xds: duplicate endpoint addresses across localities are ACKed and can panic outlier detection
维护者通常 1 天内回复
评估
- 难度
- 3/5
- 预计耗时
- 半天
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- java
调研方向
Start in xds/src/main/java/io/grpc/xds/XdsEndpointResource.java, where the ClusterLoadAssignment locality entries are parsed into an EdsUpdate, and check every endpoint address across all localities and priorities before the update is returned. Throw ResourceInvalidException on a duplicate IP:port so the existing NACK and last-good-resource path handles it. Done when the attached eds-invalid.json is NACKed, eds-valid.json still ACKs, and the same IP with a different port is still accepted.
由索引模型根据 Issue 内容生成。
描述
What version of gRPC-Java are you using?
1.71.0 and 1.83.1. Both accept the invalid EDS resource described below. The outlier-detection scenario reproduces a NullPointerException/Panic on both versions.
What is your environment?
Reproduced in a local integration test on macOS 26.2 arm64, JDK 26.0.1 (Java 17 target), using grpc-netty, grpc-xds, a local ADS server and a unary gRPC backend. The control plane uses SotW ADS v3 and the cluster uses EDS, LEAST_REQUEST and outlier detection.
What did you expect to see?
NACK the ClusterLoadAssignment containing the same endpoint IP:port in different localities. Retain the last accepted configuration and accepted version_info, keep serving RPCs, and continue processing subsequent EDS updates. On a cold start with invalid EDS, do not route RPCs until a valid configuration arrives.
This is the behavior verified with grpc-go 1.83.2.
What did you see instead?
grpc-java ACKs the invalid resource. If the endpoint is already ejected by outlier detection, adding the second locality can trigger a NullPointerException in OutlierDetectionLoadBalancer.OutlierDetectionSubchannel.eject because subchannelStateListener is null. The ManagedChannel enters INTERNAL: Panic! This is a bug!
The attached stack is from grpc-java 1.83.1. This is not the duplicate-locality-within-one-priority case fixed by https://github.com/grpc/grpc-java/pull/9119: the locality IDs here are different; the endpoint socket address is the same.
Steps to reproduce the bug
- Start a local unary gRPC backend on 127.0.0.1:1234 and an ADS server serving LDS/CDS/EDS for an EDS cluster with LEAST_REQUEST and outlier detection.
- Publish eds-valid.json as version 1 and wait for its ACK and successful RPCs.
- Make the backend return UNAVAILABLE until outlier detection ejects it; then make it healthy again. The test uses interval=0.1s, baseEjectionTime=2s, maxEjectionTime=2s, maxEjectionPercent=100, enforcingSuccessRate=0, enforcingFailurePercentage=100, failurePercentageThreshold=30, failurePercentageMinimumHosts=1 and failurePercentageRequestVolume=1.
- While the endpoint is still ejected, publish eds-invalid.json as version 2. Observe ACK instead of NACK and the NPE/Panic stack.
- Repeat invalid EDS updates, then roll back to valid EDS. The invalid configuration should never have reached the load balancer or poisoned the channel.
The simpler validation failure does not require backend failures or outlier detection: publish eds-invalid.json after a healthy version 1 and observe ACK instead of NACK. Publishing invalid EDS on cold start also incorrectly permits successful RPCs.
Potential fix
Validate uniqueness of endpoint addresses while parsing all original ClusterLoadAssignment locality entries, before exposing an EdsUpdate to load balancing. Do not validate only the locality-keyed output map: repeated locality IDs in different priorities can overwrite entries in that map. Throw ResourceInvalidException for duplicate IP:port, using the normal NACK/last-good-resource path. The same IP with a different port must remain valid.
Relevant implementation
https://github.com/grpc/grpc-java/blob/v1.83.1/xds/src/main/java/io/grpc/xds/XdsEndpointResource.java
https://github.com/grpc/grpc-go/blob/v1.83.2/internal/xds/xdsclient/xdsresource/unmarshal_eds.go
- 主要语言
- Java
- 星标
- 12.1k
- 派生
- 4k
- 平均合并
- 2 天 9 小时
- 30 天内合并 PR
- 44
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
grpc/grpc-java 的其他 Issue
-
channelz: ServerData `calls_failed` counter not incremented upon client cancellation可能已有人在做 @JoeCqupt 于 5 天前认领。 未关闭enhancement
难度 2/5 1-3 小时 新手友好度 88/100
grpc/grpc-java#13063 · 4 条评论 ·
维护者通常 1 天内回复
-
docs enhancement
难度 2/5 1-3 小时 新手友好度 72/100
grpc/grpc-java#10824 · 8 条评论 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 42/100
维护者通常 1 天内回复
-
question
难度 4/5 3-5 天 新手友好度 25/100
维护者通常 1 天内回复
-
binder: `ServerStream.close()` marks the stream closed before the suffix is sent, so a flow-control-deferred send failure leaks the call可能已有人在做 @kkmurthyt21 于 7 天前认领。 未关闭bug
难度 4/5 3-5 天 新手友好度 45/100
grpc/grpc-java#13097 · 1 条评论 ·
维护者通常 1 天内回复
相似的 Issue
-
Optimize consumer version heatmap aggregation to avoid repeated scans可能已有人在做 @praykaria31 今天认领。 未关闭type/enhancement
难度 2/5 1-3 小时 新手友好度 72/100
Apicurio/apicurio-registry#10662 · 1 条评论 ·
维护者通常 1 天内回复
-
a:false-positive
难度 2/5 1-3 小时 新手友好度 77/100
维护者通常 1 天内回复
-
status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 74/100
spring-projects/spring-boot#52347 ·
维护者通常 2 天内回复
-
bug untriaged
难度 2/5 1-3 小时 新手友好度 76/100
opensearch-project/opensearch-migrations#3480 ·
维护者通常 2 天内回复
-
[Bug] Certificate expiry sorting can reverse UTC order across a viewer daylight-saving gap可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 76/100
apache/rocketmq-dashboard#7318 ·
维护者通常 3 天内回复