You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@asterixdb.apache.org by AsterixDB Code Review <do...@asterix-gerrit.ics.uci.edu> on 2026/08/15 02:01:31 UTC
[XS] Change in asterixdb[morpheus]: [NO ISSUE][NET][BP] Only use client certificates if configured
From Michael Blow <mb...@apache.org>:
Michael Blow has uploaded this change for review. ( https://asterix-gerrit.ics.uci.edu/c/asterixdb/+/21565?usp=email )
Change subject: [NO ISSUE][NET][BP] Only use client certificates if configured
......................................................................
[NO ISSUE][NET][BP] Only use client certificates if configured
Without this, newSSLEngine(true) resolves its context from the client
key store for every outgoing SSL connection, and the default
NetworkSecurityConfig supplies neither a client key store nor a file for
one -- so createClientChannel fails with an NPE out of
loadKeyStoreFromFile and no SSL connection can be established. This
branch has carried INetworkSecurityConfig.useMutualAuth since
184a963c55 but never the commit that consults it.
It went unnoticed because the connect wait was unbounded: the handle sat
in INITIAL and the caller blocked in waitTillConnected forever. Bounding
that wait (MB-73310) turns the hang into a reported failure, which is
what surfaced this -- SslReplicationExecutionTest and
SslSqlppExecutionTest now fail in 120s rather than hanging.
Ext-ref: MB-73310
Change-Id: Id46266849ded6d0ea632293e829aed78396e1ea2
Reviewed-on: https://asterix-gerrit.ics.uci.edu/c/asterixdb/+/19471
Integration-Tests: Jenkins <je...@fulliautomatix.ics.uci.edu>
Reviewed-by: Michael Blow <mb...@apache.org>
Tested-by: Michael Blow <mb...@apache.org>
(cherry picked from commit aba667bc4fdf7760ecb8969d52b0a23b883cd4a0)
---
M hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java
1 file changed, 2 insertions(+), 1 deletion(-)
git pull ssh://asterix-gerrit.ics.uci.edu:29418/asterixdb refs/changes/65/21565/1
diff --git a/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java b/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java
index d8f5cff..7a0e482 100644
--- a/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java
+++ b/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java
@@ -53,7 +53,8 @@
@Override
public SSLEngine newSSLEngine(boolean clientMode) {
try {
- SSLEngine sslEngine = newSSLContext(clientMode).createSSLEngine();
+ boolean useClientCerts = clientMode && config.useMutualAuth();
+ SSLEngine sslEngine = newSSLContext(useClientCerts).createSSLEngine();
sslEngine.setUseClientMode(clientMode);
return sslEngine;
} catch (Exception ex) {
--
To view, visit https://asterix-gerrit.ics.uci.edu/c/asterixdb/+/21565?usp=email
To unsubscribe, or for help writing mail filters, visit https://asterix-gerrit.ics.uci.edu/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: asterixdb
Gerrit-Branch: morpheus
Gerrit-Change-Id: Id46266849ded6d0ea632293e829aed78396e1ea2
Gerrit-Change-Number: 21565
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Blow <mb...@apache.org>
Gerrit-CC: Ian Maxon <im...@apache.org>