Skip to content

HBASE-27673 Fix mTLS client hostname verification - #5065

Merged
meszibalu merged 2 commits into
apache:masterfrom
meszibalu:mb/HBASE-27673
Feb 28, 2023
Merged

HBASE-27673 Fix mTLS client hostname verification#5065
meszibalu merged 2 commits into
apache:masterfrom
meszibalu:mb/HBASE-27673

Conversation

@meszibalu

@meszibalumeszibalu commented Feb 27, 2023

Copy link
Copy Markdown
Contributor

No description provided.

@meszibalumeszibalu changed the title HBASE-27673 Fix mTLS client authenticationHBASE-27673 Fix mTLS client hostname verificationFeb 27, 2023
bbeaudreault
bbeaudreault reviewed Feb 27, 2023
View reviewed changes

@bbeaudreaultbbeaudreault left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any test we can easily add for this case? It's too bad this wasn't caught by tests

@Apache-HBase

Apache-HBase commented Feb 27, 2023

Copy link
Copy Markdown

💔 -1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 22sDocker mode activated.
_ Prechecks _
+1 💚dupname0m 0sNo case conflicting files found.
+1 💚hbaseanti0m 0sPatch does not have any anti-patterns.
+1 💚@author0m 0sThe patch does not contain any @author tags.
_ master Compile Tests _
+1 💚mvninstall3m 37smaster passed
+1 💚compile2m 24smaster passed
+1 💚checkstyle0m 35smaster passed
+1 💚spotless0m 42sbranch has no errors when running spotless:check.
+1 💚spotbugs1m 21smaster passed
_ Patch Compile Tests _
+1 💚mvninstall3m 14sthe patch passed
+1 💚compile2m 22sthe patch passed
+1 💚javac2m 22sthe patch passed
+1 💚checkstyle0m 31sthe patch passed
+1 💚whitespace0m 0sThe patch has no whitespace issues.
+1 💚hadoopcheck12m 44sPatch does not cause any errors with Hadoop 3.2.4 3.3.4.
-1 ❌spotless0m 32spatch has 26 errors when running spotless:check, run spotless:apply to fix.
+1 💚spotbugs1m 29sthe patch passed
_ Other Tests _
+1 💚asflicense0m 10sThe patch does not generate ASF License warnings.
37m 26s
SubsystemReport/Notes
DockerClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-general-check/output/Dockerfile
GITHUB PR#5065
Optional Testsdupname asflicense javac spotbugs hadoopcheck hbaseanti spotless checkstyle compile
unameLinux 5191692590c5 5.4.0-1094-aws #102~18.04.1-Ubuntu SMP Tue Jan 10 21:07:03 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 4bee21e
Default JavaEclipse Adoptium-11.0.17+8
spotlesshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-general-check/output/patch-spotless.txt
Max. process+thread count86 (vs. ulimit of 30000)
modulesC: hbase-server U: hbase-server
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/console
versionsgit=2.34.1 maven=3.8.6 spotbugs=4.7.3
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Feb 27, 2023

Copy link
Copy Markdown

💔 -1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 19sDocker mode activated.
-0 ⚠️yetus0m 3sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚mvninstall3m 33smaster passed
+1 💚compile0m 45smaster passed
+1 💚shadedjars4m 23sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 27smaster passed
_ Patch Compile Tests _
+1 💚mvninstall4m 38sthe patch passed
+1 💚compile1m 5sthe patch passed
+1 💚javac1m 5sthe patch passed
+1 💚shadedjars5m 21spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 25sthe patch passed
_ Other Tests _
-1 ❌unit299m 35shbase-server in the patch failed.
324m 31s
SubsystemReport/Notes
DockerClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR#5065
Optional Testsjavac javadoc unit shadedjars compile
unameLinux b3d3f4c0d842 5.4.0-135-generic #152-Ubuntu SMP Wed Nov 23 20:19:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 4bee21e
Default JavaEclipse Adoptium-11.0.17+8
unithttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-jdk11-hadoop3-check/output/patch-unit-hbase-server.txt
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/testReport/
Max. process+thread count2362 (vs. ulimit of 30000)
modulesC: hbase-server U: hbase-server
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Feb 27, 2023

Copy link
Copy Markdown

💔 -1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 27sDocker mode activated.
-0 ⚠️yetus0m 4sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚mvninstall4m 17smaster passed
+1 💚compile0m 53smaster passed
+1 💚shadedjars5m 5sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 33smaster passed
_ Patch Compile Tests _
+1 💚mvninstall4m 58sthe patch passed
+1 💚compile1m 11sthe patch passed
+1 💚javac1m 11sthe patch passed
+1 💚shadedjars7m 28spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 43sthe patch passed
_ Other Tests _
-1 ❌unit313m 19shbase-server in the patch failed.
343m 26s
SubsystemReport/Notes
DockerClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR#5065
Optional Testsjavac javadoc unit shadedjars compile
unameLinux ddf9c88745bc 5.4.0-135-generic #152-Ubuntu SMP Wed Nov 23 20:19:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 4bee21e
Default JavaTemurin-1.8.0_352-b08
unithttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/artifact/yetus-jdk8-hadoop3-check/output/patch-unit-hbase-server.txt
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/testReport/
Max. process+thread count2248 (vs. ulimit of 30000)
modulesC: hbase-server U: hbase-server
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/1/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@meszibalu

meszibalu commented Feb 28, 2023

Copy link
Copy Markdown
ContributorAuthor

Is there any test we can easily add for this case? It's too bad this wasn't caught by tests

It requires a test case where we connect to hbase from an IP address which is not localhost.

