chenBright opened a new pull request, #3511:
URL: https://github.com/apache/brpc/pull/3511
### What problem does this PR solve?
Issue Number: resolve
Problem Summary:
`ServerOptions.internal_port` is documented to make builtin services (and
Tabbed services, see the comment on `internal_port`) reachable only from
the
internal port. `ServerOptions::security_mode()` returns true once it is
set.
Only the http/h2 dispatch path actually enforced this. Every pb protocol
computed the same `security_mode` flag but used it just for address
obfuscation
in `AppendServerIdentiy()`, and had no check at all between method
resolution
and `CallMethod()`. Since builtin services share `_method_map` with user
services, they can be addressed by name over pb.
With `internal_port` configured, a client on the public port can therefore
reach builtin
services that the http path returns `403 Forbidden` for on the very same
server. For
example, `brpc.vars` dumps the full metrics set, and`hotspots` is
reachable the same
way.
Affected dispatch paths: `baidu_std`, `hulu_pbrpc`, `sofa_pbrpc`, and all
nshead-based pb protocols (`public_pbrpc`, `nshead_mcpack`, `nova_pbrpc`,
`ubrpc2pb`), which share `NsheadPbServiceAdaptor::ProcessNsheadRequest`.
### What is changed and the side effects?
Changed:
Side effects:
- Performance effects:
- Breaking backward compatibility:
---
### Check List:
- Please make sure your changes are compilable.
- When providing us with a new feature, it is best to add related tests.
- Please follow [Contributor Covenant Code of
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
