Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMS.java Sat Jul 12 02:24:40 2014 @@ -38,10 +38,12 @@ import javax.security.auth.login.AppConf import javax.security.auth.login.LoginContext; import java.io.File; import java.io.FileWriter; +import java.io.IOException; import java.io.Writer; import java.net.InetAddress; import java.net.MalformedURLException; import java.net.ServerSocket; +import java.net.SocketTimeoutException; import java.net.URI; import java.net.URL; import java.security.Principal; @@ -490,6 +492,49 @@ public class TestKMS { // getKeysMetadata() empty Assert.assertEquals(0, kp.getKeysMetadata().length); + // createKey() no description, no tags + options = new KeyProvider.Options(conf); + options.setCipher("AES/CTR/NoPadding"); + options.setBitLength(128); + kp.createKey("k2", options); + KeyProvider.Metadata meta = kp.getMetadata("k2"); + Assert.assertNull(meta.getDescription()); + Assert.assertTrue(meta.getAttributes().isEmpty()); + + // createKey() description, no tags + options = new KeyProvider.Options(conf); + options.setCipher("AES/CTR/NoPadding"); + options.setBitLength(128); + options.setDescription("d"); + kp.createKey("k3", options); + meta = kp.getMetadata("k3"); + Assert.assertEquals("d", meta.getDescription()); + Assert.assertTrue(meta.getAttributes().isEmpty()); + + Map<String, String> attributes = new HashMap<String, String>(); + attributes.put("a", "A"); + + // createKey() no description, tags + options = new KeyProvider.Options(conf); + options.setCipher("AES/CTR/NoPadding"); + options.setBitLength(128); + options.setAttributes(attributes); + kp.createKey("k4", options); + meta = kp.getMetadata("k4"); + Assert.assertNull(meta.getDescription()); + Assert.assertEquals(attributes, meta.getAttributes()); + + // createKey() description, tags + options = new KeyProvider.Options(conf); + options.setCipher("AES/CTR/NoPadding"); + options.setBitLength(128); + options.setDescription("d"); + options.setAttributes(attributes); + kp.createKey("k5", options); + meta = kp.getMetadata("k5"); + Assert.assertEquals("d", meta.getDescription()); + Assert.assertEquals(attributes, meta.getAttributes()); + return null; } }); @@ -808,4 +853,44 @@ public class TestKMS { }); } + /** + * Test the configurable timeout in the KMSClientProvider. Open up a + * socket, but don't accept connections for it. This leads to a timeout + * when the KMS client attempts to connect. + * @throws Exception + */ + @Test + public void testKMSTimeout() throws Exception { + File confDir = getTestDir(); + Configuration conf = createBaseKMSConf(confDir); + conf.setInt(KMSClientProvider.TIMEOUT_ATTR, 1); + writeConf(confDir, conf); + + ServerSocket sock; + int port; + try { + sock = new ServerSocket(0, 50, InetAddress.getByName("localhost")); + port = sock.getLocalPort(); + } catch ( Exception e ) { + /* Problem creating socket? Just bail. */ + return; + } + + URL url = new URL("http://localhost:"; + port + "/kms"); + URI uri = createKMSUri(url); + + boolean caughtTimeout = false; + try { + KeyProvider kp = new KMSClientProvider(uri, conf); + kp.getKeys(); + } catch (SocketTimeoutException e) { + caughtTimeout = true; + } catch (IOException e) { + Assert.assertTrue("Caught unexpected exception" + e.toString(), false); + } + + Assert.assertTrue(caughtTimeout); + + sock.close(); + } }
Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMSCacheKeyProvider.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMSCacheKeyProvider.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMSCacheKeyProvider.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/TestKMSCacheKeyProvider.java Sat Jul 12 02:24:40 2014 @@ -102,7 +102,7 @@ public class TestKMSCacheKeyProvider { Mockito.when(mockProv.getCurrentKey(Mockito.eq("k1"))).thenReturn(mockKey); Mockito.when(mockProv.getKeyVersion(Mockito.eq("k1@0"))).thenReturn(mockKey); Mockito.when(mockProv.getMetadata(Mockito.eq("k1"))).thenReturn( - new KMSClientProvider.KMSMetadata("c", 0, "l", new Date(), 1)); + new KMSClientProvider.KMSMetadata("c", 0, "l", null, new Date(), 1)); KeyProvider cache = new KMSCacheKeyProvider(mockProv, 100); Assert.assertEquals(mockKey, cache.getCurrentKey("k1")); Mockito.verify(mockProv, Mockito.times(1)).getCurrentKey(Mockito.eq("k1")); Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-minikdc/src/main/java/org/apache/hadoop/minikdc/MiniKdc.