atharvaHJoshi opened a new pull request, #23776: URL: https://github.com/apache/kafka/pull/23776
`SaslServerAuthenticator#createSaslServer` used `serverAddress().getHostName()` for non-GSSAPI mechanisms. When a listener is bound to an IP literal, `InetAddress#getHostName` performs a reverse (PTR) DNS lookup on the broker's acceptor thread. With a slow or broken resolver this blocks for seconds per connection, producing a SYN backlog / listen-queue overflow and intermittent client connection failures (KAFKA-20766). This change uses the local `InetSocketAddress#getHostString()` instead, which returns the configured host name when available and the textual IP address otherwise, and never performs a reverse lookup. This mirrors the approach adopted for KAFKA-3352. ### Testing - Added `SaslServerAuthenticatorTest#testCreateSaslServerAvoidsReverseDnsLookup`, which stubs the local socket address so that `getHostName()` throws and verifies the SASL server is created from `getHostString()`. - Updated `mockTransportLayer()` to provide a local socket address. - `./gradlew :clients:test --tests org.apache.kafka.common.security.authenticator.SaslServerAuthenticatorTest`, plus `:clients:spotlessCheck`, `:clients:checkstyleMain` and `:clients:checkstyleTest` pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
