see-quick opened a new pull request, #22883:
URL: https://github.com/apache/kafka/pull/22883
This PR fixes a problem if someone sets up CIDR-based ACLs and an idempotent
producer connects from an IP within the CIDR range, the
`authorizeByResourceType` check would fail to match the CIDR ACL, and the
producer would get `CLUSTER_AUTHORIZATION_FAILED`. It is a narrow edge case but
its bug.
As `Authorizer.java` is in clients (i.e.,
`org.apache.kafka.server.authorizer`), and the `authorizeByResourceType()`
default method there needs to call `CidrUtils.isInRange()`. So CidrUtils must
live in clients too (that's why I moved it from metadata)
`StandardAuthorizerData` in metadata also uses `CidrUtils`, but since
metadata already has implementation project(':clients') in its `build.gradle`,
it just imports it and no extra dependency needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