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-minikdc/src/main/java/org/apache/hadoop/minikdc/MiniKdc.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-minikdc/src/main/java/org/apache/hadoop/minikdc/MiniKdc.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-minikdc/src/main/java/org/apache/hadoop/minikdc/MiniKdc.java Sat Jul 12 02:24:40 2014 @@ -17,6 +17,7 @@ */ package org.apache.hadoop.minikdc; +import org.apache.commons.io.Charsets; import org.apache.commons.io.FileUtils; import org.apache.commons.io.IOUtils; import org.apache.commons.lang.text.StrSubstitutor; @@ -56,7 +57,7 @@ import org.slf4j.LoggerFactory; import java.io.BufferedReader; import java.io.File; -import java.io.FileReader; +import java.io.FileInputStream; import java.io.InputStream; import java.io.InputStreamReader; import java.io.StringReader; @@ -126,9 +127,9 @@ public class MiniKdc { + file.getAbsolutePath()); } Properties userConf = new Properties(); - FileReader r = null; + InputStreamReader r = null; try { - r = new FileReader(file); + r = new InputStreamReader(new FileInputStream(file), Charsets.UTF_8); userConf.load(r); } finally { if (r != null) { @@ -438,7 +439,7 @@ public class MiniKdc { BufferedReader r = null; try { - r = new BufferedReader(new InputStreamReader(is2)); + r = new BufferedReader(new InputStreamReader(is2, Charsets.UTF_8)); String line = r.readLine(); while (line != null) { Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/pom.xml URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/pom.xml?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/pom.xml (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/pom.xml Sat Jul 12 02:24:40 2014 @@ -93,6 +93,18 @@ </dependency> </dependencies> + <build> + <plugins> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>findbugs-maven-plugin</artifactId> + <configuration> + <excludeFilterFile>${basedir}/dev-support/findbugsExcludeFile.xml + </excludeFilterFile> + </configuration> + </plugin> + </plugins> + </build> <profiles> <profile> Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/nfs/nfs3/Nfs3Interface.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/nfs/nfs3/Nfs3Interface.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/nfs/nfs3/Nfs3Interface.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/nfs/nfs3/Nfs3Interface.java Sat Jul 12 02:24:40 2014 @@ -17,12 +17,9 @@ */ package org.apache.hadoop.nfs.nfs3; -import java.net.InetAddress; - import org.apache.hadoop.nfs.nfs3.response.NFS3Response; +import org.apache.hadoop.oncrpc.RpcInfo; import org.apache.hadoop.oncrpc.XDR; -import org.apache.hadoop.oncrpc.security.SecurityHandler; -import org.jboss.netty.channel.Channel; /** * RPC procedures as defined in RFC 1813. @@ -33,70 +30,65 @@ public interface Nfs3Interface { public NFS3Response nullProcedure(); /** GETATTR: Get file attributes */ - public NFS3Response getattr(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response getattr(XDR xdr, RpcInfo info); /** SETATTR: Set file attributes */ - public NFS3Response setattr(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response setattr(XDR xdr, RpcInfo info); /** LOOKUP: Lookup filename */ - public NFS3Response lookup(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response lookup(XDR xdr, RpcInfo info); /** ACCESS: Check access permission */ - public NFS3Response access(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response access(XDR xdr, RpcInfo info); + + /** READLINK: Read from symbolic link */ + public NFS3Response readlink(XDR xdr, RpcInfo info); /** READ: Read from file */ - public NFS3Response read(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response read(XDR xdr, RpcInfo info); /** WRITE: Write to file */ - public NFS3Response write(XDR xdr, Channel channel, int xid, - SecurityHandler securityHandler, InetAddress client); + public NFS3Response write(XDR xdr, RpcInfo info); /** CREATE: Create a file */ - public NFS3Response create(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response create(XDR xdr, RpcInfo info); /** MKDIR: Create a directory */ - public NFS3Response mkdir(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response mkdir(XDR xdr, RpcInfo info); + + /** SYMLINK: Create a symbolic link */ + public NFS3Response