[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/8761 ) Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. Patch Set 2: Verified+1 -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 2 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Dan Hecht Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Michael Ho Gerrit-Reviewer: Sailesh Mukil Gerrit-Comment-Date: Tue, 05 Dec 2017 23:24:06 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/8761 ) Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set In Impala, we have FLAGS_principal and FLAGS_be_principal flags. If only FLAGS_principal is set, we use it as both the internal and external principals. If both FLAGS_principal and FLAGS_be_principal are set, we use FLAGS_be_principal as the internal principal and FLAGS_principal as the external principal. However, in Kudu, they only source the internal principal from FLAGS_principal and aren't aware of a flag called FLAGS_be_principal. So as of the time IMPALA-5129 went in, if FLAGS_be_principal is explicitly set to something different from FLAGS_principal, we would be using the external principal as the internal principal, which is incorrect. This is fixed on the Kudu side by the following commit: https://github.com/apache/kudu/commit/d42c2916467b83347f064ddea59f7a65202f7247 This is now cherry-picked to Impala and we now use the new API to fix this problem. Testing: Made the MiniKdc explicitly set FLAGS_principal and FLAGS_be_principal. Confirmed that the tests fail without this patch and with FLAGS_be_principal set. Change-Id: If5af4398467857da09878075439b6612a04d7a01 Reviewed-on: http://gerrit.cloudera.org:8080/8761 Reviewed-by: Dan Hecht Reviewed-by: Michael Ho Tested-by: Impala Public Jenkins --- M be/src/rpc/authentication.cc M be/src/testutil/mini-kdc-wrapper.cc 2 files changed, 9 insertions(+), 3 deletions(-) Approvals: Dan Hecht: Looks good to me, but someone else must approve Michael Ho: Looks good to me, approved Impala Public Jenkins: Verified -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 3 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Dan Hecht Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Michael Ho Gerrit-Reviewer: Sailesh Mukil
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/8761 ) Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. Patch Set 2: Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/1572/ -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 2 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Dan Hecht Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Michael Ho Gerrit-Reviewer: Sailesh Mukil Gerrit-Comment-Date: Tue, 05 Dec 2017 19:48:59 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Michael Ho has posted comments on this change. ( http://gerrit.cloudera.org:8080/8761 ) Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. Patch Set 2: Code-Review+2 -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 2 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Dan Hecht Gerrit-Reviewer: Michael Ho Gerrit-Reviewer: Sailesh Mukil Gerrit-Comment-Date: Tue, 05 Dec 2017 19:41:07 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Dan Hecht has posted comments on this change. ( http://gerrit.cloudera.org:8080/8761 ) Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. Patch Set 2: Code-Review+1 Michael, please take a look as well. -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 2 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Dan Hecht Gerrit-Reviewer: Sailesh Mukil Gerrit-Comment-Date: Tue, 05 Dec 2017 19:03:13 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Sailesh Mukil has posted comments on this change. ( http://gerrit.cloudera.org:8080/8761 ) Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. Patch Set 2: (1 comment) http://gerrit.cloudera.org:8080/#/c/8761/1//COMMIT_MSG Commit Message: http://gerrit.cloudera.org:8080/#/c/8761/1//COMMIT_MSG@31 PS1, Line 31: FLAGS_be_principal. Confirmed that the tests fail without this > just to be sure, did you verify that the new test fails with the old code? Yes, I just updated the commit message to reflect that as well. -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 2 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Dan Hecht Gerrit-Reviewer: Sailesh Mukil Gerrit-Comment-Date: Tue, 05 Dec 2017 18:54:30 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Hello Dan Hecht, I'd like you to reexamine a change. Please visit http://gerrit.cloudera.org:8080/8761 to look at the new patch set (#2). Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set In Impala, we have FLAGS_principal and FLAGS_be_principal flags. If only FLAGS_principal is set, we use it as both the internal and external principals. If both FLAGS_principal and FLAGS_be_principal are set, we use FLAGS_be_principal as the internal principal and FLAGS_principal as the external principal. However, in Kudu, they only source the internal principal from FLAGS_principal and aren't aware of a flag called FLAGS_be_principal. So as of the time IMPALA-5129 went in, if FLAGS_be_principal is explicitly set to something different from FLAGS_principal, we would be using the external principal as the internal principal, which is incorrect. This is fixed on the Kudu side by the following commit: https://github.com/apache/kudu/commit/d42c2916467b83347f064ddea59f7a65202f7247 This is now cherry-picked to Impala and we now use the new API to fix this problem. Testing: Made the MiniKdc explicitly set FLAGS_principal and FLAGS_be_principal. Confirmed that the tests fail without this patch and with FLAGS_be_principal set. Change-Id: If5af4398467857da09878075439b6612a04d7a01 --- M be/src/rpc/authentication.cc M be/src/testutil/mini-kdc-wrapper.cc 2 files changed, 9 insertions(+), 3 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/61/8761/2 -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 2 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Dan Hecht Gerrit-Reviewer: Sailesh Mukil
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Dan Hecht has posted comments on this change. ( http://gerrit.cloudera.org:8080/8761 ) Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. Patch Set 1: Code-Review+1 (1 comment) http://gerrit.cloudera.org:8080/#/c/8761/1//COMMIT_MSG Commit Message: http://gerrit.cloudera.org:8080/#/c/8761/1//COMMIT_MSG@31 PS1, Line 31: FLAGS_be_principal. just to be sure, did you verify that the new test fails with the old code? -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 1 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Dan Hecht Gerrit-Reviewer: Sailesh Mukil Gerrit-Comment-Date: Tue, 05 Dec 2017 17:53:33 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Sailesh Mukil has posted comments on this change. ( http://gerrit.cloudera.org:8080/8761 ) Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. Patch Set 1: This depends on an API change from the following cherry-pick from Kudu: https://gerrit.cloudera.org/#/c/8760/ -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 1 Gerrit-Owner: Sailesh Mukil Gerrit-Reviewer: Sailesh Mukil Gerrit-Comment-Date: Tue, 05 Dec 2017 06:37:34 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS be principal is set
Sailesh Mukil has uploaded this change for review. ( http://gerrit.cloudera.org:8080/8761 Change subject: IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set .. IMPALA-6256: Incorrect principal will be used for internal connections if FLAGS_be_principal is set In Impala, we have FLAGS_principal and FLAGS_be_principal flags. If only FLAGS_principal is set, we use it as both the internal and external principals. If both FLAGS_principal and FLAGS_be_principal are set, we use FLAGS_be_principal as the internal principal and FLAGS_principal as the external principal. However, in Kudu, they only source the internal principal from FLAGS_principal and aren't aware of a flag called FLAGS_be_principal. So as of the time IMPALA-5129 went in, if FLAGS_be_principal is explicitly set to something different from FLAGS_principal, we would be using the external principal as the internal principal, which is incorrect. This is fixed on the Kudu side by the following commit: https://github.com/apache/kudu/commit/d42c2916467b83347f064ddea59f7a65202f7247 This is now cherry-picked to Impala and we now use the new API to fix this problem. Testing: Made the MiniKdc explicitly set FLAGS_principal and FLAGS_be_principal. Change-Id: If5af4398467857da09878075439b6612a04d7a01 --- M be/src/rpc/authentication.cc M be/src/testutil/mini-kdc-wrapper.cc 2 files changed, 9 insertions(+), 3 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/61/8761/1 -- To view, visit http://gerrit.cloudera.org:8080/8761 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: If5af4398467857da09878075439b6612a04d7a01 Gerrit-Change-Number: 8761 Gerrit-PatchSet: 1 Gerrit-Owner: Sailesh Mukil
