lh0156 opened a new pull request, #22942:
URL: https://github.com/apache/kafka/pull/22942

   ## Summary
   
   - Avoid reverse DNS lookups when Kafka creates non-GSSAPI SASL client and 
server authenticators.
   - Preserve the existing hostname path for GSSAPI so Kerberos 
service-principal resolution is unchanged.
   - Add regression coverage for both client and server server-name selection.
   
   ## Motivation
   
   Fixes [KAFKA-20766](https://issues.apache.org/jira/browse/KAFKA-20766).
   
   `SaslServerAuthenticator` used `InetAddress.getHostName()` while creating 
the SASL server, and `SaslChannelBuilder` did the same for client 
authenticators. A slow or unavailable PTR lookup can block SASL channel 
authentication and, on the broker side, delay connection acceptance.
   
   Non-GSSAPI paths now use the numeric address, keeping client and server 
values symmetric for custom SASL mechanisms such as DIGEST-MD5. GSSAPI retains 
the hostname because Kerberos service-principal resolution depends on it.
   
   ## Validation
   
   - Added unit tests that verify non-GSSAPI clients use the numeric address 
and GSSAPI clients retain the hostname.
   - Added a regression test that verifies non-Kerberos servers pass the 
numeric address to `Sasl.createSaslServer`.
   - Ran the affected SASL integration tests, including custom mechanism 
pluggability and multi-mechanism reauthentication.
   - Ran `./gradlew :clients:test --no-build-cache --console=plain` 
successfully.
   - Ran `git diff --check` successfully.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to