[
https://issues.apache.org/jira/browse/CASSANDRA-21756?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rishabh Saraswat updated CASSANDRA-21756:
-----------------------------------------
Description:
This change introduces a configurable timeout for native transport connections
to reach the {{READY}} state.
The timeout covers protocol startup and authentication and is configurable
independently of the existing idle timeout.
was:
The native protocol has no authentication timeout. A client can open a
connection, send
STARTUP, and then never authenticate — the connection is held open
indefinitely, counts
against connection limits, and remains visible in {{nodetool clientstats}} /
{{system_views.clients}} the whole time.
There is no bound on the time a connection may remain in the unauthenticated
state. The only lifetime guard on the native transport is a general, all-idle
timeout ({{{}native_transport_idle_timeout{}}}), which:
* defaults to {{0ms}} (disabled), so out of the box nothing ever closes the
connection; and
* even when enabled, is an all-idle timer ({{{}IdleStateHandler(false, 0, 0,
idleTimeout, …){}}}),
not an authentication timeout. It reacts to inactivity, not to auth state, so a
client that
periodically sends a byte to stay non-idle is never closed regardless of
whether it has
authenticated.
It compounds with CASSANDRA-21755, where the pre-auth connection also retains a
client-supplied STARTUP options map (up to native_transport_max_frame_size)
that is held for the life of the connection.
h3. Steps to reproduce
# Open a native protocol connection and send a STARTUP message.
# Do not send AUTH / do not complete authentication. Keep the socket open.
# Observe that the connection remains established indefinitely and continues
to appear in operator views.
{noformat}
% nodetool clientstats --all
Address SSL Cipher Protocol Version User Keyspace Requests
Driver-Name Driver-Version
/127.0.0.1:51690 false undefined undefined 3 anonymous 1
undefined undefined
{noformat}
The connection above never authenticated ({{{}anonymous{}}}) yet persists.
h3. Actual behaviour
Unauthenticated connections are never timed out. With default configuration
({{{}native_transport_idle_timeout = 0{}}}) they live until the client
disconnects or the server restarts.
Expected behavior is that a connection that has not completed authentication
within a bounded period should be closed by the server, independent of
idle/active state.
h3. Proposed fix
Introduce an authentication timeout (e.g.
{{{}native_transport_auth_timeout{}}}, default on the order of 10s) that closes
any connection still unauthenticated after the deadline. This is independent of
{{native_transport_idle_timeout}} and should fire even on an active-but-
unauthenticated connection.
> Native transport has no authentication timeout
> ----------------------------------------------
>
> Key: CASSANDRA-21756
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21756
> Project: Apache Cassandra
> Issue Type: Bug
> Components: Feature/Authentication
> Reporter: Brad Schoening
> Assignee: Rishabh Saraswat
> Priority: Normal
> Time Spent: 6.5h
> Remaining Estimate: 0h
>
> This change introduces a configurable timeout for native transport
> connections to reach the {{READY}} state.
> The timeout covers protocol startup and authentication and is configurable
> independently of the existing idle timeout.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
