You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by me...@apache.org on 2022/11/21 13:40:56 UTC
[ranger] branch ranger-2.4 updated (653322bcb -> e2e052532)
This is an automated email from the ASF dual-hosted git repository.
mehul pushed a change to branch ranger-2.4
in repository https://gitbox.apache.org/repos/asf/ranger.git
from 653322bcb RANGER-3966: fix to use user-roles from request context consitently
new a0442afd0 RANGER-3961: AuditFileSpool logs out all events that were not audited successfully
new e2e052532 RANGER-3962: Add preload directive to HSTS header
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/ranger/audit/queue/AuditFileSpool.java | 2 +-
.../hadoop/crypto/key/kms/server/KMSMDCFilter.java | 51 +++++++++++-----------
.../RangerSecurityContextFormationFilter.java | 2 +-
security-admin/src/main/webapp/login.jsp | 2 +-
4 files changed, 28 insertions(+), 29 deletions(-)
[ranger] 01/02: RANGER-3961: AuditFileSpool logs out all events that were not audited successfully
Posted by me...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
mehul pushed a commit to branch ranger-2.4
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit a0442afd065fbbc584c0383a388dacfa414a4539
Author: Mahesh Bandal <ma...@gmail.com>
AuthorDate: Mon Nov 21 12:27:39 2022 +0530
RANGER-3961: AuditFileSpool logs out all events that were not audited successfully
Signed-off-by: Mehul Parikh <me...@apache.org>
---
.../src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java
index bd06f7684..7256e911c 100644
--- a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java
+++ b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java
@@ -901,7 +901,7 @@ public class AuditFileSpool implements Runnable {
} catch (Throwable t) {
logger.error("Error while sending logs to consumer. provider="
+ queueProvider.getName() + ", consumer="
- + consumerProvider.getName() + ", log=" + lines, t);
+ + consumerProvider.getName() + ", logEventCount=" + lines.size(), t);
}
return ret;
[ranger] 02/02: RANGER-3962: Add preload directive to HSTS header
Posted by me...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
mehul pushed a commit to branch ranger-2.4
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit e2e052532f8176fc309bff103199ac78d0714238
Author: Mahesh Bandal <ma...@gmail.com>
AuthorDate: Mon Nov 21 12:14:13 2022 +0530
RANGER-3962: Add preload directive to HSTS header
Signed-off-by: Mehul Parikh <me...@apache.org>
---
.../hadoop/crypto/key/kms/server/KMSMDCFilter.java | 51 +++++++++++-----------
.../RangerSecurityContextFormationFilter.java | 2 +-
security-admin/src/main/webapp/login.jsp | 2 +-
3 files changed, 27 insertions(+), 28 deletions(-)
diff --git a/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java b/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java
index 1174f0bd6..b975bd099 100644
--- a/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java
+++ b/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSMDCFilter.java
@@ -71,32 +71,31 @@ public class KMSMDCFilter implements Filter {
@Override
public void doFilter(ServletRequest request, ServletResponse response,
- FilterChain chain)
- throws IOException, ServletException {
- try {
- String path = ((HttpServletRequest) request).getRequestURI();
- HttpServletResponse resp = (HttpServletResponse) response;
- resp.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-
- if (path.startsWith(RANGER_KMS_REST_API_PATH)) {
- chain.doFilter(request, resp);
- } else {
- DATA_TL.remove();
- UserGroupInformation ugi = HttpUserGroupInformation.get();
- String method = ((HttpServletRequest) request).getMethod();
- StringBuffer requestURL = ((HttpServletRequest) request).getRequestURL();
- String queryString = ((HttpServletRequest) request).getQueryString();
- if (queryString != null) {
- requestURL.append("?").append(queryString);
- }
- DATA_TL.set(new Data(ugi, method, requestURL.toString()));
- chain.doFilter(request, resp);
- }
- } finally {
- DATA_TL.remove();
-
- }
- }
+ FilterChain chain) throws IOException, ServletException {
+ try {
+ String path = ((HttpServletRequest) request).getRequestURI();
+ HttpServletResponse resp = (HttpServletResponse) response;
+ resp.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+
+ if (path.startsWith(RANGER_KMS_REST_API_PATH)) {
+ chain.doFilter(request, resp);
+ } else {
+ DATA_TL.remove();
+ UserGroupInformation ugi = HttpUserGroupInformation.get();
+ String method = ((HttpServletRequest) request).getMethod();
+ StringBuffer requestURL = ((HttpServletRequest) request).getRequestURL();
+ String queryString = ((HttpServletRequest) request).getQueryString();
+ if (queryString != null) {
+ requestURL.append("?").append(queryString);
+ }
+ DATA_TL.set(new Data(ugi, method, requestURL.toString()));
+ chain.doFilter(request, resp);
+ }
+ } finally {
+ DATA_TL.remove();
+
+ }
+ }
@Override
public void destroy() {
diff --git a/security-admin/src/main/java/org/apache/ranger/security/web/filter/RangerSecurityContextFormationFilter.java b/security-admin/src/main/java/org/apache/ranger/security/web/filter/RangerSecurityContextFormationFilter.java
index 9f83daf9a..782fe1173 100644
--- a/security-admin/src/main/java/org/apache/ranger/security/web/filter/RangerSecurityContextFormationFilter.java
+++ b/security-admin/src/main/java/org/apache/ranger/security/web/filter/RangerSecurityContextFormationFilter.java
@@ -136,7 +136,7 @@ public class RangerSecurityContextFormationFilter extends GenericFilterBean {
res.setHeader("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate");
res.setHeader("X-Frame-Options", "DENY" );
res.setHeader("X-XSS-Protection", "1; mode=block");
- res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+ res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
res.setHeader("Content-Security-Policy", "default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline';font-src 'self'");
res.setHeader("X-Permitted-Cross-Domain-Policies", "none");
chain.doFilter(request, res);
diff --git a/security-admin/src/main/webapp/login.jsp b/security-admin/src/main/webapp/login.jsp
index df234efd9..ad82ea9eb 100644
--- a/security-admin/src/main/webapp/login.jsp
+++ b/security-admin/src/main/webapp/login.jsp
@@ -56,7 +56,7 @@
response.setHeader("X-Content-Type-Options", "nosniff");
response.setHeader("X-XSS-Protection", "1; mode=block");
response.setHeader("Content-Security-Policy", "default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline';font-src 'self'");
- response.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+ response.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
// Delete browser cache in firefox environment
response.setHeader("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate"); // HTTP 1.1.
response.setHeader("Pragma", "no-cache");