View Javadoc

1   /**
2    *
3    * Licensed to the Apache Software Foundation (ASF) under one
4    * or more contributor license agreements.  See the NOTICE file
5    * distributed with this work for additional information
6    * regarding copyright ownership.  The ASF licenses this file
7    * to you under the Apache License, Version 2.0 (the
8    * "License"); you may not use this file except in compliance
9    * with the License.  You may obtain a copy of the License at
10   *
11   *     http://www.apache.org/licenses/LICENSE-2.0
12   *
13   * Unless required by applicable law or agreed to in writing, software
14   * distributed under the License is distributed on an "AS IS" BASIS,
15   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16   * See the License for the specific language governing permissions and
17   * limitations under the License.
18   */
19  package org.apache.hadoop.hbase.thrift2;
20  
21  import java.io.IOException;
22  import java.net.InetAddress;
23  import java.net.InetSocketAddress;
24  import java.net.UnknownHostException;
25  import java.security.PrivilegedAction;
26  import java.util.HashMap;
27  import java.util.List;
28  import java.util.Map;
29  import java.util.concurrent.ExecutorService;
30  import java.util.concurrent.LinkedBlockingQueue;
31  import java.util.concurrent.ThreadPoolExecutor;
32  import java.util.concurrent.TimeUnit;
33  
34  import javax.security.auth.callback.Callback;
35  import javax.security.auth.callback.UnsupportedCallbackException;
36  import javax.security.sasl.AuthorizeCallback;
37  import javax.security.sasl.Sasl;
38  import javax.security.sasl.SaslServer;
39  
40  import org.apache.commons.cli.CommandLine;
41  import org.apache.commons.cli.CommandLineParser;
42  import org.apache.commons.cli.HelpFormatter;
43  import org.apache.commons.cli.Option;
44  import org.apache.commons.cli.OptionGroup;
45  import org.apache.commons.cli.Options;
46  import org.apache.commons.cli.ParseException;
47  import org.apache.commons.cli.PosixParser;
48  import org.apache.commons.logging.Log;
49  import org.apache.commons.logging.LogFactory;
50  import org.apache.hadoop.hbase.classification.InterfaceAudience;
51  import org.apache.hadoop.conf.Configuration;
52  import org.apache.hadoop.hbase.HBaseConfiguration;
53  import org.apache.hadoop.hbase.filter.ParseFilter;
54  import org.apache.hadoop.hbase.security.SecurityUtil;
55  import org.apache.hadoop.hbase.security.UserProvider;
56  import org.apache.hadoop.hbase.thrift.CallQueue;
57  import org.apache.hadoop.hbase.thrift.CallQueue.Call;
58  import org.apache.hadoop.hbase.thrift.ThriftMetrics;
59  import org.apache.hadoop.hbase.thrift2.generated.THBaseService;
60  import org.apache.hadoop.hbase.util.InfoServer;
61  import org.apache.hadoop.hbase.util.Strings;
62  import org.apache.hadoop.net.DNS;
63  import org.apache.hadoop.security.UserGroupInformation;
64  import org.apache.hadoop.security.SaslRpcServer.SaslGssCallbackHandler;
65  import org.apache.hadoop.util.GenericOptionsParser;
66  import org.apache.thrift.TException;
67  import org.apache.thrift.TProcessor;
68  import org.apache.thrift.protocol.TBinaryProtocol;
69  import org.apache.thrift.protocol.TCompactProtocol;
70  import org.apache.thrift.protocol.TProtocol;
71  import org.apache.thrift.protocol.TProtocolFactory;
72  import org.apache.thrift.server.THsHaServer;
73  import org.apache.thrift.server.TNonblockingServer;
74  import org.apache.thrift.server.TServer;
75  import org.apache.thrift.server.TThreadPoolServer;
76  import org.apache.thrift.transport.TFramedTransport;
77  import org.apache.thrift.transport.TNonblockingServerSocket;
78  import org.apache.thrift.transport.TNonblockingServerTransport;
79  import org.apache.thrift.transport.TSaslServerTransport;
80  import org.apache.thrift.transport.TServerSocket;
81  import org.apache.thrift.transport.TServerTransport;
82  import org.apache.thrift.transport.TTransportException;
83  import org.apache.thrift.transport.TTransportFactory;
84  
85  import com.google.common.util.concurrent.ThreadFactoryBuilder;
86  
87  /**
88   * ThriftServer - this class starts up a Thrift server which implements the HBase API specified in the
89   * HbaseClient.thrift IDL file.
