lh0156 opened a new pull request, #22942: URL: https://github.com/apache/kafka/pull/22942
## Summary - Avoid reverse DNS lookups when Kafka creates non-GSSAPI SASL client and server authenticators. - Preserve the existing hostname path for GSSAPI so Kerberos service-principal resolution is unchanged. - Add regression coverage for both client and server server-name selection. ## Motivation Fixes [KAFKA-20766](https://issues.apache.org/jira/browse/KAFKA-20766). `SaslServerAuthenticator` used `InetAddress.getHostName()` while creating the SASL server, and `SaslChannelBuilder` did the same for client authenticators. A slow or unavailable PTR lookup can block SASL channel authentication and, on the broker side, delay connection acceptance. Non-GSSAPI paths now use the numeric address, keeping client and server values symmetric for custom SASL mechanisms such as DIGEST-MD5. GSSAPI retains the hostname because Kerberos service-principal resolution depends on it. ## Validation - Added unit tests that verify non-GSSAPI clients use the numeric address and GSSAPI clients retain the hostname. - Added a regression test that verifies non-Kerberos servers pass the numeric address to `Sasl.createSaslServer`. - Ran the affected SASL integration tests, including custom mechanism pluggability and multi-mechanism reauthentication. - Ran `./gradlew :clients:test --no-build-cache --console=plain` successfully. - Ran `git diff --check` successfully. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
