[
https://issues.apache.org/jira/browse/HDDS-16308?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dian-Xuan Yang updated HDDS-16308:
----------------------------------
Description:
h3. Problem
Wildcard addresses ({{0.0.0.0}}, {{::}}) and scoped IPs ({{fe80::1%eth0}}) are
valid for _binding_, but must never be used as _advertised_ endpoints (peers,
clients, Kerberos, or certificates). For instance, zone identifiers in scoped
IPs cannot be encoded in an X.509 certificate.
h3. Solution
Implement validation to reject wildcard, link-local, and scoped addresses for
advertised endpoint settings.
* Reuse existing predicates ({{HddsServerUtil.isValidInetForCsr}} and
{{isScopedOrMaskingIPv6Address}}).
* The error must explicitly name the offending property and value.
* Do not silently strip zone identifiers to force the address to be valid.
h3. Open Questions (Need Clarification)
# *Target Properties:* What is the exact set of advertised properties?
(_Proposal: Include peer/client keys like {{ozone.om.address}},
{{ozone.scm.client.address}}, {{ozone.scm.names}}, SCM/OM HA per-node keys, and
{{hdds.datanode.hostname}}. Exclude all {{*.bind.host}} keys since wildcards
are legitimate there._)
# *Failure Timing:* Should an invalid advertised address fail fast immediately
at startup, or only later at the point of registration/publication?
h3. Testing
Add component tests for the agreed set of properties to verify:
* *Accepted:* DNS names, IPv4 literals, global IPv6 literals.
* *Rejected:* Wildcard, link-local, and scoped addresses.
was:
**Sub-task of HDDS-15778**
### Problem
Wildcard addresses (`0.0.0.0`, `::`) and scoped IPs (`fe80::1%eth0`) are valid
for *binding*, but must never be used as *advertised* endpoints (peers,
clients, Kerberos, or certificates). For instance, zone identifiers in scoped
IPs cannot be encoded in an X.509 certificate.
### Solution
Implement validation to reject wildcard, link-local, and scoped addresses for
advertised endpoint settings.
* Reuse existing predicates (`HddsServerUtil.isValidInetForCsr` and
`isScopedOrMaskingIPv6Address`).
* The error must explicitly name the offending property and value.
* Do not silently strip zone identifiers to force the address to be valid.
### Open Questions (Need Clarification)
1. **Target Properties:** What is the exact set of advertised properties?
*(Proposal: Include peer/client keys like `ozone.om.address`,
`ozone.scm.client.address`, `ozone.scm.names`, SCM/OM HA per-node keys, and
`hdds.datanode.hostname`. Exclude all `*.bind.host` keys since wildcards are
legitimate there.)*
2. **Failure Timing:** Should an invalid advertised address fail fast
immediately at startup, or only later at the point of registration/publication?
### Testing
Add component tests for the agreed set of properties to verify:
* **Accepted:** DNS names, IPv4 literals, global IPv6 literals.
* **Rejected:** Wildcard, link-local, and scoped addresses.
> Validate advertised addresses before startup, registration, and publication
> ---------------------------------------------------------------------------
>
> Key: HDDS-16308
> URL: https://issues.apache.org/jira/browse/HDDS-16308
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Dian-Xuan Yang
> Assignee: Dian-Xuan Yang
> Priority: Major
>
> h3. Problem
> Wildcard addresses ({{0.0.0.0}}, {{::}}) and scoped IPs ({{fe80::1%eth0}})
> are valid for _binding_, but must never be used as _advertised_ endpoints
> (peers, clients, Kerberos, or certificates). For instance, zone identifiers
> in scoped IPs cannot be encoded in an X.509 certificate.
> h3. Solution
> Implement validation to reject wildcard, link-local, and scoped addresses for
> advertised endpoint settings.
> * Reuse existing predicates ({{HddsServerUtil.isValidInetForCsr}} and
> {{isScopedOrMaskingIPv6Address}}).
> * The error must explicitly name the offending property and value.
> * Do not silently strip zone identifiers to force the address to be valid.
> h3. Open Questions (Need Clarification)
> # *Target Properties:* What is the exact set of advertised properties?
> (_Proposal: Include peer/client keys like {{ozone.om.address}},
> {{ozone.scm.client.address}}, {{ozone.scm.names}}, SCM/OM HA per-node keys,
> and {{hdds.datanode.hostname}}. Exclude all {{*.bind.host}} keys since
> wildcards are legitimate there._)
> # *Failure Timing:* Should an invalid advertised address fail fast
> immediately at startup, or only later at the point of
> registration/publication?
> h3. Testing
> Add component tests for the agreed set of properties to verify:
> * *Accepted:* DNS names, IPv4 literals, global IPv6 literals.
> * *Rejected:* Wildcard, link-local, and scoped addresses.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
