Why is evince (PDF viewer) making outgoing https connections?

yodermk · 2015-03-01 02:05:26

Should I be freaked out about this?

# netstat -ptW | grep evince
tcp       32      0 pizza.yoderdev.com:46939 www2.twitter.jp:https   CLOSE_WAIT  11251/evince        
tcp       77      0 pizza.yoderdev.com:49516 xx-fbcdn-shv-01-dfw1.fbcdn.net:https CLOSE_WAIT  23410/evince        
tcp        0      0 pizza.yoderdev.com:55273 ob-in-f189.1e100.net:https CLOSE_WAIT  23410/evince        
tcp       77      0 pizza.yoderdev.com:33463 edge-star-shv-07-ash4.facebook.com:https CLOSE_WAIT  32039/evince        
tcp      226      0 pizza.yoderdev.com:58582 edge-star-shv-07-ash4.facebook.com:https CLOSE_WAIT  32039/evince        
tcp        1      0 pizza.yoderdev.com:34326 198.41.215.183:https    CLOSE_WAIT  11251/evince        
tcp       77      0 pizza.yoderdev.com:34223 edge-star-shv-07-ash4.facebook.com:https CLOSE_WAIT  23410/evince        
tcp        0      0 pizza.yoderdev.com:57673 ob-in-f189.1e100.net:https CLOSE_WAIT  32039/evince        
tcp        1      0 pizza.yoderdev.com:53407 94.31.29.230.IPYX-077437-ZYO.above.net:https CLOSE_WAIT  11251/evince        
tcp        0      0 pizza.yoderdev.com:54743 oe-in-f189.1e100.net:https CLOSE_WAIT  23751/evince        
tcp        0      0 pizza.yoderdev.com:57039 oe-in-f189.1e100.net:https CLOSE_WAIT  14951/evince        
tcp        1      0 pizza.yoderdev.com:37184 50.97.40.233-static.reverse.softlayer.com:https CLOSE_WAIT  23751/evince        
tcp        1      0 pizza.yoderdev.com:35155 ob-in-f189.1e100.net:https CLOSE_WAIT  8726/evince         
tcp       77      0 pizza.yoderdev.com:49903 edge-star-shv-07-frc3.facebook.com:https CLOSE_WAIT  23751/evince        
tcp       77      0 pizza.yoderdev.com:34417 edge-star-shv-07-ash4.facebook.com:https CLOSE_WAIT  32039/evince

The documents I have open in evince seem to come from reliable sources. One of these maps to a process viewing an O'Reilly e-book. One is a bill from my cable company. One is a flyer from a local grocery store.

Anyone else get this?

yodermk · 2015-03-01 02:09:42

Additionally:

[micah@pizza man]$ pacman -Qo /usr/bin/evince
/usr/bin/evince is owned by evince 3.14.1-2
[micah@pizza man]$ pacman -Qi evince
Name           : evince
Version        : 3.14.1-2
Description    : Document viewer (PDF, Postscript, djvu, tiff, dvi, XPS, SyncTex support with gedit, comics books (cbr,cbz,cb7 and
                 cbt))
Architecture   : x86_64
URL            : https://wiki.gnome.org/Apps/Evince
Licenses       : GPL
Groups         : gnome
Provides       : None
Depends On     : gtk3  libgxps  libspectre  gsfonts  poppler-glib  djvulibre  t1lib  libsecret  desktop-file-utils  dconf
                 gsettings-desktop-schemas  gnome-desktop
Optional Deps  : texlive-bin: DVI support [installed]
                 gvfs: bookmark support and session saving [installed]
                 p7zip: cbz and cb7 compressed comic books
                 tar: cbt compressed comic books [installed]
                 unrar: cbr compressed comic books
Required By    : None
Optional For   : None
Conflicts With : None
Replaces       : None
Installed Size :  12.29 MiB
Packager       : Jan de Groot <jgc@archlinux.org>
Build Date     : Mon 20 Oct 2014 12:44:40 PM CDT
Install Date   : Mon 20 Oct 2014 08:54:51 PM CDT
Install Reason : Explicitly installed
Install Script : Yes
Validated By   : Signature

jakobcreutzfeldt · 2015-03-01 12:11:38

Evince isn't making any connections on my system.

EscapedNull · 2015-03-01 12:46:00

Are you sure none of them contain embedded images or fonts from the Internet?

