[
https://issues.apache.org/jira/browse/HDFS-5502?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13824027#comment-13824027
]
Jing Zhao commented on HDFS-5502:
---------------------------------
The patch looks good to me. Some comments so far:
# The following code assumes that the ssl listener is the second listener in the
HttpServer. This is true for NameNodeHttpServer, but may not be a global
assumption. Since currently we only call this method in NameNodeHttpServer and
we know the ssl listener is the second one, maybe we can add a new method in
HttpServer to get the port of a specific listener (by providing an index)?
{code}
+ public int getHttpsPort() {
+ boolean hasHttpsServer = webServer.getConnectors().length > 1;
+ return hasHttpsServer ? webServer.getConnectors()[1].getLocalPort() : -1;
+ }
{code}
# The current patch will remove the DummyHostnameVerifier and DummyTrustManager
from HsftpFileSystem. Thus in the future we need to configure the client side
of the SSL connection to trust server certificates. We need to document this
since this requires further setup on the client side.
# Please also post the system test results you have run.
> Fix HTTPS support in HsftpFileSystem
> ------------------------------------
>
> Key: HDFS-5502
> URL: https://issues.apache.org/jira/browse/HDFS-5502
> Project: Hadoop HDFS
> Issue Type: Sub-task
> Reporter: Haohui Mai
> Assignee: Haohui Mai
> Attachments: HDFS-5502.000.patch, HDFS-5502.001.patch,
> HDFS-5502.002.patch, HDFS-5502.003.patch, HDFS-5502.004.patch,
> HDFS-5502.005.patch
>
>
> The current implementation of HsftpFileSystem suffers from the following
> issues:
> * It initializes the SSLContext incorrectly. It blindly trusts all server
> certificates which creates a security hole.
> * It tries to cancel delegation token through http, not https, which leads to
> HDFS-5295.
> * It overrides the default socket factory for HttpsConnection. Given the fact
> that it trusts all server-side certificate, it accidentally disables all
> checks on server certificates for all https connections.
> This jira tracks the effort to fix the above issues.
--
This message was sent by Atlassian JIRA
(v6.1#6144)
