xds: duplicate endpoint addresses across localities are ACKed and can panic outlier detection

Fermée
  • Quelque chose ne va pas ?
#13,119 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@valeter y travaille déjà.

Depuis le 16/10/2026.

  • #13127 par @valeter — ouverte

Évaluation

Difficulté
3/5
Temps estimé
Une demi-journée
Accessibilité débutants
45/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
java
Domaine
distributed-systems

Piste de recherche

Start in xds/src/main/java/io/grpc/xds/XdsEndpointResource.java, where the ClusterLoadAssignment locality entries are parsed into an EdsUpdate, and check every endpoint address across all localities and priorities before the update is returned. Throw ResourceInvalidException on a duplicate IP:port so the existing NACK and last-good-resource path handles it. Done when the attached eds-invalid.json is NACKed, eds-valid.json still ACKs, and the same IP with a different port is still accepted.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

What version of gRPC-Java are you using?
1.71.0 and 1.83.1. Both accept the invalid EDS resource described below. The outlier-detection scenario reproduces a NullPointerException/Panic on both versions.

What is your environment?
Reproduced in a local integration test on macOS 26.2 arm64, JDK 26.0.1 (Java 17 target), using grpc-netty, grpc-xds, a local ADS server and a unary gRPC backend. The control plane uses SotW ADS v3 and the cluster uses EDS, LEAST_REQUEST and outlier detection.

What did you expect to see?
NACK the ClusterLoadAssignment containing the same endpoint IP:port in different localities. Retain the last accepted configuration and accepted version_info, keep serving RPCs, and continue processing subsequent EDS updates. On a cold start with invalid EDS, do not route RPCs until a valid configuration arrives.

This is the behavior verified with grpc-go 1.83.2.

What did you see instead?
grpc-java ACKs the invalid resource. If the endpoint is already ejected by outlier detection, adding the second locality can trigger a NullPointerException in OutlierDetectionLoadBalancer.OutlierDetectionSubchannel.eject because subchannelStateListener is null. The ManagedChannel enters INTERNAL: Panic! This is a bug!

The attached stack is from grpc-java 1.83.1. This is not the duplicate-locality-within-one-priority case fixed by https://github.com/grpc/grpc-java/pull/9119: the locality IDs here are different; the endpoint socket address is the same.

Steps to reproduce the bug

  1. Start a local unary gRPC backend on 127.0.0.1:1234 and an ADS server serving LDS/CDS/EDS for an EDS cluster with LEAST_REQUEST and outlier detection.
  2. Publish eds-valid.json as version 1 and wait for its ACK and successful RPCs.
  3. Make the backend return UNAVAILABLE until outlier detection ejects it; then make it healthy again. The test uses interval=0.1s, baseEjectionTime=2s, maxEjectionTime=2s, maxEjectionPercent=100, enforcingSuccessRate=0, enforcingFailurePercentage=100, failurePercentageThreshold=30, failurePercentageMinimumHosts=1 and failurePercentageRequestVolume=1.
  4. While the endpoint is still ejected, publish eds-invalid.json as version 2. Observe ACK instead of NACK and the NPE/Panic stack.
  5. Repeat invalid EDS updates, then roll back to valid EDS. The invalid configuration should never have reached the load balancer or poisoned the channel.

The simpler validation failure does not require backend failures or outlier detection: publish eds-invalid.json after a healthy version 1 and observe ACK instead of NACK. Publishing invalid EDS on cold start also incorrectly permits successful RPCs.

Potential fix
Validate uniqueness of endpoint addresses while parsing all original ClusterLoadAssignment locality entries, before exposing an EdsUpdate to load balancing. Do not validate only the locality-keyed output map: repeated locality IDs in different priorities can overwrite entries in that map. Throw ResourceInvalidException for duplicate IP:port, using the normal NACK/last-good-resource path. The same IP with a different port must remain valid.

Relevant implementation
https://github.com/grpc/grpc-java/blob/v1.83.1/xds/src/main/java/io/grpc/xds/XdsEndpointResource.java
https://github.com/grpc/grpc-go/blob/v1.83.2/internal/xds/xdsclient/xdsresource/unmarshal_eds.go

eds-invalid.json
eds-valid.json
grpc-java-1.83.1-stack.txt

Langage dominant
Java
Étoiles
12.1k
Forks
4k
Merge moyen
1 j 13 h
PR mergées (30 j)
42

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de grpc/grpc-java

Toutes les issues de grpc/grpc-java

Issues similaires

Plus d'issues Java

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.