diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt index e64aa999ee..9ee3bb8e71 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt +++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt @@ -60,6 +60,8 @@ Trunk (unreleased changes) HDFS-3002. TestNameNodeMetrics need not wait for metrics update. (suresh) + HDFS-3016. Security in unit tests. (Jaimin Jetly via jitendra) + OPTIMIZATIONS HDFS-2477. Optimize computing the diff between a block report and the diff --git a/hadoop-hdfs-project/hadoop-hdfs/pom.xml b/hadoop-hdfs-project/hadoop-hdfs/pom.xml index 6fdfb64307..0b4da80e8a 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/pom.xml +++ b/hadoop-hdfs-project/hadoop-hdfs/pom.xml @@ -29,6 +29,7 @@ hdfs + ../../hadoop-common-project/hadoop-common/src/test/resources/kdc true @@ -113,6 +114,16 @@ + + org.apache.maven.plugins + maven-surefire-plugin + + + ${startKdc} + ${kdc.resource.dir} + + + org.codehaus.mojo.jspc jspc-maven-plugin @@ -513,5 +524,85 @@ + + + + startKdc + + + startKdc + true + + + + + + org.apache.maven.plugins + maven-enforcer-plugin + + + enforce-os + + enforce + + + + + + mac + unix + + + true + + + + + + org.apache.maven.plugins + maven-antrun-plugin + + + compile + compile + + run + + + + + + + + + + + + + + + + + + + + + killKdc + test + + run + + + + + + + + + + + + + diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/TestSecureNameNode.java b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/TestSecureNameNode.java new file mode 100644 index 0000000000..440574e14e --- /dev/null +++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/TestSecureNameNode.java @@ -0,0 +1,97 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with this + * work for additional information regarding copyright ownership. The ASF + * licenses this file to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations under + * the License. + */ + +package org.apache.hadoop.hdfs.server.namenode; + +import java.io.IOException; +import java.security.PrivilegedExceptionAction; + +import junit.framework.Assert; +import org.apache.hadoop.conf.Configuration; +import org.apache.hadoop.fs.CommonConfigurationKeys; +import org.apache.hadoop.fs.FileSystem; +import org.apache.hadoop.fs.Path; +import org.apache.hadoop.fs.permission.FsPermission; +import org.apache.hadoop.hdfs.DFSConfigKeys; +import org.apache.hadoop.hdfs.HdfsConfiguration; +import org.apache.hadoop.hdfs.MiniDFSCluster; +import org.apache.hadoop.security.TestUGIWithSecurityOn; +import org.apache.hadoop.security.UserGroupInformation; +import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod; +import org.junit.Assume; +import org.junit.Before; +import org.junit.Test; + +public class TestSecureNameNode { + final static private int NUM_OF_DATANODES = 0; + + @Before + public void testKdcRunning() { + // Tests are skipped if KDC is not running + Assume.assumeTrue(TestUGIWithSecurityOn.isKdcRunning()); + } + + @Test + public void testName() throws IOException, InterruptedException { + MiniDFSCluster cluster = null; + try { + String keyTabDir = System.getProperty("kdc.resource.dir") + "/keytabs"; + String nn1KeytabPath = keyTabDir + "/nn1.keytab"; + String user1KeyTabPath = keyTabDir + "/user1.keytab"; + Configuration conf = new HdfsConfiguration(); + conf.set(CommonConfigurationKeys.HADOOP_SECURITY_AUTHENTICATION, + "kerberos"); + conf.set(DFSConfigKeys.DFS_NAMENODE_USER_NAME_KEY, + "nn1/localhost@EXAMPLE.COM"); + conf.set(DFSConfigKeys.DFS_NAMENODE_KEYTAB_FILE_KEY, nn1KeytabPath); + + cluster = new MiniDFSCluster.Builder(conf).numDataNodes(NUM_OF_DATANODES) + .build(); + final MiniDFSCluster clusterRef = cluster; + cluster.waitActive(); + FileSystem fsForCurrentUser = cluster.getFileSystem(); + fsForCurrentUser.mkdirs(new Path("/tmp")); + fsForCurrentUser.setPermission(new Path("/tmp"), new FsPermission( + (short) 511)); + + UserGroupInformation ugi = UserGroupInformation + .loginUserFromKeytabAndReturnUGI("user1@EXAMPLE.COM", user1KeyTabPath); + FileSystem fs = ugi.doAs(new PrivilegedExceptionAction() { + @Override + public FileSystem run() throws Exception { + return clusterRef.getFileSystem(); + } + }); + try { + Path p = new Path("/users"); + fs.mkdirs(p); + Assert.fail("user1 must not be allowed to write in /"); + } catch (IOException expected) { + } + + Path p = new Path("/tmp/alpha"); + fs.mkdirs(p); + Assert.assertNotNull(fs.listStatus(p)); + Assert.assertEquals(AuthenticationMethod.KERBEROS, + ugi.getAuthenticationMethod()); + } finally { + if (cluster != null) { + cluster.shutdown(); + } + } + } +} diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/krb5.conf b/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/krb5.conf index 121ac6d9b9..20205d1908 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/krb5.conf +++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/resources/krb5.conf @@ -14,15 +14,24 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -# +# + [libdefaults] - default_realm = APACHE.ORG - udp_preference_limit = 1 - extra_addresses = 127.0.0.1 + default_realm = EXAMPLE.COM + allow_weak_crypto = true + default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1 + default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1 + [realms] - APACHE.ORG = { - admin_server = localhost:88 - kdc = localhost:88 - } + EXAMPLE.COM = { + kdc = localhost:60088 + } + [domain_realm] - localhost = APACHE.ORG + .example.com = EXAMPLE.COM + example.com = EXAMPLE.COM + +[login] + krb4_convert = true + krb4_get_tickets = false +