[Entitlements] Network entitlement classes + Datagram socket check fu…

…nctions (elastic#119735) (elastic#120211)
not-napoleon · Jan 15, 2025 · 00680c9 · 00680c9
1 parent a3adc5d
commit 00680c9
Show file tree

Hide file tree

Showing 11 changed files with 485 additions and 73 deletions.
diff --git a/...tlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java b/...tlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java
@@ -13,10 +13,16 @@
 import java.io.PrintStream;
 import java.io.PrintWriter;
 import java.net.ContentHandlerFactory;
+import java.net.DatagramPacket;
+import java.net.DatagramSocket;
 import java.net.DatagramSocketImplFactory;
 import java.net.FileNameMap;
+import java.net.InetAddress;
+import java.net.MulticastSocket;
+import java.net.NetworkInterface;
 import java.net.ProxySelector;
 import java.net.ResponseCache;
+import java.net.SocketAddress;
 import java.net.SocketImplFactory;
 import java.net.URL;
 import java.net.URLStreamHandler;
@@ -189,4 +195,28 @@ public interface EntitlementChecker {
 
     // The only implementation of SSLSession#getSessionContext(); unfortunately it's an interface, so we need to check the implementation
     void check$sun_security_ssl_SSLSessionImpl$getSessionContext(Class<?> callerClass, SSLSession sslSession);
+
+    void check$java_net_DatagramSocket$bind(Class<?> callerClass, DatagramSocket that, SocketAddress addr);
+
+    void check$java_net_DatagramSocket$connect(Class<?> callerClass, DatagramSocket that, InetAddress addr);
+
+    void check$java_net_DatagramSocket$connect(Class<?> callerClass, DatagramSocket that, SocketAddress addr);
+
+    void check$java_net_DatagramSocket$send(Class<?> callerClass, DatagramSocket that, DatagramPacket p);
+
+    void check$java_net_DatagramSocket$receive(Class<?> callerClass, DatagramSocket that, DatagramPacket p);
+
+    void check$java_net_DatagramSocket$joinGroup(Class<?> callerClass, DatagramSocket that, SocketAddress addr, NetworkInterface ni);
+
+    void check$java_net_DatagramSocket$leaveGroup(Class<?> callerClass, DatagramSocket that, SocketAddress addr, NetworkInterface ni);
+
+    void check$java_net_MulticastSocket$joinGroup(Class<?> callerClass, MulticastSocket that, InetAddress addr);
+
+    void check$java_net_MulticastSocket$joinGroup(Class<?> callerClass, MulticastSocket that, SocketAddress addr, NetworkInterface ni);
+
+    void check$java_net_MulticastSocket$leaveGroup(Class<?> callerClass, MulticastSocket that, InetAddress addr);
+
+    void check$java_net_MulticastSocket$leaveGroup(Class<?> callerClass, MulticastSocket that, SocketAddress addr, NetworkInterface ni);
+
+    void check$java_net_MulticastSocket$send(Class<?> callerClass, MulticastSocket that, DatagramPacket p, byte ttl);
 }
diff --git a/...qa/common/src/main/java/org/elasticsearch/entitlement/qa/common/DummyImplementations.java b/...qa/common/src/main/java/org/elasticsearch/entitlement/qa/common/DummyImplementations.java
@@ -9,8 +9,15 @@
 
 package org.elasticsearch.entitlement.qa.common;
 
+import java.io.IOException;
+import java.net.DatagramPacket;
+import java.net.DatagramSocket;
+import java.net.DatagramSocketImpl;
 import java.net.InetAddress;
+import java.net.NetworkInterface;
 import java.net.Socket;
+import java.net.SocketAddress;
+import java.net.SocketException;
 import java.security.cert.Certificate;
 import java.text.BreakIterator;
 import java.text.Collator;
@@ -327,8 +334,77 @@ public Socket createSocket(Socket s, String host, int port, boolean autoClose) {
         }
     }
 
+    static class DummyDatagramSocket extends DatagramSocket {
+        DummyDatagramSocket() throws SocketException {
+            super(new DatagramSocketImpl() {
+                @Override
+                protected void create() throws SocketException {}
+
+                @Override
+                protected void bind(int lport, InetAddress laddr) throws SocketException {}
+
+                @Override
+                protected void send(DatagramPacket p) throws IOException {}
+
+                @Override
+                protected int peek(InetAddress i) throws IOException {
+                    return 0;
+                }
+
+                @Override
+                protected int peekData(DatagramPacket p) throws IOException {
+                    return 0;
+                }
+
+                @Override
+                protected void receive(DatagramPacket p) throws IOException {}
+
+                @Override
+                protected void setTTL(byte ttl) throws IOException {}
+
+                @Override
+                protected byte getTTL() throws IOException {
+                    return 0;
+                }
+
+                @Override
+                protected void setTimeToLive(int ttl) throws IOException {}
+
+                @Override
+                protected int getTimeToLive() throws IOException {
+                    return 0;
+                }
+
+                @Override
+                protected void join(InetAddress inetaddr) throws IOException {}
+
+                @Override
+                protected void leave(InetAddress inetaddr) throws IOException {}
+
+                @Override
+                protected void joinGroup(SocketAddress mcastaddr, NetworkInterface netIf) throws IOException {}
+
+                @Override
+                protected void leaveGroup(SocketAddress mcastaddr, NetworkInterface netIf) throws IOException {}
+
+                @Override
+                protected void close() {}
+
+                @Override
+                public void setOption(int optID, Object value) throws SocketException {}
+
+                @Override
+                public Object getOption(int optID) throws SocketException {
+                    return null;
+                }
+
+                @Override
+                protected void connect(InetAddress address, int port) throws SocketException {}
+            });
+        }
+    }
+
     private static RuntimeException unexpected() {
         return new IllegalStateException("This method isn't supposed to be called");
     }
-
 }