[prev in list] [next in list] [prev in thread] [next in thread]
List: hadoop-commits
Subject: hadoop git commit: HDFS-13061. SaslDataTransferClient#checkTrustAndSend should not trust a partially
From: xyao () apache ! org
Date: 2018-01-31 18:47:13
Message-ID: 04a888c36e2d45038aa78c0e129a7f19 () git ! apache ! org
[Download RAW message or body]
Repository: hadoop
Updated Branches:
refs/heads/trunk 12eaae383 -> 37b753656
HDFS-13061. SaslDataTransferClient#checkTrustAndSend should not trust a partially \
trusted channel. Contributed by Ajay Kumar.
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/37b75365
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/37b75365
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/37b75365
Branch: refs/heads/trunk
Commit: 37b753656849d0864ed3c8858edf3b85515cbf39
Parents: 12eaae3
Author: Xiaoyu Yao <xyao@apache.org>
Authored: Wed Jan 31 10:09:43 2018 -0800
Committer: Xiaoyu Yao <xyao@apache.org>
Committed: Wed Jan 31 10:47:02 2018 -0800
----------------------------------------------------------------------
.../sasl/SaslDataTransferClient.java | 12 +-
.../datatransfer/sasl/TestSaslDataTransfer.java | 154 ++++++++++++++++++-
2 files changed, 161 insertions(+), 5 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/37b75365/hadoop-hdfs-project/hadoop \
-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java
----------------------------------------------------------------------
diff --git a/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java \
b/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java
index 7804bec..a23a108 100644
--- a/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java
+++ b/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java
@@ -203,11 +203,15 @@ public class SaslDataTransferClient {
DataEncryptionKeyFactory encryptionKeyFactory,
Token<BlockTokenIdentifier> accessToken, DatanodeID datanodeId)
throws IOException {
- if (!trustedChannelResolver.isTrusted() &&
- !trustedChannelResolver.isTrusted(addr)) {
+ boolean localTrusted = trustedChannelResolver.isTrusted();
+ boolean remoteTrusted = trustedChannelResolver.isTrusted(addr);
+ LOG.debug("SASL encryption trust check: localHostTrusted = {}, "
+ + "remoteHostTrusted = {}", localTrusted, remoteTrusted);
+
+ if (!localTrusted || !remoteTrusted) {
// The encryption key factory only returns a key if encryption is enabled.
- DataEncryptionKey encryptionKey =
- encryptionKeyFactory.newDataEncryptionKey();
+ DataEncryptionKey encryptionKey = encryptionKeyFactory
+ .newDataEncryptionKey();
return send(addr, underlyingOut, underlyingIn, encryptionKey, accessToken,
datanodeId);
} else {
http://git-wip-us.apache.org/repos/asf/hadoop/blob/37b75365/hadoop-hdfs-project/hadoop \
-hdfs/src/test/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/TestSaslDataTransfer.java
----------------------------------------------------------------------
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/TestSaslDataTransfer.java \
b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/TestSaslDataTransfer.java
index 2fe0a1c..363bb5a 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/TestSaslDataTransfer.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/TestSaslDataTransfer.java
@@ -23,8 +23,12 @@ import static \
org.apache.hadoop.hdfs.DFSConfigKeys.IGNORE_SECURE_PORTS_FOR_TESTI import static \
org.junit.Assert.assertArrayEquals; import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
import java.io.IOException;
+import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.SocketTimeoutException;
@@ -56,6 +60,7 @@ import org.junit.Rule;
import org.junit.Test;
import org.junit.rules.ExpectedException;
import org.junit.rules.Timeout;
+import org.mockito.Mockito;
public class TestSaslDataTransfer extends SaslDataTransferTestCase {
@@ -74,7 +79,7 @@ public class TestSaslDataTransfer extends SaslDataTransferTestCase \
{
@After
public void shutdown() {
- IOUtils.cleanup(null, fs);
+ IOUtils.cleanupWithLogger(null, fs);
if (cluster != null) {
cluster.shutdown();
cluster = null;
@@ -245,4 +250,151 @@ public class TestSaslDataTransfer extends \
SaslDataTransferTestCase { IOUtils.cleanup(null, socket, serverSocket);
}
}
+
+ /**
+ * Verifies that SaslDataTransferClient#checkTrustAndSend should not trust a
+ * partially trusted channel.
