HBASE-30101 Prevent NettyRpcServer from accepting connections before start()#8110
HBASE-30101 Prevent NettyRpcServer from accepting connections before start()#8110junegunn wants to merge 2 commits intoapache:masterfrom
Conversation
There was a problem hiding this comment.
Pull request overview
Prevents NettyRpcServer from accepting inbound connections in the window between bind() and start(), closing a race where connection handling could reach security/UGI-related code before server initialization completes.
Changes:
- Add a regression test asserting no connections are accepted before
start(), and that they are accepted after. - Configure the Netty server channel to start with
AUTO_READdisabled to prevent accept. - Enable
AUTO_READon the server channel at the end ofstart()to begin accepting connections.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
hbase-server/src/test/java/org/apache/hadoop/hbase/ipc/TestNettyRpcServerBindBeforeStart.java |
New regression test covering accept behavior before/after start(). |
hbase-server/src/main/java/org/apache/hadoop/hbase/ipc/NettyRpcServer.java |
Disable accept via AUTO_READ=false until start() completes, then re-enable. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…fore start() NettyRpcServer binds the server channel in its constructor but only completes auth/authorization setup in start(). Between those two points, netty workers can accept incoming connections and run handler code that reaches into UserGroupInformation before the main thread has logged in. This test fails against the unpatched server: a socket opened after the port is bound but before start() is called is accepted by netty.
…start() Disable AUTO_READ on the server channel at bootstrap time so that no connections are accepted until start() completes auth setup, and re-enable it at the end of start().
|
As noted in this Jira comment, this patch does not prevent stray I've opened a separate PR that approaches the problem in a different way, i.e. login before creating the RPC services, which will fix the |
|
What about move the auth related initialization into the channel setup step? And only bind the socket in start method? It is a bit strange that we can accept connections before starting... |
https://issues.apache.org/jira/browse/HBASE-30101