HDFS-17669 Do not reqest SASL QOP when using CryptoInput/OutputStream

apache · Nov 20, 2024 · a79fb04 · a79fb04
1 parent afdb201
commit a79fb04
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 10 deletions.
diff --git a/...src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/DataTransferSaslUtil.java b/...src/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/DataTransferSaslUtil.java
@@ -112,7 +112,7 @@ public static void checkSaslComplete(SaslParticipant sasl,
     if (!requestedQop.contains(negotiatedQop)) {
       throw new IOException(String.format("SASL handshake completed, but " +
           "channel does not have acceptable quality of protection, " +
-          "requested = %s, negotiated = %s", requestedQop, negotiatedQop));
+          "requested = %s, negotiated(effective) = %s", requestedQop, negotiatedQop));
     }
   }
 
@@ -135,12 +135,11 @@ public static boolean requestedQopContainsPrivacy(
    * @param encryptionAlgorithm to use for SASL negotation
    * @return properties of encrypted SASL negotiation
    */
-  public static Map<String, String> createSaslPropertiesForEncryption(
-      String encryptionAlgorithm) {
-    Map<String, String> saslProps = Maps.newHashMapWithExpectedSize(3);
-    saslProps.put(Sasl.QOP, QualityOfProtection.PRIVACY.getSaslQop());
+  public static Map<String, String> createSaslPropertiesForEncryption() {
+    Map<String, String> saslProps = Maps.newHashMapWithExpectedSize(1);
+    // This is equivalent to the default null, but the rest of Haddop expects this to be set
+    saslProps.put(Sasl.QOP, QualityOfProtection.AUTHENTICATION.getSaslQop());
     saslProps.put(Sasl.SERVER_AUTH, "true");
-    saslProps.put("com.sun.security.sasl.digest.cipher", encryptionAlgorithm);
     return saslProps;
   }
 

diff --git a/...c/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java b/...c/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferClient.java
@@ -315,8 +315,7 @@ private IOStreamPair getEncryptedStreams(InetAddress addr,
       Token<BlockTokenIdentifier> accessToken,
       SecretKey secretKey)
       throws IOException {
-    Map<String, String> saslProps = createSaslPropertiesForEncryption(
-        encryptionKey.encryptionAlgorithm);
+    Map<String, String> saslProps = createSaslPropertiesForEncryption();
     if (secretKey != null) {
       LOG.debug("DataNode overwriting downstream QOP" +
           saslProps.get(Sasl.QOP));

diff --git a/...c/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferServer.java b/...c/main/java/org/apache/hadoop/hdfs/protocol/datatransfer/sasl/SaslDataTransferServer.java
@@ -173,8 +173,7 @@ private IOStreamPair getEncryptedStreams(Peer peer,
       return new IOStreamPair(underlyingIn, underlyingOut);
     }
 
-    Map<String, String> saslProps = createSaslPropertiesForEncryption(
-      dnConf.getEncryptionAlgorithm());
+    Map<String, String> saslProps = createSaslPropertiesForEncryption();
 
     if (LOG.isDebugEnabled()) {
       LOG.debug("Server using encryption algorithm " +