Skip to content

[Bug] SOCKS proxy CIDR matching throws NumberFormatException for hostname or IPv6 addresses, so the client cannot connect #11483

Open

Description

@weidong-qi

Before Creating the Bug Report

  • I found a bug, not just asking a question, which should be created in GitHub Discussions.
  • I have searched the GitHub Issues and GitHub Discussions of this repository and believe that this is not a duplicate.
  • I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.

Runtime platform environment

Any (reproduced on macOS)

RocketMQ version

develop, git commit id: 57c2dc0

JDK Version

JDK 17

Describe the Bug

NettyRemotingClient#getProxy picks a SOCKS proxy by matching the target host against each CIDR key of socksProxyConfig. For every key other than the literal 0.0.0.0/0 it calls RemotingHelper#ipInCIDR(host, cidr), which parses the host with ipToInt and only accepts dotted IPv4 literals.

When the target address uses a hostname (e.g. namesrv.example.com:9876, common with Kubernetes service names) or an IPv6 literal, ipToInt throws NumberFormatException. The exception escapes getProxy → fetchBootstrap → doConnect, so the client cannot connect to that address at all, even though it should just not match that CIDR.

Steps to Reproduce

NettyClientConfig config = new NettyClientConfig();
config.setSocksProxyConfig("{\"10.0.0.0/8\":{\"addr\":\"127.0.0.1:1080\"}}");
NettyRemotingClient client = new NettyRemotingClient(config);
// any invoke against "namesrv.example.com:9876" reaches getProxy(...)

Calling getProxy("namesrv.example.com:9876") (e.g. via reflection) throws:

java.lang.NumberFormatException: For input string: "namesrv"
	at org.apache.rocketmq.remoting.common.RemotingHelper.ipToInt(RemotingHelper.java)
	at org.apache.rocketmq.remoting.common.RemotingHelper.ipInCIDR(RemotingHelper.java)
	at org.apache.rocketmq.remoting.netty.NettyRemotingClient.getProxy(NettyRemotingClient.java)

What Did You Expect to See?

A hostname or IPv6 host that cannot be compared against an IPv4 CIDR does not match that entry (no proxy, direct connection), and can still match the 0.0.0.0/0 catch-all entry.

What Did You See Instead?

NumberFormatException is thrown and the connection attempt fails.

Additional Context

This is separate from #11068, which fixes the /0 mask computation inside ipInCIDR. The fix proposed here only touches NettyRemotingClient#getProxy, so the two changes do not overlap.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions