ZooKeeper-trunk-jdk8 - Build # 552 - Still Failing

2016-04-03 Thread Apache Jenkins Server
See https://builds.apache.org/job/ZooKeeper-trunk-jdk8/552/

###
## LAST 60 LINES OF THE CONSOLE 
###
[...truncated 368717 lines...]
[junit] 2016-04-03 11:55:44,236 [myid:] - INFO  
[main:PrepRequestProcessor@965] - Shutting down
[junit] 2016-04-03 11:55:44,236 [myid:] - INFO  
[main:SyncRequestProcessor@191] - Shutting down
[junit] 2016-04-03 11:55:44,236 [myid:] - INFO  [ProcessThread(sid:0 
cport:11228)::PrepRequestProcessor@154] - PrepRequestProcessor exited loop!
[junit] 2016-04-03 11:55:44,236 [myid:] - INFO  
[SyncThread:0:SyncRequestProcessor@169] - SyncRequestProcessor exited!
[junit] 2016-04-03 11:55:44,237 [myid:] - INFO  
[main:FinalRequestProcessor@479] - shutdown of request processor complete
[junit] 2016-04-03 11:55:44,237 [myid:] - INFO  [main:MBeanRegistry@128] - 
Unregister MBean 
[org.apache.ZooKeeperService:name0=StandaloneServer_port11228,name1=InMemoryDataTree]
[junit] 2016-04-03 11:55:44,237 [myid:] - INFO  [main:MBeanRegistry@128] - 
Unregister MBean [org.apache.ZooKeeperService:name0=StandaloneServer_port11228]
[junit] 2016-04-03 11:55:44,238 [myid:] - INFO  
[main:FourLetterWordMain@85] - connecting to 127.0.0.1 11228
[junit] 2016-04-03 11:55:44,238 [myid:] - INFO  [main:JMXEnv@146] - 
ensureOnly:[]
[junit] 2016-04-03 11:55:44,258 [myid:] - INFO  [main:ClientBase@562] - 
fdcount after test is: 51 at start it was 51
[junit] 2016-04-03 11:55:44,259 [myid:] - INFO  [main:ZKTestCase$1@65] - 
SUCCEEDED testWatcherAutoResetWithLocal
[junit] 2016-04-03 11:55:44,259 [myid:] - INFO  [main:ZKTestCase$1@60] - 
FINISHED testWatcherAutoResetWithLocal
[junit] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 
31.062 sec, Thread: 1, Class: org.apache.zookeeper.test.WatcherTest
[junit] 2016-04-03 11:55:44,280 [myid:] - INFO  
[SessionTracker:SessionTrackerImpl@158] - SessionTrackerImpl exited loop!
[junit] 2016-04-03 11:55:44,280 [myid:] - INFO  
[SessionTracker:SessionTrackerImpl@158] - SessionTrackerImpl exited loop!
[junit] 2016-04-03 11:56:08,414 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@82] - Memory used 40379
[junit] 2016-04-03 11:56:08,414 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@87] - Number of threads 55
[junit] 2016-04-03 11:56:08,415 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@102] - FINISHED TEST METHOD 
testManyChildWatchersAutoReset
[junit] 2016-04-03 11:56:08,415 [myid:] - INFO  [main:ClientBase@537] - 
tearDown starting
[junit] 2016-04-03 11:56:08,416 [myid:] - INFO  [ProcessThread(sid:0 
cport:16611)::PrepRequestProcessor@647] - Processed session termination for 
sessionid: 0x101e56295da
[junit] 2016-04-03 11:56:08,423 [myid:] - INFO  [main:ZooKeeper@1110] - 
Session: 0x101e56295da closed
[junit] 2016-04-03 11:56:08,424 [myid:] - INFO  
[main-EventThread:ClientCnxn$EventThread@543] - EventThread shut down for 
session: 0x101e56295da
[junit] 2016-04-03 11:56:08,425 [myid:] - INFO  
[NIOWorkerThread-24:MBeanRegistry@128] - Unregister MBean 
[org.apache.ZooKeeperService:name0=StandaloneServer_port16611,name1=Connections,name2=127.0.0.1,name3=0x101e56295da]
[junit] 2016-04-03 11:56:08,425 [myid:] - INFO  
[NIOWorkerThread-24:NIOServerCnxn@607] - Closed socket connection for client 
/127.0.0.1:36512 which had sessionid 0x101e56295da
[junit] 2016-04-03 11:56:08,426 [myid:] - INFO  [ProcessThread(sid:0 
cport:16611)::PrepRequestProcessor@647] - Processed session termination for 
sessionid: 0x101e56295da0001
[junit] 2016-04-03 11:56:08,431 [myid:] - INFO  [main:ZooKeeper@1110] - 
Session: 0x101e56295da0001 closed
[junit] 2016-04-03 11:56:08,431 [myid:] - INFO  [main:ClientBase@507] - 
STOPPING server
[junit] 2016-04-03 11:56:08,431 [myid:] - INFO  
[NIOWorkerThread-26:MBeanRegistry@128] - Unregister MBean 
[org.apache.ZooKeeperService:name0=StandaloneServer_port16611,name1=Connections,name2=127.0.0.1,name3=0x101e56295da0001]
[junit] 2016-04-03 11:56:08,432 [myid:] - INFO  
[NIOWorkerThread-26:NIOServerCnxn@607] - Closed socket connection for client 
/127.0.0.1:36492 which had sessionid 0x101e56295da0001
[junit] 2016-04-03 11:56:08,431 [myid:] - INFO  
[main-EventThread:ClientCnxn$EventThread@543] - EventThread shut down for 
session: 0x101e56295da0001
[junit] 2016-04-03 11:56:08,447 [myid:] - INFO  
[ConnnectionExpirer:NIOServerCnxnFactory$ConnectionExpirerThread@583] - 
ConnnectionExpirerThread interrupted
[junit] 2016-04-03 11:56:08,452 [myid:] - INFO  
[NIOServerCxnFactory.AcceptThread:0.0.0.0/0.0.0.0:16611:NIOServerCnxnFactory$AcceptThread@219]
 - accept thread exitted run method
[junit] 2016-04-03 11:56:08,452 [myid:] - INFO  
[NIOServerCxnFactory.SelectorThread-0:NIOServerCnxnFactory$SelectorThread@420] 
- selector thread exitted run meth

ZooKeeper_branch35_jdk8 - Build # 37 - Still Failing

2016-04-03 Thread Apache Jenkins Server
See https://builds.apache.org/job/ZooKeeper_branch35_jdk8/37/

###
## LAST 60 LINES OF THE CONSOLE 
###
[...truncated 387087 lines...]
[junit] 2016-04-03 12:05:35,061 [myid:] - INFO  
[QuorumPeer[myid=5](plain=/127.0.0.1:14056)(secure=disabled):MBeanRegistry@128] 
- Unregister MBean 
[org.apache.ZooKeeperService:name0=ReplicatedServer_id5,name1=replica.3]
[junit] 2016-04-03 12:05:35,061 [myid:] - INFO  
[main:FourLetterWordMain@85] - connecting to 127.0.0.1 14044
[junit] 2016-04-03 12:05:35,061 [myid:] - INFO  [main:QuorumUtil@243] - 
127.0.0.1:14044 is no longer accepting client connections
[junit] 2016-04-03 12:05:35,061 [myid:] - INFO  
[main:FourLetterWordMain@85] - connecting to 127.0.0.1 14047
[junit] 2016-04-03 12:05:35,061 [myid:] - INFO  [main:QuorumUtil@243] - 
127.0.0.1:14047 is no longer accepting client connections
[junit] 2016-04-03 12:05:35,062 [myid:] - INFO  
[main:FourLetterWordMain@85] - connecting to 127.0.0.1 14050
[junit] 2016-04-03 12:05:35,062 [myid:] - INFO  [main:QuorumUtil@243] - 
127.0.0.1:14050 is no longer accepting client connections
[junit] 2016-04-03 12:05:35,062 [myid:] - INFO  
[main:FourLetterWordMain@85] - connecting to 127.0.0.1 14053
[junit] 2016-04-03 12:05:35,062 [myid:] - INFO  [main:QuorumUtil@243] - 
127.0.0.1:14053 is no longer accepting client connections
[junit] 2016-04-03 12:05:35,062 [myid:] - INFO  
[main:FourLetterWordMain@85] - connecting to 127.0.0.1 14056
[junit] 2016-04-03 12:05:35,062 [myid:] - INFO  [main:QuorumUtil@243] - 
127.0.0.1:14056 is no longer accepting client connections
[junit] 2016-04-03 12:05:35,064 [myid:] - INFO  [main:ZKTestCase$1@65] - 
SUCCEEDED testRemoveOneAsynchronous
[junit] 2016-04-03 12:05:35,064 [myid:] - INFO  [main:ZKTestCase$1@60] - 
FINISHED testRemoveOneAsynchronous
[junit] Tests run: 11, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 
143.436 sec, Thread: 2, Class: org.apache.zookeeper.test.ReconfigTest
[junit] 2016-04-03 12:07:46,477 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@82] - Memory used 137601
[junit] 2016-04-03 12:07:46,478 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@87] - Number of threads 55
[junit] 2016-04-03 12:07:46,478 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@102] - FINISHED TEST METHOD 
testManyChildWatchersAutoReset
