You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hbase.apache.org by zh...@apache.org on 2024/10/26 14:06:12 UTC
(hbase) branch branch-3 updated (a8ba8381bf5 -> 5469992b602)
This is an automated email from the ASF dual-hosted git repository.
zhangduo pushed a change to branch branch-3
in repository https://gitbox.apache.org/repos/asf/hbase.git
from a8ba8381bf5 HBASE-25876 Add retry if we fail to read all bytes of the protobuf magic marker (#3251)
new 6ddfcfd4838 Revert "HBASE-23303 Add default security headers if SSL is enabled (#4128)"
new 5469992b602 HBASE-26789 Automatically add default security headers to http/rest if SSL enabled
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java | 1 +
1 file changed, 1 insertion(+)
(hbase) 02/02: HBASE-26789 Automatically add default security headers to http/rest if SSL enabled
Posted by zh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zhangduo pushed a commit to branch branch-3
in repository https://gitbox.apache.org/repos/asf/hbase.git
commit 5469992b6021f18f6715d959092b122607784147
Author: Andor Molnár <an...@cloudera.com>
AuthorDate: Wed Mar 2 15:25:57 2022 +0100
HBASE-26789 Automatically add default security headers to http/rest if SSL enabled
Signed-off-by: Balazs Meszaros <me...@apache.org>
---
.../java/org/apache/hadoop/hbase/http/HttpServer.java | 7 ++++---
.../apache/hadoop/hbase/http/SecurityHeadersFilter.java | 16 +++++++---------
.../org/apache/hadoop/hbase/http/TestSSLHttpServer.java | 14 ++++++++++++++
.../java/org/apache/hadoop/hbase/rest/RESTServer.java | 6 ++++--
.../org/apache/hadoop/hbase/rest/TestRESTServerSSL.java | 7 ++++++-
5 files changed, 35 insertions(+), 15 deletions(-)
diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
index 91e7cac6ea7..d5af8df1c7f 100644
--- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
+++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
@@ -639,9 +639,10 @@ public class HttpServer implements FilterContainer {
addGlobalFilter("clickjackingprevention", ClickjackingPreventionFilter.class.getName(),
ClickjackingPreventionFilter.getDefaultParameters(conf));
- addGlobalFilter("securityheaders",
- SecurityHeadersFilter.class.getName(),
- SecurityHeadersFilter.getDefaultParameters(conf));
+ HttpConfig httpConfig = new HttpConfig(conf);
+
+ addGlobalFilter("securityheaders", SecurityHeadersFilter.class.getName(),
+ SecurityHeadersFilter.getDefaultParameters(conf, httpConfig.isSecure()));
// But security needs to be enabled prior to adding the other servlets
if (authenticationEnabled) {
diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
index a02e9a92126..b5601432fe1 100644
--- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
+++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
@@ -37,10 +37,10 @@ import org.slf4j.LoggerFactory;
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.CONFIG)
public class SecurityHeadersFilter implements Filter {
- private static final Logger LOG =
- LoggerFactory.getLogger(SecurityHeadersFilter.class);
- private static final String DEFAULT_HSTS = "";
- private static final String DEFAULT_CSP = "";
+ private static final Logger LOG = LoggerFactory.getLogger(SecurityHeadersFilter.class);
+ private static final String DEFAULT_HSTS = "max-age=63072000;includeSubDomains;preload";
+ private static final String DEFAULT_CSP =
+ "default-src https: data: 'unsafe-inline' 'unsafe-eval'";
private FilterConfig filterConfig;
@Override
@@ -70,12 +70,10 @@ public class SecurityHeadersFilter implements Filter {
public void destroy() {
}
- public static Map<String, String> getDefaultParameters(Configuration conf) {
+ public static Map<String, String> getDefaultParameters(Configuration conf, boolean isSecure) {
Map<String, String> params = new HashMap<>();
- params.put("hsts", conf.get("hbase.http.filter.hsts.value",
- DEFAULT_HSTS));
- params.put("csp", conf.get("hbase.http.filter.csp.value",
- DEFAULT_CSP));
+ params.put("hsts", conf.get("hbase.http.filter.hsts.value", isSecure ? DEFAULT_HSTS : ""));
+ params.put("csp", conf.get("hbase.http.filter.csp.value", isSecure ? DEFAULT_CSP : ""));
return params;
}
}
diff --git a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
index 91251f6a966..41dc2c093d0 100644
--- a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
+++ b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
@@ -21,9 +21,11 @@ import static org.junit.Assert.assertEquals;
