From common-commits-return-98704-archive-asf-public=cust-asf.ponee.io@hadoop.apache.org Sat May 2 13:10:06 2020 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by mx-eu-01.ponee.io (Postfix) with SMTP id 7A94B18064A for ; Sat, 2 May 2020 15:10:06 +0200 (CEST) Received: (qmail 82525 invoked by uid 500); 2 May 2020 13:10:05 -0000 Mailing-List: contact common-commits-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list common-commits@hadoop.apache.org Received: (qmail 82516 invoked by uid 99); 2 May 2020 13:10:05 -0000 Received: from ec2-52-202-80-70.compute-1.amazonaws.com (HELO gitbox.apache.org) (52.202.80.70) by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 02 May 2020 13:10:05 +0000 Received: by gitbox.apache.org (ASF Mail Server at gitbox.apache.org, from userid 33) id 7BACA8BFAB; Sat, 2 May 2020 13:10:05 +0000 (UTC) Date: Sat, 02 May 2020 13:10:05 +0000 To: "common-commits@hadoop.apache.org" Subject: [hadoop] branch branch-2.9 updated: SPNEGO TLS verification MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Message-ID: <158842500523.30891.11897319096549084753@gitbox.apache.org> From: aajisaka@apache.org X-Git-Host: gitbox.apache.org X-Git-Repo: hadoop X-Git-Refname: refs/heads/branch-2.9 X-Git-Reftype: branch X-Git-Oldrev: 058e57fb4110b937c6f8facd56d70bc3ea1de593 X-Git-Newrev: c1925b2310625a635692ac8039ca15219cdf59bc X-Git-Rev: c1925b2310625a635692ac8039ca15219cdf59bc X-Git-NotificationType: ref_changed_plus_diff X-Git-Multimail-Version: 1.5.dev Auto-Submitted: auto-generated This is an automated email from the ASF dual-hosted git repository. aajisaka pushed a commit to branch branch-2.9 in repository https://gitbox.apache.org/repos/asf/hadoop.git The following commit(s) were added to refs/heads/branch-2.9 by this push: new c1925b2 SPNEGO TLS verification c1925b2 is described below commit c1925b2310625a635692ac8039ca15219cdf59bc Author: Eric Yang AuthorDate: Tue Mar 31 13:37:55 2020 -0400 SPNEGO TLS verification Signed-off-by: Akira Ajisaka (cherry picked from commit ba66f3b454a5f6ea84f2cf7ac0082c555e2954a7) Conflicts: hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java (cherry picked from commit 28715b584ab25dedc600cc2d5d22866865026bf7) --- .../main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java b/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java index 283ba1b..913cc1d 100644 --- a/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java +++ b/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/WebHdfsFileSystem.java @@ -139,6 +139,7 @@ public class WebHdfsFileSystem extends FileSystem + "/v" + VERSION; public static final String EZ_HEADER = "X-Hadoop-Accept-EZ"; public static final String FEFINFO_HEADER = "X-Hadoop-feInfo"; + public static final String DFS_HTTP_POLICY_KEY = "dfs.http.policy"; /** * Default connection factory may be overridden in tests to use smaller @@ -168,6 +169,7 @@ public class WebHdfsFileSystem extends FileSystem new ObjectMapper().reader(Map.class); private DFSOpsCountStatistics storageStatistics; + private boolean isTLSKrb; /** * Return the protocol scheme for the FileSystem. @@ -230,6 +232,8 @@ public class WebHdfsFileSystem extends FileSystem .newDefaultURLConnectionFactory(connectTimeout, readTimeout, conf); } + this.isTLSKrb = "HTTPS_ONLY".equals(conf.get(DFS_HTTP_POLICY_KEY)); + ugi = UserGroupInformation.getCurrentUser(); this.uri = URI.create(uri.getScheme() + "://" + uri.getAuthority()); this.nnAddrs = resolveNNAddr(); @@ -688,6 +692,11 @@ public class WebHdfsFileSystem extends FileSystem //redirect hostname and port redirectHost = null; + if (url.getProtocol().equals(getTransportScheme()) && + UserGroupInformation.isSecurityEnabled() && + isTLSKrb) { + throw new IOException("Access denied: dfs.http.policy is HTTPS_ONLY."); + } // resolve redirects for a DN operation unless already resolved if (op.getRedirect() && !redirected) { --------------------------------------------------------------------- To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org For additional commands, e-mail: common-commits-help@hadoop.apache.org