[smengcl]

Generated-by: Codex (GPT-5.6 Sol)

Description of PR

Jira: HADOOP-19958

Parent Jira: HADOOP-11890

Delegation token services use host:port. This representation is ambiguous when the host is an IPv6 literal.

This change:

• adds a shared NetUtils helper that formats IPv6 addresses as [host]:port;
• accepts bracketed IPv6 authorities when creating socket addresses;
• uses the shared format for delegation token services in both token-service modes;
• verifies token service round trips when hadoop.security.token.service.use_ip is true or false;
• rejects ambiguous unbracketed IPv6 authorities; and
• preserves existing DNS and IPv4 behavior.

How was this patch tested?

• JAVA_HOME=<JDK17> mvn -B -pl :hadoop-common -Dtest=TestNetUtils,TestSecurityUtil test --no-transfer-progress
• Result: 76 tests passed with no failures, errors, or skips.
• git diff --check asf/trunk...HEAD

For code changes:

• Does the title of this PR start with the corresponding JIRA issue id
  (e.g. 'HADOOP-17799. Your PR title ...')?
• Object storage: Have the integration tests been executed and the endpoint
  declared according to the connector-specific documentation? Note: Automated CI
  testing doesn't cover all cases so manual testing with cloud storage is still
  required. Not applicable to this change.
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion
  under ASF 2.0? No new dependencies are added.
• If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?
  No license or notice changes are required.

AI Tooling

Contains content generated by Codex.

If an AI tool was used:

• The PR includes the phrase "Contains content generated by "
  where is the name of the AI tool used.
• My use of AI contributions follows the ASF legal policy
  https://www.apache.org/legal/generative-tooling.html

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 0s		Docker mode activated.
-1 ❌	patch	0m 21s		#8669 does not apply to trunk. Rebase required? Wrong Branch? See https://cwiki.apache.org/confluence/display/HADOOP/How+To+Contribute for help.

Subsystem	Report/Notes
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8669/1/console
versions	git=2.34.1
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

[Copilot]

Pull request overview

This PR addresses ambiguity in delegation token service identifiers when the host is an IPv6 literal by introducing a consistent bracketed "[host]:port" representation and ensuring socket address creation accepts bracketed IPv6 authorities.

Changes:

• Add NetUtils.getHostPortString(host, port) to format host:port while bracketing IPv6 literals.
• Update delegation token service string construction to use the shared host/port formatter.
• Add tests covering IPv6 host/port formatting, bracketed IPv6 socket address parsing, and delegation token service round-trips.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestSecurityUtil.java	Updates token-service string expectations and adds an IPv6 token service round-trip test.
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/net/TestNetUtils.java	Adds tests for IPv6 host/port formatting, bracketed parsing, and rejection of ambiguous unbracketed IPv6 authorities.
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java	Uses the shared host/port formatter when building token service identifiers.
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/net/NetUtils.java	Adds IPv6-aware host/port formatting and strips brackets from parsed URI hosts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jojochuang]

Review of the rebased branch — inline comments on specific areas.

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	1m 0s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 1s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
+1 💚	test4tests	0m 0s		The patch appears to include 2 new or modified test files.
			_ trunk Compile Tests _
+1 💚	mvninstall	41m 25s		trunk passed
+1 💚	compile	16m 25s		trunk passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	compile	16m 31s		trunk passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	checkstyle	1m 30s		trunk passed
+1 💚	mvnsite	1m 58s		trunk passed
+1 💚	javadoc	1m 30s		trunk passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javadoc	1m 22s		trunk passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	spotbugs	3m 8s		trunk passed
+1 💚	shadedclient	30m 59s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	mvninstall	1m 16s		the patch passed
+1 💚	compile	15m 19s		the patch passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javac	15m 19s		the patch passed
+1 💚	compile	16m 20s		the patch passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	javac	16m 20s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	1m 29s		the patch passed
+1 💚	mvnsite	2m 1s		the patch passed
+1 💚	javadoc	1m 28s		the patch passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javadoc	1m 26s		the patch passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	spotbugs	3m 20s		the patch passed
+1 💚	shadedclient	31m 3s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	23m 29s		hadoop-common in the patch passed.
-1 ❌	asflicense	1m 15s	/results-asflicense.txt	The patch generated 1 ASF License warnings.
		215m 38s

Subsystem	Report/Notes
Docker	ClientAPI=1.55 ServerAPI=1.55 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8669/3/artifact/out/Dockerfile
GITHUB PR	#8669
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets
uname	Linux e1872fb777e8 5.15.0-181-generic #191-Ubuntu SMP Fri May 22 19:09:02 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / 52966be
Default Java	Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.11+10-1-24.04.2-Ubuntu /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8669/3/testReport/
Max. process+thread count	1279 (vs. ulimit of 10000)
modules	C: hadoop-common-project/hadoop-common U: hadoop-common-project/hadoop-common
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8669/3/console
versions	git=2.43.0 maven=3.9.15 spotbugs=4.9.7
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 0s		Docker mode activated.
-1 ❌	patch	0m 19s		#8669 does not apply to trunk. Rebase required? Wrong Branch? See https://cwiki.apache.org/confluence/display/HADOOP/How+To+Contribute for help.

Subsystem	Report/Notes
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8669/4/console
versions	git=2.34.1
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 0s		Docker mode activated.
-1 ❌	patch	0m 25s		#8669 does not apply to trunk. Rebase required? Wrong Branch? See https://cwiki.apache.org/confluence/display/HADOOP/How+To+Contribute for help.

Subsystem	Report/Notes
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8669/5/console
versions	git=2.34.1
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

[jojochuang]

+11