Apache/hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HDFS-14305. Fix serial number calculation in BlockTokenSecretManager to avoid token key ID overlap between NameNodes. Contributed by Konstantin V Shvachko.

Browse Source
This commit is contained in:
Konstantin V Shvachko 2019-09-30 18:04:16 -07:00
parent 9482da7053
commit dc2b838a8e
3 changed files with 34 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/security/token/block/BlockTokenSecretManager.java
View File

@ -116,8 +116,6 @@ public BlockTokenSecretManager(long keyUpdateInterval,
encryptionAlgorithm, nnIndex, numNNs, shouldWrapQOP);
Preconditions.checkArgument(nnIndex >= 0);
Preconditions.checkArgument(numNNs > 0);
setSerialNo(new SecureRandom().nextInt());
generateKeys();
}
public BlockTokenSecretManager(long keyUpdateInterval,
@ -140,13 +138,19 @@ private BlockTokenSecretManager(boolean isMaster, long keyUpdateInterval,
this.encryptionAlgorithm = encryptionAlgorithm;
this.shouldWrapQOP = shouldWrapQOP;
this.timer = new Timer();
setSerialNo(new SecureRandom().nextInt(Integer.MAX_VALUE));
LOG.info("Block token key range: [" +
nnRangeStart + ", " + (nnRangeStart + intRange) + ")");
generateKeys();
}
@VisibleForTesting
public synchronized void setSerialNo(int serialNo) {
public synchronized void setSerialNo(int nextNo) {
// we mod the serial number by the range and then add that times the index
this.serialNo = (serialNo % intRange) + (nnRangeStart);
this.serialNo = (nextNo % intRange) + (nnRangeStart);
assert serialNo >= nnRangeStart && serialNo < (nnRangeStart + intRange) :
"serialNo " + serialNo + " is not in the designated range: [" +
nnRangeStart + ", " + (nnRangeStart + intRange) + ")";
}
public void setBlockPoolId(String blockPoolId) {

24
hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/security/token/block/TestBlockToken.java
View File

@ -411,4 +411,28 @@ public void testBlockTokenInLastLocatedBlock() throws IOException,
cluster.shutdown();
}
}
/**
* Verify that block token serialNo is always within the range designated to
* to the NameNode.
*/
@Test
public void testBlockTokenRanges() throws IOException {
final int interval = 1024;
final int numNNs = Integer.MAX_VALUE / interval;
for(int nnIdx = 0; nnIdx < 64; nnIdx++) {
BlockTokenSecretManager sm = new BlockTokenSecretManager(
blockKeyUpdateInterval, blockTokenLifetime, nnIdx, numNNs,
"fake-pool", null, false);
int rangeStart = nnIdx * interval;
for(int i = 0; i < interval * 3; i++) {
int serialNo = sm.getSerialNoForTesting();
assertTrue(
"serialNo " + serialNo + " is not in the designated range: [" +
rangeStart + ", " + (rangeStart + interval) + ")",
serialNo >= rangeStart && serialNo < (rangeStart + interval));
sm.updateKeys();
}
}
}
}

5
hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestFailoverWithBlockTokensEnabled.java
View File

@ -92,11 +92,10 @@ public void ensureSerialNumbersNeverOverlap() {
setAndCheckSerialNumber(0, btsm1, btsm2, btsm3);
setAndCheckSerialNumber(Integer.MAX_VALUE, btsm1, btsm2, btsm3);
setAndCheckSerialNumber(Integer.MIN_VALUE, btsm1, btsm2, btsm3);
setAndCheckSerialNumber(Integer.MAX_VALUE / 2, btsm1, btsm2, btsm3);
setAndCheckSerialNumber(Integer.MIN_VALUE / 2, btsm1, btsm2, btsm3);
setAndCheckSerialNumber(Integer.MAX_VALUE / 3, btsm1, btsm2, btsm3);
setAndCheckSerialNumber(Integer.MIN_VALUE / 3, btsm1, btsm2, btsm3);
setAndCheckSerialNumber(Integer.MAX_VALUE / 171717,
btsm1, btsm2, btsm3);
}
private void setAndCheckSerialNumber(int serialNumber, BlockTokenSecretManager... btsms) {