SPARK-3883 SSL support for HttpServer and Akka #2739

jacek-lewandowski · 2014-10-09T23:31:51Z

Introduced SSLOptions object
SSLOptions is created by SecurityManager
SSLOptions configures Akka and Jetty to use SSL
SSLOptions uses property file which is node-local to set SSL settings
Provided utility methods to determine the proper Akka protocol for Akka requests and to configure SSL socket factory for URL connections
Added tests cases for AkkaUtils, FileServer, SSLOptions and SecurityManager

- Introduced SSLOptions object - SSLOptions is created by SecurityManager - SSLOptions configures Akka and Jetty to use SSL - SSLOptions uses property file which is node-local to set SSL settings - Provided utility methods to determine the proper Akka protocol for Akka requests and to configure SSL socket factory for URL connections - Added tests cases for AkkaUtils, FileServer, SSLOptions and SecurityManager

AmplabJenkins · 2014-10-09T23:32:06Z

Can one of the admins verify this patch?

AmplabJenkins · 2014-10-09T23:32:10Z

Can one of the admins verify this patch?

JoshRosen · 2014-10-13T16:13:52Z

#1980 is a PR to add SSL to the web UI, which might benefit from SSLOptions. Do you want to comment on that PR's strategy for configuration, etc?

jacek-lewandowski · 2014-10-13T18:17:18Z

I'll go through the discussion and changes in that ticket tomorrow morning, thanks

vanzin · 2014-10-16T17:48:42Z

conf/ssl.conf.template

@@ -0,0 +1,27 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more


Not an expert at Apache licensing, but other config files in conf/ don't have a license header.

Ok, I'll remove it

vanzin · 2014-10-16T18:28:13Z

Hi @jacek-lewandowski, I like this because it's trying to support more than just the Web UI, but I think the configuration handling is sort of confusing and overengineered. Feels like a simpler approach based on "all configuration goes through SparkConf" would be much simpler to handle and maintain (both in the code and by admins deploying Spark). What do you think?

jacek-lewandowski · 2014-10-16T21:15:15Z

Thanks for review @vanzin
I will read all your comments soon, probably during a weekend... currently a little bit overloaded

jacek-lewandowski · 2014-10-23T00:14:07Z

btw. @vanzin how to make Jenkins run the tests on this branch?

vanzin · 2014-10-23T00:18:00Z

Let me see if I can trigger tests for you - otherwise an admin will have to intervene.

Also, let me think about the configuration thing some more. To be frank, I'm not really that concerned about the Master/Worker configuration, I think those are not that interesting; I'm way more interested in applications using SSL, since that's when you're passing potentially sensitive data around.

vanzin · 2014-10-23T00:18:08Z

Jenkins, test this please.

vanzin · 2014-10-23T00:26:22Z

(Seems like that only works for my own PRs, so this will probably need an admin to trigger tests for you...)

jacek-lewandowski · 2014-10-23T00:27:06Z

I suppose that this is because this pr is not against the master branch

jacek-lewandowski · 2014-10-23T00:31:36Z

@vanzin This PR doesn't secure data transfers anyway, because Spark uses raw communication to exchange the real data. This is intended to secure mainly control messages, JARS, application settings, like command line arguments and Spark configuration, because they may include passwords to access third party data sources from executors.

JoshRosen · 2014-10-23T00:32:48Z

Jenkins, this is ok to test. Jenkins, retest this please.

SparkQA · 2014-10-23T00:37:47Z

QA tests have started for PR 2739 at commit fcc3d29.

This patch merges cleanly.

SparkQA · 2014-10-23T01:49:12Z

QA tests have finished for PR 2739 at commit fcc3d29.

This patch fails unit tests.
This patch merges cleanly.
This patch adds no public classes.

