You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hbase.apache.org by ap...@apache.org on 2014/06/30 18:52:15 UTC
git commit: HBASE-11432 [AccessController] Remove cell first strategy
Repository: hbase
Updated Branches:
refs/heads/0.98 5f853cb89 -> 67a95ac75
HBASE-11432 [AccessController] Remove cell first strategy
Project: http://git-wip-us.apache.org/repos/asf/hbase/repo
Commit: http://git-wip-us.apache.org/repos/asf/hbase/commit/67a95ac7
Tree: http://git-wip-us.apache.org/repos/asf/hbase/tree/67a95ac7
Diff: http://git-wip-us.apache.org/repos/asf/hbase/diff/67a95ac7
Branch: refs/heads/0.98
Commit: 67a95ac75c48afdacf8a876cf767c85b49bf0113
Parents: 5f853cb
Author: Andrew Purtell <ap...@apache.org>
Authored: Mon Jun 30 08:54:47 2014 -0700
Committer: Andrew Purtell <ap...@apache.org>
Committed: Mon Jun 30 08:54:47 2014 -0700
----------------------------------------------------------------------
.../apache/hadoop/hbase/client/Mutation.java | 17 +---
.../org/apache/hadoop/hbase/client/Query.java | 16 +---
.../security/access/AccessControlFilter.java | 10 ---
.../hbase/security/access/AccessController.java | 7 +-
.../hbase/security/access/TestCellACLs.java | 84 --------------------
.../access/TestScanEarlyTermination.java | 28 -------
.../hbase/util/MultiThreadedReaderWithACL.java | 1 -
7 files changed, 10 insertions(+), 153 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hbase/blob/67a95ac7/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Mutation.java
----------------------------------------------------------------------
diff --git a/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Mutation.java b/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Mutation.java
index a51a2e2..9e6dda0 100644
--- a/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Mutation.java
+++ b/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Mutation.java
@@ -455,26 +455,18 @@ public abstract class Mutation extends OperationWithAttributes implements Row, C
}
/**
- * @return true if ACLs should be evaluated on the cell level first
+ * @deprecated No effect
*/
+ @Deprecated
public boolean getACLStrategy() {
- byte[] bytes = getAttribute(AccessControlConstants.OP_ATTRIBUTE_ACL_STRATEGY);
- if (bytes != null) {
- return Bytes.equals(bytes, AccessControlConstants.OP_ATTRIBUTE_ACL_STRATEGY_CELL_FIRST);
- }
return false;
}
/**
- * @param cellFirstStrategy true if ACLs should be evaluated on the cell
- * level first, false if ACL should first be checked at the CF and table
- * levels
+ * @deprecated No effect
*/
+ @Deprecated
public void setACLStrategy(boolean cellFirstStrategy) {
- if (cellFirstStrategy) {
- setAttribute(AccessControlConstants.OP_ATTRIBUTE_ACL_STRATEGY,
- AccessControlConstants.OP_ATTRIBUTE_ACL_STRATEGY_CELL_FIRST);
- }
}
/**
@@ -485,7 +477,6 @@ public abstract class Mutation extends OperationWithAttributes implements Row, C
return 0L;
}
-
/**
* @param row Row to check
* @throws IllegalArgumentException Thrown if <code>row</code> is empty or null or
http://git-wip-us.apache.org/repos/asf/hbase/blob/67a95ac7/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Query.java
----------------------------------------------------------------------
diff --git a/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Query.java b/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Query.java
index 5bec128..0d41934 100644
--- a/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Query.java
+++ b/hbase-client/src/main/java/org/apache/hadoop/hbase/client/Query.java
@@ -105,25 +105,17 @@ public abstract class Query extends OperationWithAttributes {
}
/**
- * @return true if ACLs should be evaluated on the cell level first
+ * @deprecated No effect
*/
+ @Deprecated
public boolean getACLStrategy() {
- byte[] bytes = getAttribute(AccessControlConstants.OP_ATTRIBUTE_ACL_STRATEGY);
- if (bytes != null) {
- return Bytes.equals(bytes, AccessControlConstants.OP_ATTRIBUTE_ACL_STRATEGY_CELL_FIRST);
- }
return false;
}
/**
- * @param cellFirstStrategy true if ACLs should be evaluated on the cell
- * level first, false if ACL should first be checked at the CF and table
- * levels
+ * @deprecated No effect
*/
+ @Deprecated
public void setACLStrategy(boolean cellFirstStrategy) {
- if (cellFirstStrategy) {
- setAttribute(AccessControlConstants.OP_ATTRIBUTE_ACL_STRATEGY,
- AccessControlConstants.OP_ATTRIBUTE_ACL_STRATEGY_CELL_FIRST);
- }
}
}
http://git-wip-us.apache.org/repos/asf/hbase/blob/67a95ac7/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessControlFilter.java
----------------------------------------------------------------------
diff --git a/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessControlFilter.java b/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessControlFilter.java
index bec1030..d866784 100644
--- a/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessControlFilter.java
