[
https://issues.apache.org/jira/browse/HADOOP-20019?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127007#comment-18127007
]
ASF GitHub Bot commented on HADOOP-20019:
-----------------------------------------
Copilot commented on code in PR #8821:
URL: https://github.com/apache/hadoop/pull/8821#discussion_r4269067634
##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java:
##########
@@ -243,13 +244,25 @@ private static String[] getComponents(String
principalConfig) {
private static String replacePattern(String[] components, String hostname)
throws IOException {
String fqdn = hostname;
- if (fqdn == null || fqdn.isEmpty() || fqdn.equals("0.0.0.0")) {
+ if (fqdn == null || fqdn.isEmpty() || isWildcardAddress(fqdn)) {
fqdn = getLocalHostName(null);
}
return components[0] + "/" +
StringUtils.toLowerCase(fqdn) + "@" + components[2];
}
+ /**
+ * Checks whether a host is the IPv4 or IPv6 wildcard address, in any
+ * spelling and with or without the brackets used around IPv6 literals.
+ */
+ private static boolean isWildcardAddress(String host) {
+ String address = host.startsWith("[") && host.endsWith("]")
+ ? host.substring(1, host.length() - 1) : host;
+ // A scoped address is never the wildcard, and parsing it can fail.
+ return address.indexOf('%') < 0 && InetAddresses.isInetAddress(address)
+ && InetAddresses.forString(address).isAnyLocalAddress();
Review Comment:
`InetAddresses.isInetAddress(address)` and
`InetAddresses.forString(address)` both parse/validate the literal, which is
redundant. Consider parsing once (after the '%' check) and then calling
`isAnyLocalAddress()` on the parsed `InetAddress`, or otherwise avoiding double
parsing to reduce overhead and keep the logic simpler.
##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java:
##########
@@ -180,8 +180,9 @@ protected static boolean isOriginalTGT(KerberosTicket
ticket) {
/**
* Convert Kerberos principal name pattern to valid Kerberos principal
* names. It replaces hostname pattern with hostname, which should be
- * fully-qualified domain name. If hostname is null or "0.0.0.0", it uses
- * dynamically looked-up fqdn of the current host instead.
+ * fully-qualified domain name. If hostname is null or a wildcard address
+ * such as "0.0.0.0" or "::", it uses dynamically looked-up fqdn of the
+ * current host instead.
Review Comment:
The updated Javadoc mentions `"::"` but not the bracketed wildcard form
(`"[::]"`) that is explicitly supported (and tested). Consider explicitly
mentioning bracketed IPv6 literals too, since this method can receive host
strings from configurations/URIs that include brackets.
> Support the IPv6 wildcard address in Kerberos _HOST substitution
> ----------------------------------------------------------------
>
> Key: HADOOP-20019
> URL: https://issues.apache.org/jira/browse/HADOOP-20019
> Project: Hadoop Common
> Issue Type: Sub-task
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> {{SecurityUtil.getServerPrincipal}} replaces {{_HOST}} with the local host
> name when the host is null, empty or {{0.0.0.0}}. The IPv6 wildcard address
> is not recognized, so it is copied into the principal.
> A daemon that logs in with the host of its bind address therefore gets an
> invalid principal when it binds to the IPv6 wildcard. For example, a
> JournalNode with {{dfs.journalnode.rpc-address=[::]:8485}}, the IPv6 form of
> the default {{0.0.0.0:8485}}, logs in as {{jn/0:0:0:0:0:0:0:0@REALM}}.
> {{HttpServer2}} takes the SPNEGO host from its first endpoint, so an endpoint
> built from {{[::]:9870}} gives {{HTTP/[0:0:0:0:0:0:0:0]@REALM}}. The
> ResourceManager and other daemons that log in with the host of their bind
> address are affected the same way.
> Treat the IPv6 wildcard address, in any spelling and with or without
> brackets, like {{0.0.0.0}}. Other hosts keep their current behavior.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
