telemetry-exporter: listen on loopback by default

PATCH Applied Robin Jarry 3 participants 4 messages Jan 27, 2025 – Nov 11, 2025

lore

Share & tools

lore

Robin Jarry

author

2025-01-27 11:52 UTC #0 lore raw

PATCH 1/1 telemetry-exporter: listen on loopback by default

Fix the following warning reported by Coverity:

Defect type: SIGMA.insecure_network_bind:

Quoted 4 lines

dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
Sigma main event: The HTTP server binds to all network interfaces by setting the IP address to "", 0.0.0.0, ::, or ::0. This may expose the server to unintended traffic.

Avoid listening to all interfaces by default to avoid exposing private information unwillingly.

Unrelated: The Python stdlib TCP server listens on IPv4 only by default. Changing this requires creating a subclass that overrides address_family to socket.AF_INET6.

Fixes d94ebd627a86 ("usertools: add telemetry exporter")

Cc [email protected]

Signed-off-by Robin Jarry <[email protected]>

---
 usertools/dpdk-telemetry-exporter.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

usertools/dpdk-telemetry-exporter.py +3 -3

index 6eca0db2e80a..6f66d4ecaab1 100755
@@ -75,7 +75,7 @@ def cmd(self, uri, arg=None) -> dict | list:
     "/usr/local/share/dpdk/telemetry-endpoints",
     "/usr/share/dpdk/telemetry-endpoints",
 ]
-DEFAULT_OUTPUT = "openmetrics://:9876"
+DEFAULT_OUTPUT = "openmetrics://127.0.0.1:9876"
 
 
 def main():

@@ -275,11 +275,11 @@ def serve_openmetrics(
     Start an HTTP server and serve requests in the openmetrics/prometheus
     format.
     """
-    listen = (args.output.hostname or "", int(args.output.port or 80))
+    listen = (args.output.hostname or "127.0.0.1", int(args.output.port or 80))
     with server.HTTPServer(listen, OpenmetricsHandler) as httpd:
         httpd.dpdk_socket_path = args.socket_path
         httpd.telemetry_endpoints = endpoints
-        LOG.info("listening on port %s", httpd.server_port)
+        LOG.info("listening on %s", httpd.socket.getsockname())
         try:
             httpd.serve_forever()
         except KeyboardInterrupt:

Signature · 1 line

2.48.1

Bruce Richardson

2025-01-27 14:40 UTC #1 lore raw

Quoted 27 lines · Robin Jarry

Fix the following warning reported by Coverity:
Defect type: SIGMA.insecure_network_bind:
Quoted 4 lines
dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
Sigma main event: The HTTP server binds to all network interfaces by setting the IP address to "", 0.0.0.0, ::, or ::0. This may expose the server to unintended traffic.
Avoid listening to all interfaces by default to avoid exposing private information unwillingly.
Unrelated: The Python stdlib TCP server listens on IPv4 only by default. Changing this requires creating a subclass that overrides address_family to socket.AF_INET6.
Fixes d94ebd627a86 ("usertools: add telemetry exporter")
Cc [email protected]
Signed-off-by Robin Jarry <[email protected]>
---
 usertools/dpdk-telemetry-exporter.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
usertools/dpdk-telemetry-exporter.py +0 -0
index 6eca0db2e80a..6f66d4ecaab1 100755

usertools/dpdk-telemetry-exporter.py def cmd(self, uri, arg=None) -> dict | list: · line 79

Quoted 6 lines

usertools/dpdk-telemetry-exporter.py +1 -1

@@ -75,7 +75,7 @@ def cmd(self, uri, arg=None) -> dict | list:
     "/usr/local/share/dpdk/telemetry-endpoints",
     "/usr/share/dpdk/telemetry-endpoints",
 ]
-DEFAULT_OUTPUT = "openmetrics://:9876"
+DEFAULT_OUTPUT = "openmetrics://127.0.0.1:9876"

Minor nit, but would it be better to use "localhost" rather than the hardcoded IP here and below?

