On Mon, Jan 27, 2025 at 12:51:44PM +0100, Robin Jarry wrote:
> Fix the following warning reported by Coverity:
>
> Defect type: SIGMA.insecure_network_bind:
> > dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
> > Sigma main event: The HTTP server binds to all network interfaces by
> > setting the IP address to "", `0.0.0.0`, `::`, or `::0`.
> > This may expose the server to unintended traffic.
>
> Avoid listening to all interfaces by default to avoid exposing private
> information unwillingly.
>
> Unrelated: The Python stdlib TCP server listens on IPv4 only by default.
> Changing this requires creating a subclass that overrides address_family
> to socket.AF_INET6.
>
> Fixes: d94ebd627a86 ("usertools: add telemetry exporter")
> Cc: sta...@dpdk.org
> Signed-off-by: Robin Jarry <rja...@redhat.com>
> ---
> usertools/dpdk-telemetry-exporter.py | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/usertools/dpdk-telemetry-exporter.py
> b/usertools/dpdk-telemetry-exporter.py
> index 6eca0db2e80a..6f66d4ecaab1 100755
> --- a/usertools/dpdk-telemetry-exporter.py
> +++ b/usertools/dpdk-telemetry-exporter.py
> @@ -75,7 +75,7 @@ def cmd(self, uri, arg=None) -> dict | list:
> "/usr/local/share/dpdk/telemetry-endpoints",
> "/usr/share/dpdk/telemetry-endpoints",
> ]
> -DEFAULT_OUTPUT = "openmetrics://:9876"
> +DEFAULT_OUTPUT = "openmetrics://127.0.0.1:9876"
>
Minor nit, but would it be better to use "localhost" rather than the
hardcoded IP here and below?
>
> def main():
> @@ -275,11 +275,11 @@ def serve_openmetrics(
> Start an HTTP server and serve requests in the openmetrics/prometheus
> format.
> """
> - listen = (args.output.hostname or "", int(args.output.port or 80))
> + listen = (args.output.hostname or "127.0.0.1", int(args.output.port or
> 80))
> with server.HTTPServer(listen, OpenmetricsHandler) as httpd:
> httpd.dpdk_socket_path = args.socket_path
> httpd.telemetry_endpoints = endpoints
> - LOG.info("listening on port %s", httpd.server_port)
> + LOG.info("listening on %s", httpd.socket.getsockname())
> try:
> httpd.serve_forever()
> except KeyboardInterrupt:
> --
> 2.48.1
>
