Repository: DataDog/dd-agent

Issue:
Bind forwarder socket to localhost by default, allow public forwarding only when specified in configuration
Right now, port 17123 is bound to all interfaces by default.



Discussion:
Same thing for 17124 (graphite listener).

Same thing for 17125 (pup)


Resolving patch:
diff --git a/config.py b/config.py
--- a/config.py
+++ b/config.py
@@ -188,6 +188,8 @@ def get_config(parse_args = True, cfg_path=None, init_logging=False, options=Non
         # Core config
         #
 
+        # FIXME unnecessarily complex
+
         if config.has_option('Main', 'use_dd'):
             agentConfig['use_dd'] = config.get('Main', 'use_dd').lower() in ("yes", "true")
         else:
@@ -195,8 +197,8 @@ def get_config(parse_args = True, cfg_path=None, init_logging=False, options=Non
 
         if options is not None and options.use_forwarder:
             listen_port = 17123
-            if config.has_option('Main','listen_port'):
-                listen_port = config.get('Main','listen_port')
+            if config.has_option('Main', 'listen_port'):
+                listen_port = int(config.get('Main', 'listen_port'))
             agentConfig['dd_url'] = "http://localhost:" + str(listen_port)
         elif options is not None and not options.disable_dd and options.dd_url:
             agentConfig['dd_url'] = options.dd_url
@@ -235,6 +237,11 @@ def get_config(parse_args = True, cfg_path=None, init_logging=False, options=Non
         # Debug mode
         agentConfig['debug_mode'] = config.get('Main', 'debug_mode').lower() in ("yes", "true")
 
+        # local traffic only? Default to no
+        agentConfig['non_local_traffic'] = False
+        if config.has_option('Main', 'non_local_traffic'):
+            agentConfig['non_local_traffic'] = config.get('Main', 'non_local_traffic').lower() in ("yes", "true")
+
         # DEPRECATED
         if config.has_option('Main', 'use_ec2_instance_id'):
             use_ec2_instance_id = config.get('Main', 'use_ec2_instance_id')
diff --git a/ddagent.py b/ddagent.py
--- a/ddagent.py
+++ b/ddagent.py
@@ -249,9 +249,16 @@ def run(self):
             debug=False,
         )
 
+        non_local_traffic = self._agentConfig.get("non_local_traffic", False)
+
         tornado.web.Application.__init__(self, handlers, **settings)
         http_server = tornado.httpserver.HTTPServer(self)
-        http_server.listen(self._port)
+        # non_local_traffic must be == True to match, not just some non-false value
+        if non_local_traffic is True:
+            http_server.listen(self._port)
+        else:
+            # localhost in lieu of 127.0.0.1 to support IPv6
+            http_server.listen(self._port, address = "localhost")
         logging.info("Listening on port %d" % self._port)
 
         # Register callbacks
@@ -272,7 +279,10 @@ def flush_trs():
             logging.info("Starting graphite listener on port %s" % gport)
             from graphite import GraphiteServer
             gs = GraphiteServer(self, gethostname(self._agentConfig), io_loop=self.mloop)
-            gs.listen(gport)
+            if non_local_traffic is True:
+                gs.listen(gport)
+            else:
+                gs.listen(port, address = "localhost")
 
         # Start everything
         if self._watchdog:
diff --git a/pup/pup.py b/pup/pup.py
--- a/pup/pup.py
+++ b/pup/pup.py
@@ -225,7 +225,11 @@ def run_pup(config):
 
     port = config.get('pup_port', 17125)
 
-    application.listen(port)
+    if config.get('non_local_traffic', False) is True:
+        application.listen(port)
+    else:
+        # localhost in lieu of 127.0.0.1 allows for ipv6
+        application.listen(port, address="localhost")
 
     interval_ms = 2000
     io_loop = ioloop.IOLoop.instance()
@@ -233,7 +237,6 @@ def run_pup(config):
     scheduler.start()
     io_loop.start()
 
-
 def main():
     """ Parses arguments and starts Pup server """
 


Test patch: