[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17802979#comment-17802979 ] Shilun Fan commented on HADOOP-12687: - Bulk update: moved all 3.4.0 non-blocker issues, please move back if it is a blocker. Retarget 3.5.0. > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G >Priority: Major > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian Jira (v8.20.10#820010) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15211255#comment-15211255 ] Jiajia Li commented on HADOOP-12687: [~sunilg], from https://builds.apache.org/job/PreCommit-HADOOP-Build/8915/testReport/, with failures of TestClientRMTokens and TestAMAuthorization, can you help to look at it? > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15211322#comment-15211322 ] Sunil G commented on HADOOP-12687: -- Yes [~jiajia]. These failures are still present. INFRA-11150 is raised to change YARN precommit build machine hostname so that this issue can be permanently fixed. Till then, unfortunately we will have this error from YARN pre-commit build. Committers are aware of this, and will consider the same accordingly. > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15285925#comment-15285925 ] Rohith Sharma K S commented on HADOOP-12687: Linking to YARN-4478, few useful discussion happened related to this issue. Discussion starts from this [comment|https://issues.apache.org/jira/browse/YARN-4478?focusedCommentId=15174874&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-15174874] > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G >Priority: Blocker > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15285931#comment-15285931 ] Rohith Sharma K S commented on HADOOP-12687: I closed the INFRA JIRA as wont fix as per discussion with Allen ([comment-link|https://issues.apache.org/jira/browse/YARN-4478?focusedCommentId=15257550&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-15257550]) in issue YARN-4478. I believe this JIRA should get in. Given RFC standard are negotiable, Can other folks express their opinion on the patch? > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G >Priority: Blocker > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname incase multiple loopback addresses are present in etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15086731#comment-15086731 ] Rohith Sharma K S commented on HADOOP-12687: Cancelled the patch and resubmitted again to trigger Jenkin > SecureUtil#getByName should also try to resolve direct hostname incase > multiple loopback addresses are present in etc/hosts > --- > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15086801#comment-15086801 ] Hadoop QA commented on HADOOP-12687: | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} reexec {color} | {color:blue} 0m 0s {color} | {color:blue} Docker mode activated. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:red}-1{color} | {color:red} test4tests {color} | {color:red} 0m 0s {color} | {color:red} The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch. {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 8m 3s {color} | {color:green} trunk passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 8m 40s {color} | {color:green} trunk passed with JDK v1.8.0_66 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 9m 26s {color} | {color:green} trunk passed with JDK v1.7.0_91 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 19s {color} | {color:green} trunk passed {color} | | {color:green}+1{color} | {color:green} mvnsite {color} | {color:green} 1m 8s {color} | {color:green} trunk passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 0m 15s {color} | {color:green} trunk passed {color} | | {color:green}+1{color} | {color:green} findbugs {color} | {color:green} 1m 55s {color} | {color:green} trunk passed {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 0m 54s {color} | {color:green} trunk passed with JDK v1.8.0_66 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 1m 6s {color} | {color:green} trunk passed with JDK v1.7.0_91 {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 1m 41s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 8m 45s {color} | {color:green} the patch passed with JDK v1.8.0_66 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 8m 45s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 9m 31s {color} | {color:green} the patch passed with JDK v1.7.0_91 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 9m 30s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 18s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvnsite {color} | {color:green} 1m 5s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 0m 15s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} Patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} findbugs {color} | {color:green} 2m 7s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 0m 59s {color} | {color:green} the patch passed with JDK v1.8.0_66 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 1m 8s {color} | {color:green} the patch passed with JDK v1.7.0_91 {color} | | {color:green}+1{color} | {color:green} unit {color} | {color:green} 8m 24s {color} | {color:green} hadoop-common in the patch passed with JDK v1.8.0_66. {color} | | {color:red}-1{color} | {color:red} unit {color} | {color:red} 7m 59s {color} | {color:red} hadoop-common in the patch failed with JDK v1.7.0_91. {color} | | {color:green}+1{color} | {color:green} asflicense {color} | {color:green} 0m 25s {color} | {color:green} Patch does not generate ASF License warnings. {color} | | {color:black}{color} | {color:black} {color} | {color:black} 75m 41s {color} | {color:black} {color} | \\ \\ || Reason || Tests || | JDK v1.7.0_91 Failed junit tests | hadoop.fs.shell.TestCopyPreserveFlag | \\ \\ || Subsystem || Report/Notes || | Docker | Image:yetus/hadoop:0ca8df7 | | JIRA Patch URL | https://issues.apache.org/jira/secure/attachment/12780891/0004-HADOOP-12687.patch | | JIRA Issue | HADOOP-12687 | | Optional Tests | asflicense compile javac javadoc mvninstall mvnsite unit findbugs checkstyle | | uname | Linux 9162e44a1c18 3.13.0-36-lowlatency #63-Ubuntu SMP PREEMPT Wed Sep 3 21:56:12 UTC 2014 x86_64 x86_64 x86_64
