See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749770: --- snip --- Package: libreoffice-impress Version: 1:4.2.4-3 Severity: normal Tags: upstream Hello, the Impress Remote (see e.g. https://f-droid.org/repository/browse/?fdid=org.libreoffice.impressremote) is enabled by default, making LibreOffice listen to the world. Additionaly, this feature is difficult to turn off (Impress must be started to get into Options, meaning you can't disable socket binding without actually binding) How to reproduce: 1. Start Impress 2. Observe 'netstat -tulpn | grep office' or telnet localhost 1599 tcp 0 0 0.0.0.0:1599 0.0.0.0:* LISTEN 6513/soffice.bin udp 0 0 0.0.0.0:1598 0.0.0.0:* 6513/soffice.bin How to turn off: 1. Start Impress. This unfortunately enables the listening immediately. 2. Tools -> Options -> Impress -> General -> [ ] Enable remote control I think (at least desktop) applications shouldn't accept connections from the internet by default. --- snip --- While it actually is easily disabeable (although it definitely listens until you do so), I *do* think he has a point. It shouldn't listen per default. Maybe we should get a config/UI option for avahi?
fwiw, this happens when you enable avahi (--enable-avahi): rene@frodo:~/LibreOffice/master/core/sd/source/ui/remotecontrol$ grep -r 159 * AvahiNetworkService.cxx: avahiService->getName().c_str(), kREG_TYPE, NULL, NULL, 1599, "local", r, NULL AvahiNetworkService.hxx: AvahiNetworkService(const std::string& aname = "", unsigned int aport = 1599) mDNSResponder/DebugServices.c: CaseErrorStringifyHardCode( -103159, kXMLBadDataErr ); OSXNetworkService.hxx: OSXNetworkService(const std::string& aname = "", unsigned int aport = 1599) OSXNetworkService.mm: netService = [[NSNetService alloc] initWithDomain:@"local" type:@"_impressremote._tcp" name:sName port:1599]; WINNetworkService.cxx: DNSServiceErrorType err = DNSServiceRegister(&client, 0, 0, NULL, kREG_TYPE, "local", NULL, 1599, 1, "", NULL, this ); WINNetworkService.hxx: WINNetworkService(const std::string& aname = "", unsigned int aport = 1599) ZeroconfService.hxx:#define PORT_DISCOVERY 1598
Indeed. I think Impress should ask the permission to enable remote control when the user launches a slideshow. I am not so far to consider that as a security issue. Best regards. JBF
That said, it doesn't seem to be avahi related at all, even in TCP mode it does t hat afaics with my 4.3.2-1 which has avahi disabled
should be fixed by http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-4-2&id=99023fe9bd7d8b665faed7fe9cb98b3fb8922292 http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-4-2-7&id=a7a890509c91e79dc330c2fbf1df97f0c6b08c92 http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-4-3&id=3d0cffab8d06a0f8af6c0ed7a95728203080a7c5 http://cgit.freedesktop.org/libreoffice/core/commit/?id=6ced5dbd1a4603b0f9c63e79d9da8b30c76b3805 no?
Moving bug to (new) 'Impress Remote' product.