big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HDDS-29. Fix TestStorageContainerManager#testRpcPermission. Contributed by Mukul Kumar Singh.

Browse Source
This commit is contained in:
Xiaoyu Yao 2018-05-14 09:09:25 -07:00
parent 8a2b5914f3
commit fc5d49c202
3 changed files with 28 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/server/SCMClientProtocolServer.java
View File

@ -40,6 +40,7 @@
import org.apache.hadoop.ipc.RPC;
import org.apache.hadoop.ozone.protocolPB
.StorageContainerLocationProtocolServerSideTranslatorPB;
import org.apache.hadoop.security.UserGroupInformation;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@ -137,17 +138,26 @@ public void join() throws InterruptedException {
getClientRpcServer().join();
}
@VisibleForTesting
public String getRpcRemoteUsername() {
UserGroupInformation user = ProtobufRpcEngine.Server.getRemoteUser();
return user == null ? null : user.getUserName();
}
@Override
public ContainerInfo allocateContainer(HddsProtos.ReplicationType
replicationType, HddsProtos.ReplicationFactor factor,
String owner) throws IOException {
getScm().checkAdminAccess();
String remoteUser = getRpcRemoteUsername();
getScm().checkAdminAccess(remoteUser);
return scm.getScmContainerManager()
.allocateContainer(replicationType, factor, owner);
}
@Override
public ContainerInfo getContainer(long containerID) throws IOException {
String remoteUser = getRpcRemoteUsername();
getScm().checkAdminAccess(remoteUser);
return scm.getScmContainerManager()
.getContainer(containerID);
}
@ -161,7 +171,8 @@ public List<ContainerInfo> listContainer(long startContainerID,
@Override
public void deleteContainer(long containerID) throws IOException {
getScm().checkAdminAccess();
String remoteUser = getRpcRemoteUsername();
getScm().checkAdminAccess(remoteUser);
scm.getScmContainerManager().deleteContainer(containerID);
}

9
hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/server/StorageContainerManager.java
View File

@ -620,14 +620,7 @@ public BlockManager getScmBlockManager() {
return scmBlockManager;
}
@VisibleForTesting
public String getPpcRemoteUsername() {
UserGroupInformation user = ProtobufRpcEngine.Server.getRemoteUser();
return user == null ? null : user.getUserName();
}
public void checkAdminAccess() throws IOException {
String remoteUser = getPpcRemoteUsername();
public void checkAdminAccess(String remoteUser) throws IOException {
if (remoteUser != null) {
if (!scmAdminUsernames.contains(remoteUser)) {
throw new IOException(

27
hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestStorageContainerManager.java
View File

@ -23,6 +23,7 @@
import org.apache.commons.lang3.RandomUtils;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.scm.container.common.helpers.ContainerInfo;
import org.apache.hadoop.hdds.scm.server.SCMClientProtocolServer;
import org.apache.hadoop.hdds.scm.server.SCMStorage;
import org.apache.hadoop.hdds.scm.node.NodeManager;
import org.apache.hadoop.ozone.container.ContainerTestHelper;
@ -107,19 +108,19 @@ private void testRpcPermissionWithConf(
MiniOzoneCluster cluster = MiniOzoneCluster.newBuilder(ozoneConf).build();
cluster.waitForClusterToBeReady();
try {
String fakeUser = fakeRemoteUsername;
StorageContainerManager mockScm = Mockito.spy(
cluster.getStorageContainerManager());
Mockito.when(mockScm.getPpcRemoteUsername())
.thenReturn(fakeUser);
SCMClientProtocolServer mockClientServer = Mockito.spy(
cluster.getStorageContainerManager().getClientProtocolServer());
Mockito.when(mockClientServer.getRpcRemoteUsername())
.thenReturn(fakeRemoteUsername);
try {
mockScm.getClientProtocolServer().deleteContainer(
mockClientServer.deleteContainer(
ContainerTestHelper.getTestContainerID());
fail("Operation should fail, expecting an IOException here.");
} catch (Exception e) {
if (expectPermissionDenied) {
verifyPermissionDeniedException(e, fakeUser);
verifyPermissionDeniedException(e, fakeRemoteUsername);
} else {
// If passes permission check, it should fail with
// container not exist exception.
@ -129,7 +130,7 @@ private void testRpcPermissionWithConf(
}
try {
ContainerInfo container2 = mockScm.getClientProtocolServer()
ContainerInfo container2 = mockClientServer
.allocateContainer(xceiverClientManager.getType(),
HddsProtos.ReplicationFactor.ONE, "OZONE");
if (expectPermissionDenied) {
@ -138,11 +139,11 @@ private void testRpcPermissionWithConf(
Assert.assertEquals(1, container2.getPipeline().getMachines().size());
}
} catch (Exception e) {
verifyPermissionDeniedException(e, fakeUser);
verifyPermissionDeniedException(e, fakeRemoteUsername);
}
try {
ContainerInfo container3 = mockScm.getClientProtocolServer()
ContainerInfo container3 = mockClientServer
.allocateContainer(xceiverClientManager.getType(),
HddsProtos.ReplicationFactor.ONE, "OZONE");
if (expectPermissionDenied) {
@ -151,16 +152,16 @@ private void testRpcPermissionWithConf(
Assert.assertEquals(1, container3.getPipeline().getMachines().size());
}
} catch (Exception e) {
verifyPermissionDeniedException(e, fakeUser);
verifyPermissionDeniedException(e, fakeRemoteUsername);
}
try {
mockScm.getClientProtocolServer().getContainer(
mockClientServer.getContainer(
ContainerTestHelper.getTestContainerID());
fail("Operation should fail, expecting an IOException here.");
} catch (Exception e) {
if (expectPermissionDenied) {
verifyPermissionDeniedException(e, fakeUser);
verifyPermissionDeniedException(e, fakeRemoteUsername);
} else {
// If passes permission check, it should fail with
// key not exist exception.