Attila Bukor has posted comments on this change. ( 
http://gerrit.cloudera.org:8080/24511 )

Change subject: KUDU-3787 Make tls_debug support Kerberos
......................................................................


Patch Set 1:

(3 comments)

http://gerrit.cloudera.org:8080/#/c/24511/1//COMMIT_MSG
Commit Message:

http://gerrit.cloudera.org:8080/#/c/24511/1//COMMIT_MSG@9
PS1, Line 9: d4ec371 introduced a new tool to debug TLS connections (diagnose
           : tls_debug), but unfortunately, it didn't work with Kerberos-enabled
           : servers, which makes it less practical in real-life environments.
> Can you add a test scenario to demonstrate this changelist is more fortunat
Done


http://gerrit.cloudera.org:8080/#/c/24511/1/src/kudu/rpc/client_negotiation.cc
File src/kudu/rpc/client_negotiation.cc:

http://gerrit.cloudera.org:8080/#/c/24511/1/src/kudu/rpc/client_negotiation.cc@225
PS1, Line 225:   if (tls_only_) {
> Question/observation: If `tls_only_` is true but TLS was not negotiated (e.
Fair point, renamed it to skip_authn() to avoid confusion.


http://gerrit.cloudera.org:8080/#/c/24511/1/src/kudu/rpc/client_negotiation.cc@221
PS1, Line 221:   // Diagnostic shortcut: when the caller only wants to observe 
the negotiated
             :   // TLS parameters (e.g. `kudu diagnose tls_debug`), skip 
SASL/token/JWT
             :   // authentication. The server will log an aborted negotiation 
when we
             :   // disconnect, but the TLS-level info on the socket is fully 
populated.
             :   if (tls_only_) {
             :     TRACE("Stopping negotiation after TLS handshake (tls_only 
mode)");
             :     return Status::OK();
             :   }
> Is this necessary only for the diagnostic tool?  This doesn't smell good.
It should never be up to the client to enforce security. Anyone can build a 
modified client that has this exact change and if they're able to bypass the 
authentication on the server side using it, it's a problem with the server, not 
with the client.

Nevertheless, I added new tests to verify this works as expected and can't be 
used to gain access to a server without a valid ticket.



--
To view, visit http://gerrit.cloudera.org:8080/24511
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: Ic6c6c9ac1cebeab8cb48bd22aea852c93c0252a4
Gerrit-Change-Number: 24511
Gerrit-PatchSet: 1
Gerrit-Owner: Attila Bukor <[email protected]>
Gerrit-Reviewer: Alexey Serbin <[email protected]>
Gerrit-Reviewer: Attila Bukor <[email protected]>
Gerrit-Reviewer: Jason Fehr <[email protected]>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <[email protected]>
Gerrit-Comment-Date: Fri, 26 Jun 2026 09:26:10 +0000
Gerrit-HasComments: Yes

Reply via email to