[
https://issues.apache.org/jira/browse/HDDS-17728?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated HDDS-17728:
----------------------------------
Labels: pull-request-available (was: )
> Bind the secure RPC client to a local address of the server's address family
> ----------------------------------------------------------------------------
>
> Key: HDDS-17728
> URL: https://issues.apache.org/jira/browse/HDDS-17728
> Project: Apache Ozone
> Issue Type: Improvement
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> In secure mode, {{org.apache.hadoop.ipc_.Client.Connection#setupConnection}}
> binds the client socket to a local address of the host in the caller's
> Kerberos principal before it connects. {{NetUtils.getLocalInetAddress(host)}}
> returns the first address of that host. On a dual-stack host with the default
> {{java.net.preferIPv6Addresses=false}} that is the IPv4 address, so
> connecting to a service configured with an IPv6 address fails. The reverse
> combination fails the same way. This affects OM to SCM, datanode to SCM,
> Recon and SCM to SCM.
> HDDS-17195 made {{ipc.client.bind.wildcard.addr=true}} work as a workaround.
> The default is {{false}}, so a dual-stack secure cluster with IPv6 service
> addresses fails until the operator finds that setting.
> h3. Proposal
> When not binding to the wildcard, bind to a local address of the principal
> host that has the same family as the server address. If the host has no local
> address of that family, do not bind, as already happens when the principal
> host is not a local address. Nothing changes when the first address already
> matches.
> With {{hadoop.security.authorization}} enabled, the server checks the client
> principal against the reverse DNS name of the connection address. The IPv6
> address therefore still needs a PTR record that maps to the principal host,
> which belongs in the HDDS-15780 docs.
> h3. Testing
> Unit test the chosen bind address for IPv4 and IPv6 server addresses on a
> host with both families, and for a host without an address of the server's
> family.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
