big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "HDFS-14305. Fix serial number calculation in BlockTokenSecretManager to avoid token key ID overlap between NameNodes. Contributed by He Xiaoqiao."

Browse Source 
This reverts commit 0feba4396f.
This commit is contained in:
Konstantin V Shvachko 2019-09-29 13:11:31 -07:00
parent c0edc848a8
commit 760b523e58
2 changed files with 7 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/security/token/block/BlockTokenSecretManager.java
View File

@ -65,17 +65,6 @@ public class BlockTokenSecretManager extends
public static final Token<BlockTokenIdentifier> DUMMY_TOKEN = new Token<BlockTokenIdentifier>(); public static final Token<BlockTokenIdentifier> DUMMY_TOKEN = new Token<BlockTokenIdentifier>();
/**
* In order to prevent serial No. of different NameNode from overlapping,
* Using 6 bits (identify 64=2^6 namenodes, and presuppose that no scenario
* where deploy more than 64 namenodes (include ANN, SBN, Observers, etc.)
* in one namespace) to identify index of NameNode, and the remainder 26 bits
* auto-incr to change the serial No.
*/
@VisibleForTesting
public static final int NUM_VALID_BITS = 26;
private static final int LOW_MASK = (1 << NUM_VALID_BITS) - 1;
private final boolean isMaster; private final boolean isMaster;
/** /**
@ -92,8 +81,8 @@ public class BlockTokenSecretManager extends
private String blockPoolId; private String blockPoolId;
private final String encryptionAlgorithm; private final String encryptionAlgorithm;
private final int nnIndex; private final int intRange;
private final int nnRangeStart;
private final boolean useProto; private final boolean useProto;
private final boolean shouldWrapQOP; private final boolean shouldWrapQOP;
@ -152,7 +141,8 @@ public BlockTokenSecretManager(long keyUpdateInterval,
private BlockTokenSecretManager(boolean isMaster, long keyUpdateInterval, private BlockTokenSecretManager(boolean isMaster, long keyUpdateInterval,
long tokenLifetime, String blockPoolId, String encryptionAlgorithm, long tokenLifetime, String blockPoolId, String encryptionAlgorithm,
int nnIndex, int numNNs, boolean useProto, boolean shouldWrapQOP) { int nnIndex, int numNNs, boolean useProto, boolean shouldWrapQOP) {
this.nnIndex = nnIndex; this.intRange = Integer.MAX_VALUE / numNNs;
this.nnRangeStart = intRange * nnIndex;
this.isMaster = isMaster; this.isMaster = isMaster;
this.keyUpdateInterval = keyUpdateInterval; this.keyUpdateInterval = keyUpdateInterval;
this.tokenLifetime = tokenLifetime; this.tokenLifetime = tokenLifetime;
@ -167,7 +157,8 @@ private BlockTokenSecretManager(boolean isMaster, long keyUpdateInterval,
@VisibleForTesting @VisibleForTesting
public synchronized void setSerialNo(int serialNo) { public synchronized void setSerialNo(int serialNo) {
this.serialNo = (serialNo & LOW_MASK) | (nnIndex << NUM_VALID_BITS); // we mod the serial number by the range and then add that times the index
this.serialNo = (serialNo % intRange) + (nnRangeStart);
} }
public void setBlockPoolId(String blockPoolId) { public void setBlockPoolId(String blockPoolId) {

31
hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestFailoverWithBlockTokensEnabled.java
View File

@ -116,36 +116,7 @@ private void setAndCheckSerialNumber(int serialNumber, BlockTokenSecretManager..
} }
} }
} }
@Test
public void testSerialNumberMaskMatchIndex() {
BlockTokenSecretManager btsm1 = cluster.getNamesystem(0).getBlockManager()
.getBlockTokenSecretManager();
BlockTokenSecretManager btsm2 = cluster.getNamesystem(1).getBlockManager()
.getBlockTokenSecretManager();
BlockTokenSecretManager btsm3 = cluster.getNamesystem(2).getBlockManager()
.getBlockTokenSecretManager();
int[] testSet = {0, Integer.MAX_VALUE, Integer.MIN_VALUE,
Integer.MAX_VALUE / 2, Integer.MIN_VALUE / 2,
Integer.MAX_VALUE / 3, Integer.MIN_VALUE / 3};
for (int i = 0; i < testSet.length; i++) {
setAndCheckHighBitsSerialNumber(testSet[i], btsm1, 0);
setAndCheckHighBitsSerialNumber(testSet[i], btsm2, 1);
setAndCheckHighBitsSerialNumber(testSet[i], btsm3, 2);
}
}
/**
* Check mask of serial number if equal to index of NameNode.
*/
private void setAndCheckHighBitsSerialNumber(int serialNumber,
BlockTokenSecretManager btsm, int nnIndex) {
btsm.setSerialNo(serialNumber);
int serialNo = btsm.getSerialNoForTesting();
int index = serialNo >> BlockTokenSecretManager.NUM_VALID_BITS;
assertEquals(index, nnIndex);
}
@Test @Test
public void ensureInvalidBlockTokensAreRejected() throws IOException, public void ensureInvalidBlockTokensAreRejected() throws IOException,
URISyntaxException { URISyntaxException {