Skip to content

Commit 44e0445

Browse files
authored
feat: backport Hadoop 3.4.1 vulnerability fixes (#1184)
* feat: backport Hadoop 3.4.1 vulnerability fixes * chore: changelog
1 parent 24d8390 commit 44e0445

6 files changed

+603
-0
lines changed

CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ All notable changes to this project will be documented in this file.
5656
- git-sync: Bump version to 4.4.1 ([#1151]).
5757
- zookeeper: bump jetty version for CVE-2024-13009 in 3.9.3 ([#1179])
5858
- zookeeper: bump netty version for CVE-2025-24970 in 3.9.3 ([#1180])
59+
- hadoop: backport HADOOP-19352, HADOOP-19335, HADOOP-19465, HADOOP-19456 and HADOOP-19225 to fix vulnerabilities in Hadoop `3.4.1` ([#1184])
5960

6061
### Changed
6162

@@ -202,6 +203,7 @@ All notable changes to this project will be documented in this file.
202203
[#1174]: https://github.com/stackabletech/docker-images/pull/1174
203204
[#1179]: https://github.com/stackabletech/docker-images/pull/1179
204205
[#1180]: https://github.com/stackabletech/docker-images/pull/1180
206+
[#1184]: https://github.com/stackabletech/docker-images/pull/1184
205207

206208
## [25.3.0] - 2025-03-21
207209

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
From 699f329ba20d938004fc2b983b7b225de36ecf88 Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?=E5=91=A8=E7=BF=B1?= <[email protected]>
3+
Date: Tue, 18 Feb 2025 14:16:37 +0800
4+
Subject: HADOOP-19352. Hadoop OSS Connector adds support for V4 signatures.
5+
(#7205)
6+
7+
* Aliyun oss connector support v4 signature
8+
---
9+
hadoop-project/pom.xml | 2 +-
10+
hadoop-tools/hadoop-aliyun/pom.xml | 26 +++++
11+
.../aliyun/oss/AliyunOSSFileSystemStore.java | 16 +++
12+
.../hadoop/fs/aliyun/oss/Constants.java | 15 +++
13+
.../fs/aliyun/oss/ITAliyunOSSSignatureV4.java | 98 +++++++++++++++++++
14+
.../src/test/resources/log4j.properties | 3 +
15+
6 files changed, 159 insertions(+), 1 deletion(-)
16+
create mode 100644 hadoop-tools/hadoop-aliyun/src/test/java/org/apache/hadoop/fs/aliyun/oss/ITAliyunOSSSignatureV4.java
17+
18+
diff --git a/hadoop-project/pom.xml b/hadoop-project/pom.xml
19+
index 3426a76c12..3a812ebc64 100644
20+
--- a/hadoop-project/pom.xml
21+
+++ b/hadoop-project/pom.xml
22+
@@ -1620,7 +1620,7 @@
23+
<dependency>
24+
<groupId>com.aliyun.oss</groupId>
25+
<artifactId>aliyun-sdk-oss</artifactId>
26+
- <version>3.13.2</version>
27+
+ <version>3.18.1</version>
28+
<exclusions>
29+
<exclusion>
30+
<groupId>org.apache.httpcomponents</groupId>
31+
diff --git a/hadoop-tools/hadoop-aliyun/pom.xml b/hadoop-tools/hadoop-aliyun/pom.xml
32+
index 5678cff642..3db04ce913 100644
33+
--- a/hadoop-tools/hadoop-aliyun/pom.xml
34+
+++ b/hadoop-tools/hadoop-aliyun/pom.xml
35+
@@ -165,5 +165,31 @@
36+
<scope>test</scope>
37+
<type>jar</type>
38+
</dependency>
39+
+
40+
+ <dependency>
41+
+ <groupId>org.junit.jupiter</groupId>
42+
+ <artifactId>junit-jupiter-api</artifactId>
43+
+ <scope>test</scope>
44+
+ </dependency>
45+
+ <dependency>
46+
+ <groupId>org.junit.jupiter</groupId>
47+
+ <artifactId>junit-jupiter-engine</artifactId>
48+
+ <scope>test</scope>
49+
+ </dependency>
50+
+ <dependency>
51+
+ <groupId>org.junit.jupiter</groupId>
52+
+ <artifactId>junit-jupiter-params</artifactId>
53+
+ <scope>test</scope>
54+
+ </dependency>
55+
+ <dependency>
56+
+ <groupId>org.junit.platform</groupId>
57+
+ <artifactId>junit-platform-launcher</artifactId>
58+
+ <scope>test</scope>
59+
+ </dependency>
60+
+ <dependency>
61+
+ <groupId>org.junit.vintage</groupId>
62+
+ <artifactId>junit-vintage-engine</artifactId>
63+
+ <scope>test</scope>
64+
+ </dependency>
65+
</dependencies>
66+
</project>
67+
diff --git a/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunOSSFileSystemStore.java b/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunOSSFileSystemStore.java
68+
index 6e0c7dc7e4..dba267b04c 100644
69+
--- a/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunOSSFileSystemStore.java
70+
+++ b/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunOSSFileSystemStore.java
71+
@@ -73,6 +73,7 @@ import java.util.List;
72+
import java.util.ListIterator;
73+
import java.util.NoSuchElementException;
74+
import java.util.stream.Collectors;
75+
+import com.aliyun.oss.common.comm.SignVersion;
76+
77+
import static org.apache.hadoop.fs.aliyun.oss.Constants.*;
78+
79+
@@ -113,6 +114,16 @@ public class AliyunOSSFileSystemStore {
80+
conf.get(USER_AGENT_PREFIX, USER_AGENT_PREFIX_DEFAULT) + ", Hadoop/"
81+
+ VersionInfo.getVersion());
82+
83+
+ String region = conf.get(REGION_KEY, "");
84+
+ String signatureVersion = conf.get(SIGNATURE_VERSION_KEY, SIGNATURE_VERSION_DEFAULT);
85+
+ if ("V4".equalsIgnoreCase(signatureVersion)) {
86+
+ clientConf.setSignatureVersion(SignVersion.V4);
87+
+ if (StringUtils.isEmpty(region)) {
88+
+ LOG.error("Signature version is V4 ,but region is empty.");
89+
+ throw new IOException("SignVersion is V4 but region is empty");
90+
+ }
91+
+ }
92+
+
93+
String proxyHost = conf.getTrimmed(PROXY_HOST_KEY, "");
94+
int proxyPort = conf.getInt(PROXY_PORT_KEY, -1);
95+
if (StringUtils.isNotEmpty(proxyHost)) {
96+
@@ -171,6 +182,11 @@ public class AliyunOSSFileSystemStore {
97+
statistics.incrementWriteOps(1);
98+
}
99+
100+
+ if (StringUtils.isNotEmpty(region)) {
101+
+ ossClient.setRegion(region);
102+
+ LOG.debug("ossClient setRegion {}", region);
103+
+ }
104+
+
105+
maxKeys = conf.getInt(MAX_PAGING_KEYS_KEY, MAX_PAGING_KEYS_DEFAULT);
106+
int listVersion = conf.getInt(LIST_VERSION, DEFAULT_LIST_VERSION);
107+
if (listVersion < 1 || listVersion > 2) {
108+
diff --git a/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/Constants.java b/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/Constants.java
109+
index baeb919937..176669ed15 100644
110+
--- a/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/Constants.java
111+
+++ b/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/Constants.java
112+
@@ -211,4 +211,19 @@ public final class Constants {
113+
public static final String LIST_VERSION = "fs.oss.list.version";
114+
115+
public static final int DEFAULT_LIST_VERSION = 2;
116+
+
117+
+ /**
118+
+ * OSS signature version.
119+
+ */
120+
+ public static final String SIGNATURE_VERSION_KEY = "fs.oss.signatureversion";
121+
+
122+
+ /**
123+
+ * OSS signature version DEFAULT {@value}.
124+
+ */
125+
+ public static final String SIGNATURE_VERSION_DEFAULT = "V1";
126+
+
127+
+ /**
128+
+ * OSS region {@value}.
129+
+ */
130+
+ public static final String REGION_KEY = "fs.oss.region";
131+
}
132+
diff --git a/hadoop-tools/hadoop-aliyun/src/test/java/org/apache/hadoop/fs/aliyun/oss/ITAliyunOSSSignatureV4.java b/hadoop-tools/hadoop-aliyun/src/test/java/org/apache/hadoop/fs/aliyun/oss/ITAliyunOSSSignatureV4.java
133+
new file mode 100644
134+
index 0000000000..5070f2a581
135+
--- /dev/null
136+
+++ b/hadoop-tools/hadoop-aliyun/src/test/java/org/apache/hadoop/fs/aliyun/oss/ITAliyunOSSSignatureV4.java
137+
@@ -0,0 +1,98 @@
138+
+/**
139+
+ * Licensed to the Apache Software Foundation (ASF) under one
140+
+ * or more contributor license agreements. See the NOTICE file
141+
+ * distributed with this work for additional information
142+
+ * regarding copyright ownership. The ASF licenses this file
143+
+ * to you under the Apache License, Version 2.0 (the
144+
+ * "License"); you may not use this file except in compliance
145+
+ * with the License. You may obtain a copy of the License at
146+
+ *
147+
+ * http://www.apache.org/licenses/LICENSE-2.0
148+
+ *
149+
+ * Unless required by applicable law or agreed to in writing, software
150+
+ * distributed under the License is distributed on an "AS IS" BASIS,
151+
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
152+
+ * See the License for the specific language governing permissions and
153+
+ * limitations under the License.
154+
+ */
155+
+
156+
+package org.apache.hadoop.fs.aliyun.oss;
157+
+
158+
+import org.apache.hadoop.conf.Configuration;
159+
+import org.apache.hadoop.fs.FileStatus;
160+
+import org.apache.hadoop.fs.Path;
161+
+import org.junit.Before;
162+
+import org.junit.Test;
163+
+import org.slf4j.Logger;
164+
+import org.slf4j.LoggerFactory;
165+
+
166+
+import java.io.IOException;
167+
+import java.net.URI;
168+
+
169+
+import static org.apache.hadoop.fs.aliyun.oss.Constants.REGION_KEY;
170+
+import static org.apache.hadoop.fs.aliyun.oss.Constants.SIGNATURE_VERSION_KEY;
171+
+import static org.apache.hadoop.fs.contract.ContractTestUtils.createFile;
172+
+import static org.apache.hadoop.fs.contract.ContractTestUtils.dataset;
173+
+import static org.junit.Assert.*;
174+
+import static org.junit.Assume.assumeNotNull;
175+
+
176+
+/**
177+
+ * Tests Aliyun OSS system.
178+
+ */
179+
+public class ITAliyunOSSSignatureV4 {
180+
+ private static final Logger LOG = LoggerFactory.getLogger(ITAliyunOSSSignatureV4.class);
181+
+ private Configuration conf;
182+
+ private URI testURI;
183+
+ private Path testFile = new Path("ITAliyunOSSSignatureV4/atestr");
184+
+
185+
+ @Before
186+
+ public void setUp() throws Exception {
187+
+ conf = new Configuration();
188+
+ String bucketUri = conf.get("test.fs.oss.name");
189+
+ LOG.debug("bucketUri={}", bucketUri);
190+
+ testURI = URI.create(bucketUri);
191+
+ }
192+
+
193+
+ @Test
194+
+ public void testV4() throws IOException {
195+
+ conf.set(SIGNATURE_VERSION_KEY, "V4");
196+
+ conf.set(REGION_KEY, "cn-hongkong");
197+
+ AliyunOSSFileSystem fs = new AliyunOSSFileSystem();
198+
+ fs.initialize(testURI, conf);
199+
+ assumeNotNull(fs);
200+
+
201+
+ createFile(fs, testFile, true, dataset(256, 0, 255));
202+
+ FileStatus status = fs.getFileStatus(testFile);
203+
+ fs.delete(testFile);
204+
+ fs.close();
205+
+ }
206+
+
207+
+ @Test
208+
+ public void testDefaultSignatureVersion() throws IOException {
209+
+ AliyunOSSFileSystem fs = new AliyunOSSFileSystem();
210+
+ fs.initialize(testURI, conf);
211+
+ assumeNotNull(fs);
212+
+
213+
+ Path testFile2 = new Path("/test/atestr");
214+
+ createFile(fs, testFile2, true, dataset(256, 0, 255));
215+
+ FileStatus status = fs.getFileStatus(testFile2);
216+
+ fs.delete(testFile2);
217+
+ fs.close();
218+
+ }
219+
+
220+
+ @Test
221+
+ public void testV4WithoutRegion() throws IOException {
222+
+ conf.set(SIGNATURE_VERSION_KEY, "V4");
223+
+ AliyunOSSFileSystem fs = new AliyunOSSFileSystem();
224+
+ IOException expectedException = null;
225+
+ try {
226+
+ fs.initialize(testURI, conf);
227+
+ } catch (IOException e) {
228+
+ LOG.warn("use V4 , but do not set region, get exception={}", e);
229+
+ expectedException = e;
230+
+ assertEquals("use V4 , but do not set region", e.getMessage(),
231+
+ "SignVersion is V4 but region is empty");
232+
+ }
233+
+ assertNotNull(expectedException);
234+
+ }
235+
+}
236+
diff --git a/hadoop-tools/hadoop-aliyun/src/test/resources/log4j.properties b/hadoop-tools/hadoop-aliyun/src/test/resources/log4j.properties
237+
index bb5cbe5ec3..2167f68811 100644
238+
--- a/hadoop-tools/hadoop-aliyun/src/test/resources/log4j.properties
239+
+++ b/hadoop-tools/hadoop-aliyun/src/test/resources/log4j.properties
240+
@@ -21,3 +21,6 @@ log4j.threshold=ALL
241+
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
242+
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
243+
log4j.appender.stdout.layout.ConversionPattern=%d{ISO8601} %-5p %c{2} (%F:%M(%L)) - %m%n
244+
+
245+
+# Log all oss classes
246+
+log4j.logger.org.apache.hadoop.fs.aliyun.oss=DEBUG
247+
\ No newline at end of file
Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
From 147d927da55853b2d1f4ab29f5cb010fc339ad35 Mon Sep 17 00:00:00 2001
2+
From: PJ Fanning <[email protected]>
3+
Date: Thu, 2 Jan 2025 09:26:20 +0100
4+
Subject: HADOOP-19335. Bump netty to 4.1.116 due to CVE-2024-47535 (#7158).
5+
Contributed by PJ Fanning (#7259)
6+
7+
---
8+
LICENSE-binary | 76 +++++++++----------
9+
hadoop-project/pom.xml | 2 +-
10+
.../hadoop-yarn/hadoop-yarn-csi/pom.xml | 4 +-
11+
3 files changed, 41 insertions(+), 41 deletions(-)
12+
13+
diff --git a/LICENSE-binary b/LICENSE-binary
14+
index b064b6a15d..3bcc589734 100644
15+
--- a/LICENSE-binary
16+
+++ b/LICENSE-binary
17+
@@ -250,43 +250,43 @@ commons-daemon:commons-daemon:1.0.13
18+
commons-io:commons-io:2.16.1
19+
commons-net:commons-net:3.9.0
20+
de.ruedigermoeller:fst:2.50
21+
-io.grpc:grpc-api:1.53.0
22+
-io.grpc:grpc-context:1.53.0
23+
-io.grpc:grpc-core:1.53.0
24+
-io.grpc:grpc-netty:1.53.0
25+
-io.grpc:grpc-protobuf:1.53.0
26+
-io.grpc:grpc-protobuf-lite:1.53.0
27+
-io.grpc:grpc-stub:1.53.0
28+
-io.netty:netty-all:4.1.100.Final
29+
-io.netty:netty-buffer:4.1.100.Final
30+
-io.netty:netty-codec:4.1.100.Final
31+
-io.netty:netty-codec-dns:4.1.100.Final
32+
-io.netty:netty-codec-haproxy:4.1.100.Final
33+
-io.netty:netty-codec-http:4.1.100.Final
34+
-io.netty:netty-codec-http2:4.1.100.Final
35+
-io.netty:netty-codec-memcache:4.1.100.Final
36+
-io.netty:netty-codec-mqtt:4.1.100.Final
37+
-io.netty:netty-codec-redis:4.1.100.Final
38+
-io.netty:netty-codec-smtp:4.1.100.Final
39+
-io.netty:netty-codec-socks:4.1.100.Final
40+
-io.netty:netty-codec-stomp:4.1.100.Final
41+
-io.netty:netty-codec-xml:4.1.100.Final
42+
-io.netty:netty-common:4.1.100.Final
43+
-io.netty:netty-handler:4.1.100.Final
44+
-io.netty:netty-handler-proxy:4.1.100.Final
45+
-io.netty:netty-resolver:4.1.100.Final
46+
