Attila Bukor has posted comments on this change. ( http://gerrit.cloudera.org:8080/24511 )
Change subject: KUDU-3787 Make tls_debug support Kerberos ...................................................................... Patch Set 1: (3 comments) http://gerrit.cloudera.org:8080/#/c/24511/1//COMMIT_MSG Commit Message: http://gerrit.cloudera.org:8080/#/c/24511/1//COMMIT_MSG@9 PS1, Line 9: d4ec371 introduced a new tool to debug TLS connections (diagnose : tls_debug), but unfortunately, it didn't work with Kerberos-enabled : servers, which makes it less practical in real-life environments. > Can you add a test scenario to demonstrate this changelist is more fortunat Done http://gerrit.cloudera.org:8080/#/c/24511/1/src/kudu/rpc/client_negotiation.cc File src/kudu/rpc/client_negotiation.cc: http://gerrit.cloudera.org:8080/#/c/24511/1/src/kudu/rpc/client_negotiation.cc@225 PS1, Line 225: if (tls_only_) { > Question/observation: If `tls_only_` is true but TLS was not negotiated (e. Fair point, renamed it to skip_authn() to avoid confusion. http://gerrit.cloudera.org:8080/#/c/24511/1/src/kudu/rpc/client_negotiation.cc@221 PS1, Line 221: // Diagnostic shortcut: when the caller only wants to observe the negotiated : // TLS parameters (e.g. `kudu diagnose tls_debug`), skip SASL/token/JWT : // authentication. The server will log an aborted negotiation when we : // disconnect, but the TLS-level info on the socket is fully populated. : if (tls_only_) { : TRACE("Stopping negotiation after TLS handshake (tls_only mode)"); : return Status::OK(); : } > Is this necessary only for the diagnostic tool? This doesn't smell good. It should never be up to the client to enforce security. Anyone can build a modified client that has this exact change and if they're able to bypass the authentication on the server side using it, it's a problem with the server, not with the client. Nevertheless, I added new tests to verify this works as expected and can't be used to gain access to a server without a valid ticket. -- To view, visit http://gerrit.cloudera.org:8080/24511 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ic6c6c9ac1cebeab8cb48bd22aea852c93c0252a4 Gerrit-Change-Number: 24511 Gerrit-PatchSet: 1 Gerrit-Owner: Attila Bukor <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Attila Bukor <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Reviewer: Marton Greber <[email protected]> Gerrit-Comment-Date: Fri, 26 Jun 2026 09:26:10 +0000 Gerrit-HasComments: Yes
