Skip to content

HBASE-30337 Miscellaneous improvements on rpc checks #8560

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Apache9 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

HBASE-30337 Miscellaneous improvements on rpc checks #8560

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions hbase-client/src/main/java/org/apache/hadoop/hbase/security/access/Permission.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
import java.util.List;
import java.util.Map;
import java.util.Objects;
import org.apache.hadoop.hbase.HBaseInterfaceAudience;
import org.apache.hadoop.hbase.TableName;
import org.apache.hadoop.hbase.util.Bytes;
import org.apache.hadoop.io.VersionedWritable;
Expand Down Expand Up @@ -62,8 +63,8 @@ public byte code() {
}
}

@InterfaceAudience.Private
protected enum Scope {
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.COPROC)
public enum Scope {
GLOBAL('G'),
NAMESPACE('N'),
TABLE('T'),
Expand Down
16 changes: 16 additions & 0 deletions ...client/src/main/java/org/apache/hadoop/hbase/security/access/ShadedAccessControlUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,4 +328,20 @@ public static HasUserPermissionsRequest buildHasUserPermissionsRequest(String us
}
return builder.build();
}

public static Permission.Scope toPermissionScope(AccessControlProtos.Permission.Type protoType) {
if (protoType == null) {
return null;
}
switch (protoType) {
case Global:
return Permission.Scope.GLOBAL;
case Namespace:
return Permission.Scope.NAMESPACE;
case Table:
return Permission.Scope.TABLE;
default:
return null;
}
}
}
55 changes: 0 additions & 55 deletions hbase-server/src/main/java/org/apache/hadoop/hbase/HBaseRpcServicesBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,8 @@
import com.google.errorprone.annotations.RestrictedApi;
import java.io.IOException;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.net.BindException;
import java.net.InetSocketAddress;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
Expand All @@ -43,9 +41,6 @@
import org.apache.hadoop.hbase.ipc.RpcServerInterface;
import org.apache.hadoop.hbase.namequeues.NamedQueuePayload;
import org.apache.hadoop.hbase.namequeues.NamedQueueRecorder;
import org.apache.hadoop.hbase.namequeues.RpcLogDetails;
import org.apache.hadoop.hbase.namequeues.request.NamedQueueGetRequest;
import org.apache.hadoop.hbase.namequeues.response.NamedQueueGetResponse;
import org.apache.hadoop.hbase.net.Address;
import org.apache.hadoop.hbase.regionserver.RpcSchedulerFactory;
import org.apache.hadoop.hbase.security.User;
Expand All @@ -62,7 +57,6 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import org.apache.hbase.thirdparty.com.google.protobuf.ByteString;
import org.apache.hbase.thirdparty.com.google.protobuf.Message;
import org.apache.hbase.thirdparty.com.google.protobuf.RpcController;
import org.apache.hbase.thirdparty.com.google.protobuf.ServiceException;
Expand All @@ -71,11 +65,8 @@
import org.apache.hadoop.hbase.shaded.protobuf.generated.AdminProtos.AdminService;
import org.apache.hadoop.hbase.shaded.protobuf.generated.AdminProtos.ClearSlowLogResponseRequest;
import org.apache.hadoop.hbase.shaded.protobuf.generated.AdminProtos.ClearSlowLogResponses;
import org.apache.hadoop.hbase.shaded.protobuf.generated.AdminProtos.SlowLogResponseRequest;
import org.apache.hadoop.hbase.shaded.protobuf.generated.AdminProtos.SlowLogResponses;
import org.apache.hadoop.hbase.shaded.protobuf.generated.AdminProtos.UpdateConfigurationRequest;
import org.apache.hadoop.hbase.shaded.protobuf.generated.AdminProtos.UpdateConfigurationResponse;
import org.apache.hadoop.hbase.shaded.protobuf.generated.HBaseProtos;
import org.apache.hadoop.hbase.shaded.protobuf.generated.RPCProtos.RequestHeader;
import org.apache.hadoop.hbase.shaded.protobuf.generated.RegistryProtos.ClientMetaService;
import org.apache.hadoop.hbase.shaded.protobuf.generated.RegistryProtos.GetActiveMasterRequest;
Expand All @@ -89,7 +80,6 @@
import org.apache.hadoop.hbase.shaded.protobuf.generated.RegistryProtos.GetMastersResponseEntry;
import org.apache.hadoop.hbase.shaded.protobuf.generated.RegistryProtos.GetMetaRegionLocationsRequest;
import org.apache.hadoop.hbase.shaded.protobuf.generated.RegistryProtos.GetMetaRegionLocationsResponse;
import org.apache.hadoop.hbase.shaded.protobuf.generated.TooSlowLog.SlowLogPayload;

