commit d708644a758d1fbae959cb2b7fb8dfc6244bcb9e

Author: Devaraj Das <ddas@yahoo-inc.com>
Date:   Tue Feb 16 12:51:39 2010 -0800

    HADOOP:1026 from https://issues.apache.org/jira/secure/attachment/12436027/1026-bp20-bugfix.patch
    
    +++ b/YAHOO-CHANGES.txt
    +    HADOOP-1026. Fixes a bug in the backport. (ddas)
    +


git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/branches/branch-0.20-security-patches@1077169 13f79535-47bb-0310-9956-ffa450edef68

src/mapred/org/apache/hadoop/mapred/ReduceTask.java

@@ -1385,27 +1385,8 @@ class ReduceTask extends Task {
         // Connect
         URL url = mapOutputLoc.getOutputLocation();
         URLConnection connection = url.openConnection();
-
-        // generate hash of the url
-        String msgToEncode = SecureShuffleUtils.buildMsgFrom(url);
-        String encHash = SecureShuffleUtils.hashFromString(msgToEncode, jobTokenSecret);
-
-        // put url hash into http header
-        connection.addRequestProperty(
-            SecureShuffleUtils.HTTP_HEADER_URL_HASH, encHash);
         
-        InputStream input = getInputStream(connection, shuffleConnectionTimeout,
-                                           shuffleReadTimeout); 
-
-        // get the replyHash which is HMac of the encHash we sent to the server
-        String replyHash = connection.getHeaderField(SecureShuffleUtils.HTTP_HEADER_REPLY_URL_HASH);
-        if(replyHash==null) {
-          throw new IOException("security validation of TT Map output failed");
-        }       
-        LOG.debug("url="+msgToEncode+";encHash="+encHash+";replyHash="+replyHash);
-        // verify that replyHash is HMac of encHash
-        SecureShuffleUtils.verifyReply(replyHash, encHash, jobTokenSecret);
-        LOG.info("for url="+msgToEncode+" sent hash and receievd reply");
+        InputStream input = setupSecureConnection(mapOutputLoc, connection);
  
         // Validate header from map output
         TaskAttemptID mapId = null;
@@ -1477,6 +1458,38 @@ class ReduceTask extends Task {
             
         return mapOutput;
       }
+      
+      private InputStream setupSecureConnection(MapOutputLocation mapOutputLoc, 
+          URLConnection connection) throws IOException {
+
+        // generate hash of the url
+        String msgToEncode = 
+          SecureShuffleUtils.buildMsgFrom(connection.getURL());
+        String encHash = SecureShuffleUtils.hashFromString(msgToEncode, 
+            jobTokenSecret);
+
+        // put url hash into http header
+        connection.setRequestProperty(
+            SecureShuffleUtils.HTTP_HEADER_URL_HASH, encHash);
+        
+        InputStream input = getInputStream(connection, shuffleConnectionTimeout,
+                                           shuffleReadTimeout); 
+
+        // get the replyHash which is HMac of the encHash we sent to the server
+        String replyHash = connection.getHeaderField(
+            SecureShuffleUtils.HTTP_HEADER_REPLY_URL_HASH);
+        if(replyHash==null) {
+          throw new IOException("security validation of TT Map output failed");
+        }
+        if (LOG.isDebugEnabled())
+          LOG.debug("url="+msgToEncode+";encHash="+encHash+";replyHash="
+              +replyHash);
+        // verify that replyHash is HMac of encHash
+        SecureShuffleUtils.verifyReply(replyHash, encHash, jobTokenSecret);
+        if (LOG.isDebugEnabled())
+          LOG.debug("for url="+msgToEncode+" sent hash and receievd reply");
+        return input;
+      }
 
       /** 
        * The connection establishment is attempted multiple times and is given up 
@@ -1544,8 +1557,7 @@ class ReduceTask extends Task {
           // Reconnect
           try {
             connection = mapOutputLoc.getOutputLocation().openConnection();
-            input = getInputStream(connection, shuffleConnectionTimeout, 
-                                   shuffleReadTimeout);
+            input = setupSecureConnection(mapOutputLoc, connection);
           } catch (IOException ioe) {
             LOG.info("Failed reopen connection to fetch map-output from " + 
                      mapOutputLoc.getHost());

src/mapred/org/apache/hadoop/mapred/TaskTracker.java

@@ -3460,7 +3460,8 @@ public class TaskTracker
       String urlHashStr = request.getHeader(SecureShuffleUtils.HTTP_HEADER_URL_HASH);
       if(urlHashStr == null) {
         response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-        throw new IOException("fetcher cannot be authenticated");
+        throw new IOException("fetcher cannot be authenticated " + 
+            request.getRemoteHost());
       }
       int len = urlHashStr.length();
       LOG.debug("verifying request. enc_str="+enc_str+"; hash=..."+