[smengcl]

Generated-by: Claude Code (Opus 5.5), Codex (GPT-6)

What changes were proposed in this pull request?

Ozone carries its own copy of the Hadoop RPC client (org.apache.hadoop.ipc_.Client). In secure mode, when the protocol has @KerberosInfo, Connection.setupConnection binds the client socket to the local address of the host in the caller's Kerberos principal before connecting.

Hadoop lets operators turn that off with ipc.client.bind.wildcard.addr=true. Ozone's copy reads the flag into bindToWildCardAddress and computes bindTo, but then binds to localAddr anyway, so the flag has no effect.

On a dual stack host this breaks service to service RPC (OM to SCM, datanode to SCM, SCM to SCM) when the target is configured with an IPv6 literal: the principal's host name resolves to IPv4 first, so the socket is bound to an IPv4 address and then connects to an IPv6 address. The reverse combination fails the same way.

This change binds the socket to the existing bindTo variable, which is null (wildcard) when the flag is set. Upstream Hadoop calls NetUtils.bindToLocalAddress for this, but that method is missing in Hadoop 2, and the Ozone filesystem jar for Hadoop 2 uses the Hadoop 2 NetUtils at runtime. With the default (false), behavior is unchanged.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-17195

How was this patch tested?

Added TestClient.testKerberosSocketBinding, which runs the real connection setup with a mocked socket and Kerberos identity for both values of ipc.client.bind.wildcard.addr. Without the fix, the true case fails. Checkstyle passes locally. CI.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[jojochuang]

@smengcl I added a test-only regression commit on top of this PR: jojochuang@e8ec942

Branch: jojochuang:codex/HDDS-17195-bind-test. Feel free to cherry-pick the commit.

TestClient.testKerberosSocketBinding exercises the actual RPC connection setup with a mocked socket and Kerberos identity for both values of ipc.client.bind.wildcard.addr. It verifies wildcard versus explicit local binding, ephemeral local port, and an unchanged remote destination. It needs no KDC or network connection and makes no production-code changes.

Confirmed regression: restoring the original line makes the true case fail (it binds to loopback rather than wildcard), while false passes. With this PR's fix, both cases pass (about one second). Checkstyle and the hdds-common RAT check also pass on JDK 21.

Generated-by: Codex (GPT-6)

[smengcl]

@jojochuang Thanks for the test!

[jojochuang]

I triggered CI 3 times, all ended up time out after 2.5 hr.

[smengcl]

I triggered CI 3 times, all ended up time out after 2.5 hr.

Looks to be the change breaking ozone client on Hadoop 2. let me check

[smengcl]

Thanks @jojochuang for the review.