[PATCH dpdk] telemetry-exporter: listen on loopback by default

[PATCH dpdk] telemetry-exporter: listen on loopback by default

[Robin Jarry]

Fix the following warning reported by Coverity:

Defect type: SIGMA.insecure_network_bind:
> dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
> Sigma main event: The HTTP server binds to all network interfaces by
> setting the IP address to "", `0.0.0.0`, `::`, or `::0`.
> This may expose the server to unintended traffic.

Avoid listening to all interfaces by default to avoid exposing private
information unwillingly.

Unrelated: The Python stdlib TCP server listens on IPv4 only by default.
Changing this requires creating a subclass that overrides address_family
to socket.AF_INET6.

Fixes: d94ebd627a86 ("usertools: add telemetry exporter")
Cc: stable@dpdk.org
Signed-off-by: Robin Jarry <rjarry@redhat.com>
---
 usertools/dpdk-telemetry-exporter.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/usertools/dpdk-telemetry-exporter.py b/usertools/dpdk-telemetry-exporter.py
index 6eca0db2e80a..6f66d4ecaab1 100755
--- a/usertools/dpdk-telemetry-exporter.py
+++ b/usertools/dpdk-telemetry-exporter.py
@@ -75,7 +75,7 @@ def cmd(self, uri, arg=None) -> dict | list:
     "/usr/local/share/dpdk/telemetry-endpoints",
     "/usr/share/dpdk/telemetry-endpoints",
 ]
-DEFAULT_OUTPUT = "openmetrics://:9876"
+DEFAULT_OUTPUT = "openmetrics://127.0.0.1:9876"
 
 
 def main():
@@ -275,11 +275,11 @@ def serve_openmetrics(
     Start an HTTP server and serve requests in the openmetrics/prometheus
     format.
     """
-    listen = (args.output.hostname or "", int(args.output.port or 80))
+    listen = (args.output.hostname or "127.0.0.1", int(args.output.port or 80))
     with server.HTTPServer(listen, OpenmetricsHandler) as httpd:
         httpd.dpdk_socket_path = args.socket_path
         httpd.telemetry_endpoints = endpoints
-        LOG.info("listening on port %s", httpd.server_port)
+        LOG.info("listening on %s", httpd.socket.getsockname())
         try:
             httpd.serve_forever()
         except KeyboardInterrupt:
-- 
2.48.1

Re: [PATCH dpdk] telemetry-exporter: listen on loopback by default

[Bruce Richardson]

On Mon, Jan 27, 2025 at 12:51:44PM +0100, Robin Jarry wrote:
> Fix the following warning reported by Coverity:
> 
> Defect type: SIGMA.insecure_network_bind:
> > dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
> > Sigma main event: The HTTP server binds to all network interfaces by
> > setting the IP address to "", `0.0.0.0`, `::`, or `::0`.
> > This may expose the server to unintended traffic.
> 
> Avoid listening to all interfaces by default to avoid exposing private
> information unwillingly.
> 
> Unrelated: The Python stdlib TCP server listens on IPv4 only by default.
> Changing this requires creating a subclass that overrides address_family
> to socket.AF_INET6.
> 
> Fixes: d94ebd627a86 ("usertools: add telemetry exporter")
> Cc: stable@dpdk.org
> Signed-off-by: Robin Jarry <rjarry@redhat.com>
> ---
>  usertools/dpdk-telemetry-exporter.py | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/usertools/dpdk-telemetry-exporter.py b/usertools/dpdk-telemetry-exporter.py
> index 6eca0db2e80a..6f66d4ecaab1 100755
> --- a/usertools/dpdk-telemetry-exporter.py
> +++ b/usertools/dpdk-telemetry-exporter.py
> @@ -75,7 +75,7 @@ def cmd(self, uri, arg=None) -> dict | list:
>      "/usr/local/share/dpdk/telemetry-endpoints",
>      "/usr/share/dpdk/telemetry-endpoints",
>  ]
> -DEFAULT_OUTPUT = "openmetrics://:9876"
> +DEFAULT_OUTPUT = "openmetrics://127.0.0.1:9876"
>  

Minor nit, but would it be better to use "localhost" rather than the
hardcoded IP here and below?

>  
>  def main():
> @@ -275,11 +275,11 @@ def serve_openmetrics(
>      Start an HTTP server and serve requests in the openmetrics/prometheus
>      format.
>      """
> -    listen = (args.output.hostname or "", int(args.output.port or 80))
> +    listen = (args.output.hostname or "127.0.0.1", int(args.output.port or 80))
>      with server.HTTPServer(listen, OpenmetricsHandler) as httpd:
>          httpd.dpdk_socket_path = args.socket_path
>          httpd.telemetry_endpoints = endpoints
> -        LOG.info("listening on port %s", httpd.server_port)
> +        LOG.info("listening on %s", httpd.socket.getsockname())
>          try:
>              httpd.serve_forever()
>          except KeyboardInterrupt:
> -- 
> 2.48.1
> 

Re: [PATCH dpdk] telemetry-exporter: listen on loopback by default

[Robin Jarry]

Bruce Richardson, Jan 27, 2025 at 15:39:
> On Mon, Jan 27, 2025 at 12:51:44PM +0100, Robin Jarry wrote:
>> Fix the following warning reported by Coverity:
>> 
>> Defect type: SIGMA.insecure_network_bind:
>> > dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
>> > Sigma main event: The HTTP server binds to all network interfaces by
>> > setting the IP address to "", `0.0.0.0`, `::`, or `::0`.
>> > This may expose the server to unintended traffic.
>> 
>> Avoid listening to all interfaces by default to avoid exposing private
>> information unwillingly.
>> 
>> Unrelated: The Python stdlib TCP server listens on IPv4 only by default.
>> Changing this requires creating a subclass that overrides address_family
>> to socket.AF_INET6.
>> 
>> Fixes: d94ebd627a86 ("usertools: add telemetry exporter")
>> Cc: stable@dpdk.org
>> Signed-off-by: Robin Jarry <rjarry@redhat.com>
>> ---
>>  usertools/dpdk-telemetry-exporter.py | 6 +++---
>>  1 file changed, 3 insertions(+), 3 deletions(-)
>> 
>> diff --git a/usertools/dpdk-telemetry-exporter.py b/usertools/dpdk-telemetry-exporter.py
>> index 6eca0db2e80a..6f66d4ecaab1 100755
>> --- a/usertools/dpdk-telemetry-exporter.py
>> +++ b/usertools/dpdk-telemetry-exporter.py
>> @@ -75,7 +75,7 @@ def cmd(self, uri, arg=None) -> dict | list:
>>      "/usr/local/share/dpdk/telemetry-endpoints",
>>      "/usr/share/dpdk/telemetry-endpoints",
>>  ]
>> -DEFAULT_OUTPUT = "openmetrics://:9876"
>> +DEFAULT_OUTPUT = "openmetrics://127.0.0.1:9876"
>>  
>
> Minor nit, but would it be better to use "localhost" rather than the
> hardcoded IP here and below?

That's a good point. I had considered it but as I wrote in the commit
message:

>> Unrelated: The Python stdlib TCP server listens on IPv4 only by default.
>> Changing this requires creating a subclass that overrides address_family
>> to socket.AF_INET6.

On certain systems and depending on the libc implementation, localhost
may resolve to ::1 which causes an error on startup:

  socket.gaierror: [Errno -9] Address family for hostname not supported

I dug a bit and it happens that the python standard TCPServer
implementation explicitly uses AF_INET when creating the socket. Hence
bind() fails with IPv6 addresses.