Using an empty listening address in the config results in chasquid listening on a random port
albertito opened this issue · comments
If chasquid.conf contain an entry like submission_address: "", then chasquid will use a random port for listening for submissions.
While that is a misconfiguration, it is an easy mistake to make (by users who don't want to listen on any ports), and the result of chasquid listening on a random port can be unexpectedly dangerous.
I will add some code to make chasquid reject empty addresses, to prevent this misconfiguration from happening.
Thanks to xavierg who reported this via IRC!
For future reference, we discussed this a bit on IRC.
An alternative to rejection would be to make it such an empty listening address means "do not listen for this mode". However, if there are repeated listening entries, it can also end up being surprising behaviour (although easier to spot).
Another option would be to have a separate toggle for "not listen on this mode", but that adds a fair amount of complexity to the config.
In the end I think a direct rejection of the config in this case is the safest option: the admin can quickly identify and adjust the configuration accordingly, and it's not going to cause any runtime surprises.
We can always change this later, if we want to end up allowing them, since it'd be backwards-compatible.
Another possible future change could be to special-case the listening address none (or similar), so there is no ambiguity or risk of accidental misconfiguration, and still allow a clear explicit way to say "I don't want chasquid listening for this mode".
But again, that is more complex than just commenting out the entry (or disabling it in systemd).
Commit dbff2f0 contains the proposed fix for this; it's in the next branch.
I'm inclined to leave it there a little while, just in case something unexpected comes up.
chasquid v1.13 includes the fix.
Thanks a lot!