You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Tamas Mate (Code Review)" <ge...@cloudera.org> on 2021/12/03 13:37:58 UTC

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Tamas Mate has uploaded this change for review. ( http://gerrit.cloudera.org:8080/18068


Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................

IMPALA-11042: Escape special characters in LDAP User DN

In LDAP DNs can contain special characters such as '#', ",", etc.
However, these have to be escaped with a backlash inside the directory
service, because DN syntax can use these characters. When the DN is used
in a search filter these escape characters additional escaping is
required. In Impala the user DN can be used in group searches and this
commit adds additional escaping when necessary.

Example DN in directory service: cn=Doe\, John,ou=Users2,dc=myorg,dc=com
Example DN used in filter: cn=Doe\\, John,ou=Users2,dc=myorg,dc=com

Testing:
 - Added a custom cluster unti test
 - Tested the behaviour manually with OpenLDAP and Active Directory

Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
---
M be/src/util/ldap-search-bind.cc
M fe/src/test/java/org/apache/impala/customcluster/LdapSearchBindImpalaShellTest.java
M fe/src/test/java/org/apache/impala/testutil/LdapUtil.java
M fe/src/test/resources/users.ldif
4 files changed, 33 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/68/18068/1
-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 1
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................


Patch Set 3:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/9882/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 3
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Mon, 06 Dec 2021 18:21:56 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 6: Code-Review+2


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 6
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 17:16:05 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 5: Code-Review+1

(1 comment)

http://gerrit.cloudera.org:8080/#/c/18068/5/be/src/util/ldap-search-bind.h
File be/src/util/ldap-search-bind.h:

http://gerrit.cloudera.org:8080/#/c/18068/5/be/src/util/ldap-search-bind.h@65
PS5, Line 65: peroperties
typo



-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 5
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 16:00:23 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................


Patch Set 1:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/9868/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 1
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Comment-Date: Fri, 03 Dec 2021 14:00:06 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Tamas Mate (Code Review)" <ge...@cloudera.org>.
Hello Laszlo Gaal, Csaba Ringhofer, Impala Public Jenkins, 

I'd like you to reexamine a change. Please visit

    http://gerrit.cloudera.org:8080/18068

to look at the new patch set (#6).

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................

IMPALA-11042: Escape special characters in LDAP filters

The LDAP filter specification assigns special meaning to the following
characters: '*', '(', ')', '\', 'NUL'. These 5 characters should be
represented with their ASCII characters in LDAP filters. (RFC 4516)
Impala allows '{0}' and '{1}' notations, these patterns will be replaced
dynamically during runtime, the '{0}' is replaced with the login
username, while '{1}' is replaced with the DN of the login user. This DN
is obtained through an LDAP Search.

This commit handles the escaping of the dynamically obtained properties
(username/DN) in LDAP filters according to RFC-4516. Impala should be
configured with a properly escaped filters apart from these properties.

Example DN in directory service:
  cn=Ldap\, (Test6*),ou=Users2,dc=myorg,dc=com
Example DN used in filter:
  cn=Ldap\5C, \28Test6\2A\29,ou=Users2,dc=myorg,dc=com

Testing:
 - Added a custom cluster unti test
 - Tested the behaviour manually with OpenLDAP and Active Directory

Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
---
M be/src/util/ldap-search-bind.cc
M be/src/util/ldap-search-bind.h
M fe/src/test/java/org/apache/impala/customcluster/LdapSearchBindImpalaShellTest.java
M fe/src/test/java/org/apache/impala/testutil/LdapUtil.java
M fe/src/test/resources/users.ldif
5 files changed, 78 insertions(+), 5 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/68/18068/6
-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 6
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Posted by "Laszlo Gaal (Code Review)" <ge...@cloudera.org>.
Laszlo Gaal has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................


