[
https://issues.apache.org/jira/browse/HADOOP-19962?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126129#comment-18126129
]
ASF GitHub Bot commented on HADOOP-19962:
-----------------------------------------
Copilot commented on code in PR #8812:
URL: https://github.com/apache/hadoop/pull/8812#discussion_r4243580821
##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/MachineList.java:
##########
@@ -60,10 +63,48 @@ public InetAddress getByName (String host) throws
UnknownHostException {
}
}
+ /**
+ * An IPv6 address range in CIDR format, which SubnetUtils does not support.
+ */
+ private static final class Inet6Subnet {
+ private static final int MAX_PREFIX_LENGTH = 128;
+
+ private final byte[] network;
+ private final int prefixLength;
+
+ Inet6Subnet(String cidr) {
+ int slash = cidr.indexOf('/');
+ String prefix = cidr.substring(slash + 1);
+ // Any other character is rejected, in particular a scope id because the
prefix match
+ // would silently ignore it.
+ InetAddress address = cidr.matches("[0-9A-Fa-f:.]+/\\d{1,3}")
+ ? InetAddresses.forString(cidr.substring(0, slash)) : null;
+ // An IPv4-mapped address is parsed as an Inet4Address and belongs in an
IPv4 CIDR.
+ if (!(address instanceof Inet6Address) || Integer.parseInt(prefix) >
MAX_PREFIX_LENGTH) {
Review Comment:
The mapped-address rejection described here is not enforced:
`InetAddresses.forString` preserves `::ffff:a.b.c.d` as a 16-byte
`Inet6Address`, so this `instanceof` check succeeds and `::ffff:10.222.0.0/112`
is accepted. The new `testInvalidIPv6CIDR` case for that value will therefore
fail. Detect the IPv4-mapped 16-byte prefix explicitly and reject it before
adding the subnet.
> Support IPv6 CIDR rules in MachineList
> --------------------------------------
>
> Key: HADOOP-19962
> URL: https://issues.apache.org/jira/browse/HADOOP-19962
> Project: Hadoop Common
> Issue Type: Sub-task
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> MachineList uses the IPv4-only SubnetUtils class. IPv6 CIDR rules therefore
> fail in address-based security policies. Add family-aware prefix matching for
> IPv4 and IPv6. Preserve existing IPv4 behavior. Reject invalid prefixes and
> addresses from the wrong family.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
