krishvishal opened a new pull request, #4778: URL: https://github.com/apache/iggy/pull/4778
## Which issue does this PR address? Relates to #4528. ## Rationale kafka-python 2.0.2 always sends `SaslHandshake` v0, and it was the latest kafka-python release for four and a half years. Sarama sends v0 by default up to 1.40.1, and aiokafka up to 0.12 sends it with `api_version="auto"`. Kafka 3.x brokers accept v0, so these clients work with SASL against Kafka. With SASL on, they failed to connect to the gateway. If v0 is not in `ApiVersions`, librdkafka gives up before its handshake, so the gateway already listed v0 there. But the gateway refused a v0 handshake. After a v0 handshake, the client sends the SASL token in a bare frame (KIP-152). The frame is a 4-byte length and the token, with no Kafka request header. The broker answers a valid PLAIN token with an empty token in the same kind of frame, which is four zero bytes. For any failure, the broker closes the connection, because this exchange has no field for an error code. kafka-python 2.0.2 and Sarama 1.40.1 wait for these four bytes. ## What changed? Before, the gateway answered `SaslHandshake` v0 with `UNSUPPORTED_VERSION` (35) and closed the connection. Now it accepts v0 and reads the next frame as the bare PLAIN token, with no request header and a cap of 4096 bytes. A valid token gets four zero bytes back, and the connection continues as signed in. A wrong, malformed or oversized token closes the connection without an answer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
