|
| 1 | +/* |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one or more |
| 3 | + * contributor license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright ownership. |
| 5 | + * The ASF licenses this file to You under the Apache License, Version 2.0 |
| 6 | + * (the "License"); you may not use this file except in compliance with |
| 7 | + * the License. You may obtain a copy of the License at |
| 8 | + * |
| 9 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | + * |
| 11 | + * Unless required by applicable law or agreed to in writing, software |
| 12 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | + * See the License for the specific language governing permissions and |
| 15 | + * limitations under the License. |
| 16 | + */ |
| 17 | + |
| 18 | +package org.apache.spark.network.netty |
| 19 | + |
| 20 | +import java.nio._ |
| 21 | +import java.util.concurrent.TimeUnit |
| 22 | + |
| 23 | +import scala.concurrent.duration._ |
| 24 | +import scala.concurrent.{Await, Promise} |
| 25 | +import scala.util.{Failure, Success, Try} |
| 26 | + |
| 27 | +import org.apache.commons.io.IOUtils |
| 28 | +import org.apache.spark.network.buffer.{ManagedBuffer, NioManagedBuffer} |
| 29 | +import org.apache.spark.network.shuffle.BlockFetchingListener |
| 30 | +import org.apache.spark.network.{BlockDataManager, BlockTransferService} |
| 31 | +import org.apache.spark.storage.{BlockId, ShuffleBlockId} |
| 32 | +import org.apache.spark.{SecurityManager, SparkConf} |
| 33 | +import org.mockito.Mockito._ |
| 34 | +import org.scalatest.mock.MockitoSugar |
| 35 | +import org.scalatest.{BeforeAndAfterAll, BeforeAndAfterEach, FunSuite, ShouldMatchers} |
| 36 | + |
| 37 | +class NettyBlockTransferSecuritySuite extends FunSuite with MockitoSugar with ShouldMatchers { |
| 38 | + test("security default off") { |
| 39 | + testConnection(new SparkConf, new SparkConf) match { |
| 40 | + case Success(_) => // expected |
| 41 | + case Failure(t) => fail(t) |
| 42 | + } |
| 43 | + } |
| 44 | + |
| 45 | + test("security on same password") { |
| 46 | + val conf = new SparkConf() |
| 47 | + .set("spark.authenticate", "true") |
| 48 | + .set("spark.authenticate.secret", "good") |
| 49 | + .set("spark.app.id", "app-id") |
| 50 | + testConnection(conf, conf) match { |
| 51 | + case Success(_) => // expected |
| 52 | + case Failure(t) => fail(t) |
| 53 | + } |
| 54 | + } |
| 55 | + |
| 56 | + test("security on mismatch password") { |
| 57 | + val conf0 = new SparkConf() |
| 58 | + .set("spark.authenticate", "true") |
| 59 | + .set("spark.authenticate.secret", "good") |
| 60 | + .set("spark.app.id", "app-id") |
| 61 | + val conf1 = conf0.clone.set("spark.authenticate.secret", "bad") |
| 62 | + testConnection(conf0, conf1) match { |
| 63 | + case Success(_) => fail("Should have failed") |
| 64 | + case Failure(t) => t.getMessage should include ("Mismatched response") |
| 65 | + } |
| 66 | + } |
| 67 | + |
| 68 | + test("security mismatch auth off on server") { |
| 69 | + val conf0 = new SparkConf() |
| 70 | + .set("spark.authenticate", "true") |
| 71 | + .set("spark.authenticate.secret", "good") |
| 72 | + .set("spark.app.id", "app-id") |
| 73 | + val conf1 = conf0.clone.set("spark.authenticate", "false") |
| 74 | + testConnection(conf0, conf1) match { |
| 75 | + case Success(_) => fail("Should have failed") |
| 76 | + case Failure(t) => // any funny error may occur, sever will interpret SASL token as RPC |
| 77 | + } |
| 78 | + } |
| 79 | + |
| 80 | + test("security mismatch auth off on client") { |
| 81 | + val conf0 = new SparkConf() |
| 82 | + .set("spark.authenticate", "false") |
| 83 | + .set("spark.authenticate.secret", "good") |
| 84 | + .set("spark.app.id", "app-id") |
| 85 | + val conf1 = conf0.clone.set("spark.authenticate", "true") |
| 86 | + testConnection(conf0, conf1) match { |
| 87 | + case Success(_) => fail("Should have failed") |
| 88 | + case Failure(t) => t.getMessage should include ("Expected SaslMessage") |
| 89 | + } |
| 90 | + } |
| 91 | + |
| 92 | + test("security mismatch app ids") { |
| 93 | + val conf0 = new SparkConf() |
| 94 | + .set("spark.authenticate", "true") |
| 95 | + .set("spark.authenticate.secret", "good") |
| 96 | + .set("spark.app.id", "app-id") |
| 97 | + val conf1 = conf0.clone.set("spark.app.id", "other-id") |
| 98 | + testConnection(conf0, conf1) match { |
| 99 | + case Success(_) => fail("Should have failed") |
| 100 | + case Failure(t) => t.getMessage should include ("SASL appId app-id did not match") |
| 101 | + } |
| 102 | + } |
| 103 | + |
| 104 | + /** |
| 105 | + * Creates two servers with different configurations and sees if they can talk. |
| 106 | + * Returns Success() if they can transfer a block, and Failure() if the block transfer was failed |
| 107 | + * properly. We will throw an out-of-band exception if something other than that goes wrong. |
| 108 | + */ |
| 109 | + private def testConnection(conf0: SparkConf, conf1: SparkConf): Try[Unit] = { |
| 110 | + val blockManager = mock[BlockDataManager] |
| 111 | + val blockId = ShuffleBlockId(0, 1, 2) |
| 112 | + val blockString = "Hello, world!" |
| 113 | + val blockBuffer = new NioManagedBuffer(ByteBuffer.wrap(blockString.getBytes)) |
| 114 | + when(blockManager.getBlockData(blockId)).thenReturn(blockBuffer) |
| 115 | + |
| 116 | + val securityManager0 = new SecurityManager(conf0) |
| 117 | + val exec0 = new NettyBlockTransferService(conf0, securityManager0) |
| 118 | + exec0.init(blockManager) |
| 119 | + |
| 120 | + val securityManager1 = new SecurityManager(conf1) |
| 121 | + val exec1 = new NettyBlockTransferService(conf1, securityManager1) |
| 122 | + exec1.init(blockManager) |
| 123 | + |
| 124 | + val result = fetchBlock(exec0, exec1, "1", blockId) match { |
| 125 | + case Success(buf) => |
| 126 | + IOUtils.toString(buf.createInputStream()) should equal(blockString) |
| 127 | + buf.release() |
| 128 | + Success() |
| 129 | + case Failure(t) => |
| 130 | + Failure(t) |
| 131 | + } |
| 132 | + exec0.close() |
| 133 | + exec1.close() |
| 134 | + result |
| 135 | + } |
| 136 | + |
| 137 | + /** Synchronously fetches a single block, acting as the given executor fetching from another. */ |
| 138 | + private def fetchBlock( |
| 139 | + self: BlockTransferService, |
| 140 | + from: BlockTransferService, |
| 141 | + execId: String, |
| 142 | + blockId: BlockId): Try[ManagedBuffer] = { |
| 143 | + |
| 144 | + val promise = Promise[ManagedBuffer]() |
| 145 | + |
| 146 | + self.fetchBlocks(from.hostName, from.port, execId, Array(blockId.toString), |
| 147 | + new BlockFetchingListener { |
| 148 | + override def onBlockFetchFailure(blockId: String, exception: Throwable): Unit = { |
| 149 | + promise.failure(exception) |
| 150 | + } |
| 151 | + |
| 152 | + override def onBlockFetchSuccess(blockId: String, data: ManagedBuffer): Unit = { |
| 153 | + promise.success(data.retain()) |
| 154 | + } |
| 155 | + }) |
| 156 | + |
| 157 | + Await.ready(promise.future, FiniteDuration(1000, TimeUnit.MILLISECONDS)) |
| 158 | + promise.future.value.get |
| 159 | + } |
| 160 | +} |
| 161 | + |
0 commit comments