90   */
91  @InterfaceAudience.Private
92  @SuppressWarnings({ "rawtypes", "unchecked" })
93  public class ThriftServer {
94    private static final Log log = LogFactory.getLog(ThriftServer.class);
95  
96    /**
97     * Thrift quality of protection configuration key. Valid values can be:
98     * auth-conf: authentication, integrity and confidentiality checking
99     * auth-int: authentication and integrity checking
100    * auth: authentication only
101    *
102    * This is used to authenticate the callers and support impersonation.
103    * The thrift server and the HBase cluster must run in secure mode.
104    */
105   static final String THRIFT_QOP_KEY = "hbase.thrift.security.qop";
106 
107   public static final int DEFAULT_LISTEN_PORT = 9090;
108 
109   
110   public ThriftServer() {
111   }
112 
113   private static void printUsage() {
114     HelpFormatter formatter = new HelpFormatter();
115     formatter.printHelp("Thrift", null, getOptions(),
116         "To start the Thrift server run 'bin/hbase-daemon.sh start thrift2'\n" +
117             "To shutdown the thrift server run 'bin/hbase-daemon.sh stop thrift2' or" +
118             " send a kill signal to the thrift server pid",
119         true);
120   }
121 
122   private static Options getOptions() {
123     Options options = new Options();
124     options.addOption("b", "bind", true,
125         "Address to bind the Thrift server to. [default: 0.0.0.0]");
126     options.addOption("p", "port", true, "Port to bind to [default: " + DEFAULT_LISTEN_PORT + "]");
127     options.addOption("f", "framed", false, "Use framed transport");
128     options.addOption("c", "compact", false, "Use the compact protocol");
129     options.addOption("h", "help", false, "Print help information");
130     options.addOption(null, "infoport", true, "Port for web UI");
131 
132     OptionGroup servers = new OptionGroup();
133     servers.addOption(
134         new Option("nonblocking", false, "Use the TNonblockingServer. This implies the framed transport."));
135     servers.addOption(new Option("hsha", false, "Use the THsHaServer. This implies the framed transport."));
136     servers.addOption(new Option("threadpool", false, "Use the TThreadPoolServer. This is the default."));
137     options.addOptionGroup(servers);
138     return options;
139   }
140 
141   private static CommandLine parseArguments(Configuration conf, Options options, String[] args)
142       throws ParseException, IOException {
143     GenericOptionsParser genParser = new GenericOptionsParser(conf, args);
144     String[] remainingArgs = genParser.getRemainingArgs();
145     CommandLineParser parser = new PosixParser();
146     return parser.parse(options, remainingArgs);
147   }
148 
149   private static TProtocolFactory getTProtocolFactory(boolean isCompact) {
150     if (isCompact) {
151       log.debug("Using compact protocol");
152       return new TCompactProtocol.Factory();
153     } else {
154       log.debug("Using binary protocol");
155       return new TBinaryProtocol.Factory();
156     }
157   }
158 
159   private static TTransportFactory getTTransportFactory(
160       String qop, String name, String host, boolean framed, int frameSize) {
161     if (framed) {
162       if (qop != null) {
163         throw new RuntimeException("Thrift server authentication"
164           + " doesn't work with framed transport yet");
165       }
166       log.debug("Using framed transport");
167       return new TFramedTransport.Factory(frameSize);
168     } else if (qop == null) {
169       return new TTransportFactory();
170     } else {
171       Map<String, String> saslProperties = new HashMap<String, String>();
172       saslProperties.put(Sasl.QOP, qop);
173       TSaslServerTransport.Factory saslFactory = new TSaslServerTransport.Factory();
174       saslFactory.addServerDefinition("GSSAPI", name, host, saslProperties,
175         new SaslGssCallbackHandler() {
176           @Override
177           public void handle(Callback[] callbacks)
178               throws UnsupportedCallbackException {
179             AuthorizeCallback ac = null;
180             for (Callback callback : callbacks) {
181               if (callback instanceof AuthorizeCallback) {
182                 ac = (AuthorizeCallback) callback;
183               } else {
184                 throw new UnsupportedCallbackException(callback,
185                     "Unrecognized SASL GSSAPI Callback");
186               }
187             }
188             if (ac != null) {
189               String authid = ac.getAuthenticationID();
190               String authzid = ac.getAuthorizationID();
191               if (!authid.equals(authzid)) {
192                 ac.setAuthorized(false);
193               } else {
194                 ac.setAuthorized(true);
195                 String userName = SecurityUtil.getUserFromPrincipal(authzid);
196                 log.info("Effective user: " + userName);
197                 ac.setAuthorizedID(userName);
198               }
199             }
200           }
201         });
202       return saslFactory;
203     }
204   }
205 
206   /*
207    * If bindValue is null, we don't bind.
