You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org> on 2020/10/22 20:55:00 UTC
[Impala-ASF-CR] WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Wenzhe Zhou has uploaded this change for review. ( http://gerrit.cloudera.org:8080/16630
Change subject: WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also turn off HTTP Digest Authorization in
FIPS mode since Digest Authorization use MD5 hash.
Testing:
- Passed core tests.
- TODO: Verify HTTP Digest Authorization could not be enabled
on FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
---
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver.cc
2 files changed, 37 insertions(+), 11 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/16630/1
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 1
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 8:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/6622/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 8
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 29 Oct 2020 23:09:25 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Thomas Tauber-Marshall (Code Review)" <ge...@cloudera.org>.
Thomas Tauber-Marshall has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
Patch Set 4:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/16630/4/be/src/thirdparty/squeasel/squeasel.c
File be/src/thirdparty/squeasel/squeasel.c:
http://gerrit.cloudera.org:8080/#/c/16630/4/be/src/thirdparty/squeasel/squeasel.c@1527
PS4, Line 1527: #ifndef USE_SQ_OWN_HASH_FUNCTIONS
Does FIPS have a requirement that non-openssl crypto functions have to be compiled out, or is it good enough that they don't get used? Seems like given your change in webserver.cc that prevents us from using passwords files in FIPS that these functions won't ever actually get used.
http://gerrit.cloudera.org:8080/#/c/16630/4/be/src/thirdparty/squeasel/squeasel.c@3247
PS4, Line 3247: #ifndef USE_SQ_OWN_HASH_FUNCTIONS
Like above, seems like these functions aren't actually getting used. And in fact, I think these are already getting compiled out due to the USE_WEBSOCKET above, which I don't think we set.
If we really do still want to make this change, I might suggest just completely deleting the squeasel functions and leave openssl as the only option.
http://gerrit.cloudera.org:8080/#/c/16630/4/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/16630/4/be/src/util/webserver.cc@401
PS4, Line 401: Don't support HTTP Digest Authorization in FIPS mode.
nit: this is worded kind of strangely. Maybe
"HTTP digest authorization is not supported in FIPS mode"
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 4
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Tue, 27 Oct 2020 20:28:25 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 8:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/7585/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 8
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 29 Oct 2020 23:22:32 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
Patch Set 2:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/7534/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 2
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 22 Oct 2020 21:52:08 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also force to turn off Digest Authorization
for Web server in FIPS approved mode since Digest Authorization
use MD5 hash and it doesn't comply with FIPS 140-2.
Testing:
- Passed webserver-test.
- Passed exhaustive tests.
- Manually verified HTTP Digest Authorization could not be enabled
by setting webserver_password_file on a FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Reviewed-on: http://gerrit.cloudera.org:8080/16630
Reviewed-by: Thomas Tauber-Marshall <tm...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
3 files changed, 38 insertions(+), 338 deletions(-)
Approvals:
Thomas Tauber-Marshall: Looks good to me, approved
Impala Public Jenkins: Verified
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 9
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
Patch Set 1:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/7532/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 1
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Thu, 22 Oct 2020 21:10:11 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Thomas Tauber-Marshall (Code Review)" <ge...@cloudera.org>.
Thomas Tauber-Marshall has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 7:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/16630/7/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/16630/7/be/src/util/webserver.cc@401
PS7, Line 401: stringstream ss;
This is unnecessary, you can just pass the string directly into the Status constructor.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 7
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 29 Oct 2020 22:38:28 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
Patch Set 4:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/7562/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 4
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Tue, 27 Oct 2020 04:55:32 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
Patch Set 1:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/16630/1/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/16630/1/be/src/util/webserver.cc@400
PS1, Line 400: ss << "Webserver: Password file does not exist: " << FLAGS_webserver_password_file;
line too long (91 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 1
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Thu, 22 Oct 2020 20:55:42 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org>.
Wenzhe Zhou has uploaded a new patch set (#2). ( http://gerrit.cloudera.org:8080/16630 )
Change subject: WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also turn off HTTP Digest Authorization in
FIPS mode since Digest Authorization use MD5 hash.
Testing:
- Passed core tests.
- TODO: Verify HTTP Digest Authorization could not be enabled
on FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
---
A Impala.cbp
A be/ASSEMBLER.cbp
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver.cc
4 files changed, 41,306 insertions(+), 11 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/16630/2
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 2
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org>.
Wenzhe Zhou has uploaded a new patch set (#4). ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also force to turn off Digest Authorization
for Web server in FIPS mode since Digest Authorization use MD5 hash.
Testing:
- Passed exhaustive tests.
- Manually verified HTTP Digest Authorization could not be enabled
by setting webserver_password_file on a FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
---
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver.cc
2 files changed, 38 insertions(+), 11 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/16630/4
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 4
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Thomas Tauber-Marshall (Code Review)" <ge...@cloudera.org>.
Thomas Tauber-Marshall has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 8: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 8
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 29 Oct 2020 23:09:07 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org>.
Wenzhe Zhou has uploaded a new patch set (#6). ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also force to turn off Digest Authorization
for Web server in FIPS approved mode since Digest Authorization
use MD5 hash and it doesn't comply with FIPS 140-2.
Testing:
- Passed exhaustive tests.
- Manually verified HTTP Digest Authorization could not be enabled
by setting webserver_password_file on a FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
---
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
3 files changed, 31 insertions(+), 333 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/16630/6
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 6
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org>.
Wenzhe Zhou has uploaded a new patch set (#7). ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also force to turn off Digest Authorization
for Web server in FIPS approved mode since Digest Authorization
use MD5 hash and it doesn't comply with FIPS 140-2.
Testing:
- Passed webserver-test.
- Passed exhaustive tests.
- Manually verified HTTP Digest Authorization could not be enabled
by setting webserver_password_file on a FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
---
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
3 files changed, 38 insertions(+), 336 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/16630/7
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 7
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 7:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/7584/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 7
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 29 Oct 2020 22:15:48 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org>.
Wenzhe Zhou has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 7:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/16630/7/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/16630/7/be/src/util/webserver.cc@401
PS7, Line 401: stringstream ss;
> This is unnecessary, you can just pass the string directly into the Status
Right, fixed it.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 7
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 29 Oct 2020 23:04:49 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
Patch Set 5:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/7571/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 5
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Tue, 27 Oct 2020 23:14:12 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org>.
Wenzhe Zhou has uploaded a new patch set (#3). ( http://gerrit.cloudera.org:8080/16630 )
Change subject: WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also turn off HTTP Digest Authorization in
FIPS mode since Digest Authorization use MD5 hash.
Testing:
- Passed core tests.
- TODO: Verify HTTP Digest Authorization could not be enabled
on FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
---
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver.cc
2 files changed, 38 insertions(+), 11 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/16630/3
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 3
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: WIP IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
Patch Set 3:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/7535/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 3
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 22 Oct 2020 21:52:33 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
Posted by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org>.
Wenzhe Zhou has uploaded a new patch set (#5). ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
......................................................................
IMPALA-10206: Avoid MD5 Digest Authorization in FIPS mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also force to turn off Digest Authorization
for Web server in FIPS mode since Digest Authorization use MD5 hash.
Testing:
- Passed exhaustive tests.
- Manually verified HTTP Digest Authorization could not be enabled
by setting webserver_password_file on a FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
---
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver.cc
2 files changed, 28 insertions(+), 333 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/16630/5
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 5
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 6:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/7582/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 6
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 29 Oct 2020 19:44:16 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Wenzhe Zhou (Code Review)" <ge...@cloudera.org>.
Wenzhe Zhou has uploaded a new patch set (#8). ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
To compliant with FIPS requirement, we should use OpenSSL libraries
for cryptographic hash functions, instead of own hash functions.
This patch replace MD5 and SHA1 functions in Squeasel Web server
with OpenSSL APIs. It also force to turn off Digest Authorization
for Web server in FIPS approved mode since Digest Authorization
use MD5 hash and it doesn't comply with FIPS 140-2.
Testing:
- Passed webserver-test.
- Passed exhaustive tests.
- Manually verified HTTP Digest Authorization could not be enabled
by setting webserver_password_file on a FIPS enabled cluster.
Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
---
M be/src/thirdparty/squeasel/squeasel.c
M be/src/util/webserver-test.cc
M be/src/util/webserver.cc
3 files changed, 38 insertions(+), 338 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/30/16630/8
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 8
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Thomas Tauber-Marshall (Code Review)" <ge...@cloudera.org>.
Thomas Tauber-Marshall has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 6:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/16630/6/be/src/util/webserver-test.cc
File be/src/util/webserver-test.cc:
http://gerrit.cloudera.org:8080/#/c/16630/6/be/src/util/webserver-test.cc@439
PS6, Line 439: if (FIPS_mode()) return;
Once we're returning an error status (per my other comment), lets have this test check for that, ie. do an if(FIPS_mode()) ASSERT_ERROR(webserver.Start())
http://gerrit.cloudera.org:8080/#/c/16630/6/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/16630/6/be/src/util/webserver.cc@401
PS6, Line 401: LOG(WARNING) << "HTTP digest authorization is not supported in FIPS approved mode.";
We should probably return an error status here, just to be sure people don't accidentally misconfigure this.
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 6
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Thu, 29 Oct 2020 20:47:49 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/16630 )
Change subject: IMPALA-10206: Avoid MD5 Digest Authorization in FIPS approved mode
......................................................................
Patch Set 8: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/16630
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ie075389b3ab65c612d64ba58e16a10b19bdf4d6f
Gerrit-Change-Number: 16630
Gerrit-PatchSet: 8
Gerrit-Owner: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Thomas Tauber-Marshall <tm...@cloudera.com>
Gerrit-Reviewer: Wenzhe Zhou <wz...@cloudera.com>
Gerrit-Comment-Date: Fri, 30 Oct 2020 04:33:09 +0000
Gerrit-HasComments: No