security(cluster): confine insecure transport binds

Author: farhan-syah

nodedb-cluster/src/lib.rs

@@ -143,8 +143,9 @@ pub use transport::{
     PinnedClientVerifier, PinnedServerVerifier, RaftRpcHandler, ShufflePushStream, TlsCredentials,
     TransportCredentials, TransportPeerSnapshot, VerifyMethod, VerifyOutcome, ca_fingerprint,
     ca_fingerprint_hex, generate_node_credentials, generate_node_credentials_multi_san,
-    insecure_transport_count, issue_leaf_for_sans, load_crls_from_pem,
-    make_raft_client_config_mtls, make_raft_server_config_mtls, spki_pin_from_cert_der,
+    insecure_transport_bind_allowed, insecure_transport_count, issue_leaf_for_sans,
+    load_crls_from_pem, make_raft_client_config_mtls, make_raft_server_config_mtls,
+    spki_pin_from_cert_der,
 };
 pub use wire::VShardEnvelope;
 

nodedb-cluster/src/transport/client/tests.rs

@@ -171,6 +171,24 @@ impl RaftRpcHandler for EchoHandler {
     async fn on_timeout_now(&self, _req: TimeoutNowRequest) {}
 }
 
+#[test]
+fn insecure_transport_rejects_non_private_bind_before_observability_increment() {
+    let before = crate::transport::credentials::insecure_transport_count();
+    let error = match NexarTransport::new(
+        1,
+        "0.0.0.0:0".parse().unwrap(),
+        TransportCredentials::Insecure,
+    ) {
+        Ok(_) => panic!("unspecified insecure bind must be rejected"),
+        Err(error) => error,
+    };
+    assert!(matches!(error, ClusterError::Config { .. }));
+    assert_eq!(
+        crate::transport::credentials::insecure_transport_count(),
+        before
+    );
+}
+
 fn make_transport(node_id: u64) -> NexarTransport {
     NexarTransport::new(
         node_id,

nodedb-cluster/src/transport/client/transport.rs

@@ -155,6 +155,15 @@ impl NexarTransport {
         creds: TransportCredentials,
         identity_store: Arc<dyn PeerIdentityStore>,
     ) -> Result<Self> {
+        if creds.is_insecure() && !credentials::insecure_transport_bind_allowed(listen_addr) {
+            return Err(ClusterError::Config {
+                detail: format!(
+                    "insecure cluster transport requires a loopback or private bind address; \
+                     {listen_addr} is unspecified or publicly routable"
+                ),
+            });
+        }
+
         let (server_config, client_config) = match &creds {
             TransportCredentials::Mtls(tls) => (
                 config::make_raft_server_config_mtls(tls, tuning, Arc::clone(&identity_store))?,

nodedb-cluster/src/transport/credentials.rs

@@ -13,6 +13,7 @@
 //! [`NexarTransport`]: super::client::NexarTransport
 //! [`insecure_transport_count`]: self::insecure_transport_count
 
+use std::net::{IpAddr, SocketAddr};
 use std::sync::atomic::{AtomicU64, Ordering};
 
 use tracing::warn;
@@ -63,6 +64,18 @@ impl std::fmt::Debug for TransportCredentials {
 
 static INSECURE_TRANSPORT_COUNT: AtomicU64 = AtomicU64::new(0);
 
+/// Whether an unauthenticated cluster listener is confined to a loopback or
+/// private-network bind address.
+///
+/// Unspecified and globally routable addresses are deliberately rejected.
+/// IPv4 permits loopback and RFC 1918 space; IPv6 permits loopback and ULA.
+pub fn insecure_transport_bind_allowed(addr: SocketAddr) -> bool {
+    match addr.ip() {
+        IpAddr::V4(ip) => ip.is_loopback() || ip.is_private(),
+        IpAddr::V6(ip) => ip.is_loopback() || ip.is_unique_local(),
+    }
+}
+
 /// Number of [`NexarTransport`] instances constructed in `Insecure` mode
 /// since process start. Exposed for operational dashboards — any non-zero
 /// value in a production deployment is a misconfiguration.
@@ -94,6 +107,38 @@ mod tests {
         assert!(TransportCredentials::Insecure.is_insecure());
     }
 