AmplabJenkins · 2014-10-23T01:49:16Z

Test FAILed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/22051/
Test FAILed.

vanzin · 2014-10-23T01:50:56Z

There's still sensitive data that may go in control messages; e.g., IIRC broadcasts go through akka, and those may include things like Hadoop job configuration and delegation tokens. Anyway, I know there are more channels that might need securing, but it's ok to treat those separately. Having a common SSL configuration infrastructure is a good first start.

jacek-lewandowski · 2014-10-23T19:47:05Z

@JoshRosen will it be retested automatically after commit ?

SparkQA · 2014-10-23T19:47:42Z

QA tests have finished for PR 2739 at commit 77591cb.

This patch fails unit tests.
This patch merges cleanly.
This patch adds no public classes.

AmplabJenkins · 2014-10-23T19:47:43Z

Test FAILed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/22079/
Test FAILed.

jacek-lewandowski · 2014-10-23T19:50:30Z

@vanzin fyi:

=========================================================================
Running Apache RAT checks
=========================================================================
Attempting to fetch rat
Launching rat from /home/jenkins/workspace/SparkPullRequestBuilder/lib/apache-rat-0.10.jar
Could not find Apache license headers in the following files:
 !????? /home/jenkins/workspace/SparkPullRequestBuilder/conf/ssl.conf.template

vanzin · 2014-10-23T20:05:39Z

You may want to add that file to .rat-excludes (unless you plan to rework this on top of master and get rid of the file altogether :-)).

SparkQA · 2014-10-23T20:19:57Z

QA tests have started for PR 2739 at commit f24d854.

This patch merges cleanly.

SparkQA · 2014-10-23T21:31:17Z

QA tests have finished for PR 2739 at commit f24d854.

This patch fails unit tests.
This patch merges cleanly.
This patch adds no public classes.

AmplabJenkins · 2014-10-23T21:31:20Z

Test FAILed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/22080/
Test FAILed.

JoshRosen · 2014-10-25T22:35:34Z

Hi @jacek-lewandowski,

Do you mind re-opening this pull request against the master branch, since this is targeted for 1.2?

tgravescs · 2014-10-27T13:34:16Z

Please also update the documentation. docs/security.md and the big comment header at the top of SecurityManager.scala

pwendell · 2014-11-10T06:01:30Z

@jacek-lewandowski do you have any sense of when you'll be able to do this? It would be great to get this into master soon!

vanzin · 2014-11-19T21:28:38Z

@jacek-lewandowski are you still working on this? If you don't plan to continue working on this I'd like to pick it up. Thanks!

jacek-lewandowski · 2014-12-02T11:25:05Z

Back to working on this... I've rebased against branch-1.2 and then I'll rebase against master if you want.

vanzin · 2014-12-02T18:26:20Z

@jacek-lewandowski please work on top of master. We can work on backporting it to branch-1.2 if there's a strong desire for it, but new features should always be checked into master first.

jacek-lewandowski · 2014-12-02T18:31:05Z

@vanzin already did that. Now I'm running tests - is there a new procedure for testing? Or just sbt clean assembly test?

I can see one test failure which I can reproduce on master as well.

vanzin · 2014-12-02T18:35:46Z

I think dev/run-tests will run more comprehensive checks. Also, always a good idea to try such a thing yourself on real jobs, aside from the unit tests. :-)

You'll probably need to open a new PR, I don't think Github allows you to change the target branch.

jacek-lewandowski · 2014-12-02T18:40:29Z

@vanzin yeah, thats right
I tried running the real jobs before rebasing and they worked :)

jacek-lewandowski · 2014-12-02T22:08:36Z

I still have got one test failing:

[info] InputOutputMetricsSuite:
[info] - input metrics when reading text file with single split (34 milliseconds)
[info] - input metrics when reading text file with multiple splits *** FAILED *** (5 seconds, 250 milliseconds)
...  had length 3438 instead of expected length 2 (InputOutputMetricsSuite.scala:78)

It fails on master and on my branch - do you know about it - it looks to me as a broken test case. Can you confirm?

vanzin · 2014-12-02T22:54:11Z

If you don't believe it's your fault, it will be much easier to help if you create the new PR and an admin triggers a jenkins job to test it. Then we can see whether it's a flaky test or a result of your code.

pwendell · 2014-12-02T23:02:30Z

Jenkins, test this please.