symlink(XDR xdr, RpcInfo info); + + /** MKNOD: Create a special device */ + public NFS3Response mknod(XDR xdr, RpcInfo info); /** REMOVE: Remove a file */ - public NFS3Response remove(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response remove(XDR xdr, RpcInfo info); /** RMDIR: Remove a directory */ - public NFS3Response rmdir(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response rmdir(XDR xdr, RpcInfo info); /** RENAME: Rename a file or directory */ - public NFS3Response rename(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response rename(XDR xdr, RpcInfo info); - /** SYMLINK: Create a symbolic link */ - public NFS3Response symlink(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + /** LINK: create link to an object */ + public NFS3Response link(XDR xdr, RpcInfo info); /** READDIR: Read From directory */ - public NFS3Response readdir(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response readdir(XDR xdr, RpcInfo info); + /** READDIRPLUS: Extended read from directory */ + public NFS3Response readdirplus(XDR xdr, RpcInfo info); + /** FSSTAT: Get dynamic file system information */ - public NFS3Response fsstat(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response fsstat(XDR xdr, RpcInfo info); /** FSINFO: Get static file system information */ - public NFS3Response fsinfo(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response fsinfo(XDR xdr, RpcInfo info); /** PATHCONF: Retrieve POSIX information */ - public NFS3Response pathconf(XDR xdr, SecurityHandler securityHandler, - InetAddress client); + public NFS3Response pathconf(XDR xdr, RpcInfo info); /** COMMIT: Commit cached data on a server to stable storage */ - public NFS3Response commit(XDR xdr, Channel channel, int xid, - SecurityHandler securityHandler, InetAddress client); + public NFS3Response commit(XDR xdr, RpcInfo info); } Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/RpcProgram.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/RpcProgram.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/RpcProgram.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/RpcProgram.java Sat Jul 12 02:24:40 2014 @@ -48,7 +48,7 @@ public abstract class RpcProgram extends private final int progNumber; private final int lowProgVersion; private final int highProgVersion; - private final boolean allowInsecurePorts; + protected final boolean allowInsecurePorts; /** * If not null, this will be used as the socket to use to connect to the @@ -146,31 +146,6 @@ public abstract class RpcProgram extends RpcCall call = (RpcCall) info.header(); SocketAddress remoteAddress = info.remoteAddress(); - if (!allowInsecurePorts) { - if (LOG.isDebugEnabled()) { - LOG.debug("Will not allow connections from unprivileged ports. " + - "Checking for valid client port..."); - } - if (remoteAddress instanceof InetSocketAddress) { - InetSocketAddress inetRemoteAddress = (InetSocketAddress) remoteAddress; - if (inetRemoteAddress.getPort() > 1023) { - LOG.warn("Connection attempted from '" + inetRemoteAddress + "' " - + "which is an unprivileged port. Rejecting connection."); - sendRejectedReply(call, remoteAddress, ctx); - return; - } else { - if (LOG.isDebugEnabled()) { - LOG.debug("Accepting connection from '" + remoteAddress + "'"); - } - } - } else { - LOG.warn("Could not determine remote port of socket address '" + - remoteAddress + "'. Rejecting connection."); - sendRejectedReply(call, remoteAddress, ctx); - return; - } - } - if (LOG.isTraceEnabled()) { LOG.trace(program + " procedure #" + call.getProcedure()); } @@ -191,6 +166,29 @@ public abstract class RpcProgram extends handleInternal(ctx, info); } + public boolean doPortMonitoring(SocketAddress remoteAddress) { + if (!allowInsecurePorts) { + if (LOG.isTraceEnabled()) { + LOG.trace("Will not allow connections from unprivileged ports. " + + "Checking for valid client port..."); + } + + if (remoteAddress instanceof InetSocketAddress) { + InetSocketAddress inetRemoteAddress = (InetSocketAddress) remoteAddress; + if (inetRemoteAddress.getPort() > 1023) { + LOG.warn("Connection attempted from '" + inetRemoteAddress + "' " + + "which is an unprivileged port. Rejecting connection."); + return false; + } + } else { + LOG.warn("Could not determine remote port of socket address '" + + remoteAddress + "'. Rejecting