yyqdbngt opened a new pull request, #5339: URL: https://github.com/apache/rocketmq-dashboard/pull/5339
### Which Issue(s) This PR Fixes - Fixes #5300 ### Brief Description The adaptive plain-HTTP policy only recognized literal addresses. `isPrivateHost` in `rmqctl/internal/studio/auth.go` handed the host to `net.ParseIP`, which returns `nil` for a DNS name, so `Target.validate()` (via `isPrivateHost` at `internal/studio/client.go:61`) rejected an intranet endpoint such as `http://studio.internal:6789` with `studio server must use HTTPS (HTTP is allowed only for loopback or private-network addresses)` - even when that name resolves exclusively to RFC1918/loopback/link-local addresses, i.e. it is exactly the private-network deployment the policy is meant to allow. `isPrivateHost` now keeps the literal-address path and, for a name, resolves it through `net.DefaultResolver.LookupIPAddr` (bounded by a 2s timeout) and accepts it only when **every** resolved address is loopback/RFC1918/link-local. Mixed resolution, public-only names and names the resolver cannot answer keep requiring HTTPS, so the security posture is unchanged for anything reachable from the Internet. The linked previous attempt (#4946) used a package-level lookup variable; this PR keeps production code hook-free and lets the test point the process resolver at an in-process DNS server instead. ### How Did You Test This Change? Both new tests live in `rmqctl/internal/studio/auth_hostname_test.go`. They answer name lookups from a fixed table through a stub DNS server on a loopback UDP port, so they are deterministic and never touch a real intranet DNS or the network. Red run on the unmodified tree, green run after the fix, same command and same test names: ```powershell $ cd rmqctl $ go test ./internal/studio/ -run "TestPlainHTTPAllowedForIntranetDNSName|TestIsPrivateHostResolvesIntranetNames" -count=1 -v === RUN TestPlainHTTPAllowedForIntranetDNSName/http_intranet_dns_name_accepted auth_hostname_test.go:65: validate("http://studio.internal:6789";) = studio server must use HTTPS (HTTP is allowed only for loopback or private-network addresses), want nil auth_hostname_test.go:65: validate("http://corp.internal:6789";) = studio server must use HTTPS (HTTP is allowed only for loopback or private-network addresses), want nil === RUN TestIsPrivateHostResolvesIntranetNames/studio.internal auth_hostname_test.go:99: isPrivateHost("studio.internal") = false, want true auth_hostname_test.go:99: isPrivateHost("corp.internal") = false, want true --- FAIL: TestPlainHTTPAllowedForIntranetDNSName (0.00s) --- FAIL: TestIsPrivateHostResolvesIntranetNames (0.00s) FAIL github.com/apache/rocketmq-dashboard/rmqctl/internal/studio 0.082s ``` ```powershell $ go test ./internal/studio/ -run "TestPlainHTTPAllowedForIntranetDNSName|TestIsPrivateHostResolvesIntranetNames" -count=2 -v --- PASS: TestPlainHTTPAllowedForIntranetDNSName/http_intranet_dns_name_accepted (0.00s) --- PASS: TestPlainHTTPAllowedForIntranetDNSName/http_second_intranet_dns_name_accepted (0.00s) --- PASS: TestPlainHTTPAllowedForIntranetDNSName/http_mixed_resolution_rejected (0.00s) --- PASS: TestPlainHTTPAllowedForIntranetDNSName/http_public_dns_name_rejected (0.00s) --- PASS: TestPlainHTTPAllowedForIntranetDNSName/http_unresolvable_dns_name_rejected (0.00s) --- PASS: TestIsPrivateHostResolvesIntranetNames/studio.internal (0.00s) --- PASS: TestIsPrivateHostResolvesIntranetNames/mixed.internal (0.00s) PASS ok github.com/apache/rocketmq-dashboard/rmqctl/internal/studio 0.109s ``` Package and neighbours after the fix: ```powershell $ go test ./internal/... ./cmd/... -count=1 ok github.com/apache/rocketmq-dashboard/rmqctl/internal/catalog 0.039s ok github.com/apache/rocketmq-dashboard/rmqctl/internal/catalog/generate 0.074s ok github.com/apache/rocketmq-dashboard/rmqctl/internal/config 0.051s ok github.com/apache/rocketmq-dashboard/rmqctl/internal/output 0.043s ok github.com/apache/rocketmq-dashboard/rmqctl/internal/studio 0.221s ok github.com/apache/rocketmq-dashboard/rmqctl/cmd 1.798s ``` `gofmt -l` and `go vet ./internal/studio/` are clean. (`go test ./...` also runs `rmqctl/scripts`, whose packaging test shells out to `bash` and fails on this Windows box for that unrelated reason; it fails identically before the change.) ### Checklist - [x] One coherent change; unrelated modifications are not bundled in - [x] Commit subject follows Conventional Commits - [x] Tests added or updated for non-trivial changes - [ ] New UI text has both Chinese and English entries under `web/src/i18n/` - not applicable, no UI text - [ ] Architecture constraints stay green (`mvn test` runs the ArchUnit checks) - not applicable, Go module only - [x] New source files carry the ASF license header - [x] Documentation touched where behaviour changed (README / `docs/` / in-app help) - the comment above `isPrivateHost` now documents resolution-based acceptance; no user-facing doc states the old rule -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