/**
* Base class for Master and RegionServer RpcServices.
Expand Down Expand Up @@ -414,49 +404,4 @@ public ClearSlowLogResponses clearSlowLogsResponses(final RpcController controll
ClearSlowLogResponses.newBuilder().setIsCleaned(slowLogsCleaned).build();
return clearSlowLogResponses;
}

private List<SlowLogPayload> getSlowLogPayloads(SlowLogResponseRequest request,
NamedQueueRecorder namedQueueRecorder) {
if (namedQueueRecorder == null) {
return Collections.emptyList();
}
List<SlowLogPayload> slowLogPayloads;
NamedQueueGetRequest namedQueueGetRequest = new NamedQueueGetRequest();
namedQueueGetRequest.setNamedQueueEvent(RpcLogDetails.SLOW_LOG_EVENT);
namedQueueGetRequest.setSlowLogResponseRequest(request);
NamedQueueGetResponse namedQueueGetResponse =
namedQueueRecorder.getNamedQueueRecords(namedQueueGetRequest);
slowLogPayloads = namedQueueGetResponse != null
? namedQueueGetResponse.getSlowLogPayloads()
: Collections.emptyList();
return slowLogPayloads;
}

@Override
@QosPriority(priority = HConstants.ADMIN_QOS)
public HBaseProtos.LogEntry getLogEntries(RpcController controller,
HBaseProtos.LogRequest request) throws ServiceException {
try {
final String logClassName = request.getLogClassName();
Class<?> logClass = Class.forName(logClassName).asSubclass(Message.class);
Method method = logClass.getMethod("parseFrom", ByteString.class);
if (logClassName.contains("SlowLogResponseRequest")) {
SlowLogResponseRequest slowLogResponseRequest =
(SlowLogResponseRequest) method.invoke(null, request.getLogMessage());
final NamedQueueRecorder namedQueueRecorder = this.server.getNamedQueueRecorder();
final List<SlowLogPayload> slowLogPayloads =
getSlowLogPayloads(slowLogResponseRequest, namedQueueRecorder);
SlowLogResponses slowLogResponses =
SlowLogResponses.newBuilder().addAllSlowLogPayloads(slowLogPayloads).build();
return HBaseProtos.LogEntry.newBuilder()
.setLogClassName(slowLogResponses.getClass().getName())
.setLogMessage(slowLogResponses.toByteString()).build();
}
} catch (ClassNotFoundException | NoSuchMethodException | IllegalAccessException
| InvocationTargetException e) {
LOG.error("Error while retrieving log entries.", e);
throw new ServiceException(e);
}
throw new ServiceException("Invalid request params");
}
}
52 changes: 48 additions & 4 deletions hbase-server/src/main/java/org/apache/hadoop/hbase/coprocessor/MasterObserver.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -593,7 +593,7 @@ default void preSplitRegionAction(final ObserverContext<MasterCoprocessorEnviron
*/
@SuppressWarnings("unused")
default void preTruncateRegionAction(final ObserverContext<MasterCoprocessorEnvironment> c,
final RegionInfo regionInfo) {
final RegionInfo regionInfo) throws IOException {
}

/**
Expand All @@ -603,7 +603,7 @@ default void preTruncateRegionAction(final ObserverContext<MasterCoprocessorEnvi
*/
@SuppressWarnings("unused")
default void preTruncateRegion(final ObserverContext<MasterCoprocessorEnvironment> c,
RegionInfo regionInfo) {
RegionInfo regionInfo) throws IOException {
}

