[
https://issues.apache.org/jira/browse/RANGER-5798?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18121585#comment-18121585
]
Eoin McDonnell commented on RANGER-5798:
----------------------------------------
PR : https://github.com/apache/ranger/pull/1232
> Sanitize Test Connection failure messages to avoid port reachability
> disclosure
> -------------------------------------------------------------------------------
>
> Key: RANGER-5798
> URL: https://issues.apache.org/jira/browse/RANGER-5798
> Project: Ranger
> Issue Type: Improvement
> Components: admin
> Reporter: Eoin McDonnell
> Assignee: Eoin McDonnell
> Priority: Major
>
> Ranger Admin "Test Connection" (validateConfig) can disclose whether a
> host:port is reachable.
> An administrator can enter an arbitrary service URL (for example a NiFi URL
> pointing at a non-service port), click Test Connection, and observe distinct
> failure details in the UI such as:
> java.net.ConnectException: Connection refused
> Because the connection is initiated from the Ranger Admin server, this can be
> used to infer reachability of internal hosts/ports. Note that literal
> localhost / 127.0.0.1 are already rejected in service configs; using a
> resolvable hostname or IP bypasses that check.
> Expected behavior:
> - Keep Test Connection available and keep service URLs configurable (custom
> ports / load balancers are valid).
> - On failure, return a generic connection-failure message to the UI.
> - Log full exception details only in ranger_admin.log.
> - Prefer applying the sanitization on the shared validateConfig / client
> response path so all service types benefit, not only NiFi.
> Repro (NiFi example):
> 1. Ranger Admin UI -> Service Manager -> NiFi -> Add service
> 2. Authentication Type = SSL, use default SSL context = Yes
> 3. Set nifi.url to
> https://<ranger-admin-host>:<closed-port>/nifi-api/resources
> 4. Click Test Connection
> 5. UI shows Connection refused (or similar low-level exception text)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