[junit] 2016-04-03 12:07:46,479 [myid:] - INFO  [main:ClientBase@537] - 
tearDown starting
[junit] 2016-04-03 12:07:46,479 [myid:] - INFO  [ProcessThread(sid:0 
cport:24690)::PrepRequestProcessor@647] - Processed session termination for 
sessionid: 0x101eb5a4fba
[junit] 2016-04-03 12:07:46,486 [myid:] - INFO  [main:ZooKeeper@1110] - 
Session: 0x101eb5a4fba closed
[junit] 2016-04-03 12:07:46,486 [myid:] - INFO  
[NIOWorkerThread-17:MBeanRegistry@128] - Unregister MBean 
[org.apache.ZooKeeperService:name0=StandaloneServer_port24690,name1=Connections,name2=127.0.0.1,name3=0x101eb5a4fba]
[junit] 2016-04-03 12:07:46,486 [myid:] - INFO  
[main-EventThread:ClientCnxn$EventThread@543] - EventThread shut down for 
session: 0x101eb5a4fba
[junit] 2016-04-03 12:07:46,488 [myid:] - INFO  [ProcessThread(sid:0 
cport:24690)::PrepRequestProcessor@647] - Processed session termination for 
sessionid: 0x101eb5a4fba0001
[junit] 2016-04-03 12:07:46,488 [myid:] - INFO  
[NIOWorkerThread-17:NIOServerCnxn@607] - Closed socket connection for client 
/127.0.0.1:49582 which had sessionid 0x101eb5a4fba
[junit] 2016-04-03 12:07:46,494 [myid:] - INFO  [main:ZooKeeper@1110] - 
Session: 0x101eb5a4fba0001 closed
[junit] 2016-04-03 12:07:46,494 [myid:] - INFO  [main:ClientBase@507] - 
STOPPING server
[junit] 2016-04-03 12:07:46,494 [myid:] - INFO  
[NIOWorkerThread-1:MBeanRegistry@128] - Unregister MBean 
[org.apache.ZooKeeperService:name0=StandaloneServer_port24690,name1=Connections,name2=127.0.0.1,name3=0x101eb5a4fba0001]
[junit] 2016-04-03 12:07:46,495 [myid:] - INFO  
[main-EventThread:ClientCnxn$EventThread@543] - EventThread shut down for 
session: 0x101eb5a4fba0001
[junit] 2016-04-03 12:07:46,495 [myid:] - INFO  
[NIOServerCxnFactory.AcceptThread:0.0.0.0/0.0.0.0:24690:NIOServerCnxnFactory$AcceptThread@219]
 - accept thread exitted run method
[junit] 2016-04-03 12:07:46,496 [myid:] - INFO  
[NIOServerCxnFactory.SelectorThread-0:NIOServerCnxnFactory$SelectorThread@420] 
- selector thread exitted run method
[junit] 2016-04-03 12:07:46,496 [myid:] - INFO  
[NIOServerCxnFactory.SelectorThread-1:NIOServerCnxnFactory$SelectorThread@420] 
- selector thread exitted run method
[junit] 2016-04-03 12:07:46,496 [myid:] - INFO  
[NIOWorkerThread-1:NIOServerCnxn@607] - Closed socket connection for client 
/127.0.0.1:49581 which had sessionid 0x101eb5a4fba0001
[junit] 2016-04-03 12:07:46,497 [myid:] - 