+++ b/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessControlFilter.java
@@ -53,8 +53,6 @@ class AccessControlFilter extends FilterBase {
CHECK_TABLE_AND_CF_ONLY,
/** Cell permissions can override table or CF permissions */
CHECK_CELL_DEFAULT,
- /** Cell permissions must authorize */
- CHECK_CELL_FIRST,
};
private TableAuthManager authManager;
@@ -131,14 +129,6 @@ class AccessControlFilter extends FilterBase {
}
}
break;
- // Cell permissions must authorize
- case CHECK_CELL_FIRST: {
- if (authManager.authorize(user, table, cell, Permission.Action.READ) &&
- authManager.authorize(user, table, family, qualifier, Permission.Action.READ)) {
- return ReturnCode.INCLUDE;
- }
- }
- break;
default:
throw new RuntimeException("Unhandled strategy " + strategy);
}
http://git-wip-us.apache.org/repos/asf/hbase/blob/67a95ac7/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
----------------------------------------------------------------------
diff --git a/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java b/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
index 03e8094..588a216 100644
--- a/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
+++ b/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
@@ -1347,8 +1347,7 @@ public class AccessController extends BaseRegionObserver
// filter) but that's the price of backwards compatibility.
if (hasFamilyQualifierPermission(user, Action.READ, env, families)) {
Filter ourFilter = new AccessControlFilter(authManager, user, table,
- query.getACLStrategy() ? AccessControlFilter.Strategy.CHECK_CELL_FIRST :
- AccessControlFilter.Strategy.CHECK_TABLE_AND_CF_ONLY,
+ AccessControlFilter.Strategy.CHECK_TABLE_AND_CF_ONLY,
cfVsMaxVersions);
// wrap any existing filter
if (filter != null) {
@@ -1375,9 +1374,7 @@ public class AccessController extends BaseRegionObserver
// allowed. We will not throw an AccessDeniedException. This is a
// behavioral change since 0.96.
Filter ourFilter = new AccessControlFilter(authManager, user, table,
- query.getACLStrategy() ? AccessControlFilter.Strategy.CHECK_CELL_FIRST :
- AccessControlFilter.Strategy.CHECK_CELL_DEFAULT,
- cfVsMaxVersions);
+ AccessControlFilter.Strategy.CHECK_CELL_DEFAULT, cfVsMaxVersions);
// wrap any existing filter
if (filter != null) {
ourFilter = new FilterList(FilterList.Operator.MUST_PASS_ALL,
http://git-wip-us.apache.org/repos/asf/hbase/blob/67a95ac7/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestCellACLs.java
----------------------------------------------------------------------
diff --git a/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestCellACLs.java b/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestCellACLs.java
index 7b48acd..f48b454 100644
--- a/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestCellACLs.java
+++ b/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestCellACLs.java
@@ -447,90 +447,6 @@ public class TestCellACLs extends SecureTestUtil {
}, USER_OTHER);
}
- @Test
- public void testCellStrategy() throws Exception {
- // Set up our test actions
- AccessTestAction readQ1Default = new AccessTestAction() {
- @Override
- public Object run() throws Exception {
- HTable t = new HTable(conf, TEST_TABLE.getTableName());
- try {
- return t.get(new Get(TEST_ROW).addColumn(TEST_FAMILY, TEST_Q1));
- } finally {
- t.close();
- }
- }
- };
- AccessTestAction readQ2Default = new AccessTestAction() {
- @Override
- public Object run() throws Exception {
- HTable t = new HTable(conf, TEST_TABLE.getTableName());
- try {
- return t.get(new Get(TEST_ROW).addColumn(TEST_FAMILY, TEST_Q2));
- } finally {
- t.close();
- }
- }
- };
- AccessTestAction readQ1CellFirst = new AccessTestAction() {
- @Override
- public Object run() throws Exception {
- HTable t = new HTable(conf, TEST_TABLE.getTableName());
- try {
- Get get = new Get(TEST_ROW).addColumn(TEST_FAMILY, TEST_Q1);
- get.setACLStrategy(true);
- return t.get(get);
- } finally {
- t.close();
- }
- }
- };
-
- // Add test data
- verifyAllowed(new AccessTestAction() {
- @Override
- public Object run() throws Exception {
- HTable t = new HTable(conf, TEST_TABLE.getTableName());
- try {
- Put p;
- // The empty permission set on Q1
- p = new Put(TEST_ROW).add(TEST_FAMILY, TEST_Q1, ZERO);
- p.setACL(USER_OTHER.getShortName(), new Permission());
- t.put(p);
- // Read permissions on Q2
- p = new Put(TEST_ROW).add(TEST_FAMILY, TEST_Q2, ZERO);
- p.setACL(USER_OTHER.getShortName(), new Permission(Action.READ));
- t.put(p);
- } finally {
- t.close();
- }
- return null;
- }
- }, USER_OWNER);
-
- // A read by USER_OTHER will be denied with the default cell strategy as
- // there is no visibility without a grant and a cell ACL giving
- // explicit permission
- verifyDenied(readQ1Default, USER_OTHER);
-
- // A read will be allowed by the default cell strategy if there is a cell
- // ACL giving explicit permission.