Try blocking network access for evince and see if everything displays the same way.

adduser nonet
iptables -A OUTPUT -m owner --uid-owner nonet -j REJECT
sudo -u nonet evince

You could also try compiling it yourself and see if anything changes.

smirky · 2015-03-01 13:12:56

It's trying to order pizza? This must be the coolest pdf viewer ever. Sorry for the offtopic

On topic:
Have you done any custom configuration which could be the reason for this?

EDIT: I don't know if this is possible (not a pdf expert), but is the file you're viewing containing any links (hyperlinks) or additional information containing link references which you're not aware?

Last edited by smirky (2015-03-01 13:15:37)

yodermk · 2015-03-01 15:30:50

Even if they were requesting resources, why is it from edge routers? That is just weird.

In any case, it doesn't seem to be too active. Just checked again now and the list looks pretty much the same as it did last night. And they are all in CLOSE_WAIT status - I guess that means that a TCP connection was in fact made and closed by the remote end, if I'm not mistaken.

Some of these PDFs (like the O'Reilly ebook) I have viewed on my laptop offline with no trouble. The laptop uses Fedora - I'll check it out later today.

benob · 2015-03-01 16:23:04

By looking at the poppler source code, it seems that it only opens connections to load a full pdf from a url using curl. Unless I missed something, it should not open many connections except if you opened pdfs through urls (if your browser embeds evince, for instance).

The pattern of the hosts you are seeing look like those of a web browser. I am wondering if they could come from the fact that you closed that browser at some point but the connections stayed in the time-wait status long enough for process ids to cycle through 32k and evince to be run with one of them.

I also wonder if the process name you are seeing is the real name of the process doing the connections (it's easy to change a process's name to whatever, just fiddle with argv[0]). Could your browser have its name overwritten by some library when loading it?

EscapedNull · 2015-03-06 03:51:09

benob wrote:

The pattern of the hosts you are seeing look like those of a web browser. I am wondering if they could come from the fact that you closed that browser at some point but the connections stayed in the time-wait status long enough for process ids to cycle through 32k and evince to be run with one of them.

Good thinking. I suppose it's possible, but could it really happen twice in a row?

benob wrote:

I also wonder if the process name you are seeing is the real name of the process doing the connections (it's easy to change a process's name to whatever, just fiddle with argv[0]). Could your browser have its name overwritten by some library when loading it?

Also a possibility, but I don't think its likely that a browser or library would overwrite the process's name. The only case I can think of where that might make sense is a browser that is tightly coupled (shares a codebase) with evince; the browser fork(3)'s itself and changes its name to 'evince', assuming that network sockets are carried across a fork (not sure about that).

@yodermk, if you really want to get to the bottom of this, there are a few things you can try. Similar to what I mentioned before, but with logging:

adduser nonet
iptables -A OUTPUT -m owner --uid-owner nonet -j LOG --log-prefix "Network access blocked: "
iptables -A OUTPUT -m owner --uid-owner nonet -j REJECT
sudo -u nonet evince
journalctl -k | grep "Network access blocked"

That should guarantee that 'evince' is the only process being logged, and will show you more detailed information about the connections it is trying to make. The "REJECT" rule is optional in this case.

tcpdump(1) might be helpful for seeing all packets being sent, rather than existing sockets at the time netstat is run.

SELinux can be used to control network access to individual programs, I think. From what I understand, it's fairly complicated to setup given this use-case, though.

Arch Linux

#1 2015-03-01 02:05:26

Why is evince (PDF viewer) making outgoing https connections?

#2 2015-03-01 02:09:42

Re: Why is evince (PDF viewer) making outgoing https connections?

#3 2015-03-01 12:11:38

Re: Why is evince (PDF viewer) making outgoing https connections?

#4 2015-03-01 12:46:00

Re: Why is evince (PDF viewer) making outgoing https connections?

#5 2015-03-01 13:12:56

Re: Why is evince (PDF viewer) making outgoing https connections?

#6 2015-03-01 15:30:50

Re: Why is evince (PDF viewer) making outgoing https connections?

#7 2015-03-01 16:23:04

Re: Why is evince (PDF viewer) making outgoing https connections?

#8 2015-03-06 03:51:09

Re: Why is evince (PDF viewer) making outgoing https connections?

Board footer