[config{grpc,http}] Add warning when using unspecified address

.chloggen/mx-psi_add-logging-0.0.0.0.yaml

@@ -0,0 +1,16 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: receiver/otlp
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Add warning when using unspecified (`0.0.0.0`) address on HTTP or gRPC servers 
+
+# One or more tracking issues or pull requests related to the change
+issues: [6151]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

config/configgrpc/configgrpc.go

@@ -27,6 +27,7 @@ import (
 	"github.com/mostynb/go-grpc-compression/zstd"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/zap"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/balancer/roundrobin"
 	"google.golang.org/grpc/credentials"
@@ -273,6 +274,22 @@ func (gss *GRPCServerSettings) ToListener() (net.Listener, error) {
 
 // ToServerOption maps configgrpc.GRPCServerSettings to a slice of server options for gRPC.
 func (gss *GRPCServerSettings) ToServerOption(host component.Host, settings component.TelemetrySettings) ([]grpc.ServerOption, error) {
+
+	switch gss.NetAddr.Transport {
+	case "tcp", "tcp4", "tcp6", "udp", "udp4", "udp6":
+		if host, _, err := net.SplitHostPort(gss.NetAddr.Endpoint); err != nil {
+			return nil, fmt.Errorf("failed to parse endpoint: %w", err)
+		} else if host == "0.0.0.0" || host == "::" {
+			settings.Logger.Warn(
+				"Using the 0.0.0.0 address exposes this server to every network interface, which may facilitate Denial of Service attacks",
+				zap.String(
+					"documentation",
+					"https://github.com/open-telemetry/opentelemetry-collector/blob/main/docs/security.md#safeguards-against-denial-of-service-attacks",
+				),
+			)
+		}
+	}
+
 	var opts []grpc.ServerOption
 
 	if gss.TLSSetting != nil {

config/configgrpc/configgrpc_test.go

@@ -26,6 +26,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/peer"
@@ -162,7 +164,11 @@ func TestAllGrpcClientSettings(t *testing.T) {
 }
 
 func TestDefaultGrpcServerSettings(t *testing.T) {
-	gss := &GRPCServerSettings{}
+	gss := &GRPCServerSettings{
+		NetAddr: confignet.NetAddr{
+			Endpoint: "0.0.0.0:1234",
+		},
+	}
 	opts, err := gss.ToServerOption(componenttest.NewNopHost(), componenttest.NewNopTelemetrySettings())
 	_ = grpc.NewServer(opts...)
 
@@ -206,7 +212,11 @@ func TestAllGrpcServerSettingsExceptAuth(t *testing.T) {
 }
 
 func TestGrpcServerAuthSettings(t *testing.T) {
-	gss := &GRPCServerSettings{}
+	gss := &GRPCServerSettings{
+		NetAddr: confignet.NetAddr{
+			Endpoint: "0.0.0.0:1234",
+		},
+	}
 
 	// sanity check
 	_, err := gss.ToServerOption(componenttest.NewNopHost(), componenttest.NewNopTelemetrySettings())
@@ -370,6 +380,48 @@ func TestUseSecure(t *testing.T) {
 	assert.Len(t, dialOpts, 3)
 }
 
+func TestGRPCServerWarning(t *testing.T) {
+	tests := []struct {
+		name     string
+		settings GRPCServerSettings
+		len      int
+	}{
+		{
+			settings: GRPCServerSettings{
+				NetAddr: confignet.NetAddr{
+					Endpoint:  "0.0.0.0:1234",
+					Transport: "tcp",
+				},
+			},
+			len: 1,
+		},
+		{
+			settings: GRPCServerSettings{
+				NetAddr: confignet.NetAddr{
+					Endpoint:  "127.0.0.1:1234",
+					Transport: "tcp",
+				},
+			},
+			len: 0,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			set := componenttest.NewNopTelemetrySettings()
+			logger, observed := observer.New(zap.DebugLevel)
+			set.Logger = zap.New(logger)
+
+			opts, err := test.settings.ToServerOption(componenttest.NewNopHost(), set)
+			require.NoError(t, err)
+			require.NotNil(t, opts)
+			_ = grpc.NewServer(opts...)
+
+			require.Len(t, observed.FilterLevelExact(zap.WarnLevel).All(), test.len)
+		})
+	}
+
+}
+
 func TestGRPCServerSettingsError(t *testing.T) {
 	tests := []struct {
 		settings GRPCServerSettings

config/confighttp/confighttp.go

@@ -17,13 +17,15 @@ package confighttp // import "go.opentelemetry.io/collector/config/confighttp"
 import (
 	"crypto/tls"
 	"errors"
+	"fmt"
 	"net"
 	"net/http"
 	"time"
 
