Aias00 commented on PR #10693: URL: https://github.com/apache/rocketmq/pull/10693#issuecomment-5138075286
Addressed the P1 fail-open concern in the latest commit `075b9cd49`. Changes: - Separate absent PROXY metadata from malformed PROXY metadata. - Treat any present `proxy_protocol_*` metadata as requiring a complete valid source/destination address and port set. - Reject malformed/incomplete PROXY metadata by closing the inbound channel and not calling `ctx.fireChannelRead(msg)`. - Close the inbound channel when forwarding the HAProxy header fails, including `writeAndFlush(...).sync()` failure, cancellation, and interruption paths. Regression coverage added for: - malformed source and destination PROXY ports - missing and empty individual PROXY attributes - IPv6 PROXY attributes - port boundaries `0` and `65535` - `writeAndFlush(...).sync()` failure / cancellation / interruption - asserting malformed metadata does not forward application traffic without the PROXY header Local verification with JDK 8: `JAVA_HOME=$(/usr/libexec/java_home -v 1.8) mvn -pl proxy -Dtest=HAProxyMessageForwarderTest -DfailIfNoTests=false test` Result: `Tests run: 15, Failures: 0, Errors: 0, Skipped: 0`; checkstyle and spotbugs passed in the same run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