208    */
209   private static InetSocketAddress bindToPort(String bindValue, int listenPort)
210       throws UnknownHostException {
211     try {
212       if (bindValue == null) {
213         return new InetSocketAddress(listenPort);
214       } else {
215         return new InetSocketAddress(InetAddress.getByName(bindValue), listenPort);
216       }
217     } catch (UnknownHostException e) {
218       throw new RuntimeException("Could not bind to provided ip address", e);
219     }
220   }
221 
222   private static TServer getTNonBlockingServer(TProtocolFactory protocolFactory, TProcessor processor,
223       TTransportFactory transportFactory, InetSocketAddress inetSocketAddress) throws TTransportException {
224     TNonblockingServerTransport serverTransport = new TNonblockingServerSocket(inetSocketAddress);
225     log.info("starting HBase Nonblocking Thrift server on " + inetSocketAddress.toString());
226     TNonblockingServer.Args serverArgs = new TNonblockingServer.Args(serverTransport);
227     serverArgs.processor(processor);
228     serverArgs.transportFactory(transportFactory);
229     serverArgs.protocolFactory(protocolFactory);
230     return new TNonblockingServer(serverArgs);
231   }
232 
233   private static TServer getTHsHaServer(TProtocolFactory protocolFactory,
234       TProcessor processor, TTransportFactory transportFactory,
235       InetSocketAddress inetSocketAddress, ThriftMetrics metrics)
236       throws TTransportException {
237     TNonblockingServerTransport serverTransport = new TNonblockingServerSocket(inetSocketAddress);
238     log.info("starting HBase HsHA Thrift server on " + inetSocketAddress.toString());
239     THsHaServer.Args serverArgs = new THsHaServer.Args(serverTransport);
240     ExecutorService executorService = createExecutor(
241         serverArgs.getWorkerThreads(), metrics);
242     serverArgs.executorService(executorService);
243     serverArgs.processor(processor);
244     serverArgs.transportFactory(transportFactory);
245     serverArgs.protocolFactory(protocolFactory);
246     return new THsHaServer(serverArgs);
247   }
248 
249   private static ExecutorService createExecutor(
250       int workerThreads, ThriftMetrics metrics) {
251     CallQueue callQueue = new CallQueue(
252         new LinkedBlockingQueue<Call>(), metrics);
253     ThreadFactoryBuilder tfb = new ThreadFactoryBuilder();
254     tfb.setDaemon(true);
255     tfb.setNameFormat("thrift2-worker-%d");
256     return new ThreadPoolExecutor(workerThreads, workerThreads,
257             Long.MAX_VALUE, TimeUnit.SECONDS, callQueue, tfb.build());
258   }
259 
260   private static TServer getTThreadPoolServer(TProtocolFactory protocolFactory, TProcessor processor,
261       TTransportFactory transportFactory, InetSocketAddress inetSocketAddress) throws TTransportException {
262     TServerTransport serverTransport = new TServerSocket(inetSocketAddress);
263     log.info("starting HBase ThreadPool Thrift server on " + inetSocketAddress.toString());
264     TThreadPoolServer.Args serverArgs = new TThreadPoolServer.Args(serverTransport);
265     serverArgs.processor(processor);
266     serverArgs.transportFactory(transportFactory);
267     serverArgs.protocolFactory(protocolFactory);
268     return new TThreadPoolServer(serverArgs);
269   }
270 
271   /**
272    * Adds the option to pre-load filters at startup.
