[
https://issues.apache.org/jira/browse/HADOOP-19962?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126130#comment-18126130
]
ASF GitHub Bot commented on HADOOP-19962:
-----------------------------------------
smengcl commented on code in PR #8812:
URL: https://github.com/apache/hadoop/pull/8812#discussion_r4243611237
##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/MachineList.java:
##########
@@ -60,10 +63,48 @@ public InetAddress getByName (String host) throws
UnknownHostException {
}
}
+ /**
+ * An IPv6 address range in CIDR format, which SubnetUtils does not support.
+ */
+ private static final class Inet6Subnet {
+ private static final int MAX_PREFIX_LENGTH = 128;
+
+ private final byte[] network;
+ private final int prefixLength;
+
+ Inet6Subnet(String cidr) {
+ int slash = cidr.indexOf('/');
+ String prefix = cidr.substring(slash + 1);
+ // Any other character is rejected, in particular a scope id because the
prefix match
+ // would silently ignore it.
+ InetAddress address = cidr.matches("[0-9A-Fa-f:.]+/\\d{1,3}")
+ ? InetAddresses.forString(cidr.substring(0, slash)) : null;
+ // An IPv4-mapped address is parsed as an Inet4Address and belongs in an
IPv4 CIDR.
+ if (!(address instanceof Inet6Address) || Integer.parseInt(prefix) >
MAX_PREFIX_LENGTH) {
Review Comment:
No change needed. `InetAddresses.forString("::ffff:10.222.0.0")` returns an
`Inet4Address`, because the JDK converts IPv4 mapped addresses when the address
is built from bytes. The `instanceof Inet6Address` check therefore rejects
`::ffff:10.222.0.0/112`. `testInvalidIPv6CIDR` covers this value and passes.
> Support IPv6 CIDR rules in MachineList
> --------------------------------------
>
> Key: HADOOP-19962
> URL: https://issues.apache.org/jira/browse/HADOOP-19962
> Project: Hadoop Common
> Issue Type: Sub-task
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> MachineList uses the IPv4-only SubnetUtils class. IPv6 CIDR rules therefore
> fail in address-based security policies. Add family-aware prefix matching for
> IPv4 and IPv6. Preserve existing IPv4 behavior. Reject invalid prefixes and
> addresses from the wrong family.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
