A stranger that writes this node's own id as requestor and a member as addressee makes this node reset its channel to that member every 5 s #10225

Follow-up of #10144 (found while fixing it, out of its scope).

Summary

RaftHAServer.onMisdirectedRaftRequest decides that a refused Raft RPC is a self-dial - and resets this node's replication channel to the addressed peer - with member && localPeerId.equals(requestor). requestor is the unauthenticated RaftRpcRequestProto.requestorId header field (GuardedRaftServer.refuseIfMisdirected), never checked against the connection it arrived on.

#10144 stops that field from choosing the throttle slot. It still chooses the action: a sender outside the cluster that addresses a request to a member (replyId = a declared peer id, e.g. arcadedb-1) and writes this node's own id as requestor makes this node close and rebuild its working gRPC channel to that member, once per MISDIRECTED_RECOVERY_INTERVAL_MS (5 s) per member, for as long as it keeps sending. Each reset fails the in-flight appendEntries on that channel and forces a reconnect.

The same shape arises without an attacker: two clusters with the stock arcadedb-0/1/2 naming whose DNS overlaps, which is the shape #10016 was written for.

Where

• ha-raft/src/main/java/com/arcadedb/server/ha/raft/RaftHAServer.java, onMisdirectedRaftRequest, the worker body: final boolean selfDial = member && localPeerId.equals(requestor);
• ha-raft/src/main/java/com/arcadedb/server/ha/raft/ratis/GuardedRaftServer.java, refuseIfMisdirected: requestor read verbatim from the header.

Possible fixes

• Confirm the self-dial from something the sender cannot write: the address this node holds for addressedTo resolves to one of this node's own listener endpoints (host AND Raft port, since several nodes may share a host), which the worker already resolves for its log line; or
• compare against the transport identity (gRPC TRANSPORT_ATTR_REMOTE_ADDR, or the TLS peer identity when ha.ssl is on) via a server interceptor.

Why not in #10144

#10144 is about the throttle slot. Authenticating the requestor needs either new gRPC plumbing into the guard or an endpoint-equality check against this node's own listeners, a separate change with its own tests.