Comments (8)
Yes, I don't think this is ever the correct behavior. I think the correct behavior would be to error in this case, because you also probably don't want Serf to just bind to a public network. I think Serf should error if no explicit bind address is set and the only one it can detect is a public one.
If you explicitly set a bind address to the public IP, then it is fine.
Thoughts?
from serf.
I dont fully understand the implications of serf running on a public network. The encryption key protects other members from joining the cluster, so it seems like it would be up to the administrator to responsibly setup the cluster. regardless of the node being in a private or public network, it seems like using dns to lookup the hostname to an IP address would be the correct behavior.
from serf.
We also have to consider the case of not using encryption. Basically, if you want serf to run on a public network I prefer it is explicit so we don't have to deal with people accidentally running over a public network without encryption and then being surprised when there is an incident. I think @mitchellh has a good point that if we cannot find a suitable private address, we should error instead of using loopback.
from serf.
You should probably warn when binding to a public network without encryption explicitly.
from serf.
@thedrow That is a great idea.
from serf.
I second @thedrow
from serf.
In hashicorp/memberlist@e15d81a we now warn if binding to a public address without encryption
from serf.
And in hashicorp/memberlist@54a7ab8 we now error if bind address is "0.0.0.0" and no private IP can be found. Default behavior before was to use loopback.
from serf.
Related Issues (20)
- CVE-2019-19794 on last release by repos hashicorp/mdns
- Website Simulator Alert for Number of Nodes Check is Off-by-One
- When a serf member is leaving the pool using `Leave` if `messageLeaveType` broadcast fail, the leave is not completed
- maybe mark `v0.9.6` as the latest release?
- Release latest binaries HOT 2
- response size check on keyListResponseWithCorrectSize breaks with 32bit keys and keyring size >20
- Data race related to query Ack channel
- Is Serf suitable for integration into the kubernetes app as a library?
- When the nodes leave and start at the same time in a large-capacity consul cluster, some member states will continue to keep leaving, not alive.
- Upgrade kramdown package used in Website Gemfile.lock to version 2.3.0+ to fix Remote Code Execution CVE-2020-14001
- Can't bind Serf agent to IPv6 address
- serf panics on MacOS when waking up from sleep during a network switch
- serf agent panic when -iface and -discover is given HOT 2
- serf: protect field access with lock to avoid potential data race
- [Question] User events to a node rejoining the cluster
- Is this a small typo? Should read start and stop?
- Please, Upgrade armon/go-metrics to hashicorp/go-metrics HOT 2
- Question regarding the estimation of the latency between two kubernetes clusters using serf
- Unix Domain Sockets for the RPC address.
- Using as a library of managing membership, Is serf just provides a different/better implementation of memberlist? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from serf.