SteNicholas opened a new pull request, #3759:
URL: https://github.com/apache/celeborn/pull/3759

   ### What changes were proposed in this pull request?
   
   Call `checkAuth(context, appId)` before serving `PbApplicationMetaRequest` 
in the Master, consistent with the other application-scoped handlers 
(`RequestSlots`, `UnregisterShuffle`, `ApplicationLost`).
   
   Workers fetch application meta over the internal channel, where the 
connection has no per-application client id, so the check is a no-op for them; 
it only rejects an external application that asks for another application's 
secret.
   
   ### Why are the changes needed?
   
   The Master served `PbApplicationMetaRequest` by returning the requested 
application's SASL secret without an authorization check. With authentication 
enabled, a caller on the external application port could read another 
application's secret and impersonate it.
   
   ### Does this PR resolve a correctness bug?
   
   - [ ] Yes
   
   ### Does this PR introduce _any_ user-facing change?
   
   - [ ] Yes
   
   ### How was this patch tested?
   
   - New `MasterApplicationMetaAuthSuite` verifying `PbApplicationMetaRequest` 
is authorized against the registered application.
   - New case in `MasterSuite` verifying a caller requesting another 
application's secret is rejected.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to