Merge pull request from GHSA-3f48-9j7q-q2gv

* service: Listen on loopback interface and log listener URL

* pyproject.toml: Add dev-dependency on psutil

* Update poetry.lock

* tests: Verify the service listens on the loopback interface

* Update poetry.lock

* tests: Use non-deprecated API to get server port

ni_measurementlink_service/_internal/service_manager.py

@@ -124,9 +124,11 @@ def start(
                 raise ValueError(
                     f"Unknown interface was provided in the .serviceconfig file: {interface}"
                 )
-        port = str(self._server.add_insecure_port("[::]:0"))
+        host = "[::1]"
+        port = str(self._server.add_insecure_port(f"{host}:0"))
+        address = f"http://{host}:{port}"
         self._server.start()
-        _logger.info("Measurement service hosted on port: %s", port)
+        _logger.info("Measurement service listening on: %s", address)
 
         self._service_location = ServiceLocation("localhost", port, "")
         self._registration_id = self._discovery_client.register_service(

pyproject.toml

@@ -52,6 +52,8 @@ types-protobuf = "^4.21"
 types-pkg-resources = "*"
 types-pywin32 = ">=304"
 grpc-stubs = "^1.53"
+psutil = ">=5.9"
+types-psutil = ">=5.9"
 
 [tool.poetry.group.docs]
 optional = true

tests/acceptance/test_security.py

@@ -0,0 +1,32 @@
+from ipaddress import ip_address
+from typing import Generator
+
+import psutil
+import pytest
+
+from ni_measurementlink_service.measurement.service import MeasurementService
+from tests.utilities import loopback_measurement
+from tests.utilities.discovery_service_process import DiscoveryServiceProcess
+
+
+def test___loopback_measurement___listening_on_loopback_interface(
+    measurement_service: MeasurementService,
+):
+    insecure_port = int(measurement_service.service_location.insecure_port)
+
+    listener_ips = [
+        ip_address(conn.laddr.ip)
+        for conn in psutil.Process().connections()
+        if conn.laddr.port == insecure_port and conn.status == psutil.CONN_LISTEN
+    ]
+    assert len(listener_ips) >= 1 and all([ip.is_loopback for ip in listener_ips])
+    assert measurement_service.service_location.ssl_authenticated_port == ""
+
+
+@pytest.fixture(scope="module")
+def measurement_service(
+    discovery_service_process: DiscoveryServiceProcess,
+) -> Generator[MeasurementService, None, None]:
+    """Test fixture that creates and hosts a measurement service."""
+    with loopback_measurement.measurement_service.host_service() as service:
+        yield service