Brad Schoening created CASSANDRA-21756:
------------------------------------------
Summary: Native transport has no authentication timeout;
unauthenticated connections persist indefinitely
Key: CASSANDRA-21756
URL: https://issues.apache.org/jira/browse/CASSANDRA-21756
Project: Apache Cassandra
Issue Type: Bug
Reporter: Brad Schoening
The native protocol has no authentication timeout. A client can open a
connection, send
STARTUP, and then never authenticate — the connection is held open
indefinitely, counts
against connection limits, and remains visible in {{nodetool clientstats}} /
{{system_views.clients}} the whole time.
There is no bound on the time a connection may remain in the unauthenticated
state. The only lifetime guard on the native transport is a general, all-idle
timeout
({{{}native_transport_idle_timeout{}}}), which:
* defaults to {{0ms}} (disabled), so out of the box nothing ever closes the
connection; and
* even when enabled, is an all-idle timer ({{{}IdleStateHandler(false, 0, 0,
idleTimeout, …){}}}),
not an authentication timeout. It reacts to inactivity, not to auth state, so a
client that
periodically sends a byte to stay non-idle is never closed regardless of
whether it has
authenticated.
It compounds with CASSANDRA-21755, where the pre-auth connection also retains a
client-supplied STARTUP options map (up to native_transport_max_frame_size)
that is held for the life of the connection.
h3. Steps to reproduce
# Open a native protocol connection and send a STARTUP message.
# Do not send AUTH / do not complete authentication. Keep the socket open.
# Observe that the connection remains established indefinitely and continues
to appear in operator views.
{noformat}
% nodetool clientstats --all
Address SSL Cipher Protocol Version User Keyspace Requests
Driver-Name Driver-Version
/127.0.0.1:51690 false undefined undefined 3 anonymous 1
undefined undefined
{noformat}
The connection above never authenticated ({{{}anonymous{}}}) yet persists.
h3. Actual behaviour
Unauthenticated connections are never timed out. With default configuration
({{{}native_transport_idle_timeout = 0{}}}) they live until the client
disconnects or the server restarts.
Expected behavior is that a connection that has not completed authentication
within a bounded period should be closed by the server, independent of
idle/active state.
h3. Proposed fix
Introduce an authentication timeout (e.g.
{{{}native_transport_auth_timeout{}}}, default on the order of 10s) that closes
any connection still unauthenticated after the deadline. This is
independent of {{native_transport_idle_timeout}} and should fire even on an
active-but- unauthenticated connection.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
