This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch ranger-2.8
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.8 by this push:
new 1ec38a4a5 RANGER-5403: fix intermittent HDFS authorization failures
(#737)
1ec38a4a5 is described below
commit 1ec38a4a55092414cc472e3f511faa5ac44b9eef
Author: Xuze Yang <[email protected]>
AuthorDate: Tue Nov 18 23:07:48 2025 -0800
RANGER-5403: fix intermittent HDFS authorization failures (#737)
Signed-off-by: Madhan Neethiraj <[email protected]>
(cherry picked from commit 2e62cd346d845890eff8d39ecf9f66ec6c7a4711)
---
.../resourcematcher/RangerPathResourceMatcher.java | 22 +++++++++++-----------
.../resourcematcher/RangerURLResourceMatcher.java | 22 +++++++++++-----------
2 files changed, 22 insertions(+), 22 deletions(-)
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
index 0cb515c22..2778b204b 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
@@ -644,12 +644,12 @@ public boolean isChildMatch(String resourceValue,
Map<String, Object> evalContex
}
static class RecursivePathResourceMatcher extends
AbstractPathResourceMatcher {
- String valueWithoutSeparator;
- String valueWithSeparator;
-
final IOCase ioCase;
final BiFunction<String, String, Boolean> primaryFunction;
final BiFunction<String, String, Boolean> fallbackFunction;
+ final String valueWithoutSeparator;
+ final String valueWithSeparator;
+
RecursivePathResourceMatcher(String value, Map<String, String>
options, char pathSeparatorChar, boolean optIgnoreCase, int priority) {
super(value, options, pathSeparatorChar, true,
priority);
@@ -657,6 +657,14 @@ static class RecursivePathResourceMatcher extends
AbstractPathResourceMatcher {
this.ioCase = optIgnoreCase ?
IOCase.INSENSITIVE : IOCase.SENSITIVE;
this.primaryFunction = optIgnoreCase ?
StringUtils::equalsIgnoreCase : StringUtils::equals;
this.fallbackFunction = optIgnoreCase ?
StringUtils::startsWithIgnoreCase : StringUtils::startsWith;
+
+ if (this.value == null || getNeedsDynamicEval()) {
+ valueWithoutSeparator = null;
+ valueWithSeparator = null;
+ } else {
+ valueWithoutSeparator =
getStringToCompare(this.value);
+ valueWithSeparator = valueWithoutSeparator +
pathSeparatorChar;
+ }
}
String getStringToCompare(String policyValue) {
@@ -677,10 +685,6 @@ boolean isMatch(String resourceValue, Map<String, Object>
evalContext) {
String expandedPolicyValue =
getExpandedValue(evalContext);
noSeparator = expandedPolicyValue != null ?
getStringToCompare(expandedPolicyValue) : null;
} else {
- if (valueWithoutSeparator == null && value !=
null) {
- valueWithoutSeparator =
getStringToCompare(value);
- valueWithSeparator =
valueWithoutSeparator + pathSeparatorChar;
- }
noSeparator = valueWithoutSeparator;
}
@@ -721,10 +725,6 @@ public boolean isChildMatch(String resourceValue,
Map<String, Object> evalContex
String expandedPolicyValue =
getExpandedValue(evalContext);
noSeparator = expandedPolicyValue != null ?
getStringToCompare(expandedPolicyValue) : null;
} else {
- if (valueWithoutSeparator == null && value !=
null) {
- valueWithoutSeparator =
getStringToCompare(value);
- valueWithSeparator =
valueWithoutSeparator + pathSeparatorChar;
- }
noSeparator = valueWithoutSeparator;
}
final int lastLevelSeparatorIndex = noSeparator != null
? noSeparator.lastIndexOf(pathSeparatorChar) : -1;
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
index 323994322..674ae202d 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
@@ -276,13 +276,21 @@ public boolean isPrefixMatch(String resourceValue,
Map<String, Object> evalConte
}
abstract class RecursiveMatcher extends AbstractStringResourceMatcher {
- final char levelSeparatorChar;
- String valueWithoutSeparator;
- String valueWithSeparator;
+ final char levelSeparatorChar;
+ final String valueWithoutSeparator;
+ final String valueWithSeparator;
RecursiveMatcher(String value, Map<String, String> options, char
levelSeparatorChar) {
super(value, options);
this.levelSeparatorChar = levelSeparatorChar;
+
+ if (this.value == null || getNeedsDynamicEval()) {
+ valueWithoutSeparator = null;
+ valueWithSeparator = null;
+ } else {
+ valueWithoutSeparator = getStringToCompare(this.value);
+ valueWithSeparator = valueWithoutSeparator +
Character.toString(levelSeparatorChar);
+ }
}
String getStringToCompare(String policyValue) {
@@ -307,10 +315,6 @@ boolean isMatch(String resourceValue, Map<String, Object>
evalContext) {
String expandedPolicyValue = getExpandedValue(evalContext);
noSeparator = expandedPolicyValue != null ?
getStringToCompare(expandedPolicyValue) : null;
} else {
- if (valueWithoutSeparator == null && value != null) {
- valueWithoutSeparator = getStringToCompare(value);
- valueWithSeparator = valueWithoutSeparator +
Character.toString(levelSeparatorChar);
- }
noSeparator = valueWithoutSeparator;
}
@@ -345,10 +349,6 @@ boolean isMatch(String resourceValue, Map<String, Object>
evalContext) {
String expandedPolicyValue = getExpandedValue(evalContext);
noSeparator = expandedPolicyValue != null ?
getStringToCompare(expandedPolicyValue) : null;
} else {
- if (valueWithoutSeparator == null && value != null) {
- valueWithoutSeparator = getStringToCompare(value);
- valueWithSeparator = valueWithoutSeparator +
Character.toString(levelSeparatorChar);
- }
noSeparator = valueWithoutSeparator;
}