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15086808#comment-15086808 ] Rohith Sharma K S commented on HADOOP-12687: committing shortly > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15086840#comment-15086840 ] Hudson commented on HADOOP-12687: - FAILURE: Integrated in Hadoop-trunk-Commit #9063 (See [https://builds.apache.org/job/Hadoop-trunk-Commit/9063/]) HADOOP-12687. SecureUtil#QualifiedHostResolver#getByName should also try (rohithsharmaks: rev 2b252844e04eebd4f32815d4bd6f914c02994709) * hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java * hadoop-common-project/hadoop-common/CHANGES.txt > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Fix For: 2.9.0 > > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15086841#comment-15086841 ] Sunil G commented on HADOOP-12687: -- Thanks [~rohithsharma] for the review and commit. And thanks [~vinayrpet] for the review! > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Fix For: 2.9.0 > > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15087185#comment-15087185 ] Varun Vasudev commented on HADOOP-12687: [~rohithsharma] - I think you need to revert this patch. If essentially undoes the security check in getByExactName(). When doing hostname lookups, the hostname must be rooted(“.” added to the end to avoid the security hole in RFC 1535). This patch undoes that check. > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Fix For: 2.9.0 > > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15088944#comment-15088944 ] Rohith Sharma K S commented on HADOOP-12687: All the VM's machine should contains "." at the end of hostname in /etc/hosts file. I verified tests cases by adding dot "." and all tests are passing. I think need to raise INFRA jira for changing hostname in VM's. > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15088947#comment-15088947 ] Hudson commented on HADOOP-12687: - FAILURE: Integrated in Hadoop-trunk-Commit #9072 (See [https://builds.apache.org/job/Hadoop-trunk-Commit/9072/]) Revert "HADOOP-12687. SecureUtil#QualifiedHostResolver#getByName should (rohithsharmaks: rev ed18527e38438113fdf2f48b08be5ec283a5f481) * hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java * hadoop-common-project/hadoop-common/CHANGES.txt > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15089072#comment-15089072 ] Vinayakumar B commented on HADOOP-12687: bq. If essentially undoes the security check in getByExactName(). When doing hostname lookups, the hostname must be rooted(“.” added to the end to avoid the security hole in RFC 1535). This patch undoes that check. After seeing the RFC 1535, I agree that direct look up without trailing dot may connect to unauthorized machine or wrong machine after searching through different search domains. But in current case, with patch, direct look-up is being done after all check is done including trailing dot and search domains. Is it still a RFC violation to lookup for direct host? below code itself throws {{UnKnownHostException}}, i.e. its not able to resolve its own hostname. This happens only in linux(ubuntu), works fine in windows though. {code}SecurityUtil.getByName(InetSocketAddress.getLocalhost().getHostName()){code} > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15292812#comment-15292812 ] Vinayakumar B commented on HADOOP-12687: bq. But in current case, with patch, direct look-up is being done after all check is done including trailing dot and search domains. Is it still a RFC violation to lookup for direct host? Anyone can confirm this? > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G >Priority: Blocker > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org
[jira] [Commented] (HADOOP-12687) SecureUtil#getByName should also try to resolve direct hostname, incase multiple loopback addresses are present in /etc/hosts
[ https://issues.apache.org/jira/browse/HADOOP-12687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15314871#comment-15314871 ] Vinod Kumar Vavilapalli commented on HADOOP-12687: -- bq. But in current case, with patch, direct look-up is being done after all check is done including trailing dot and search domains. Is it still a RFC violation to lookup for direct host? bq. Anyone can confirm this? That's be a question for [~vvasudev] / [~sunilg] / [~rohithsharma]. Folks, can we please get a consensus here? This issue is plaguing way too many JIRAs. > SecureUtil#getByName should also try to resolve direct hostname, incase > multiple loopback addresses are present in /etc/hosts > - > > Key: HADOOP-12687 > URL: https://issues.apache.org/jira/browse/HADOOP-12687 > Project: Hadoop Common > Issue Type: Bug >Reporter: Junping Du >Assignee: Sunil G >Priority: Blocker > Labels: security > Attachments: 0001-YARN-4352.patch, 0002-YARN-4352.patch, > 0003-HADOOP-12687.patch, 0004-HADOOP-12687.patch > > > From > https://builds.apache.org/job/PreCommit-YARN-Build/9661/artifact/patchprocess/patch-unit-hadoop-yarn-project_hadoop-yarn_hadoop-yarn-client-jdk1.7.0_79.txt, > we can see the tests in TestYarnClient, TestAMRMClient and TestNMClient get > timeout which can be reproduced locally. > When {{/etc/hosts}} has multiple loopback entries, > {{InetAddress.getByName(null)}} will be returning the first entry present in > etc/hosts. Hence its possible that machine hostname can be second in list and > cause {{UnKnownHostException}}. > Suggesting a direct resolve for such hostname scenarios. -- This message was sent by Atlassian JIRA (v6.3.4#6332) - To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org