Repository navigation
Connect SyslogOutputStream's DatagramSocket to the syslog host (#939) - #1076
Merged
Merged
Conversation
…h#939) SyslogOutputStream created its DatagramSocket with the no-arg constructor, which binds an ephemeral port on the wildcard address. The appender holds that socket for its whole lifetime, so hardened environments see an unconnected UDP listener on all interfaces (ss -ulnp) for as long as the application runs. This stream only ever sends datagrams to one host:port, so the socket is now connected to that address. A connected UDP socket is reported as connected to its peer instead of listening on the wildcard, while the OS still selects the source address per routing table - remote syslog targets are unaffected. The issue's suggestion of binding to localhost was not followed, as loopback-sourced packets are dropped by remote receivers. SyslogOutputStreamTest asserts the connected state and, on a real local DatagramSocket, that flush() still delivers the datagram. Closes qos-ch#939
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SyslogOutputStreamcreates itsDatagramSocketwith the no-arg constructor, which binds an ephemeral port on the wildcard address. The appender holds that socket for its whole lifetime, so hardened environments observe an unconnected UDP listener on all interfaces (ss -ulnp) for as long as the application runs - exactly the "random ports getting (and remaining) open" from the issue.This stream only ever sends datagrams to one
host:port, so the socket is now connected to that address in the constructor:ssas connected to its peer instead of listening on the wildcard, which removes the exposure;send()is unchanged - every packet already targets exactly the connected address.The issue's suggestion of binding the socket to
localhostwas deliberately not followed: datagrams sourced from a loopback address are dropped by remote syslog receivers, which would break every non-local configuration.SyslogOutputStreamTest(new) asserts the connected state and, against a real localDatagramSocket, thatflush()still delivers the datagram to the receiving socket. Existing behavior is otherwise untouched;close()still releases the socket.Verification: Windows, JDK 21.
mvn -pl logback-core test -Dtest=SyslogOutputStreamTestpasses (2/2); reverting onlySyslogOutputStreamfails the connected-state test.Closes #939