[jira] [Updated] (HDDS-16308) Validate advertised addresses before startup, registration, and publication

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/HDDS-16308?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

ASF GitHub Bot updated HDDS-16308:
----------------------------------
    Labels: pull-request-available  (was: )

> Validate advertised addresses before startup, registration, and publication
> ---------------------------------------------------------------------------
>
>                 Key: HDDS-16308
>                 URL: https://issues.apache.org/jira/browse/HDDS-16308
>             Project: Apache Ozone
>          Issue Type: Sub-task
>            Reporter: Dian-Xuan Yang
>            Assignee: Dian-Xuan Yang
>            Priority: Major
>              Labels: pull-request-available
>
> h3. Problem
> Wildcard addresses ({{0.0.0.0}}, {{::}}) and scoped IPs ({{fe80::1%eth0}}) are valid for _binding_, but must never be used as _advertised_ endpoints (peers, clients, Kerberos, or certificates). For instance, zone identifiers in scoped IPs cannot be encoded in an X.509 certificate.
> A separate gap is the textual form of the configured value. Since HDDS-16307 an ambiguous authority no longer fails at startup; it resolves to a different address instead, so the misconfiguration is silent:
> {code}
> ozone.om.address = 2001:db8::1:9862
>   intended:  host 2001:db8::1         port 9862
>   actual:    host 2001:db8::1:9862    port 9862 (the default)
> {code}
> Both readings are valid IPv6 literals, so nothing in the value itself distinguishes them.
> h3. Solution
> Implement validation to reject wildcard, link-local, and scoped addresses for advertised endpoint settings.
> * Reuse existing predicates ({{HddsServerUtil.isValidInetForCsr}} and {{isScopedOrMaskingIPv6Address}}).
> * The error must explicitly name the offending property and value.
> * Do not silently strip zone identifiers to force the address to be valid.
> * Reject an unbracketed IPv6 literal in a host-and-port property. This is a check on the configured text, not on the resolved address: {{2001:db8::1:9862}} is itself a valid global unicast address, so both predicates above accept it. The error must show the bracketed form the operator most likely meant.
> h3. Open Questions (Need Clarification)
> # *Target Properties:* What is the exact set of advertised properties?
> (_Proposal: Include peer/client keys like {{ozone.om.address}}, {{ozone.scm.client.address}}, {{ozone.scm.names}}, SCM/OM HA per-node keys, and {{hdds.datanode.hostname}}. Exclude all {{*.bind.host}} keys since wildcards are legitimate there._)
> # *Failure Timing:* Should an invalid advertised address fail fast immediately at startup, or only later at the point of registration/publication?
> # *Bare IPv6 Literals in Host-and-Port Keys:* Should a property such as {{ozone.om.address}} accept a bare IPv6 literal at all? The OEP allows a bare literal only for host-only configuration, and requires brackets wherever a port may follow. Accepting both forms is exactly what makes the example above ambiguous. Requiring brackets removes the ambiguity, at the cost of rejecting {{ozone.om.address=::1}}, which parses today.
> h3. Testing
> Add component tests for the agreed set of properties to verify:
> * *Accepted:* DNS names, IPv4 literals, global IPv6 literals.
> * *Rejected:* Wildcard, link-local, and scoped addresses.
> * *Rejected:* Unbracketed IPv6 authorities such as {{2001:db8::1:9862}}.
> h3. Related
> The SPNEGO principal for a wildcard bind host is a different problem and is tracked separately. With a {{::}} bind host, {{HttpServer2.Builder.build()}} falls back to the first endpoint's host, so {{_HOST}} expands to a bracketed wildcard and no keytab matches. That fix has to decide what {{_HOST}} should resolve to, rather than reject a configured value.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org