import java.io.ByteArrayOutputStream;
import java.io.File;
+import java.io.IOException;
import java.io.InputStream;
import java.net.URI;
import java.net.URL;
+import java.security.GeneralSecurityException;
import javax.net.ssl.HttpsURLConnection;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.FileUtil;
@@ -71,6 +73,7 @@ public class TestSSLHttpServer extends HttpServerFunctionalTest {
serverConf = HTU.getConfiguration();
serverConf.setInt(HttpServer.HTTP_MAX_THREADS, TestHttpServer.MAX_THREADS);
+ serverConf.setBoolean(ServerConfigurationKeys.HBASE_SSL_ENABLED_KEY, true);
keystoresDir = new File(HTU.getDataTestDir("keystore").toString());
keystoresDir.mkdirs();
@@ -117,6 +120,17 @@ public class TestSSLHttpServer extends HttpServerFunctionalTest {
assertEquals("a:b\nc<:d\ne:>\n", readOut(new URL(baseUrl, "/echo?a=b&c<=d&e=>")));
}
+ @Test
+ public void testSecurityHeaders() throws IOException, GeneralSecurityException {
+ HttpsURLConnection conn = (HttpsURLConnection) baseUrl.openConnection();
+ conn.setSSLSocketFactory(clientSslFactory.createSSLSocketFactory());
+ assertEquals(HttpsURLConnection.HTTP_OK, conn.getResponseCode());
+ assertEquals("max-age=63072000;includeSubDomains;preload",
+ conn.getHeaderField("Strict-Transport-Security"));
+ assertEquals("default-src https: data: 'unsafe-inline' 'unsafe-eval'",
+ conn.getHeaderField("Content-Security-Policy"));
+ }
+
private static String readOut(URL url) throws Exception {
HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setSSLSocketFactory(clientSslFactory.createSSLSocketFactory());
diff --git a/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java b/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
index 4b707fd13a2..760f2ca8b41 100644
--- a/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
+++ b/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
@@ -288,7 +288,9 @@ public class RESTServer implements Constants {
httpConfig.setSendDateHeader(false);
ServerConnector serverConnector;
+ boolean isSecure = false;
if (conf.getBoolean(REST_SSL_ENABLED, false)) {
+ isSecure = true;
HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
httpsConfig.addCustomizer(new SecureRequestCustomizer());
@@ -375,8 +377,8 @@ public class RESTServer implements Constants {
ctxHandler.addFilter(filter, PATH_SPEC_ANY, EnumSet.of(DispatcherType.REQUEST));
}
addCSRFFilter(ctxHandler, conf);
- HttpServerUtil.addClickjackingPreventionFilter(ctxHandler, conf);
- HttpServerUtil.addSecurityHeadersFilter(ctxHandler, conf);
+ HttpServerUtil.addClickjackingPreventionFilter(ctxHandler, conf, PATH_SPEC_ANY);
+ HttpServerUtil.addSecurityHeadersFilter(ctxHandler, conf, isSecure, PATH_SPEC_ANY);
HttpServerUtil.constrainHttpMethods(ctxHandler, servlet.getConfiguration()
.getBoolean(REST_HTTP_ALLOW_OPTIONS_METHOD, REST_HTTP_ALLOW_OPTIONS_METHOD_DEFAULT));
diff --git a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
index da6dea2f4ad..f4bce03abca 100644
--- a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
+++ b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
@@ -24,7 +24,6 @@ import java.lang.reflect.Method;
import java.security.KeyPair;
import java.security.cert.X509Certificate;
import java.util.Optional;
-
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.HBaseClassTestRule;
import org.apache.hadoop.hbase.HBaseTestingUtil;
@@ -122,6 +121,12 @@ public class TestRESTServerSSL {
Response response = sslClient.get("/version", Constants.MIMETYPE_TEXT);
assertEquals(200, response.getCode());
+
+ // Default security headers
+ assertEquals("max-age=63072000;includeSubDomains;preload",
+ response.getHeader("Strict-Transport-Security"));
+ assertEquals("default-src https: data: 'unsafe-inline' 'unsafe-eval'",
+ response.getHeader("Content-Security-Policy"));
}
@Test(expected = org.apache.http.client.ClientProtocolException.class)
(hbase) 01/02: Revert "HBASE-23303 Add default security headers if SSL is enabled (#4128)"
Posted by zh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zhangduo pushed a commit to branch branch-3
in repository https://gitbox.apache.org/repos/asf/hbase.git
commit 6ddfcfd48385e892df0052f4a4eabd3aae71328a
Author: Duo Zhang <zh...@apache.org>
AuthorDate: Sat Oct 26 21:51:55 2024 +0800
Revert "HBASE-23303 Add default security headers if SSL is enabled (#4128)"
This reverts commit 87f8d9ac4e1ed9f7f31eb51208f15e37a68473a1.
