[
https://issues.apache.org/jira/browse/IMPALA-11195?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116668#comment-18116668
]
ASF subversion and git services commented on IMPALA-11195:
----------------------------------------------------------
Commit e1a2da732c6de5383002eb6960a825b2f73b053f in impala's branch
refs/heads/master from Csaba Ringhofer
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=e1a2da732 ]
IMPALA-15354: bump Thrift to 0.24.0 - C++ parts
Switching from 0.16.0-p7 to 0.24.0-p3 needed a few changes:
- Thrift changed the way it prints global output,
needing GlobalOutput() replaced with TOutput::instance()
- some struct sizes shrinked due to not generating virtual
destructors and thus omitting vtable pointers
- patches in TSslSocket were removed in native-toolchain,
moving the logic to Impala by passing SslContext to
Thrift
Removed TSslSocket patches:
https://github.com/cloudera/native-toolchain/blob/master/source/thrift/thrift-0.16.0-patches/0001-TLS-forward-compatibility.patch
https://github.com/cloudera/native-toolchain/blob/master/source/thrift/thrift-0.16.0-patches/0002-IMPALA-11195-Disable-SSL-renegotiations.patch
That area was changed in Thrift, so I decided to move the logic
to Impala instead of rebasing the patches.
With the change I saw common OOM kills during build - my guess is that
somehow the order changed, causing more overlap between ld.gold and
maven. Left 6 GB for maven, which leads to 11 instead of 12 parallel
linkers on a 64 GB machine.
Testing:
- the risky parts are the SSL changes, these are fairly covered
in BE and custom cluster tests
Change-Id: Ieea10df03996fef64ea25f51c9e5e4e47c8cefa1
Reviewed-on: http://gerrit.cloudera.org:8080/24814
Reviewed-by: Peter Rozsa <[email protected]>
Tested-by: Csaba Ringhofer <[email protected]>
> Disable SSL session renegotiation
> ---------------------------------
>
> Key: IMPALA-11195
> URL: https://issues.apache.org/jira/browse/IMPALA-11195
> Project: IMPALA
> Issue Type: Bug
> Components: Backend
> Reporter: Zoltán Borók-Nagy
> Assignee: Zoltán Borók-Nagy
> Priority: Major
> Fix For: Impala 4.3.0
>
>
> SSL renegotiations has had a couple of CVEs in the past. We should figure out
> how to disable it.
> Kudu disabled SSL renegotations in KUDU-1926, so we can do something similar.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
