[
https://issues.apache.org/jira/browse/HDFS-13060?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16344226#comment-16344226
]
Xiaoyu Yao commented on HDFS-13060:
-----------------------------------
Thanks [~ajayydv] for workong on this. Patch looks good to me overall. Here are
few minor issues:
CombinedIPBlacklist.java
Can this be a common util class like CombinedIPList which will be used for both
white and black list.
Line 27: NIT: unused LOCALHOST_IP
BlackListBasedTrustedChannelResolver.java
Line 38/44/50: the comment should note that these keys are for the server
Line 60/65/70/76: the comment should note that these keys are for the client
Can you open a separate ticket to support composite trusted channel resolver
that supports both whitelist and blacklist?
> Adding a BlacklistBasedTrustedChannelResolver for TrustedChannelResolver
> ------------------------------------------------------------------------
>
> Key: HDFS-13060
> URL: https://issues.apache.org/jira/browse/HDFS-13060
> Project: Hadoop HDFS
> Issue Type: Bug
> Reporter: Xiaoyu Yao
> Assignee: Ajay Kumar
> Priority: Major
> Attachments: HDFS-13060.000.patch
>
>
> HDFS-5910 introduces encryption negotiation between client and server based
> on a customizable TrustedChannelResolver class. The TrustedChannelResolver is
> invoked on both client and server side. If the resolver indicates that the
> channel is trusted, then the data transfer will not be encrypted even if
> dfs.encrypt.data.transfer is set to true.
> The default trust channel resolver implementation returns false indicating
> that the channel is not trusted, which always enables encryption. HDFS-5910
> also added a build-int whitelist based trust channel resolver. It allows you
> to put IP address/Network Mask of trusted client/server in whitelist files to
> skip encryption for certain traffics.
> This ticket is opened to add a blacklist based trust channel resolver for
> cases only certain machines (IPs) are untrusted without adding each trusted
> IP individually.
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-h...@hadoop.apache.org
