From 85631013fbb28dea7e9c89e5a3b51684defbdd11 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Sat, 11 Jul 2026 07:41:55 +0000
Subject: [PATCH] [#728] Reject TCP self-connects in replication connect paths (#729)
---
opendj-server-legacy/src/main/java/org/opends/server/replication/server/ReplicationServer.java | 11 +++++++++++
1 files changed, 11 insertions(+), 0 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/replication/server/ReplicationServer.java b/opendj-server-legacy/src/main/java/org/opends/server/replication/server/ReplicationServer.java
index e7b334e..29ba80d 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/replication/server/ReplicationServer.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/replication/server/ReplicationServer.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2010 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC.
*/
package org.opends.server.replication.server;
@@ -21,6 +22,7 @@
import static org.opends.server.util.StaticUtils.*;
import java.io.IOException;
+import java.net.ConnectException;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.ServerSocket;
@@ -414,6 +416,15 @@
}
int timeoutMS = MultimasterReplication.getConnectionTimeoutMS();
socket.connect(remoteServerAddress.toInetSocketAddress(), timeoutMS);
+ if (isSelfConnection(socket))
+ {
+ // While the remote RS is down, the kernel may pick its port as the
+ // local port of this connecting socket (TCP simultaneous open),
+ // "connecting" it to itself. Keeping such a socket open would hold
+ // the port and prevent the RS from binding it on restart.
+ throw new ConnectException("Connection to " + remoteServerAddress
+ + " is a TCP self-connect, no replication server is listening");
+ }
session = replSessionSecurity.createClientSession(socket, timeoutMS);
ReplicationServerHandler rsHandler = new ReplicationServerHandler(
--
Gitblit v1.10.0