[HADOOP-16819] Possible inconsistent state of AbstractDelegationTokenSecretManager

• Type: Sub-task
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.3.0
• Component/s: fs/s3, security
• Labels: pull-request-available
• Assignee: Hankó Gergely
• Reporter: Hankó Gergely
• Created: 21/Jan/20 09:12
• Updated: 04/Oct/22 16:23

Description

AbstractDelegationTokenSecretManager.updateCurrentKey increments the current key id and creates the new delegation key in two distinct synchronized blocks.

This means that other threads can see the class in an inconsistent state, where the key for the current key id doesn't exist (yet).

For example the following method sometimes returns null when the token remover thread is between the two synchronized blocks:

@Override
public DelegationKey getCurrentKey() {
  return getDelegationKey(getCurrentKeyId());
}

 

Also it is possible that updateCurrentKey is called from multiple threads at the same time so distinct keys can be generated with the same key id.

 

This issue is suspected to be the cause of the intermittent failure of  TestLlapSignerImpl.testSigning - HIVE-22621.

Issue Links

• causes: HIVE-22621 Disable unstable tests
• links to: GitHub Pull Request #1894