/**
Expand All @@ -613,7 +613,7 @@ default void preTruncateRegion(final ObserverContext<MasterCoprocessorEnvironmen
*/
@SuppressWarnings("unused")
default void postTruncateRegion(final ObserverContext<MasterCoprocessorEnvironment> c,
RegionInfo regionInfo) {
RegionInfo regionInfo) throws IOException {
}

/**
Expand All @@ -623,7 +623,7 @@ default void postTruncateRegion(final ObserverContext<MasterCoprocessorEnvironme
*/
@SuppressWarnings("unused")
default void postTruncateRegionAction(final ObserverContext<MasterCoprocessorEnvironment> c,
final RegionInfo regionInfo) {
final RegionInfo regionInfo) throws IOException {
}

/**
Expand Down Expand Up @@ -1834,12 +1834,34 @@ default void postRevoke(ObserverContext<MasterCoprocessorEnvironment> ctx,
* @param family the table column family, null if don't get table family permission
* @param qualifier the table column qualifier, null if don't get table qualifier permission
* @throws IOException if something went wrong
* @deprecated Since 2.5.17,2.6.8, 2.7.0, 3.0.1 and 3.10, will be removed in 4.0.0. Use

@liuxiaocs7 liuxiaocs7 Aug 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3.10 should be 3.1.0?

* {@link #preGetUserPermissions(ObserverContext, String, String, TableName, byte[], byte[], Permission.Scope)}
* instead.
*/
@Deprecated
default void preGetUserPermissions(ObserverContext<MasterCoprocessorEnvironment> ctx,
String userName, String namespace, TableName tableName, byte[] family, byte[] qualifier)
throws IOException {
}

/**
* Called before getting user permissions.
* @param ctx the coprocessor instance's environment
* @param userName the user name, null if get all user permissions
* @param namespace the namespace, null if don't get namespace permission
* @param tableName the table name, null if don't get table permission
* @param family the table column family, null if don't get table family permission
* @param qualifier the table column qualifier, null if don't get table qualifier permission
* @param permissionScope the scope of permission being requested (GLOBAL, NAMESPACE, or TABLE),
* may be null for backward compatibility
* @throws IOException if something went wrong
*/
default void preGetUserPermissions(ObserverContext<MasterCoprocessorEnvironment> ctx,
String userName, String namespace, TableName tableName, byte[] family, byte[] qualifier,
Permission.Scope permissionScope) throws IOException {
preGetUserPermissions(ctx, userName, namespace, tableName, family, qualifier);
}

/**
* Called after getting user permissions.
* @param ctx the coprocessor instance's environment
Expand All @@ -1849,12 +1871,34 @@ default void preGetUserPermissions(ObserverContext<MasterCoprocessorEnvironment>
* @param family the table column family, null if don't get table family permission
* @param qualifier the table column qualifier, null if don't get table qualifier permission
* @throws IOException if something went wrong
* @deprecated Since 2.5.17,2.6.8, 2.7.0, 3.0.1 and 3.10, will be removed in 4.0.0. Use
* {@link #postGetUserPermissions(ObserverContext, String, String, TableName, byte[], byte[], Permission.Scope)}
* instead.
*/
@Deprecated
default void postGetUserPermissions(ObserverContext<MasterCoprocessorEnvironment> ctx,
String userName, String namespace, TableName tableName, byte[] family, byte[] qualifier)
throws IOException {
}

/**
* Called after getting user permissions.
* @param ctx the coprocessor instance's environment
* @param userName the user name, null if get all user permissions
* @param namespace the namespace, null if don't get namespace permission
* @param tableName the table name, null if don't get table permission
* @param family the table column family, null if don't get table family permission
* @param qualifier the table column qualifier, null if don't get table qualifier permission
* @param permissionScope the scope of permission being requested (GLOBAL, NAMESPACE, or TABLE),
* may be null for backward compatibility
* @throws IOException if something went wrong
*/
default void postGetUserPermissions(ObserverContext<MasterCoprocessorEnvironment> ctx,
String userName, String namespace, TableName tableName, byte[] family, byte[] qualifier,
Permission.Scope permissionScope) throws IOException {
postGetUserPermissions(ctx, userName, namespace, tableName, family, qualifier);
}

