-
Notifications
You must be signed in to change notification settings - Fork 7.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ZOOKEEPER-3905: Race condition causes sessions to be created for clients even though their certificate authentication has failed (3.6) #1427
Conversation
…nts even though their certificate authentication has failed Netty channel doesn't get closed if authentication fails after a successful SSL handshake. We need a custom authentication provider in order to trigger this, because the default implementation does the same check as for the SSL handshake. Hence it never fails. Unit test added to make sure client is not able to connect. Target branches: master, 3.6, 3.5 (will create separate PR for 3.5) Author: Andor Molnar <andor@apache.org> Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org> Closes apache#1422 from anmolnar/ZOOKEEPER-3905
4fbbb56
to
43ec688
Compare
@eolivelli @symat PTAL. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, thanks for the quick backport!
(according to Jenkins there is a small checkstyle error.)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Can't merge it now.
I will do tomorrow.
We should check CI as well
Wrong importorder: |
@@ -22,7 +22,9 @@ | |||
|
|||
package org.apache.zookeeper.test; | |||
|
|||
import java.io.IOException; | |||
import static org.junit.Assert.assertTrue; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
checkstyle don't like the order for this... yikes.
I guess Assert.fail should be before? Not sure why.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oh, nevermind, static imports should be first, that's the problem.
Thanks @nkalmar . Just fixed it. |
@eolivelli all good now. |
@eolivelli @symat @nkalmar Please merge. |
I'm merging it |
…nts even though their certificate authentication has failed (3.6) Backport to branch-3.6 Netty channel doesn't get closed if authentication fails after a successful SSL handshake. We need a custom authentication provider in order to trigger this, because the default implementation does the same check as for the SSL handshake. Hence it never fails. Unit test added to make sure client is not able to connect. Author: Andor Molnar <andor@apache.org> Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, Norbert Kalmar <nkalmar@apache.org> Closes #1427 from anmolnar/ZOOKEEPER-3905_36
…nts even though their certificate authentication has failed (3.5) Backport to branch-3.5 Netty channel doesn't get closed if authentication fails after a successful SSL handshake. We need a custom authentication provider in order to trigger this, because the default implementation does the same check as for the SSL handshake. Hence it never fails. Unit test added to make sure client is not able to connect. Author: Andor Molnar <andor@apache.org> Reviewers: Enrico Olivelli <eolivelli@apache.org>, Mate Szalay-Beko <symat@apache.org>, Norbert Kalmar <nkalmar@apache.org> Closes #1427 from anmolnar/ZOOKEEPER-3905_36 (cherry picked from commit 8bcaf7b) Signed-off-by: Mate Szalay-Beko <symat@apache.org>
Thanks @anmolnar! |
Great, thanks @symat ! |
Backport to branch-3.6
Netty channel doesn't get closed if authentication fails after a successful SSL handshake. We need a custom authentication provider in order to trigger this, because the default implementation does the same check as for the SSL handshake. Hence it never fails.
Unit test added to make sure client is not able to connect.