[
https://issues.apache.org/jira/browse/HADOOP-20028?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18130265#comment-18130265
]
ASF GitHub Bot commented on HADOOP-20028:
-----------------------------------------
hadoop-yetus commented on PR #8855:
URL: https://github.com/apache/hadoop/pull/8855#issuecomment-6340044130
:confetti_ball: **+1 overall**
| Vote | Subsystem | Runtime | Logfile | Comment |
|:----:|----------:|--------:|:--------:|:-------:|
| +0 :ok: | reexec | 0m 24s | | Docker mode activated. |
|||| _ Prechecks _ |
| +1 :green_heart: | dupname | 0m 0s | | No case conflicting files
found. |
| +0 :ok: | codespell | 0m 1s | | codespell was not available. |
| +0 :ok: | detsecrets | 0m 1s | | detect-secrets was not available.
|
| +1 :green_heart: | @author | 0m 0s | | The patch does not contain
any @author tags. |
| +1 :green_heart: | test4tests | 0m 0s | | The patch appears to
include 1 new or modified test files. |
|||| _ trunk Compile Tests _ |
| +1 :green_heart: | mvninstall | 33m 4s | | trunk passed |
| +1 :green_heart: | compile | 11m 0s | | trunk passed with JDK
Ubuntu-21.0.12.1+1-1-24.04.4-Ubuntu |
| +1 :green_heart: | compile | 11m 5s | | trunk passed with JDK
Ubuntu-17.0.20.1+1-1-24.04-Ubuntu |
| +1 :green_heart: | checkstyle | 0m 55s | | trunk passed |
| +1 :green_heart: | mvnsite | 1m 14s | | trunk passed |
| +1 :green_heart: | javadoc | 0m 53s | | trunk passed with JDK
Ubuntu-21.0.12.1+1-1-24.04.4-Ubuntu |
| +1 :green_heart: | javadoc | 0m 55s | | trunk passed with JDK
Ubuntu-17.0.20.1+1-1-24.04-Ubuntu |
| +1 :green_heart: | spotbugs | 2m 4s | | trunk passed |
| +1 :green_heart: | shadedclient | 22m 50s | | branch has no errors
when building and testing our client artifacts. |
|||| _ Patch Compile Tests _ |
| +1 :green_heart: | mvninstall | 0m 55s | | the patch passed |
| +1 :green_heart: | compile | 9m 20s | | the patch passed with JDK
Ubuntu-21.0.12.1+1-1-24.04.4-Ubuntu |
| +1 :green_heart: | javac | 9m 20s | | the patch passed |
| +1 :green_heart: | compile | 9m 16s | | the patch passed with JDK
Ubuntu-17.0.20.1+1-1-24.04-Ubuntu |
| +1 :green_heart: | javac | 9m 16s | | the patch passed |
| +1 :green_heart: | blanks | 0m 0s | | The patch has no blanks
issues. |
| +1 :green_heart: | checkstyle | 0m 45s | | the patch passed |
| +1 :green_heart: | mvnsite | 1m 9s | | the patch passed |
| +1 :green_heart: | javadoc | 0m 47s | | the patch passed with JDK
Ubuntu-21.0.12.1+1-1-24.04.4-Ubuntu |
| +1 :green_heart: | javadoc | 0m 48s | | the patch passed with JDK
Ubuntu-17.0.20.1+1-1-24.04-Ubuntu |
| +1 :green_heart: | spotbugs | 1m 53s | | the patch passed |
| +1 :green_heart: | shadedclient | 20m 13s | | patch has no errors
when building and testing our client artifacts. |
|||| _ Other Tests _ |
| +1 :green_heart: | unit | 18m 36s | | hadoop-common in the patch
passed. |
| +1 :green_heart: | asflicense | 0m 37s | | The patch does not
generate ASF License warnings. |
| | | 149m 42s | | |
| Subsystem | Report/Notes |
|----------:|:-------------|
| Docker | ClientAPI=1.56 ServerAPI=1.56 base:
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8855/1/artifact/out/Dockerfile
|
| GITHUB PR | https://github.com/apache/hadoop/pull/8855 |
| Optional Tests | dupname asflicense compile javac javadoc mvninstall
mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets |
| uname | Linux 300cdbb6b2c6 5.15.0-190-generic #200-Ubuntu SMP Fri Aug 7
15:06:04 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux |
| Build tool | maven |
