HyukjinKwon commented on code in PR #58616:
URL: https://github.com/apache/spark/pull/58616#discussion_r3973869552
##########
common/network-common/src/main/java/org/apache/spark/network/server/OneForOneStreamManager.java:
##########
@@ -164,16 +164,21 @@ public void connectionTerminated(Channel channel) {
@Override
public void checkAuthorization(TransportClient client, long streamId) {
- if (client.getClientId() != null) {
- StreamState state = streams.get(streamId);
- Preconditions.checkArgument(state != null, "Unknown stream ID.");
- if (!client.getClientId().equals(state.appId)) {
- throw new SecurityException(String.format(
- "Client %s not authorized to read stream %d (app %s).",
- client.getClientId(),
- streamId,
- state.appId));
- }
+ StreamState state = streams.get(streamId);
+ Preconditions.checkArgument(state != null, "Unknown stream ID.");
+ if (client.getClientId() != null &&
!client.getClientId().equals(state.appId)) {
+ throw new SecurityException(String.format(
+ "Client %s not authorized to read stream %d (app %s).",
+ client.getClientId(),
+ streamId,
+ state.appId));
+ }
+ // Streams are registered to (and documented as only readable from)
exactly one client
+ // connection. Enforce that binding for every request.
+ if (state.associatedChannel != null && state.associatedChannel !=
client.getChannel()) {
Review Comment:
This channel-binding check (and the `SecureRandom` seed in the constructor
above) is already on `branch-3.5` via `3551b280` — this file is identical to
the current branch tip. After rebasing onto the latest `branch-3.5` this commit
should disappear, leaving only the KVStore change as new.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
