Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

HBASE-27673 Fix mTLS client hostname verification #5065

Merged
merged 2 commits into from
Feb 28, 2023
Merged

HBASE-27673 Fix mTLS client hostname verification #5065

merged 2 commits into from
Feb 28, 2023

Conversation

meszibalu
Copy link
Contributor

No description provided.

@meszibalu meszibalu changed the title HBASE-27673 Fix mTLS client authentication HBASE-27673 Fix mTLS client hostname verification Feb 27, 2023
bbeaudreault
bbeaudreault reviewed Feb 27, 2023
View reviewed changes
Copy link
Contributor

@bbeaudreault bbeaudreault left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any test we can easily add for this case? It's too bad this wasn't caught by tests

@Apache-HBase
Copy link

💔 -1 overall

Vote Subsystem Runtime Comment
+0 🆗 reexec 0m 22s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+1 💚 hbaseanti 0m 0s Patch does not have any anti-patterns.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ master Compile Tests _
+1 💚 mvninstall 3m 37s master passed
+1 💚 compile 2m 24s master passed
+1 💚 checkstyle 0m 35s master passed
+1 💚 spotless 0m 42s branch has no errors when running spotless:check.
+1 💚 spotbugs 1m 21s master passed
_ Patch Compile Tests _
+1 💚 mvninstall 3m 14s the patch passed
+1 💚 compile 2m 22s the patch passed
+1 💚 javac 2m 22s the patch passed
+1 💚 checkstyle 0m 31s the patch passed
+1 💚 whitespace 0m 0s The patch has no whitespace issues.
+1 💚 hadoopcheck 12m 44s Patch does not cause any errors with Hadoop 3.2.4 3.3.4.
-1 ❌ spotless 0m 32s patch has 26 errors when running spotless:check, run spotless:apply to fix.
+1 💚 spotbugs 1m 29s the patch passed
_ Other Tests _
+1 💚 asflicense 0m 10s The patch does not generate ASF License warnings.
37m 26s
Subsystem Report/Notes
Docker ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-general-check/output/Dockerfile
GITHUB PR #5065
Optional Tests dupname asflicense javac spotbugs hadoopcheck hbaseanti spotless checkstyle compile
uname Linux 5191692590c5 5.4.0-1094-aws #102~18.04.1-Ubuntu SMP Tue Jan 10 21:07:03 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision master / 4bee21e
Default Java Eclipse Adoptium-11.0.17+8
spotless https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-general-check/output/patch-spotless.txt
Max. process+thread count 86 (vs. ulimit of 30000)
modules C: hbase-server U: hbase-server
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/console
versions git=2.34.1 maven=3.8.6 spotbugs=4.7.3
Powered by Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase
Copy link

💔 -1 overall

Vote Subsystem Runtime Comment
+0 🆗 reexec 0m 19s Docker mode activated.
-0 ⚠️ yetus 0m 3s Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚 mvninstall 3m 33s master passed
+1 💚 compile 0m 45s master passed
+1 💚 shadedjars 4m 23s branch has no errors when building our shaded downstream artifacts.
+1 💚 javadoc 0m 27s master passed
_ Patch Compile Tests _
+1 💚 mvninstall 4m 38s the patch passed
+1 💚 compile 1m 5s the patch passed
+1 💚 javac 1m 5s the patch passed
+1 💚 shadedjars 5m 21s patch has no errors when building our shaded downstream artifacts.
+1 💚 javadoc 0m 25s the patch passed
_ Other Tests _
-1 ❌ unit 299m 35s hbase-server in the patch failed.
324m 31s
Subsystem Report/Notes
Docker ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR #5065
Optional Tests javac javadoc unit shadedjars compile
uname Linux b3d3f4c0d842 5.4.0-135-generic #152-Ubuntu SMP Wed Nov 23 20:19:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision master / 4bee21e
Default Java Eclipse Adoptium-11.0.17+8
unit https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-jdk11-hadoop3-check/output/patch-unit-hbase-server.txt
Test Results https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/testReport/
Max. process+thread count 2362 (vs. ulimit of 30000)
modules C: hbase-server U: hbase-server
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/console
versions git=2.34.1 maven=3.8.6
Powered by Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase
Copy link

