核心代码在
hadoop-trunk\hadoop-common-project\hadoop-common\src\main\java\org\apache\hadoop\security
hadoop-main--->hadoop-project--->hadoop-project-dist--->hadoop-common 3.4.0-SNAPSHOT
org.apache.hadoop.security.SecurityUtil#getServerPrincipal(java.lang.String, java.lang.String)
IDEA Ctrl+N找不到某个类的时候,可以试试Ctrl+Shfit+N,项目加载可能会有小问题
@InterfaceAudience.Public @InterfaceStability.Evolving public static String getServerPrincipal(String principalConfig, String hostname) throws IOException { String[] components = principalConfig.split("[/@]") if (components == null || components.length != 3 || !components[1].equals(HOSTNAME_PATTERN)) { return principalConfig; } else { return replacePattern(components, hostname); } }
还有一个重载的方法
@InterfaceAudience.Public @InterfaceStability.Evolving public static String getServerPrincipal(String principalConfig, InetAddress addr) throws IOException { String[] components = getComponents(principalConfig); if (components == null || components.length != 3 || !components[1].equals(HOSTNAME_PATTERN)) { return principalConfig; } else { if (addr == null) { throw new IOException("Can't replace " + HOSTNAME_PATTERN + " pattern since client address is null"); } return replacePattern(components, domainNameResolver.getHostnameByIP(addr)); } }
重点关注 domainNameResolver.getHostnameByIP
org.apache.hadoop.net.DomainNameResolver domainNameResolver = DomainNameResolverFactory.newInstance(conf, CommonConfigurationKeys.HADOOP_SECURITY_RESOLVER_IMPL);
有一个配置项 hadoop.security.resolver.impl 默认是 org.apache.hadoop.net.DNSDomainNameResolver
The resolver implementation used to resolve FQDN for Kerberos |
反向解析dns的逻辑 根据ip获取域名
@Override
public String getHostnameByIP(InetAddress address) {
String host = address.getCanonicalHostName();
if (host != null && host.length() != 0
&& host.charAt(host.length()-1) == '.') {
host = host.substring(0, host.length()-1);
}
// Protect against the Java behaviour of returning the IP address as a string from a cache
// instead of performing a reverse lookup.
//防止Java行为,即从缓存中返回IP地址的字符串形式, 而不是执行反向DNS查找。
解释
这行注释意味着在处理IP地址时,Java程序可能会直接从缓存中返回IP地址的字符串表示,而不是进行反向DNS查找来获取与该IP地址关联的域名。这可能是因为反向查找可能比较慢,而直接从缓存中读取可以提高性能。然而,在某些情况下,直接使用IP地址可能不满足需求,比如需要知道具体的域名时。因此,这行注释提醒开发者要注意这种行为,并根据具体场景决定是否需要进行反向DNS查找。
此处涉及缓存(即 修改/etc/hosts 需要重启进程的现象)
if (host != null && host.equals(address.getHostAddress())) {
LOG.debug("IP address returned for FQDN detected: {}", address.getHostAddress());
try {
return DNS.reverseDns(address, null);
} catch (NamingException lookupFailure) {
LOG.warn("Failed to perform reverse lookup: {}", address);
}
}
return host;
}