@Apache-HBase

Apache-HBase commented Feb 28, 2023

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 23sDocker mode activated.
_ Prechecks _
+1 💚dupname0m 0sNo case conflicting files found.
+1 💚hbaseanti0m 0sPatch does not have any anti-patterns.
+1 💚@author0m 0sThe patch does not contain any @author tags.
_ master Compile Tests _
+1 💚mvninstall3m 44smaster passed
+1 💚compile2m 27smaster passed
+1 💚checkstyle0m 31smaster passed
+1 💚spotless0m 41sbranch has no errors when running spotless:check.
+1 💚spotbugs1m 25smaster passed
_ Patch Compile Tests _
+1 💚mvninstall3m 13sthe patch passed
+1 💚compile2m 24sthe patch passed
+1 💚javac2m 24sthe patch passed
+1 💚checkstyle0m 31sthe patch passed
+1 💚whitespace0m 0sThe patch has no whitespace issues.
+1 💚hadoopcheck12m 53sPatch does not cause any errors with Hadoop 3.2.4 3.3.4.
+1 💚spotless0m 37spatch has no errors when running spotless:check.
+1 💚spotbugs1m 28sthe patch passed
_ Other Tests _
+1 💚asflicense0m 9sThe patch does not generate ASF License warnings.
37m 54s
SubsystemReport/Notes
DockerClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/artifact/yetus-general-check/output/Dockerfile
GITHUB PR#5065
Optional Testsdupname asflicense javac spotbugs hadoopcheck hbaseanti spotless checkstyle compile
unameLinux 2a5d6f2fc80b 5.4.0-1094-aws #102~18.04.1-Ubuntu SMP Tue Jan 10 21:07:03 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / ef6a113
Default JavaEclipse Adoptium-11.0.17+8
Max. process+thread count85 (vs. ulimit of 30000)
modulesC: hbase-server U: hbase-server
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/console
versionsgit=2.34.1 maven=3.8.6 spotbugs=4.7.3
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

petersomogyi
petersomogyi approved these changes Feb 28, 2023
View reviewed changes

@petersomogyipetersomogyi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with covering this with a unit test but I don't see how we can do that.
@meszibalu Were you able to verify this change on an HBase cluster?

@meszibalu

meszibalu commented Feb 28, 2023

Copy link
Copy Markdown
ContributorAuthor

I agree with covering this with a unit test but I don't see how we can do that. @meszibalu Were you able to verify this change on an HBase cluster?

Yes, I validated it.

@Apache-HBase

Apache-HBase commented Feb 28, 2023

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 23sDocker mode activated.
-0 ⚠️yetus0m 3sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚mvninstall3m 7smaster passed
+1 💚compile0m 35smaster passed
+1 💚shadedjars4m 33sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 22smaster passed
_ Patch Compile Tests _
+1 💚mvninstall2m 43sthe patch passed
+1 💚compile0m 34sthe patch passed
+1 💚javac0m 34sthe patch passed
+1 💚shadedjars4m 32spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 21sthe patch passed
_ Other Tests _
+1 💚unit205m 54shbase-server in the patch passed.
227m 7s
SubsystemReport/Notes
DockerClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR#5065
Optional Testsjavac javadoc unit shadedjars compile
unameLinux 82d5fafa9e73 5.4.0-1093-aws #102~18.04.2-Ubuntu SMP Wed Dec 7 00:31:59 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / ef6a113
Default JavaTemurin-1.8.0_352-b08
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/testReport/
Max. process+thread count2615 (vs. ulimit of 30000)
modulesC: hbase-server U: hbase-server
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Feb 28, 2023

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 24sDocker mode activated.
-0 ⚠️yetus0m 2sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚mvninstall3m 56smaster passed
+1 💚compile0m 48smaster passed
+1 💚shadedjars4m 53sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 24smaster passed
_ Patch Compile Tests _
+1 💚mvninstall3m 39sthe patch passed
+1 💚compile0m 45sthe patch passed
+1 💚javac0m 44sthe patch passed
+1 💚shadedjars4m 51spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 22sthe patch passed
_ Other Tests _
+1 💚unit203m 54shbase-server in the patch passed.
227m 48s
SubsystemReport/Notes
DockerClientAPI=1.42 ServerAPI=1.42 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR#5065
Optional Testsjavac javadoc unit shadedjars compile
unameLinux f85c3fb0fdc6 5.4.0-1094-aws #102~18.04.1-Ubuntu SMP Tue Jan 10 21:07:03 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / ef6a113
Default JavaEclipse Adoptium-11.0.17+8
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/testReport/
Max. process+thread count2665 (vs. ulimit of 30000)
modulesC: hbase-server U: hbase-server
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5065/2/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@bbeaudreault

bbeaudreault commented Feb 28, 2023

Copy link
Copy Markdown
Contributor

I wasn't sure if we could somehow use a mocked address, but didn't have much of any idea beyond that :). If nothing comes to mind and you verified in a cluster, then LGTM

@meszibalu
meszibalu merged commit 43aa9b3 into apache:masterFeb 28, 2023
@meszibalu
meszibalu deleted the mb/HBASE-27673 branch February 28, 2023 17:41
vinayakphegde pushed a commit to vinayakphegde/hbase that referenced this pull request Apr 4, 2024
@meszibalu
HBASE-27673 Fix mTLS client hostname verification (apache#5065)
86e3dd7
Signed-off-by: Peter Somogyi <psomogyi@apache.org>
Signed-off-by: Bryan Beaudreault <bbeaudreault@apache.org>
(cherry picked from commit 43aa9b3)
Change-Id: I40f704e12d2c675eb28270639ec2a3a631e456c3
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bbeaudreaultbbeaudreaultbbeaudreault left review comments
@petersomogyipetersomogyipetersomogyi approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@meszibalu@Apache-HBase@bbeaudreault@petersomogyi