Tarantool binds to 0.0.0.0 despite advertise_uri settings

[donatengit]

Hi Guys,

Thanks for your work. We have a problem with our cartridge/tarantool setup: tarantool binds both tcp/udp to 0.0.0.0 despite advertise_uri setting in local/instances.lua (ip address changed):

  advertise_uri: 10.31.200.1:3301
  http_port: 8081
  http_host: 10.31.200.1

I've checked opened ports

>> sudo netstat -tulnp | grep 3301
tcp        0      0 0.0.0.0:3301            0.0.0.0:*               LISTEN      1926351/tarantool i

and nc -v some.public.domain 3301 from outer internet

Connection to some.public.domain port 3301 [tcp/*] succeeded!
Tarantool 2.11.0 (Binary) ....

Other than adopting this patch partially, we tried hardcoding bind IP address right in .rocks/share/tarantool/cartridge/confapplier.lua i.e.:
local ok, err = remote_control.bind('10.31.200.1', vars.binary_port)

and got no luck. Even though it logs specified port
no-vshard.master | 2022-08-16 16:26:35.651 [1236913] main/109/remote_control/10.31.200.1:3301 I> started

NB with a specific IP address hardcode in membership.lua for udp it binds properly.

No need to say, I believe, that there is a potential risk to expose all tarantool data to the outer world if for any reason firewall is misconfigured or disabled at some moment. And thus why wouldn't anyone want to have additional protection by forcing db to bind to local interfaces. Any advise?

Versions:

cartridge --version
Tarantool Cartridge CLI
Version: 2.12.1
OS/Arch: linux/amd64
Git commit: af99c20

tarantool --version
Tarantool Enterprise 2.11.0-entrypoint-1-g16694464a-r489-nogc64
Target: Linux-x86_64-RelWithDebInfo

[filonenko-mikhail]

reproduced