HADOOP-8878. Merge r1396925 from branch-1 for release 1.1.1

git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/branches/branch-1.1@1407256 13f79535-47bb-0310-9956-ffa450edef68

CHANGES.txt

@@ -12,6 +12,10 @@ Release 1.1.1 - Unreleased
 
   BUG FIXES
 
+    HADOOP-8878. Uppercase namenode hostname causes hadoop dfs calls with
+    webhdfs filesystem and fsck to fail when security is on.
+    (Arpit Gupta via suresh)
+
     HDFS-3791. HDFS-173 Backport - Namenode will not block until a large 
     directory deletion completes. It allows other operations when the 
     deletion is in progress. (umamahesh via suresh)

src/core/org/apache/hadoop/security/SecurityUtil.java

@@ -258,7 +258,14 @@ public class SecurityUtil {
     return components[0] + "/" + fqdn.toLowerCase() + "@" + components[2];
   }
   
-  static String getLocalHostName() throws UnknownHostException {
+  /**
+   * Get the fqdn for the current host.
+   * 
+   * @return fqdn of the current host.
+   * @throws UnknownHostException
+   *           if no IP address for the local host could be found.
+   */
+  public static String getLocalHostName() throws UnknownHostException {
     return InetAddress.getLocalHost().getCanonicalHostName();
   }
 

src/core/org/apache/hadoop/security/authentication/client/KerberosAuthenticator.java

@@ -194,7 +194,8 @@ public class KerberosAuthenticator implements Authenticator {
           GSSContext gssContext = null;
           try {
             GSSManager gssManager = GSSManager.getInstance();
-            String servicePrincipal = "HTTP/" + KerberosAuthenticator.this.url.getHost();
+            String servicePrincipal = KerberosUtil.getServicePrincipal("HTTP",
+                KerberosAuthenticator.this.url.getHost());
             Oid oid = KerberosUtil.getOidInstance("NT_GSS_KRB5_PRINCIPAL");
             GSSName serviceName = gssManager.createName(servicePrincipal,
                                                         oid);

src/core/org/apache/hadoop/security/authentication/util/KerberosUtil.java

@@ -20,7 +20,10 @@ package org.apache.hadoop.security.authentication.util;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.net.UnknownHostException;
+import java.util.Locale;
 
+import org.apache.hadoop.security.SecurityUtil;
 import org.ietf.jgss.GSSException;
 import org.ietf.jgss.Oid;
 
@@ -65,4 +68,26 @@ public class KerberosUtil {
          new Class[0]);
     return (String)getDefaultRealmMethod.invoke(kerbConf, new Object[0]);
   }
+  
+  /**
+   * Create Kerberos principal for a given service and hostname. It converts
+   * hostname to lower case. If hostname is null or "0.0.0.0", it uses
+   * dynamically looked-up fqdn of the current host instead.
+   * 
+   * @param service
+   *          Service for which you want to generate the principal.
+   * @param hostname
+   *          Fully-qualified domain name.
+   * @return Converted Kerberos principal name.
+   * @throws UnknownHostException
+   *           If no IP address for the local host could be found.
+   */
+  public static final String getServicePrincipal(String service, String hostname)
+      throws UnknownHostException {
+    String fqdn = hostname;
+    if (null == fqdn || fqdn.equals("") || fqdn.equals("0.0.0.0")) {
+      fqdn = SecurityUtil.getLocalHostName();
+    }
+    return service + "/" + fqdn.toLowerCase(Locale.US);
+  }
 }

src/test/org/apache/hadoop/security/TestKerberosUtil.java

@@ -0,0 +1,58 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.hadoop.security;
+
+import static org.junit.Assert.*;
+
+import java.io.IOException;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.apache.hadoop.security.authentication.util.KerberosUtil;
+import org.junit.Test;
+
+public class TestKerberosUtil {
+  public static final Log LOG = LogFactory.getLog(TestKerberosUtil.class);
+
+  @Test
+  public void testGetServerPrincipal() throws IOException {
+    String service = "TestKerberosUtil";
+    String localHostname = SecurityUtil.getLocalHostName();
+    String testHost = "FooBar";
+    
+    // send null hostname
+    assertEquals("When no hostname is sent",
+        service + "/" + localHostname.toLowerCase(),
+        KerberosUtil.getServicePrincipal(service, null));
+    // send empty hostname
+    assertEquals("When empty hostname is sent",
+        service + "/" + localHostname.toLowerCase(),
+        KerberosUtil.getServicePrincipal(service, ""));
+    // send 0.0.0.0 hostname
+    assertEquals("When 0.0.0.0 hostname is sent",
+        service + "/" + localHostname.toLowerCase(),
+        KerberosUtil.getServicePrincipal(service, "0.0.0.0"));
+    // send uppercase hostname
+    assertEquals("When uppercase hostname is sent",
+        service + "/" + testHost.toLowerCase(),
+        KerberosUtil.getServicePrincipal(service, testHost));
+    // send lowercase hostname
+    assertEquals("When lowercase hostname is sent",
+        service + "/" + testHost.toLowerCase(),
+        KerberosUtil.getServicePrincipal(service, testHost.toLowerCase()));
+  }
+}