-
Notifications
You must be signed in to change notification settings - Fork 136
Description
tl;dr
In GA Zui v1.5.0 and older, the Zed lake service was launched by Zui with zed serve -l localhost:9867 such that client connections would only be permitted from localhost. The changes in #2934 resulted in this becoming zed serve -l :9867 such that in GA Zui v1.6.0 and newer Zui's local lake service has been open to connections from remote addresses as well. Hopefully default desktop configs are such that firewalls would prevent such incoming connections regardless, but we should likely revert this change in the interest of good security hygiene. Unfortunately, other tool changes (probably the same ones that resulted in the change in #2934) require us to do a bit more than just put back the original code.
Details
The change from #2934 in question is commit e0e3a7d where this line that formerly said this.addr(), changed to:
zui/packages/zed-node/src/lake.ts
Line 41 in 9c98969
| ':' + this.port, |
If we revert just that change back to this.addr() and then try to do something with the lake such as load data, we now get an error:
Web searches regarding this error brings up Node.js issue nodejs/node#40702 wherein this comment seems like the best summary I've seen. In brief, it appears that the move to Node v18 in #2972 has made it such that now when the zed-node client seeks to connect to localhost, new Node behavior has made it such that the connection is now attempted to the IPv6 address ::1 and since the Zed service is listening only on the IPv4 address the connection is refused.
I've been experimenting with some of the fixes/workarounds described in nodejs/node#40702 and am weighing the trade-offs. I'll add a comment next with findings thus far.
