[
https://issues.apache.org/jira/browse/DRILL-4335?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15957896#comment-15957896
]
ASF GitHub Bot commented on DRILL-4335:
---------------------------------------
Github user sudheeshkatkam commented on a diff in the pull request:
https://github.com/apache/drill/pull/773#discussion_r109957575
--- Diff:
exec/java-exec/src/main/java/org/apache/drill/exec/rpc/security/AuthenticationOutcomeListener.java
---
@@ -243,4 +247,43 @@ public SaslMessage process(SaslChallengeContext
context) throws Exception {
}
}
}
+
+ private static void handleSuccess(SaslChallengeContext context) throws
SaslException {
+ final ClientConnection connection = context.connection;
+ final SaslClient saslClient = connection.getSaslClient();
+
+ if (connection.isEncrypted()) {
+ try {
+ // Check if connection was marked for being secure then verify for
negotiated QOP value for
+ // correctness.
+ final String negotiatedQOP =
saslClient.getNegotiatedProperty(Sasl.QOP).toString();
+ assert
(negotiatedQOP.equals(SaslProperties.QualityOfProtection.PRIVACY.getSaslQop()));
+
+ // Update the rawWrapChunkSize with the negotiated buffer size
since we cannot call encode with more than
+ // negotiated size of buffer.
+ final int negotiatedRawSendSize = Integer.parseInt(saslClient
+
.getNegotiatedProperty(SaslProperties.WRAP_RAW_SEND_SIZE)
+ .toString());
+ if(negotiatedRawSendSize <= 0) {
+ throw new SaslException(String.format("Negotiated rawSendSize:
%d is invalid. Please check the configured " +
+ "value of sasl.encryption.encodesize. It might be configured
to a very small value.",
+ negotiatedRawSendSize));
+ }
+ connection.setRawWrapSendSize(negotiatedRawSendSize);
+ connection.addSecurityHandlers();
+ } catch (Exception e) {
+ throw new SaslException(String.format("Unexpected failure while
retrieving negotiated property values (%s)",
+ e.getMessage()), e);
+ }
+ } else {
+ // Encryption is not required hence we don't need to hold on to
saslClient object.
+ if (saslClient != null) {
--- End diff --
Although `dispose` is documented to be idempotent, should `dispose` be
called only once (at connection closure) to keep this logic in one place?
> Apache Drill should support network encryption
> ----------------------------------------------
>
> Key: DRILL-4335
> URL: https://issues.apache.org/jira/browse/DRILL-4335
> Project: Apache Drill
> Issue Type: New Feature
> Reporter: Keys Botzum
> Assignee: Sorabh Hamirwasia
> Labels: security
> Attachments: ApacheDrillEncryptionUsingSASLDesign.pdf
>
>
> This is clearly related to Drill-291 but wanted to make explicit that this
> needs to include network level encryption and not just authentication. This
> is particularly important for the client connection to Drill which will often
> be sending passwords in the clear until there is encryption.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
