From 954dac6860c3a14ec1a7ecc4b5ffe5fd29a9e6ad Mon Sep 17 00:00:00 2001 From: Varun Saxena Date: Wed, 13 Jul 2016 07:31:49 +0530 Subject: [PATCH] YARN-5353. ResourceManager can leak delegation tokens when they are shared across apps. (Jason Lowe via Varun Saxena). --- hadoop-yarn-project/CHANGES.txt | 3 +++ .../resourcemanager/security/DelegationTokenRenewer.java | 7 +------ .../security/TestDelegationTokenRenewer.java | 3 +++ 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/hadoop-yarn-project/CHANGES.txt b/hadoop-yarn-project/CHANGES.txt index d004de6b795..4a001fda956 100644 --- a/hadoop-yarn-project/CHANGES.txt +++ b/hadoop-yarn-project/CHANGES.txt @@ -18,6 +18,9 @@ Release 2.7.4 - UNRELEASED YARN-4393. Fix intermittent test failure for TestResourceLocalizationService #testFailedDirsResourceRelease (Varun Saxana via rohithsharmaks) + YARN-5353. ResourceManager can leak delegation tokens when they are shared across + apps. (Jason Lowe via Varun Saxena) + Release 2.7.3 - UNRELEASED INCOMPATIBLE CHANGES diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/security/DelegationTokenRenewer.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/security/DelegationTokenRenewer.java index 90627d10ee6..ad96053880c 100644 --- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/security/DelegationTokenRenewer.java +++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/security/DelegationTokenRenewer.java @@ -738,7 +738,7 @@ public class DelegationTokenRenewer extends AbstractService { private void removeApplicationFromRenewal(ApplicationId applicationId) { rmContext.getSystemCredentialsForApps().remove(applicationId); - Set tokens = appTokens.get(applicationId); + Set tokens = appTokens.remove(applicationId); if (tokens != null && !tokens.isEmpty()) { synchronized (tokens) { @@ -763,15 +763,10 @@ public class DelegationTokenRenewer extends AbstractService { // cancel the token cancelToken(dttr); - it.remove(); allTokens.remove(dttr.token); } } } - - if(tokens != null && tokens.isEmpty()) { - appTokens.remove(applicationId); - } } /** diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/security/TestDelegationTokenRenewer.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/security/TestDelegationTokenRenewer.java index f2c0a301eb6..3352e277b23 100644 --- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/security/TestDelegationTokenRenewer.java +++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/security/TestDelegationTokenRenewer.java @@ -1139,5 +1139,8 @@ public class TestDelegationTokenRenewer { Assert.assertTrue(dttr.referringAppIds.isEmpty()); Assert.assertTrue(dttr.isTimerCancelled()); Assert.assertTrue(Renewer.cancelled); + + // make sure the token also has been removed from appTokens + Assert.assertFalse(renewer.getDelegationTokens().contains(token1)); } }