[jira] [Commented] (ZOOKEEPER-1634) A new feature proposal to ZooKeeper: authentication enforcement

2016-04-03 Thread Flavio Junqueira (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-1634?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15223310#comment-15223310
 ] 

Flavio Junqueira commented on ZOOKEEPER-1634:
-

[~apurtell] Kafka allows authentication via SSL:

http://kafka.apache.org/documentation.html#security_ssl

Although it does support authentication with SASL+Kerberos. I think that also 
supporting SSL auth like in Kafka would be a nice addition, do you agree?

> A new feature proposal to ZooKeeper: authentication enforcement
> ---
>
> Key: ZOOKEEPER-1634
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1634
> Project: ZooKeeper
>  Issue Type: New Feature
>  Components: security, server
>Affects Versions: 3.4.5
>Reporter: Jaewoong Choi
> Fix For: 3.5.2, 3.6.0
>
> Attachments: 
> zookeeper_3.4.5_patch_for_authentication_enforcement.patch
>
>   Original Estimate: 72h
>  Remaining Estimate: 72h
>
> Up to the version of 3.4.5, ZooKeeperServer doesn't force the authentication 
> if the client doesn't give any auth-info through ZooKeeper#addAuthInfo method 
> invocation.  Hence, every znode should have at least one ACL assigned 
> otherwise any unauthenticated client can do anything on it.
> The current authentication/authorization mechanism of ZooKeeper described 
> above has several points at issue:
> 1. At security standpoint, a maleficent client can access a znode which 
> doesn't have any proper authorization access control set.
> 2. At runtime performance standpoint, authorization for every znode to every 
> operation is unnecessarily but always evaluated against the client who 
> bypassed the authentication phase.
> In other words, the current mechanism doesn't address a certain requirement 
> at below:
> "We want to protect a ZK server by enforcing a simple authentication to every 
> client no matter which znode it is trying to access.  Every connection (or 
> operation) from the client won't be established but rejected if it doesn't 
> come with a valid authentication information.  As we don't have any other 
> distinction between znodes in term of authorization, we don't want any ACLs 
> on any znode."
> To address the issues mentioned above, we propose a feature called 
> "authentication enforcement" to the ZK source.  The idea is roughly but 
> clearly described in a form of patch in the attached file 
> (zookeeper_3.4.5_patch_for_authentication_enforcement.patch): which makes 
> ZooKeeperServer enforce the authentication with the given 2 configurations: 
> authenticationEnforced (boolean) and enforcedAuthenticationScheme (string) 
> against every operation coming through ZooKeeperServer#processPacket method 
> except for OpCode.auth operation.  The repository base of the patch is 
> "http://svn.apache.org/repos/asf/zookeeper/tags/release-3.4.5/";



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-2139) Support multiple ZooKeeper client, with different configurations, in a single JVM

2016-04-03 Thread Flavio Junqueira (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-2139?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15223336#comment-15223336
 ] 

Flavio Junqueira commented on ZOOKEEPER-2139:
-

The one test failure in the last QA build seems to be unrelated: 
{{org.apache.zookeeper.test.ReconfigTest.testPortChange}}

Based on the discussion on github, I think this is good to go. 
[~arshad.mohammad] are there any pending changes or the latest patch here 
reflects all changes discussed on github?



