[
https://issues.apache.org/jira/browse/HADOOP-19962?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126128#comment-18126128
]
ASF GitHub Bot commented on HADOOP-19962:
-----------------------------------------
smengcl opened a new pull request, #8812:
URL: https://github.com/apache/hadoop/pull/8812
Generated-by: Claude Code (Opus 5.5)
### Description of PR
`MachineList` parses CIDR entries with commons-net `SubnetUtils`, which
supports IPv4 only. Two things fail as a result:
* An IPv6 CIDR entry such as `2001:db8::/32` makes the `MachineList`
constructor throw `IllegalArgumentException`. A `hadoop.proxyuser.*.hosts`
value or a service level authorization host list with an IPv6 range cannot be
loaded.
* An IPv6 client checked against an existing IPv4 CIDR entry makes
`MachineList.includes(InetAddress)` throw `IllegalArgumentException` instead of
returning false. This affects a dual stack cluster with an unchanged IPv4
configuration.
This PR adds prefix matching for IPv6 CIDR entries and makes the range
lookup aware of the address family.
* IPv4 CIDR entries still use `SubnetUtils`, so their results are unchanged.
* An address never matches a CIDR entry of the other address family. The
lookup returns false and does not throw.
* IPv4 mapped addresses (`::ffff:a.b.c.d`): the JDK returns a mapped client
address as `Inet4Address`, so it matches IPv4 entries only. A mapped CIDR entry
is rejected at construction because it could never match. It should be written
as an IPv4 CIDR.
* An invalid IPv6 CIDR entry is rejected at construction with
`IllegalArgumentException`, as an invalid IPv4 CIDR entry is today. The prefix
length must be a number from 0 to 128.
* A CIDR entry with a scope id (`fe80::%eth0/64`) is rejected. The scope id
of a client address is ignored, as it already is for exact IPv6 entries.
* Exact IPv6 entries (not CIDR) already work and are unchanged.
Behavior change to note: on trunk, an IPv6 client checked against a list
with an IPv4 CIDR entry failed with an exception, which dropped the RPC
connection. Such a client is now evaluated normally. With a blocked host list
(`*.hosts.blocked`) that has only IPv4 ranges, IPv6 clients are no longer
rejected as a side effect. Add IPv6 ranges to the blocked list if they should
be blocked.
Sub-task of HADOOP-11890.
### How was this patch tested?
Added 10 tests to `TestMachineList`:
* IPv6 CIDR includes and excludes, including an entry with host bits set.
* Boundary addresses of `/33` and `/61` prefixes, which do not end on a byte
boundary.
* `/128` and `::/0`.
* IPv4 and IPv6 entries in one list.
* Lookups against CIDR entries of the other address family return false and
do not throw.
* IPv4 mapped client addresses, and a client address with a scope id.
* Invalid IPv6 CIDR entries are rejected (prefix length out of range,
negative or not a number, scope id, IPv4 mapped address, brackets, characters
that are not ASCII).
* IPv4 CIDR edge cases (`/32`, `/31`, `/0`) and exact IPv6 entries, to show
that existing behavior is kept.
On trunk, 8 of the 10 new tests fail with `IllegalArgumentException`. The
other 2 cover behavior that already works (exact IPv6 entries, rejection of
invalid entries).
`mvn test
-Dtest='TestMachineList,TestProxyUsers,TestServiceAuthorization,TestFileBasedIPList'`
in `hadoop-common` with JDK 17: 57 tests run, 0 failures, 0 errors, 0 skipped.
### For code changes:
- [x] Does the title of this PR start with the corresponding JIRA issue id
(e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: Have the integration tests been executed and the
endpoint
declared according to the connector-specific documentation? *Note:
Automated CI
testing doesn't cover all cases so manual testing with cloud storage
is still
required.*
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`,
`NOTICE-binary` files?
### AI Tooling
Contains content generated by Claude Code.
- [x] The PR includes the phrase "Contains content generated by <tool>"
where <tool> is the name of the AI tool used.
- [x] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
🤖 Generated with [Claude Code](https://claude.com/claude-code)
> Support IPv6 CIDR rules in MachineList
> --------------------------------------
>
> Key: HADOOP-19962
> URL: https://issues.apache.org/jira/browse/HADOOP-19962
> Project: Hadoop Common
> Issue Type: Sub-task
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
>
> MachineList uses the IPv4-only SubnetUtils class. IPv6 CIDR rules therefore
> fail in address-based security policies. Add family-aware prefix matching for
> IPv4 and IPv6. Preserve existing IPv4 behavior. Reject invalid prefixes and
> addresses from the wrong family.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