 	"github.com/rs/cors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.opentelemetry.io/otel"
+	"go.uber.org/zap"
 	"golang.org/x/net/http2"
 
 	"go.opentelemetry.io/collector/component"
@@ -259,6 +261,18 @@ func WithErrorHandler(e errorHandler) ToServerOption {
 
 // ToServer creates an http.Server from settings object.
 func (hss *HTTPServerSettings) ToServer(host component.Host, settings component.TelemetrySettings, handler http.Handler, opts ...ToServerOption) (*http.Server, error) {
+	if host, _, err := net.SplitHostPort(hss.Endpoint); err != nil {
+		return nil, fmt.Errorf("failed to parse endpoint: %w", err)
+	} else if host == "0.0.0.0" || host == "::" {
+		settings.Logger.Warn(
+			"Using the 0.0.0.0 address exposes this server to every network interface, which may facilitate Denial of Service attacks",
+			zap.String(
+				"documentation",
+				"https://github.com/open-telemetry/opentelemetry-collector/blob/main/docs/security.md#safeguards-against-denial-of-service-attacks",
+			),
+		)
+	}
+
 	serverOpts := &toServerOptions{}
 	for _, o := range opts {
 		o(serverOpts)

config/confighttp/confighttp_test.go

@@ -29,6 +29,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
 
 	"go.opentelemetry.io/collector/client"
 	"go.opentelemetry.io/collector/component"
@@ -392,6 +394,45 @@ func TestHTTPServerSettingsError(t *testing.T) {
 	}
 }
 
+func TestHTTPServerWarning(t *testing.T) {
+	tests := []struct {
+		name     string
+		settings HTTPServerSettings
+		len      int
+	}{
+		{
+			settings: HTTPServerSettings{
+				Endpoint: "0.0.0.0:0",
+			},
+			len: 1,
+		},
+		{
+			settings: HTTPServerSettings{
+				Endpoint: "127.0.0.1:0",
+			},
+			len: 0,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			set := componenttest.NewNopTelemetrySettings()
+			logger, observed := observer.New(zap.DebugLevel)
+			set.Logger = zap.New(logger)
+
+			_, err := test.settings.ToServer(
+				componenttest.NewNopHost(),
+				set,
+				http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					_, errWrite := fmt.Fprint(w, "test")
+					assert.NoError(t, errWrite)
+				}))
+			require.NoError(t, err)
+			require.Len(t, observed.FilterLevelExact(zap.WarnLevel).All(), test.len)
+		})
+	}
+
+}
+
 func TestHttpReception(t *testing.T) {
 	tests := []struct {
 		name           string
@@ -687,6 +728,7 @@ func TestHttpCorsInvalidSettings(t *testing.T) {
 
 func TestHttpCorsWithAuthentication(t *testing.T) {
 	hss := &HTTPServerSettings{
+		Endpoint: "localhost:0",
 		CORS: &CORSSettings{
 			AllowedOrigins: []string{"*"},
 		},
@@ -884,6 +926,7 @@ func TestServerAuth(t *testing.T) {
 	// prepare
 	authCalled := false
 	hss := HTTPServerSettings{
+		Endpoint: "localhost:0",
 		Auth: &configauth.Authentication{
 			AuthenticatorID: config.NewComponentID("mock"),
 		},
@@ -931,6 +974,7 @@ func TestInvalidServerAuth(t *testing.T) {
 func TestFailedServerAuth(t *testing.T) {
 	// prepare
 	hss := HTTPServerSettings{
+		Endpoint: "localhost:0",
 		Auth: &configauth.Authentication{
 			AuthenticatorID: config.NewComponentID("mock"),
 		},