Exempt non-network schemes from drain-specific network checks in poller

c62111f added secure-endpoint/metrics-endpoint/structured-format to
allowedSchemes so non-syslog CUPS bindings (e.g. TAS Metric Registrar's
documented tagging convention) aren't dropped from the shared
/v2/bindings store. However, checkBindings still ran the syslog-drain
network validations (hostname presence, log type filters, DNS
resolution, IP blacklist) on these bindings too, which don't apply
since they're used as opaque discovery tags rather than real drain
endpoints - e.g. "metrics-endpoint:///metrics" has no host at all, and
"structured-format://DogStatsD"'s host segment is not a resolvable
DNS name. Both still got rejected, just with a different error.

Skip those network checks for schemes in the new nonNetworkSchemes
list; credential validation still applies to all schemes.

Adds regression tests reproducing the exact URL shapes from the bug
report (#727).

Author: weili-broadcom

src/pkg/binding/poller.go

@@ -9,6 +9,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"slices"
 	"strings"
 	"time"
 
@@ -78,6 +79,14 @@ type Setter interface {
 // belong to the Syslog Agent. If a particular downstream consumer doesn't support some scheme, it should handle the validation itself
 var allowedSchemes = []string{"syslog", "syslog-tls", "https", "https-batch", "secure-endpoint", "metrics-endpoint", "structured-format"}
 
+// nonNetworkSchemes lists schemes used by downstream consumers other than the Syslog Agent as opaque
+// discovery tags on a CUPS binding (e.g. TAS Metric Registrar's documented "structured-format://" and
+// "metrics-endpoint://" convention) rather than as real syslog drain endpoints. Bindings using these
+// schemes aren't guaranteed to have a resolvable, or even present, hostname, so they must be exempt from
+// the syslog-drain-specific network checks below (hostname presence, log type filters, DNS resolution,
+// IP blacklist) - those only make sense for bindings that are actually dialed as drains.
+var nonNetworkSchemes = []string{"secure-endpoint", "metrics-endpoint", "structured-format"}
+
 func NewPoller(
 	ac client,
 	pi time.Duration,
@@ -237,39 +246,41 @@ func (bc *bindingChecker) checkBindings(bindings []Binding) []Binding {
 			continue
 		}
 
-		if len(u.Host) == 0 {
-			bc.rejectBinding(b.Credentials, fmt.Sprintf("No hostname found in syslog drain url %s", anonymousUrl.String()), true)
-			continue
-		}
+		if !slices.Contains(nonNetworkSchemes, u.Scheme) {
+			if len(u.Host) == 0 {
+				bc.rejectBinding(b.Credentials, fmt.Sprintf("No hostname found in syslog drain url %s", anonymousUrl.String()), true)
+				continue
+			}
 
-		if invalidLogFilter(u) {
-			bc.rejectBinding(b.Credentials, fmt.Sprintf("include-log-types and exclude-log-types cannot be used at the same time in syslog drain url %s", anonymousUrl.String()), true)
-			continue
-		}
+			if invalidLogFilter(u) {
+				bc.rejectBinding(b.Credentials, fmt.Sprintf("include-log-types and exclude-log-types cannot be used at the same time in syslog drain url %s", anonymousUrl.String()), true)
+				continue
+			}
 
-		sourceTypes := getUnknownSourceTypes(u.Query())
-		if sourceTypes != nil {
-			bc.rejectBinding(b.Credentials, fmt.Sprintf("Unknown log types '%s' in log type filter in syslog drain url %s", strings.Join(sourceTypes, ", "), anonymousUrl.String()), true)
-			continue
-		}
+			sourceTypes := getUnknownSourceTypes(u.Query())
+			if sourceTypes != nil {
+				bc.rejectBinding(b.Credentials, fmt.Sprintf("Unknown log types '%s' in log type filter in syslog drain url %s", strings.Join(sourceTypes, ", "), anonymousUrl.String()), true)
+				continue
+			}
 
