[MNG-7132] mirrorOf external:* external:http:* detect only 127.0.01 as local, missing IPv6, 127.x.y.z and other

[jira-importer]

Romain Manni-Bucau opened MNG-7132 and commented

DefaultMirrorSelector used in org.apache.maven.internal.aether.DefaultRepositorySystemSessionFactory#newRepositorySession does not implement isLocal properly - more exactly it only handles 2 particular cases whereas local can be way more numerous:

1. ipv4 case: 127.x.y.z (test can be has 4 segments separated by a dot and starts with 127.)
2. ipv6 case: starts with 1 and ends with 0 (see java.net.Inet6Address.Inet6AddressHolder#isLoopbackAddress)
3. host case: not sure we want to handle it but except localhost hardcoded string we could parse /etc/hosts (or windows specific location) too to resolve the ip without going through InetAddress - see next point) and use the ip with 1+2 rules.

this can be implemented as string parsing (faster) or reusing java.net.InetAddress#isLoopbackAddress (which can fallback in some resolution which can be slow at startup but works better overall and is easier).

 

---

Issue Links:

• MNG-7116 Add support for mirror selector on external:http:*

• MNG-3461 Enhance Mirror definition syntax with external:*

[jira-importer]

Michael Osipov commented

I am aware of this for a long time, but did not start to work on. Fully agree on 1 and 2, though 2 is just ::1. IPv6 does not have any local ranges anymore. There is also link-local which I need to check.
As for 3: I would only use localhost everything else is a user problem or try to rely on InetAdress if it is suitable.

[jira-importer]

Romain Manni-Bucau commented

Fully agree, I would prefer to rely on InetAdress in terms of impl but on some (old now - j7 last time I tested) JDK it is a bit slow but since it will end up loaded at some point maybe we don't care much except if mirror is loaded and no download are done (which happens luckily quite often).

[jira-importer]

Hervé Boutemy commented

from a user perspective, this means that mirrorOf external:* (that exists since years) and mirrorOf external:http:* (recently added) do consider some URLs as external when they are local:

• the title of this issue should be rephrased to match
• it seems nobody ever noticed such cases

notice that this will have to be done both in Maven Resolver and Maven itself

[jira-importer]

Romain Manni-Bucau commented

Hervé Boutemy isn't it only in resolver? About the title, I tried an update, does it work better for you?

[jira-importer]

Hervé Boutemy commented

sadly no, it's not only in resolver: given Maven architecture based on multiple refactorings, the code is maintained 3 times (see commits from MNG-7116 and MRESOVER-165 for precise pointers)

 

on the title, I'll update, thank you