> Support multiple ZooKeeper client, with different configurations, in a single 
> JVM
> -
>
> Key: ZOOKEEPER-2139
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2139
> Project: ZooKeeper
>  Issue Type: Improvement
>  Components: java client
>Affects Versions: 3.5.0
>Reporter: Surendra Singh Lilhore
>Assignee: Arshad Mohammad
>Priority: Blocker
> Fix For: 3.5.2, 3.6.0
>
> Attachments: ZOOKEEPER-2139-05.patch, ZOOKEEPER-2139-06.patch, 
> ZOOKEEPER-2139-07.patch, ZOOKEEPER-2139-08.patch, ZOOKEEPER-2139-09.patch, 
> ZOOKEEPER-2139-10.patch, ZOOKEEPER-2139-11.patch, ZOOKEEPER-2139.patch, 
> ZOOKEEPER-2139.patch, ZOOKEEPER-2139_1.patch, ZOOKEEPER-2139_2.patch
>
>
> I have two ZK client in one JVM, one is secure client and second is normal 
> client (For non secure cluster).
> "zookeeper.sasl.client" system property is "true" by default, because of this 
> my second client connection is failing.
> We should pass all client configurations in client constructor like HDFS 
> client.
> For example :
> {code}
> public ZooKeeper(String connectString, int sessionTimeout, Watcher watcher, 
> Configuration conf) throws IOException
>   {
>   ..
>   ..
>   }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-1634) A new feature proposal to ZooKeeper: authentication enforcement

2016-04-03 Thread Flavio Junqueira (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-1634?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15223356#comment-15223356
 ] 

Flavio Junqueira commented on ZOOKEEPER-1634:
-

Actually, we already support it:

https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide



> A new feature proposal to ZooKeeper: authentication enforcement
> ---
>
> Key: ZOOKEEPER-1634
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1634
> Project: ZooKeeper
>  Issue Type: New Feature
>  Components: security, server
>Affects Versions: 3.4.5
>Reporter: Jaewoong Choi
> Fix For: 3.5.2, 3.6.0
>
> Attachments: 
> zookeeper_3.4.5_patch_for_authentication_enforcement.patch
>
>   Original Estimate: 72h
>  Remaining Estimate: 72h
>
> Up to the version of 3.4.5, ZooKeeperServer doesn't force the authentication 
> if the client doesn't give any auth-info through ZooKeeper#addAuthInfo method 
> invocation.  Hence, every znode should have at least one ACL assigned 
> otherwise any unauthenticated client can do anything on it.
> The current authentication/authorization mechanism of ZooKeeper described 
> above has several points at issue:
> 1. At security standpoint, a maleficent client can access a znode which 
> doesn't have any proper authorization access control set.
> 2. At runtime performance standpoint, authorization for every znode to every 
> operation is unnecessarily but always evaluated against the client who 
> bypassed the authentication phase.
> In other words, the current mechanism doesn't address a certain requirement 
> at below:
> "We want to protect a ZK server by enforcing a simple authentication to every 
> client no matter which znode it is trying to access.  Every connection (or 
> operation) from the client won't be established but rejected if it doesn't 
> come with a valid authentication information.  As we don't have any other 
> distinction between znodes in term of authorization, we don't want any ACLs 
> on any znode."
> To address the issues mentioned above, we propose a feature called 
> "authentication enforcement" to the ZK source.  The idea is roughly but 
> clearly described in a form of patch in the attached file 
> (zookeeper_3.4.5_patch_for_authentication_enforcement.patch): which makes 
> ZooKeeperServer enforce the authentication with the given 2 configurations: 
> authenticationEnforced (boolean) and enforcedAuthenticationScheme (string) 
> against every operation coming through ZooKeeperServer#processPacket method 
> except for OpCode.auth operation.  The repository base of the patch is 
> "http://svn.apache.org/repos/asf/zookeeper/tags/release-3.4.5/";



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-1634) A new feature proposal to ZooKeeper: authentication enforcement

2016-04-03 Thread Andrew Purtell (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-1634?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15223418#comment-15223418
 ] 

Andrew Purtell commented on ZOOKEEPER-1634:
---

You should read my comment as agreeing with other comments here that if 
"authorization enforcement" didn't work with the current framework, but somehow 
required TLS, then this would be unsatisfactory for all those environments 
based on Kerberos  

