Sharang Gupta created ZOOKEEPER-5113:
----------------------------------------
Summary: Audit log keys, mntr peer_state and admin zabstate are
lower-cased with the JVM default locale
Key: ZOOKEEPER-5113
URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5113
Project: ZooKeeper
Issue Type: Bug
Components: server
Affects Versions: 3.9.6
Reporter: Sharang Gupta
Several machine-read strings in zookeeper-server are produced with
{{String.toLowerCase()}} without a {{Locale}}, so they follow the JVM default
locale. Under a Turkish default locale ({{tr-TR}}; {{-Duser.language=tr
-Duser.country=TR}} reproduces it anywhere) an uppercase {{I}} becomes a
dotless {{ı}} (U+0131):
# {{audit/AuditEvent.java}} (lines 47, 52, 87): the {{logEntries}} keys come
from {{FieldName.name().toLowerCase()}} and the result from
{{Result.name().toLowerCase()}}, so the documented tab-separated audit log
(zookeeperAuditLogs.md) becomes
{code}
sessıon=0x100001 user=alice ıp=10.0.0.7 operatıon=create
znode=/app/config znode_type=persistent acl=... result=success
{code}
(keys {{sessıon}}, {{ıp}}, {{operatıon}}; {{Result.INVOKED}} ->
{{result=ınvoked}}). Reproduced against zookeeper 3.9.6 through the public
{{ZKAuditProvider.log(...)}} with the default {{Slf4jAuditLogger}} and
{{zookeeper.audit.enable=true}}. Log parsers / SIEM rules keyed on
{{session=}}, {{ip=}}, {{operation=}} silently stop matching.
# {{audit/AuditHelper.java}} (line 185): the {{znode_type}} value
{{CreateMode...toString().toLowerCase()}} ({{PERSISTENT_SEQUENTIAL}},
{{CONTAINER}}, {{PERSISTENT_WITH_TTL}} -> {{contaıner}}, ...).
# {{server/admin/Commands.java}}: the {{zabstate}} value
{{ZabState.name().toLowerCase()}} ({{ELECTION}} / {{DISCOVERY}} /
{{SYNCHRONIZATION}} -> {{electıon}}, {{dıscovery}}, {{synchronızatıon}}) in the
admin {{/commands/zabstate}} JSON.
# {{server/quorum/QuorumPeer.java}}: {{getDetailedPeerState()}} lower-cases
{{ServerState}} / {{ZabState}} / {{SyncMode}}, exposed as {{zk_peer_state}} by
the 4lw {{mntr}} command and the admin {{/commands/monitor}} endpoint
({{followıng}}, {{observıng}}, ...); and {{QuorumServer.getType}} switches on
{{s.trim().toLowerCase()}} for the {{peerType}} config value.
The code base already pins the locale for machine-read output
({{ZKHostnameVerifier}} uses {{toLowerCase(Locale.ROOT)}},
{{PrepRequestProcessor}} uses {{String.format(Locale.ENGLISH, "%010d", ...)}}
for sequential znode names). Fix: {{toLowerCase(Locale.ROOT)}} at those sites,
plus a unit test in {{AuditEventTest}} that builds an {{AuditEvent}} under a
{{tr-TR}} default locale and asserts the emitted keys. PR to follow.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