+    #[test]
+    fn insecure_bind_policy_rejects_public_and_unspecified_addresses() {
+        for addr in [
+            "0.0.0.0:9400",
+            "8.8.8.8:9400",
+            "[::]:9400",
+            "[2001:4860:4860::8888]:9400",
+        ] {
+            assert!(
+                !insecure_transport_bind_allowed(addr.parse().unwrap()),
+                "{addr}"
+            );
+        }
+    }
+
+    #[test]
+    fn insecure_bind_policy_allows_loopback_and_private_addresses() {
+        for addr in [
+            "127.0.0.1:9400",
+            "10.0.0.1:9400",
+            "172.16.0.1:9400",
+            "192.168.0.1:9400",
+            "[::1]:9400",
+            "[fd00::1]:9400",
+        ] {
+            assert!(
+                insecure_transport_bind_allowed(addr.parse().unwrap()),
+                "{addr}"
+            );
+        }
+    }
+
     #[test]
     fn announce_bumps_counter() {
         let before = insecure_transport_count();

nodedb-cluster/src/transport/mod.rs

@@ -30,7 +30,9 @@ pub mod pki_types {
         CertificateDer, CertificateRevocationListDer, PrivateKeyDer, PrivatePkcs8KeyDer, UnixTime,
     };
 }
-pub use credentials::{TransportCredentials, insecure_transport_count};
+pub use credentials::{
+    TransportCredentials, insecure_transport_bind_allowed, insecure_transport_count,
+};
 pub use peer_identity_store::{NoopIdentityStore, PeerIdentityStore};
 pub use peer_identity_verifier::{
     IDENTITY_MISMATCH_QUIC_ERROR, VerifyMethod, VerifyOutcome, spki_pin_from_cert_der,

nodedb/src/config/server/cluster.rs

@@ -175,6 +175,16 @@ impl ClusterSettings {
                 detail: "cluster.replication_factor must be at least 1".into(),
             });
         }
+        if self.insecure_transport && !nodedb_cluster::insecure_transport_bind_allowed(self.listen)
+        {
+            return Err(crate::Error::Config {
+                detail: format!(
+                    "cluster.insecure_transport requires cluster.listen to use a loopback or \
+                     private address; {} is unspecified or publicly routable",
+                    self.listen
+                ),
+            });
+        }
         if self.force_bootstrap && !self.seed_nodes.contains(&self.listen) {
             return Err(crate::Error::Config {
                 detail: "cluster.force_bootstrap requires cluster.listen to be present in \
@@ -185,3 +195,40 @@ impl ClusterSettings {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn insecure_settings(listen: &str) -> ClusterSettings {
+        let listen = listen.parse().unwrap();
+        ClusterSettings {
+            node_id: 1,
+            listen,
+            seed_nodes: vec![listen],
+            num_groups: 1,
+            replication_factor: 1,
+            force_bootstrap: false,
+            tls: None,
+            max_active_sessions: 0,
+            login_attempts_per_ip_per_min: 30,
+            login_attempts_per_user_per_min: 10,
+            insecure_transport: true,
+            log_compaction_threshold: None,
+        }
+    }
+
+    #[test]
+    fn insecure_transport_rejects_public_and_unspecified_binds() {
+        for listen in ["0.0.0.0:9400", "8.8.8.8:9400", "[::]:9400"] {
+            assert!(insecure_settings(listen).validate().is_err(), "{listen}");
+        }
+    }
+
+    #[test]
+    fn insecure_transport_allows_private_binds() {
+        for listen in ["127.0.0.1:9400", "10.0.0.1:9400", "[fd00::1]:9400"] {
+            assert!(insecure_settings(listen).validate().is_ok(), "{listen}");
+        }
+    }
+}

nodedb/src/control/metrics/prometheus/core.rs

@@ -74,6 +74,12 @@ impl SystemMetrics {
             "Active vShard migrations",
             self.vshard_migrations_active.load(Ordering::Relaxed),
         );
+        gauge(
+            out,
+            "nodedb_cluster_insecure_transports",
+            "Insecure cluster transports created; alert whenever this is greater than zero",
+            nodedb_cluster::insecure_transport_count(),
+        );
 
         // ── Bridge ──
         gauge_f64(