Nowadays, OSGi is becoming more and more popular in Java world. Consequently, the quantity of available bundles is increasing rapidly, and the means to verify and assess security guaranties about these artifacts are lacking. In the context of opening its platforms to third party applications, Orange is seeking the necessary mechanisms and tools that could be used in order to ensure platforms' protection and robustness. We propose a platform that offers several services that enable statical analysis and transformation of OSGi bundles. The services range from simple ones, like for instance a service for analyzing bundles' manifests, to more complex ones that allow byte-code inspection and transformation. The platform is itself built on OSGi for modularity and extensibility. We further demonstrate the usefulness of our approach by instrumenting an instance of the Eclipse IDE in order to monitor thread creation and CPU consumption per bundle. Radu Kopetz, Technical Architect - Orange Labs

1. A toolbox for statical analysis and
transformation of OSGi bundles
Radu Kopetz – Orange Labs
radu.kopetz @orange.com
OSGi Users’ Group France Meeting
25/11/2011

2. motivations
Source: http://www.drm-x.com/

3. why OSGi ?
• ease of development
• rich, mature ecosystem
• modularity
• isolation and security guaranties

4. chalenges
• platforms’ security and availability
• preserved QoS
• malicious comportement can be both
intended or unintended

5. security in OSGi
• based on Java 2 security
– Conditional Permission Admin

6. security in OSGi
• based on Java 2 security
– Conditional Permission Admin
• adds namespace isolation mechanism between
bundles

7. security in OSGi
• based on Java 2 security
– Conditional Permission Admin
• adds namespace isolation mechanism between
bundles
• but …

8. security flaws in OSGi
• originate in OSGi platform
– infinite loop / thread hanging in bundle activator
– huge manifest file or import statements
– decompression bomb

9. security flaws in OSGi
• originate in OSGi platform
– infinite loop / thread hanging in bundle activator
– huge manifest file or import statements
– decompression bomb
• originate in JVM shortcomings: not designed
for multi-application systems
– memory load injection
– exponential thread creation
– infinite loops

10. possible approach
(automated) analysis
bundle

11. possible approach
(automated) analysis
bundle
bundle
deploy !

12. possible approach
(automated) analysis
bundle
bundle
deploy !
bundle

13. possible approach
(automated) analysis
bundle
bundle
deploy !
bundle
Statical Analysis and
Transformation

14. possible approach
(automated) analysis
bundle
bundle
deploy !
bundle
Statical Analysis and Simulation ?
Transformation

15. possible approach
(automated) analysis
bundle
bundle
deploy !
bundle
Statical Analysis and Simulation ? ?
Transformation

16. possible approach
(automated) analysis
bundle
bundle
deploy !
bundle
Statical Analysis and Simulation ? ?
Transformation

17. global idea
• a set of generic tools (services)

18. global idea
• a set of generic tools (services)
• that can be composed to get complex
checkings and transformations on bundles

19. architecture
bundle bundle
bundle bundle bundle bundle
OSGi

20. architecture
bundle bundle
bundle bundle bundle bundle
OSGi
generic (base) services

21. architecture
more complex, business - specific services
bundle bundle
bundle bundle bundle bundle
OSGi
generic (base) services

22. generic services
jars
• decompress
• compress
• estimate size
• class bytes

23. generic services
jars
• decompress
• compress
• estimate size
• class bytes
metadata
• manifest contents
• DS / iPOJO components

24. generic services
jars bytecode
• decompress • method call search
• compress • class related information
• estimate size • method instrumentation
• class bytes
metadata
• manifest contents
• DS / iPOJO components

25. generic services
jars bytecode
• decompress • method call search
• compress • class related information
• estimate size • method instrumentation
• class bytes
metadata graphs
• manifest contents • construction
• DS / iPOJO components • analysis (strongly
connected components)

26. business - specific services
• remove double imports

27. business - specific services
• remove double imports
• detect inappropriate method calls
– Runtime.getRuntime.halt()
– System.exit()

28. business - specific services
• remove double imports
• detect inappropriate method calls
– Runtime.getRuntime.halt()
– System.exit()
• cycles between services

29. business - specific services
• remove double imports
• detect inappropriate method calls
– Runtime.getRuntime.halt()
– System.exit()
• cycles between services
• associate CPU consumption & Threads with
bundles

30. DÉMO

31. how it was done
• unjar
• parse the manifest
• retrieve the Activator / DS components bytes
• instrument the bytecode
• remove digital signature
• jar

32. how it was done
• unjar
• parse the manifest
• retrieve the Activator / DS components bytes
• instrument the bytecode
• remove digital signature
• jar
=> used almost all of our basic services

33. bytecode instrumentation
class MyActivator implements
BundleActivator {
…
public void start(
BundleContext context)
throws Exception {
// method body
}
…
}

34. bytecode instrumentation
public void renamed_start(BundleContext
context) throws Exception {
// method body
}
class MyActivator implements
BundleActivator {
…
public void start(
BundleContext context)
throws Exception {
// method body
}
…
}

35. bytecode instrumentation
public void renamed_start(BundleContext
context) throws Exception {
// method body
}
class MyActivator implements
BundleActivator { public void start(BundleContext context)
… throws Exception {
… // get bundleName from manifest
public void start(
BundleContext context) ThreadGroup tg = new
throws Exception { ThreadGroup(bundleName+"_TGroup");
// method body ThreadGroup oldTg =
Thread.currentThread().getThreadGroup()
} ;
… …// modify the thread group of
}
…// current thread
renamed_start(context);
…// restore the thread group
}

36. conclusion
• some tools for statical analysis &
transformation of bundles
• complete solution: statical analysis + modified
OSGi framework + modified JVM
• nice to have: public repository with LOTs of
bundles offering generic analysis services

37. thank you ! questions ?

38. public void start(final BundleContext context) throws
Exception {
Dictionary manifProps =
context.getBundle().getHeaders();
String bundleName = manifProps.get("Bundle-
Name").toString();
ThreadGroup tg = new
ThreadGroup(bundleName+"_ThreadGroup");
ThreadGroup oldTg =
Thread.currentThread().getThreadGroup();
Field groupField =
Thread.class.getDeclaredField("group");
groupField.setAccessible(true);
groupField.set(Thread.currentThread(),tg);
orange___start(context);
groupField.set(Thread.currentThread(), oldTg);
groupField.setAccessible(false);
}