> A new feature proposal to ZooKeeper: authentication enforcement
> ---
>
> Key: ZOOKEEPER-1634
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1634
> Project: ZooKeeper
>  Issue Type: New Feature
>  Components: security, server
>Affects Versions: 3.4.5
>Reporter: Jaewoong Choi
> Fix For: 3.5.2, 3.6.0
>
> Attachments: 
> zookeeper_3.4.5_patch_for_authentication_enforcement.patch
>
>   Original Estimate: 72h
>  Remaining Estimate: 72h
>
> Up to the version of 3.4.5, ZooKeeperServer doesn't force the authentication 
> if the client doesn't give any auth-info through ZooKeeper#addAuthInfo method 
> invocation.  Hence, every znode should have at least one ACL assigned 
> otherwise any unauthenticated client can do anything on it.
> The current authentication/authorization mechanism of ZooKeeper described 
> above has several points at issue:
> 1. At security standpoint, a maleficent client can access a znode which 
> doesn't have any proper authorization access control set.
> 2. At runtime performance standpoint, authorization for every znode to every 
> operation is unnecessarily but always evaluated against the client who 
> bypassed the authentication phase.
> In other words, the current mechanism doesn't address a certain requirement 
> at below:
> "We want to protect a ZK server by enforcing a simple authentication to every 
> client no matter which znode it is trying to access.  Every connection (or 
> operation) from the client won't be established but rejected if it doesn't 
> come with a valid authentication information.  As we don't have any other 
> distinction between znodes in term of authorization, we don't want any ACLs 
> on any znode."
> To address the issues mentioned above, we propose a feature called 
> "authentication enforcement" to the ZK source.  The idea is roughly but 
> clearly described in a form of patch in the attached file 
> (zookeeper_3.4.5_patch_for_authentication_enforcement.patch): which makes 
> ZooKeeperServer enforce the authentication with the given 2 configurations: 
> authenticationEnforced (boolean) and enforcedAuthenticationScheme (string) 
> against every operation coming through ZooKeeperServer#processPacket method 
> except for OpCode.auth operation.  The repository base of the patch is 
> "http://svn.apache.org/repos/asf/zookeeper/tags/release-3.4.5/";



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (ZOOKEEPER-1634) A new feature proposal to ZooKeeper: authentication enforcement

2016-04-03 Thread Andrew Purtell (JIRA)

[ 
https://issues.apache.org/jira/browse/ZOOKEEPER-1634?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15223419#comment-15223419
 ] 

Andrew Purtell commented on ZOOKEEPER-1634:
---

*authenticaion enforcement 

> A new feature proposal to ZooKeeper: authentication enforcement
> ---
>
> Key: ZOOKEEPER-1634
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1634
> Project: ZooKeeper
>  Issue Type: New Feature
>  Components: security, server
>Affects Versions: 3.4.5
>Reporter: Jaewoong Choi
> Fix For: 3.5.2, 3.6.0
>
> Attachments: 
> zookeeper_3.4.5_patch_for_authentication_enforcement.patch
>
>   Original Estimate: 72h
>  Remaining Estimate: 72h
>
> Up to the version of 3.4.5, ZooKeeperServer doesn't force the authentication 
> if the client doesn't give any auth-info through ZooKeeper#addAuthInfo method 
> invocation.  Hence, every znode should have at least one ACL assigned 
> otherwise any unauthenticated client can do anything on it.
> The current authentication/authorization mechanism of ZooKeeper described 
> above has several points at issue:
> 1. At security standpoint, a maleficent client can access a znode which 
> doesn't have any proper authorization access control set.
> 2. At runtime performance standpoint, authorization for every znode to every 
> operation is unnecessarily but always evaluated against the client who 
> bypassed the authentication phase.
> In other words, the current mechanism doesn't address a certain requirement 
> at below:
> "We want to protect a ZK server by enforcing a simple authentication to every 
> client no matter which znode it is trying to access.  Every connection (or 
> operation) from the client won't be established but rejected if it doesn't 
> come with a valid authentication information.  As we don't have any other 
> distinction between znodes in term of authorization, we don't want any ACLs 
> on any znode."
> To address the issues mentioned above, we propose a feature called 
> "authentication enforcement" to the ZK source.  The idea is roughly but 
> clearly described in a form of patch in the attached file 
> (zookeeper_3.4.5_patch_for_authentication_enforcement.patch): which makes 
> ZooKeeperServer enforce the authentication with the given 2 configurations: 
> authenticationEnforced (boolean) and enforcedAuthenticationScheme (string) 
> against every operation coming through ZooKeeperServer#processPacket method 
> except for OpCode.auth operation.  The repository base of the patch is 
> "http://svn.apache.org/repos/asf/zookeeper/tags/release-3.4.5/";



