Merge pull request #6365 from heyitsanthony/fix-dns-bind

embed: reject domain names before binding

embed/config.go

@@ -17,6 +17,7 @@ package embed
 import (
 	"fmt"
 	"io/ioutil"
+	"net"
 	"net/http"
 	"net/url"
 	"strings"
@@ -253,6 +254,13 @@ func (cfg *configYAML) configFromFile(path string) error {
 }
 
 func (cfg *Config) Validate() error {
+	if err := checkBindURLs(cfg.LPUrls); err != nil {
+		return err
+	}
+	if err := checkBindURLs(cfg.LCUrls); err != nil {
+		return err
+	}
+
 	// Check if conflicting flags are passed.
 	nSet := 0
 	for _, v := range []bool{cfg.Durl != "", cfg.InitialCluster != "", cfg.DNSCluster != ""} {
@@ -346,3 +354,22 @@ func (cfg Config) IsDefaultHost() (string, error) {
 	}
 	return "", defaultHostStatus
 }
+
+// checkBindURLs returns an error if any URL uses a domain name.
+func checkBindURLs(urls []url.URL) error {
+	for _, url := range urls {
+		if url.Scheme == "unix" || url.Scheme == "unixs" {
+			continue
+		}
+		host := strings.Split(url.Host, ":")[0]
+		if host == "localhost" {
+			// special case for local address
+			// TODO: support /etc/hosts ?
+			continue
+		}
+		if net.ParseIP(host) == nil {
+			return fmt.Errorf("expected IP in URL for binding (%s)", url.String())
+		}
+	}
+	return nil
+}

integration/embed_test.go

@@ -40,6 +40,8 @@ func TestEmbedEtcd(t *testing.T) {
 		{wpeers: 1, wclients: 1},
 		{wpeers: 2, wclients: 1},
 		{wpeers: 1, wclients: 2},
+		{werr: "expected IP"},
+		{werr: "expected IP"},
 	}
 
 	urls := newEmbedURLs(10)
@@ -58,6 +60,10 @@ func TestEmbedEtcd(t *testing.T) {
 	setupEmbedCfg(&tests[5].cfg, []url.URL{urls[4]}, []url.URL{urls[5], urls[6]})
 	setupEmbedCfg(&tests[6].cfg, []url.URL{urls[7], urls[8]}, []url.URL{urls[9]})
 
+	dnsURL, _ := url.Parse("http://whatever.test:12345")
+	tests[7].cfg.LCUrls = []url.URL{*dnsURL}
+	tests[8].cfg.LPUrls = []url.URL{*dnsURL}
+
 	dir := path.Join(os.TempDir(), fmt.Sprintf("embed-etcd"))
 	os.RemoveAll(dir)
 	defer os.RemoveAll(dir)