smengcl opened a new pull request, #8821:
URL: https://github.com/apache/hadoop/pull/8821
Generated-by: Claude Code (Opus 5.5)
### Description of PR
`SecurityUtil.getServerPrincipal` replaces `_HOST` with the local host name
when the host is null, empty or `0.0.0.0`. The IPv6 wildcard address is not
recognized, so it is copied into the principal.
Daemons that log in with the host of their bind address therefore get an
invalid principal when they bind to the IPv6 wildcard. A JournalNode with
`dfs.journalnode.rpc-address=[::]:8485`, the IPv6 form of the default
`0.0.0.0:8485`, logs in as `jn/0:0:0:0:0:0:0:0@REALM`, because
`InetSocketAddress#getHostName` returns `0:0:0:0:0:0:0:0` for it. `HttpServer2`
takes the SPNEGO host from its first endpoint, so an endpoint built from
`[::]:9870` gives `HTTP/[0:0:0:0:0:0:0:0]@REALM`. The ResourceManager logs in
the same way.
This PR treats the IPv6 wildcard address like `0.0.0.0`, in any spelling and
with or without brackets. The check parses IP literals only, so it never does a
DNS lookup. Host names and other IP addresses are substituted as before. A
scoped IPv6 address is never treated as the wildcard and is not parsed, so it
cannot throw.
Sub-task of HADOOP-11890.
### How was this patch tested?
Extended `TestSecurityUtil#testLocalHostNameForNullOrWild`: `::`, `[::]`,
`0:0:0:0:0:0:0:0` and `[0:0:0:0:0:0:0:0]` are replaced with the local host
name, while `2001:db8::1` and `fe80::1%nosuchif` are kept as is. On trunk the
test fails with `expected: <hdfs/<local host>@REALM> but was: <hdfs/::@REALM>`.
`mvn test -Dtest=TestSecurityUtil` in `hadoop-common` with JDK 17: 26 tests
run, 0 failures, 0 errors, 0 skipped.
Also checked that the host strings derived from a `[::]:8485` bind address
(`InetSocketAddress#getHostName` and the host of the endpoint URI) now give the
same principal as `0.0.0.0:8485`.
### For code changes:
- [x] Does the title of this PR start with the corresponding JIRA issue id
(e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: Have the integration tests been executed and the
endpoint
declared according to the connector-specific documentation? *Note:
Automated CI
testing doesn't cover all cases so manual testing with cloud storage
is still
required.*
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`,
`NOTICE-binary` files?
### AI Tooling
Contains content generated by Claude Code.
- [x] The PR includes the phrase "Contains content generated by <tool>"
where <tool> is the name of the AI tool used.
- [x] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