| Personality | dev-support/bin/hadoop.sh |
| git revision | trunk / 516caa97e971de8296ef8219d556d92a777e75b8 |
| Default Java | Ubuntu-17.0.20.1+1-1-24.04-Ubuntu |
| Multi-JDK versions |
/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.12.1+1-1-24.04.4-Ubuntu
/usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.20.1+1-1-24.04-Ubuntu |
| Test Results |
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8855/1/testReport/ |
| Max. process+thread count | 1276 (vs. ulimit of 10000) |
| modules | C: hadoop-common-project/hadoop-common U:
hadoop-common-project/hadoop-common |
| Console output |
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8855/1/console |
| versions | git=2.43.0 maven=3.9.15 spotbugs=4.9.7 |
| Powered by | Apache Yetus 0.14.1 https://yetus.apache.org |
This message was automatically generated.
> SecurityUtil.getByName rejects bracketed IPv6 literals when token service
> use_ip is false
> -----------------------------------------------------------------------------------------
>
> Key: HADOOP-20028
> URL: https://issues.apache.org/jira/browse/HADOOP-20028
> Project: Hadoop Common
> Issue Type: Sub-task
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Minor
> Labels: ipv6, pull-request-available
>
> {{SecurityUtil.getByName}} gives different results for a bracketed IPv6
> literal such as {{[2001:db8::1]}} depending on
> {{hadoop.security.token.service.use_ip}}:
> * {{use_ip=true}} (default): {{StandardHostResolver}} calls
> {{InetAddress.getByName}}, which accepts the brackets and returns the address.
> * {{use_ip=false}}: {{QualifiedHostResolver.resolve}} checks
> {{InetAddresses.isInetAddress(host)}}, which is false for the bracketed form.
> The literal then goes down the host name path ({{getByNameWithSearch}},
> {{getByExactName}}), where the JDK rejects names like
> {{[2001:db8::1].example.com.}} as invalid IPv6 literals, and {{resolve}}
> throws {{UnknownHostException}}.
> [SecurityUtil.java:711|https://github.com/apache/hadoop/blob/9ede2e95c6fb577d7ae8664833d5e151cbfc47c9/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java#L711]
> {{URI.getHost()}} returns IPv6 hosts with brackets, so callers that pass it
> on hit this. Examples on trunk:
> * {{DelegationTokenSelector.selectToken}} calls
> {{NetUtils.createSocketAddrForHost(nnUri.getHost(), nnRpcPort)}}. With
> {{use_ip=false}} this returns an unresolved address for
> {{hdfs://[2001:db8::1]:8020}}.
> * {{NetUtils.getCanonicalUri}} passes {{uri.getHost()}} to
> {{canonicalizeHost}}, which leaves the host as is when the lookup fails.
> Failures are not cached, so the lookup is repeated on every call.
> HADOOP-19958 made {{NetUtils.createSocketAddr}} strip the brackets before
> resolving, which covers the most common path. I have not confirmed a
> user-visible failure from the remaining callers; the token service names
> still match in the {{DelegationTokenSelector}} case because
> {{buildTokenService}} normalizes the brackets. The problem is that the two
> resolvers disagree on the same input.
> *Proposed fix:* in {{QualifiedHostResolver.resolve}}, remove one pair of
> surrounding brackets before the {{isInetAddress}} check, so a bracketed
> literal is treated as an IP address in both modes. Add tests for {{[::1]}}
> and {{[2001:db8::1]}} with {{use_ip}} set to true and false.
> POC (part of a larger change):
> https://github.com/smengcl/hadoop/commit/784fc0c2e78017c3eaa3a8012cc2d0a1a6e53d6b
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
