {
116-
socket.close();
117-
} catch(InterruptedIOException e) {
118-
Thread.currentThread().interrupt();
119-
} catch(IOException ex) {
120-
}
121-
}
122-
}
52+
LogLog.error(SOCKET_NODE_UNSUPPORTED);
12353
}
12454
}

‎src/main/java/org/apache/log4j/net/SocketServer.java

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -17,17 +17,9 @@
1717

1818
package org.apache.log4j.net;
1919

20-
import java.io.File;
21-
import java.net.InetAddress;
22-
import java.util.Hashtable;
20+
import org.apache.log4j.helpers.LogLog;
2321

24-
import org.apache.log4j.Hierarchy;
25-
import org.apache.log4j.Level;
26-
import org.apache.log4j.LogManager;
27-
import org.apache.log4j.Logger;
28-
import org.apache.log4j.PropertyConfigurator;
29-
import org.apache.log4j.spi.LoggerRepository;
30-
import org.apache.log4j.spi.RootLogger;
22+
import java.io.File;
3123

3224

3325
/**
@@ -45,9 +37,7 @@ public class SocketServer {
4537

4638
static final String SOCKET_SERVER_UNSUPPORTED =
4739
"ERROR-LOG4J-NETWORKING-UNSUPPORTED: SocketServer unsupported!" +
48-
" This is a breaking change in Log4J >=1.2.18. Stop using this class!";
49-
50-
static Logger cat = Logger.getLogger(SocketServer.class);
40+
" This is a breaking change in Log4J 1 >=1.2.18. Stop using this class!";
5141

5242
public
5343
static
@@ -65,6 +55,6 @@ void usage() {
6555
/** @noinspection unused*/
6656
public
6757
SocketServer(File directory) {
68-
cat.error(SOCKET_SERVER_UNSUPPORTED);
58+
LogLog.error(SOCKET_SERVER_UNSUPPORTED);
6959
}
7060
}

‎src/main/java/org/apache/log4j/net/SyslogAppender.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@
3737
/**
3838
Use SyslogAppender to send log messages to a remote syslog daemon.
3939
40+
Since Log4J 1.2.18, will log a warning if the remote syslog daemon
41+
is not a local loopback (127.x.x.x or ::1/128).
42+
4043
@author Ceki G&uuml;lc&uuml;
4144
@author Anders Kristensen
4245
*/

0 commit comments

Comments
 (0)