You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by aa...@apache.org on 2020/06/15 02:22:11 UTC
[hadoop] branch branch-2.10 updated: SPNEGO TLS verification
This is an automated email from the ASF dual-hosted git repository.
aajisaka pushed a commit to branch branch-2.10
in repository https://gitbox.apache.org/repos/asf/hadoop.git
The following commit(s) were added to refs/heads/branch-2.10 by this push:
new e81002b SPNEGO TLS verification
e81002b is described below
commit e81002bcb1c835b6ece72470d85aacaddd2ca98a
Author: Eric Yang <ey...@apache.org>
AuthorDate: Mon Jun 15 10:55:26 2020 +0900
SPNEGO TLS verification
Signed-off-by: Akira Ajisaka <aa...@apache.org>
(cherry picked from commit 81d8a887b0406380e469c76ed2e41022a6372dd7)
Conflicts:
hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java
---
.../main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java b/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java
index 7e4b3d9..fe1e372 100644
--- a/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java
+++ b/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java
@@ -140,6 +140,7 @@ public class WebHdfsFileSystem extends FileSystem
+ "/v" + VERSION;
public static final String EZ_HEADER = "X-Hadoop-Accept-EZ";
public static final String FEFINFO_HEADER = "X-Hadoop-feInfo";
+ public static final String DFS_HTTP_POLICY_KEY = "dfs.http.policy";
/**
* Default connection factory may be overridden in tests to use smaller
@@ -169,6 +170,7 @@ public class WebHdfsFileSystem extends FileSystem
new ObjectMapper().reader(Map.class);
private DFSOpsCountStatistics storageStatistics;
+ private boolean isTLSKrb;
/**
* Return the protocol scheme for the FileSystem.
@@ -231,6 +233,8 @@ public class WebHdfsFileSystem extends FileSystem
.newDefaultURLConnectionFactory(connectTimeout, readTimeout, conf);
}
+ this.isTLSKrb = "HTTPS_ONLY".equals(conf.get(DFS_HTTP_POLICY_KEY));
+
ugi = UserGroupInformation.getCurrentUser();
this.uri = URI.create(uri.getScheme() + "://" + uri.getAuthority());
this.nnAddrs = resolveNNAddr();
@@ -690,6 +694,11 @@ public class WebHdfsFileSystem extends FileSystem
//redirect hostname and port
redirectHost = null;
+ if (url.getProtocol().equals("http") &&
+ UserGroupInformation.isSecurityEnabled() &&
+ isTLSKrb) {
+ throw new IOException("Access denied: dfs.http.policy is HTTPS_ONLY.");
+ }
// resolve redirects for a DN operation unless already resolved
if (op.getRedirect() && !redirected) {
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org