/*
* Called before checking if user has permissions.
* @param ctx the coprocessor instance's environment
Expand Down
32 changes: 28 additions & 4 deletions hbase-server/src/main/java/org/apache/hadoop/hbase/master/MasterCoprocessorHost.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -873,7 +873,7 @@ public void call(MasterObserver observer) throws IOException {
public void preTruncateRegion(RegionInfo regionInfo) throws IOException {
execOperation(coprocEnvironments.isEmpty() ? null : new MasterObserverOperation() {
@Override
public void call(MasterObserver observer) {
public void call(MasterObserver observer) throws IOException {
observer.preTruncateRegion(this, regionInfo);
}
});
Expand All @@ -886,7 +886,7 @@ public void call(MasterObserver observer) {
public void postTruncateRegion(RegionInfo regionInfo) throws IOException {
execOperation(coprocEnvironments.isEmpty() ? null : new MasterObserverOperation() {
@Override
public void call(MasterObserver observer) {
public void call(MasterObserver observer) throws IOException {
observer.postTruncateRegion(this, regionInfo);
}
});
Expand Down Expand Up @@ -2085,22 +2085,46 @@ public void call(MasterObserver observer) throws IOException {
});
}

/**
* @deprecated Since 2.5.17,2.6.8, 2.7.0, 3.0.1 and 3.10, will be removed in 4.0.0.. Use
* {@link #preGetUserPermissions(String, String, TableName, byte[], byte[], Permission.Scope)}
* instead.
*/
@Deprecated
public void preGetUserPermissions(String userName, String namespace, TableName tableName,
byte[] family, byte[] qualifier) throws IOException {
preGetUserPermissions(userName, namespace, tableName, family, qualifier, null);
}

public void preGetUserPermissions(String userName, String namespace, TableName tableName,
byte[] family, byte[] qualifier, Permission.Scope permissionScope) throws IOException {
execOperation(coprocEnvironments.isEmpty() ? null : new MasterObserverOperation() {
@Override
public void call(MasterObserver observer) throws IOException {
observer.preGetUserPermissions(this, userName, namespace, tableName, family, qualifier);
observer.preGetUserPermissions(this, userName, namespace, tableName, family, qualifier,
permissionScope);
}
});
}

/**
* @deprecated Since 2.5.17,2.6.8, 2.7.0, 3.0.1 and 3.10, will be removed in 4.0.0. Use
* {@link #postGetUserPermissions(String, String, TableName, byte[], byte[], Permission.Scope)}
* instead.
*/
@Deprecated
public void postGetUserPermissions(String userName, String namespace, TableName tableName,
byte[] family, byte[] qualifier) throws IOException {
postGetUserPermissions(userName, namespace, tableName, family, qualifier, null);
}