SparkQA · 2014-12-02T23:08:10Z

QA tests have started for PR 2739 at commit f24d854.

This patch merges cleanly.

pwendell · 2014-12-02T23:13:02Z

Oh yeah - this is still against 1.1. @jacek-lewandowski can you open a new PR and close this one?

SparkQA · 2014-12-03T00:10:49Z

QA tests have finished for PR 2739 at commit f24d854.

This patch fails unit tests.
This patch merges cleanly.
This patch adds no public classes.

AmplabJenkins · 2014-12-03T00:10:53Z

Test FAILed.
Refer to this link for build results (access rights to CI server needed):
https://amplab.cs.berkeley.edu/jenkins//job/SparkPullRequestBuilder/24059/
Test FAILed.

jacek-lewandowski · 2014-12-03T05:04:24Z

Here is the new PR #3571

jacek-lewandowski · 2014-12-03T05:05:47Z

So - can I close this one?

vanzin · 2014-12-03T18:12:14Z

Yes please.

vanzin reviewed Oct 16, 2014
View reviewed changes

jacek-lewandowski mentioned this pull request Oct 22, 2014

[SPARK-2750] support https in spark web ui #1980

Closed

SPARK-3883: Added ssl.conf.template to .rat-excludes

f24d854

jacek-lewandowski closed this Dec 3, 2014

vanzin mentioned this pull request Dec 18, 2014

Spark 3883: SSL support for HttpServer and Akka #3571

Closed

		@@ -0,0 +1,27 @@
		#
		# Licensed to the Apache Software Foundation (ASF) under one or more

SPARK-3883 SSL support for HttpServer and Akka #2739

SPARK-3883 SSL support for HttpServer and Akka #2739

Conversation

jacek-lewandowski commented Oct 9, 2014

AmplabJenkins commented Oct 9, 2014

AmplabJenkins commented Oct 9, 2014

JoshRosen commented Oct 13, 2014

jacek-lewandowski commented Oct 13, 2014

vanzin Oct 16, 2014

Choose a reason for hiding this comment

jacek-lewandowski Oct 21, 2014

Choose a reason for hiding this comment

vanzin commented Oct 16, 2014

jacek-lewandowski commented Oct 16, 2014

jacek-lewandowski commented Oct 23, 2014

vanzin commented Oct 23, 2014

vanzin commented Oct 23, 2014

vanzin commented Oct 23, 2014

jacek-lewandowski commented Oct 23, 2014

jacek-lewandowski commented Oct 23, 2014

JoshRosen commented Oct 23, 2014

SparkQA commented Oct 23, 2014

SparkQA commented Oct 23, 2014

AmplabJenkins commented Oct 23, 2014

vanzin commented Oct 23, 2014

jacek-lewandowski commented Oct 23, 2014

SparkQA commented Oct 23, 2014

AmplabJenkins commented Oct 23, 2014

jacek-lewandowski commented Oct 23, 2014

vanzin commented Oct 23, 2014

SparkQA commented Oct 23, 2014

SparkQA commented Oct 23, 2014

AmplabJenkins commented Oct 23, 2014

JoshRosen commented Oct 25, 2014

tgravescs commented Oct 27, 2014

pwendell commented Nov 10, 2014

vanzin commented Nov 19, 2014

jacek-lewandowski commented Dec 2, 2014

vanzin commented Dec 2, 2014

jacek-lewandowski commented Dec 2, 2014

vanzin commented Dec 2, 2014

jacek-lewandowski commented Dec 2, 2014

jacek-lewandowski commented Dec 2, 2014

vanzin commented Dec 2, 2014

pwendell commented Dec 2, 2014

SparkQA commented Dec 2, 2014

pwendell commented Dec 2, 2014

SparkQA commented Dec 3, 2014

AmplabJenkins commented Dec 3, 2014

jacek-lewandowski commented Dec 3, 2014

jacek-lewandowski commented Dec 3, 2014

vanzin commented Dec 3, 2014