You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by si...@apache.org on 2026/10/27 20:47:18 UTC
(hadoop) 06/06: HADOOP-20019. Support the IPv6 wildcard address in Kerberos _HOST substitution (#8821)
This is an automated email from the ASF dual-hosted git repository.
smengcl pushed a commit to branch branch-3.4
in repository https://gitbox.apache.org/repos/asf/hadoop.git
commit 56f9ccfd08701488aa5c7d8f664e33f6a0aa6663
Author: Siyao Meng <50...@users.noreply.github.com>
AuthorDate: Sun Oct 18 17:55:53 2026 -0700
HADOOP-20019. Support the IPv6 wildcard address in Kerberos _HOST substitution (#8821)
Co-authored-by: Claude Opus 5.5 <no...@anthropic.com>
(cherry picked from commit 1097744bc490b65cad5ab2fbeafff35687971357)
---
.../java/org/apache/hadoop/security/SecurityUtil.java | 19 ++++++++++++++++---
.../org/apache/hadoop/security/TestSecurityUtil.java | 11 +++++++++++
2 files changed, 27 insertions(+), 3 deletions(-)
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java
index ca2631a4cc5..6a9ee824dac 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java
@@ -172,8 +172,9 @@ protected static boolean isOriginalTGT(KerberosTicket ticket) {
/**
* Convert Kerberos principal name pattern to valid Kerberos principal
* names. It replaces hostname pattern with hostname, which should be
- * fully-qualified domain name. If hostname is null or "0.0.0.0", it uses
- * dynamically looked-up fqdn of the current host instead.
+ * fully-qualified domain name. If hostname is null or a wildcard address
+ * such as "0.0.0.0", "::" or "[::]", it uses dynamically looked-up fqdn of the
+ * current host instead.
*
* @param principalConfig
* the Kerberos principal name conf value to convert
@@ -235,13 +236,25 @@ private static String[] getComponents(String principalConfig) {
private static String replacePattern(String[] components, String hostname)
throws IOException {
String fqdn = hostname;
- if (fqdn == null || fqdn.isEmpty() || fqdn.equals("0.0.0.0")) {
+ if (fqdn == null || fqdn.isEmpty() || isWildcardAddress(fqdn)) {
fqdn = getLocalHostName(null);
}
return components[0] + "/" +
StringUtils.toLowerCase(fqdn) + "@" + components[2];
}
+ /**
+ * Checks whether a host is the IPv4 or IPv6 wildcard address, in any
+ * spelling and with or without the brackets used around IPv6 literals.
+ */
+ private static boolean isWildcardAddress(String host) {
+ String address = host.startsWith("[") && host.endsWith("]")
+ ? host.substring(1, host.length() - 1) : host;
+ // A scoped address is never the wildcard, and parsing it can fail.
+ return address.indexOf('%') < 0 && InetAddresses.isInetAddress(address)
+ && InetAddresses.forString(address).isAnyLocalAddress();
+ }
+
/**
* Retrieve the name of the current host. Multihomed hosts may restrict the
* hostname lookup to a specific interface and nameserver with {@link
diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestSecurityUtil.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestSecurityUtil.java
index 554515ad64b..6713b7d3924 100644
--- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestSecurityUtil.java
+++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestSecurityUtil.java
@@ -129,6 +129,17 @@ public void testLocalHostNameForNullOrWild() throws Exception {
SecurityUtil.getServerPrincipal("hdfs/_HOST@REALM", (String)null));
assertEquals("hdfs/" + local + "@REALM",
SecurityUtil.getServerPrincipal("hdfs/_HOST@REALM", "0.0.0.0"));
+ // The IPv6 wildcard as configured, as InetSocketAddress#getHostName
+ // returns it, and as the host of a URI
+ for (String wildcard : new String[] {"::", "[::]", "0:0:0:0:0:0:0:0", "[0:0:0:0:0:0:0:0]"}) {
+ assertEquals("hdfs/" + local + "@REALM",
+ SecurityUtil.getServerPrincipal("hdfs/_HOST@REALM", wildcard));
+ }
+ // Other IP addresses are not replaced
+ assertEquals("hdfs/2001:db8::1@REALM",
+ SecurityUtil.getServerPrincipal("hdfs/_HOST@REALM", "2001:db8::1"));
+ assertEquals("hdfs/fe80::1%nosuchif@REALM",
+ SecurityUtil.getServerPrincipal("hdfs/_HOST@REALM", "fe80::1%nosuchif"));
}
@Test
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org