- verifyAllowed(readQ2Default, USER_OTHER);
-
- // Grant read access to USER_OTHER
- grantOnTable(TEST_UTIL, USER_OTHER.getShortName(), TEST_TABLE.getTableName(),
- TEST_FAMILY, null, Action.READ);
-
- // A read by USER_OTHER will now be allowed with the default cell strategy
- // because we have a CF level grant and we take the union of permissions.
- verifyAllowed(readQ1Default, USER_OTHER);
-
- // A read by USER_OTHER will be denied with the cell first strategy
- // because the empty perm set for USER_OTHER in the cell ACL there
- // revokes access.
- verifyDenied(readQ1CellFirst, USER_OTHER);
- }
-
@After
public void tearDown() throws Exception {
// Clean the _acl_ table
http://git-wip-us.apache.org/repos/asf/hbase/blob/67a95ac7/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestScanEarlyTermination.java
----------------------------------------------------------------------
diff --git a/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestScanEarlyTermination.java b/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestScanEarlyTermination.java
index 215dcaf..ab09910 100644
--- a/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestScanEarlyTermination.java
+++ b/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestScanEarlyTermination.java
@@ -267,33 +267,5 @@ public class TestScanEarlyTermination extends SecureTestUtil {
}
}
}, USER_OTHER);
-
- // A scan of FAMILY1 and FAMILY2 will produce combined results. If we use
- // a cell first strategy then cell ACLs come into effect. In FAMILY2, that
- // cell ACL on Q1 now grants access and the empty permission set on Q2 now
- // denies access.
- verifyAllowed(new AccessTestAction() {
- @Override
- public Object run() throws Exception {
- // force a new RS connection
- conf.set("testkey", UUID.randomUUID().toString());
- HTable t = new HTable(conf, TEST_TABLE.getTableName());
- try {
- Scan scan = new Scan();
- scan.setACLStrategy(true);
- Result result = t.getScanner(scan).next();
- if (result != null) {
- assertTrue("Improper exclusion", result.containsColumn(TEST_FAMILY1, TEST_Q1));
- assertTrue("Improper exclusion", result.containsColumn(TEST_FAMILY2, TEST_Q1));
- assertFalse("Improper inclusion", result.containsColumn(TEST_FAMILY2, TEST_Q2));
- return result.listCells();
- }
- return null;
- } finally {
- t.close();
- }
- }
- }, USER_OTHER);
-
}
}
http://git-wip-us.apache.org/repos/asf/hbase/blob/67a95ac7/hbase-server/src/test/java/org/apache/hadoop/hbase/util/MultiThreadedReaderWithACL.java
----------------------------------------------------------------------
diff --git a/hbase-server/src/test/java/org/apache/hadoop/hbase/util/MultiThreadedReaderWithACL.java b/hbase-server/src/test/java/org/apache/hadoop/hbase/util/MultiThreadedReaderWithACL.java
index 99b4f1d..068f120 100644
--- a/hbase-server/src/test/java/org/apache/hadoop/hbase/util/MultiThreadedReaderWithACL.java
+++ b/hbase-server/src/test/java/org/apache/hadoop/hbase/util/MultiThreadedReaderWithACL.java
@@ -95,7 +95,6 @@ public class MultiThreadedReaderWithACL extends MultiThreadedReader {
public Object run() throws Exception {
HTable localTable = null;
try {
- get.setACLStrategy(true);
Result result = null;
int specialPermCellInsertionFactor = Integer.parseInt(dataGenerator.getArgs()[2]);
int mod = ((int) keyToRead % userNames.length);