[ https://issues.apache.org/jira/browse/MESOS-6621?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15688513#comment-15688513 ]
Joseph Wu commented on MESOS-6621: ---------------------------------- {code:title=0.28.3} commit 95ee5a583eef1e60ba743900d49629b2286dbc97 Author: Joseph Wu <josep...@apache.org> Date: Tue Nov 22 17:08:42 2016 -0800 Added MESOS-6621 to CHANGELOG for 0.28.3. commit 4c56f51f5ea8b633cee12cbc212f29a760f99583 Author: Joseph Wu <jos...@mesosphere.io> Date: Tue Nov 22 17:07:40 2016 -0800 Fix SSL downgrade pathway for temporary/persistent sockets. {code} {code:title=1.0.3} commit c82a283d87af557128a96ec02f2ef9a00f00d4df Author: Joseph Wu <josep...@apache.org> Date: Tue Nov 22 17:06:59 2016 -0800 Added MESOS-6621 to CHANGELOG for 1.0.3. commit 3c5b5e054c0328dc500d4940d527d40bb1526b65 Author: Joseph Wu <jos...@mesosphere.io> Date: Tue Nov 22 17:03:02 2016 -0800 Fix SSL downgrade pathway for temporary/persistent sockets. {code} {code:title=1.1.1} commit de3a1b58a105493e45e87299bcaf3a4279939a02 Author: Joseph Wu <josep...@apache.org> Date: Tue Nov 22 16:58:56 2016 -0800 Added MESOS-6621 to CHANGELOG for 1.1.1. commit 1d84b0b42d0cd067c034091a4897e817fc2f86d0 Author: Joseph Wu <jos...@mesosphere.io> Date: Tue Nov 22 17:00:01 2016 -0800 Fix SSL downgrade pathway for temporary/persistent sockets. {code} > SSL downgrade path will CHECK-fail when using both temporary and persistent > sockets > ----------------------------------------------------------------------------------- > > Key: MESOS-6621 > URL: https://issues.apache.org/jira/browse/MESOS-6621 > Project: Mesos > Issue Type: Bug > Components: libprocess > Affects Versions: 0.28.2, 1.0.2, 1.1.0 > Environment: SSL with downgrade enabled > Reporter: Joseph Wu > Assignee: Joseph Wu > Priority: Blocker > Labels: mesosphere > Fix For: 1.2.0 > > Attachments: test.patch, test_linkee.cpp > > > The code path for downgrading sockets from SSL to non-SSL includes this code: > {code} > // If this address is a temporary link. > if (temps.count(addresses[to_fd]) > 0) { > temps[addresses[to_fd]] = to_fd; > // No need to erase as we're changing the value, not the key. > } > // If this address is a persistent link. > if (persists.count(addresses[to_fd]) > 0) { > persists[addresses[to_fd]] = to_fd; > // No need to erase as we're changing the value, not the key. > } > {code} > https://github.com/apache/mesos/blob/1.1.x/3rdparty/libprocess/src/process.cpp#L2311-L2321 > It is possible for libprocess to hold both temporary and persistent sockets > to the same address. This can happen when a message is first sent > ({{ProcessBase::send}}), and then a link is established > ({{ProcessBase::link}}). When the target of the message/link is a non-SSL > socket, both temporary and persistent sockets go through the downgrade path. > If a temporary socket is present while a persistent socket is being created, > the above code will remap both temporary and persistent sockets to the same > address (it should only remap the persistent socket). This leads to some > CHECK failures if those sockets are used or closed later: > * {code} > bool persist = persists.count(address) > 0; > bool temp = temps.count(address) > 0; > if (persist || temp) { > int s = persist ? persists[address] : temps[address]; > CHECK(sockets.count(s) > 0); > socket = sockets.at(s); > {code} > https://github.com/apache/mesos/blob/1.1.x/3rdparty/libprocess/src/process.cpp#L1942 > * {code} > if (dispose.count(s) > 0) { > // This is either a temporary socket we created or it's a > // socket that we were receiving data from and possibly > // sending HTTP responses back on. Clean up either way. > if (addresses.count(s) > 0) { > const Address& address = addresses[s]; > CHECK(temps.count(address) > 0 && temps[address] == s); > temps.erase(address); > {code} > https://github.com/apache/mesos/blob/1.1.x/3rdparty/libprocess/src/process.cpp#L2044 -- This message was sent by Atlassian JIRA (v6.3.4#6332)