[#728] Reject TCP self-connects in replication connect paths (#729)

Valery Kharseko

19 hours ago 85631013fbb28dea7e9c89e5a3b51684defbdd11

 opendj-server-legacy/src/main/java/org/opends/server/replication/server/ReplicationServer.java

@@ -13,6 +13,7 @@
 *
 * Copyright 2006-2010 Sun Microsystems, Inc.
 * Portions Copyright 2011-2016 ForgeRock AS.
 * Portions Copyrighted 2026 3A Systems, LLC.
 */
package org.opends.server.replication.server;

@@ -21,6 +22,7 @@
import static org.opends.server.util.StaticUtils.*;

import java.io.IOException;
import java.net.ConnectException;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.ServerSocket;
@@ -414,6 +416,15 @@
      }
      int timeoutMS = MultimasterReplication.getConnectionTimeoutMS();
      socket.connect(remoteServerAddress.toInetSocketAddress(), timeoutMS);
      if (isSelfConnection(socket))
      {
        // While the remote RS is down, the kernel may pick its port as the
        // local port of this connecting socket (TCP simultaneous open),
        // "connecting" it to itself. Keeping such a socket open would hold
        // the port and prevent the RS from binding it on restart.
        throw new ConnectException("Connection to " + remoteServerAddress
            + " is a TCP self-connect, no replication server is listening");
      }
      session = replSessionSecurity.createClientSession(socket, timeoutMS);

      ReplicationServerHandler rsHandler = new ReplicationServerHandler(