You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Dan Burkert (Code Review)" <ge...@cloudera.org> on 2017/02/28 03:22:37 UTC
[kudu-CR] Fix security tests on macOS
Hello Adar Dembo, Alexey Serbin,
I'd like you to do a code review. Please visit
http://gerrit.cloudera.org:8080/6176
to review the following change.
Change subject: Fix security tests on macOS
......................................................................
Fix security tests on macOS
This fixes a few issues:
* The macOS Heimdal Kerberos implementation stubs out
krb5_aname_to_localname. Workaround is to grab the username from the
principal instead of doing the full mapping, this should be good
enough for now.
* The curl library was linking against the system OpenSSL, to fix this
I rejiggered how we pass OpenSSL include and link flags to the
thirdparty dependencies which need them. In my opinion it's a little
bit cleaner now.
* Another test was failing because of Heimdal caching the
non-existence of credentials, the test has been disabled, since
there is no known workaround for this (it happens in
negotiation-test.cc as well).
Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
---
M src/kudu/integration-tests/security-itest.cc
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc-test.cc
M thirdparty/build-definitions.sh
M thirdparty/build-thirdparty.sh
5 files changed, 61 insertions(+), 33 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/76/6176/1
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 1
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
[kudu-CR] Fix security tests on macOS
Posted by "Adar Dembo (Code Review)" <ge...@cloudera.org>.
Adar Dembo has posted comments on this change.
Change subject: Fix security tests on macOS
......................................................................
Patch Set 3:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/6176/3/src/kudu/security/init.cc
File src/kudu/security/init.cc:
PS3, Line 379: 1>
Nit: 1 >
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 3
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-HasComments: Yes
[kudu-CR] Fix security tests on macOS
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change.
Change subject: Fix security tests on macOS
......................................................................
Patch Set 1:
(2 comments)
This looks much cleaner than the original approach with separate flags for squeasel and libcurl.
http://gerrit.cloudera.org:8080/#/c/6176/1/thirdparty/build-thirdparty.sh
File thirdparty/build-thirdparty.sh:
PS1, Line 169: brew
nit: Homebrew ?
PS1, Line 171: brew_openssl_include_dir
Looks like a typo: in the line above and below the variable is named 'brew_openssl_dir'
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 1
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-HasComments: Yes
[kudu-CR] Fix security tests on macOS
Posted by "Adar Dembo (Code Review)" <ge...@cloudera.org>.
Adar Dembo has posted comments on this change.
Change subject: Fix security tests on macOS
......................................................................
Patch Set 4: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 4
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-HasComments: No
[kudu-CR] Fix security tests on macOS
Posted by "Dan Burkert (Code Review)" <ge...@cloudera.org>.
Dan Burkert has submitted this change and it was merged.
Change subject: Fix security tests on macOS
......................................................................
Fix security tests on macOS
This fixes a few issues:
* The macOS Heimdal Kerberos implementation stubs out
krb5_aname_to_localname. Workaround is to grab the username from the
principal instead of doing the full mapping, this should be good
enough for now.
* The curl library was linking against the system OpenSSL, to fix this
I rejiggered how we pass OpenSSL include and link flags to the
thirdparty dependencies which need them. In my opinion it's a little
bit cleaner now.
* Another test was failing because of Heimdal caching the
non-existence of credentials, the test has been disabled, since
there is no known workaround for this (it happens in
negotiation-test.cc as well).
Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Reviewed-on: http://gerrit.cloudera.org:8080/6176
Reviewed-by: Adar Dembo <ad...@cloudera.com>
Tested-by: Kudu Jenkins
---
M src/kudu/integration-tests/security-itest.cc
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc-test.cc
M thirdparty/build-definitions.sh
M thirdparty/build-thirdparty.sh
5 files changed, 62 insertions(+), 33 deletions(-)
Approvals:
Adar Dembo: Looks good to me, approved
Kudu Jenkins: Verified
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 5
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
[kudu-CR] Fix security tests on macOS
Posted by "Dan Burkert (Code Review)" <ge...@cloudera.org>.
Dan Burkert has posted comments on this change.
Change subject: Fix security tests on macOS
......................................................................
Patch Set 4:
(5 comments)
http://gerrit.cloudera.org:8080/#/c/6176/2/src/kudu/security/init.cc
File src/kudu/security/init.cc:
Line 388: }
> Can you move this higher up so it's part of the existing anonymous namespac
Done
Line 400: KRB5_RETURN_NOT_OK_PREPEND(krb5_parse_name(g_krb5_ctx, principal->c_str(), &princ),
> Is there an off-by-one error here? It looks like we're OK with username.len
Done
http://gerrit.cloudera.org:8080/#/c/6176/3/src/kudu/security/init.cc
File src/kudu/security/init.cc:
PS3, Line 379:
> Nit: 1 >
Done
http://gerrit.cloudera.org:8080/#/c/6176/1/thirdparty/build-thirdparty.sh
File thirdparty/build-thirdparty.sh:
PS1, Line 169: Home
> nit: Homebrew ?
Done
PS1, Line 171: homebrew_openssl_dir ];
> Looks like a typo: in the line above and below the variable is named 'brew_
Done
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 4
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-HasComments: Yes
[kudu-CR] Fix security tests on macOS
Posted by "Dan Burkert (Code Review)" <ge...@cloudera.org>.
Hello Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/6176
to look at the new patch set (#3).
Change subject: Fix security tests on macOS
......................................................................
Fix security tests on macOS
This fixes a few issues:
* The macOS Heimdal Kerberos implementation stubs out
krb5_aname_to_localname. Workaround is to grab the username from the
principal instead of doing the full mapping, this should be good
enough for now.
* The curl library was linking against the system OpenSSL, to fix this
I rejiggered how we pass OpenSSL include and link flags to the
thirdparty dependencies which need them. In my opinion it's a little
bit cleaner now.
* Another test was failing because of Heimdal caching the
non-existence of credentials, the test has been disabled, since
there is no known workaround for this (it happens in
negotiation-test.cc as well).
Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
---
M src/kudu/integration-tests/security-itest.cc
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc-test.cc
M thirdparty/build-definitions.sh
M thirdparty/build-thirdparty.sh
5 files changed, 59 insertions(+), 33 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/76/6176/3
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 3
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Kudu Jenkins
[kudu-CR] Fix security tests on macOS
Posted by "Dan Burkert (Code Review)" <ge...@cloudera.org>.
Hello Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/6176
to look at the new patch set (#2).
Change subject: Fix security tests on macOS
......................................................................
Fix security tests on macOS
This fixes a few issues:
* The macOS Heimdal Kerberos implementation stubs out
krb5_aname_to_localname. Workaround is to grab the username from the
principal instead of doing the full mapping, this should be good
enough for now.
* The curl library was linking against the system OpenSSL, to fix this
I rejiggered how we pass OpenSSL include and link flags to the
thirdparty dependencies which need them. In my opinion it's a little
bit cleaner now.
* Another test was failing because of Heimdal caching the
non-existence of credentials, the test has been disabled, since
there is no known workaround for this (it happens in
negotiation-test.cc as well).
Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
---
M src/kudu/integration-tests/security-itest.cc
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc-test.cc
M thirdparty/build-definitions.sh
M thirdparty/build-thirdparty.sh
5 files changed, 61 insertions(+), 33 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/76/6176/2
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 2
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Kudu Jenkins
[kudu-CR] Fix security tests on macOS
Posted by "Dan Burkert (Code Review)" <ge...@cloudera.org>.
Hello Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/6176
to look at the new patch set (#4).
Change subject: Fix security tests on macOS
......................................................................
Fix security tests on macOS
This fixes a few issues:
* The macOS Heimdal Kerberos implementation stubs out
krb5_aname_to_localname. Workaround is to grab the username from the
principal instead of doing the full mapping, this should be good
enough for now.
* The curl library was linking against the system OpenSSL, to fix this
I rejiggered how we pass OpenSSL include and link flags to the
thirdparty dependencies which need them. In my opinion it's a little
bit cleaner now.
* Another test was failing because of Heimdal caching the
non-existence of credentials, the test has been disabled, since
there is no known workaround for this (it happens in
negotiation-test.cc as well).
Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
---
M src/kudu/integration-tests/security-itest.cc
M src/kudu/security/init.cc
M src/kudu/security/test/mini_kdc-test.cc
M thirdparty/build-definitions.sh
M thirdparty/build-thirdparty.sh
5 files changed, 62 insertions(+), 33 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/76/6176/4
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 4
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Kudu Jenkins
[kudu-CR] Fix security tests on macOS
Posted by "Adar Dembo (Code Review)" <ge...@cloudera.org>.
Adar Dembo has posted comments on this change.
Change subject: Fix security tests on macOS
......................................................................
Patch Set 2:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/6176/2/src/kudu/security/init.cc
File src/kudu/security/init.cc:
Line 388: // macOS's Heimdal library has a no-op implementation of
Can you move this higher up so it's part of the existing anonymous namespace?
Line 400: if (username.length > len) {
Is there an off-by-one error here? It looks like we're OK with username.length == len, but we're going to copy username.length + 1 bytes below, which would be len + 1.
--
To view, visit http://gerrit.cloudera.org:8080/6176
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I1ff10fa47cb7b8ec6f927619e1420fa5e81a7f20
Gerrit-PatchSet: 2
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Adar Dembo <ad...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-HasComments: Yes