[HADOOP-12579] Deprecate WriteableRPCEngine

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha2
• Target Version/s: 3.0.0-alpha2
• Hadoop Flags: Reviewed
• Assignee: Wei Zhou
• Reporter: Haohui Mai
• Created: 17/Nov/15 22:15
• Updated: 25/Oct/19 20:27
• Resolved: 09/Oct/16 09:09

Description

The WriteableRPCEninge depends on Java's serialization mechanisms for RPC requests. Without proper checks, it has be shown that it can lead to security vulnerabilities such as remote code execution (e.g., COLLECTIONS-580, HADOOP-12577).

The current implementation has migrated from WriteableRPCEngine to ProtobufRPCEngine now. This jira proposes to deprecate WriteableRPCEngine in branch-2 and to remove it in trunk.

Issue Links

• breaks: MAPREDUCE-6705 Task failing continuously on trunk
• breaks: YARN-5163 Migrate TestClientToAMTokens and TestClientRMTokens tests from the old RPC engine
• depends upon: MAPREDUCE-6706 Update TaskUmbilicalProtocol to use ProtobufRPCEngine
• incorporates: MAPREDUCE-6775 Fix MapReduce failures caused by default RPC engine changing
• is related to: HADOOP-12818 Deprecate RPC#waitForProxy and cleanup
• relates to: HADOOP-14511 WritableRpcEngine.Invocation#toString NPE on null parameters
• relates to: HADOOP-12577 Bump up commons-collections version to 3.2.2 to address a security flaw
• relates to: COLLECTIONS-580 Arbitrary remote code execution with InvokerTransformer

Sub-Tasks

• Migrate TestRPC and related codes to rebase on ProtobufRpcEngine: Resolved
• Migrate TestSaslRPC and related codes to rebase on ProtobufRpcEngine: Resolved
• Migrate other Hadoop side tests to prepare for removing WritableRPCEngine: Resolved