HDDS-16140. Qualify S3 Gateway path-style access over IPv6 - #11124
Draft
rjgoyln wants to merge 2 commits into
Draft
HDDS-16140. Qualify S3 Gateway path-style access over IPv6#11124rjgoyln wants to merge 2 commits into
rjgoyln wants to merge 2 commits into
Conversation
A client that reaches the gateway over an IPv6 address has to use path style access, because virtual host style is not available on an address literal. That traffic was never qualified, and the Host header was matched against the configured domain in two ways that only make sense for a DNS name: by suffix, so any address ending with the configured domain was taken apart as if its leading segments were a bucket name, and as text, so a client spelling the address differently from the operator did not reach the gateway at all. The rest of the qualification listed in the JIRA (HTTPS endpoint verification, proxy forwarding, and virtual host style through a DNS name with an AAAA record) needs a gateway that actually listens on an IPv6 address, which is blocked by HDDS-15778.
rjgoyln
marked this pull request as draft
August 26, 2026 15:15
…ddress Guava reports a scoped literal as a valid address but resolves the scope to a local interface when it parses one, so a Host header naming an interface the gateway host does not have escaped the filter as an IllegalArgumentException and reached the client as an internal error. Nothing about deciding whether a request is addressed to this gateway needs the interface, and InetAddress equality drops the scope anyway, which would make two interfaces one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
A client reaching the S3 Gateway over an IPv6 address has to use path style access, since virtual host style is not available on an address literal.
VirtualHostStyleFiltermatched such a Host header the way it matches a DNS name — by suffix, and as text — and neither holds for an address: withozone.s3g.domain.nameset to[::1],Host: [2001:db8::1]:9878was rejected as a malformed request for a bucket named2001:db8, while the gateway's own address in another spelling matched nothing at all. An IPv6 literal is now compared as an address against the whole host; DNS and IPv4 matching is unchanged.The tests add the qualification this JIRA asks for that does not need an IPv6 listener: path style Host headers with and without a port, equivalent and foreign addresses, and a SigV4 string to sign carrying the bracketed Host through unchanged.
The rest — HTTPS endpoint verification, proxy forwarding, and virtual host style through a DNS name with an AAAA record — needs a gateway that listens on an IPv6 address, which
BaseHttpServer.getBindAddresscannot do: it joins host and port ashost + ":" + port, so[::1]:9878becomes::1:9878andNetUtils.createSocketAddrrejects it.I plan to take that on as HDDS-15778 and finish this qualification once it lands, so HDDS-16140 stays open. Requiring brackets on IPv6 Host values is left out too: an unbracketed value is already rejected unless it names the gateway, and enforcing it belongs with the parsing helper HDDS-15776 added.
What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-16140
How was this patch tested?
mvn -pl :ozone-s3gateway test checkstyle:check: 771 tests pass, checkstyle clean. Each new filter case fails without the change.Generated-by: Claude Code (Opus 5)