gocd / gocd

GoCD - Continuous Delivery server main repository
https://www.gocd.org
Apache License 2.0
7.1k stars 970 forks source link

Hostname returned in SystemUtils.java performs dns lookup.. #1462

Closed mopfeffe closed 4 years ago

mopfeffe commented 9 years ago

To get the host name, SystemUtil.java is using public static String getLocalhostName() { try { return InetAddress.getLocalHost().getHostName(); } catch (UnknownHostException e) { throw new RuntimeException(e); } } See:

https://github.com/gocd/gocd/blob/f52a72f9b7c23919470dbdbc47139ef1dc95acf8/base/src/com/thoughtworks/go/util/SystemUtil.java#L46

This causes a DNS lookup on the IP address, which may return something other than the hostname (or may fail if the IP address is not registered in the DNS (causing go agent to send unknonw-host-NNN as the hostname). I would consider that perhaps InetAddress.getHostName() might be a good option to use in case this fails, or perhaps just replace InetAddress.getLocalHost().getHostname() with InetAddress.getHostName() instead...

arvindsv commented 9 years ago

Sort of related to #599? Maybe making both hostname and IP configurable? Of course, we have to consider the implications of an agent being setup with a made-up hostname and IP address. Does it matter?

mopfeffe commented 9 years ago

Does seems related to #599 – which is much more generally addressing the agent IP address presented to the server for server communication to the agent.

I’m actually quite new to go-cd, so I actually don’t understand the use of the hostname once it reaches the go server. Is that for information only? Is the name actually used or just displayed on the server web site for administrators to see?

--Moshe

From: Aravind SV [mailto:notifications@github.com] Sent: Monday, August 31, 2015 3:09 PM To: gocd/gocd Cc: Moshe Pfeffer (mopfeffe) Subject: Re: [gocd] Hostname returned in SystemUtils.java performs dns lookup.. (#1462)

Sort of related to #599https://github.com/gocd/gocd/issues/599? Maybe making both hostname and IP configurable? Of course, we have to consider the implications of an agent being setup with a made-up hostname and IP address. Does it matter?

— Reply to this email directly or view it on GitHubhttps://github.com/gocd/gocd/issues/1462#issuecomment-136353445.

grahamc commented 9 years ago

The way it is doing the hostname lookup, it should be returning the entry in /etc/hosts which you're supposed to define when you set the hostname. IMHO this isn't a bug in GoCD but in the configuration of your system.

ex, the debian instructions: https://wiki.debian.org/HowTo/ChangeHostname#Core_networking

thusly, the local IP should always resolve promptly.

grahamc commented 9 years ago

@arvindsv re: made up hostnames and made up IPs:

  1. a hostname is made up anyway (you can set it to whatever you want)
  2. an attacker doesn't have to use the GoCD agent, so if the IP and the hostname are submitted by the agent, it should be considered potentially made up and "user data."
arvindsv commented 9 years ago

@grahamc: About it should be considered potentially made up and "user data": You're right.

The server knows the "real" IP (at least the server-side ingress IP) that the connection came in from, just in case an administrator wants to track an agent down, which claims to be a made-up IP which doesn't belong in the network. Should the agents page show that too, then? Today, it is not.

arvindsv commented 9 years ago

I’m actually quite new to go-cd, so I actually don’t understand the use of the hostname once it reaches the go server. Is that for information only? Is the name actually used or just displayed on the server web site for administrators to see?

As far as I can recall, it's just used for information purposes. /cc @jyotisingh: Is that right?

grahamc commented 9 years ago

@arvindsv I suspect having the real IP display in the "Details" page for an agent would be helpful. I'm not sure it has a good use case on the main screen. Along these lines, I think having the "first connected' datetime displayed there too, but I don't want to start adding work to this issue :).

stale[bot] commented 4 years ago

This issue has been automatically marked as stale because it has not had activity in the last 90 days. If you can still reproduce this error on the master branch using local development environment or on the latest GoCD Release, please reply with all of the information you have about it in order to keep the issue open. Thank you for all your contributions.