---
.../java/org/apache/hadoop/hbase/http/HttpServer.java | 7 +++----
.../apache/hadoop/hbase/http/SecurityHeadersFilter.java | 17 ++++++++++-------
.../org/apache/hadoop/hbase/http/TestSSLHttpServer.java | 14 --------------
.../java/org/apache/hadoop/hbase/rest/RESTServer.java | 6 ++----
.../org/apache/hadoop/hbase/rest/TestRESTServerSSL.java | 7 +------
5 files changed, 16 insertions(+), 35 deletions(-)
diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
index d5af8df1c7f..91e7cac6ea7 100644
--- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
+++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
@@ -639,10 +639,9 @@ public class HttpServer implements FilterContainer {
addGlobalFilter("clickjackingprevention", ClickjackingPreventionFilter.class.getName(),
ClickjackingPreventionFilter.getDefaultParameters(conf));
- HttpConfig httpConfig = new HttpConfig(conf);
-
- addGlobalFilter("securityheaders", SecurityHeadersFilter.class.getName(),
- SecurityHeadersFilter.getDefaultParameters(conf, httpConfig.isSecure()));
+ addGlobalFilter("securityheaders",
+ SecurityHeadersFilter.class.getName(),
+ SecurityHeadersFilter.getDefaultParameters(conf));
// But security needs to be enabled prior to adding the other servlets
if (authenticationEnabled) {
diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
index 01c8a32c62a..a02e9a92126 100644
--- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
+++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
@@ -36,10 +36,11 @@ import org.slf4j.LoggerFactory;
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.CONFIG)
public class SecurityHeadersFilter implements Filter {
- private static final Logger LOG = LoggerFactory.getLogger(SecurityHeadersFilter.class);
- private static final String DEFAULT_HSTS = "max-age=63072000;includeSubDomains;preload";
- private static final String DEFAULT_CSP =
- "default-src https: data: 'unsafe-inline' 'unsafe-eval'";
+
+ private static final Logger LOG =
+ LoggerFactory.getLogger(SecurityHeadersFilter.class);
+ private static final String DEFAULT_HSTS = "";
+ private static final String DEFAULT_CSP = "";
private FilterConfig filterConfig;
@Override
@@ -69,10 +70,12 @@ public class SecurityHeadersFilter implements Filter {
public void destroy() {
}
- public static Map<String, String> getDefaultParameters(Configuration conf, boolean isSecure) {
+ public static Map<String, String> getDefaultParameters(Configuration conf) {
Map<String, String> params = new HashMap<>();
- params.put("hsts", conf.get("hbase.http.filter.hsts.value", isSecure ? DEFAULT_HSTS : ""));
- params.put("csp", conf.get("hbase.http.filter.csp.value", isSecure ? DEFAULT_CSP : ""));
+ params.put("hsts", conf.get("hbase.http.filter.hsts.value",
+ DEFAULT_HSTS));
+ params.put("csp", conf.get("hbase.http.filter.csp.value",
+ DEFAULT_CSP));
return params;
}
}
diff --git a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
index 41dc2c093d0..91251f6a966 100644
--- a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
+++ b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
@@ -21,11 +21,9 @@ import static org.junit.Assert.assertEquals;
import java.io.ByteArrayOutputStream;
import java.io.File;
-import java.io.IOException;
import java.io.InputStream;
import java.net.URI;
import java.net.URL;
-import java.security.GeneralSecurityException;
import javax.net.ssl.HttpsURLConnection;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.FileUtil;
@@ -73,7 +71,6 @@ public class TestSSLHttpServer extends HttpServerFunctionalTest {
