[
https://issues.apache.org/jira/browse/HADOOP-20019?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127002#comment-18127002
]
ASF GitHub Bot commented on HADOOP-20019:
-----------------------------------------
smengcl opened a new pull request, #8821:
URL: https://github.com/apache/hadoop/pull/8821
Generated-by: Claude Code (Opus 5.5)
### Description of PR
`SecurityUtil.getServerPrincipal` replaces `_HOST` with the local host name
when the host is null, empty or `0.0.0.0`. The IPv6 wildcard address is not
recognized, so it is copied into the principal.
Daemons that log in with the host of their bind address therefore get an
invalid principal when they bind to the IPv6 wildcard. A JournalNode with
`dfs.journalnode.rpc-address=[::]:8485`, the IPv6 form of the default
`0.0.0.0:8485`, logs in as `jn/0:0:0:0:0:0:0:0@REALM`, because
`InetSocketAddress#getHostName` returns `0:0:0:0:0:0:0:0` for it. `HttpServer2`
takes the SPNEGO host from its first endpoint, so an endpoint built from
`[::]:9870` gives `HTTP/[0:0:0:0:0:0:0:0]@REALM`. The ResourceManager logs in
the same way.
This PR treats the IPv6 wildcard address like `0.0.0.0`, in any spelling and
with or without brackets. The check parses IP literals only, so it never does a
DNS lookup. Host names and other IP addresses are substituted as before. A
scoped IPv6 address is never treated as the wildcard and is not parsed, so it
cannot throw.
Sub-task of HADOOP-11890.
### How was this patch tested?
Extended `TestSecurityUtil#testLocalHostNameForNullOrWild`: `::`, `[::]`,
`0:0:0:0:0:0:0:0` and `[0:0:0:0:0:0:0:0]` are replaced with the local host
name, while `2001:db8::1` and `fe80::1%nosuchif` are kept as is. On trunk the
test fails with `expected: <hdfs/<local host>@REALM> but was: <hdfs/::@REALM>`.
`mvn test -Dtest=TestSecurityUtil` in `hadoop-common` with JDK 17: 26 tests
run, 0 failures, 0 errors, 0 skipped.
Also checked that the host strings derived from a `[::]:8485` bind address
(`InetSocketAddress#getHostName` and the host of the endpoint URI) now give the
same principal as `0.0.0.0:8485`.
### For code changes:
- [x] Does the title of this PR start with the corresponding JIRA issue id
(e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: Have the integration tests been executed and the
endpoint
declared according to the connector-specific documentation? *Note:
Automated CI
testing doesn't cover all cases so manual testing with cloud storage
is still
required.*
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`,
`NOTICE-binary` files?
### AI Tooling
Contains content generated by Claude Code.
- [x] The PR includes the phrase "Contains content generated by <tool>"
where <tool> is the name of the AI tool used.
- [x] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
🤖 Generated with [Claude Code](https://claude.com/claude-code)
> Support the IPv6 wildcard address in Kerberos _HOST substitution
> ----------------------------------------------------------------
>
> Key: HADOOP-20019
> URL: https://issues.apache.org/jira/browse/HADOOP-20019
> Project: Hadoop Common
> Issue Type: Sub-task
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
>
> {{SecurityUtil.getServerPrincipal}} replaces {{_HOST}} with the local host
> name when the host is null, empty or {{0.0.0.0}}. The IPv6 wildcard address
> is not recognized, so it is copied into the principal.
> A daemon that logs in with the host of its bind address therefore gets an
> invalid principal when it binds to the IPv6 wildcard. For example, a
> JournalNode with {{dfs.journalnode.rpc-address=[::]:8485}}, the IPv6 form of
> the default {{0.0.0.0:8485}}, logs in as {{jn/0:0:0:0:0:0:0:0@REALM}}.
> {{HttpServer2}} takes the SPNEGO host from its first endpoint, so an endpoint
> built from {{[::]:9870}} gives {{HTTP/[0:0:0:0:0:0:0:0]@REALM}}. The
> ResourceManager and other daemons that log in with the host of their bind
> address are affected the same way.
> Treat the IPv6 wildcard address, in any spelling and with or without
> brackets, like {{0.0.0.0}}. Other hosts keep their current behavior.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
