[2.8] Restrict remote log configuration and local listeners

[pcnudde]

Summary

• restrict remote job log configuration to log levels and built-in log modes
• bind SimEnv/PocEnv FL, admin, and internal listeners to IPv4 loopback
• preserve wildcard listener defaults for non-localhost production deployments
• combine the 2.8 backports of Align remote job log configuration controls #5120 and Use loopback for SimEnv/PocEnv listeners #5122

Testing

• targeted unit tests: 42 passed
• project style checks: ./runtest.sh -s

[greptile-apps]

Greptile Summary

This security backport restricts remote job-log configuration to supported levels and built-in modes while binding local simulation and POC listeners to IPv4 loopback without changing production wildcard defaults.

• Validates job-log configuration on server and client paths.
• Propagates client rejection, timeout, missing-response, and partial-response failures through error data and metadata.
• Separates advertised listener hosts from bind hosts and applies loopback binding to local environments.
• Adds focused coverage for logging validation, reply handling, and listener selection.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
nvflare/private/fed/server/job_cmds.py	Detects rejected, non-OK, absent, and partial client responses and emits both visible error data and error metadata.
nvflare/private/fed/client/admin_commands.py	Validates remote job-log configuration before applying it and returns validation failures to the server.
nvflare/private/fed/server/server_commands.py	Restricts server-side job-log configuration to supported safe values.
nvflare/fuel/f3/cellnet/connector_manager.py	Adds an optional internal listener host while preserving explicitly configured communication resources.
nvflare/fuel/f3/drivers/net_utils.py	Separates the advertised connection host from the listener bind host while retaining wildcard binding by default.
nvflare/private/fed/server/fed_server.py	Uses IPv4 loopback for localhost deployments while preserving wildcard listener behavior for production targets.

Sequence Diagram

sequenceDiagram
  participant O as Operator/API
  participant S as Server command
  participant C as Client job
  O->>S: configure_job_log
  S->>S: Validate server configuration
  S->>C: Forward validated configuration
  C->>C: Validate and apply configuration
  C-->>S: Success or rejection
  alt All requested clients succeed
    S-->>O: Reply table with successful metadata
  else Rejection, timeout, or missing reply
    S-->>O: Reply table plus error item and error metadata
  end

Loading

_{Reviews (6): Last reviewed commit: "Report client job log failures to intera..." | Re-trigger Greptile}

[pcnudde]

/build

[pcnudde]

/build

[pcnudde]

@greptile-apps The remaining 4/5 concern is specific to the legacy interactive HCI status classifier. That classifier is outside the scope of this minimal 2.8 security backport. The relevant Session API path consumes the error metadata and correctly reports client configuration failures, while the appended error is also visible in HCI output. We intentionally do not want to broaden this backport by changing generic HCI status-classification behavior. Please reevaluate the PR with that scope.

[YuanTingHsieh]

Approved after local smoke testing on the exact PR head using a Python virtualenv.

• Default one-client PocEnv reached readiness, the client registered successfully, and graceful shutdown completed.
• A PocEnv explicitly configured with a localhost server target bound both external and internal listeners to 127.0.0.1; the client connected and registered successfully.
• 135 targeted unit tests passed.

Non-blocking notes:

• Remote job logging now accepts only log levels and built-in log modes; dictConfig, inline JSON, and file paths are intentionally rejected as part of the security hardening.
• The default PocEnv still generates a server:8002 server target, so its external listener retains the pre-existing wildcard bind. The new loopback behavior activates when the server target is explicitly localhost.