smengcl opened a new pull request, #8812:
URL: https://github.com/apache/hadoop/pull/8812
Generated-by: Claude Code (Opus 5.5)
### Description of PR
`MachineList` parses CIDR entries with commons-net `SubnetUtils`, which
supports IPv4 only. Two things fail as a result:
* An IPv6 CIDR entry such as `2001:db8::/32` makes the `MachineList`
constructor throw `IllegalArgumentException`. A `hadoop.proxyuser.*.hosts`
value or a service level authorization host list with an IPv6 range cannot be
loaded.
* An IPv6 client checked against an existing IPv4 CIDR entry makes
`MachineList.includes(InetAddress)` throw `IllegalArgumentException` instead of
returning false. This affects a dual stack cluster with an unchanged IPv4
configuration.
This PR adds prefix matching for IPv6 CIDR entries and makes the range
lookup aware of the address family.
* IPv4 CIDR entries still use `SubnetUtils`, so their results are unchanged.
* An address never matches a CIDR entry of the other address family. The
lookup returns false and does not throw.
* IPv4 mapped addresses (`::ffff:a.b.c.d`): the JDK returns a mapped client
address as `Inet4Address`, so it matches IPv4 entries only. A mapped CIDR entry
is rejected at construction because it could never match. It should be written
as an IPv4 CIDR.
* An invalid IPv6 CIDR entry is rejected at construction with
`IllegalArgumentException`, as an invalid IPv4 CIDR entry is today. The prefix
length must be a number from 0 to 128.
* A CIDR entry with a scope id (`fe80::%eth0/64`) is rejected. The scope id
of a client address is ignored, as it already is for exact IPv6 entries.
* Exact IPv6 entries (not CIDR) already work and are unchanged.
Behavior change to note: on trunk, an IPv6 client checked against a list
with an IPv4 CIDR entry failed with an exception, which dropped the RPC
connection. Such a client is now evaluated normally. With a blocked host list
(`*.hosts.blocked`) that has only IPv4 ranges, IPv6 clients are no longer
rejected as a side effect. Add IPv6 ranges to the blocked list if they should
be blocked.
Sub-task of HADOOP-11890.
### How was this patch tested?
Added 10 tests to `TestMachineList`:
* IPv6 CIDR includes and excludes, including an entry with host bits set.
* Boundary addresses of `/33` and `/61` prefixes, which do not end on a byte
boundary.
* `/128` and `::/0`.
* IPv4 and IPv6 entries in one list.
* Lookups against CIDR entries of the other address family return false and
do not throw.
* IPv4 mapped client addresses, and a client address with a scope id.
* Invalid IPv6 CIDR entries are rejected (prefix length out of range,
negative or not a number, scope id, IPv4 mapped address, brackets, characters
that are not ASCII).
* IPv4 CIDR edge cases (`/32`, `/31`, `/0`) and exact IPv6 entries, to show
that existing behavior is kept.
On trunk, 8 of the 10 new tests fail with `IllegalArgumentException`. The
other 2 cover behavior that already works (exact IPv6 entries, rejection of
invalid entries).
`mvn test
-Dtest='TestMachineList,TestProxyUsers,TestServiceAuthorization,TestFileBasedIPList'`
in `hadoop-common` with JDK 17: 57 tests run, 0 failures, 0 errors, 0 skipped.
### For code changes:
- [x] Does the title of this PR start with the corresponding JIRA issue id
(e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: Have the integration tests been executed and the
endpoint
declared according to the connector-specific documentation? *Note:
Automated CI
testing doesn't cover all cases so manual testing with cloud storage
is still
required.*
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`,
`NOTICE-binary` files?
### AI Tooling
Contains content generated by Claude Code.
- [x] The PR includes the phrase "Contains content generated by <tool>"
where <tool> is the name of the AI tool used.
- [x] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
