docs(paxos-standalone): surface the no-auth warning and default to loopback binds#222
Merged
Merged
Conversation
…opback binds The example's paxos peer transport accepts any deserialize-valid message and feeds it straight into `OmniPaxos::handle_incoming` with no peer-identity or membership check, and every RPC is plaintext. The "Production caveats" note explaining this sat below the cargo-run block where a copy-paster could miss it, and `--listen`/`--tso-listen` were required with no safe default. - Add a `> **Warning**` callout above the run instructions stating the no-auth/plaintext exposure and the loopback-by-default posture. - Default `--listen` and `--tso-listen` to `127.0.0.1:0` so binding off-loopback is an explicit operator override rather than something an omitted flag can produce. `scripts/run.sh` is unaffected (it passes both explicitly). The sibling examples need no change: paxos-piggyback and paxos-embedded route paxos messages in-process via `MeshSink` (no tonic peer transport), and paxos-embedded's only network bind — the tsoracle API — is already loopback. Closes #202
Coverage Report for CI Build 26342191821Coverage increased (+0.03%) to 94.82%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
examples/paxos-standaloneexposes a tonic peer transport that feeds any deserialize-validMessage<HighWaterCommand>straight intoOmniPaxos::handle_incomingwith no peer-identity or membership check, and every RPC (peer + client API) is plaintext. The example ispublish = falseand documents this — but the "Authentication & TLS" note sat below thecargo runblock, where a copy-paster could miss it, and--listen/--tso-listenwere required args with no safe default.> **Warning** — no authentication or encryptioncallout immediately above the run instructions, stating the plaintext/no-auth exposure and the loopback-by-default posture.--listenand--tso-listento127.0.0.1:0, so binding off-loopback is an explicit operator override rather than something an omitted flag can produce.Sibling audit (per the issue)
No change needed for the other paxos examples — neither exposes the unauthenticated peer transport:
paxos-piggybackroutes paxos messages in-process viaMeshSink(no tonic peer server).paxos-embeddedlikewise uses an in-processMeshSink; its only network bind, the tsoracle API, is already hardcoded to127.0.0.1.So there's no off-loopback or unauthenticated exposure to fix or to file a follow-up for.
Closes #202
Test plan
cargo runinvocationcargo doc --no-deps -p example-paxos-standalonerenders cleanly (no warnings)--listen/--tso-listenbinds loopback only —lsof -nP -iTCP -sTCP:LISTENshows the process's two sockets on127.0.0.1(OS-assigned ports), no0.0.0.0/*scripts/run.shunaffected — it passes--listen/--tso-listenexplicitly, overriding the new defaultscargo build/cargo clippy -p example-paxos-standaloneclean; pre-commit hook (workspace fmt + clippy) passed