Repository navigation
ZOOKEEPER-5123: (C client) Broadcast completion of auth can return ZOK for rejected credentials - #2498
Open
apurtell wants to merge 1 commit into
Open
ZOOKEEPER-5123: (C client) Broadcast completion of auth can return ZOK for rejected credentials#2498apurtell wants to merge 1 commit into
apurtell wants to merge 1 commit into
Conversation
…K for rejected credentials When the C client received a reply to a SetAuth request, auth_completion_func ran every pending callback with the status of that one reply without checking which credential the reply belongs to. The client also put SetAuth frames at the front of the send queue, so frames from back-to-back calls went out in reverse order. There were additional related problems on the same path: - Credentials that the client sends again during a reconnect could complete newly issued zoo_add_auth calls before the server checked them. - An auth reply on a handle with no credentials dereferenced a NULL list and crashed the I/O thread. - Concurrent zoo_add_auth calls could both send the last credential in the list. - If a frame could not be queued zoo_add_auth would return an error but leave the callback registered. Each handle now keeps a FIFO of pending SetAuth frames in the order of frames on the wire. Each reply completes only the entry at the head. Related fixes: - An auth reply with no pending frame is logged and ignored. Before, it dereferenced a NULL credential list. - zoo_add_auth holds the auth lock while it queues the frame of its own credential. Concurrent calls no longer send the tail credential twice. The frame goes to the end of the send queue. - zoo_add_auth checks its allocations. If the frame cannot be queued, the credential is not added and its completion never runs. - zoo_add_auth no longer sends a frame in ZOO_ASSOCIATING_STATE. Session establishment sends the credential with its completion. Adds the Zookeeper_authCompletion suite in tests/TestAuthCompletion.cc. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When the C client received a reply to a SetAuth request, auth_completion_func ran every pending callback with the status of that one reply without checking which credential the reply belongs to. The client also put SetAuth frames at the front of the send queue, so frames from back-to-back calls went out in reverse order.
There were additional related problems on the same path:
Each handle now keeps a FIFO of pending SetAuth frames in the order of frames on the wire. Each reply completes only the entry at the head.
Related fixes:
Adds the Zookeeper_authCompletion suite in tests/TestAuthCompletion.cc.