[config{grpc,http}] Add warning when using unspecified address #6267
Conversation
Codecov ReportBase: 92.06% // Head: 91.76% // Decreases project coverage by
Additional details and impacted files@@ Coverage Diff @@
## main #6267 +/- ##
==========================================
- Coverage 92.06% 91.76% -0.30%
==========================================
Files 219 236 +17
Lines 13242 13476 +234
==========================================
+ Hits 12191 12366 +175
- Misses 828 880 +52
- Partials 223 230 +7
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
Co-authored-by: Alex Boten <alex@boten.ca>
config/configgrpc/configgrpc.go
Outdated
| case "tcp", "tcp4", "tcp6", "udp", "udp4", "udp6": | ||
| host, _, err := net.SplitHostPort(gss.NetAddr.Endpoint) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to parse endpoint: %w", err) | ||
| } | ||
|
|
||
| if ip := net.ParseIP(host); ip != nil && ip.IsUnspecified() { | ||
| settings.Logger.Warn( | ||
| "Using the 0.0.0.0 address exposes this server to every network interface, which may facilitate Denial of Service attacks", | ||
| zap.String( | ||
| "documentation", | ||
| "https://github.com/open-telemetry/opentelemetry-collector/blob/main/docs/security-best-practices.md#safeguards-against-denial-of-service-attacks", | ||
| ), |
There was a problem hiding this comment.
Last comment, I promise :))
Can we actually have a Validate() error on confignet.NetAddr and confignet.TCPAddr. That way you can share this code.
There was a problem hiding this comment.
Hard probably to have the warning about "0.0.0.0" (since the Validate will not have access to the logger) but that can be duplicate or a standalone helper in the confignet package.
Even better the helper can be in config/internal
There was a problem hiding this comment.
I created a WarnOnUnspecifiedHost helper on config/internal. Does that look good?
…telemetry#6267) * [config/config{grpc,http}] Add warning when using a 0.0.0.0 endpoint * Add warning when using unspecified address * Add changelog entry * Fix tests * Fix HTTP tests * Apply suggestions from code review Co-authored-by: Alex Boten <alex@boten.ca> * Use IsUnspecified method * no else after return * Move shared code to internal Co-authored-by: Alex Boten <alex@boten.ca> (cherry picked from commit 396964d)
Description:
Add warning when using
0.0.0.0address on an HTTP or gRPC server.Link to tracking Issue: Fixes #6151