morningman opened a new pull request, #69588:
URL: https://github.com/apache/doris/pull/69588
### What problem does this PR solve?
Problem Summary:
External catalogs register user-supplied network endpoints (e.g. an HMS
catalog's `hive.metastore.uris`) that the FE then connects to. When the
operator
has installed the SSRF security SDK (the `security_checker_class_name`
config,
i.e. Aliyun `com.aliyun.securitysdk.SecurityUtil`), those endpoints were not
checked against the SSRF policy at CREATE / ALTER CATALOG, so a user with
CREATE_PRIV (no SUPER required) could point a catalog at an intranet address.
This PR adds one replay-safe gate that, when an SSRF checker is installed,
brackets a lightweight TCP connect to each user-supplied endpoint with the
SDK's
no-arg net-hook so an intranet target is rejected before the catalog is
accepted. The judgment is delegated entirely to the SDK; the FE only
enumerates
the endpoints and brackets the probe. Minimal scope: HMS
(`hive.metastore.uris`
/ `uri`), on CREATE (`checkWhenCreating`) and ALTER
(`validatePropertiesBeforeUpdate`), never on replay. With no checker
installed
(the default open-source build) the gate is a no-op and behavior is
unchanged.
The gate mirrors the existing driver-url operator gate
(`PluginDrivenExternalCatalog#driverUrlKeysOf` /
`checkDriverUrlsAgainstOperatorGate`): a single wire-stable key table
(`ssrfEndpointKeysOf`) drives both the ALTER trigger set and the checked
values,
so a new catalog type adds its endpoint keys in one place. This keeps
endpoint
parsing out of fe-core's connector-agnostic path the same way the driver-url
gate already does, without widening (and major-version-bumping) the connector
plugin SPI.
This PR also fixes a latent bug in the existing SSRF wiring:
`UrlSecurityChecker`
bound the SDK's stop method as `stopSSRFNetHookChecking(String)` but invoked
it
with no argument, so the net-hook was never actually removed and leaked onto
the
pooled FE thread after any bracketed request. It now binds and invokes the
no-arg `stopSSRFNetHookChecking()`, and adds the no-arg
`startSSRFNetHookChecking()` (TCP form) needed to hook non-http connections
such
as HMS thrift.
SSRF surface note (per repo policy): the probe is a new FE -> user-named-host
outbound TCP connect, performed only when the operator installed the SSRF SDK
and only at CREATE / ALTER CATALOG (actor: CREATE_PRIV or ADMIN for CREATE,
ALTER privilege for ALTER). Its sole purpose is to let the SDK reject an
intranet target; a plain connectivity failure is ignored (not treated as a
rejection), so a catalog pointing at a currently-unreachable public endpoint
can
still be created. Known limit: point-in-time check only -- it does not guard
a
later runtime connection (DNS rebinding) or clients that bypass the JDK
socket
layer (e.g. Netty native epoll).
### Release note
None
### Check List (For Author)
- Test:
- Unit Test: SecurityCheckerTest (fe-common, 6 cases),
PluginDrivenExternalCatalogSsrfGateTest (fe-core, 9 cases)
- Behavior changed: Yes -- a new CREATE/ALTER CATALOG SSRF gate plus a fix
to the SSRF net-hook stop binding, both active only when
`security_checker_class_name` is configured; the default open-source build is
unchanged.
- Does this need documentation: No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
