[JENKINS-38187] Make slaveAgentPort readonly in case the enforce flag…

… is set
jici2016 · Sep 23, 2016 · de473f1 · de473f1
1 parent e9e2d86
commit de473f1
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 3 deletions.
diff --git a/core/src/main/java/hudson/security/GlobalSecurityConfiguration.java b/core/src/main/java/hudson/security/GlobalSecurityConfiguration.java
@@ -72,6 +72,10 @@ public int getSlaveAgentPort() {
         return Jenkins.getInstance().getSlaveAgentPort();
     }
 
+    public boolean isSlaveAgentPortEnforced() {
+        return Jenkins.getInstance().isSlaveAgentPortEnforced();
+    }
+
     public Set<String> getAgentProtocols() {
         return Jenkins.getInstance().getAgentProtocols();
     }

diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java
@@ -1104,11 +1104,21 @@ public int getSlaveAgentPort() {
         return slaveAgentPort;
     }
 
+    public boolean isSlaveAgentPortEnforced() {
+        return Jenkins.SLAVE_AGENT_PORT_ENFORCE;
+    }
+
     /**
      * @param port
      *      0 to indicate random available TCP port. -1 to disable this service.
      */
     public void setSlaveAgentPort(int port) throws IOException {
+        if (!SLAVE_AGENT_PORT_ENFORCE) {
+            forceSetSlaveAgentPort(port);
+        }
+    }
+
+    private void forceSetSlaveAgentPort(int port) throws IOException {
         this.slaveAgentPort = port;
         launchTcpSlaveAgentListener();
     }
@@ -1240,7 +1250,7 @@ public int getExpectedPort() {
         }
 
         public void doAct(StaplerRequest req, StaplerResponse rsp) throws IOException {
-            j.setSlaveAgentPort(getExpectedPort());
+            j.forceSetSlaveAgentPort(getExpectedPort());
             rsp.sendRedirect2(req.getContextPath() + "/manage");
         }
 

diff --git a/core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.groovy b/core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.groovy
@@ -26,8 +26,18 @@ l.layout(norefresh:true, permission:app.ADMINISTER, title:my.displayName, csscla
             set("descriptor", my.descriptor);
 
             f.optionalBlock( field:"useSecurity", title:_("Enable security"), checked:app.useSecurity) {
-                f.entry (title:_("TCP port for JNLP agents"), field:"slaveAgentPort") {
-                    f.serverTcpPort()
+                f.entry(title: _("TCP port for JNLP agents"), field: "slaveAgentPort") {
+                    if (my.slaveAgentPortEnforced) {
+                        if (my.slaveAgentPort == -1) {
+                            text(_("slaveAgentPortEnforcedDisabled"))
+                        } else if (my.slaveAgentPort == 0) {
+                            text(_("slaveAgentPortEnforcedRandom"))
+                        } else {
+                            text(_("slaveAgentPortEnforced", my.slaveAgentPort))
+                        }
+                    } else {
+                        f.serverTcpPort()
+                    }
                 }
                 f.advanced(title: _("Agent protocols"), align:"left") {
                     f.entry(title: _("Agent protocols")) {

diff --git a/core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.properties b/core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.properties
@@ -0,0 +1,3 @@
+slaveAgentPortEnforced=enforced to {0,number,#} on startup through system property.
+slaveAgentPortEnforcedRandom=enforced to random port on startup through system property.
+slaveAgentPortEnforcedDisabled=disabled on startup through system property.