-io.netty:netty-resolver-dns:4.1.100.Final
47+
-io.netty:netty-transport:4.1.100.Final
48+
-io.netty:netty-transport-rxtx:4.1.100.Final
49+
-io.netty:netty-transport-sctp:4.1.100.Final
50+
-io.netty:netty-transport-udt:4.1.100.Final
51+
-io.netty:netty-transport-classes-epoll:4.1.100.Final
52+
-io.netty:netty-transport-native-unix-common:4.1.100.Final
53+
-io.netty:netty-transport-classes-kqueue:4.1.100.Final
54+
-io.netty:netty-resolver-dns-classes-macos:4.1.100.Final
55+
-io.netty:netty-transport-native-epoll:4.1.100.Final
56+
-io.netty:netty-transport-native-kqueue:4.1.100.Final
57+
-io.netty:netty-resolver-dns-native-macos:4.1.100.Final
58+
+io.grpc:grpc-api:1.69.0
59+
+io.grpc:grpc-context:1.69.0
60+
+io.grpc:grpc-core:1.69.0
61+
+io.grpc:grpc-netty:1.69.0
62+
+io.grpc:grpc-protobuf:1.69.0
63+
+io.grpc:grpc-protobuf-lite:1.69.0
64+
+io.grpc:grpc-stub:1.69.0
65+
+io.netty:netty-all:4.1.116.Final
66+
+io.netty:netty-buffer:4.1.116.Final
67+
+io.netty:netty-codec:4.1.116.Final
68+
+io.netty:netty-codec-dns:4.1.116.Final
69+
+io.netty:netty-codec-haproxy:4.1.116.Final
70+
+io.netty:netty-codec-http:4.1.116.Final
71+
+io.netty:netty-codec-http2:4.1.116.Final
72+
+io.netty:netty-codec-memcache:4.1.116.Final
73+
+io.netty:netty-codec-mqtt:4.1.116.Final
74+
+io.netty:netty-codec-redis:4.1.116.Final
75+
+io.netty:netty-codec-smtp:4.1.116.Final
76+
+io.netty:netty-codec-socks:4.1.116.Final
77+
+io.netty:netty-codec-stomp:4.1.116.Final
78+
+io.netty:netty-codec-xml:4.1.116.Final
79+
+io.netty:netty-common:4.1.116.Final
80+
+io.netty:netty-handler:4.1.116.Final
81+
+io.netty:netty-handler-proxy:4.1.116.Final
82+
+io.netty:netty-resolver:4.1.116.Final
83+
+io.netty:netty-resolver-dns:4.1.116.Final
84+
+io.netty:netty-transport:4.1.116.Final
85+
+io.netty:netty-transport-rxtx:4.1.116.Final
86+
+io.netty:netty-transport-sctp:4.1.116.Final
87+
+io.netty:netty-transport-udt:4.1.116.Final
88+
+io.netty:netty-transport-classes-epoll:4.1.116.Final
89+
+io.netty:netty-transport-native-unix-common:4.1.116.Final
90+
+io.netty:netty-transport-classes-kqueue:4.1.116.Final
91+
+io.netty:netty-resolver-dns-classes-macos:4.1.116.Final
92+
+io.netty:netty-transport-native-epoll:4.1.116.Final
93+
+io.netty:netty-transport-native-kqueue:4.1.116.Final
94+
+io.netty:netty-resolver-dns-native-macos:4.1.116.Final
95+
io.opencensus:opencensus-api:0.12.3
96+
io.opencensus:opencensus-contrib-grpc-metrics:0.12.3
97+
io.reactivex:rxjava:1.3.8
98+
@@ -486,7 +486,7 @@ org.bouncycastle:bcpkix-jdk18on:1.78.1
99+
org.bouncycastle:bcprov-jdk18on:1.78.1
100+
org.bouncycastle:bcutil-jdk18on:1.78.1
101+
org.checkerframework:checker-qual:3.8.0
102+
-org.codehaus.mojo:animal-sniffer-annotations:1.21
103+
+org.codehaus.mojo:animal-sniffer-annotations:1.24
104+
org.jruby.jcodings:jcodings:1.0.13
105+
org.jruby.joni:joni:2.1.2
106+
org.ojalgo:ojalgo:43.0
107+
diff --git a/hadoop-project/pom.xml b/hadoop-project/pom.xml
108+
index 3a812ebc64..f921df0209 100644
109+
--- a/hadoop-project/pom.xml
110+
+++ b/hadoop-project/pom.xml
111+
@@ -143,7 +143,7 @@
112+
<jna.version>5.2.0</jna.version>
113+
<gson.version>2.9.0</gson.version>
114+
<metrics.version>3.2.4</metrics.version>
115+
- <netty4.version>4.1.100.Final</netty4.version>
116+
+ <netty4.version>4.1.116.Final</netty4.version>
117+
<snappy-java.version>1.1.10.4</snappy-java.version>
118+
<lz4-java.version>1.7.1</lz4-java.version>
119+
120+
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-csi/pom.xml b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-csi/pom.xml
121+
index c66120798d..909b59d317 100644
122+
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-csi/pom.xml
123+
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-csi/pom.xml
124+
@@ -26,8 +26,8 @@
125+
<packaging>jar</packaging>
126+
127+
<properties>
128+
- <grpc.version>1.53.0</grpc.version>
129+
- <animal-sniffer.version>1.21</animal-sniffer.version>
130+
+ <grpc.version>1.69.0</grpc.version>
131+
+ <animal-sniffer.version>1.24</animal-sniffer.version>
132+
</properties>
133+
134+
<dependencies>

0 commit comments

Comments
 (0)