Skip to content

fix(server): configure finite DNS cache TTL #3126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bitflicker64 wants to merge 3 commits into
base: master
Choose a base branch
from
Open

fix(server): configure finite DNS cache TTL #3126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
10ed6d2
fix(server): configure finite DNS cache TTL
bitflicker64 Jul 29, 2026
35e1a24
fix(server): validate DNS security properties
bitflicker64 Jul 29, 2026
0a07cd8
fix(server): validate DNS policy before startup
imbajin Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/server-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,14 @@ jobs:
run: |
mvn clean compile -U -Dmaven.javadoc.skip=true -ntp

- name: Run Java security properties tests
if: ${{ env.BACKEND == 'rocksdb' }}
run: |
mvn package -Dmaven.test.skip=true -pl hugegraph-server/hugegraph-dist -am -ntp
VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
$TRAVIS_DIR/test-java-security-properties.sh $SERVER_DIR

- name: Check startup test prerequisites
id: server-preflight
if: ${{ env.BACKEND == 'rocksdb' }}
Expand All @@ -86,7 +94,6 @@ jobs:
- name: Run start-hugegraph.sh foreground mode tests
if: ${{ env.BACKEND == 'rocksdb' && steps.server-preflight.outputs.can_run == 'true' }}
run: |
mvn package -Dmaven.test.skip=true -pl hugegraph-server/hugegraph-dist -am -ntp
VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
SERVER_DIR=hugegraph-server/apache-hugegraph-server-$VERSION/
$TRAVIS_DIR/test-start-hugegraph.sh $SERVER_DIR
Expand Down
21 changes: 16 additions & 5 deletions hugegraph-server/hugegraph-dist/src/assembly/static/bin/hugegraph-server.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,8 +142,15 @@ case "$GC_OPTION" in
esac

JVM_OPTIONS="-Dlog4j.configurationFile=${CONF}/log4j2.xml"
SECURITY_MANAGER_OPTION=""
if [[ ${OPEN_SECURITY_CHECK} == "true" ]]; then
JVM_OPTIONS="${JVM_OPTIONS} -Djava.security.manager=org.apache.hugegraph.security.HugeSecurityManager"
SECURITY_PROPERTIES="${CONF}/java-security.properties"
JVM_OPTIONS="${JVM_OPTIONS} \
-Djava.security.properties=${SECURITY_PROPERTIES}"
if [[ ${JAVA_VERSION} -ge 18 ]]; then

@imbajin imbajin Aug 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

‼️ This unbounded JDK 18+ branch also includes JDK 24+, where -Djava.security.manager=allow is a fatal VM-initialization error and System.setSecurityManager() cannot install the fallback manager (OpenJDK JEP 486). Since the project documents Java 11+ without an upper bound, security-enabled JDK 24+ deployments cannot start. Please explicitly cap or reject JDK 24+ with a clear compatibility message until the sandbox is replaced, or provide a supported non-SecurityManager path, and exercise the 23/24 boundary with real JVMs.

# Required to install HugeSecurityManager programmatically on JDK 18+.
SECURITY_MANAGER_OPTION="-Djava.security.manager=allow"
fi
fi

if [ "${OPEN_TELEMETRY}" == "true" ]; then
Expand Down Expand Up @@ -186,10 +193,14 @@ fi

# Turn on security check
if [[ "${STDOUT_MODE:-false}" == "true" ]]; then
exec ${JAVA} -Dname="HugeGraphServer" ${JVM_OPTIONS} ${JAVA_OPTIONS} -cp ${CLASSPATH}: \
org.apache.hugegraph.dist.HugeGraphServer ${GREMLIN_SERVER_CONF} ${REST_SERVER_CONF}
exec ${JAVA} -Dname="HugeGraphServer" ${JVM_OPTIONS} ${JAVA_OPTIONS} \
${SECURITY_MANAGER_OPTION} -cp ${CLASSPATH}: \
org.apache.hugegraph.bootstrap.HugeGraphServerBootstrap \
${OPEN_SECURITY_CHECK} ${GREMLIN_SERVER_CONF} ${REST_SERVER_CONF}
else
exec ${JAVA} -Dname="HugeGraphServer" ${JVM_OPTIONS} ${JAVA_OPTIONS} -cp ${CLASSPATH}: \
org.apache.hugegraph.dist.HugeGraphServer ${GREMLIN_SERVER_CONF} ${REST_SERVER_CONF} \
exec ${JAVA} -Dname="HugeGraphServer" ${JVM_OPTIONS} ${JAVA_OPTIONS} \
${SECURITY_MANAGER_OPTION} -cp ${CLASSPATH}: \
org.apache.hugegraph.bootstrap.HugeGraphServerBootstrap \
${OPEN_SECURITY_CHECK} ${GREMLIN_SERVER_CONF} ${REST_SERVER_CONF} \
>> ${LOGS}/hugegraph-server-stdout.log 2>&1
fi
18 changes: 18 additions & 0 deletions hugegraph-server/hugegraph-dist/src/assembly/static/conf/java-security.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Permit failed network clients to resolve a changed address instead of
# retaining the first successful DNS result for the lifetime of the JVM.
networkaddress.cache.ttl=30
Loading
Loading