public void postGetUserPermissions(String userName, String namespace, TableName tableName,
byte[] family, byte[] qualifier, Permission.Scope permissionScope) throws IOException {
execOperation(coprocEnvironments.isEmpty() ? null : new MasterObserverOperation() {
@Override
public void call(MasterObserver observer) throws IOException {
observer.postGetUserPermissions(this, userName, namespace, tableName, family, qualifier);
observer.postGetUserPermissions(this, userName, namespace, tableName, family, qualifier,
permissionScope);
}
});
}
Expand Down
17 changes: 13 additions & 4 deletions hbase-server/src/main/java/org/apache/hadoop/hbase/master/MasterRpcServices.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2770,6 +2770,7 @@ private void checkMasterProcedureExecutor() throws ServiceException {
@Override
public MasterProtos.AssignsResponse assigns(RpcController controller,
MasterProtos.AssignsRequest request) throws ServiceException {
rpcPreCheck("assigns");
checkMasterProcedureExecutor();
final ProcedureExecutor<MasterProcedureEnv> pe = server.getMasterProcedureExecutor();
final AssignmentManager am = server.getAssignmentManager();
Expand Down Expand Up @@ -2798,6 +2799,7 @@ public MasterProtos.AssignsResponse assigns(RpcController controller,
@Override
public MasterProtos.UnassignsResponse unassigns(RpcController controller,
MasterProtos.UnassignsRequest request) throws ServiceException {
rpcPreCheck("unassigns");
checkMasterProcedureExecutor();
final ProcedureExecutor<MasterProcedureEnv> pe = server.getMasterProcedureExecutor();
final AssignmentManager am = server.getAssignmentManager();
Expand Down Expand Up @@ -2830,6 +2832,7 @@ public MasterProtos.UnassignsResponse unassigns(RpcController controller,
@Override
public MasterProtos.BypassProcedureResponse bypassProcedure(RpcController controller,
MasterProtos.BypassProcedureRequest request) throws ServiceException {
rpcPreCheck("bypassProcedure");
try {
LOG.info("{} bypass procedures={}, waitTime={}, override={}, recursive={}",
server.getClientIdAuditPrefix(), request.getProcIdList(), request.getWaitTime(),
Expand All @@ -2847,6 +2850,7 @@ public MasterProtos.BypassProcedureResponse bypassProcedure(RpcController contro
public MasterProtos.ScheduleServerCrashProcedureResponse scheduleServerCrashProcedure(
RpcController controller, MasterProtos.ScheduleServerCrashProcedureRequest request)
throws ServiceException {
rpcPreCheck("scheduleServerCrashProcedure");
List<Long> pids = new ArrayList<>();
for (HBaseProtos.ServerName sn : request.getServerNameList()) {
ServerName serverName = ProtobufUtil.toServerName(sn);
Expand All @@ -2865,6 +2869,7 @@ public MasterProtos.ScheduleServerCrashProcedureResponse scheduleServerCrashProc
public MasterProtos.ScheduleSCPsForUnknownServersResponse scheduleSCPsForUnknownServers(
RpcController controller, MasterProtos.ScheduleSCPsForUnknownServersRequest request)
throws ServiceException {
rpcPreCheck("scheduleSCPsForUnknownServers");
List<Long> pids = new ArrayList<>();
final Set<ServerName> serverNames = server.getAssignmentManager().getRegionStates()
.getRegionStates().stream().map(RegionState::getServerName).collect(Collectors.toSet());
Expand Down Expand Up @@ -2993,7 +2998,10 @@ public GetUserPermissionsResponse getUserPermissions(RpcController controller,
byte[] cq =
request.hasColumnQualifier() ? request.getColumnQualifier().toByteArray() : null;
Type permissionType = request.hasType() ? request.getType() : null;
server.getMasterCoprocessorHost().preGetUserPermissions(userName, namespace, table, cf, cq);
Permission.Scope permissionScope =
ShadedAccessControlUtil.toPermissionScope(permissionType);
server.getMasterCoprocessorHost().preGetUserPermissions(userName, namespace, table, cf, cq,
permissionScope);

List<UserPermission> perms = null;
if (permissionType == Type.Table) {
Expand All @@ -3018,8 +3026,8 @@ public GetUserPermissionsResponse getUserPermissions(RpcController controller,
}
}

server.getMasterCoprocessorHost().postGetUserPermissions(userName, namespace, table, cf,
cq);
server.getMasterCoprocessorHost().postGetUserPermissions(userName, namespace, table, cf, cq,
permissionScope);
AccessControlProtos.GetUserPermissionsResponse response =
ShadedAccessControlUtil.buildGetUserPermissionsResponse(perms);
return response;
Expand Down Expand Up @@ -3436,6 +3444,7 @@ public UpdateRSGroupConfigResponse updateRSGroupConfig(RpcController controller,
public HBaseProtos.LogEntry getLogEntries(RpcController controller,
HBaseProtos.LogRequest request) throws ServiceException {
try {
requirePermission("getLogEntries", Permission.Action.ADMIN);
final String logClassName = request.getLogClassName();
Class<?> logClass = Class.forName(logClassName).asSubclass(Message.class);
Method method = logClass.getMethod("parseFrom", ByteString.class);
Expand All @@ -3457,7 +3466,7 @@ public HBaseProtos.LogEntry getLogEntries(RpcController controller,
.setLogMessage(balancerRejectionsResponse.toByteString()).build();
}
} catch (ClassNotFoundException | NoSuchMethodException | IllegalAccessException
| InvocationTargetException e) {
| InvocationTargetException | IOException e) {
LOG.error("Error while retrieving log entries.", e);
throw new ServiceException(e);
}
Expand Down
Loading