clojure swank server opens public port?

Question

(This question has been downvoted, which I find strange. How have I offended?)

Am I right to think that running a swank server usually opens port 4005 to the world, not bound to localhost-only connections?

So anyone hacking in a café is not only allowing passers-by to execute arbitrary code on their computer, but is giving them a nice interface to do it with.

It appears that when I run a swank server with either 'mvn clojure:swank', or 'lein swank', or (swank.swank/start-server "/tmp/yo")

then I get something like (thanks Mike!):

$lsof -i -P
java      11693 john   13r  IPv6 6701891      0t0  TCP *:34983 (LISTEN)

and indeed I can connect from an emacs running on another machine on the same network.

(swank.swank/start-server "/tmp/yo")

If I start the server by hand, it produces the following output

Connection opened on local port  34983
#<ServerSocket ServerSocket[addr=0.0.0.0/0.0.0.0,port=0,localport=34983]>

Whereas:

(swank.swank/start-server "/tmp/yo" :host "localhost")

produces:

Connection opened on local port  40368
#<ServerSocket ServerSocket[addr=localhost/127.0.0.1,port=0,localport=40368]>

Which seems more like I was expecting.

Is there any good reason for doing this?

Any ideas on how it the more conventional ways of starting it could be persuaded to only accept connections from local processes?

Answer 1

Totally valid question.

After opening a slime server, you'll notice:

eames:~:% lsof -i -P | grep 4005
java      41477  mjd   33u  IPv6 0x0b8956d0      0t0  TCP [::127.0.0.1]:4005 (LISTEN)

The connection is listening on the local address at port 4005. This interface isn't exposed to the network, so other devices on the network can't connect to your slime server.

edit:

This was my result of starting swank using leiningen, which provides "localhost" as an argument to swank.swank/start-server. You may want to double check that the leiningen plugin is opening non-local ports.

You're right that swank opens the connection on every address if a host isn't explicitly provided. The relevant code is swank.util.net.sockets/make-server-socket, and this behavior is documented. I agree, it seems like the wrong default.

Answer 2

it only accepts one connection so even if it is exposed to the world it stops listening once you connect.

Answer 3

If you're using the clojure-maven-plugin, version 1.3.4 was recently released which now start the swank server against localhost to prevent this problem.

This behaviour can be configured in your pom.xml file with:

<configuration>
  <swankHost>someotherhostname</swankHost>
</configuration>

or from the command line with:

mvn clojure:swank -Dclojure.swank.host=someotherhostname