Patch Set 3: Code-Review+1

(3 comments)

Left a few minor notes about comments and the commit message.
Code LGTM.

http://gerrit.cloudera.org:8080/#/c/18068/3//COMMIT_MSG
Commit Message:

http://gerrit.cloudera.org:8080/#/c/18068/3//COMMIT_MSG@11
PS3, Line 11: backslas
nit: typo


http://gerrit.cloudera.org:8080/#/c/18068/3//COMMIT_MSG@13
PS3, Line 13: additional
            : escaping is required
nit: suggest rephrasing as "require additional escaping" to match active/passive voice with the first half of the sentence.


http://gerrit.cloudera.org:8080/#/c/18068/3/be/src/util/ldap-search-bind.h
File be/src/util/ldap-search-bind.h:

http://gerrit.cloudera.org:8080/#/c/18068/3/be/src/util/ldap-search-bind.h@65
PS3, Line 65: the admin should take care of escaping other parts of the filter
do you mean here that "other parts of the filter should be provided in an already escaped form"?
Is the filter you mention here the user or the group search filter?



-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 3
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Mon, 06 Dec 2021 21:24:39 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 7:

Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/7694/ DRY_RUN=false


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 7
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 17:16:25 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Posted by "Tamas Mate (Code Review)" <ge...@cloudera.org>.
Tamas Mate has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................


Patch Set 3:

Discussed the change with Csaba and Laszlo privately, wanted to thank the observations on this change here as well.

The new patch set replaces the special characters with the ascii characters as recommended in https://www.rfc-editor.org/rfc/rfc4515.txt, instead of appending an extra backlash.


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 3
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Mon, 06 Dec 2021 18:01:29 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................


Patch Set 3: Code-Review+1

I agree with Laci's comments, otherwise lgtm


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 3
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 08:20:24 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 7: Code-Review+2


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 7
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 17:16:24 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Laszlo Gaal (Code Review)" <ge...@cloudera.org>.
Laszlo Gaal has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 6: Code-Review+1

LGTM, a lot cleaner than previous versions.
+1 to let @csringhofer review as well, otherwise I'm OK with it.


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 6
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 16:51:16 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Tamas Mate (Code Review)" <ge...@cloudera.org>.
Tamas Mate has uploaded a new patch set (#5). ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................

IMPALA-11042: Escape special characters in LDAP filters

The LDAP filter specification assigns special meaning to the following
characters: '*', '(', ')', '\', 'NUL'. These 5 characters should be
represented with their ASCII characters in LDAP filters. (RFC 4516)
Impala allows '{0}' and '{1}' notations, these patterns will be replaced
dynamically during runtime, the '{0}' is replaced with the login
username, while '{1}' is replaced with the DN of the login user. This DN
is obtained through an LDAP Search.

This commit handles the escaping of the dynamically obtained properties
(username/DN) in LDAP filters according to RFC-4516. Impala should be
configured with a properly escaped filters apart from these properties.

Example DN in directory service:
  cn=Ldap\, (Test6*),ou=Users2,dc=myorg,dc=com
Example DN used in filter:
  cn=Ldap\5C, \28Test6\2A\29,ou=Users2,dc=myorg,dc=com

Testing:
 - Added a custom cluster unti test
 - Tested the behaviour manually with OpenLDAP and Active Directory

Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
---
M be/src/util/ldap-search-bind.cc
M be/src/util/ldap-search-bind.h
M fe/src/test/java/org/apache/impala/customcluster/LdapSearchBindImpalaShellTest.java
M fe/src/test/java/org/apache/impala/testutil/LdapUtil.java
M fe/src/test/resources/users.ldif
5 files changed, 78 insertions(+), 5 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/68/18068/5
-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 5
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Posted by "Tamas Mate (Code Review)" <ge...@cloudera.org>.
Tamas Mate has uploaded a new patch set (#3). ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................

IMPALA-11042: Escape special characters in LDAP User DN

The LDAP filter specification assigns special meaning to the following
characters: '*', '(', ')', '\', 'NUL'. These 5 characters should be
escaped with the backslas escape character, followed by the two
character ASCII hexadecimal representation of the character.  When the
DN is used in a search filter these escape characters additional
escaping is required. In Impala the user DN can be used in group
searches and this commit adds additional escaping when necessary.

