[KAFKA-14265] Prefix ACLs may shadow other prefix ACLs

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 3.3.0
• Fix Version/s: 3.3.1
• Assignee: Colin McCabe
• Reporter: Colin McCabe
• Created: 29/Sep/22 00:01
• Updated: 30/Sep/22 14:02
• Resolved: 29/Sep/22 18:20

Description

Prefix ACLs may shadow other prefix ACLs. Consider the case where we have prefix ACLs for foobar, fooa, and f. If we were matching a resource named "foobar", we'd start scanning at the foobar ACL, hit the fooa ACL, and stop – missing the f ACL.

To fix this, we should re-scan for ACLs at the first divergence point (in this case, f) whenever we hit a mismatch of this kind.

Issue Links

• links to: GitHub Pull Request #12695