You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "see-quick (via GitHub)" <gi...@apache.org> on 2026/07/20 14:58:27 UTC
[PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
see-quick opened a new pull request, #22883:
URL: https://github.com/apache/kafka/pull/22883
This PR fixes a problem if someone sets up CIDR-based ACLs and an idempotent producer connects from an IP within the CIDR range, the `authorizeByResourceType` check would fail to match the CIDR ACL, and the producer would get `CLUSTER_AUTHORIZATION_FAILED`. It is a narrow edge case but its bug.
As `Authorizer.java` is in clients (i.e., `org.apache.kafka.server.authorizer`), and the `authorizeByResourceType()` default method there needs to call `CidrUtils.isInRange()`. So CidrUtils must live in clients too (that's why I moved it from metadata)
`StandardAuthorizerData` in metadata also uses `CidrUtils`, but since metadata already has implementation project(':clients') in its `build.gradle`, it just imports it and no extra dependency needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "see-quick (via GitHub)" <gi...@apache.org>.
see-quick commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3719086787
##########
build.gradle:
##########
@@ -1996,6 +1992,10 @@ project(':clients') {
implementation libs.opentelemetryProto
implementation libs.protobuf
implementation libs.slf4jApi
+ // commons-io is a transitive dependency not needed by SubnetUtils/SubnetUtils6
Review Comment:
Okay, I have added and checked the shaded jar. All related packages from `commons-net` should be there:
```
relocate('org.apache.commons.net', 'org.apache.kafka.shaded.org.apache.commons.net')
```
Let me know if I need to do more.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "see-quick (via GitHub)" <gi...@apache.org>.
see-quick commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3620825130
##########
clients/src/main/java/org/apache/kafka/server/authorizer/CidrUtils.java:
##########
@@ -15,11 +15,14 @@
* limitations under the License.
*/
-package org.apache.kafka.metadata.authorizer;
+package org.apache.kafka.server.authorizer;
+
+import org.apache.kafka.common.annotation.InterfaceAudience;
import org.apache.commons.net.util.SubnetUtils;
import org.apache.commons.net.util.SubnetUtils6;
+@InterfaceAudience.Public
Review Comment:
There was build issues when I marked it to `@InterfaceAudience.Private` or not marking class at all, but thinking about this again I think we can move it to `org.apache.kafka.server.authorizer.internals` package to prevent those build issues and also not marking it as public API. WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3712668523
##########
build.gradle:
##########
@@ -1996,6 +1992,10 @@ project(':clients') {
implementation libs.opentelemetryProto
implementation libs.protobuf
implementation libs.slf4jApi
+ // commons-io is a transitive dependency not needed by SubnetUtils/SubnetUtils6
Review Comment:
@omkreddy What do you think?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3621212994
##########
clients/src/main/java/org/apache/kafka/server/authorizer/CidrUtils.java:
##########
@@ -15,11 +15,14 @@
* limitations under the License.
*/
-package org.apache.kafka.metadata.authorizer;
+package org.apache.kafka.server.authorizer;
+
+import org.apache.kafka.common.annotation.InterfaceAudience;
import org.apache.commons.net.util.SubnetUtils;
import org.apache.commons.net.util.SubnetUtils6;
+@InterfaceAudience.Public
Review Comment:
I'm not familiar with the `InterfaceAudience` behavior yet, but I'm pretty sure we don't want `CidrUtils` to be part of the public API, so we need to find a way to remove this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison merged PR #22883:
URL: https://github.com/apache/kafka/pull/22883
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "see-quick (via GitHub)" <gi...@apache.org>.
see-quick commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3628509878
##########
clients/src/main/java/org/apache/kafka/server/authorizer/internals/CidrUtils.java:
##########
@@ -60,4 +60,4 @@ public static boolean isInRange(String host, String cidrPattern) {
return false;
}
}
-}
+}
Review Comment:
note for me: add line here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "omkreddy (via GitHub)" <gi...@apache.org>.
omkreddy commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3713165067
##########
build.gradle:
##########
@@ -1996,6 +1992,10 @@ project(':clients') {
implementation libs.opentelemetryProto
implementation libs.protobuf
implementation libs.slf4jApi
+ // commons-io is a transitive dependency not needed by SubnetUtils/SubnetUtils6
Review Comment:
@mimaison Yes, I agree. If the client library depends on it, we should include the the shaded jar.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "see-quick (via GitHub)" <gi...@apache.org>.
see-quick commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3628516623
##########
clients/src/main/java/org/apache/kafka/server/authorizer/CidrUtils.java:
##########
@@ -15,11 +15,14 @@
* limitations under the License.
*/
-package org.apache.kafka.metadata.authorizer;
+package org.apache.kafka.server.authorizer;
+
+import org.apache.kafka.common.annotation.InterfaceAudience;
import org.apache.commons.net.util.SubnetUtils;
import org.apache.commons.net.util.SubnetUtils6;
+@InterfaceAudience.Public
Review Comment:
I moved CidrUtils to `org.apache.kafka.server.authorizer.internals` and removed `InterfaceAudience.Public` annotation seems to work fine.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3620501332
##########
clients/src/main/java/org/apache/kafka/server/authorizer/CidrUtils.java:
##########
@@ -15,11 +15,14 @@
* limitations under the License.
*/
-package org.apache.kafka.metadata.authorizer;
+package org.apache.kafka.server.authorizer;
+
+import org.apache.kafka.common.annotation.InterfaceAudience;
import org.apache.commons.net.util.SubnetUtils;
import org.apache.commons.net.util.SubnetUtils6;
+@InterfaceAudience.Public
Review Comment:
Why are we marking this as public API?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20816: Add support for CIDR into Authorizer.authorizeByResourceType [kafka]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on code in PR #22883:
URL: https://github.com/apache/kafka/pull/22883#discussion_r3656222263
##########
build.gradle:
##########
@@ -1996,6 +1992,10 @@ project(':clients') {
implementation libs.opentelemetryProto
implementation libs.protobuf
implementation libs.slf4jApi
+ // commons-io is a transitive dependency not needed by SubnetUtils/SubnetUtils6
Review Comment:
Unfortunately this adds a server-only dependency to the clients module. I wonder if it should be shadowed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org