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


can I join zookeeper dev mailing list

2016-04-03 Thread Mobai ZHANG
Hi,

Can I subscribe this dev mailing list?

My email: zhangmo...@gmail.com

Mobai


ZooKeeper-trunk - Build # 2877 - Failure

2016-04-03 Thread Apache Jenkins Server
See https://builds.apache.org/job/ZooKeeper-trunk/2877/

###
## LAST 60 LINES OF THE CONSOLE 
###
[...truncated 381589 lines...]
[junit] 2016-04-03 23:27:06,402 [myid:] - INFO  [main:ZKTestCase$1@65] - 
SUCCEEDED testWatcherAutoResetWithLocal
[junit] 2016-04-03 23:27:06,402 [myid:] - INFO  [main:ZKTestCase$1@60] - 
FINISHED testWatcherAutoResetWithLocal
[junit] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 
32.883 sec, Thread: 1, Class: org.apache.zookeeper.test.WatcherTest
[junit] 2016-04-03 23:27:56,096 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@82] - Memory used 32575
[junit] 2016-04-03 23:27:56,098 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@87] - Number of threads 55
[junit] 2016-04-03 23:27:56,098 [myid:] - INFO  
[main:JUnit4ZKTestRunner$LoggedInvokeMethod@102] - FINISHED TEST METHOD 
testManyChildWatchersAutoReset
[junit] 2016-04-03 23:27:56,098 [myid:] - INFO  [main:ClientBase@537] - 
tearDown starting
[junit] 2016-04-03 23:27:56,099 [myid:] - INFO  [ProcessThread(sid:0 
cport:24690)::PrepRequestProcessor@647] - Processed session termination for 
sessionid: 0x101e7dce2e0
[junit] 2016-04-03 23:27:56,122 [myid:] - INFO  [main:ZooKeeper@1110] - 
Session: 0x101e7dce2e0 closed
[junit] 2016-04-03 23:27:56,122 [myid:] - INFO  [ProcessThread(sid:0 
cport:24690)::PrepRequestProcessor@647] - Processed session termination for 
sessionid: 0x101e7dce2e1
[junit] 2016-04-03 23:27:56,122 [myid:] - INFO  
[NIOWorkerThread-32:MBeanRegistry@128] - Unregister MBean 
[org.apache.ZooKeeperService:name0=StandaloneServer_port24690,name1=Connections,name2=127.0.0.1,name3=0x101e7dce2e0]
[junit] 2016-04-03 23:27:56,123 [myid:] - INFO  
[NIOWorkerThread-32:NIOServerCnxn@607] - Closed socket connection for client 
/127.0.0.1:43259 which had sessionid 0x101e7dce2e0
[junit] 2016-04-03 23:27:56,123 [myid:] - INFO  
[main-EventThread:ClientCnxn$EventThread@543] - EventThread shut down for 
session: 0x101e7dce2e0
[junit] 2016-04-03 23:27:56,130 [myid:] - INFO  
[NIOWorkerThread-28:MBeanRegistry@128] - Unregister MBean 
[org.apache.ZooKeeperService:name0=StandaloneServer_port24690,name1=Connections,name2=127.0.0.1,name3=0x101e7dce2e1]
[junit] 2016-04-03 23:27:56,130 [myid:] - INFO  
[NIOWorkerThread-28:NIOServerCnxn@607] - Closed socket connection for client 
/127.0.0.1:43262 which had sessionid 0x101e7dce2e1
[junit] 2016-04-03 23:27:56,131 [myid:] - INFO  [main:ZooKeeper@1110] - 
Session: 0x101e7dce2e1 closed