+ */
+ @Test
+ public void testSaslDataTransferWithTrustedServerUntrustedClient() throws
+ Exception {
+ HdfsConfiguration conf = createSecureConfig(
+ "authentication,integrity,privacy");
+
+ AtomicBoolean fallbackToSimpleAuth = new AtomicBoolean(false);
+ TrustedChannelResolver trustedChannelResolver = new
+ TrustedChannelResolver() {
+ @Override
+ public boolean isTrusted() {
+ return true;
+ }
+
+ @Override
+ public boolean isTrusted(InetAddress peerAddress) {
+ return false;
+ }
+ };
+
+ SaslDataTransferClient saslClient = new SaslDataTransferClient(
+ conf, DataTransferSaslUtil.getSaslPropertiesResolver(conf),
+ trustedChannelResolver, fallbackToSimpleAuth);
+
+ ServerSocket serverSocket = null;
+ Socket socket = null;
+ DataEncryptionKeyFactory dataEncryptionKeyFactory = null;
+ try {
+ serverSocket = new ServerSocket(10002, 10);
+ socket = new Socket(serverSocket.getInetAddress(),
+ serverSocket.getLocalPort());
+
+ dataEncryptionKeyFactory = mock(DataEncryptionKeyFactory.class);
+ Mockito.when(dataEncryptionKeyFactory.newDataEncryptionKey())
+ .thenThrow(new IOException("Encryption enabled"));
+
+ saslClient.socketSend(socket, null, null, dataEncryptionKeyFactory,
+ null, null);
+
+ Assert.fail("Expected IOException from "
+ + "SaslDataTransferClient#checkTrustAndSend");
+ } catch (IOException e) {
+ GenericTestUtils.assertExceptionContains("Encryption enabled", e);
+ verify(dataEncryptionKeyFactory, times(1)).newDataEncryptionKey();
+ } finally {
+ IOUtils.cleanupWithLogger(null, socket, serverSocket);
+ }
+ }
+
+ @Test
+ public void testSaslDataTransferWithUntrustedServerUntrustedClient() throws
+ Exception {
+ HdfsConfiguration conf = createSecureConfig(
+ "authentication,integrity,privacy");
+
+ AtomicBoolean fallbackToSimpleAuth = new AtomicBoolean(false);
+ TrustedChannelResolver trustedChannelResolver = new
+ TrustedChannelResolver() {
+ @Override
+ public boolean isTrusted() {
+ return false;
+ }
+
+ @Override
+ public boolean isTrusted(InetAddress peerAddress) {
+ return false;
+ }
+ };
+
+ SaslDataTransferClient saslClient = new SaslDataTransferClient(
+ conf, DataTransferSaslUtil.getSaslPropertiesResolver(conf),
+ trustedChannelResolver, fallbackToSimpleAuth);
+
+ ServerSocket serverSocket = null;
+ Socket socket = null;
+ DataEncryptionKeyFactory dataEncryptionKeyFactory = null;
+ try {
+ serverSocket = new ServerSocket(10002, 10);
+ socket = new Socket(serverSocket.getInetAddress(),
+ serverSocket.getLocalPort());
+
+ dataEncryptionKeyFactory = mock(DataEncryptionKeyFactory.class);
+ Mockito.when(dataEncryptionKeyFactory.newDataEncryptionKey())
+ .thenThrow(new IOException("Encryption enabled"));
+
+ saslClient.socketSend(socket, null, null, dataEncryptionKeyFactory,
+ null, null);
+
+ Assert.fail("Expected IOException from "
+ + "SaslDataTransferClient#checkTrustAndSend");
+ } catch (IOException e) {
+ GenericTestUtils.assertExceptionContains("Encryption enabled", e);
+ verify(dataEncryptionKeyFactory, times(1)).newDataEncryptionKey();
+ } finally {
+ IOUtils.cleanupWithLogger(null, socket, serverSocket);
+ }
+ }
+
+ @Test
+ public void testSaslDataTransferWithTrustedServerTrustedClient() throws
+ Exception {
+ HdfsConfiguration conf = createSecureConfig(
+ "authentication,integrity,privacy");
+
+ AtomicBoolean fallbackToSimpleAuth = new AtomicBoolean(false);
+ TrustedChannelResolver trustedChannelResolver = new
+ TrustedChannelResolver() {
+ @Override
+ public boolean isTrusted() {
+ return true;
+ }
+
+ @Override
+ public boolean isTrusted(InetAddress peerAddress) {
+ return true;
+ }
+ };
+
+ SaslDataTransferClient saslClient = new SaslDataTransferClient(
+ conf, DataTransferSaslUtil.getSaslPropertiesResolver(conf),
+ trustedChannelResolver, fallbackToSimpleAuth);
+
+ ServerSocket serverSocket = null;
+ Socket socket = null;
+ DataEncryptionKeyFactory dataEncryptionKeyFactory = null;
+ try {
+ serverSocket = new ServerSocket(10002, 10);
+ socket = new Socket(serverSocket.getInetAddress(),
+ serverSocket.getLocalPort());
+
+ dataEncryptionKeyFactory = mock(DataEncryptionKeyFactory.class);
+ Mockito.when(dataEncryptionKeyFactory.newDataEncryptionKey())
+ .thenThrow(new IOException("Encryption enabled"));
+
+ saslClient.socketSend(socket, null, null, dataEncryptionKeyFactory,
+ null, null);
+ verify(dataEncryptionKeyFactory, times(0)).newDataEncryptionKey();
+ } finally {
+ IOUtils.cleanupWithLogger(null, socket, serverSocket);
+ }
+ }
+
}
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic