GlassFish vs Hostname Resolution - Remove Autodetection Magic?

[dmatej]

Hi, for years there was a feature implemented in NetUtils and used on SOME places in code which tried to guess the best hostname used by asadmin to communicate with the server when it is starting or when it is asked to stop, etc.

It never worked reliably, so I tried to fix it, and on this long painful path I learned a lot of things. I will try to summarize it here, then you can try to argue, create PRs or report your experiments and experiences.

The last version is in 8.0.4, and not much surprisingly brought problems to developers working on MacOS, because the reverse lookup is usually extremely slow for link-local addresses, which are temporary and regenerated from time to time, which is not what you would usually want at all.

8.0.3 had issues even with docker, that is why we did not release any image. Later I have found some workaround, set

export AS_NO_REVERSE_DNS=true

In 8.0.4 you can explicitly set the hostname with

export AS_HOSTNAME=localhost

or uncomment more sophisticated line in asenv.conf

export AS_HOSTNAME="${AS_HOSTNAME:-$(hostname)}"

Somewhere in the middle of messing with #26037 and #25972 I tried to add more and more checks how to disqualify addresses and host names, opening ports, validating this and that ... and it just made starts slower, so they timed out in tests, because when you hit the black hole ... there's just silence.

I have found that Windows, Macs and Ubuntu have different rules for some addresses and host name resolution, some resolutions are cached and some are not, some are temporary, some are by convention which can be suppressed (yes it is possible that localhost does not resolve ... and it is also possible that it is impossible to find it by reverse lookup, but it still works (Windows)).

And when I learned that all and even more I missed, I came to few facts:

• NetUtils have no idea about firewall rules, so whatever it chose as the best host name might not work at all.
• NetUtils have no idea about what user wants
  • Developer usually wants localhost (or better loopback host), so he can test locally his application, and especially if nobody from the outside world would be able to access it (firewall will allow just local connections). That contradicts our attempts to find the best host name visible to whole world.
  • Sysadmin usually wants THE hostname. The one he set in fresh os installation, probably as a system computer name (Windows) or hostname (the command name on Linux)
  • WAIT! Docker virtual machines map ports to their host. So it MUST be localhost.
  • WAIT! Other virtual machines have different rules, sometimes you even have no permission to set the host name.
• And then comes TLS/HTTPS and server certificate......

My Conclusion

In my opinion, user always knows better. He knows what is the host name he wants to have in the CN of the certificate, in its extensions, so the communication would be secure. He knows if there is a loadbalancer and what kind of it, proxies and a firewall rules to align with, etc. He should set the value and GlassFish must respect it - it can just complain if something doesn't work.

My idea is that we would remove this heuristic in 8.0.5. By default, GlassFish would use the looback canonical host name (usually localhost). What do you think?

[OndroMih]

I agree. Simpler is better, even more so if it speeds up startup. If it doesn’t work, users can adjust the config to match their hostname. Ideally an error message would instruct users how to do so if the default loopback interfaces doesn’t work.

[renatsaf]

I agree.