Siyao Meng created HADOOP-20073:
-----------------------------------
Summary: Bind the secure RPC client to a local address of the
server's address family
Key: HADOOP-20073
URL: https://issues.apache.org/jira/browse/HADOOP-20073
Project: Hadoop Common
Issue Type: Sub-task
Components: ipc
Reporter: Siyao Meng
In secure mode, {{Client.Connection#setupConnection}} binds the client socket
to a local address of the host in the caller's Kerberos principal before it
connects, unless {{ipc.client.bind.wildcard.addr=true}}.
{{NetUtils.getLocalInetAddress(host)}} returns the first address of that host.
On a dual-stack host with the default {{java.net.preferIPv6Addresses=false}}
that is the IPv4 address, so connecting to a service configured with an IPv6
address fails. The reverse combination fails the same way.
{{ipc.client.bind.wildcard.addr=true}} (HADOOP-15250) works around it, but the
default is {{false}}, so a dual-stack secure cluster with IPv6 service
addresses fails until the operator finds that setting.
h3. Proposal
When not binding to the wildcard, bind to a local address of the principal host
that has the same family as the server address. If the host has no local
address of that family, do not bind, as already happens when the principal host
is not a local address. Nothing changes when the first address already matches,
which covers IPv4-only and IPv6-only clusters.
With {{hadoop.security.authorization}} enabled, the server checks the client
principal against the reverse DNS name of the connection address, so the IPv6
address still needs a PTR record that maps to the principal host.
Apache Ozone carries its own copy of this client and fixes it the same way in
HDDS-17728 ([apache/ozone#11970|https://github.com/apache/ozone/pull/11970]).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
