Siyao Meng created HDDS-17728:
---------------------------------
Summary: Bind the secure RPC client to a local address of the
server's address family
Key: HDDS-17728
URL: https://issues.apache.org/jira/browse/HDDS-17728
Project: Apache Ozone
Issue Type: Improvement
Reporter: Siyao Meng
In secure mode, {{org.apache.hadoop.ipc_.Client.Connection#setupConnection}}
binds the client socket to a local address of the host in the caller's Kerberos
principal before it connects. {{NetUtils.getLocalInetAddress(host)}} returns
the first address of that host. On a dual-stack host with the default
{{java.net.preferIPv6Addresses=false}} that is the IPv4 address, so connecting
to a service configured with an IPv6 address fails. The reverse combination
fails the same way. This affects OM to SCM, datanode to SCM, Recon and SCM to
SCM.
HDDS-17195 made {{ipc.client.bind.wildcard.addr=true}} work as a workaround.
The default is {{false}}, so a dual-stack secure cluster with IPv6 service
addresses fails until the operator finds that setting.
h3. Proposal
When not binding to the wildcard, bind to a local address of the principal host
that has the same family as the server address. If the host has no local
address of that family, do not bind, as already happens when the principal host
is not a local address. Nothing changes when the first address already matches.
With {{hadoop.security.authorization}} enabled, the server checks the client
principal against the reverse DNS name of the connection address. The IPv6
address therefore still needs a PTR record that maps to the principal host,
which belongs in the HDDS-15780 docs.
h3. Testing
Unit test the chosen bind address for IPv4 and IPv6 server addresses on a host
with both families, and for a host without an address of the server's family.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
