Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "HADOOP-14241. Add ADLS sensitive config keys to default list. Contributed by John Zhuge." 

This reverts commit 935ea448c1.
This commit is contained in:
John Zhuge 2017-04-19 13:34:43 -07:00
parent 935ea448c1
commit e813110734
4 changed files with 12 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/conf/ConfigRedactor.java
View File

@ -42,8 +42,7 @@ public class ConfigRedactor {
String sensitiveRegexList = conf.get( String sensitiveRegexList = conf.get(
HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS, HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS,
HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS_DEFAULT); HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS_DEFAULT);
List<String> sensitiveRegexes = List<String> sensitiveRegexes = Arrays.asList(sensitiveRegexList.split(","));
Arrays.asList(sensitiveRegexList.trim().split("[,\\s]+"));
compiledPatterns = new ArrayList<Pattern>(); compiledPatterns = new ArrayList<Pattern>();
for (String regex : sensitiveRegexes) { for (String regex : sensitiveRegexes) {
Pattern p = Pattern.compile(regex); Pattern p = Pattern.compile(regex);

16
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/CommonConfigurationKeysPublic.java
View File

@ -737,14 +737,12 @@ public class CommonConfigurationKeysPublic {
public static final String HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS = public static final String HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS =
"hadoop.security.sensitive-config-keys"; "hadoop.security.sensitive-config-keys";
public static final String HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS_DEFAULT = public static final String HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS_DEFAULT =
String.join(",", "secret$" + "," +
"secret$", "password$" + "," +
"password$", "ssl.keystore.pass$" + "," +
"ssl.keystore.pass$", "fs.s3.*[Ss]ecret.?[Kk]ey" + "," +
"fs.s3.*[Ss]ecret.?[Kk]ey", "fs.azure\\.account.key.*" + "," +
"fs.azure\\.account.key.*", "dfs.webhdfs.oauth2.[a-z]+.token" + "," +
"credential$", HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS;
"oauth.*token$",
HADOOP_SECURITY_SENSITIVE_CONFIG_KEYS);
} }

15
hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
View File

@ -432,18 +432,9 @@
<property> <property>
<name>hadoop.security.sensitive-config-keys</name> <name>hadoop.security.sensitive-config-keys</name>
<value> <value>secret$,password$,ssl.keystore.pass$,fs.s3.*[Ss]ecret.?[Kk]ey,fs.azure.account.key.*,dfs.webhdfs.oauth2.[a-z]+.token,hadoop.security.sensitive-config-keys</value>
secret$ <description>A comma-separated list of regular expressions to match against
password$ configuration keys that should be redacted where appropriate, for
ssl.keystore.pass$
fs.s3.*[Ss]ecret.?[Kk]ey
fs.azure.account.key.*
credential$
oauth.*token$
hadoop.security.sensitive-config-keys
</value>
<description>A comma-separated or multi-line list of regular expressions to
match configuration keys that should be redacted where appropriate, for
example, when logging modified properties during a reconfiguration, example, when logging modified properties during a reconfiguration,
private credentials should not be logged. private credentials should not be logged.
</description> </description>

17
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/conf/TestConfigRedactor.java
View File

@ -34,30 +34,15 @@ public class TestConfigRedactor {
private static final String ORIGINAL_VALUE = "Hello, World!"; private static final String ORIGINAL_VALUE = "Hello, World!";
@Test @Test
public void testRedactWithCoreDefault() throws Exception { public void redact() throws Exception {
Configuration conf = new Configuration(); Configuration conf = new Configuration();
testRedact(conf);
}
@Test
public void testRedactNoCoreDefault() throws Exception {
Configuration conf = new Configuration(false);
testRedact(conf);
}
private void testRedact(Configuration conf) throws Exception {
ConfigRedactor redactor = new ConfigRedactor(conf); ConfigRedactor redactor = new ConfigRedactor(conf);
String processedText; String processedText;
List<String> sensitiveKeys = Arrays.asList( List<String> sensitiveKeys = Arrays.asList(
"fs.s3a.secret.key", "fs.s3a.secret.key",
"fs.s3a.bucket.BUCKET.secret.key",
"fs.s3n.awsSecretKey", "fs.s3n.awsSecretKey",
"fs.azure.account.key.abcdefg.blob.core.windows.net", "fs.azure.account.key.abcdefg.blob.core.windows.net",
"fs.adl.oauth2.refresh.token",
"fs.adl.oauth2.credential",
"dfs.adls.oauth2.refresh.token",
"dfs.adls.oauth2.credential",
"dfs.webhdfs.oauth2.access.token", "dfs.webhdfs.oauth2.access.token",
"dfs.webhdfs.oauth2.refresh.token", "dfs.webhdfs.oauth2.refresh.token",
"ssl.server.keystore.keypassword", "ssl.server.keystore.keypassword",