[HADOOP-18824] ZKDelegationTokenSecretManager causes ArithmeticException due to improper numRetries value checking

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Component/s: common
• Labels: pull-request-available
• Target Version/s: 3.4.0
• Hadoop Flags: Reviewed
• Assignee: ConfX
• Reporter: ConfX
• Created: 24/Jul/23 16:38
• Updated: 27/Jan/24 08:17
• Resolved: 14/Sep/23 22:53

Description

What happened

There is no value checking for parameter zk-dt-secret-manager.zkNumRetries. This may cause improper calculations and crashes the system like division by 0.

Buggy code

In ZKDelegationTokenSecretManager.java, there is no value checking for numRetries which is passed directly in RetryNTimes constructor. When numRetries is mistakenly set to 0, the code would cause division by 0 and throw ArithmeticException to crash the system.

public ZKDelegationTokenSecretManager(Configuration conf) {
        ...
        int numRetries =
            conf.getInt(ZK_DTSM_ZK_NUM_RETRIES, ZK_DTSM_ZK_NUM_RETRIES_DEFAULT);
        builder =
            ...
                .retryPolicy(
                    new RetryNTimes(numRetries, sessionT / numRetries));
        ...

How to reproduce

1. set zk-dt-secret-manager.zkNumRetries=0
2. run org.apache.hadoop.security.token.delegation.TestZKDelegationTokenSecretManager.testMultiNodeOperations
3. You will see the following stack trace.

java.lang.RuntimeException: Could not Load ZK acls or auth: java.lang.ArithmeticException: / by zero
    at org.apache.hadoop.security.token.delegation.ZKDelegationTokenSecretManager.<init>(ZKDelegationTokenSecretManager.java:227)
    at org.apache.hadoop.security.token.delegation.web.DelegationTokenManager$ZKSecretManager.<init>(DelegationTokenManager.java:99)
    at org.apache.hadoop.security.token.delegation.web.DelegationTokenManager.<init>(DelegationTokenManager.java:120)
    at org.apache.hadoop.security.token.delegation.TestZKDelegationTokenSecretManager.testMultiNodeOperations(TestZKDelegationTokenSecretManager.java:113)
        ...

For an easy reproduction, run the reproduce.sh in the attachment. We are happy to provide a patch if this issue is confirmed.

Issue Links

• links to: GitHub Pull Request #6052