You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "smengcl (via GitHub)" <gi...@apache.org> on 2026/10/09 00:26:47 UTC
[PR] HDDS-16800. Add availability to THREAT_MODEL.md [ozone]
smengcl opened a new pull request, #11451:
URL: https://github.com/apache/ozone/pull/11451
Generated-by: Claude Code (Opus 5.5)
## What changes were proposed in this pull request?
`THREAT_MODEL.md` does not mention availability. Section 8 lists six security properties and none of them covers it, and section 9 does not disclaim it either. A report that a request stops a service therefore has no disposition in section 13, and a triager cannot tell whether it is `VALID` or `BY-DESIGN`.
This adds the missing statement in both directions.
What Ozone provides (section 8, new item 7): a small, fixed number of requests from an untrusted client or an authenticated non-admin user does not terminate or hang an Ozone service process, and does not leave the service unable to serve other users.
What Ozone does not provide (section 9):
* Withstanding load by volume, such as request floods and connection exhaustion. Limiting that is the operator's job.
* Protection against a user consuming resources within the limits the operator granted.
* Availability against admins or compromised service peers.
Matching edits so the rest of the document agrees: the adversary list (section 7), operator guidance on quotas, FairCallQueue and rate limiting in front of S3 Gateway (section 10), known non-findings (section 11a), and the triage dispositions table (section 13).
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-16800
## How was this patch tested?
- n/a
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16800. Add availability to THREAT_MODEL.md [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on PR #11451:
URL: https://github.com/apache/ozone/pull/11451#issuecomment-6130872180
Thanks @jojochuang for the review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16800. Add availability to THREAT_MODEL.md [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on PR #11451:
URL: https://github.com/apache/ozone/pull/11451#issuecomment-6130525913
> Thanks for closing the availability triage gap — the §8 item 7 / §9 volume split and the §7 “authorized operation vs service failure” wording look right.
>
> One small doc improvement: **§8 item 7** says requests must not “terminate or **hang**” a service. “Hang” is a bit fuzzy in triage (indefinite block on a thread pool vs full JVM stop vs severe GC/livelock that makes the process effectively unusable). It would help to add a short clarification of what “hang” means here — e.g. the service remains up but cannot make progress serving other users within a reasonable time — so reporters and maintainers align on when that counts as a §8 item 7 violation vs operational slowness under load (§9).
>
> Not blocking; happy to approve once that’s in or if you prefer to track it as a follow-up.
Thanks @jojochuang. Added in 182732dc17e
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16800. Add availability to THREAT_MODEL.md [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #11451:
URL: https://github.com/apache/ozone/pull/11451#discussion_r4225724633
##########
THREAT_MODEL.md:
##########
@@ -328,6 +337,7 @@ Per-boundary input trust (grouped by family):
ideally, encrypt them on disk. *(maintainer — jojochuang, 2026-06-25.)*
- **Isolate the KMS** in a separate, firewalled network segment. *(maintainer —
jojochuang, 2026-06-25.)*
+- **Bound client load:** set namespace and space quotas, enable the RPC `FairCallQueue` on the OM (for S3 traffic it needs the Ozone identity provider), and put rate limiting in front of an internet-facing S3 Gateway. Ozone does not promise to withstand load by volume (§9).
Review Comment:
Added in 3eeb3c33c75: the guidance now says FairCallQueue covers S3 traffic only when S3 Gateway reaches the OM over Hadoop RPC, not over gRPC. One correction to the comment: Hadoop RPC is the default (`ozone.om.transport.class` defaults to `Hadoop3OmTransportFactory`). `ozone.om.s3.grpc.server_enabled=true` only opens the OM gRPC endpoint, S3 Gateway uses it only when the transport class is set to `GrpcOmTransportFactory`. So no switch is required on a default setup.
_🤖 Addressed by [Claude Code](https://claude.com/claude-code)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16800. Add availability to THREAT_MODEL.md [ozone]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #11451:
URL: https://github.com/apache/ozone/pull/11451#discussion_r4225492426
##########
THREAT_MODEL.md:
##########
@@ -328,6 +337,7 @@ Per-boundary input trust (grouped by family):
ideally, encrypt them on disk. *(maintainer — jojochuang, 2026-06-25.)*
- **Isolate the KMS** in a separate, firewalled network segment. *(maintainer —
jojochuang, 2026-06-25.)*
+- **Bound client load:** set namespace and space quotas, enable the RPC `FairCallQueue` on the OM (for S3 traffic it needs the Ozone identity provider), and put rate limiting in front of an internet-facing S3 Gateway. Ozone does not promise to withstand load by volume (§9).
Review Comment:
The FairCallQueue recommendation omits that the default S3 Gateway-to-OM transport is gRPC (`ozone.om.s3.grpc.server_enabled=true`), while FairCallQueue has no gRPC implementation. Configuring only the identity provider therefore leaves default S3 traffic unprotected; explicitly require switching S3 Gateway to Hadoop RPC before enabling FairCallQueue (see `hadoop-hdds/docs/content/feature/FairCallQueue.md:21-28,44-63` and `hadoop-hdds/common/src/main/resources/ozone-default.xml:4502-4508`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16800. Add availability to THREAT_MODEL.md [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl merged PR #11451:
URL: https://github.com/apache/ozone/pull/11451
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org