shml created RANGER-5763:
----------------------------
Summary: HBase plugin: NPE in snapshot hooks when table descriptor
is null aborts HMaster on HBase 2.6.3/2.6.4
Key: RANGER-5763
URL: https://issues.apache.org/jira/browse/RANGER-5763
Project: Ranger
Issue Type: Bug
Components: plugins
Reporter: shml
Taking a snapshot of a non-existent table aborts the HMaster when the Ranger
HBase plugin is installed.
Seen on a cluster running HBase 2.6.3 with the ranger hbase plugin; the same
unguarded dereference is present in ranger 2.7.0, 2.8.0, 2.9.0 and master.
{noformat}
java.lang.NullPointerException: Cannot invoke
"org.apache.hadoop.hbase.client.TableDescriptor.getTableName()" because
"hTableDescriptor" is null
at
org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor.preSnapshot(RangerAuthorizationCoprocessor.java:1113)
at
org.apache.hadoop.hbase.master.MasterCoprocessorHost.preSnapshot(MasterCoprocessorHost.java:1119)
at
org.apache.hadoop.hbase.master.snapshot.SnapshotManager.takeSnapshot(SnapshotManager.java:713)
at
org.apache.hadoop.hbase.master.MasterRpcServices.snapshot(MasterRpcServices.java:1721)
...
ERROR master.HMaster: ***** ABORTING master *****
{noformat}
On HBase 2.6.3/2.6.4 the snapshot coprocessor hooks run before the
table-existence check, and the descriptor is passed to the hook without a null
check (HBASE-29361, SnapshotManager.submitSnapshotProcedure):
{noformat}
TableDescriptor tableDescriptor =
master.getTableDescriptors().get(TableName.valueOf(snapshot.getTable()));
...
cpHost.preSnapshot(snapshotDesc, tableDescriptor, user);
sanityCheckBeforeSnapshot(snapshot, false);
{noformat}
For a missing table the hook receives a null descriptor, and
RangerAuthorizationCoprocessor.preSnapshot/preCloneSnapshot/preRestoreSnapshot
dereference it right away. Since hbase.coprocessor.abortonerror defaults to
true, the NPE aborts the master.
HBase corrected the ordering in HBASE-29955 (released in 2.6.5), but the plugin
still dereferences the descriptor without a null check, so any HBase version
calling these hooks with a null descriptor takes down the master.
Proposal: skip the permission check in
preSnapshot/preCloneSnapshot/preRestoreSnapshot when hTableDescriptor is null.
In that case the operation is rejected by HBase itself, so there is nothing to
authorize.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
