Attila Bukor has posted comments on this change. ( http://gerrit.cloudera.org:8080/24511 )
Change subject: KUDU-3787 Make tls_debug support Kerberos ...................................................................... Patch Set 3: (2 comments) http://gerrit.cloudera.org:8080/#/c/24511/2/src/kudu/integration-tests/security-itest.cc File src/kudu/integration-tests/security-itest.cc: http://gerrit.cloudera.org:8080/#/c/24511/2/src/kudu/integration-tests/security-itest.cc@496 PS2, Line 496: here is: > Refused by the server side, right? But what if a client talks to a malicio Yea I guess you would need to deliberately set up a scenario that fails to run normally, and then, if this otherwise non-functional client connected to a rogue server, it would work without authn. http://gerrit.cloudera.org:8080/#/c/24511/1/src/kudu/rpc/client_negotiation.cc File src/kudu/rpc/client_negotiation.cc: http://gerrit.cloudera.org:8080/#/c/24511/1/src/kudu/rpc/client_negotiation.cc@221 PS1, Line 221: // Diagnostic shortcut: when the caller only wants to observe the negotiated : // TLS parameters (e.g. `kudu diagnose tls_debug`), skip SASL/token/JWT : // authentication. The server will log an aborted negotiation when we : // disconnect, but the TLS-level info on the socket is fully populated. : if (skip_authn_) { : TRACE("Stopping negotiation before authentication (skip_authn mode)"); : return Status::OK(); : } > The point not about the client to enforce security. The point was about a Right - I don't see how that would be a valid use-case for anything other than probing TLS connections like tls_debug does. You wouldn't be able to talk to a legitimate server this way, so there's no reason to set it up like this unless you deliberately wanted to talk to a rogue server. -- To view, visit http://gerrit.cloudera.org:8080/24511 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ic6c6c9ac1cebeab8cb48bd22aea852c93c0252a4 Gerrit-Change-Number: 24511 Gerrit-PatchSet: 3 Gerrit-Owner: Attila Bukor <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Attila Bukor <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Reviewer: Marton Greber <[email protected]> Gerrit-Comment-Date: Fri, 26 Jun 2026 16:30:24 +0000 Gerrit-HasComments: Yes