💔 -1 overall

Vote Subsystem Runtime Comment
+0 🆗 reexec 0m 27s Docker mode activated.
-0 ⚠️ yetus 0m 4s Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚 mvninstall 4m 17s master passed
+1 💚 compile 0m 53s master passed
+1 💚 shadedjars 5m 5s branch has no errors when building our shaded downstream artifacts.
+1 💚 javadoc 0m 33s master passed
_ Patch Compile Tests _
+1 💚 mvninstall 4m 58s the patch passed
+1 💚 compile 1m 11s the patch passed
+1 💚 javac 1m 11s the patch passed
+1 💚 shadedjars 7m 28s patch has no errors when building our shaded downstream artifacts.
+1 💚 javadoc 0m 43s the patch passed
_ Other Tests _
-1 ❌ unit 313m 19s hbase-server in the patch failed.
343m 26s
Subsystem Report/Notes
Docker ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR #5065
Optional Tests javac javadoc unit shadedjars compile
uname Linux ddf9c88745bc 5.4.0-135-generic #152-Ubuntu SMP Wed Nov 23 20:19:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision master / 4bee21e
Default Java Temurin-1.8.0_352-b08
unit https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-jdk8-hadoop3-check/output/patch-unit-hbase-server.txt
Test Results https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/testReport/
Max. process+thread count 2248 (vs. ulimit of 30000)
modules C: hbase-server U: hbase-server
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/console
versions git=2.34.1 maven=3.8.6
Powered by Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@meszibalu
Copy link
Contributor Author

Is there any test we can easily add for this case? It's too bad this wasn't caught by tests

It requires a test case where we connect to hbase from an IP address which is not localhost.

@Apache-HBase
Copy link

🎊 +1 overall

Vote Subsystem Runtime Comment
+0 🆗 reexec 0m 23s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+1 💚 hbaseanti 0m 0s Patch does not have any anti-patterns.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ master Compile Tests _
+1 💚 mvninstall 3m 44s master passed
+1 💚 compile 2m 27s master passed
+1 💚 checkstyle 0m 31s master passed
+1 💚 spotless 0m 41s branch has no errors when running spotless:check.
+1 💚 spotbugs 1m 25s master passed
_ Patch Compile Tests _
+1 💚 mvninstall 3m 13s the patch passed
+1 💚 compile 2m 24s the patch passed
+1 💚 javac 2m 24s the patch passed
+1 💚 checkstyle 0m 31s the patch passed
+1 💚 whitespace 0m 0s The patch has no whitespace issues.
+1 💚 hadoopcheck 12m 53s Patch does not cause any errors with Hadoop 3.2.4 3.3.4.
+1 💚 spotless 0m 37s patch has no errors when running spotless:check.
+1 💚 spotbugs 1m 28s the patch passed
_ Other Tests _
+1 💚 asflicense 0m 9s The patch does not generate ASF License warnings.
37m 54s
Subsystem Report/Notes
Docker ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/artifact/yetus-general-check/output/Dockerfile
GITHUB PR #5065
Optional Tests dupname asflicense javac spotbugs hadoopcheck hbaseanti spotless checkstyle compile
uname Linux 2a5d6f2fc80b 5.4.0-1094-aws #102~18.04.1-Ubuntu SMP Tue Jan 10 21:07:03 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision master / ef6a113
Default Java Eclipse Adoptium-11.0.17+8
Max. process+thread count 85 (vs. ulimit of 30000)
modules C: hbase-server U: hbase-server
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/console
versions git=2.34.1 maven=3.8.6 spotbugs=4.7.3
Powered by Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

petersomogyi
petersomogyi approved these changes Feb 28, 2023
View reviewed changes
Copy link
Contributor

@petersomogyi petersomogyi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with covering this with a unit test but I don't see how we can do that.
@meszibalu Were you able to verify this change on an HBase cluster?

@meszibalu
Copy link
Contributor Author

I agree with covering this with a unit test but I don't see how we can do that. @meszibalu Were you able to verify this change on an HBase cluster?

Yes, I validated it.

@Apache-HBase
Copy link

🎊 +1 overall

Vote Subsystem Runtime Comment
+0 🆗 reexec 0m 23s Docker mode activated.
-0 ⚠️ yetus 0m 3s Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚 mvninstall 3m 7s master passed
+1 💚 compile 0m 35s master passed
+1 💚 shadedjars 4m 33s branch has no errors when building our shaded downstream artifacts.
+1 💚 javadoc 0m 22s master passed
_ Patch Compile Tests _
+1 💚 mvninstall 2m 43s the patch passed
+1 💚 compile 0m 34s the patch passed
+1 💚 javac 0m 34s the patch passed
+1 💚 shadedjars 4m 32s patch has no errors when building our shaded downstream artifacts.
+1 💚 javadoc 0m 21s the patch passed
_ Other Tests _
+1 💚 unit 205m 54s hbase-server in the patch passed.
227m 7s
Subsystem Report/Notes
Docker ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR #5065
Optional Tests javac javadoc unit shadedjars compile
uname Linux 82d5fafa9e73 5.4.0-1093-aws #102~18.04.2-Ubuntu SMP Wed Dec 7 00:31:59 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision master / ef6a113
Default Java Temurin-1.8.0_352-b08
Test Results https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/testReport/
Max. process+thread count 2615 (vs. ulimit of 30000)
modules C: hbase-server U: hbase-server
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/console
versions git=2.34.1 maven=3.8.6
Powered by Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase
Copy link

🎊 +1 overall

Vote Subsystem Runtime Comment
+0 🆗 reexec 0m 24s Docker mode activated.
-0 ⚠️ yetus 0m 2s Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚 mvninstall 3m 56s master passed
+1 💚 compile 0m 48s master passed
+1 💚 shadedjars 4m 53s branch has no errors when building our shaded downstream artifacts.
+1 💚 javadoc 0m 24s master passed
_ Patch Compile Tests _
+1 💚 mvninstall 3m 39s the patch passed
+1 💚 compile 0m 45s the patch passed
+1 💚 javac 0m 44s the patch passed
+1 💚 shadedjars 4m 51s patch has no errors when building our shaded downstream artifacts.
+1 💚 javadoc 0m 22s the patch passed
_ Other Tests _
+1 💚 unit 203m 54s hbase-server in the patch passed.
227m 48s
Subsystem Report/Notes
Docker ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR #5065
Optional Tests javac javadoc unit shadedjars compile
uname Linux f85c3fb0fdc6 5.4.0-1094-aws #102~18.04.1-Ubuntu SMP Tue Jan 10 21:07:03 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/hbase-personality.sh
git revision master / ef6a113
Default Java Eclipse Adoptium-11.0.17+8
Test Results https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/testReport/
Max. process+thread count 2665 (vs. ulimit of 30000)
modules C: hbase-server U: hbase-server
Console output https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/console
versions git=2.34.1 maven=3.8.6
Powered by Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@bbeaudreault
Copy link
Contributor

I wasn't sure if we could somehow use a mocked address, but didn't have much of any idea beyond that :). If nothing comes to mind and you verified in a cluster, then LGTM

@meszibalu meszibalu merged commit 43aa9b3 into apache:master Feb 28, 2023
@meszibalu meszibalu deleted the mb/HBASE-27673 branch February 28, 2023 17:41
vinayakphegde pushed a commit to vinayakphegde/hbase that referenced this pull request Apr 4, 2024
@meszibalu
HBASE-27673 Fix mTLS client hostname verification (apache#5065)
86e3dd7 
Signed-off-by: Peter Somogyi <[email protected]>
Signed-off-by: Bryan Beaudreault <[email protected]>
(cherry picked from commit 43aa9b3)

Change-Id: I40f704e12d2c675eb28270639ec2a3a631e456c3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bbeaudreault bbeaudreault bbeaudreault left review comments

@petersomogyi petersomogyi petersomogyi approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@meszibalu @Apache-HBase @bbeaudreault @petersomogyi