Bruce Richardson, Jan 27, 2025 at 15:39:
> On Mon, Jan 27, 2025 at 12:51:44PM +0100, Robin Jarry wrote:
>> Fix the following warning reported by Coverity:
>>
>> Defect type: SIGMA.insecure_network_bind:
>> > dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
>> > Sigma main event: The HTTP server binds to all network interfaces by
>> > setting the IP address to "", `0.0.0.0`, `::`, or `::0`.
>> > This may expose the server to unintended traffic.
>>
>> Avoid listening to all interfaces by default to avoid exposing private
>> information unwillingly.
>>
>> Unrelated: The Python stdlib TCP server listens on IPv4 only by default.
>> Changing this requires creating a subclass that overrides address_family
>> to socket.AF_INET6.
>>
>> Fixes: d94ebd627a86 ("usertools: add telemetry exporter")
>> Cc: sta...@dpdk.org
>> Signed-off-by: Robin Jarry <rja...@redhat.com>
>> ---
>> usertools/dpdk-telemetry-exporter.py | 6 +++---
>> 1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/usertools/dpdk-telemetry-exporter.py
>> b/usertools/dpdk-telemetry-exporter.py
>> index 6eca0db2e80a..6f66d4ecaab1 100755
>> --- a/usertools/dpdk-telemetry-exporter.py
>> +++ b/usertools/dpdk-telemetry-exporter.py
>> @@ -75,7 +75,7 @@ def cmd(self, uri, arg=None) -> dict | list:
>> "/usr/local/share/dpdk/telemetry-endpoints",
>> "/usr/share/dpdk/telemetry-endpoints",
>> ]
>> -DEFAULT_OUTPUT = "openmetrics://:9876"
>> +DEFAULT_OUTPUT = "openmetrics://127.0.0.1:9876"
>>
>
> Minor nit, but would it be better to use "localhost" rather than the
> hardcoded IP here and below?
That's a good point. I had considered it but as I wrote in the commit
message:
>> Unrelated: The Python stdlib TCP server listens on IPv4 only by default.
>> Changing this requires creating a subclass that overrides address_family
>> to socket.AF_INET6.
On certain systems and depending on the libc implementation, localhost
may resolve to ::1 which causes an error on startup:
socket.gaierror: [Errno -9] Address family for hostname not supported
I dug a bit and it happens that the python standard TCPServer
implementation explicitly uses AF_INET when creating the socket. Hence
bind() fails with IPv6 addresses.