Quoted 19 lines

usertools/dpdk-telemetry-exporter.py +2 -2

 def main():

@@ -275,11 +275,11 @@ def serve_openmetrics(
     Start an HTTP server and serve requests in the openmetrics/prometheus
     format.
     """
-    listen = (args.output.hostname or "", int(args.output.port or 80))
+    listen = (args.output.hostname or "127.0.0.1", int(args.output.port or 80))
     with server.HTTPServer(listen, OpenmetricsHandler) as httpd:
         httpd.dpdk_socket_path = args.socket_path
         httpd.telemetry_endpoints = endpoints
-        LOG.info("listening on port %s", httpd.server_port)
+        LOG.info("listening on %s", httpd.socket.getsockname())
         try:
             httpd.serve_forever()
         except KeyboardInterrupt:

Signature · 1 line

2.48.1

Robin Jarry

author

2025-01-27 20:21 UTC #2 lore raw

Bruce Richardson, Jan 27, 2025 at 15:39:

Quoted 23 lines · Robin Jarry

Quoted 22 lines
Fix the following warning reported by Coverity:
Defect type: SIGMA.insecure_network_bind:
Quoted 4 lines
dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
Sigma main event: The HTTP server binds to all network interfaces by setting the IP address to "", 0.0.0.0, ::, or ::0. This may expose the server to unintended traffic.
Avoid listening to all interfaces by default to avoid exposing private information unwillingly.
Unrelated: The Python stdlib TCP server listens on IPv4 only by default. Changing this requires creating a subclass that overrides address_family to socket.AF_INET6.
Fixes d94ebd627a86 ("usertools: add telemetry exporter")
Cc [email protected]
Signed-off-by Robin Jarry <[email protected]>
---
 usertools/dpdk-telemetry-exporter.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Quoted 14 lines

usertools/dpdk-telemetry-exporter.py def cmd(self, uri, arg=None) -> dict | list: · line 79
Quoted 11 lines
usertools/dpdk-telemetry-exporter.py +1 -1
index 6eca0db2e80a..6f66d4ecaab1 100755
@@ -75,7 +75,7 @@ def cmd(self, uri, arg=None) -> dict | list:
     "/usr/local/share/dpdk/telemetry-endpoints",
     "/usr/share/dpdk/telemetry-endpoints",
 ]
-DEFAULT_OUTPUT = "openmetrics://:9876"
+DEFAULT_OUTPUT = "openmetrics://127.0.0.1:9876"
 
Minor nit, but would it be better to use "localhost" rather than the hardcoded IP here and below?

That's a good point. I had considered it but as I wrote in the commit message:

Quoted 3 lines

Quoted 3 lines
Unrelated: The Python stdlib TCP server listens on IPv4 only by default. Changing this requires creating a subclass that overrides address_family to socket.AF_INET6.

On certain systems and depending on the libc implementation, localhost may resolve to ::1 which causes an error on startup:

socket.gaierror: [Errno -9] Address family for hostname not supported

I dug a bit and it happens that the python standard TCPServer implementation explicitly uses AF_INET when creating the socket. Hence bind() fails with IPv6 addresses.

Thomas Monjalon

Applied

2025-11-11 17:44 UTC #3 lore raw

In reply to Robin Jarry

27/01/2025 12:51, Robin Jarry:

Quoted 11 lines

Fix the following warning reported by Coverity:
Defect type: SIGMA.insecure_network_bind:
Quoted 4 lines
dpdk-stable-24.11.1/usertools/dpdk-telemetry-exporter.py:278:
Sigma main event: The HTTP server binds to all network interfaces by setting the IP address to "", 0.0.0.0, ::, or ::0. This may expose the server to unintended traffic.
Avoid listening to all interfaces by default to avoid exposing private information unwillingly.

Quoted 7 lines

Unrelated: The Python stdlib TCP server listens on IPv4 only by default. Changing this requires creating a subclass that overrides address_family to socket.AF_INET6.
Fixes d94ebd627a86 ("usertools: add telemetry exporter")
Cc [email protected]
Signed-off-by Robin Jarry <[email protected]>

Applied, thanks.