Example DN in directory service:
  cn=Ldap\, (Test6*),ou=Users2,dc=myorg,dc=com
Example DN used in filter:
  cn=Ldap\5C, \28Test6\2A\29,ou=Users2,dc=myorg,dc=com

Testing:
 - Added a custom cluster unti test
 - Tested the behaviour manually with OpenLDAP and Active Directory

Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
---
M be/src/util/ldap-search-bind.cc
M be/src/util/ldap-search-bind.h
M fe/src/test/java/org/apache/impala/customcluster/LdapSearchBindImpalaShellTest.java
M fe/src/test/java/org/apache/impala/testutil/LdapUtil.java
M fe/src/test/resources/users.ldif
5 files changed, 48 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/68/18068/3
-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 3
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Tamas Mate (Code Review)" <ge...@cloudera.org>.
Tamas Mate has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 6:

(1 comment)

Thanks for the review, fixed..

http://gerrit.cloudera.org:8080/#/c/18068/5/be/src/util/ldap-search-bind.h
File be/src/util/ldap-search-bind.h:

http://gerrit.cloudera.org:8080/#/c/18068/5/be/src/util/ldap-search-bind.h@65
PS5, Line 65: properties,
> typo
Fixed.



-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 6
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 16:06:53 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 7: Verified+1


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 7
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 23:34:34 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................

IMPALA-11042: Escape special characters in LDAP filters

The LDAP filter specification assigns special meaning to the following
characters: '*', '(', ')', '\', 'NUL'. These 5 characters should be
represented with their ASCII characters in LDAP filters. (RFC 4516)
Impala allows '{0}' and '{1}' notations, these patterns will be replaced
dynamically during runtime, the '{0}' is replaced with the login
username, while '{1}' is replaced with the DN of the login user. This DN
is obtained through an LDAP Search.

This commit handles the escaping of the dynamically obtained properties
(username/DN) in LDAP filters according to RFC-4516. Impala should be
configured with a properly escaped filters apart from these properties.

Example DN in directory service:
  cn=Ldap\, (Test6*),ou=Users2,dc=myorg,dc=com
Example DN used in filter:
  cn=Ldap\5C, \28Test6\2A\29,ou=Users2,dc=myorg,dc=com

Testing:
 - Added a custom cluster unti test
 - Tested the behaviour manually with OpenLDAP and Active Directory

Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Reviewed-on: http://gerrit.cloudera.org:8080/18068
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M be/src/util/ldap-search-bind.cc
M be/src/util/ldap-search-bind.h
M fe/src/test/java/org/apache/impala/customcluster/LdapSearchBindImpalaShellTest.java
M fe/src/test/java/org/apache/impala/testutil/LdapUtil.java
M fe/src/test/resources/users.ldif
5 files changed, 78 insertions(+), 5 deletions(-)

Approvals:
  Impala Public Jenkins: Looks good to me, approved; Verified

-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 8
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 5:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/9888/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 5
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 15:36:44 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP filters

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP filters
......................................................................


Patch Set 6:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/9889/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 6
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Reviewer: Tamas Mate <tm...@cloudera.com>
Gerrit-Comment-Date: Tue, 07 Dec 2021 16:28:16 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................


Patch Set 1: Verified+1


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 1
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Comment-Date: Mon, 06 Dec 2021 14:30:49 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11042: Escape special characters in LDAP User DN

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18068 )

Change subject: IMPALA-11042: Escape special characters in LDAP User DN
......................................................................


Patch Set 1:

Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/7692/ DRY_RUN=true


-- 
To view, visit http://gerrit.cloudera.org:8080/18068
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic82e8fc0ff8bbe687632db177385f467dd200dbb
Gerrit-Change-Number: 18068
Gerrit-PatchSet: 1
Gerrit-Owner: Tamas Mate <tm...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Laszlo Gaal <la...@cloudera.com>
Gerrit-Comment-Date: Mon, 06 Dec 2021 08:15:38 +0000
Gerrit-HasComments: No