[
https://issues.apache.org/jira/browse/IMPALA-9021?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16947236#comment-16947236
]
Fang-Yu Rao commented on IMPALA-9021:
-------------------------------------
Taking a look at the current implementation, we found that Impala simply passes
the client's hostname to the Ranger server
(https://github.com/apache/impala/blob/master/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationChecker.java#L222-L224),
which is not desirable for the Ranger server since the Ranger server expects
to see an IP address.
According to the discussion at https://gerrit.cloudera.org/c/13601, two
solutions had been discussed.
1. Use {{InetAddress.getByName()}} to get the client's IP from the client's
hostname retrieved in the current {{TSesstionState}}.
2. Use {{InetAddresses.forString()}} to get the client's IP from the client's
IP string literal.
The first method is not desirable in that it may involve DNS lookup and DNS
service is not reliable and thus could slow down or even fail the query.
The second method may not work because a client's hostname may not be a IP
string literal.
On the other hand, we note that {{InetAddress.getLocalHost().getHostAddress()}}
corresponds to Impala server's IP instead of the client's IP and therefore this
approach does not work either.
> Impala produces a wrong value for the Ranger audit field of client IP
> ---------------------------------------------------------------------
>
> Key: IMPALA-9021
> URL: https://issues.apache.org/jira/browse/IMPALA-9021
> Project: IMPALA
> Issue Type: Bug
> Reporter: Fang-Yu Rao
> Assignee: Fang-Yu Rao
> Priority: Critical
>
> Currently on a Ranger-enabled Impala minicluster, Impala would produce a
> wrong value for the Ranger audit field of client IP after executing a SQL
> statement that triggers the check of authorization.
> Specifically, if a user issues a SQL statement '{{SHOW TABLE STATS
> functional.alltypes;}}', the value of the 3rd argument {{clientIp}} to the
> constructor of {{RangerBufferAuditHandler}}
> (https://github.com/apache/impala/blob/master/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationChecker.java#L224)
> would be '{{::ffff:127.0.0.1}}' instead of '{{127.0.0.1}}'. This could be
> verified by attaching a Java debugger to {{impalad}} and observing the value
> of the 3rd argument {{clientIp}}.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