273    *
274    * @param conf  The current configuration instance.
275    */
276   protected static void registerFilters(Configuration conf) {
277     String[] filters = conf.getStrings("hbase.thrift.filters");
278     if(filters != null) {
279       for(String filterClass: filters) {
280         String[] filterPart = filterClass.split(":");
281         if(filterPart.length != 2) {
282           log.warn("Invalid filter specification " + filterClass + " - skipping");
283         } else {
284           ParseFilter.registerFilter(filterPart[0], filterPart[1]);
285         }
286       }
287     }
288   }
289 
290   /**
291    * Start up the Thrift2 server.
292    *
293    * @param args
294    */
295   public static void main(String[] args) throws Exception {
296     TServer server = null;
297     Options options = getOptions();
298     Configuration conf = HBaseConfiguration.create();
299     CommandLine cmd = parseArguments(conf, options, args);
300 
301     /**
302      * This is to please both bin/hbase and bin/hbase-daemon. hbase-daemon provides "start" and "stop" arguments hbase
303      * should print the help if no argument is provided
304      */
305     List<?> argList = cmd.getArgList();
306     if (cmd.hasOption("help") || !argList.contains("start") || argList.contains("stop")) {
307       printUsage();
308       System.exit(1);
309     }
310 
311     // Get address to bind
312     String bindAddress;
313     if (cmd.hasOption("bind")) {
314       bindAddress = cmd.getOptionValue("bind");
315       conf.set("hbase.thrift.info.bindAddress", bindAddress);
316     } else {
317       bindAddress = conf.get("hbase.thrift.info.bindAddress");
318     }
319 
320     // Get port to bind to
321     int listenPort = 0;
322     try {
323       if (cmd.hasOption("port")) {
324         listenPort = Integer.parseInt(cmd.getOptionValue("port"));
325       } else {
326         listenPort = conf.getInt("hbase.regionserver.thrift.port", DEFAULT_LISTEN_PORT);
327       }
328     } catch (NumberFormatException e) {
329       throw new RuntimeException("Could not parse the value provided for the port option", e);
330     }
331 
332     // Local hostname and user name,
333     // used only if QOP is configured.
334     String host = null;
335     String name = null;
336 
337     UserProvider userProvider = UserProvider.instantiate(conf);
338     // login the server principal (if using secure Hadoop)
339     boolean securityEnabled = userProvider.isHadoopSecurityEnabled()
340       && userProvider.isHBaseSecurityEnabled();
341     if (securityEnabled) {
342       host = Strings.domainNamePointerToHostName(DNS.getDefaultHost(
343         conf.get("hbase.thrift.dns.interface", "default"),
344         conf.get("hbase.thrift.dns.nameserver", "default")));
345       userProvider.login("hbase.thrift.keytab.file",
346         "hbase.thrift.kerberos.principal", host);
347     }
348 
349     UserGroupInformation realUser = userProvider.getCurrent().getUGI();
350     String qop = conf.get(THRIFT_QOP_KEY);
351     if (qop != null) {
352       if (!qop.equals("auth") && !qop.equals("auth-int")
353           && !qop.equals("auth-conf")) {
354         throw new IOException("Invalid " + THRIFT_QOP_KEY + ": " + qop
355           + ", it must be 'auth', 'auth-int', or 'auth-conf'");
356       }
357       if (!securityEnabled) {
358         throw new IOException("Thrift server must"
359           + " run in secure mode to support authentication");
360       }
361       // Extract the name from the principal
362       name = SecurityUtil.getUserFromPrincipal(
363         conf.get("hbase.thrift.kerberos.principal"));
364     }
365 
366     boolean nonblocking = cmd.hasOption("nonblocking");
367     boolean hsha = cmd.hasOption("hsha");
368 
369     ThriftMetrics metrics = new ThriftMetrics(conf, ThriftMetrics.ThriftServerType.TWO);
370 
371     String implType = "threadpool";
372     if (nonblocking) {
373       implType = "nonblocking";
374     } else if (hsha) {
375       implType = "hsha";
376     }
377 
378     conf.set("hbase.regionserver.thrift.server.type", implType);
379     conf.setInt("hbase.regionserver.thrift.port", listenPort);
380     registerFilters(conf);
381 
382     // Construct correct ProtocolFactory
383     boolean compact = cmd.hasOption("compact") ||
384         conf.getBoolean("hbase.regionserver.thrift.compact", false);
385     TProtocolFactory protocolFactory = getTProtocolFactory(compact);
386     final ThriftHBaseServiceHandler hbaseHandler =
387       new ThriftHBaseServiceHandler(conf, userProvider);
388     THBaseService.Iface handler =
389       ThriftHBaseServiceHandler.newInstance(hbaseHandler, metrics);
390     final THBaseService.Processor p = new THBaseService.Processor(handler);
391     conf.setBoolean("hbase.regionserver.thrift.compact", compact);
392     TProcessor processor = p;
393 
394     boolean framed = cmd.hasOption("framed") ||
395         conf.getBoolean("hbase.regionserver.thrift.framed", false) || nonblocking || hsha;
396     TTransportFactory transportFactory = getTTransportFactory(qop, name, host, framed,
397         conf.getInt("hbase.regionserver.thrift.framed.max_frame_size_in_mb", 2) * 1024 * 1024);
398     InetSocketAddress inetSocketAddress = bindToPort(bindAddress, listenPort);
399     conf.setBoolean("hbase.regionserver.thrift.framed", framed);
400     if (qop != null) {
401       // Create a processor wrapper, to get the caller
402       processor = new TProcessor() {
403         @Override
404         public boolean process(TProtocol inProt,
405             TProtocol outProt) throws TException {
406           TSaslServerTransport saslServerTransport =
407             (TSaslServerTransport)inProt.getTransport();
408           SaslServer saslServer = saslServerTransport.getSaslServer();
409           String principal = saslServer.getAuthorizationID();
410           hbaseHandler.setEffectiveUser(principal);
411           return p.process(inProt, outProt);
412         }
413       };
414     }
415 
416     // check for user-defined info server port setting, if so override the conf
417     try {
418       if (cmd.hasOption("infoport")) {
419         String val = cmd.getOptionValue("infoport");
420         conf.setInt("hbase.thrift.info.port", Integer.valueOf(val));
421         log.debug("Web UI port set to " + val);
422       }
423     } catch (NumberFormatException e) {
424       log.error("Could not parse the value provided for the infoport option", e);
425       printUsage();
426       System.exit(1);
427     }
428 
429     // Put up info server.
430     int port = conf.getInt("hbase.thrift.info.port", 9095);
431     if (port >= 0) {
432       conf.setLong("startcode", System.currentTimeMillis());
433       String a = conf.get("hbase.thrift.info.bindAddress", "0.0.0.0");
434       InfoServer infoServer = new InfoServer("thrift", a, port, false, conf);
435       infoServer.setAttribute("hbase.conf", conf);
436       infoServer.start();
437     }
438 
439     if (nonblocking) {
440       server = getTNonBlockingServer(protocolFactory, processor, transportFactory, inetSocketAddress);
441     } else if (hsha) {
442       server = getTHsHaServer(protocolFactory, processor, transportFactory, inetSocketAddress, metrics);
443     } else {
444       server = getTThreadPoolServer(protocolFactory, processor, transportFactory, inetSocketAddress);
445     }
446 
447     final TServer tserver = server;
448     realUser.doAs(
449       new PrivilegedAction<Object>() {
450         @Override
451         public Object run() {
452           tserver.serve();
453           return null;
454         }
455       });
456   }
457 }