[
https://issues.apache.org/jira/browse/CASSANDRA-21756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18130790#comment-18130790
]
Stefan Miklosovic commented on CASSANDRA-21756:
-----------------------------------------------
Added few comments, the change makes sense but I would like to see you writing
to DEV ML saying you are going to do this. This is technically introducing a
new parameter to cassandra.yaml and modifies the behavior a bit so it warrants
dev mailing list interaction.
> Native transport has no authentication timeout
> ----------------------------------------------
>
> Key: CASSANDRA-21756
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21756
> Project: Apache Cassandra
> Issue Type: Bug
> Components: Feature/Authentication
> Reporter: Brad Schoening
> Assignee: Rishabh Saraswat
> Priority: Normal
> Time Spent: 5h
> Remaining Estimate: 0h
>
> The native protocol has no authentication timeout. A client can open a
> connection, send
> STARTUP, and then never authenticate — the connection is held open
> indefinitely, counts
> against connection limits, and remains visible in {{nodetool clientstats}} /
> {{system_views.clients}} the whole time.
> There is no bound on the time a connection may remain in the unauthenticated
> state. The only lifetime guard on the native transport is a general, all-idle
> timeout ({{{}native_transport_idle_timeout{}}}), which:
> * defaults to {{0ms}} (disabled), so out of the box nothing ever closes the
> connection; and
> * even when enabled, is an all-idle timer ({{{}IdleStateHandler(false, 0, 0,
> idleTimeout, …){}}}),
> not an authentication timeout. It reacts to inactivity, not to auth state, so
> a client that
> periodically sends a byte to stay non-idle is never closed regardless of
> whether it has
> authenticated.
> It compounds with CASSANDRA-21755, where the pre-auth connection also retains
> a client-supplied STARTUP options map (up to native_transport_max_frame_size)
> that is held for the life of the connection.
> h3. Steps to reproduce
> # Open a native protocol connection and send a STARTUP message.
> # Do not send AUTH / do not complete authentication. Keep the socket open.
> # Observe that the connection remains established indefinitely and continues
> to appear in operator views.
> {noformat}
> % nodetool clientstats --all
> Address SSL Cipher Protocol Version User Keyspace
> Requests Driver-Name Driver-Version
> /127.0.0.1:51690 false undefined undefined 3 anonymous 1
> undefined undefined
> {noformat}
> The connection above never authenticated ({{{}anonymous{}}}) yet persists.
> h3. Actual behaviour
> Unauthenticated connections are never timed out. With default configuration
> ({{{}native_transport_idle_timeout = 0{}}}) they live until the client
> disconnects or the server restarts.
> Expected behavior is that a connection that has not completed authentication
> within a bounded period should be closed by the server, independent of
> idle/active state.
> h3. Proposed fix
> Introduce an authentication timeout (e.g.
> {{{}native_transport_auth_timeout{}}}, default on the order of 10s) that
> closes any connection still unauthenticated after the deadline. This is
> independent of {{native_transport_idle_timeout}} and should fire even on an
> active-but- unauthenticated connection.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
