Переглянути джерело

HUE-219. More cleanup, javadoc, etc

Todd Lipcon 15 роки тому
батько
коміт
23f19fe943

+ 9 - 3
desktop/core/src/desktop/lib/thrift_sasl.py

@@ -18,6 +18,7 @@
 # specific language governing permissions and limitations
 # under the License.
 #
+""" SASL transports for Thrift. """
 
 import sys
 
@@ -36,6 +37,11 @@ class TSaslClientTransport(TTransportBase, CReadableTransport):
   COMPLETE = 5
 
   def __init__(self, sasl_client_factory, mechanism, trans):
+    """
+    @param sasl_client_factory: a callable that returns a new sasl.Client object
+    @param mechanism: the SASL mechanism (e.g. "GSSAPI")
+    @param trans: the underlying transport over which to communicate.
+    """
     self._trans = trans
     self.sasl_client_factory = sasl_client_factory
     self.sasl = None
@@ -86,10 +92,10 @@ class TSaslClientTransport(TTransportBase, CReadableTransport):
     self._trans.flush()
 
   def _recv_sasl_message(self):
-    header = self._trans.read(5)
+    header = self._trans.readAll(5)
     status, length = struct.unpack(">BI", header)
     if length > 0:
-      payload = self._trans.read(length)
+      payload = self._trans.readAll(length)
     else:
       payload = ""
     return status, payload
@@ -139,7 +145,7 @@ class TSaslClientTransport(TTransportBase, CReadableTransport):
     # ask for a refill until the previous buffer is empty.  Therefore,
     # we can start reading new frames immediately.
     while len(prefix) < reqlen:
-      self.readFrame()
+      self._read_frame()
       prefix += self.__rbuf.getvalue()
     self.__rbuf = StringIO(prefix)
     return self.__rbuf

+ 15 - 3
desktop/core/src/desktop/lib/thrift_util.py

@@ -30,7 +30,7 @@ from thrift.Thrift import TType
 from thrift.transport.TSocket import TSocket
 from thrift.transport.TTransport import TBufferedTransport, TMemoryBuffer,\
                                         TTransportException
-from thrift.protocol.TBinaryProtocol import TBinaryProtocol, TBinaryProtocolAccelerated
+from thrift.protocol.TBinaryProtocol import TBinaryProtocol
 from desktop.lib.thrift_sasl import TSaslClientTransport
 
 # The maximum depth that we will recurse through a "jsonable" structure
@@ -44,10 +44,22 @@ WARN_LEVEL_CALL_DURATION_MS = 5000
 INFO_LEVEL_CALL_DURATION_MS = 1000
 
 class ConnectionConfig(object):
+  """ Struct-like class encapsulating the configuration of a Thrift client. """
   def __init__(self, klass, host, port, service_name,
                use_sasl=False,
                kerberos_principal="thrift",
                timeout_seconds=45):
+    """
+    @param klass The thrift client class
+    @param host Host to connect to
+    @param port Port to connect to
+    @param service_name A human-readable name to describe the service
+    @param use_sasl If true, will use Kerberos over SASL to authenticate
+    @param kerberos_principal The Kerberos service name to connect to.
+              NOTE: for a server like fooservice/foo.blah.com@REALM only
+              specify "fooservice", NOT the full principal name.
+    @param timeout_seconds Timeout for thrift calls
+    """
     self.klass = klass
     self.host = host
     self.port = port
@@ -164,7 +176,7 @@ def connect_to_thrift(conf):
   sock = TSocket(conf.host, conf.port)
   if conf.timeout_seconds:
     # Thrift trivia: You can do this after the fact with
-    # self.wrapped.transport._TBufferedTransport__trans.setTimeout(seconds*1000)
+    # _grab_transport_from_wrapper(self.wrapped.transport).setTimeout(seconds*1000)
     sock.setTimeout(conf.timeout_seconds*1000.0)
   if conf.use_sasl:
     def sasl_factory():
@@ -188,7 +200,7 @@ _connection_pool = ConnectionPooler()
 def get_client(klass, host, port, service_name,
                **kwargs):
   conf = ConnectionConfig(
-    klass,host,port,service_name,
+    klass, host, port, service_name,
     **kwargs)
   return PooledClient(conf)
 

+ 1 - 1
desktop/libs/hadoop/java/src/java/org/apache/hadoop/mapred/ThriftJobTrackerPlugin.java

@@ -658,7 +658,7 @@ public class ThriftJobTrackerPlugin extends JobTrackerPlugin implements Configur
           // The port may have been 0, so we update it.
           conf.set(THRIFT_ADDRESS_PROPERTY, address.getHostName() + ":" +
               thriftServer.getPort());
-        } catch (Exception  e) {
+        } catch (Exception e) {
             LOG.warn("Cannot start Thrift jobtracker plug-in", e);
             throw new RuntimeException("Cannot start Thrift jobtracker plug-in", e);
         }

+ 17 - 4
desktop/libs/hadoop/java/src/java/org/apache/hadoop/thriftfs/ThriftUtils.java

@@ -22,6 +22,7 @@ import java.util.Arrays;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 
@@ -47,8 +48,10 @@ import org.apache.thrift.protocol.TBinaryProtocol;
 import org.apache.thrift.protocol.TProtocol;
 import org.apache.thrift.transport.TSocket;
 import org.apache.thrift.transport.TTransport;
+
+
 public class ThriftUtils {
-  
+
   static final Log LOG = LogFactory.getLog(ThriftUtils.class);
 
   static final String HUE_USER_NAME_KEY = "hue.kerberos.principal.shortname";
@@ -173,10 +176,16 @@ public class ThriftUtils {
     return ret;
   }
 
-  public static class SecurityCheckingProxy<T> implements java.lang.reflect.InvocationHandler {
+  /**
+   * An invocation proxy that authorizes all calls into the Thrift interface.
+   * This proxy intercepts all method calls on the handler interface, and verifies
+   * that the remote UGI is either (a) the hue user, or (b) another HDFS daemon.
+   */
+  public static class SecurityCheckingProxy<T> implements InvocationHandler {
     private final T wrapped;
     private final Configuration conf;
 
+    @SuppressWarnings("unchecked")
     public static <T> T create(Configuration conf, T wrapped, Class<T> iface) {
       return (T)java.lang.reflect.Proxy.newProxyInstance(
         iface.getClassLoader(),
@@ -195,8 +204,8 @@ public class ThriftUtils {
       Object result;
       try {
         if (LOG.isDebugEnabled()) {
-          LOG.debug("Call " + wrapped.getClass() + "." + m.getName() +
-                    StringUtils.joinObjects(", ", Arrays.asList(args)));
+          LOG.debug("Call " + wrapped.getClass() + "." + m.getName()
+                    + "(" + StringUtils.joinObjects(", ", Arrays.asList(args)) + ")");
         }
         authorizeCall(m);
 
@@ -218,9 +227,13 @@ public class ThriftUtils {
               caller.getShortUserName())) {
 
           String errMsg = "Unauthorized access for user " + caller.getUserName();
+          // If we can throw our thrift IOException type, do so, so it goes back
+          // to the client correctly.
           if (Arrays.asList(m.getExceptionTypes()).contains(IOException.class)) {
             throw ThriftUtils.toThrift(new Exception(errMsg));
           } else {
+            // Otherwise we have to just throw the more generic exception, which
+            // won't make it back to the client
             throw new TException(errMsg);
           }
         }