Skip to content

HDDS-9894. IP address checks neglect disabling some IPv6 addresses that are disabled for IPv4#10687

Draft
smengcl wants to merge 3 commits into
apache:masterfrom
smengcl:worktree-HDDS-9894
Draft

HDDS-9894. IP address checks neglect disabling some IPv6 addresses that are disabled for IPv4#10687
smengcl wants to merge 3 commits into
apache:masterfrom
smengcl:worktree-HDDS-9894

Conversation

@smengcl

@smengcl smengcl commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Generated-by: Claude Code (Opus 4.8)

What changes were proposed in this pull request?

HddsServerUtil#getValidInetsForCurrentHost() excluded IPv4 wildcard/loopback
(0.0.0.0, 127.0.0.1) from certificate SANs via a fixed string set, but missed
the IPv6 equivalents (::, ::1), which then leaked into SANs.

Replaced the string match with the semantic isAnyLocalAddress() /
isLoopbackAddress() predicates (covering both families) in a new testable helper
isValidInetForCsr(InetAddress); removed the unused INVALID_IPS set.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-9894

How was this patch tested?

  • Added unit tests coverage in TestHddsServerUtils

@smengcl smengcl requested review from Copilot and fapifta July 8, 2026 01:07
@smengcl smengcl added the bug Something isn't working label Jul 8, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes an address-filtering gap in HddsServerUtil#getValidInetsForCurrentHost() where IPv6 wildcard/loopback addresses (::, ::1) could be included in certificate SANs even though the IPv4 equivalents were excluded, by switching from string-based filtering to semantic InetAddress predicates.

Changes:

  • Replaced fixed-string invalid IP filtering with a semantic helper isValidInetForCsr(InetAddress) using isAnyLocalAddress() / isLoopbackAddress(), plus existing IPv6 scoped/prefix exclusion.
  • Removed the unused INVALID_IPS set and centralized the CSR eligibility logic in the helper.
  • Added unit tests validating exclusion of IPv4/IPv6 wildcard and loopback addresses, and inclusion of representative routable addresses.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
hadoop-hdds/server-scm/src/test/java/org/apache/hadoop/hdds/scm/TestHddsServerUtils.java Adds unit tests covering IPv4/IPv6 wildcard + loopback exclusion and routable address inclusion for CSR SAN eligibility.
hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/utils/HddsServerUtil.java Introduces isValidInetForCsr(InetAddress) and updates interface enumeration to use semantic address predicates, ensuring IPv6 equivalents are filtered consistently.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants