Code0x58 commented on a change in pull request #3650:
URL: https://github.com/apache/incubator-heron/pull/3650#discussion_r541828521
##########
File path: heron/shell/src/python/handlers/killexecutorhandler.py
##########
@@ -44,13 +44,20 @@ def kill_parent():
logger.info("Killing parent executor")
os.killpg(os.getppid(), signal.SIGTERM)
+ def is_local():
+ remote_ip = self.request.remote_ip
+ if 'localhost' == remote_ip or '127.0.0.1' == remote_ip or '::1' ==
remote_ip:
+ return True
+ else:
+ return False
Review comment:
```suggestion
return self.request.remote_ip in ('localhost', '127.0.0.1', '::1')
```
##########
File path: heron/shell/src/python/handlers/killexecutorhandler.py
##########
@@ -44,13 +44,20 @@ def kill_parent():
logger.info("Killing parent executor")
os.killpg(os.getppid(), signal.SIGTERM)
+ def is_local():
+ remote_ip = self.request.remote_ip
+ if 'localhost' == remote_ip or '127.0.0.1' == remote_ip or '::1' ==
remote_ip:
+ return True
+ else:
+ return False
+
logger = logging.getLogger(__file__)
logger.info("Received 'Killing process' request")
data = dict(parse_qsl(self.request.body))
# check shared secret
sharedSecret = data.get('secret')
- if sharedSecret != options.secret:
+ if not is_local() and sharedSecret != options.secret:
Review comment:
This change is really that the secret is disregarded if the last hop of
the request comes from a local connection (which could happen if you use a
reverse proxy like nginx).
If this change is to allow graceful shutown, does mean aurora always calls
this endpoint without the secret and from a loopback address? So before this
patch, aurora would call this endpoint and get a 403 and no action, instead of
getting to send a SIGTERM to the executor process group? If so, I'm wondering
if you could just make Aurora send the SIGTERM to avoid having to worry about
secrets being ignored in certain cases.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
