Copilot commented on code in PR #11124:
URL: https://github.com/apache/ozone/pull/11124#discussion_r4022957179
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/VirtualHostStyleFilter.java:
##########
@@ -166,6 +184,37 @@ String checkHostWithoutPort(String host) {
}
}
+ /**
+ * Compares a host with a configured domain by address rather than by
+ * spelling, so that a client writing the gateway's address in a form other
+ * than the configured one still reaches it: ::1 and 0:0:0:0:0:0:0:1 are the
+ * same address, and hexadecimal digits may be in either case. Follows
+ * {@code SCMFailoverProxyProviderBase#sameIpLiteral} in comparing an IPv6
+ * scope as text: {@link java.net.InetAddress#equals} drops it, so
fe80::1%eth0
+ * and fe80::1%eth1 would otherwise be the same interface, and resolving a
+ * scope the gateway host does not have would throw.
+ */
+ private static boolean isSameAddress(String host, String domain) {
+ if (host.equals(domain)) {
+ return true;
+ }
+ String hostIp = stripScope(host);
+ String domainIp = stripScope(domain);
+ return scopeOf(host).equals(scopeOf(domain))
+ && InetAddresses.isInetAddress(hostIp) &&
InetAddresses.isInetAddress(domainIp)
+ &&
InetAddresses.forString(hostIp).equals(InetAddresses.forString(domainIp));
Review Comment:
Requiring textual scope equality rejects valid link-local requests. IPv6
zone identifiers are node-local (the client's interface name need not match the
gateway's), and RFC 9844 requires omitting the zone identifier from an HTTP
`Host` field. Consequently, a configured `fe80::1%eth0` does not match the
standards-compliant `Host: [fe80::1]:9878`; a URI-form `%25eth0` also becomes
scope `25eth0` and fails against `%eth0`. Compare the address bytes after
stripping scopes, and handle/reject a scoped Host separately; add coverage for
both forms.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