[junit] 2016-04-03 23:27:56,131 [myid:] - INFO  [main:ClientBase@507] - 
STOPPING server
[junit] 2016-04-03 23:27:56,132 [myid:] - INFO  
[main-EventThread:ClientCnxn$EventThread@543] - EventThread shut down for 
session: 0x101e7dce2e1
[junit] 2016-04-03 23:27:56,140 [myid:] - INFO  
[NIOServerCxnFactory.SelectorThread-1:NIOServerCnxnFactory$SelectorThread@420] 
- selector thread exitted run method
[junit] 2016-04-03 23:27:56,141 [myid:] - INFO  
[NIOServerCxnFactory.AcceptThread:0.0.0.0/0.0.0.0:24690:NIOServerCnxnFactory$AcceptThread@219]
 - accept thread exitted run method
[junit] 2016-04-03 23:27:56,141 [myid:] - INFO  
[ConnnectionExpirer:NIOServerCnxnFactory$ConnectionExpirerThread@583] - 
ConnnectionExpirerThread interrupted
[junit] 2016-04-03 23:27:56,143 [myid:] - INFO  
[NIOServerCxnFactory.SelectorThread-0:NIOServerCnxnFactory$SelectorThread@420] 
- selector thread exitted run method
[junit] 2016-04-03 23:27:56,144 [myid:] - INFO  [main:ZooKeeperServer@498] 
- shutting down
[junit] 2016-04-03 23:27:56,144 [myid:] - INFO  
[main:SessionTrackerImpl@232] - Shutting down
[junit] 2016-04-03 23:27:56,144 [myid:] - INFO  
[main:PrepRequestProcessor@965] - Shutting down
[junit] 2016-04-03 23:27:56,144 [myid:] - INFO  
[main:SyncRequestProcessor@191] - Shutting down
[junit] 2016-04-03 23:27:56,144 [myid:] - INFO  [ProcessThread(sid:0 
cport:24690)::PrepRequestProcessor@154] - PrepRequestProcessor exited loop!
[junit] 2016-04-03 23:27:56,146 [myid:] - INFO  
[SyncThread:0:SyncRequestProcessor@169] - SyncRequestProcessor exited!
[junit] 2016-04-03 23:27:56,147 [myid:] - INFO  
[main:FinalRequestProcessor@479] - shutdown of request processor complete
[junit] 2016-04-03 23:27:56,147 [myid:] - INFO  [main:MBeanRegistry@128] - 
Unregister MBean 
[org.apache.ZooKeeperService:name0=StandaloneServer_port24690,name1=InMemoryDataTree]
[junit] 2016-04-03 23:27:56,148 [myid:] - INFO  [main:MBeanRegistry@128] - 
Unregister MBean [org.apache.ZooKeeperService:name0=StandaloneServer_port24690]
[junit] 2016-04-03 23:27:56,148 [myid:] - INFO  
[main:FourLetterWordMain@85] - connecting to 127.0.0.1 24690
[junit] 2016-04-03 23:27:56,149 [myid:] - INFO  [main:JMXEnv@146] - 
ensureOnly:[]
[junit] 

Re: can I join zookeeper dev mailing list

2016-04-03 Thread Chris Nauroth
Hello Mobai,

Yes, anyone may subscribe to the ZooKeeper dev mailing lists.  See here
for more instructions on how the mailing lists work:

https://zookeeper.apache.org/lists.html


Send an email to dev-subscr...@zookeeper.apache.org, and then you'll get
an automated confirmation email.

--Chris Nauroth




On 4/3/16, 11:53 AM, "Mobai ZHANG"  wrote:

>Hi,
>
>Can I subscribe this dev mailing list?
>
>My email: zhangmo...@gmail.com
>
>Mobai