serverConf = HTU.getConfiguration();
serverConf.setInt(HttpServer.HTTP_MAX_THREADS, TestHttpServer.MAX_THREADS);
- serverConf.setBoolean(ServerConfigurationKeys.HBASE_SSL_ENABLED_KEY, true);
keystoresDir = new File(HTU.getDataTestDir("keystore").toString());
keystoresDir.mkdirs();
@@ -120,17 +117,6 @@ public class TestSSLHttpServer extends HttpServerFunctionalTest {
assertEquals("a:b\nc<:d\ne:>\n", readOut(new URL(baseUrl, "/echo?a=b&c<=d&e=>")));
}
- @Test
- public void testSecurityHeaders() throws IOException, GeneralSecurityException {
- HttpsURLConnection conn = (HttpsURLConnection) baseUrl.openConnection();
- conn.setSSLSocketFactory(clientSslFactory.createSSLSocketFactory());
- assertEquals(HttpsURLConnection.HTTP_OK, conn.getResponseCode());
- assertEquals("max-age=63072000;includeSubDomains;preload",
- conn.getHeaderField("Strict-Transport-Security"));
- assertEquals("default-src https: data: 'unsafe-inline' 'unsafe-eval'",
- conn.getHeaderField("Content-Security-Policy"));
- }
-
private static String readOut(URL url) throws Exception {
HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setSSLSocketFactory(clientSslFactory.createSSLSocketFactory());
diff --git a/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java b/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
index 760f2ca8b41..4b707fd13a2 100644
--- a/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
+++ b/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
@@ -288,9 +288,7 @@ public class RESTServer implements Constants {
httpConfig.setSendDateHeader(false);
ServerConnector serverConnector;
- boolean isSecure = false;
if (conf.getBoolean(REST_SSL_ENABLED, false)) {
- isSecure = true;
HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
httpsConfig.addCustomizer(new SecureRequestCustomizer());
@@ -377,8 +375,8 @@ public class RESTServer implements Constants {
ctxHandler.addFilter(filter, PATH_SPEC_ANY, EnumSet.of(DispatcherType.REQUEST));
}
addCSRFFilter(ctxHandler, conf);
- HttpServerUtil.addClickjackingPreventionFilter(ctxHandler, conf, PATH_SPEC_ANY);
- HttpServerUtil.addSecurityHeadersFilter(ctxHandler, conf, isSecure, PATH_SPEC_ANY);
+ HttpServerUtil.addClickjackingPreventionFilter(ctxHandler, conf);
+ HttpServerUtil.addSecurityHeadersFilter(ctxHandler, conf);
HttpServerUtil.constrainHttpMethods(ctxHandler, servlet.getConfiguration()
.getBoolean(REST_HTTP_ALLOW_OPTIONS_METHOD, REST_HTTP_ALLOW_OPTIONS_METHOD_DEFAULT));
diff --git a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
index f4bce03abca..da6dea2f4ad 100644
--- a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
+++ b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
@@ -24,6 +24,7 @@ import java.lang.reflect.Method;
import java.security.KeyPair;
import java.security.cert.X509Certificate;
import java.util.Optional;
+
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.HBaseClassTestRule;
import org.apache.hadoop.hbase.HBaseTestingUtil;
@@ -121,12 +122,6 @@ public class TestRESTServerSSL {
Response response = sslClient.get("/version", Constants.MIMETYPE_TEXT);
assertEquals(200, response.getCode());
-
- // Default security headers
- assertEquals("max-age=63072000;includeSubDomains;preload",
- response.getHeader("Strict-Transport-Security"));
- assertEquals("default-src https: data: 'unsafe-inline' 'unsafe-eval'",
- response.getHeader("Content-Security-Policy"));
}
@Test(expected = org.apache.http.client.ClientProtocolException.class)