connection."); + return false; + } + } + return true; + } + private void sendAcceptedReply(RpcCall call, SocketAddress remoteAddress, AcceptState acceptState, ChannelHandlerContext ctx) { RpcAcceptedReply reply = RpcAcceptedReply.getInstance(call.getXid(), @@ -208,7 +206,7 @@ public abstract class RpcProgram extends RpcUtil.sendRpcResponse(ctx, rsp); } - private static void sendRejectedReply(RpcCall call, + protected static void sendRejectedReply(RpcCall call, SocketAddress remoteAddress, ChannelHandlerContext ctx) { XDR out = new XDR(); RpcDeniedReply reply = new RpcDeniedReply(call.getXid(), Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/CredentialsSys.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/CredentialsSys.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/CredentialsSys.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/CredentialsSys.java Sat Jul 12 02:24:40 2014 @@ -58,6 +58,10 @@ public class CredentialsSys extends Cred return mUID; } + public int[] getAuxGIDs() { + return mAuxGIDs; + } + public void setGID(int gid) { this.mGID = gid; } @@ -65,7 +69,7 @@ public class CredentialsSys extends Cred public void setUID(int uid) { this.mUID = uid; } - + public void setStamp(int stamp) { this.mStamp = stamp; } Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/SecurityHandler.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/SecurityHandler.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/SecurityHandler.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/SecurityHandler.java Sat Jul 12 02:24:40 2014 @@ -60,4 +60,9 @@ public abstract class SecurityHandler { public int getGid() { throw new UnsupportedOperationException(); } + + /** Used by AUTH_SYS */ + public int[] getAuxGids() { + throw new UnsupportedOperationException(); + } } Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/SysSecurityHandler.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/SysSecurityHandler.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/SysSecurityHandler.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/main/java/org/apache/hadoop/oncrpc/security/SysSecurityHandler.java Sat Jul 12 02:24:40 2014 @@ -56,4 +56,9 @@ public class SysSecurityHandler extends public int getGid() { return mCredentialsSys.getGID(); } + + @Override + public int[] getAuxGids() { + return mCredentialsSys.getAuxGIDs(); + } } Modified: hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/test/java/org/apache/hadoop/oncrpc/TestFrameDecoder.java URL: http://svn.apache.org/viewvc/hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/test/java/org/apache/hadoop/oncrpc/TestFrameDecoder.java?rev=1609878&r1=1609877&r2=1609878&view=diff ============================================================================== --- hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/test/java/org/apache/hadoop/oncrpc/TestFrameDecoder.java (original) +++ hadoop/common/branches/YARN-1051/hadoop-common-project/hadoop-nfs/src/test/java/org/apache/hadoop/oncrpc/TestFrameDecoder.java Sat Jul 12 02:24:40 2014 @@ -66,6 +66,18 @@ public class TestFrameDecoder { @Override protected void handleInternal(ChannelHandlerContext ctx, RpcInfo info) { + // This is just like what's done in RpcProgramMountd#handleInternal and + // RpcProgramNfs3#handleInternal. + RpcCall rpcCall = (RpcCall) info.header(); + final int procedure = rpcCall.getProcedure(); + if (procedure != 0) { + boolean portMonitorSuccess = doPortMonitoring(info.remoteAddress()); + if (!portMonitorSuccess) { + sendRejectedReply(rpcCall, info.remoteAddress(), ctx); + return; + } + } + resultSize = info.data().readableBytes(); RpcAcceptedReply reply = RpcAcceptedReply.getAcceptInstance(1234, new VerifierNone()); @@ -190,6 +202,20 @@ public class TestFrameDecoder { // Verify the server rejected the request. assertEquals(0, resultSize); + + // Ensure that the NULL procedure does in fact succeed. + xdrOut = new XDR(); + createPortmapXDRheader(xdrOut, 0); + int headerSize = xdrOut.size(); + buffer = new byte[bufsize]; + xdrOut.writeFixedOpaque(buffer); + int requestSize = xdrOut.size() - headerSize; + + // Send the request to the server + testRequest(xdrOut, serverPort); + + // Verify the server did not reject the request. + assertEquals(requestSize, resultSize); } private static int startRpcServer(boolean allowInsecurePorts) {
