A toolbox for statical analysis and transformation of OSGi bundles
Radu Kopetz – Orange Labsradu.kopetz @orange.com
OSGi Users’ Group France Meeting
25/11/2011
motivations
Source: http://www.drm-x.com/
why OSGi ?
• ease of development
• rich, mature ecosystem
• modularity • modularity
• isolation and security guaranties
chalenges
• platforms’ security and availability
• preserved QoS
• malicious comportement can be both intended or unintendedintended or unintended
security in OSGi
• based on Java 2 security
– Conditional Permission Admin
security in OSGi
• based on Java 2 security
– Conditional Permission Admin
• adds namespace isolation mechanism between bundlesbundles
security in OSGi
• based on Java 2 security
– Conditional Permission Admin
• adds namespace isolation mechanism between bundlesbundles
• but …
security flaws in OSGi
• originate in OSGi platform– infinite loop / thread hanging in bundle activator
– huge manifest file or import statements
– decompression bomb– decompression bomb
security flaws in OSGi
• originate in OSGi platform– infinite loop / thread hanging in bundle activator
– huge manifest file or import statements
– decompression bomb– decompression bomb
• originate in JVM shortcomings: not designed for multi-application systems– memory load injection
– exponential thread creation
– infinite loops
possible approach
bundle
(automated) analysis
possible approach
bundle
(automated) analysis
bundle
deploy !deploy !
possible approach
bundle
(automated) analysis
bundle
deploy !deploy !bundle
possible approach
bundle
(automated) analysis
bundle
deploy !deploy !bundle
StaticalAnalysis and Transformation
possible approach
bundle
(automated) analysis
bundle
deploy !deploy !bundle
StaticalAnalysis and Transformation
Simulation ?
possible approach
bundle
(automated) analysis
bundle
deploy !deploy !bundle
StaticalAnalysis and Transformation
Simulation ? ?
possible approach
bundle
(automated) analysis
bundle
deploy !deploy !bundle
StaticalAnalysis and Transformation
Simulation ? ?
global idea
• a set of generic tools (services)
global idea
• a set of generic tools (services)
• that can be composed to get complex checkings and transformations on bundles
architecture
bundle bundle
bundle bundle bundlebundle
OSGiOSGi
architecture
bundle bundle
bundle bundle bundlebundle
OSGiOSGi
generic (base) services
architecture
bundle bundle
more complex, business - specific services
bundle bundle bundlebundle
OSGiOSGi
generic (base) services
generic services
jars• decompress• compress• estimate size• estimate size• class bytes
generic services
jars• decompress• compress• estimate size• estimate size• class bytes
metadata• manifest contents • DS / iPOJO components
generic services
jars• decompress• compress• estimate size
bytecode• method call search• class related information• method instrumentation• estimate size
• class bytes
metadata• manifest contents • DS / iPOJO components
• method instrumentation
generic services
jars• decompress• compress• estimate size
bytecode• method call search• class related information• method instrumentation• estimate size
• class bytes
metadata• manifest contents • DS / iPOJO components
• method instrumentation
graphs• construction• analysis (strongly connected components)
business - specific services
• remove double imports
business - specific services
• remove double imports
• detect inappropriate method calls
– Runtime.getRuntime.halt()
– System.exit()– System.exit()
business - specific services
• remove double imports
• detect inappropriate method calls
– Runtime.getRuntime.halt()
– System.exit()– System.exit()
• cycles between services
business - specific services
• remove double imports
• detect inappropriate method calls
– Runtime.getRuntime.halt()
– System.exit()– System.exit()
• cycles between services
• associate CPU consumption & Threads with bundles
DÉMODÉMO
how it was done
• unjar
• parse the manifest
• retrieve the Activator / DS components bytes
• instrument the bytecode• instrument the bytecode
• remove digital signature
• jar
how it was done
• unjar
• parse the manifest
• retrieve the Activator / DS components bytes
• instrument the bytecode• instrument the bytecode
• remove digital signature
• jar
=> used almost all of our basic services
bytecode instrumentation
class MyActivator implements BundleActivator {…
public void start(
public void start( BundleContext context)
throws Exception {
// method body
}…
}
bytecode instrumentation
class MyActivator implements BundleActivator {…
public void start(
public void renamed_start(BundleContextcontext) throws Exception {// method body
}
public void start( BundleContext context)
throws Exception {
// method body
}…
}
bytecode instrumentation
class MyActivator implements BundleActivator {…
public void start(
public void renamed_start(BundleContextcontext) throws Exception {// method body
}
public void start(BundleContext context) throws Exception {… // get bundleName from manifest
public void start( BundleContext context)
throws Exception {
// method body
}…
}
… // get bundleName from manifest
ThreadGroup tg = new ThreadGroup(bundleName+"_TGroup");
ThreadGroup oldTg = Thread.currentThread().getThreadGroup();…// modify the thread group of
…// current thread
renamed_start(context);
…// restore the thread group
}
conclusion
• some tools for statical analysis &
transformation of bundles
• complete solution: statical analysis + modified
OSGi framework + modified JVMOSGi framework + modified JVM
• nice to have: public repository with LOTs of
bundles offering generic analysis services
thank you ! questions ?thank you ! questions ?
public void start(final BundleContext context) throws Exception {
Dictionary manifProps = context.getBundle().getHeaders();
String bundleName = manifProps.get("Bundle-Name").toString();
ThreadGroup tg = new ThreadGroup(bundleName+"_ThreadGroup");
ThreadGroup oldTg = Thread.currentThread().getThreadGroup();
Field groupField = Field groupField = Thread.class.getDeclaredField("group");
groupField.setAccessible(true);
groupField.set(Thread.currentThread(),tg);
orange___start(context);
groupField.set(Thread.currentThread(), oldTg);groupField.setAccessible(false);
}