-		_, exists := bc.failedHostsCache.Get(u.Host)
-		if exists {
-			bc.rejectBinding(b.Credentials, fmt.Sprintf("Skipped resolve ip address for syslog drain with url %s due to prior failure", anonymousUrl.String()), false)
-			continue
-		}
+			_, exists := bc.failedHostsCache.Get(u.Host)
+			if exists {
+				bc.rejectBinding(b.Credentials, fmt.Sprintf("Skipped resolve ip address for syslog drain with url %s due to prior failure", anonymousUrl.String()), false)
+				continue
+			}
 
-		ip, err := bc.checker.ResolveAddr(u.Host)
-		if err != nil {
-			bc.failedHostsCache.Set(u.Host, true)
-			bc.rejectBinding(b.Credentials, fmt.Sprintf("Cannot resolve ip address for syslog drain with url %s", anonymousUrl.String()), true)
-			continue
-		}
+			ip, err := bc.checker.ResolveAddr(u.Host)
+			if err != nil {
+				bc.failedHostsCache.Set(u.Host, true)
+				bc.rejectBinding(b.Credentials, fmt.Sprintf("Cannot resolve ip address for syslog drain with url %s", anonymousUrl.String()), true)
+				continue
+			}
 
-		err = bc.checker.CheckBlacklist(ip)
-		if err != nil {
-			bc.rejectBinding(b.Credentials, fmt.Sprintf("Resolved ip address for syslog drain with url %s is blacklisted", anonymousUrl.String()), true, true)
-			continue
+			err = bc.checker.CheckBlacklist(ip)
+			if err != nil {
+				bc.rejectBinding(b.Credentials, fmt.Sprintf("Resolved ip address for syslog drain with url %s is blacklisted", anonymousUrl.String()), true, true)
+				continue
+			}
 		}
 
 		var validCredentials []Credentials
@@ -316,13 +327,7 @@ func sendAppLogMessage(msg string, apps []App, appLogClient v2.LogClient, logger
 }
 
 func invalidScheme(scheme string) bool {
-	for _, s := range allowedSchemes {
-		if s == scheme {
-			return false
-		}
-	}
-
-	return true
+	return !slices.Contains(allowedSchemes, scheme)
 }
 
 // invalidLogFilter checks if both include-log-types and exclude-log-types are set

src/pkg/binding/poller_test.go

@@ -430,6 +430,46 @@ var _ = Describe("Poller", func() {
 			Expect(bndChecker.blacklistedDrains).To(Equal(float64(0)))
 		})
 
+		It("returns non-network-scheme bindings even without a hostname, like the Metric Registrar's documented convention", func() {
+			// e.g. "metrics-endpoint:///metrics" - a discovery tag, not a real drain endpoint, and never
+			// has a host. It must not be rejected by the "no hostname found" check.
+			bindings := []Binding{
+				{
+					Url: "metrics-endpoint:///metrics",
+					Credentials: []Credentials{
+						{
+							Apps: []App{{Hostname: "app-hostname0", AppID: "app-id-0"}},
+						},
+					},
+				},
+			}
+
+			filteredBindings := bndChecker.checkBindings(bindings)
+
+			Expect(filteredBindings).To(HaveLen(1))
+			Expect(bndChecker.invalidDrains).To(Equal(float64(0)))
+		})
+
+		It("returns non-network-scheme bindings even when their host cannot be resolved via DNS", func() {
+			// e.g. "structured-format://DogStatsD" - the host segment is an opaque tag, not a resolvable
+			// hostname, so it must not be rejected by the DNS resolution check.
+			bindings := []Binding{
+				{
+					Url: "structured-format://fail_to_resolve_ip",
+					Credentials: []Credentials{
+						{
+							Apps: []App{{Hostname: "app-hostname0", AppID: "app-id-0"}},
+						},
+					},
+				},
+			}
+
+			filteredBindings := bndChecker.checkBindings(bindings)
+
+			Expect(filteredBindings).To(HaveLen(1))
+			Expect(bndChecker.invalidDrains).To(Equal(float64(0)))
+		})
+
 		It("returns no binding if a host cannot be parsed from the given url", func() {
 			bindings := []Binding{
 				{