Uploaded image for project: 'Hadoop HDFS'
  1. Hadoop HDFS
  2. HDFS-13060

Adding a BlacklistBasedTrustedChannelResolver for TrustedChannelResolver

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 3.1.0
    • Component/s: datanode, security
    • Labels:
      None
    • Hadoop Flags:
      Reviewed

      Description

      HDFS-5910 introduces encryption negotiation between client and server based on a customizable TrustedChannelResolver class. The TrustedChannelResolver is invoked on both client and server side. If the resolver indicates that the channel is trusted, then the data transfer will not be encrypted even if dfs.encrypt.data.transfer is set to true.

      The default trust channel resolver implementation returns false indicating that the channel is not trusted, which always enables encryption. HDFS-5910 also added a build-int whitelist based trust channel resolver. It allows you to put IP address/Network Mask of trusted client/server in whitelist files to skip encryption for certain traffics.

      This ticket is opened to add a blacklist based trust channel resolver for cases only certain machines (IPs) are untrusted without adding each trusted IP individually.

        Attachments

        1. HDFS-13060.003.patch
          13 kB
          Ajay Kumar
        2. HDFS-13060.002.patch
          12 kB
          Ajay Kumar
        3. HDFS-13060.001.patch
          11 kB
          Ajay Kumar
        4. HDFS-13060.000.patch
          11 kB
          Ajay Kumar

          Issue Links

            Activity

              People

              • Assignee:
                ajayydv Ajay Kumar
                Reporter:
                xyao Xiaoyu Yao
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: