flink-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (FLINK-3930) Implement Service-Level Authorization
Date Wed, 19 Oct 2016 10:59:02 GMT

    [ https://issues.apache.org/jira/browse/FLINK-3930?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15588393#comment-15588393
] 

ASF GitHub Bot commented on FLINK-3930:
---------------------------------------

Github user mxm commented on a diff in the pull request:

    https://github.com/apache/flink/pull/2425#discussion_r84033402
  
    --- Diff: flink-runtime/src/main/java/org/apache/flink/runtime/io/network/netty/NettyMessage.java
---
    @@ -57,24 +61,37 @@
     	// constructor in order to work with the generic deserializer.
     	// ------------------------------------------------------------------------
     
    -	static final int HEADER_LENGTH = 4 + 4 + 1; // frame length (4), magic number (4), msg
ID (1)
    +	static final int HEADER_LENGTH = 4 + 4 + 4 + 1; // frame length (4), magic number (4),
Cookie (4), msg ID (1)
     
     	static final int MAGIC_NUMBER = 0xBADC0FFE;
     
    +	static final int BUFFER_SIZE = 65536;
    +
    +	static final Charset DEFAULT_CHARSET = Charset.forName("utf-8");
    +
     	abstract ByteBuf write(ByteBufAllocator allocator) throws Exception;
     
     	abstract void readFrom(ByteBuf buffer) throws Exception;
     
     	// ------------------------------------------------------------------------
     
    -	private static ByteBuf allocateBuffer(ByteBufAllocator allocator, byte id) {
    -		return allocateBuffer(allocator, id, 0);
    +	private static ByteBuf allocateBuffer(ByteBufAllocator allocator, byte id, String secureCookie)
{
    +		return allocateBuffer(allocator, id, secureCookie, 0);
     	}
     
    -	private static ByteBuf allocateBuffer(ByteBufAllocator allocator, byte id, int length)
{
    +	private static ByteBuf allocateBuffer(ByteBufAllocator allocator, byte id, String secureCookie,
int length) {
    +		secureCookie = (secureCookie == null || secureCookie.length() == 0) ? "": secureCookie;
    +		length+=secureCookie.getBytes().length;
    --- End diff --
    
    This seems inefficient, always getting the byte array. The length should be supplied and
just be calculated once.


> Implement Service-Level Authorization
> -------------------------------------
>
>                 Key: FLINK-3930
>                 URL: https://issues.apache.org/jira/browse/FLINK-3930
>             Project: Flink
>          Issue Type: New Feature
>          Components: Security
>            Reporter: Eron Wright 
>            Assignee: Vijay Srinivasaraghavan
>              Labels: security
>   Original Estimate: 672h
>  Remaining Estimate: 672h
>
> _This issue is part of a series of improvements detailed in the [Secure Data Access|https://docs.google.com/document/d/1-GQB6uVOyoaXGwtqwqLV8BHDxWiMO2WnVzBoJ8oPaAs/edit?usp=sharing]
design doc._
> Service-level authorization is the initial authorization mechanism to ensure clients
(or servers) connecting to the Flink cluster are authorized to do so.   The purpose is to
prevent a cluster from being used by an unauthorized user, whether to execute jobs, disrupt
cluster functionality, or gain access to secrets stored within the cluster.
> Implement service-level authorization as described in the design doc.
> - Introduce a shared secret cookie
> - Enable Akka security cookie
> - Implement data transfer authentication
> - Secure the web dashboard



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message