You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Alexey Serbin (Code Review)" <ge...@cloudera.org> on 2023/08/23 23:18:47 UTC
[kudu-CR](branch-1.17.x) Fix master hms-itest on RHEL9
Alexey Serbin has uploaded this change for review. ( http://gerrit.cloudera.org:8080/20412
Change subject: Fix master_hms-itest on RHEL9
......................................................................
Fix master_hms-itest on RHEL9
Tests in master_hms-itest are failing on RHEL9 with the following error:
"Algorithm constraints check failed on keysize limits: RSA 768 bit key
used with certificate: CN=kudu-ipki-ca
...
(DisabledAlgorithmConstraints.java:887)".
This is not expected as we already relax some constraints in
mini_hms.cc [1].
As it turns out there is a property in java.security properties
file [2]:
\# Determines whether this properties file will be appended to
\# using the system properties file stored at
\# /etc/crypto-policies/back-ends/java.config
\#
\security.useSystemPropertiesFile=true
If we take a look inside the above mentioned java.config file we can
find the source of the test errors (RSA keySize < 2048):
jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
jdk.tls.disabledAlgorithms=DH keySize < 2048, TLSv1.1, TLSv1, SSLv3,
...
jdk.tls.legacyAlgorithms=
This patch sets security.useSystemPropertiesFile=false in mini_hms.cc to
make all the tests in master_hms-itest work on RHEL9.
[1] https://github.com/apache/kudu/blob/\
master/src/kudu/hms/mini_hms.cc#L226-L228
[2] location: ${JAVA_HOME}/jre/lib/security/java.security
Change-Id: I1906a1f79af62557a922348dcc64da9c788a9422
Reviewed-on: http://gerrit.cloudera.org:8080/20128
Tested-by: Kudu Jenkins
Reviewed-by: Alexey Serbin <al...@apache.org>
(cherry picked from commit ec43817068c7aaa429f5f7371108751bb2d5e675)
---
M src/kudu/hms/mini_hms.cc
1 file changed, 4 insertions(+), 0 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/12/20412/1
--
To view, visit http://gerrit.cloudera.org:8080/20412
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: newchange
Gerrit-Change-Id: I1906a1f79af62557a922348dcc64da9c788a9422
Gerrit-Change-Number: 20412
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR](branch-1.17.x) Fix master hms-itest on RHEL9
Posted by "Yingchun Lai (Code Review)" <ge...@cloudera.org>.
Yingchun Lai has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/20412 )
Change subject: Fix master_hms-itest on RHEL9
......................................................................
Fix master_hms-itest on RHEL9
Tests in master_hms-itest are failing on RHEL9 with the following error:
"Algorithm constraints check failed on keysize limits: RSA 768 bit key
used with certificate: CN=kudu-ipki-ca
...
(DisabledAlgorithmConstraints.java:887)".
This is not expected as we already relax some constraints in
mini_hms.cc [1].
As it turns out there is a property in java.security properties
file [2]:
\# Determines whether this properties file will be appended to
\# using the system properties file stored at
\# /etc/crypto-policies/back-ends/java.config
\#
\security.useSystemPropertiesFile=true
If we take a look inside the above mentioned java.config file we can
find the source of the test errors (RSA keySize < 2048):
jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
jdk.tls.disabledAlgorithms=DH keySize < 2048, TLSv1.1, TLSv1, SSLv3,
...
jdk.tls.legacyAlgorithms=
This patch sets security.useSystemPropertiesFile=false in mini_hms.cc to
make all the tests in master_hms-itest work on RHEL9.
[1] https://github.com/apache/kudu/blob/\
master/src/kudu/hms/mini_hms.cc#L226-L228
[2] location: ${JAVA_HOME}/jre/lib/security/java.security
Change-Id: I1906a1f79af62557a922348dcc64da9c788a9422
Reviewed-on: http://gerrit.cloudera.org:8080/20128
Tested-by: Kudu Jenkins
Reviewed-by: Alexey Serbin <al...@apache.org>
(cherry picked from commit ec43817068c7aaa429f5f7371108751bb2d5e675)
Reviewed-on: http://gerrit.cloudera.org:8080/20412
Reviewed-by: Yingchun Lai <la...@apache.org>
---
M src/kudu/hms/mini_hms.cc
1 file changed, 4 insertions(+), 0 deletions(-)
Approvals:
Kudu Jenkins: Verified
Yingchun Lai: Looks good to me, approved
--
To view, visit http://gerrit.cloudera.org:8080/20412
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: merged
Gerrit-Change-Id: I1906a1f79af62557a922348dcc64da9c788a9422
Gerrit-Change-Number: 20412
Gerrit-PatchSet: 2
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Yingchun Lai <la...@apache.org>
[kudu-CR](branch-1.17.x) Fix master hms-itest on RHEL9
Posted by "Yingchun Lai (Code Review)" <ge...@cloudera.org>.
Yingchun Lai has posted comments on this change. ( http://gerrit.cloudera.org:8080/20412 )
Change subject: Fix master_hms-itest on RHEL9
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/20412
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: comment
Gerrit-Change-Id: I1906a1f79af62557a922348dcc64da9c788a9422
Gerrit-Change-Number: 20412
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Reviewer: Yingchun Lai <la...@apache.org>
Gerrit-Comment-Date: Thu, 24 Aug 2023 03:19:08 +0000
Gerrit-HasComments: No