-1

Background

Simplifying, assume I want to write some tool for code-analysis, which tell me which files - class/module - are/have some kind of network interface(s). No matter if it's REST Controller, DB connection, RPC or simple socket.

Restrictions

I want to achive this automatically. What do I mean by that? I don't want to use any regex stuff to search network-specific keywords in method names or strings like GET, POST, other http operations, URLs, IP addresses and other things which are related to certain protocol. I want to obtain if class use some socket operations under the hood. Even if it's app build on e.g http framework, and all network operations are hidden in deeper dependencies.

Example

We have some REST controller, which listen on particular URL. If we use some HTTP framework, then probably such controller is injected as dependency to other class and this class is injected to other class and so on, where finally we have some network socket which listen on low level network interface. I assume that every programming environment has some atomic socket abstraction, or couple of such, which are used by every network interface.

Question

How can I properly fulfill such requirements? The goal is to indicate places where are located network inputs and outputs of the system. Can I achieve that using tool written in only one programming language or do I have to write individual tool every technology?

PS. Post is language-agnostic in general, but some example in java or python would be helpful.

2
  • Suppose I run a hello-world program over an SSH connection, does the hello-world then have a network interface? Commented May 24, 2020 at 13:22
  • @BartvanIngenSchenau I mean only about network interfaces in range of program code. Run hello-world from ssh is not hello-world network interface, because hello-world do not use network card. You connect with SSH program and next from that point you call hello-world. It's not what I'm talking about.
    – xana
    Commented May 24, 2020 at 13:37

1 Answer 1

0

This is impossible.

Take a PHP webapp, for example. If I run this PHP webapp on Apache using the mod_php module, there will be a directly-linked path from the application code down to the socket handling code in Apache.

If I run the exact same PHP webapp on Apache using CGI, the webapp runs in a separate process.

The only difference is one line in the Apache configuration file.

It is impossible to determine from the source code of the webapp, since the source code is exactly the same in both cases. (As is the source code of the PHP interpreter and the source code of Apache.)

You cannot determine this with analysis of the source code since it is a property of the environment, not the source code.

You cannot determine this with static analysis since it is a property of the runtime environment.

1
  • So can I do achieve my goal using other method than static analysis? If so, what should I do to obtain what modules handle network events?
    – xana
    Commented May 24, 2020 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.