Details

    • Type: Sub-task
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.3.0
    • Component/s: None
    • Labels:
      None
    • Hadoop Flags:
      Reviewed
    • Release Note:
      Hide
      Fix the https support in HsftpFileSystem. With the change the client now verifies the server certificate. In particular, client side will verify the Common Name of the certificate using a strategy specified by the configuration property "hadoop.ssl.hostname.verifier".
      Show
      Fix the https support in HsftpFileSystem. With the change the client now verifies the server certificate. In particular, client side will verify the Common Name of the certificate using a strategy specified by the configuration property "hadoop.ssl.hostname.verifier".

      Description

      The current implementation of HsftpFileSystem suffers from the following issues:

      • It initializes the SSLContext incorrectly. It blindly trusts all server certificates which creates a security hole.
      • It tries to cancel delegation token through http, not https, which leads to HDFS-5295.
      • It overrides the default socket factory for HttpsConnection. Given the fact that it trusts all server-side certificate, it accidentally disables all checks on server certificates for all https connections.

      This jira tracks the effort to fix the above issues.

        Attachments

        1. HDFS-5502.006.patch
          41 kB
          Haohui Mai
        2. HDFS-5502.005.patch
          41 kB
          Haohui Mai
        3. HDFS-5502.004.patch
          41 kB
          Haohui Mai
        4. HDFS-5502.003.patch
          39 kB
          Haohui Mai
        5. HDFS-5502.002.patch
          39 kB
          Haohui Mai
        6. HDFS-5502.001.patch
          38 kB
          Haohui Mai
        7. HDFS-5502.000.patch
          31 kB
          Haohui Mai

          Issue Links

            Activity

              People

              • Assignee:
                wheat9 Haohui Mai
                Reporter:
                wheat9 Haohui Mai
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: