You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Todd Lipcon (Code Review)" <ge...@cloudera.org> on 2016/10/28 01:18:44 UTC
[kudu-CR] Fix SASL mechanism negotiation on the server side
Hello Dan Burkert, Alexey Serbin,
I'd like you to do a code review. Please visit
http://gerrit.cloudera.org:8080/4875
to review the following change.
Change subject: Fix SASL mechanism negotiation on the server side
......................................................................
Fix SASL mechanism negotiation on the server side
This fixes the order in which the SASL server is intiialized such that
the mechanism list is set up before the sasl_server_init function is
called. This is equivalent to the change made in Change ID
I3c1b93045acd428ef3437597059c5106b03e25d0 on the client side.
Without this change, the server would use a null mechanism list, which
was being treated as a wildcard.
The new test case configures a server to only accept GSSAPI, and then
has a client configured to accept GSSAPI or PLAIN. Before the fix, it
would negotiate PLAIN despite the attempt to require GSSAPI on the
server side. Now, it properly negotiates.
Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
---
M src/kudu/rpc/connection.cc
M src/kudu/rpc/sasl_helper.cc
M src/kudu/rpc/sasl_rpc-test.cc
M src/kudu/rpc/sasl_server.cc
4 files changed, 51 insertions(+), 11 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/75/4875/1
--
To view, visit http://gerrit.cloudera.org:8080/4875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Gerrit-PatchSet: 1
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Todd Lipcon <to...@apache.org>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
[kudu-CR] Fix SASL mechanism negotiation on the server side
Posted by "Todd Lipcon (Code Review)" <ge...@cloudera.org>.
Todd Lipcon has posted comments on this change.
Change subject: Fix SASL mechanism negotiation on the server side
......................................................................
Patch Set 1:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/4875/1//COMMIT_MSG
Commit Message:
PS1, Line 9: intiialized
> nit: typo intiialized --> initialized
Done
http://gerrit.cloudera.org:8080/#/c/4875/1/src/kudu/rpc/sasl_rpc-test.cc
File src/kudu/rpc/sasl_rpc-test.cc:
PS1, Line 211: CHECK_OK(sasl_client.EnablePlain("foo", "bar"));
: CHECK_OK(sasl_client.EnableGSSAPI());
> What happens if GSSAPI is not enabled on the client side, having just plain
i.e a test where client has PLAIN only, and the server has GSSAPI only? sure, can add that.
--
To view, visit http://gerrit.cloudera.org:8080/4875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Gerrit-PatchSet: 1
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Todd Lipcon <to...@apache.org>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Todd Lipcon <to...@apache.org>
Gerrit-HasComments: Yes
[kudu-CR] Fix SASL mechanism negotiation on the server side
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change.
Change subject: Fix SASL mechanism negotiation on the server side
......................................................................
Patch Set 4: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/4875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Gerrit-PatchSet: 4
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Todd Lipcon <to...@apache.org>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Todd Lipcon <to...@apache.org>
Gerrit-HasComments: No
[kudu-CR] Fix SASL mechanism negotiation on the server side
Posted by "Todd Lipcon (Code Review)" <ge...@cloudera.org>.
Hello Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/4875
to look at the new patch set (#4).
Change subject: Fix SASL mechanism negotiation on the server side
......................................................................
Fix SASL mechanism negotiation on the server side
This fixes the order in which the SASL server is initialized such that
the mechanism list is set up before the sasl_server_init function is
called. This is equivalent to the change made in Change ID
I3c1b93045acd428ef3437597059c5106b03e25d0 on the client side.
Without this change, the server would use a null mechanism list, which
was being treated as a wildcard.
The new test case configures a server to only accept GSSAPI, and then
has a client configured to accept GSSAPI or PLAIN. Before the fix, it
would negotiate PLAIN despite the attempt to require GSSAPI on the
server side. Now, it properly negotiates.
Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
---
M src/kudu/rpc/connection.cc
M src/kudu/rpc/sasl_helper.cc
M src/kudu/rpc/sasl_rpc-test.cc
M src/kudu/rpc/sasl_server.cc
4 files changed, 85 insertions(+), 11 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/75/4875/4
--
To view, visit http://gerrit.cloudera.org:8080/4875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Gerrit-PatchSet: 4
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Todd Lipcon <to...@apache.org>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Todd Lipcon <to...@apache.org>
[kudu-CR] Fix SASL mechanism negotiation on the server side
Posted by "Todd Lipcon (Code Review)" <ge...@cloudera.org>.
Todd Lipcon has submitted this change and it was merged.
Change subject: Fix SASL mechanism negotiation on the server side
......................................................................
Fix SASL mechanism negotiation on the server side
This fixes the order in which the SASL server is initialized such that
the mechanism list is set up before the sasl_server_init function is
called. This is equivalent to the change made in Change ID
I3c1b93045acd428ef3437597059c5106b03e25d0 on the client side.
Without this change, the server would use a null mechanism list, which
was being treated as a wildcard.
The new test case configures a server to only accept GSSAPI, and then
has a client configured to accept GSSAPI or PLAIN. Before the fix, it
would negotiate PLAIN despite the attempt to require GSSAPI on the
server side. Now, it properly negotiates.
Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Reviewed-on: http://gerrit.cloudera.org:8080/4875
Tested-by: Kudu Jenkins
Reviewed-by: Alexey Serbin <as...@cloudera.com>
---
M src/kudu/rpc/connection.cc
M src/kudu/rpc/sasl_helper.cc
M src/kudu/rpc/sasl_rpc-test.cc
M src/kudu/rpc/sasl_server.cc
4 files changed, 85 insertions(+), 11 deletions(-)
Approvals:
Alexey Serbin: Looks good to me, approved
Kudu Jenkins: Verified
--
To view, visit http://gerrit.cloudera.org:8080/4875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Gerrit-PatchSet: 5
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Todd Lipcon <to...@apache.org>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Todd Lipcon <to...@apache.org>
[kudu-CR] WIP: Fix SASL mechanism negotiation on the server side
Posted by "Todd Lipcon (Code Review)" <ge...@cloudera.org>.
Hello Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/4875
to look at the new patch set (#2).
Change subject: WIP: Fix SASL mechanism negotiation on the server side
......................................................................
WIP: Fix SASL mechanism negotiation on the server side
This fixes the order in which the SASL server is initialized such that
the mechanism list is set up before the sasl_server_init function is
called. This is equivalent to the change made in Change ID
I3c1b93045acd428ef3437597059c5106b03e25d0 on the client side.
Without this change, the server would use a null mechanism list, which
was being treated as a wildcard.
The new test case configures a server to only accept GSSAPI, and then
has a client configured to accept GSSAPI or PLAIN. Before the fix, it
would negotiate PLAIN despite the attempt to require GSSAPI on the
server side. Now, it properly negotiates.
WIP because I need to add another test Alexey suggested
Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
---
M src/kudu/rpc/connection.cc
M src/kudu/rpc/sasl_helper.cc
M src/kudu/rpc/sasl_rpc-test.cc
M src/kudu/rpc/sasl_server.cc
4 files changed, 54 insertions(+), 11 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/75/4875/2
--
To view, visit http://gerrit.cloudera.org:8080/4875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Gerrit-PatchSet: 2
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Todd Lipcon <to...@apache.org>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Todd Lipcon <to...@apache.org>
[kudu-CR] Fix SASL mechanism negotiation on the server side
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change.
Change subject: Fix SASL mechanism negotiation on the server side
......................................................................
Patch Set 1:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/4875/1//COMMIT_MSG
Commit Message:
PS1, Line 9: intiialized
nit: typo intiialized --> initialized
http://gerrit.cloudera.org:8080/#/c/4875/1/src/kudu/rpc/sasl_rpc-test.cc
File src/kudu/rpc/sasl_rpc-test.cc:
PS1, Line 211: CHECK_OK(sasl_client.EnablePlain("foo", "bar"));
: CHECK_OK(sasl_client.EnableGSSAPI());
What happens if GSSAPI is not enabled on the client side, having just plain with correct would-be-GSSAPI credentials?
I assume the negotiation should fail. I might be missing something, but I don't see a test for that.
Do you think it's worth adding such a test?
--
To view, visit http://gerrit.cloudera.org:8080/4875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Gerrit-PatchSet: 1
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Todd Lipcon <to...@apache.org>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-HasComments: Yes
[kudu-CR] WIP: Fix SASL mechanism negotiation on the server side
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change.
Change subject: WIP: Fix SASL mechanism negotiation on the server side
......................................................................
Patch Set 1:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/4875/1/src/kudu/rpc/sasl_rpc-test.cc
File src/kudu/rpc/sasl_rpc-test.cc:
PS1, Line 211: CHECK_OK(sasl_client.EnablePlain("foo", "bar"));
: CHECK_OK(sasl_client.EnableGSSAPI());
> i.e a test where client has PLAIN only, and the server has GSSAPI only? sur
Yes -- I was curious what would be the outcome if a client which does not support GSSAPI, just plain, negotiates with the server which requires GSSAPI. The client has correct credentials for the plain mode.
--
To view, visit http://gerrit.cloudera.org:8080/4875
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I4741ce618525311258d5ba61dd85f6f4721caf66
Gerrit-PatchSet: 1
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-Owner: Todd Lipcon <to...@apache.org>
Gerrit-Reviewer: Alexey Serbin <as...@cloudera.com>
Gerrit-Reviewer: Dan Burkert <da...@apache.org>
Gerrit-Reviewer: Kudu Jenkins
Gerrit-Reviewer: Todd Lipcon <to...@apache.org>
Gerrit-HasComments: Yes