This is an automated email from the ASF dual-hosted git repository.
jojochuang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new fd1dc168d7c HDDS-16970. Add IPv6 addresses to certificate subject
alternative names (#11541)
fd1dc168d7c is described below
commit fd1dc168d7c965837aa9cac543c254a6706e1c89
Author: Siyao Meng <[email protected]>
AuthorDate: Wed Oct 14 16:07:00 2026 -0700
HDDS-16970. Add IPv6 addresses to certificate subject alternative names
(#11541)
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
.../org/apache/hadoop/hdds/utils/HddsServerUtil.java | 18 +++++++++++++++++-
.../apache/hadoop/hdds/scm/TestHddsServerUtils.java | 20 ++++++++++++++++++++
2 files changed, 37 insertions(+), 1 deletion(-)
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/utils/HddsServerUtil.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/utils/HddsServerUtil.java
index d763753c54b..7930a9b19a6 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/utils/HddsServerUtil.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/utils/HddsServerUtil.java
@@ -68,6 +68,7 @@
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.NetworkInterface;
+import java.net.UnknownHostException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.ArrayList;
@@ -188,7 +189,7 @@ public static List<InetAddress>
getValidInetsForCurrentHost()
if (ifc.isUp()) {
Enumeration<InetAddress> enumAdds = ifc.getInetAddresses();
while (enumAdds.hasMoreElements()) {
- InetAddress addr = enumAdds.nextElement();
+ InetAddress addr = dropScopeUnlessLinkLocal(enumAdds.nextElement());
if (isValidInetForCsr(addr)) {
LOG.info("Adding ip:{},host:{}", addr.getHostAddress(),
addr.getHostName());
@@ -203,6 +204,21 @@ public static List<InetAddress>
getValidInetsForCurrentHost()
return hostIps;
}
+ /**
+ * A network interface returns every IPv6 address with the interface as
scope, which
+ * {@link #isScopedOrMaskingIPv6Address(InetAddress)} rejects. Only a
link-local address needs the scope, so it is
+ * dropped from any other address.
+ *
+ * @param addr the InetAddress as returned by a network interface
+ * @return the address without scope, or the same address if it is
link-local or not an IPv6 address
+ */
+ public static InetAddress dropScopeUnlessLinkLocal(InetAddress addr) throws
UnknownHostException {
+ if (addr instanceof Inet6Address && !addr.isLinkLocalAddress()) {
+ return InetAddress.getByAddress(addr.getAddress());
+ }
+ return addr;
+ }
+
/**
* Determines whether the supplied address is valid to add to a certificate's
* SAN extension. Wildcard/unspecified (0.0.0.0, ::) and loopback
diff --git
a/hadoop-hdds/server-scm/src/test/java/org/apache/hadoop/hdds/scm/TestHddsServerUtils.java
b/hadoop-hdds/server-scm/src/test/java/org/apache/hadoop/hdds/scm/TestHddsServerUtils.java
index e452ef51dbb..0ea8dd0ed99 100644
---
a/hadoop-hdds/server-scm/src/test/java/org/apache/hadoop/hdds/scm/TestHddsServerUtils.java
+++
b/hadoop-hdds/server-scm/src/test/java/org/apache/hadoop/hdds/scm/TestHddsServerUtils.java
@@ -32,6 +32,7 @@
import static org.junit.jupiter.api.Assertions.assertTrue;
import java.io.File;
+import java.net.Inet6Address;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.UnknownHostException;
@@ -221,6 +222,25 @@ public void testValidInetsIncludedInCsr() throws
UnknownHostException {
assertThat(HddsServerUtil.isValidInetForCsr(InetAddress.getByName("2001:db8::1"))).isTrue();
}
+ /**
+ * A network interface reports every IPv6 address with a scope. Only a
link-local address keeps it and stays excluded.
+ */
+ @Test
+ public void testScopeDroppedFromRoutableIPv6ForCsr() throws
UnknownHostException {
+ InetAddress routable = Inet6Address.getByAddress(null,
InetAddress.getByName("2001:db8::1").getAddress(), 1);
+ assertThat(HddsServerUtil.isValidInetForCsr(routable)).isFalse();
+ InetAddress dropped = HddsServerUtil.dropScopeUnlessLinkLocal(routable);
+ assertThat(dropped.getHostAddress()).isEqualTo("2001:db8:0:0:0:0:0:1");
+ assertThat(HddsServerUtil.isValidInetForCsr(dropped)).isTrue();
+
+ InetAddress linkLocal = Inet6Address.getByAddress(null,
InetAddress.getByName("fe80::1").getAddress(), 1);
+
assertThat(HddsServerUtil.dropScopeUnlessLinkLocal(linkLocal)).isSameAs(linkLocal);
+ assertThat(HddsServerUtil.isValidInetForCsr(linkLocal)).isFalse();
+
+ InetAddress ipv4 = InetAddress.getByName("1.2.3.4");
+ assertThat(HddsServerUtil.dropScopeUnlessLinkLocal(ipv4)).isSameAs(ipv4);
+ }
+
@Test
public void testGetStaleNodeInterval() {
final OzoneConfiguration conf = new OzoneConfiguration();
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
